ML19150A444

Revision 28 to Updated Final Safety Analysis Report, Chapter 3, Design of Structures, Components, Equipment, and Systems

ML19150A444
Person / Time
Site:	Ginna
Issue date:	05/10/2019
From:	Exelon Generation Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML19150A453	List: ML19150A431 ML19150A432 ML19150A434 ML19150A435 ML19150A436 ML19150A437 ML19150A439 ML19150A441 ML19150A442 ML19150A443 ML19150A444 ML19150A445 ML19150A446 ML19150A448 ML19150A449 ML19150A450 ML19150A451 ML19150A454 ML19150A456 ML19150A457 ML19150A464 ML19150A465 ML19150A466 ML19150A467 ML19150A468 ML19150A470 ML19150A471 ML19150A473 ML19150A474 ML19150A476 ML19150A477 ML19150A478 ML19150A479 ML19150A480 ML19150A481 ML19150A482 ML19150A483 ML19150A484 ML19150A485 ML19150A486 ML19150A488 ML19150A489 ML19150A491 ML19150A492 ML19150A493 ML19150A494 ML19150A495 ML19150A497 ML19150A498 ML19150A499 ... further results
References
Download: ML19150A444 (222)

Text

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Page 1 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1 CONFORMANCE WITH NRC GENERAL DESIGN CRITERIA The discussion of general design criteria is divided into two parts. Section 3.1.1 discusses the general design criteria used during the licensing of Ginna Station. Section 3.1.2 discusses the adequacy of the Ginna design relative to the 1972 version of the General Design Criteria in 10 CFR 50, Appendix A.

3.1.1 ATOMIC INDUSTRIAL FORUM DESIGN CRITERIA The following general design criteria comprise the proposed Atomic Industrial Forum (AIF) versions of the criteria issued for comment by the AEC on July 10, 1967. These criteria define or describe safety objectives and approaches incorporated in the design of this plant.

Each criterion is followed by a brief description of related plant features which are provided to meet the design objectives reflected in the criterion. The description is developed more fully in succeeding sections of the updated FSAR. The criteria are identified as AIF-GDC plus their identification numbers to distinguish them from the later 10 CFR 50, Appendix A, criteria which are identified as GDC plus their identification numbers.

3.1.1.1 Overall Plant Requirements 3.1.1.1.1 Quality Standards CRITERION: Those systems and components of reactor facilities which are essential to the prevention, or the mitigation of the consequences, of nuclear accidents which could cause undue risk to the health and safety of the public shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed. Where generally recognized codes and standards pertaining to design, materials, fabrication, and inspection are used, they shall be identified. Where adherence to such codes or standards does not suffice to assure a quality product in keeping with the safety function, they shall be supplemented or modified as necessary. Quality assurance programs, test procedures, and inspection acceptance criteria to be used shall be identified. An indication of the applicability of codes, standards, quality assurance programs, test procedures, and inspection acceptance criteria used is required. Where such items are not covered by applicable codes and standards, a showing of adequacy is required (AIF-GDC 1).

All structures, systems, and components of the facility were classified according to their safety importance. Those items vital to safe shutdown and isolation of the reactor or whose failure might cause or increase the severity of a loss-of-coolant accident or result in an uncontrolled release of excessive amounts of radioactivity were designated Class I. Those items important to reactor operation but not essential to safe shutdown and isolation of the reactor or control of the release of substantial amounts of radioactivity were designated Class II. Those items not related to reactor operation or safety were designated Class III.

Class I systems and components were designated as essential to the protection of the health and safety of the public. Consequently, they were designed, fabricated, inspected, and erected and the materials selected to the applicable provisions of recognized codes, good nuclear Page 2 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS practice and to quality standards that reflect their importance. Discussions of applicable codes and standards, quality assurance programs, test provisions, etc., are given in the sections of the UFSAR describing each system. It should be noted that Ginna Station no longer uses the Class I, II, and III classification scheme. The classification and codes applicable to Ginna Station structures, systems, and components are discussed in Section 3.2 and in the applicable UFSAR sections.

Reference chapters are as follows:

Chapter Title Chapter Chapter 4 Reactor Coolant System and Connected Systems Chapter 5 Engineered Safety Features Chapter 6 Instrumentation and Controls Chapter 7 Electric Power Chapter 8 Auxiliary Systems Chapter 9 Steam and Power Conversion System Chapter 10 Radioactive Waste Management Chapter 11 Page 3 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.1.2 Performance Standards CRITERION: Those systems and components of reactor facilities which are essential to the prevention or to the mitigation of the consequences of nuclear accidents which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that enable such systems and components to withstand, without undue risk to the health and safety of the public the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomenon such as earthquake, tornado, flooding condition, high wind or heavy ice. The design bases so established shall reflect:

(a) appropriate consideration of the most severe of these natural phenomena that have been officially recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design (AIF-GDC 2).

All systems and components designated Class I were designed so that no loss of function in the event of the maximum potential ground acceleration acting in the horizontal and vertical directions simultaneously would occur. Similarly, measures were taken in the plant design to protect against high winds, sudden barometric pressure changes, seiches, and other natural phenomena.

Reference chapters are as follows:

Chapter Title Chapter Site Characteristics Chapter 2 Design of Structures, Components, and Systems Chapter 3 Chapter 4 Reactor Coolant System and Connected Systems Chapter 5 Engineered Safety Features Chapter 6 Instrumentation and Controls Chapter 7 Electrical Power Chapter 8 Auxiliary Systems Chapter 9 Steam and Power Conversion System Chapter 10 Page 4 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.1.3 Fire Protection CRITERION: A reactor facility shall be designed such that the probability of events such as fires and explosions and the potential consequences of such events does not result in undue risk to the health and safety of the public. Noncombustible and fire resistant materials shall be used throughout the facility wherever necessary to preclude such risk, particularly in areas containing critical portions of the facility such as containment, control room, and components of engineered safety features (AIF-GDC 3).

Fire prevention in all areas of the nuclear-electric plant is provided by structure and component design which optimizes the containment of combustible materials and maintains exposed combustible materials below their ignition temperature in the design atmosphere.

Fire control requires the capability to isolate or remove fuel from an igniting source, or to reduce the combustibles temperature below the ignition point, or to exclude the oxidant, and preferably, to provide a combination of the three basic control means. The latter two means are fulfilled by providing fixed or portable fire fighting equipment of capacities proportional to the energy that might credibly be released by fire.

This station is designed on the basis of limiting the use of combustible materials in construction by using fire-resistant materials to the greatest extent possible.

The fire protection system has the design capability to extinguish any probable combination of simultaneous fires which might occur at the station. The system is designed in accordance with the standards of the National Fire Protection Association and is based generally on the recommendations of the Nuclear Energy Property Insurance Association.

Fire protection systems for Ginna Station are discussed in Section 9.5.1.

Refer to Section 9.5.1.1.2 and Section 9.5.1.1.3 for updated design information.

3.1.1.1.4 Sharing of Systems CRITERION: Reactor facilities may share systems or components if it can be shown that such sharing will not result in undue risk to the health and safety of the public (AIF-GDC 4).

Analyses confirm that the sharing of components among systems does not result in interference with the basic function and operability of these systems and hence there is no undue risk to the health and safety of the public.

3.1.1.1.5 Records Requirements CRITERION: The reactor licensee shall be responsible for assuring the maintenance throughout the life of the reactor of records of the design, fabrication, and construction of major components of the plant essential to avoid undue risk to the health and safety of the public (AIF-GDC 5).

Page 5 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS A complete set of as-built facility plant and system diagrams including arrangement plans and structural plans are maintained throughout the life of the reactor.

A set of completed test procedures for all plant testing is maintained as outlined in Chapter 14.

A set of all the quality assurance data generated during fabrication and erection of the essential components of the plant, as defined by the quality assurance program, is retained.

3.1.1.2 Protection by Multiple Fission Product Barriers 3.1.1.2.1 Reactor Core Design CRITERION: The reactor core with its related controls and protection systems, shall be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits which have been stipulated and justified. The core and related auxiliary system design shall provide this integrity under all expected conditions of MODES 1 and 2 with appropriate margins for uncertainties and for specified transient situations which can be anticipated (AIF-GDC 6).

The reactor core, with its related control and protection system, is designed to function throughout its design lifetime without exceeding acceptable fuel damage limits. The core design, together with reliable process and decay heat removal systems, provides for this capability under all expected conditions of MODES 1 and 2 with appropriate margins for uncertainties and anticipated transient situations, including the effects of the loss of reactor coolant flow (Section 15.3), loss of electrical load (Section 15.2.2), loss of normal feedwater (Section 15.2.6), and loss of all offsite power (Section 15.2.5).

The reactor control and protection instrumentation is designed to actuate a reactor trip for any anticipated combination of plant conditions, when necessary to ensure a minimum departure from nucleate boiling ratio (DNBR) equal to or greater than the safety limit and fuel center temperature below the melting point of uranium dioxide.

Referenced chapters are:

Chapter Title Chapter Chapter 4 Instrumentation and Controls Chapter 7 Accident Analyses Chapter 15 Page 6 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.2.2 Suppression of Power Oscillations CRITERION: The design of the reactor core with its related controls and protection systems shall ensure that power oscillations, the magnitude of which could cause damage in excess of acceptable fuel damage limits, are not possible or can be readily suppressed (AIF-GDC 7).

The design of the reactor core and related protection systems ensures that power oscillations which could cause fuel damage in excess of acceptable limits are not possible or can be readily suppressed.

The potential for possible spatial oscillations of power distribution for this core has been reviewed. In summary it is concluded that the only potential spatial instability of a magnitude which could cause damage in excess of acceptable fuel damage limits is the xenon-induced axial instability which may be a nearly free running oscillation with little or no inherent damping. Part-length control rods were originally provided to suppress these oscillations if they occurred. They have since been removed. Operating control strategies have been devised that do not require insertion of the part-length rods and eliminate the potential for axial xenon instabilities. Out-of-core instrumentation is provided to obtain necessary information concerning axial distributions. This instrumentation is adequate to enable the operator to monitor and control xenon induced oscillations. In-core instrumentation is used to periodically calibrate and verify the information provided by the out-of-core instrumentation.

The temperature coefficient in the power operating range was maintained zero or negative by inclusion of burnable poison shims in the first core loading. The burnable poison shims have since been removed.

3.1.1.2.3 Overall Power Coefficient CRITERION: The reactor shall be designed so that the overall power coefficient in the power operating range shall not be positive (AIF-GDC 8).

The overall power coefficient in the power operating range is maintained nonpositive. The nuclear design of the reactor is discussed in Section 4.2.4.2.7.

3.1.1.2.4 Reactor Coolant Pressure Boundary CRITERION: The reactor coolant pressure boundary shall be designed, fabricated and constructed so as to have an exceedingly low probability of gross rupture or significant uncontrolled leakage throughout its design lifetime (AIF-GDC 9).

The reactor coolant system, in conjunction with its control and protective provisions, is designed to accommodate the system pressures and temperatures attained under all expected modes of plant operation or anticipated system interactions, and maintain the stresses within applicable code stress limits.

Fabrication of the components which constitute the pressure retaining boundary of the reactor coolant system is carried out in strict accordance with the applicable codes. In addition, there Page 7 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS are areas where equipment specifications for reactor coolant system components go beyond the applicable codes. Materials of construction were chosen to lessen the probability of gross leakage or failure. Details are given in Section 5.2.3.

The materials of construction of the pressure retaining boundary of the reactor coolant system are protected by control of coolant chemistry from corrosion phenomena which might otherwise reduce the system structural integrity during its service lifetime.

System conditions resulting from anticipated transients or malfunctions are monitored and appropriate action is automatically initiated to maintain the required cooling capability and to limit system conditions so that continued safe operation is possible.

The system is protected from overpressure by means of pressure relieving devices, as required by Section III of the ASME Code. Low temperature over-pressure protection is also provided, together with operating precautions to minimize operation under undesirable conditions (see Section 5.2.2).

Isolable sections of the system are provided with overpressure relieving devices discharging to closed systems such that the system code allowable relief pressure within the protected section is not exceeded.

3.1.1.2.5 Reactor Containment CRITERION: Reactor containment shall be provided. The containment structure shall be designed (a) to sustain without undue risk to the health and safety of the public the initial effects of gross equipment failures, such as a large reactor coolant pipe break, without loss of required integrity and (b) together with other engineered safety features as may be necessary, to retain for as long as the situation requires the functional capability of the containment to the extent necessary to avoid undue risk to the health and safety of the public (AIF-GDC 10).

The reactor containment structure is a reinforced-concrete vertical cylinder with pre-stressed tendons in the vertical wall, a reinforced-concrete ring anchored to bedrock and a reinforced hemispherical dome. See Section 3.8.1.

The design pressure of the containment exceeds the peak pressure occurring as the result of the complete blowdown of the reactor coolant through any pipe rupture of the reactor coolant system up to and including the hypothetical severance of a reactor coolant pipe, as well as a postulated main steam line break. The containment structure and all penetrations are designed to withstand within design limits the combined loadings of the design-basis accident and design seismic conditions.

All piping systems which penetrate the containment are anchored in the penetration sleeve or the structural concrete of the Containment Building. The penetrations for the main steam, feedwater, blowdown, and sample lines are designed so that the penetration is stronger than the piping system and that the containment will not be breached due to a postulated pipe rupture. The lines connected to the primary coolant system that penetrate the containment and pass through the secondary shield walls (i.e., walls surrounding the steam generators and reactor coolant pumps) are also anchored in the primary shield walls and are each provided Page 8 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS with at least one valve between the anchor and the coolant system. These anchors are designed to withstand the thrust moment and torque resulting from a postulated rupture of the attached pipe.

All isolation valves are supported to withstand, without impairment of valve operability, the combined loadings of the design-basis accident and design seismic conditions.

3.1.1.3 Nuclear and Radiation Controls 3.1.1.3.1 Control Room CRITERION: The facility shall be provided with a control room from which actions to maintain safe operational status of the plant can be controlled. Adequate radiation protection shall be provided to permit continuous occupancy of the control room under any credible postaccident condition or as an alternative access to other areas of the facility as necessary to shut down and maintain safe control of the facility without excessive radiation exposures of personnel (AIF-GDC 11).

The plant is equipped with a control room which contains all controls and instrumentation necessary for operation of the reactor and turbine generator under normal and accident conditions.

The control room is capable of continuous occupancy by the operating personnel under all operating and accident conditions.

Sufficient shielding, ventilation, and habitability provisions exist to ensure that control room personnel can perform all required safety functions from the control room, under all credible postulated accident conditions (see Section 6.4.1).

3.1.1.3.2 Instrumentation and Controls Systems CRITERION: Instrumentation and controls shall be provided as required to monitor and maintain within prescribed operating ranges essential reactor facility operating variables (AIF-GDC 12).

Instrumentation and controls essential to avoid undue risk to the health and safety of the public are provided to monitor and maintain neutron flux, primary coolant pressure, flow rate, temperature, and control rod positions within prescribed operating ranges.

The non-nuclear regulating, process, and containment instrumentation measures temperature, pressure, flow, and levels in the reactor coolant system, steam systems, containment and other auxiliary systems. Process variables required on a continuous basis for the startup, operation, and shutdown of the plant are indicated, recorded, and controlled from the control room into which access is supervised. The quantity and types of process instrumentation provided ensures safe and orderly operation of all systems and processes over the full operating range of the plant.

The instrumentation and controls systems are discussed in Chapter 7.

Page 9 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.3.3 Fission Process Monitors and Controls CRITERION: Means shall be provided for monitoring or otherwise measuring and maintaining control over the fission process throughout core life under all conditions that can reasonably be anticipated to cause variations in reactivity of the core (AIF-GDC 13).

The nuclear instrumentation system is provided to monitor the reactor power from source range through the intermediate range and power range up to 120% of full power. The system provides indication, control, and alarm signals for reactor operation and protection.

The operational status of the reactor is monitored from the control room. When the reactor is sub-critical and during approach to criticality (i.e., during MODE 6, "Refueling" through MODE 3 "Hot Shutdown", and during MODE 2 "Startup"), the relative reactivity status (neutron source multiplication) is continuously monitored by two Source Range proportional counter detectors located in instrument wells within the primary shield and adjacent to the reactor vessel. Two source range detector channels are provided to supply neutron source multiplication information during the above-mentioned plant modes. A reactor trip is actuated from either channel if the neutron flux level becomes excessive.

The source range channels are checked prior to operations in which criticality may be approached. A source of neutrons is necessary to provide at least the minimum count rate (>

5 cps) required for startup operations. The discrete (Sb-Be) secondary sources initially installed were removed from the core during the refueling outage at the end of cycle 20. The neutron emissions which occur naturally in burnt fuel are now utilized as the neutron source.

These neutron emissions are produced primarily by spontaneous fission of Cm-242 and Cm-244.

Any appreciable increase in the neutron source multiplication, including that caused by the maximum physical boron dilution rate, is slow enough to give ample time to start corrective action (boron dilution stop and/or emergency boron injection) to prevent the core from becoming critical.

When the reactor is critical, means for showing the relative reactivity status of the reactor is provided by control bank positions displayed in the control room. The position of the control banks is directly related to the reactivity status of the reactor when at power and any unexpected change in the position of the control banks under automatic control or change in the coolant temperature under manual control provides a direct and immediate indication of a change in the reactivity status of the reactor. Periodic samples of the coolant boron concentration are taken. The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion.

High nuclear flux protection is provided both in the power and intermediate ranges by reactor trips actuated from either range if the neutron flux level exceeds trip setpoints. When the reactor is critical, the best indications of the reactivity status in the core (in relation to the power level and average coolant temperature) is the control room display of the rod control group position.

Page 10 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Reactor Trip System (RTS) instrumentation and controls are discussed in Section 7.2.1.

3.1.1.3.4 Core Protection Systems CRITERION: Core protection systems, together with associated equipment, shall be designed to prevent or to suppress conditions that could result in exceeding acceptable fuel damage limits (AIF-GDC 14).

Instrumentation and controls provided for the protective systems are designed to trip the reactor when necessary to prevent or limit fission product release from the core; to limit energy release; to signal closure of containment isolation valves; and to control the operation of engineered safety features equipment.

During reactor operation in the startup and power modes, redundant safety limit signals will automatically actuate two reactor trip breakers which are in series with the rod drive mechanism coils. This action would interrupt power and initiate reactor trip. This criterion, as applied to the Reactor Trip System (RTS), is discussed more fully in Sections 3.1.1.4.8, 7.2.1, and 7.2.3.

3.1.1.3.5 Engineered Safety Features Protection Systems CRITERION: Protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features (AIF-GDC 15).

The Engineered Safety Features Actuation System (ESFAS) provides actuation of the following functions: safety injection, containment isolation, steam line isolation, containment spray and feedwater isolation, automatic diesel start-up, and preferred auxiliary feedwater pump startup.

The safety injection systems deliver water to the reactor core following a loss-of-coolant accident. The principal components of the safety injection system are two passive accumulators (one for each loop), three high-head safety injection pumps, two low-head safety injection (residual heat removal) pumps, and the essential piping and valves. A safety injection accumulator makeup pump is available to fill the accumulator tanks when there is a need, due to miscellaneous system leakage. The accumulators are passive devices which discharge into the cold leg of each loop.

The safety injection system may be actuated by two-out-of-three low-pressurizer-pressure signals, two-out-of-three low-steam-line-pressure signals, two-out-of-three high-containment-pressure signals; or the system can be actuated manually. Any of the safety injection system signals will open the system isolation valves, start the high-head safety injection pumps and the low-head (residual heat removal) pumps (see Section 6.3).

The steam line isolation valves are closed upon receipt of high steam line flow in conjunction with a safety injection system signal, by containment pressure, or by manual initiation. See Section 6.2.4.3 and Section 3.2.2.1 for a more current and detailed description of steam line isolation.

Page 11 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The containment spray system consists of two pumps, one spray additive tank, valves, piping, and spray nozzles. Containment spray is initiated by coincident signals from two sets of two-out-of-three containment pressure signals monitoring containment high-high pressure. The actuation signal starts the pumps and opens the discharge valves to the spray header. Valves for the spray additive tank open after a very short time delay.

Containment isolation is initiated by an automatic safety injection system signal or manually.

Actuation of containment isolation trips the containment sump pumps, closes containment isolation valves (as discussed in Section 6.2.4 and listed in Tables 6.2-29 and 6.2-32), and trips the purge supply and exhaust fans. Containment ventilation isolation and depressurization valves are also isolated on high containment activity (R-11 and R-12), any safety injection signal, or from a manual containment spray signal. See Section 6.2.4.3 for a more current and detailed description of containment isolation and containment ventilation isolation.

The feedwater isolation system consists of the two main feedwater regulating valves, two main feedwater regulating valve bypass valves, and two main feedwater isolation valves. The main feedwater regulating valves and the main feedwater regulating bypass valves close when they receive a safety injection system signal or an engineered safety feature sequence initiation signal. They fail closed if power or air is lost. The two main feedwater isolation valves close when they receive a safety injection signal. They fail close if power or instrument air is lost. See Section 7.3.2.2.2 for a more detailed description of feedwater isolation.

As part of the plant uprate to 1775 MWt two manual feedwater isolation valves were upgraded to automatic isolation valves by the installation of an air actuator on each valve. The modifications provided an additional automatic feedwater isolation valve for each SG. These new automatic isolation valves provide redundancy to the automatic isolation function provided by the two main feedwater regulating valves and two main feedwater by-pass valves.

Automatic diesel startup will be caused by undervoltage at the engineered safety features buses in addition to being caused by the safety injection signal.

The motor-driven auxiliary feedwater pumps (MDAFW) start upon a safety injection signal, either steam generator low-low level, loss of both main feedwater pumps or ATWS Mitigation System Actuation Circuitry (AMSAC). The turbine-driven auxiliary feedwater pump (TDAFW) will start on low-low level in both steam generators and loss of bus voltage on 11A and 11B. See Section 7.3.2.2.2 and Section 7.2.6 for a more current and detailed description of auxiliary feedwater pump starts.

3.1.1.3.6 Monitoring Reactor Coolant Leakage CRITERION: Means shall be provided to detect significant uncontrolled leakage from the reactor coolant pressure boundary (AIF-GDC 16).

Positive indications in the control room of leakage of coolant from the reactor coolant system to the containment are provided by equipment which permits continuous monitoring of containment air activity (R-11 and R-12) and humidity, containment sump A level (LT-2039 and LT-2044), and of runoff from the condensate collection system under the cooling coils of Page 12 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The containment recirculation fan cooler (CRFC) units. This equipment provides indication of normal background which is indicative of a basic level of leakage from primary systems and components. Any increase in the observed parameters is an indication of change within the containment, and the equipment provided is capable of monitoring this change. The basic design criterion is the detection of deviations from normal containment environmental conditions including air particulate activity, radiogas activity, humidity, condensate runoff, and the liquid inventory in the process systems and containment sump A. Further details are supplied in Section 5.2.5.

3.1.1.3.7 Monitoring Radioactivity Releases CRITERION: Means shall be provided for monitoring the containment atmosphere and the facility effluent discharge paths for radioactivity released from MODES 1 and 2, from anticipated transients, and from accident conditions. An environmental monitoring program shall be maintained to confirm that radioactivity releases to the environs of the plant have not been excessive (AIF-GDC 17).

The containment atmosphere, the containment purge, the plant vent, the containment fan-coolers service water (SW) discharge, the waste disposal system liquid effluent, and the spent fuel pool (SFP) heat exchanger raw water discharge are monitored for radioactivity concentration during MODES 1 and 2, from anticipated transients, and from accident conditions.

All gaseous effluent from possible sources of accidental releases of radioactivity external to the reactor containment (e.g., the spent fuel pool (SFP) and waste handling equipment) will be exhausted from the plant vent which is monitored. All accidental spills of liquids are maintained within the auxiliary building and collected in a drain tank. Any contaminated liquid effluent discharged to the condenser circulating water canal is monitored.

Process radiation monitoring and area radiation monitoring are described in Sections 11.5.2.2 and12.3.4, respectively.

Additional details of offsite radiological monitoring are provided in the Offsite Dose Calculation Manual (ODCM).

3.1.1.3.8 Monitoring Fuel and Waste Storage CRITERION: Monitoring and alarm instrumentation shall be provided for fuel and waste storage and associated handling areas for conditions that might result in loss of capability to remove decay heat and to detect excessive radiation levels (AIF-GDC 18).

Monitoring and alarm instrumentation is provided for fuel and waste storage and handling areas to detect inadequate cooling and to detect excessive radiation levels. Radiation monitors are provided to maintain surveillance over the release operation.

The spent fuel pool (SFP) cooling system flow is monitored to ensure proper operation as described in Section 9.1.3.

Page 13 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS A controlled ventilation system removes gaseous radioactivity from the atmosphere and fuel storage and waste treating areas of the auxiliary building and discharges it to the atmosphere via the plant vent. Radiation monitors are in continuous service in these areas to actuate high activity alarms on the control board annunciator, as described in Sections 11.5 and 12.3.

3.1.1.4 Reliability and Testability of Protection Systems 3.1.1.4.1 Protection Systems Reliability CRITERION: Protection systems shall be designed for high functional reliability and inservice testability necessary to avoid undue risk to the health and safety of the public (AIF-GDC 19).

The reactor uses a higher speed version of the Westinghouse magnetic-type control rod drive mechanisms used in the San Onofre and Connecticut Yankee plants. The original control rod drive mechanisms (CRDM) supplied to Ginna Station were replaced with equivalent model L-106 during the 2003 refueling outage by modification PCR 2001-0042. Upon a loss of power to the coils, the rod cluster control assembly is released and falls by gravity into the core.

The reactor internals, fuel assemblies, control rods, and control rod drive system components (as required for trip) are designed as Seismic Category I equipment. The control rods are fully guided through the fuel assembly and for the maximum travel of the control rod into the guide tube. Furthermore, the control rods are never fully withdrawn from their guide thimbles in the fuel assembly. Due to this and the flexibility designed into the control rods, abnormal loadings and misalignments can be sustained without impairing operation of the control rods.

The control rod guide system throughout its length is locked together with pins, bolts and welds to ensure against misalignments which might impair control rod movement under normal operating conditions and credible accident conditions.

All reactor protection channels are supplied with sufficient redundancy to provide the capability for channel calibration and test at power. Bypass removal of one trip circuit is accomplished by placing that circuit in a half-tripped mode; i.e., a two-out-of-three circuit becomes a one-out-of-two circuit. Testing does not trip the system unless a trip condition exists in a concurrent channel.

Reliability and independence is obtained by redundancy within each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate primary sensors. Each channel is continuously fed from its own independent electrical sources.

Failure to deenergize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event.

Routing and separation standards applicable to existing cables are those that were invoked at the time of cable installation. For more information, see Section 8.3.1.4.

Page 14 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.4.2 Protection Systems Redundancy and Independence CRITERION: Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of such a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served (AIF-GDC 20).

3.1.1.4.2.1 Reactor Trip Circuits Two reactor trip breakers are provided to interrupt power to the rod drive mechanisms. The breaker main contacts are connected in series with the power supply to the mechanism coils.

Opening either breaker interrupts power to the magnetic latch mechanisms on each control rod drive causing them to release the rods to fall by gravity into the core. Each breaker is opened through an undervoltage trip coil. Each protection channel actuates two separate trip logic trains, one for each reactor trip breaker undervoltage trip coil. The protection system is thus inherently safe in the event of a loss of rod control power.

The coincident trip philosophy is carried out to provide a safe and reliable system since a single failure will not defeat the function of a redundant channel and will also not cause a spurious plant trip. Channel independence is carried throughout the system extending from the sensor to the relay providing the logic. In most cases, the safety and control functions when combined are combined only at the sensor (and power supply). Both functions are fully isolated in the remaining part of the channel, control being derived from the primary safety signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the safety channels. This approach is used for pressurizer pressure and water level channels, steam generator water level, TAVG and delta T channels, steam flow, and nuclear power range channels.

The power supplies to the channels are fed from four instrument buses. Two of the buses are supplied by constant voltage transformers and two are supplied by inverters.

3.1.1.4.2.2 Engineered Safety Features Initiation Circuits The initiation of the engineered safety features provided for loss-of-coolant accidents, e.g.,

high-head safety injection and residual heat removal pumps, and containment spray systems, is accomplished from several signals derived from reactor coolant system and containment instrumentation. Channel independence is carried throughout the system from the sensors to the signal output relays including the power supplies for the channels. The initiation signal for containment spray comes from coincidence of two sets of two-out-of-three high-high-containment-pressure signals. On loss of voltage to the safeguards bus, the diesel generator will be automatically started and connected to the bus.

The signal for containment isolation of non-vital valves, i.e., the isolation valves trip signal, is derived from a coincidence of two-out-of-three containment high-pressure signals. This setpoint is below that for containment spray actuation. For this circuit also, the channels are independent from sensor to output relay and are supplied from independent power sources.

Page 15 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Redundancy is provided in that there are two diesel-generator sets capable of supplying the separate 480-V safeguards buses. One complete set of safety features equipment is therefore independently supplied from each diesel generator.

In the event that either diesel generator fails to start, a bus tie breaker may be manually closed by the operator to connect the 480-V safeguards bus to the second diesel-generator set. This would then allow a duplicate safety feature component from the bus associated with a failed diesel generator to be fed from the other bus in the event of a component failure. In the event of a fault on either bus, closing of the tie breaker is blocked.

Required continuous electrical power supply is discussed in Chapter 8.

3.1.1.4.3 Single-Failure Definition (Category B)

CRITERION: Multiple failures resulting from a single event shall be treated as a single failure (AIF-GDC 21).

The requirements of this criterion are included in Section 3.1.1.4.5.

3.1.1.4.4 Separation of Protection and Control Instrumentation Systems CRITERION: Protection systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation system component or channel, or of those common to control instrumentation and protection circuitry, leaves intact a system satisfying all requirements for the protection channels (AIF-GDC 22).

The requirements of this criterion are included in Section 3.1.1.4.2.

3.1.1.4.5 Protection Against Multiple Disability for Protection Systems CRITERION: The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function or shall be tolerable on some other basis (AIF-GDC 23).

The components of the protection system are qualified such that the mechanical and thermal adverse environment resulting from emergency situations during which the components are required to function does not prevent them from accomplishing their safety function.

3.1.1.4.6 Emergency Power for Protection Systems CRITERION: In the event of loss of all offsite power, sufficient alternate sources of power shall be provided to permit the required functioning of the protection systems (AIF-GDC 24).

The requirements of this criterion are included in Section 3.1.1.7.3.

Page 16 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.4.7 Demonstration of Functional Operability of Protection Systems CRITERION: Means shall be included for suitable testing of the active components of protection systems while the reactor is in operation to determine if failure or loss of redundancy has occurred (AIF-GDC 25).

Each protection channel in service at power is capable of being calibrated and tripped independently by simulated signals for test purposes to verify its operation. This includes checking through to the trip breakers which necessarily involves the trip logic. Thus, the operability of each trip channel can be determined conveniently and without ambiguity.

Periodic testing of the diesel generators is routinely performed to ensure their operability.

During power operation, surveillance testing verifies that the fuel transfer system is operational, the diesels start from normal standby conditions, the generators are properly synchronized and loaded, and that proper alignment is made so that the diesel generators could supply safeguards bus power. During shutdown conditions, the diesel generators are tested to ensure they can restore safeguards bus voltage in a timely manner by automatically actuating breakers in the time period required.

3.1.1.4.8 Protection Systems Failure Analysis Design CRITERION: The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the systems, loss of energy (e.g., electrical power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced (AIF-GDC 26).

Each reactor trip circuit is designed so that trip occurs when the circuit is deenergized; an open circuit or loss of channel power therefore causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from independent electrical buses. Failure to deenergize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event.

The signal for containment isolation of nonvital valves is developed from a two-out-of-three circuit in which each channel is separate and independent and which signals for containment isolation upon loss of power. The failure of any channel to deenergize when required does not interfere with the proper functioning of the isolation circuit.

Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on each drive, allowing the rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power.

Automatic starting of either emergency diesel generator is initiated by redundant undervoltage relays on the 480-V safeguards bus to which the diesel generator is connected or by the safety injection signal. Engine cranking is accomplished by a stored energy system supplied solely for the associated diesel generator. The undervoltage relay scheme is designed so that loss of 480-V power does not prevent the relay scheme from functioning properly.

Page 17 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.5 Reactivity Control 3.1.1.5.1 Redundancy of Reactivity Control CRITERION: Two independent reactivity control systems, preferably of different principles, shall be provided (AIF-GDC 27).

In addition to the reactivity control achieved by the control rods, reactivity control is provided by the chemical and volume control system which regulates the concentration of boric acid solution neutron absorber in the reactor coolant system. The system is designed to prevent, under anticipated system malfunction, uncontrolled or inadvertent reactivity changes which might stress the system beyond allowable limits.

3.1.1.5.2 Reactivity Hot Shutdown Capability CRITERION: The reactivity control systems provided shall be capable of making and holding the core subcritical from any hot standby or hot operating condition (AIF-GDC 28).

The reactivity control systems provided are capable of making and holding the core subcritical from any hot standby condition, including those resulting from power changes. The maximum excess reactivity expected for the core occurs for the cold, clean condition at the beginning of each cycle.

The control rods are divided into two categories comprising a control group and shutdown groups. The control group, used in combination with chemical shim (soluble boron),

provides control of the reactivity changes of the core throughout the life of the core at power conditions. This group of control rods is used to compensate for short-term reactivity changes at power that might be produced due to variations in reactor power requirements or in coolant temperature. The chemical shim control is used to compensate for the more slowly occurring changes in reactivity throughout core life such as those due to fuel depletion and fission product buildup and decay.

3.1.1.5.3 Reactivity Shutdown Capability CRITERION: One of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast to prevent exceeding acceptable fuel damage limits. Shutdown margin should assure subcriticality with the most reactive control rod fully withdrawn (AIF-GDC 29).

The shutdown groups are provided to supplement the control group of control rods to make the reactor subcritical with the required shutdown margin following trip from any credible operating condition to the hot, zero power condition assuming the most reactive rod cluster control assembly remains in the fully withdrawn position. Manually controlled boric acid addition is used to supplement the rod cluster control assemblies in maintaining the shutdown margin for the long-term conditions of xenon decay or plant cooldown. See Sections 4.2.1 and 9.3.4 concerning details of the control rods and chemical and volume control systems.

Page 18 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.5.4 Reactivity Hold-Down Capability CRITERION: The reactivity control systems provided shall be capable of making the core subcritical under credible accident conditions with appropriate margins for contingencies and limiting any subsequent return to power such that there will be no undue risk to the health and safety of the public (AIF-GDC 30).

Normal reactivity shutdown capability is provided by control rods with boric acid injection used to compensate for the long-term xenon decay transient and for plant cooldown. Any time that the plant is at power, the quantity of boric acid retained in the boric acid tanks or refueling water storage tank (RWST) and ready for injection will always exceed that quantity required for the normal MODE 5 (Cold Shutdown). This quantity will also exceed the quantity of boric acid required to bring the reactor to MODE 3 (Hot Shutdown) and to compensate for subsequent xenon decay.

The boric acid solution is transferred from the boric acid storage tanks by boric acid transfer pumps to the suction of the charging pumps which inject boric acid into the reactor coolant.

Any charging pump and boric acid transfer pump can be operated from diesel-generator power on loss of primary power. Boric acid injection from the Boric Acid Storage Tanks (BAST) to the RCS by one charging pump operating at its nominal charging flow rate of 46 gpm is capable of shutting down the reactor with no rods inserted in approximately 81 minutes.

Sufficient boric acid from the BAST or the Refueling Water Storage Tank (RWST) can also be injected to compensate for xenon decay beyond the equilibrium level, with one charging pump operating at its minimum speed, and thereby delivering in excess of the required minimum flow of approximately 9 gpm into the reactor coolant system. This required flow rate is checked on a cycle specific basis. Additional boric acid is employed if it is desired to bring the reactor to MODE 5 (Cold Shutdown) conditions.

On the basis of the above, the injection of boric acid is shown to afford backup reactivity shutdown capability, independent of control rod clusters which normally serve this function in the short-term situation. Shutdown for long-term and reduced temperature conditions can be accomplished with boric acid injection using redundant components. Furthermore, boric acid from the refueling water storage tank (RWST) can also be transferred to the reactor coolant system via the charging pumps.

3.1.1.5.5 Reactivity Control Systems Malfunction CRITERION: The Reactor Trip System (RTS) shall be capable of protecting against any single malfunction of the reactivity control system, such as unplanned continuous withdrawal (not ejection or dropout) of a control rod, by limiting reactivity transients to avoid exceeding acceptable fuel damage limits (AIF-GDC 31).

Page 19 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS As described in Chapter 7, the Reactor Trip System (RTS) is designed to limit reactivity transients to DNBR greater than or equal to the safety limit due to any single malfunction in the deboration controls.

Reactor shutdown with control rods is completely independent of the normal control functions since the trip breakers completely interrupt the power to the rod mechanisms regardless of existing control signals.

Details of the effects of continuous withdrawal of a control rod and of continuous deboration are described in Sections 15.4.1 and 15.4.4.

3.1.1.5.6 Maximum Reactivity Worth of Control Rods CRITERION: Limits, which include reasonable margin, shall be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change or reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to lose capability of cooling the core (AIF-GDC 32).

Limits, which include considerable margin, are placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals so as to lose capability to cool the core.

The reactor coolant system employs control rods, less than half of which are fully withdrawn during power operation, serving as shutdown rods. The remaining rods comprise the controlling group which are used to control load and reactor coolant temperature. The control rod drive mechanisms are wired into preselected groups, and are therefore prevented from being withdrawn in other than their respective groups. The control rod drive mechanism is of the magnetic latch type and the coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate is analyzed in the detailed plant analysis described in Section 15.4.

No credible mechanical or electrical control system malfunction can cause a control rod to be withdrawn at a speed greater than 77 steps per minute.

3.1.1.6 Reactor Coolant Pressure Boundary 3.1.1.6.1 Reactor Coolant Pressure Boundary Capability CRITERION: The reactor coolant pressure boundary shall be capable of accommodating without rupture the static and dynamic loads imposed on any boundary component as a result of an inadvertent and sudden release of energy to the coolant. As a design reference, this sudden release shall be taken as that which would result from a sudden reactivity insertion such as rod ejection (unless prevented by positive mechanical means), rod dropout, or cold water addition (AIF-GDC 33).

Page 20 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The reactor coolant boundary is shown to be capable of accommodating without further rupture the static and dynamic loads imposed as a result of a sudden reactivity insertion such as a rod ejection. Details of this analysis are provided in Section 15.4.5.

The operation of the reactor is such that the severity of an ejection accident is inherently limited. Since control rod clusters are used to control load variations only and core depletion is followed with boron dilution, only the rod cluster control assemblies in the controlling groups are inserted in the core at power, and at full power these rods are only partially inserted. A rod insertion limit monitor is provided as an administrative aid to the operator to ensure that this condition is met.

By using the flexibility in the selection of control rod groupings, radial locations and position as a function of load, the design limits the maximum fuel temperature for the highest worth ejected rod to a value which precludes any resultant damage to the primary system, pressure boundary, i.e., gross fuel dispersion in the coolant and possible excessive pressure surges.

The failure of a rod mechanism housing causing a control rod to be rapidly ejected from the core is evaluated as a theoretical, though not a credible, accident. While limited fuel damage could result from this hypothetical event, the fission products are confined to the reactor coolant system and the reactor containment. The environmental consequences of rod ejection are less severe than from the postulated loss-of-coolant accident, for which public health and safety are shown to be adequately protected.

3.1.1.6.2 Reactor Coolant Pressure Boundary Rapid Propagation Failure Prevention CRITERION: The reactor coolant pressure boundary shall be designed and operated to reduce to an acceptable level the probability of rapidly propagating type failures.

Consideration shall be given (a) to the provisions for control over service temperature and irradiation effects which may require operational restrictions, (b) to the design and construction of the reactor pressure vessel in accordance with applicable codes, including those which establish requirements for absorption of energy within the elastic strain energy range and for absorption of energy by plastic deformation and (c) to the design and construction of reactor coolant pressure boundary piping and equipment in accordance with applicable codes (AIF-GDC 34).

The reactor coolant pressure boundary is designed to reduce to an acceptable level the probability of a rapidly propagating type failure.

In the core region of the reactor vessel it is expected that the notch toughness of the material will change as a result of fast neutron exposure. This change is evidenced as a shift in the nil ductility transition temperature (NDTT) which is factored into the operating procedures in such a manner that full operating pressure is not obtained until the affected vessel material is above the now higher design transition temperature (DTT) and in the ductile material region.

The pressure during startup and shutdown at the temperature below NDTT is maintained below the threshold of concern for safe operation.

Page 21 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The DTT is a minimum of NDTT plus 60F and dictates the procedures to be followed in the hydrostatic test and in station operations to avoid excessive cold stress. The value of the DTT is increased during the life of the plant, as required by the expected shift in the NDTT and as confirmed by the experimental data obtained from irradiated specimens of reactor vessel material during the plant lifetime. Following installation of the Ex-Vessel Neutron Dosimetry modification, radiometric monitors and gradient chains are used for this purpose.

Further details are given in Sections 5.2 and 5.3.

Low temperature reactor vessel overpressure protection is discussed in Section 5.2.2.

Pressurized thermal shock of the reactor vessel is discussed in Section 5.3.3.5.

All pressure-containing components of the reactor coolant system are designed, fabricated, inspected, and tested in conformance with the applicable codes. Further details are given in Section 5.2.1.2.

3.1.1.6.3 Reactor Coolant Pressure Boundary Brittle Fracture Prevention CRITERION: Under conditions where reactor coolant pressure boundary system components constructed of ferritic materials may be subjected to potential loadings, such as a reactivity-induced loading, service temperatures shall be at least 120F above the nil ductility transition temperature (NDTT) of the component material if the resulting energy release is expected to be absorbed by plastic deformation or 60F above the NDTT of the component material if the resulting energy release is expected to be absorbed within the elastic strain energy range (AIF-GDC 35).

The requirements of this criterion are included in Section 3.1.1.6.2.

3.1.1.6.4 Reactor Coolant Pressure Boundary Surveillance CRITERION: Reactor coolant pressure boundary components shall have provisions for inspection, testing, and surveillance of critical areas by appropriate means to assess the structural and leaktight integrity of the boundary components during their service lifetime. For the reactor vessel, a material surveillance program conforming with current applicable codes shall be provided (AIF-GDC 36).

The design of the reactor vessel and its arrangement in the system provides the capability for accessibility during service life to the entire internal surfaces of the vessel and certain external zones of the vessel including the nozzle to reactor coolant piping welds and the top and bottom heads. The reactor arrangement within the containment provides sufficient space for inspection of the external surfaces of the reactor coolant piping, except for the area of pipe within the primary shielding concrete.

Monitoring of the NDTT properties of the core region plate forgings, weldments, and associated heat-treated zones are performed in accordance with ASTM E185, Recommended Practice for Surveillance Tests on Structural Materials in Nuclear Reactors. Samples of reactor vessel plate materials are retained and cataloged in case future engineering development shows the need for further testing.

The material properties surveillance program includes not only the conventional tensile and impact tests but also fracture mechanics specimens. The fracture mechanics specimens are the wedge-opening loading type specimens. The observed shifts in NDTT of the core region Page 22 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS materials with irradiation will be used to confirm the calculated limits to startup and shut-down transients. Following installation of the Ex-Vessel Neutron Dosimetry modification, radiometric monitors and gradient chains are used for this purpose.

To define permissible operating conditions below DTT, a pressure range is established which is bounded by a lower limit for pump operation and an upper limit which satisfies reactor vessel stress criteria. To allow for thermal stresses during heatup or cooldown of the reactor vessel, an equivalent pressure limit is defined to compensate for thermal stress as a function of rate of change of coolant temperature. The reactor coolant temperature and pressure and the system heatup and cooldown rates allowable are discussed in Section 5.1.3.9.

Since the normal operating temperature of the reactor vessel is well above the maximum expected DTT, brittle fracture during MODES 1 and 2 is not considered to be a credible mode of failure. The reactor vessel has been evaluated for potential damage due to "Pressurized Thermal Shock" (Unresolved Safety Issue A-49) and it was concluded that the potential for damage was acceptably small. A discussion of reactor vessel integrity under transient conditions is discussed in Sections 5.3.3.4 and 5.3.3.5.

3.1.1.7 Engineered Safety Features 3.1.1.7.1 Engineered Safety Features Basis for Design CRITERION: Engineered safety features shall be provided in the facility to back up the safety provided by the core design, the reactor coolant pressure boundary, and their protection systems. Such engineered safety features shall be designed to cope with any size reactor coolant piping break up to and including the equivalent of a circumferential rupture of any pipe in that boundary assuming unobstructed discharge from both ends (AIF-GDC 37).

The design, fabrication, testing, and inspection of the core, reactor coolant pressure boundary, and their protection systems give assurance of safe and reliable operation under all anticipated normal, transient, and accident conditions. However, engineered safety features are provided in the facility to back up the safety provided by these components. These engineered safety features have been designed to cope with any size reactor coolant pipe break up to and including the circumferential rupture of any pipe in that boundary assuming unobstructed discharge from both ends, and to cope with any steam or feedwater line break up to and including the main steam or feedwater headers.

The release of fission products from the reactor fuel is limited by the safety injection system which, by cooling the core, keeps the fuel in place and substantially intact and limits the metal-water reaction.

The safety injection system consists of high and low-head centrifugal pumps driven by electric motors and passive accumulator tanks which are self-energized and which act independently of any actuation signal or power source.

The release of fission products from the containment is limited in three ways:

1. Blocking the potential leakage paths from the containment. This is accomplished by Page 23 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

a. A steel-lined concrete reactor containment with testable, double penetrations and liner weld channels which form a virtually leaktight barrier to the escape of fission products should a loss of coolant occur.

b. Isolation of process lines by the containment isolation system which imposes double barriers in each line that penetrates the containment.

2. Reducing the fission product concentration in the containment atmosphere. This is accomplished by

a. Air recirculation filters which provide for rapid removal of particles and iodine vapor from the containment atmosphere.

b. Chemically treated spray which removes elemental iodine vapor from the containment atmosphere by washing action.

3. Reducing the containment pressure and thereby limiting the driving potential for fission product leakage. This is accomplished by cooling the containment atmosphere by the following independent systems

a. Containment spray system.

b. Containment recirculation fan cooler (CRFC) and filtration system.

3.1.1.7.2 Reliability and Testability of Engineered Safety Features CRITERION: All engineered safety features shall be designed to provide such functional reliability and ready testability as is necessary to avoid undue risk to the health and safety of the public (AIF-GDC 38).

A comprehensive program of plant testing is performed for all equipment systems and system controls vital to the functioning of engineered safety features. The program consists of performance tests of individual pieces of equipment in the manufacturers shop, and integrated tests of the system as a whole, and periodic tests of the actuation circuitry and mechanical components to ensure reliable performance, upon demand, throughout the plant lifetime.

The initial tests of the individual components and the integrated test of the system as a whole complement each other to ensure performance of the system as designed and to prove proper operation of the actuation circuitry.

Routine periodic testing of the engineered safety features components is scheduled. In the event that one of the components should require maintenance as a result of failure to perform during the test according to prescribed limits, the necessary corrections or minor maintenance will be made as required by the Technical Specifications.

3.1.1.7.3 Emergency Power CRITERION: An emergency power source shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this capacity assuming a failure of a single active component (AIF-GDC 39).

Page 24 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Independent, redundant, alternate power systems are provided with adequate capacity and testability to supply the required engineered safety features.

The plant is supplied with normal, standby and emergency power sources as follows:

A. The normal source of auxiliary power during plant operation is the generator. Power is supplied via the unit auxiliary transformer 11 that is connected to the main leads of the generator, except for safeguards loads required during MODES 1 and 2, which are supplied from transformer 12A and the offsite source. See Section 8.2.1.2 for an updated description of the supply to the safeguards loads.

B. Standby power required during plant startup, shutdown, and after reactor trip is supplied from the high-tension transmission terminal which has multiple lines running to the interconnected system.

C. Two diesel-generator sets are connected to the engineered safety features buses to supply emergency shutdown power in the event of loss of all other ac auxiliary power.

D. Emergency power supply for vital instruments and control and for emergency lighting is supplied from the two 125-V dc station batteries.

Although the engineered safety features loads are arranged to operate from electrical buses supplied from normal outside ac power which is designed to remain functional following reactor trip, reliable onsite emergency power is provided. Thus, if normal ac power to the station is lost concurrent with a loss-of-coolant accident, power is available for the engineered safety features. Two diesel-generator sets, each capable of supplying the necessary engineered safety features or safe shutdown loads, are provided. Details are provided in Sections 8.1.4.2 and 8.3.1.1.

3.1.1.7.4 Missile Protection CRITERION: Adequate protection for those engineered safety features, the failure of which could cause an undue risk to the health and safety of the public, shall be provided against dynamic effects and missiles that might result from plant equipment failures (AIF-GDC 40).

A loss-of-coolant accident or other plant equipment failure might result in dynamic effects or missiles. For such engineered safety features as are required to ensure safety in the event of such an accident or equipment failure, protection from these dynamic effects or missiles is considered in the layout of plant equipment and missile barriers. Fluid and mechanical driving forces are calculated and consideration is given to the possibility of damage due to fluid jets and missiles which might be produced by the action of such jets. Consideration is given during the design of the following potential sources of missiles: valve stems and bonnets, instrument thimbles including installed sensors, bolts, complete control rod drive shafts and/ or mechanisms, and rotating components. Consideration is also given to pipe whip effects.

Layout and structural design specifically protect injection paths leading to unbroken reactor coolant loops against damage as a result of the maximum reactor coolant pipe rupture.

Injection lines penetrate the main missile barrier, and the injection headers are located in the missile-protected area between the missile barrier and the containment outside wall.

Page 25 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Individual injection lines, connected to the injection header, pass through the barrier and then connect to the loops. Separation of the individual injection lines is provided to the maximum extent practicable. Movement of the injection line, associated with rupture of a reactor coolant loop, is accommodated by line flexibility and by the design of the pipe supports.

All hangers, stops, and anchors are designed in accordance with USAS B31.1, Code for Pressure Piping, and ACI 318, Building Code Requirements for Reinforced Concrete, which provides minimum requirements on material, design, and fabrication with ample safety margins for both dead and dynamic loads over the life of the equipment. Additional information is provided in Sections 3.5 and 3.6.

3.1.1.7.5 Engineered Safety Features Performance Capability CRITERION: Engineered safety features, such as the Emergency Core Cooling System (ECCS) and the containment heat removal system, shall provide sufficient performance capability to accommodate the failure of any single active component without resulting in undue risk to the health and safety of the public (AIF-GDC 41).

Each engineered safety feature provides sufficient performance capability to accommodate any single failure of an active component and still function in a manner to avoid undue risk to the health and safety of the public.

The extreme upper limit of public exposure is taken as the levels and time periods presently outlined in 10 CFR 100. The accident condition considered is the hypothetical case of a release of fission products per TID 14844. Also, the total loss of all offsite power is assumed concurrent with this accident. In Reference 2, the NRC approved the use of alternate source term (AST) methodology as defined in 10CFR50.67 for use by Ginna in determining offsite doses. The AST methodology was used during the power uprate to 1775 MWt to calculate offsite doses.

Under the above accident conditions, all engineered safety features equipment is designed to accomplish its safety function, assuming the worst case single failure.

3.1.1.7.6 Engineered Safety Features Components Capability CRITERION: Engineered safety features shall be designed so that the capability of these features to perform their required function is not impaired by the effects of a loss of-coolant accident to the extent of causing undue risk to the health and safety of the public (AIF-GDC 42).

All active components of the safety injection system (with the exception of residual heat removal low-pressure safety injection line discharge valves) and the containment spray system are located outside the containment and are not subject to containment accident conditions.

Instrumentation, motors, cables, and penetrations located inside the containment are selected to meet the most adverse accident conditions to which they may be subjected. These items are either protected from containment accident conditions or are designed to withstand, Page 26 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS without failure, exposure to the worst combination of temperature, pressure, and humidity expected during the required operational period.

The piping and other components of the engineered safety features systems are designed and qualified to perform their safety function during and after the accident conditions, with concurrent seismic forces and accident operational loadings.

3.1.1.7.7 Accident Aggravation Prevention CRITERION: Protection against any action of the engineered safety features which would accentuate significantly the adverse aftereffects of a loss of normal cooling shall be provided (AIF-GDC 43).

The reactor is maintained subcritical following a primary system pipe rupture accident.

Introduction of borated cooling water into the core results in a net negative reactivity addition.

The delivery of cold safety injection water to the reactor vessel following a reactor coolant system break or secondary system break will not further adversely affect the integrity of the reactor coolant pressure boundary.

3.1.1.7.8 Emergency Core Cooling System (ECCS) Capability CRITERION: An Emergency Core Cooling System (ECCS) with the capability for accomplishing adequate emergency core cooling shall be provided. This core cooling system and the core shall be designed to prevent fuel and clad damage that would interfere with the emergency core cooling function and to limit the clad metal-water reaction to acceptable amounts for all sizes of breaks in the reactor coolant piping up to the equivalent of a double-ended rupture of the largest pipe. The performance of such an Emergency Core Cooling System (ECCS) is evaluated conservatively in each area of uncertainty (AIF-GDC 44).

Adequate emergency core cooling is provided by the safety injection system which constitutes the Emergency Core Cooling System (ECCS) whose components include the passive accumulators, high-pressure safety injection, and residual heat removal low pressure safety injection and recirculation.

The primary purpose of the safety injection system is to automatically deliver cooling water to the reactor core to limit the fuel clad temperature and thereby ensure that the core will remain intact and in place, with its essential heat transfer geometry preserved. This protection is prescribed for all break sizes up to and including the hypothetical instantaneous double-ended rupture of the reactor coolant pipe, the rod ejection accident, a steam or feedwater line break, the steam generator tube rupture, and other accidents analyzed in Chapter 15.

The ability of the safety injection system to meet its capability objectives is presented in Section 6.3.3.

Page 27 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.7.9 Inspection of Emergency Core Cooling System (ECCS)

CRITERION: Design provisions shall, where practical, be made to facilitate physical inspection of all critical parts of the Emergency Core Cooling System (ECCS),

including reactor vessel internals and water injection nozzles (AIF-GDC 45).

Design provisions are made to the extent practical to facilitate access to the critical parts of the reactor vessel internals, injection nozzles, pipes, valves, and safety injection pumps for visual, boroscopic, and ultrasonic inspection for erosion, corrosion, and vibration wear evidence, and for nondestructive test inspection where such techniques are desirable and appropriate.

3.1.1.7.10 Testing of Emergency Core Cooling System (ECCS) Components CRITERION: Design provisions shall be made so that components of the Emergency Core Cooling System (ECCS) can be tested periodically for operability and functional performance (AIF-GDC 46).

Design provisions are made so that active components of the safety injection system can be tested periodically for operability and functional performance.

Each active component can be individually actuated on the normal power source at any time during plant operation.

The safety injection pumps can be tested periodically during plant operation using the full flow test lines in accordance with the inservice pump and valve testing program. The residual heat removal pumps are used every time the residual heat removal loop is put into operation, as well as being periodically tested. All remote-operated valves are exercised and actuation circuits are tested during routine maintenance.

The accumulators are tested for flow during startup after a MODE 6 (Refueling) shutdown.

Accumulator flow is measured when valves in the accumulator test line are opened during the test. This flow is recirculated to the refueling water storage tank (RWST).

See Section 6.3.5 for a more detailed description of current testing provisions.

3.1.1.7.11 Testing of Emergency Core Cooling System (ECCS)

CRITERION: Capability shall be provided to test periodically the operability of the Emergency Core Cooling System (ECCS) up to a location as close to the core as is practical (AIF-GDC 47).

This information is included in Section 3.1.1.7.10.

3.1.1.7.12 Testing of Operational Sequence of Emergency Core Cooling System (ECCS)

CRITERION: Capability shall be provided to test initially, under conditions as close as practical to design, the full operational sequence that would bring the Emergency Core Cooling System (ECCS) into action, including the transfer to alternate power sources (AIF-GDC 48).

Page 28 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The design provides for capability to test initially, to the extent practical, the full operational sequence up to the design conditions for the safety injection system to demonstrate the state of readiness and capability of the system. Details of the operational sequence testing are presented in Section 6.3.5, Tests and Inspections.

The functional test that was performed during startup is described in Section 5.4.5.5 and Section 14.6.1. (See also Section 6.3.1.4.)

3.1.1.7.13 Containment Design Basis CRITERION: The reactor containment structure, including access openings and penetrations, and any necessary containment heat removal systems shall be designed so that the leakage of radioactive materials from the containment structure under conditions of pressure and temperature resulting from the largest credible energy release following a loss-of-coolant accident, including the calculated energy from metal-water or other chemical reactions that could occur as a consequence of failure of any single active component in the Emergency Core Cooling System (ECCS), will not result in undue risk to the health and safety of the public (AIF-GDC 49).

The following general criteria are followed to ensure conservatism in computing the required structural load capacity:

1. In calculating the containment pressure, rupture sizes up to and including a double-ended severance of reactor coolant pipes and steam lines are considered.

2. In considering postaccident pressure effects, various malfunctions of the emergency systems are evaluated consistent with the single-failure criteria.

3. The pressure and temperature loadings obtained by analyzing various accidents, when combined with operating loads and maximum wind or seismic forces, do not exceed the load-carrying capacity of the structure, its access openings, or penetrations.

Details of the containment evaluation are provided in Section 6.2.

3.1.1.7.14 Nil Ductility Transition Temperature Requirement for Containment Material CRITERION: The selection and use of containment materials shall be in accordance with applicable engineering codes (AIF-GDC 50).

The selection and use of containment materials comply with the applicable codes and standards tabulated in Section 3.8.1.2.5.

The concrete containment is not susceptible to low-temperature brittle fracture.

The containment liner is enclosed within the containment and thus is not exposed to the outside temperature extremes. The containment ambient temperature during operation is between 50F and 125F which is expected to be well above the NDTT + 30F for the liner material. Containment penetrations which can be exposed to the environment are also designed to the NDTT + 30F criterion. The containment liner evaluation is discussed in Sections 3.8.1 and 3.8.2.

Page 29 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.7.15 Reactor Coolant Pressure Boundary Outside Containment CRITERION: If part of the reactor coolant pressure boundary is outside the containment, features shall be provided to avoid undue risk to the health and safety of the public in case of an accidental rupture in that part (AIF-GDC 51).

The reactor coolant pressure boundary does not extend outside of the containment.

3.1.1.7.16 Containment Heat Removal Systems CRITERION: Where an active heat removal system is needed under accident conditions to prevent exceeding containment design pressure, this system shall perform its required function, assuming failure of any single active component (AIF-GDC 52).

Two means of removing heat from the containment atmosphere are provided: the containment recirculation fan cooler (CRFC)units and the containment spray system. Sections 6.2.2 and 6.5 and Chapter 15 describe the operability and capability of the containment spray system, the residual heat removal loop part of the containment heat removal system, and the containment recirculation fan cooler (CRFC) and filtration system.

3.1.1.7.17 Containment Isolation Valves CRITERION: Penetrations that require closure for the containment function shall be protected by redundant valving and associated apparatus (AIF-GDC 53).

Isolation valves for all fluid system lines penetrating the containment provide at least two barriers for redundancy against leakage of radioactive fluids to the environment in the event of a loss-of-coolant accident. These barriers, in the form of isolation valves or closed systems, are defined on an individual line basis. In addition to satisfying containment isolation criteria, the valving is designed to facilitate normal operation and maintenance of the systems and to ensure reliable operation of other engineered safety features.

With respect to numbers and locations of isolation valves, the criteria applied are generally those outlined by the five classes described in Section 6.2.4.4.

3.1.1.7.18 Initial Leakage Rate Testing of Containment CRITERION: Containment shall be designed so that integrated leakage rate testing can be conducted at the peak pressure calculated to result from the design-basis accident on completion and installation of all penetrations, and the leakage rate shall be measured over a sufficient period of time to verify its conformance with required performance (AIF-GDC 54).

After completion of the containment structure and installation of all penetration and weld channels, an initial integrated leakage rate test was conducted at the peak calculated accident pressure, maintained for a minimum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, to verify that the leakage rate is not greater than 0.1% by weight of the containment volume per day.

Page 30 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The absolute method was used, and the test continued at a reduced pressure to provide a leak rate versus pressure characteristic curve. Weld channels and double penetrations were not pressurized during this test. Containment recirculation units operated continuously throughout the test to ensure good air mixing and temperature control.

3.1.1.7.19 Periodic Containment Leakage Rate Testing CRITERION: The containment shall be designed so that an integrated leakage rate can be periodically determined by test during plant lifetime (AIF-GDC 55).

A leak rate test at the peak calculated accident pressure using the same method as the initial leak rate test can be performed at any time during the operational life of the plant, provided the plant is not in operation and precautions are taken to protect instruments and equipment from damage. However, in accordance with 10 CFR 50, Appendix J, subsequent containment integrated leak rate tests were conducted at reduced pressure, with appropriate compensatory modifications to the leakage acceptance criteria. See Section 6.2.6 for the latest criteria.

3.1.1.7.20 Provisions for Testing of Penetrations CRITERION: Provisions shall be made to the extent practical for periodically testing penetrations which have resilient seals or expansion bellows to permit leak tightness to be demonstrated at the peak pressure calculated to result from occurrence of the design-basis accident (AIF-GDC 56).

A permanently piped monitoring system is provided such that all penetrations may be checked for leaktight integrity at any time throughout the operating life of the plant.

Penetrations are designed with double seals so as to permit pressurization of the interior of the penetration whenever a leak test is required. The large access openings such as the equipment hatch and personnel air locks are equipped with double seals with the space between the seals connected to the pressurizing system. The system utilizes a supply of clean, dry, compressed air which places all the penetrations under an internal pressure as required for the test.

Leakage from the system is checked by measurement of the integrated makeup air flow or change in internal pressure. In the event excessive leakage is discovered, each penetration can then be checked separately.

3.1.1.7.21 Provisions for Testing of Isolation Valves CRITERION: Capability shall be provided to the extent practical for testing functional operability of valves and associated apparatus essential to the containment function for establishing that no failure has occurred and for determining that valve leakage does not exceed acceptable limits (AIF-GDC 57).

Capability is provided to the extent practical for testing the functional operability of valves and associated apparatus during periods of reactor shutdown. The type C tests for containment isolation valves are performed in accordance with 10 CFR 50, Appendix J. The results are documented in the Containment Integrated Leak Rate Test Report which is submitted Page 31 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS following the performance of each type A test. Containment leakage testing is discussed in Section 6.2.6.

3.1.1.7.22 Inspection of Containment Pressure-Reducing Systems CRITERION: Design provisions shall be made to the extent practical to facilitate the periodic physical inspection of all important components of the containment pressure-reducing systems, such as pumps, valves, spray nozzles, torus, and sumps (AIF-GDC 58).

Design provisions are made to the extent practical to facilitate access for periodic visual inspection of all important components of the containment air recirculation and filtration and containment spray systems.

3.1.1.7.23 Testing of Containment Pressure-Reducing Systems Components CRITERION: The containment pressure-reducing systems shall be designed to the extent practical so that components, such as pumps and valves, can be tested periodically for operability and required functional performance (AIF-GDC 59).

The containment pressure-reducing systems are designed to the extent practical so that the spray pumps, spray injection valves, spray nozzles and additive injection valves can be tested periodically and after any component maintenance action for operability and functional performance.

The air recirculating and cooling units, and the service water (SW) pumps that supply the cooling units are in operation on a relatively continuous schedule during plant operation, and no additional periodic tests are required.

3.1.1.7.24 Testing of Containment Spray Systems CRITERION: A capability shall be provided to the extent practical to test periodically the operability of the containment spray system up to a position as close to the spray nozzles as is practical (AIF-GDC 60).

Permanent test lines for the containment spray loops are located so that all components up to the isolation valve at the spray nozzles may be tested. These isolation valves are checked separately. The spray nozzles are checked by blowing hot air (approximately 200F) through the nozzles and observing the flow by use of thermography.

3.1.1.7.25 Testing of Operational Sequence of Containment Pressure-Reducing Systems CRITERION: A capability shall be provided to test initially under conditions as close as practical to the design and the full operational sequence that would bring the containment pressure-reducing systems into action, including the transfer to alternate power sources (AIF-GDC 61).

Capability is provided to test initially to the extent practical the operational startup sequence beginning with transfer to alternate power sources and ending with near design conditions for Page 32 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS the containment spray and containment recirculation fan cooler (CRFC) and filtration systems.

3.1.1.7.26 Inspection of Air Cleanup Systems CRITERION: Design provisions shall be made to the extent practical to facilitate physical inspection of all critical parts of containment air cleanup systems, such as, ducts, filters, fans, and dampers (AIF-GDC 62).

Access is available for visual inspection of the containment fan cooler and recirculation filtration components.

3.1.1.7.27 Testing of Air Cleanup Systems Components CRITERION: Design provisions shall be made to the extent practical so that active components of the air cleanup systems, such as fans and dampers, can be tested periodically for operability and required functional performance (AIF-GDC 63).

Periodic tests of the dampers associated with the charcoal filter units of the containment air cleanup system are conducted. Each damper is stroked and its operation (including stroke time) is checked by personnel in the containment. An indicating light in the control room provides indication of damper movement. Periodic tests also verify that the dampers fail in a safe position upon loss of air, and that air flow and orientation for accident operation is acceptable.

3.1.1.7.28 Testing Air Cleanup System CRITERION: A capability shall be provided to the extent practical for on site periodic testing and surveillance of the air cleanup systems to ensure (a) filter bypass paths have not developed and (b) filter and trapping materials have not deteriorated beyond acceptable limits (AIF-GDC 64).

Each containment recirculation fan unit is checked periodically for water in the filtration area.

Also, charcoal filters are tested for bypass flow and pressure drop, and are visually inspected for damage and loss of charcoal. Further, a representative sample frame is removed during shutdown and tested periodically to verify its continued efficiency. After reinstallation the filter units are tested in place by aerosol injection to determine integrity of the flow path.

3.1.1.7.29 Testing of Operational Sequence of Air Cleanup Systems CRITERION: Capability shall be provided to test initially under conditions as close to design as practical, the full operational sequence that would bring the air cleanup systems into action, including the transfer to alternate power sources and the design air flow delivery capability (AIF-GDC 65).

Means are provided to test initially under conditions as close to design and as near as is practical the full operational sequence that would bring the containment recirculation fan cooler (CRFC) and filtration system into action, including transfer to the emergency diesel-generator power source.

Page 33 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.1.8 Fuel and Waste Storage Systems 3.1.1.8.1 Prevention of Fuel Storage Criticality CRITERION: Criticality in new and spent fuel storage shall be prevented by physical systems or processes. Such means as geometrically safe configurations shall be emphasized over procedural controls (AIF-GDC 66).

During reactor vessel head removal and while loading and unloading fuel from the reactor, the boron concentration is maintained at not less than that required to shutdown the core to a kEFF = 0.90. This shutdown margin maintains the core at kEFF less than 0.99, even if all control rods are withdrawn from the core. Weekly checks of refueling water boron concentration ensure the proper shutdown margin.

The new and spent fuel storage racks are designed so that it is impossible to insert assemblies in other than the prescribed locations. Borated water is used to fill the spent fuel storage pool at a concentration to match that used in the reactor cavity and refueling canal during refueling operations. The fuel is stored vertically in an array with sufficient center-to-center distance between assemblies to ensure kEFF less than or equal to 0.90 even if unborated water were used to fill the pool.

Detailed instructions are available for use by trained refueling personnel. Furthermore, interlocks are provided to limit the travel of heavy loads in areas where failure could result in unacceptable consequences.

Since initial criticality, changes have been made. Clarifications include:

1. Boron concentration ensures that kEFF is maintained less than or equal to 0.95, vs. 0.90.

2. Checks of refueling water boron concentration are periodically conducted per the requirements of the Technical Specifications and Technical Requirements Manual, and not necessarily "weekly".

3. It is not impossible to insert assemblies into incorrect locations. Therefore, administrative controls have been established to ensure that assemblies are inserted into the proper locations.

4. The criticality methodology (Section 9.1.2.4) assumes a limited credit for borated water.

The water can no longer be unborated, and this limited credit for borated water ensures that there are safe margins to an inadvertent criticality.

3.1.1.8.2 Fuel and Waste Storage Decay Heat CRITERION: Reliable decay heat removal systems shall be designed to prevent damage to the fuel in storage facilities and to waste storage tanks that could result in radioactivity release which would result in undue risk to the health and safety of the public (AIF-GDC 67).

Page 34 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The refueling water provides a reliable and adequate cooling medium for spent fuel transfer.

Heat removal is provided by auxiliary cooling systems, such as the spent fuel pool (SFP) cooling system (Section 9.1.2) and the service water (SW) system (Section 9.2.1).

3.1.1.8.3 Fuel and Waste Storage Radiation Shielding CRITERION: Adequate shielding for radiation protection shall be provided in the design of spent fuel and waste storage facilities (AIF-GDC 68).

Adequate shielding for radiation protection is provided during refueling operations by conducting all spent fuel transfer and storage operations under water. This permits visual control of the operation at all times while maintaining low radiation levels. Shielding is provided for waste handling and storage facilities to permit operation within regulatory guidelines.

Gamma radiation is continuously monitored in the auxiliary building. A high level signal is alarmed locally and is annunciated in the control room.

Shielding for the waste disposal system and its storage components is designed to limit the dose rates as required by personnel access, testing, operation, and maintenance requirements.

3.1.1.8.4 Protection Against Radioactivity Release From Spent Fuel and Waste Storage CRITERION: Provisions shall be made in the design of fuel and waste storage facilities such that no undue risk to the health and safety of the public could result from an accidental release of radioactivity (AIF-GDC 69).

The reactor cavity, refueling canal and spent fuel storage pool are reinforced concrete structures with a seam-welded stainless steel plate liner. These structures are designed to withstand the anticipated earthquake loadings as Seismic Category I structures so that the liner should prevent leakage even in the event the reinforced concrete develops cracks.

Accident analyses described in Chapter 15 demonstrate that the postulated accidents result in exposures well within regulatory guidelines.

3.1.1.9 Control of Releases of Radioactivity to the Environment CRITERION: The facility design shall include those means necessary to maintain control over the plant radioactivity effluents, whether gaseous, liquid, or solid. Appropriate holdup capacity shall be provided for retention of gaseous, liquid, or solid effluents, particularly where unfavorable environmental conditions can be expected to require operational limitations upon the release of radioactive effluents to the environment. In all cases, the design for radioactivity control must be justified (a) on the basis of 10 CFR 20 requirements, for normal operations and for any transient situation that might reasonably be anticipated to occur and (b) on the basis of 10 CFR 100 dosage level guidelines for potential reactor accidents of exceedingly low probability of occurrence (AIF-GDC 70).

Liquid, gaseous, and solid waste disposal facilities are designed so that discharge of effluents and offsite shipments are in accordance with applicable NRC regulations and guidelines.

Page 35 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Radioactive fluids entering the waste disposal system are collected in sumps and tanks until determination of subsequent treatment can be made. They are sampled and analyzed to determine the quantity of radioactivity, with an isotopic breakdown if necessary. Before any attempt is made to discharge, they are processed as required and then released under controlled conditions. The system design and operation are characteristically directed toward minimizing releases to unrestricted areas. Discharge streams are appropriately monitored and safety features are incorporated to preclude excessive releases, in accordance with the Offsite Dose Calculation Manual (ODCM).

The bulk of the radioactive liquids discharged from the reactor coolant system are processed and retained inside the plant by the chemical and volume control system recycle train. This minimizes liquid input to the waste disposal system which processes relatively small quantities of generally low-activity level wastes. The processed water from waste disposal, from which most of the radioactive material has been removed, is discharged through a monitored line into the circulating water discharge.

Radioactive gases are pumped by compressors through a manifold to one of the gas decay tanks where they are held a suitable period of time for decay. Cover gases in the nitrogen blanketing system are reused to minimize gaseous wastes. During MODES 1 and 2, gases are discharged intermittently at a controlled rate from these tanks through the monitored plant vent. The system is provided with discharge controls so that environmental conditions do not restrict the release of radioactive effluents to the atmosphere.

Liquid wastes are processed to remove most of the radioactive materials. The spent resins from the demineralizers, the filter cartridges, and the concentrates from the evaporators are packaged and stored onsite until shipment offsite for disposal. Suitable containers are used to package these solids at the highest practical concentrations to minimize the number of containers shipped for burial.

All solid waste is placed in suitable containers and stored onsite until shipment offsite is made for disposal.

3.1.2 GENERAL DESIGN CRITERIA General Design Criteria (GDC) are set forth in Appendix A of 10 CFR 50. The Ginna Station conformance to the 1972 version of the GDC is described in the following sections.

3.1.2.1 Overall Requirements These criteria are intended to ensure that the quality control and quality assurance programs are identified, recorded, and justified in terms of their adequacy. The five criteria of this group are intended to apply to the design, fabrication, erection, and performance requirements of the facilitys essential components and systems to ensure that there is protection against natural phenomena and environmental conditions. In addition, these criteria are also intended to provide fire and explosion protection for all equipment important to safety.

Page 36 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.2.1.1 General Design Criterion 1 Quality Standards and Records CRITERION: Structures, systems, and components important to safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed. Where generally recognized codes and standards are used, they shall be identified and evaluated to determine their applicability, adequacy, and sufficiency and shall be supplemented or modified as necessary to assure a quality product in keeping with the required safety function. A quality assurance program shall be established and implemented in order to provide adequate assurance that these structures, systems, and components will satisfactorily perform their safety functions. Appropriate records of the design, fabrication, erection, and testing of structures, systems, and components important to safety shall be maintained by or under the control of the nuclear power unit licensee throughout the life of the unit (GDC 1).

All systems and components of the facility were classified according to their importance.

Those items vital to safe shutdown and isolation of the reactor or whose failure might cause or increase the severity of a loss-of-coolant accident or result in an uncontrolled release of excessive amounts of radioactivity were designated Class I. Those items important to reactor operation but not essential to safe shutdown and isolation of the reactor or control of the release of substantial amounts of radioactivity were designated Class II. Those items not related to reactor operation or safety were designated Class III. Note that Ginna LLC no longer uses this classification scheme. The classification of structures and equipment is discussed in Section 3.2.

Safety-related structures, systems, and components are essential to the protection of the health and safety of the public. Consequently, they were designed, fabricated, inspected and erected, and the materials selected to the applicable provisions of the then recognized codes, good nuclear practice, and to quality standards that reflected their importance. Discussions of applicable codes and standards, quality assurance programs, test provisions, etc., that were used are given in the section describing each system.

A complete set of as-built facility plant and system diagrams are maintained throughout the life of the reactor. Records of modifications to the general arrangement and structural plans are also maintained throughout the life of the reactor.

A set of completed test procedures for all initial plant testing is maintained as outlined in Chapter 14.

A set of all the quality assurance data generated during fabrication and erection of the essential components of the plant, as defined by the Ginna Station construction quality assurance program, is retained. The quality control and quality assurance program for Ginna Station construction is described in Section 17.1. The current quality assurance program for Ginna Station is referenced in Section 17.2.

Page 37 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.2.1.2 General Design Criterion 2 - Design Bases for Protection Against Natural Phenomena CRITERION: Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these structures, systems, and components shall reflect: (1) Appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena and (3) the importance of the safety functions to be performed (GDC 2).

All systems and components designated Seismic Category I are designed so that there is no loss of function in the event of the safe shutdown earthquake. Measures were also taken in the plant design to protect against high winds, sudden barometric pressure changes, seiches, and other natural phenomena. Tornado and flood protection measures are discussed in Sections 3.3 and 3.4. Procedures have been written that will be followed in the event of such natural phenomena. The occurrence of such phenomena is discussed in Chapter 2.

On May 22, 1992, Generic Letter 87-02, Supplement 1, transmitted Supplemental Safety Evaluation Report No. 2 (SSER No. 2) on the Seismic Qualification Utility Group (SQUG)

Generic Implementation Procedure, Revision 2, dated February 14, 1992 (GIP-2).

Supplemental Safety Evaluation Report No. 2 approved the methodology in the Generic Implementation Procedure for use in verification of equipment seismic adequacy including equipment involved in future modifications and replacement equipment. In letters dated November 30, 1992, and June 8, 1993, the NRC accepted RG&Es response to Generic Letter 87-02, Supplement 1.

3.1.2.1.3 General Design Criterion 3 - Fire Protection CRITERION: Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions. Noncombustible and heat resistant materials shall be used wherever practical throughout the unit, particularly in locations such as the containment and control room. Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse effects of fires on structures, systems, and components important to safety. Fire-fighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capability of these structures, systems, and components (GDC 3).

Fire detection and fighting systems of appropriate capacity and capability are provided to minimize the adverse effects of fire on structures, systems, and components important to safety. Sensing devices include both ionization chambers (smoke detectors) and temperature detectors. Fire-fighting equipment includes automatic water suppression in appropriate areas.

Page 38 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Automatically initiated Halon 1301 total flooding systems are provided in the relay room and computer room. Appropriate hoses and portable fire-fighting equipment are placed throughout the plant. The fire protection system and compliance with NRC requirements and guidelines are discussed in Section 9.5.1.

3.1.2.1.4 General Design Criterion 4 - Environmental and Missile Design Bases CRITERION: Structures, systems, and components important to safety shall be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents. These structures, systems, and components shall be appropriately protected against dynamic effects, including the effects of missiles, pipe whipping, and discharging fluids, that may result from equipment failures and from events and conditions outside the nuclear power unit (GDC 4).

A comprehensive review has been performed to ensure proper environmental qualification of safety-related electrical equipment, in accordance with 10 CFR 50.49. This is discussed in detail in Section 3.11. Also, a review of postulated pipe breaks inside and outside containment was conducted as part of the Systematic Evaluation Program (SEP) including dynamic effects such as pipe whip and jet impingement. This is discussed in Section 3.6.

Finally, internally generated missiles, tornado missiles, and site proximity missiles, including aircraft, were reviewed as part of the SEP and are discussed in Section 3.5.

3.1.2.1.5 General Design Criterion 5 - Sharing of Structures, Systems, and Components CRITERION: Structures, systems, and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and cooldown of the remaining units (GDC 5).

The R. E. Ginna Nuclear Power Plant is a single unit installation.

3.1.2.2 Protection by Multiple Fission Product Barriers These criteria are intended to ensure that designs provide the reactor unit with multiple barriers which remain intact during MODES 1 and 2 and all anticipated transients and that adequate barriers are available for design-basis accidents. In addition, these criteria are intended to identify and define the instrumentation and control systems, electrical power systems, and control room requirements required for MODES 1 and 2, anticipated operational occurrences, and for accident condition.

3.1.2.2.1 General Design Criterion 10 - Reactor Design CRITERION: The reactor core and associated coolant, control, and protection systems shall be designed with appropriate margin to assure that specified acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences (GDC 10).

Page 39 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The reactor core design, in combination with coolant, control, and protection systems, provides margins to ensure that fuel is not damaged during MODES 1 and 2 or as a result of anticipated operational transients.

The DNB correlations have been used to predict the DNB flux and location of DNB for axially uniform and nonuniform heat flux distributions. For operation within the Technical Specification limits, the DNBR during steady-state operation and anticipated transients is limited to specific safety values.

The reactor control and protective system also prevents the power level or system temperature or pressure from exceeding limits that would result in a DNBR of less than the limiting values for anticipated transients (see Chapter 4).

3.1.2.2.2 General Design Criterion 11 - Reactor Inherent Protection CRITERION: The reactor core and associated coolant systems shall be designed so that in the power operating range the net effect of the prompt inherent nuclear feedback characteristics tends to compensate for a rapid increase in reactivity (GDC 11).

The reactor core and associated coolant systems have been designed so that in the power operating range the net effect of the prompt nuclear feedback characteristics tends to compensate for a rapid increase in reactivity.

The moderator temperature coefficient is usually, though not always, negative. The moderator pressure and density coefficients are not usually negative; however, the overall power coefficient (due to the doppler coefficient) is negative and so provides a nuclear feedback characteristic to limit a rapid increase in reactivity.

3.1.2.2.3 General Design Criterion 12 - Suppression of Reactor Power Oscillations CRITERION: The reactor core and associated coolant, control, and protection systems shall be designed to assure that power oscillations which can result in conditions exceeding specified acceptable fuel design limits are not possible or can be reliably and readily detected and suppressed (GDC 12).

The reactor core and the associated coolant, control, and protection systems, and operating strategies have been designed to prevent or easily suppress power oscillations that could result in exceeding fuel design limits.

3.1.2.2.4 General Design Criterion 13 - Instrumentation and Control CRITERION: Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges (GDC 13).

Page 40 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Instrumentation and controls essential to avoid undue risk to the health and safety of the public are provided to monitor and maintain containment pressure, neutron flux, primary coolant pressure, flow rate, temperature, and control rod positions within prescribed operating ranges.

The fission process is monitored and controlled for all conditions from the source range through the power range. The neutron monitoring system detects core conditions that could potentially threaten the overall integrity of the fuel barrier due to excess power generation and provides a corresponding signal to the Reactor Trip System (RTS). In addition to the ex-core neutron monitoring system, movable in-core instrumentation provides the capability of mapping the core.

The nonnuclear regulating, process, and containment instrumentation measures temperatures, pressure, flow, and levels in the reactor coolant system, steam systems, containment and other auxiliary systems. Process variables required on a continuous basis for the startup, operation, and shutdown of the plant are indicated, recorded, and controlled from the control room. The quantity and types of process instrumentation provided ensures safe and orderly operation of all systems and processes over the full operating range of the plant.

The instrumentation and control systems are discussed in Chapter 7.

3.1.2.2.5 General Design Criterion 14 - Reactor Coolant Pressure Boundary CRITERION: The reactor coolant pressure boundary shall be designed, fabricated, erected, and tested so as to have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture (GDC 14).

All piping components and supporting structures of the reactor coolant system were designed as Class I and later reevaluated as Seismic Category I equipment as defined in Section 3.7.

All pressure containing components of the reactor coolant system were designed, fabricated, inspected, and tested in conformance with the code requirements listed in Table 5.2-1.

Therefore, the probability of abnormal leakage, of rapidly propagating failure and of gross rupture is very low.

3.1.2.2.6 General Design Criterion 15 - Reactor Coolant System Design CRITERION: The reactor coolant system and associated auxiliary, control, and protection systems shall be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences (GDC 15).

The reactor coolant system and associated auxiliary, control, and protection systems were designed with sufficient margins so that design conditions are not exceeded during MODES 1 and 2 including anticipated operational occurrences. The normal operating pressure is 2235 psig with design pressure being 2485 psig. This provides a reasonable range for maneuvering during operation with allowance for pressure transients without actuation of the safety valves.

The analysis presented in Chapter 15 demonstrates the ability of the plant to safely undergo all anticipated transients with pressure peaks below 2485 psig.

Page 41 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Overpressurization is prevented by a combination of automatic control and pressure relief devices. The pressurizer safety valves (2485 psig setpoint) and pressurizer power operated relief valves (2335 psig setpoint) prevent overpressuring the reactor coolant system (RCS) during operation at rated power. Cold overpressure protection of the RCS is provided by the pressurizer power operated relief valves (PORV). The PORV lift setting is switched to Low Temperature Overpressure Protection (LTOP) control (lift setting 410 psig) prior to reducing RCS temperature below 330F or placing the residual heat removal system in service.

3.1.2.2.7 General Design Criterion 16 - Containment Design CRITERION: Reactor containment and associated systems shall be provided to establish an essentially leaktight barrier against the uncontrolled release of radioactivity to the environment and to assure that the containment design conditions important to safety are not exceeded for as long as postulated accident conditions require (GDC 16).

The building containing the reactor and primary system is a reinforced-concrete structure prestressed in the vertical direction, with a welded steel liner on the inside. The structure contains a free volume of approximately 1,000,000 ft3 and is designed for an internal pressure of 60 psig. Prior to initial operation, the containment was strength tested at 69 psig and then was leak tested. The acceptance criterion for the preoperational leakage test was established as 0.1% per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 60 psig.

Reports on the Structural Integrity Test of Reactor Containment Structure and Pre-operational Integrated Leak Rate Test of the Reactor Containment Building were submitted to the AEC.

The leakage rate at 60 psig was determined to be 0.0219 .0168% per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Periodic leak rate measurements as defined in the Technical Specifications ensure that the containment structure provides an essentially leaktight barrier against the uncontrolled release of radioactivity to the environment. Periodic inspection of prestressed tendons as well as periodic integrated leak rate tests, as defined in the Technical Specifications, ensure the continued structural integrity of the containment structure.

A containment spray system and fan coolers are provided to mitigate the consequences of a loss-of-coolant accident. More details on the containment system can be found in Sections 6.2 and 3.8.

3.1.2.2.8 General Design Criterion 17 - Electrical Power Systems CRITERION: An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

Page 42 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integrity, and other vital safety functions are maintained.

Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies (GDC 17).

Onsite and offsite electrical power systems are provided to permit functioning of structures, systems, and components important to safety. Each system provides sufficient capacity and capability to ensure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences, and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

Two completely independent and redundant emergency diesel-generator systems are provided as well as two completely separate and independent station battery systems.

Offsite power is supplied by two separate sources. One source comes from the 115-kV system through a 115-kV to 34.5-kV step-down transformer and station auxiliary (startup) transformer 12A and the second from the 115-kV system through a 115-kV to 34.5-kV step-down transformer and station auxiliary (startup) transformer 12B. The station auxiliary transformers (12A and 12B) are the normal offsite power sources to the safeguards buses. In the event of a failure of both station auxiliary transformers, the unit auxiliary transformer (11) can be used as a backup supply. This transformer can be used by disconnecting a flexible connection on the isolated phase bus at the generator terminals and backfeeding from the 115-kV system through the main transformer.

Diesels and batteries are tested according to the requirements of the Technical Specifications.

Both the onsite and offsite power systems would be available following a loss-of-coolant accident in time to ensure that core cooling, containment integrity, and other vital safety functions are maintained. More detailed information on the electrical systems can be found in Chapter 8.

Page 43 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.2.2.9 General Design Criterion 18 - Inspection and Testing of Electrical Power Systems CRITERION: Electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important areas and features, such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their components. The systems shall be designed with a capability to test periodically (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and (2) the operability of the systems as a whole and, under conditions as close to design as practical, the full operation sequence that brings the systems into operation, including operation of applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system (GDC 18).

The electrical power systems are designed with the capability of periodic testing for operability. Components of the systems, i.e., onsite power sources, relays, and switches, are similarly capable of being periodically tested. Passive components such as wiring, connections, switchboards, and buses are capable of periodic inspection.

Verification of operability of the systems as a whole, including transfer of power, is described in Chapter 8. Operability of the systems in accordance with design conditions was verified by preoperational testing and periodic testing of the systems is required by the Technical Specifications.

3.1.2.2.10 General Design Criterion 19 - Control Room CRITERION: A control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions, including loss-of-coolant accidents.

Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent to any part of the body, for the duration of the accident. Equipment at appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures (GDC 19).

The station is equipped with a control room which contains controls and instrumentation as necessary for operation of the reactor and turbine generator under normal and accident conditions.

The control room is capable of continuous occupancy by the operating personnel under all operating and accident conditions, within specified dose limits. See Section 6.4.

Page 44 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Although the likelihood of conditions which could render the main control room inaccessible even for a short time is extremely small, provisions have been made so that plant operators can shut down and maintain the plant in a safe condition by means of controls located outside the control room. During such a period of control room inaccessibility, the reactor will be tripped and the plant maintained in a safe shutdown condition. This is described in Section 7.4.3.

3.1.2.3 Protection and Reactivity Control Systems These criteria are intended to identify and establish requirements for functional reliability, inservice testability, redundancy, physical and electrical independence and separation, and fail-safe design of the systems that are essential to the reactor protection functions. In addition, these criteria are intended to establish (1) the reactor core reactivity insertion rate limit and (2) the means of control of the reactor within these limits.

3.1.2.3.1 General Design Criterion 20 - Protection Systems Functions CRITERION: The protection system shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety (GDC 20).

A plant protection system, as described in Section 7.2 is provided to automatically initiate appropriate action whenever specific plant conditions reach preestablished limits. These limits ensure that specified fuel design limits are not exceeded when anticipated operational occurrences happen. In addition, other protective instrumentation is provided to initiate actions which mitigate the consequences of an accident. The Ginna Station installation meets the requirements of Criterion 20.

3.1.2.3.2 General Design Criterion 21 - Protection System Reliability and Testability CRITERION: The protection system shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

The protection system shall be designed to permit periodic testing of its functioning when the reactor is in operation, including a capability to test channels including a capability to test channels independently to determine failures and losses of redundancy that may have occurred (GDC 21).

Sufficient redundancy and independence are designed into the Reactor Trip System (RTS) to ensure that no single failure results in loss of protection function. The system is designed such that it will accommodate any single component failure and still perform its protective function.

Page 45 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Reliability and independence is obtained by redundancy within each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate primary sensors. Each channel is continuously fed from its own independent electrical sources.

Failure to deenergize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event.

All reactor protection channels are supplied with sufficient redundancy to provide the capability for channel calibration and test at power. Bypass removal of one trip circuit is accomplished by placing that circuit in a half-tripped mode; i.e., a two-out-of-three circuit becomes a one-out-of-two circuit. Testing does not trip the system unless a trip condition exists in a concurrent channel.

Detailed information verifying compliance with this criterion is in Section 7.2 and in the Technical Specifications.

3.1.2.3.3 General Design Criterion 22 - Protection System Independence CRITERION: The protection system shall be designed to assure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function, or shall be demonstrated to be acceptable on some other defined basis.

Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent practical to prevent loss of the protection function (GDC 22).

The Ginna Station protection system was designed so that the effects of natural phenomena and of normal operating, maintenance, testing, and postulated accident conditions do not result in the loss of the protective function. The design includes the techniques of functional diversity or diversity in components design and principles of operation to the extent practical in preventing the loss of the protection functions. Specific information about system independence is covered in Section 7.2.2.

3.1.2.3.4 General Design Criterion 23 - Protection System Failure Modes CRITERION: The protection system shall be designed to fall into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air),

or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, and radiation) are experienced (GDC 23).

The Reactor Trip System (RTS) is designed to fail-safe upon loss of power. Each reactor trip circuit is designed so that trip occurs when the circuit is deenergized; an open circuit or loss of channel power, therefore, causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from independent electrical buses. Failure to deenergize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event.

Page 46 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on each drive, allowing the rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power. Automatic starting of either emergency diesel generator is initiated by redundant undervoltage relays on the 480-V safeguards bus with which the diesel generator is associated, or by the safety injection signal. Engine cranking is accomplished by a stored energy system supplied solely for the associated diesel generator.

The undervoltage relay scheme is designed so that loss of 480-V power does not prevent the relay scheme from functioning properly.

Environmental and seismic qualification requirements are met as required for specified protection system equipment.

Chapters 7 and 8 discuss compliance with this criterion.

3.1.2.3.5 General Design Criterion 24 - Separation of Protection and Control Systems CRITERION: The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired (GDC 24).

The Reactor Trip System (RTS) is physically and electrically separate from the control systems such that failure of any single control component or channel, or removal from service, leaves the system satisfying the reliability, redundancy, and independence requirements of the Reactor Trip System (RTS). Information supporting compliance with this criterion is in Section 7.2.5.

3.1.2.3.6 General Design Criterion 25 - Protection System Requirements for Reactivity Control Malfunctions CRITERION: The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods (GDC 25).

The Reactor Trip System (RTS) is designed to ensure that the specified fuel design limits are not exceeded for any single malfunction of the reactivity control systems. Reactor shutdown with rods is completely independent of the normal control functions. The trip breakers interrupt the power to the rod mechanisms to trip the reactor regardless of existing control signals.

Details of the effects of continuous withdrawal of a control rod assembly and of continuous deboration are discussed in Sections 15.4.1 and 15.4.4.

Page 47 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.2.3.7 General Design Criterion 26 - Reactivity Control System Redundancy and Capability CRITERION: Two independent reactivity control systems of different design principles shall be provided. One of the systems shall use control rods, preferably including a positive means for inserting the rods, and shall be capable of reliably controlling reactivity changes to assure that under conditions of normal operation, including anticipated operational occurrences, and with appropriate margin for malfunctions such as stuck rods, specified acceptable fuel design limits are not exceeded. The second reactivity control system shall be capable of reliably controlling the rate of reactivity changes resulting from planned, normal power changes (including xenon burnout) to assure acceptable fuel design limits are not exceeded. One of the systems shall be capable of holding the reactor core subcritical under cold conditions (GDC 26).

One of the two reactivity control systems employs control rod drive mechanisms to regulate the position of silver-indium-cadmium neutron absorbers within the reactor core. The control rods are designed to shut down the reactor with adequate margin for all anticipated occurrences so that fuel design limits are not exceeded. The other reactivity control system employs the chemical and volume control system to regulate the concentration of boric acid neutron absorber in the reactor coolant system. The chemical and volume control system is capable of controlling the reactivity change resulting from planned normal power changes.

Reactivity control system redundancy and capability are discussed in detail in Sections 4.3 and 9.3.4.

3.1.2.3.8 General Design Criterion 27 - Combined Reactivity Control System Capability CRITERION: The reactivity control systems shall be designed to have a combined capability, in conjunction with poison addition by the Emergency Core Cooling System (ECCS), of reliably controlling reactivity changes to assure that under postulated accident conditions and with appropriate margin for stuck rods the capability to cool the core is maintained (GDC 27).

The reactivity control systems in conjunction with boron addition through the Emergency Core Cooling System (ECCS) has the capability of controlling reactivity changes under postulated accident conditions with appropriate margins for stuck rods.

Ginna Station is provided with the means of making and holding the core subcritical under any anticipated conditions and with appropriate margin for contingencies. Combined use of the rod cluster control system and the chemical shim control system permit the necessary shutdown margin to be maintained during long-term xenon decay and plant cooldown, even with the single highest worth control rod stuck out.

In a loss-of-coolant accident the safety injection system is actuated and concentrated boric acid is injected into the cold legs of the reactor coolant system. This is in addition to the boric acid content of the accumulators which is passively injected on a decrease in system pressure.

See Section 6.3 and Section 4.2.1 for further details.

Page 48 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.2.3.9 General Design Criterion 28 - Reactivity Limits CRITERION: The reactivity control systems shall be designed with appropriate limits on the potential amount and rate of reactivity increase to assure that the effects of postulated reactivity accidents can neither (1) result in damage to the reactor coolant pressure boundary greater than limited local yielding nor (2) sufficiently disturb the core, its support structures or other reactor pressure vessel internals to impair significantly the capability to cool the core. These postulated reactivity accidents shall include consideration of rod ejection (unless prevented by positive means), rod dropout, steam line rupture, changes in reactor coolant temperature and pressure, and cold water addition (GDC 28).

The maximum reactivity worth of control rods and the maximum rates of reactivity insertion employing control rods are limited by the design of the facility to values which prevent failure of the coolant pressure boundary or disruptions of the core or vessel internals to a degree which could impair the effectiveness of emergency core cooling. Section 4.2.1 discusses the design basis in meeting this criterion, and Chapter 15 discusses the accident analyses and the relationship of the reactivity insertion rates to plant safety. The Core Operating Limits Report (COLR) includes appropriate graphs showing the maximum permissible insertion limits and overlap of rod cluster control assembly banks as a function of power.

3.1.2.3.10 General Design Criterion 29 - Protection Against Anticipated Operational Occurrences CRITERION: The protection and reactivity control systems shall be designed to assure an extremely high probability of accomplishing their safety functions in the event of anticipated operational occurrences (GDC 29).

The protection and reactivity control systems are designed to ensure extremely high reliability in regard to their required safety functions in any anticipated operational occurrences.

Anticipated failure modes of system components are designed to be safe modes. Equipment used in these systems is designed, constructed, operated, and maintained with a high level of reliability. Loss of power to the protection system will result in a reactor trip.

3.1.2.4 Fluid Systems These criteria are intended to (1) identify those nuclear safety systems within the general category of fluid systems, (2) examine each one for capability, redundancy, testability, and inspectability, and (3) ensure that each safety feature capability encompasses all the anticipated and credible phenomena associated with the operational transients or design-basis accidents.

In addition, these criteria are intended to establish the design requirements for the reactor coolant pressure boundary and to identify the means for satisfying these design requirements.

3.1.2.4.1 General Design Criterion 30 - Quality of Reactor Coolant Pressure Boundary CRITERION: Components which are part of the reactor coolant pressure boundary shall be designed, fabricated, erected, and tested to the highest quality standards Page 49 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS practical. Means shall be provided for detecting and, to the extent practical, identifying the location of the source of reactor coolant leakage (GDC 30).

Quality standards of material selection, design, fabrication, and inspection for the Ginna reactor coolant system conformed to the applicable provisions of recognized codes and good nuclear practice of that period. Details of the quality assurance programs, test procedures, and inspection acceptance levels are given in Section 17.1. Particular emphasis was placed on the assurance of quality of the reactor vessel to obtain material whose properties are uniformly within tolerances appropriate to the application of the design methods of the code used. Table 3.2-1 gives the code requirements used for the reactor coolant system.

Leakage detection systems are described in Section 5.2.5.

3.1.2.4.2 General Design Criterion 31 - Fracture Prevention of Reactor Coolant Pressure Boundary CRITERION: The reactor coolant pressure boundary shall be designed with sufficient margin to assure that when stressed under operating, maintenance, testing, and postulated accident conditions (1) the boundary behaves in a nonbrittle manner and (2) the probability of rapidly propagating fracture is minimized. The design shall reflect consideration of service temperatures and other conditions of the boundary material under operating, maintenance, testing, and postulated accident conditions and the uncertainties in determining (1) material properties, (2) the effects of irradiation on material properties, (3) residual, steady-state and transient stresses, and (4) size of flaws (GDC 31).

The reactor coolant pressure boundary was fabricated, inspected and tested in accordance with codes (i.e., ASME Boiler and Pressure Vessel Code and the ASA Code for Pressure Piping) that were applicable at the time of fabrication and installation. An evaluation of the Ginna reactor vessel concluded that the Ginna vessel met the ASME,Section III, fracture toughness requirements (see Section 5.3.1.2).

A maximum initial NDTT for the vessel shell material was established as 40F. Curves for heatup and cooldown limitations are in the Pressure and Temperature Limits Report (PTLR) and are based upon an initial NDTT of 40F. These curves are periodically updated to ensure operation within the required stress limits. Specimens of the vessel, weld material, and heat affected zone are located within the core region to permit periodic monitoring of exposure and material properties relative to control samples, as defined in the Pressure and Temperature Limits Report (PTLR). Following installation of the Ex-Vessel Neutron Dosimetry modification, radiometric monitors and gradient chains are used for this purpose.

Preservice ultrasonic inspection of the reactor vessel and primary system piping welds was performed and an inservice inspection program, as defined in the Technical Specifications, is maintained.

The heatup and cooldown rates during plant life are predicted using conservative values for the change in NDTT due to irradiation. Operating limitations during startup and shutdown of the reactor coolant systems were evaluated using Appendix G, Protection Against Non-Ductile Failure, of the ASME Code,Section III, fracture toughness rules (Code Case 1514)

Page 50 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Heatup and cooldown curves in accordance with the method of Appendix G of Section III ASME Code showed that the Pressure and Temperature Limits Report (PTLR) limits were very conservative.

Reactor vessel integrity has been evaluated as part of the SEP Topic V-6, Reactor Vessel Integrity (NUREG 0569), and unresolved safety issues A-49, Pressurized Thermal Shock, and A-11, Reactor Vessel Materials Toughness. Information on these evaluations is provided in Section 5.3.3.

Steady-state and transient analyses are presented in Chapter 15. These analyses demonstrate that the design of the vessel meets the necessary requirements. Inspections ensure that the probability of undetected and rapidly propagating fracture of the reactor coolant system is minimized.

3.1.2.4.3 General Design Criterion 32 - Inspection of Reactor Coolant Pressure Boundary CRITERION: Components which are part of the reactor coolant pressure boundary shall be designed to permit (1) periodic inspection and testing of important areas and features to assess their structural and leak tight integrity, and (2) an appropriate material surveillance program for the reactor pressure vessel (GDC 32).

Inservice inspections of the reactor coolant pressure boundary and methods and frequencies for performing these inspections have been developed. The inspection program developed includes interpretation and analysis of the results employing the latest techniques available at the time of inspection. This program is described in the Technical Specifications and in Section 5.2.4.

3.1.2.4.4 General Design Criterion 33 - Reactor Coolant Makeup CRITERION: A system to supply reactor coolant makeup for protection against small breaks in the reactor coolant pressure boundary shall be provided. The system safety function shall be to assure that specified acceptable fuel design limits are not exceeded as a result of reactor coolant loss due to leakage from the reactor coolant pressure boundary and rupture of small piping or other small components which are part of the boundary. The system shall be designed to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished using the piping, pumps, and valves used to maintain coolant inventory during normal reactor operation (GDC 33).

The chemical and volume control system provides a means of reactor coolant makeup and adjustment of the boric acid concentration. Normally, makeup is added automatically from the boric acid blend system to the suction of the positive displacement charging pumps when the volume control tank falls below a preset level. Further decrease in the level of the volume control tank requires a valve alignment to the refueling water storage tank (RWST). The charging pumps, of which there are three, are capable of injecting coolant into the reactor Page 51 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS coolant system at a rate of 60 gpm each when powered from either the onsite or offsite electric power systems.

Protection against small breaks in the reactor coolant system is afforded by low level in the pressurizer which initiates isolation of the normal letdown purification path of the chemical and volume control system. Charging flow should then be sufficient to compensate for break flow.

For larger breaks, the resultant loss of pressure will cause reactor trip and initiation of safety injection. These counter measures will limit the consequences of the accident in two ways:

1. Reactor trip and borated water injection will supplement void formation in causing rapid reduction of the nuclear power to a residual level corresponding to delayed fissions and fission product decay.

2. Injection of borated water ensures sufficient flooding of the core to prevent excessive temperatures.

3.1.2.4.5 General Design Criterion 34 - Residual Heat Removal CRITERION: A system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded.

Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure (GDC 34).

The residual heat removal system, in conjunction with the steam power conversion system, is designed to transfer the fission product decay heat and other residual heat from the reactor core at a rate such that design limits of the fuel and the primary system coolant boundary are not exceeded. Suitable redundancy is provided with two residual heat removal pumps and two heat exchangers. The residual heat removal system is able to operate on either onsite or offsite power systems. Details of the system design are given in Section 5.4.5.

3.1.2.4.6 General Design Criterion 35 - Emergency Core Cooling CRITERION: A system to provide abundant emergency core cooling shall be provided. The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and (2) clad metal-water reaction is limited to negligible amounts.

Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is Page 52 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure (GDC 35).

The Emergency Core Cooling System (ECCS) are provided to cope with any loss-of-coolant accident due to a pipe rupture. Cooling water would be available in an emergency to transfer heat from the core at a rate sufficient to maintain the core in a coolable geometry and to ensure that the clad metal-water reaction is limited. The Emergency Core Cooling System (ECCS) are capable of meeting the requirements of 10 CFR 50.46 and 10 CFR 50, Appendix K. Adequate design provisions are made to ensure performance of the required safety functions even with a single failure, assuming that electrical power is available from either the offsite or the onsite electrical power system. Emergency core cooling is discussed in Section 6.3.

3.1.2.4.7 General Design Criterion 36 - Inspection of Emergency Core Cooling System (ECCS)

CRITERION: The Emergency Core Cooling System (ECCS) shall be designed to permit appropriate periodic inspection of important components, such as spray rings in the reactor pressure vessel, water injection nozzles, and piping, to assure the integrity and capability of the system (GDC 36).

Important components of the Emergency Core Cooling System (ECCS) are examined on a periodic basis as defined in the Inservice Inspection Program. Except for the low-head safety injection nozzles on the reactor vessel, all other connections are either directly or indirectly to the primary system piping, thus being more accessible for examination. Periodic ultrasonic and visual inspection using remote equipment is performed on the low-head safety injection nozzles.

Valves and piping are periodically inspected visually with nondestructive inspections being performed where appropriate. The components located outside containment are accessible for leaktightness inspection during operation.

3.1.2.4.8 General Design Criterion 37 - Testing of Emergency Core Cooling Systems (ECCS)

CRITERION: The Emergency Core Cooling System (ECCS) shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leaktight integrity of its components, (2) the operability and performance of the active components of the system, and (3) the operability of the system as a whole and, under conditions as close to design as practical, the performance of the full operational sequence that brings the system into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of the associated cooling water system (GDC 37).

Components of Emergency Core Cooling System (ECCS) located outside the containment are accessible for leaktightness inspection during periodic tests.

Page 53 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS All of the pumps of the Emergency Core Cooling System (ECCS) are started at intervals as specified in the Inservice Testing Program. Valve operability as well as system operability tests are performed during the MODE 6 (Refueling) shutdowns to demonstrate proper automatic operation of the Emergency Core Cooling System (ECCS). The required surveillance tests are described in the Technical Specifications.

3.1.2.4.9 General Design Criterion 38 - Containment Heat Removal CRITERION: A system to remove heat from the reactor containment shall be provided. The system safety function shall be to reduce rapidly, consistent with the functioning of other associated systems, the containment pressure and temperature following any loss-of-coolant accident and maintain them at acceptably low levels.

Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure (GDC 38).

Two systems based on different principles are provided to remove heat from the containment following an accident in order to maintain the pressure below the containment design pressure.

Containment spray is supplied from two pumps each being fed from a separate electrical bus.

Two fan coolers are fed from one safeguards bus with the other two being fed from another safeguards bus. Power is supplied from either the normal supply or from the associated emergency diesel. These systems are discussed in Section 6.2.2.

3.1.2.4.10 General Design Criterion 39 - Inspection of Containment Heat Removal System CRITERION: The containment heat removal system shall be designed to permit appropriate periodic inspection of important components, such as the torus, sumps, spray nozzles, and piping to assure the integrity and capability of the system (GDC 39).

The two containment heat removal systems can receive appropriate periodic inspection of important components. Containment spray nozzles are tested by blowing air or smoke into the spray rings and checking each nozzle for flow. Periodic testing of the pumps is also done.

Besides their safeguards role, the containment fan coolers are routinely used during operation to maintain ambient temperature inside the containment at acceptable levels. The periodic testing is described in the Technical Specifications.

3.1.2.4.11 General Design Criterion 40 - Testing of Containment Heat Removal System CRITERION: The containment heat removal system shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leaktight integrity of its components, (2) the operability and performance of the active components of the system, and (3) the operability of the system as a whole, and, under conditions as close to the design as practical, the performance of the full Page 54 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS operational sequence that brings the system into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of the associated cooling water system (GDC 40).

The containment heat removal systems have the capability of being periodically tested as follows:

1. Containment fan cooler system.

a. The containment fan-cooler units are used during MODES 1 and 2 and by those means are continuously monitored.

b. The service water (SW) pumps operate when the reactor is in operation and therefore are continuously monitored.

c. Periodic system tests demonstrate proper automatic operation of the safety injection system. A test signal is applied to initiate automatic action and verify that the components receive the safety injection signal in the proper sequence. The test demonstrates the operability of the valves, circuit breakers, and automatic circuitry.

2. Containment spray system.

a. Design provisions are made to the extent practical to facilitate access for periodic visual inspection of all important components of the containment spray system.

b. Permanent test lines for the containment spray loops are located so that all components up to the isolation valves at the spray nozzles may be tested. These isolation valves are checked separately.

c. The containment spray nozzles are tested by blowing air or smoke through the nozzles and observing the flow.

The required periodic tests are described in the Technical Specifications.

3.1.2.4.12 General Design Criterion 41 - Containment Atmosphere Cleanup CRITERION: Systems to control fission products, hydrogen, oxygen, and other substances which may be released into the reactor containment shall be provided as necessary to reduce, consistent with the functioning of other associated systems, the concentration and quality of fission products released to the environment following postulated accidents, and to control the concentration of hydrogen or oxygen and other substances in the containment atmosphere following postulated accidents to assure that containment integrity is maintained.

Each system shall have suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) its safety function can be accomplished, assuming a single failure (GDC 41).

Page 55 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS There are two systems which are designed to clean up the containment atmosphere after a postulated loss-of-coolant accident:

1. The containment spray system includes the injection of sodium hydroxide solution into the spray into the containment to remove elemental iodine. The system consists of redundant active components each supplied from separate electrical buses. No single active failure will cause both subsystems to fail to operate. This portion of the system is described in Section 6.5.

2. Charcoal filters are placed into the air stream flow of two of the four fan coolers to remove iodine. Each of the fan coolers is provided with a high efficiency particulate air filter bank.

These are described in Section 6.5.

In addition, two recombiner units are installed in the containment. The purpose of these units is to prevent the uncontrolled postaccident buildup of hydrogen concentrations in the containment. These are described in Section 6.2.5 By Reference 3, the NRC removed from the Ginna Technical Specifications the requirements related to the hydrogen recombiners and hydrogen monitors.

3.1.2.4.13 General Design Criterion 42 - Inspection of Containment Atmosphere Cleanup Systems CRITERION: The containment atmosphere cleanup systems shall be designed to permit appropriate periodic inspection of important components, such as filter frames, ducts, and piping to assure the integrity and capability of the systems (GDC 42).

The containment atmosphere cleanup systems, with the exception of the spray headers and nozzles, are designed and located such that they can be inspected periodically as required.

The spray headers and nozzles can be tested as described in the response of Criterion 39 (Section 3.1.2.4.10).

The systems are described in Section 6.2.5 and the surveillance requirements are given in the Technical Specifications.

3.1.2.4.14 General Design Criterion 43 - Testing of Containment Atmosphere Cleanup Systems CRITERION: The containment atmosphere cleanup systems shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leaktight integrity of its components, (2) the operability and performance of the active components of the systems such as fans, filters, dampers, pumps, and valves and (3) the operability of the systems as a whole and, under conditions as close to design as practical, the performance of the full operational sequence that brings the systems into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of associated systems (GDC 43).

Page 56 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The containment atmosphere cleanup systems are tested as described in Criterion 40 (Section 3.1.2.4.11). In addition, the efficiency of the high efficiency particulate air and charcoal filters is checked periodically as required by the Technical Specifications.

3.1.2.4.15 General Design Criterion 44 - Cooling Water CRITERION: A system to transfer heat from structures, systems, and components important to safety, to an ultimate heat sink shall be provided. The system safety function shall be to transfer the combined heat load of these structures, systems, and components under normal operating and accident conditions.

Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure (GDC 44).

The systems provided to transfer heat from safety-related components to the ultimate heat sink of Lake Ontario consist of the service water (SW) and the component cooling water (CCW) systems described in Sections 9.2.1 and 9.2.2, respectively.

Component cooling water is supplied by two redundant pumps (one operating, one standby) which are supplied with power from separate buses. The service water (SW) is supplied by four pumps, two being fed power from one safeguards bus, the other two from another safeguards bus. Only one pump is needed during safe shutdown operation or during the injection phase of a postulated loss-of-coolant accident, and two are required during the recirculation phase of the accident.

The systems are operable from offsite power or from emergency onsite power (from the diesel generators).

No single active failure results in system loss of function for those functions important to safety.

3.1.2.4.16 General Design Criterion 45 - Inspection of Cooling Water System CRITERION: The cooling water system shall be designed to permit appropriate periodic inspection of important components, such as heat exchangers and piping, to assure the integrity and capability of the system (GDC 45).

Important components of the component cooling water (CCW) system are located in areas which are accessible for periodic inspection.

Most of the service water (SW) system piping is buried reinforced concrete pipe which is not readily inspectable; however, there are two redundant service water (SW) supply headers and failure of one would not be expected to affect the operability of the other. The service water (SW) system consists of a single loop header supplied by two separate, 100% capacity, safety related pump trains as described in the Technical Specification Bases.

Page 57 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.2.4.17 General Design Criterion 46 - Testing of Cooling Water System CRITERION: The cooling water system shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leaktight integrity of its components, (2) the operability and the performance of the active components of the system, and (3) the operability of the system as a whole and, under conditions as close to design as practical, the performance of the full operational sequence that brings the system into operation for reactor shutdown and for loss-of-coolant accidents, including operation of applicable portions of the protection system and the transfer between normal and emergency power sources (GDC 46).

Redundancy and isolation are provided to allow periodic pressure and functional testing of the system as a whole, including the functional sequence that initiates system operation, and the transfer between the normal and diesel power sources. One of the redundant pumps in the component cooling water (CCW) system is in service during MODES 1 and 2.

During routine plant operation two (2) Service Water (SW) pumps are typically in operation; however, during the summer three service water (SW) pumps are in operation. See Section 9.2.1 for a current discussion of requirements for pump operation.

3.1.2.5 Reactor Containment These criteria are intended to establish the design requirements for the primary containment and to identify the means for satisfying these requirements, including fracture prevention leakage testing, containment testing, inspection, and isolation.

3.1.2.5.1 General Design Criterion 50 - Containment Design Basis CRITERION: The reactor containment structure, including access openings, penetrations, and the containment heat removal system shall be designed so that the containment structure and its internal compartments can accommodate, without exceeding the design leakage rate and, with sufficient margin, the calculated pressure and temperature conditions resulting from any loss-of-coolant accident. This margin shall reflect consideration of (1) the effects of potential energy sources which have not been included in the determination of the peak conditions, such as energy in steam generators and energy from metal-water and other chemical reactions that may result from degraded emergency core cooling functioning, (2) the limited experience and experimental data available for defining accident phenomena and containment responses, and (3) the conservatism of the calculational model and input parameters (GDC 50).

The reactor containment structure, penetrations, valves, access openings, and the containment spray system are designed with margin to accommodate the temperature and pressure conditions associated with the loss-of-coolant accident and main steam line break, without loss of function.

Page 58 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The design of the containment is based on a postulated main steam line break or a double-ended rupture of a reactor coolant pipe, coupled with partial loss of the redundant engineered safety features systems (minimum engineered safety features).

The containment integrity evaluation is provided in Section 6.2.1.2.

3.1.2.5.2 General Design Criterion 51 - Fracture Prevention of Containment Pressure Boundary CRITERION: The reactor containment boundary shall be designed with sufficient margin to assure that under operating, maintenance, testing, and postulated accident conditions (1) its ferritic materials behave in a nonbrittle manner and (2) the probability of rapidly propagating fracture is minimized. The design shall reflect consideration of service temperatures and other conditions of the containment boundary material during operation, maintenance, testing, and postulated accident conditions, and the uncertainties in determining (1) material properties, (2) residual, steady-state, and transient stresses, and (3) size of flaws (GDC 51).

The concrete containment is not susceptible to a low-temperature brittle fracture.

The containment liner is enclosed within the containment and thus is not exposed to the temperature extremes of the environs. The containment ambient temperature during operation is between 50F and 125F. The minimum service metal temperature of the containment liner is well above the NDTT + 30F for the liner material. Containment penetrations which can be exposed to the environment are also designed to the NDTT + 30F criterion.

3.1.2.5.3 General Design Criterion 52 - Capability for Containment Leakage Rate Testing CRITERION: The reactor containment and other equipment which may be subjected to containment test conditions shall be designed so that periodic integrated leakage rate testing can be conducted at containment design pressure (GDC 52).

The containment system is designed and constructed and the necessary equipment is provided to permit periodic integrated leakage rate tests during plant lifetime. Most of these periodic integrated leakage rate tests of the containment system were conducted at 58% of the reactor building design pressure (35 psig). However, periodic integrated leakage rate tests will be conducted at design pressure at intervals as described in the Containment Leakage Rate Testing Program.

3.1.2.5.4 General Design Criterion 53 - Provisions for Containment Testing and Inspection CRITERION: The reactor containment shall be designed to permit (1) appropriate periodic inspection of all important areas, such as penetrations, (2) an appropriate surveillance program, and (3) periodic testing at containment design pressure of the leaktightness of penetrations which have resilient seals and expansion bellows (GDC 53).

Page 59 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS There are special provisions for conducting individual leakage rate tests on applicable penetrations. Penetrations will be visually inspected and pressure tested for leaktightness at periodic intervals. Provisions have been made for an inservice tendon surveillance program throughout the life of the plant intended to provide sufficient inservice historic evidence to maintain confidence that the integrity of the containment is being preserved.

3.1.2.5.5 General Design Criterion 54 - Piping Systems Penetrating Containment CRITERION: Piping systems penetrating primary reactor containment shall be provided with leak detection, isolation, and containment capabilities having redundancy, reliability, and performance capabilities which reflect the importance to safety of isolating these piping systems. Such piping systems shall be designed with a capability to test periodically the operability of the isolation valves and associated apparatus and to determine if valve leakage is within acceptable limits (GDC 54).

Piping systems penetrating containment are designed to provide the required isolation and testing capabilities. These piping systems are provided with test connections as necessary to allow periodic leak detection to be performed. The Engineered Safety Features Actuation System (ESFAS) test circuitry provides the means for testing isolation valve operability.

Details of the containment isolation capability are provided in Section 6.2.4.

3.1.2.5.6 General Design Criterion 55 - Reactor Coolant Pressure Boundary Penetrating Containment CRITERION: Each line that is part of the reactor coolant pressure boundary and that penetrates primary reactor containment shall be provided with containment isolation valves as follows, unless it can be demonstrated that the containment isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis:

1. One locked closed isolation valve inside and one locked closed isolation valve outside containment; or

2. One automatic isolation valve inside and one locked closed isolation valve outside containment; or

3. One locked closed isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment; or

4. One automatic isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment.

Isolation valves outside containment shall be located as close to containment as practical and upon loss of actuating power, automatic isolation valves shall be designed to take the position that provides greater safety.

Page 60 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Other appropriate requirements to minimize the probability or consequences of an accidental rupture of these lines or of lines connected to them shall be provided as necessary to assure adequate safety. Determination of the appropriateness of these requirements, such as higher quality in design, fabrication, and testing, additional provisions for inservice inspection, protection against more severe natural phenomena, and additional isolation valves and containment, shall include consideration of the population density, use characteristics, and physical characteristics of the site environs (GDC 55).

During the design phase of Ginna Station, containment isolation valves were covered by a proposed criterion that existed at that time (AIF-GDC 53): "Penetrations that require closure for the containment function shall be protected by redundant valving and associated apparatus." The design response to this criterion is in Section 3.1.1.7.17.

The criterion in effect during the design phase was met. The compliance with Criterion 55 was reviewed during the Systematic Evaluation Program (Topic VI-4) and is discussed in Section 6.2.4.4.

3.1.2.5.7 General Design Criterion 56 - Primary Containment Isolation CRITERION: Each line that connects directly to the containment atmosphere and penetrates primary reactor containment shall be provided with containment isolation valves as follows, unless it can be demonstrated that the containment isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis:

1. One locked closed isolation valve inside and one locked closed isolation valve outside containment; or

2. One automatic isolation valve inside and one locked closed isolation valve outside containment; or

3. One locked closed isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment; or

4. One automatic isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment.

Isolation valves outside containment shall be located as close to the containment as practical and upon loss of actuating power, automatic isolation valves shall be designed to take the position that provides greater safety (GDC 56).

The review of the Ginna Station containment isolation valve provisions relative to GDC 56 was performed during the Systematic Evaluation Program (Topic VI-4) and is discussed in Section 6.2.4.4.

Page 61 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1.2.5.8 General Design Criterion 57 - Closed System Isolation Valves CRITERION: Each line that penetrates primary reactor containment and is neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere shall have at least one containment isolation valve which shall be either automatic, or locked closed, or capable of remote manual operation. This valve shall be outside containment and located as close to the containment as practical. A simple check valve may not be used as the automatic isolation valve (GDC 57).

The installation of valves was done in accordance with criteria which were applicable at the time (AIF-GDC 53). A review relative to GDC 57 was performed in the Systematic Evaluation Program (Topic VI-4). Compliance with GDC 57 is discussed in Section 6.2.4.4.

3.1.2.6 Fuel and Radioactivity Control These criteria are intended (1) to establish station effluent release limits and to identify the means of controlling releases within these limits, (2) to define the radiation shielding, monitoring, and fission process controls necessary to effectively sense abnormal conditions and initiate required safety systems, and (3) to establish requirements for safe fuel and waste storage systems and to identify the means to satisfy these requirements.

3.1.2.6.1 General Design Criterion 60 - Control of Releases of Radioactive Materials to the Environment CRITERION: The nuclear power unit design shall include means to control suitably the release of radioactive materials in gaseous and liquid effluents and to handle radioactive solid wastes produced during normal reactor operation, including anticipated operational occurrences. Sufficient holdup capacity shall be provided for retention of gaseous and liquid effluents containing radioactive materials, particularly where unfavorable site environmental conditions can be expected to impose unusual operational limitations upon the release of such effluents to the environment (GDC 60).

The handling, control, and release of radioactive materials during MODES 1 and 2 is in compliance with 10 CFR 50, Appendix I, and is described in the Offsite Dose Calculation Manual.

Additional information concerning the liquid and gaseous radwaste systems is provided in Sections 11.2 and 11.3, respectively.

3.1.2.6.2 General Design Criterion 61 - Fuel Storage and Handling and Radioactivity Control CRITERION: The fuel storage and handling, radioactive waste, and other systems which may contain radioactivity shall be designed to assure adequate safety under normal and postulated accident conditions. These systems shall be designed (1) with a capability to permit appropriate periodic inspection and testing of components important to safety, (2) with suitable shielding for radiation protection, (3) with Page 62 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS appropriate containment, confinement, and filtering systems, (4) with a residual heat removal capability having reliability and testability that reflects the importance to safety of decay heat and other residual heat removal, and (5) to prevent significant reduction in fuel storage coolant inventory under accident conditions (GDC 61).

The spent fuel pool (SFP) and cooling system, fuel handling system, radioactive waste processing systems, and other systems that contain radioactivity are designed to ensure adequate safety under normal and postulated accident conditions and are discussed in Section 9.1, and Chapters 11 and 15.

A. Components are designed and located such that appropriate periodic inspection and testing may be performed.

B. All areas of the plant are designed with suitable shielding for radiation protection based on anticipated radiation dose rates and occupancy as discussed in Chapter 12.

C. Individual components which contain significant radioactivity are located in confined areas which are adequately ventilated through appropriate filtering systems.

D. The spent fuel pool (SFP) cooling system provides cooling to remove residual heat from the fuel stored in the spent fuel pool (SFP). The system is designed such that, in addition to permanently installed equipment, temporary connections and equipment can also be utilized.

E. The spent fuel pool (SFP) is designed such that no postulated accident could cause significant loss of coolant inventory.

3.1.2.6.3 General Design Criterion 62 - Prevention of Criticality in Fuel Storage and Handling CRITERION: Criticality in the fuel storage and handling system shall be prevented by physical systems or processes, preferably by use of geometrically safe configurations (GDC 62).

Criticality in new and spent fuel storage areas is prevented both by physical separation of fuel assemblies and by the presence of borated water in the spent fuel storage pool. Criticality prevention is discussed in detail in Section 9.1.2.

3.1.2.6.4 General Design Criterion 63 - Monitoring Fuel and Waste Storage CRITERION: Appropriate systems shall be provided in fuel storage and radioactive waste systems and associated handling areas (1) to detect conditions that may result in loss of residual heat removal capability and excessive radiation levels and (2) to initiate appropriate safety actions (GDC 63).

Monitoring systems are provided to alarm on excessive temperature or low water level in the spent fuel pool (SFP). Appropriate safety actions will be initiated by operator action.

Page 63 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Radiation monitors and alarms are provided as required to warn personnel of impending excessive levels of radiation or airborne activity. The radiation monitoring system is described in Section 12.3.

3.1.2.6.5 General Design Criterion 64 - Monitoring Radioactivity Releases CRITERION: Means shall be provided for monitoring the reactor containment atmosphere, spaces containing components for recirculation of loss-of-coolant accident fluids, effluent discharge paths, and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences, and from postulated accidents (GDC 64).

The containment atmosphere is continually monitored during normal and transient station operations using the containment particulate and gas monitors. In the event of accident conditions, samples of the containment atmosphere will provide data of existing airborne radioactive concentrations within the containment. Radioactivity levels contained in the facility effluent discharge paths and in the environs are continually monitored during normal and accident conditions by the station radiation monitoring system and by the Radiation Protection Program for Ginna Station as described in Sections 11.5 and 12.5.

Page 64 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS REFERENCES FOR SECTION 3.1

1. Deleted

2. NRC Letter P. Milano to M. Korsnick (Ginna), "Modification of the Control Room Emergency Air Treatment System and Change to Dose Calculation Methodology to Alternate Source Term," February 2, 2005.

3. NRC Letter D. M. Skay to M. Korsnick (Ginna), "Amendment Eliminating Requirements for Hydrogen Recombiners and Hydrogen Monitors Using Consolidated Line Item Improvement Process," May 5, 2005.

Page 65 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.2 CLASSIFICATION OF STRUCTURES, COMPONENTS, AND SYSTEMS 3.

2.1 INTRODUCTION

As part of the Systematic Evaluation Program (SEP), Topic III-1, the original codes and standards used in the design of structures, systems, and components at Ginna Station were compared with later licensing criteria based on Regulatory Guide 1.26 (Reference 1) and 10 CFR 50.55a. The objective was to assess the capability of Ginna Station structures, systems, and components to perform their safety functions as judged by the later standards.

Several areas were identified where requirements had changed; however, all areas were satisfactorily resolved as documented in References 2 through 6. The NRC has concluded that SEP Topic III-1 regarding classification of structures, systems, and components is resolved (Reference 6). Section 3.2.2 summarizes the results of the review.

Table 3.2-1 lists systems and components at Ginna Station, the code required to satisfy licensing criteria effective at the time of the SEP review, the codes and standards used when the systems and components were originally produced, the seismic classification in accordance with Regulatory Guide 1.29 (Reference 7), and the seismic classification used in the plant design. It should be noted that the original Ginna Station seismic design included three seismic classes, but the Regulatory Guide 1.29 comparison includes only two (Seismic Category I and nonseismic). Definitions of the original seismic classes are included in Section 3.7.1.1.

The following systems and their respective components are addressed in Table 3.2-1:

• Reactor coolant system.

• Safety injection system.

• Sampling system.

• Containment spray system.

• Chemical and volume control system.

• Residual heat removal system.

• Component cooling water (CCW) system.

• Service water (SW) system.

• Main Steam System

• Feedwater system.

• Preferred Auxiliary feedwater system.

• Standby auxiliary feedwater system.

• Containment isolation system.

3.2.2 SYSTEMATIC EVALUATION PROGRAM EVALUATION After comparing the original codes with those currently used for licensing new facilities, the following areas were identified where the requirements had changed:

Page 66 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

1. Fracture toughness.

2. Quality group classification.

3. Code stress limits.

4. Radiography requirements.

5. Fatigue analysis of piping systems.

It was determined that changes in the areas of quality group classification, code stress limits, and fatigue analysis of piping systems have not affected the safety functions of the Ginna systems and components reviewed. In the remaining two areas (e.g., fracture toughness and radiography requirements), although no significant deviations were identified, the evaluation was incomplete due to insufficient information available at the time of the evaluation.

Additional specific information was requested by the NRC in these two areas and also on the design of certain valves, pumps, and storage tanks. That information is provided in the following sections. The information was submitted to the NRC by Reference 5. The NRC staff reviewed the information and concluded in Reference 6 it was adequate to fully resolve the open issues in SEP Topic III-1 regarding classification of structures, components, and systems.

3.2.2.1 Fracture Toughness For components not exempt from current fracture toughness requirements, the following evaluations were submitted to justify that fracture toughness is sufficient to ensure component integrity.

3.2.2.1.1 Pressurizer The pressurizer evaluation is based on a conservative adaptation of ASME Section NC-2311(a)(8).

In order to make the evaluation, the lowest service temperature (LST) is defined. This is the minimum temperature of the fluid retained by the component or the calculated minimum metal temperature expected during MODES 1 and 2 whenever the pressure within the component exceeds 20% of the preoperational system hydrostatic test pressure.

The hydrostatic test pressure was 3125 psia. Thus, 20% of this pressure is 625 psia. The Ginna Technical Specifications and Pressure and Temperature Limits Report (PTLR) require, for Low Temperature Overpressure Protection (LTOP) System purposes, that reactor coolant system pressure relief setpoint must be lower than 430 psig (setpoint is determined in the PTLR which accounts for instrument uncertainty) whenever reactor coolant system temperature is lower than the enable temperature specified for LTOP in the PTLR or the residual heat removal system is in operation. The lowest service temperature is thus taken as the enable temperature specified for LTOP in the PTLR.

The pressurizer head material is SA-215 WCC, which has a TNDT of 30 F. Thus, the difference between the lowest service temperature and TNDT is 292 F, which is much greater than the acceptance criteria of 90 F. Thus, it can be concluded that the pressurizer head material is exempt from impact testing.

Page 67 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The pressurizer shell material is SA-302 grade B material, the same material as the reactor vessel. This material has been shown to have adequate fracture toughness as concluded in SEP Topic V-6, Reactor Vessel Integrity.

3.2.2.1.2 Accumulators The accumulators are constructed of SA-516, grade 70 material. The TNDT of this material is 0F. The lowest service temperature of the accumulator would be the minimum expected normal containment temperature, approximately 60F during MODE 6 (Refueling) operations. (It should be noted that by procedure the accumulators are isolated from the reactor coolant system during cooldown, when reactor coolant system pressure is about less than or equal to 1500 psig. When the accumulators are in service and connected to the reactor coolant system, containment temperature is maintained less than 125F.) For purposes of this evaluation, the lower figure was used.

The allowable (LST - TNDT) for material up to 2.50-in. thick is 30F. The actual (LST -

TNDT) is 60F. Therefore, the fracture toughness of the accumulators is considered adequate.

3.2.2.1.3 Component Cooling Water (CCW) Pumps The component cooling water (CCW) pump casing is cast iron.

The potential for complete failure of both component cooling water (CCW) pumps due to brittle fracture is considered minimal. One component cooling water (CCW) pump provides all required services; the second pump is a standby pump only. Thus, it is not expected that both pumps would fail. In addition, in 1983 RG&E purchased a spare component cooling water (CCW) pump to be stored on site which could be manually placed in service, if needed.

Thus, based on the number of backup component cooling water (CCW) pumps available, it was not considered that impact testing was required of the component cooling water (CCW) pump material. An evaluation by RG&E later determined that due to the thickness of the piping connected to the component cooling water (CCW) pumps, impact testing was not required by the ASME Code for the pump casing material. This evaluation eliminated the need to maintain a spare pump for the purpose of resolving brittle fracture concerns. (See also section 9.2.2.4.3.)

3.2.2.1.4 Service Water Pumps The service water (SW) pumps are vertical shaft pumps, constructed of cast iron (discharge head) and carbon steel (intake column pipe). It is not considered that brittle fracture is a significant consideration for these pumps. This type of pump has been used in similar commercial applications for many years. It is not known that there have been any problems with brittle fracture of the pump material. Two of the four service water (SW) pumps are needed to perform safe shutdown cooling functions. It is very unlikely that all four pumps would experience simultaneous brittle fracture.

Rochester Gas and Electric has also made modifications during the course of the SEP to minimize the safety requirements for operation of the service water (SW) pumps. Fire hose connections have been provided for the diesel generators and for the standby auxiliary feedwater Page 68 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS system (SAFW) to allow safe shutdown operation, even in the event of a loss of the service water (SW) pumps.

Thus, it is not considered that impact testing is required for the service water (SW) pump material.

3.2.2.1.5 Main Steam Piping and Valves The main steam piping greater than 20 in. is ASTM A155-65, grade C55, Class I. Main steam piping 20 in. and smaller is ASTM A106-65, grade B.

The normal service temperature for the main steam line is 514F to 547F at power.

Although the TNDT of the main steam piping material is not available, the fact that the lowest service temperature during the great majority of the operating time of this system is greater than 500F would indicate that a fracture mechanics evaluation is not required.

3.2.2.1.6 Feedwater Piping and Valves The feedwater piping material is ASTM A106-64, grade C. The normal service temperature of the final feedwater piping during full power operation is approximately 432F. Although the TNDT of these materials is not available, the fact that the lowest service temperature during the great majority of the operating time of the system for final feedwater temperature is greater than 400F would indicate that a fracture mechanics evaluation is not required.

This assessment of the potential for pipe fracture was accepted by the NRC in Reference 6.

3.2.2.2 Radiography Requirements Information on the radiography requirements for (1) certain Class 2 pressure vessels and (2)

Class 1 and 2 welded joints was requested.

3.2.2.2.1 Class 2 Pressure Vessels The vessels in question include the accumulators, volume control tank, reactor coolant filter, seal-water injection filter, and charging pump accumulator. All main seams of the accumulators were required to be fully radiographed per ASME Code, Section 8, Paragraph UW-51 by Westinghouse Equipment Specification 676448, dated March 15, 1967.

The charging pump accumulator (or the charging pump filter) composite record indicates that all butt welds were radiographed.

The above pressure vessels were included in the Ginna Station Inservice Inspection Program for Quality Groups A, B, and C components.

Although these pressure vessels are Class 2 components, their failure would not result in the release of significant amounts of radiation. The failure of the volume control tank was analyzed in Section 15.7.1.2 as a design-basis accident. The radiological consequences of this failure were well within the guidelines of 10 CFR 100.

It was therefore concluded that, based on the original radiography performed on some of the pressure vessels, the inclusion of these pressure vessels in the inservice inspection program Page 69 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS and the minor consequences associated with any potential equipment failures, no additional radiography requirements were warranted.

3.2.2.2.2 Class 1 and 2 Welded Joints It was determined that if the confirmation of Code Case N-7 (B31.1) was applied to all Class 1 and 2 piping, the radiography requirements for Class 1 and 2 welded joints would not be an issue.

Rochester Gas and Electric has confirmed that Code Case N-7 was used specifically for certain Class 1 and Class 2 piping systems, such as the primary loop and the safety injection system. In the specifications for other Westinghouse supplied systems, the statement is made that ASA B31.1 and all applicable nuclear code cases would be used. No specific mention of Code Case N-7 is made for these systems. However, Westinghouse Equipment Specification 676262, dated April 29, 1966, provides the weld inspection schedule for Westinghouse-supplied piping systems. All piping from Class 2501 to Class 601R was 100% radiographed.

Random radiography was required for 10% to 20% of the balance of the welds, with evidence of unacceptable quality corresponding to random radiography being a cause to require 100%

radiographic inspection. The remaining classes of piping (601 non-radioactive, 602, 301, 302, and 151) are primarily either (a) piping systems at or near the range of atmospheric temperatures up to 212F (to which provision 2 of Code Case N-7 does not apply) or (b) Class 3 systems.

For Gilbert Associates supplied piping systems, GAI Specification SP-5291, dated December 23, 1966, provides the following radiography requirements.

Radiography inspection is to be made of all field butt welds and all field nozzle welds 4 in.

and larger, for the following systems (only those of Class 2 are discussed below):

A. Main steam system up to main steam stop valves and connected piping for main steam safety valves (MSSV) and steam admission to the auxiliary feedwater pump turbine.

B. Feedwater piping to the first check valves outside containment (3992 and 3993).

C. Steam piping to the auxiliary feedwater pump turbine.

D. Preferred auxiliary feedwater piping.

E. Steam generator blowdown piping to the containment isolation valve.

F. Service water (SW) piping, including inside containment.

Also, all shop butt welds and all 4 in. and larger nozzle welds are required to be radiographed for the above systems.

Based on the above evaluation, it is concluded that the radiography requirements imposed on the original piping and valves for Ginna Station compare favorably with current criteria.

3.2.2.2.3 Main Steam and Feedwater Piping The main steam and feedwater piping systems in the intermediate building and portions of the turbine building are included in the augmented inservice inspection program, which required Page 70 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS a new baseline radiograph inspection of 100% of welds in the subject high-energy piping.

This program has been reviewed and approved by the NRC, in the review of SEP Topic III-5.B, Pipe Break Outside Containment, SER dated September 4, 1981 (Reference 8).

3.2.2.3 Valve Design It was requested that information be provided, on a sample basis, regarding the design of valves in order to determine if (1) Class 2 and 3 valves meet current pressure-temperature ratings and (2) Class 1 valves meet current body shape requirements.

Rochester Gas and Electric has made an extensive sampling comparison and determined that, in almost all cases, the original pressure-temperature ratings were more restrictive than those defined in ANSI B16.34-1977. The valve specifications designate that the valve body materials be A312 type 304, A358, type 304, A376 type 304 (all group 2.1 materials), A312 type 316 or A358 type 316 (group 2.2 materials), A105, A216WCB (group 1.1 materials) and A216WCC (group 1.2 materials). In only one instance evaluated, for ASA 150 lb Class, did the Ginna specifications allow a higher working pressure for the designated temperature, and the difference was only 5 lb (210 lb versus 205 lb at 300F, and 240 lb versus 235 lb at 200F). This is a minor difference since hydrostatic testing of the systems was originally performed at 125% of design pressure.

It is thus considered that the pressure-temperature ratings for the Ginna Class 2 and 3 valves compare favorably with current criteria.

It was also requested that valve body shapes for Class 1 valves be compared to current criteria designated in the ASME Code, NB-3544.

A drawing review of a sample of Class 1 valves was conducted to determine if there appeared to be any significant differences from the valve body shape requirements of NB-3544. From the drawings, it appeared that (1) there were no sharp fillets at the intersections of the surfaces of the pressure retaining boundary at the neck to body junction (with r2 0.3 tm), (2) body internal contours were generally smooth in curvature, (3) flat sections were minimized, and (4) body contours at weld ends were smooth and gradual.

This sampling indicates that Class 1 valves installed at Ginna Station have body shapes which are not significantly different from present code requirements. Further, during the years since Ginna Station began operation, periodic testing, and inservice inspection, no apparent failures due to severe stress concentrations resulting from unacceptable valve body shape contours have occurred or have been observed. It is thus considered that valve body shape requirements for Class 1 valves at Ginna Station are not of concern.

3.2.2.4 Pump Design It was requested that information be provided with respect to the codes and requirements to which the gas stripper pumps, service water (SW) pumps, and lube-oil pumps for the turbine-driven auxiliary feedwater pump (TDAFW) bearings were designed.

The gas stripper pumps are not safety-related and the turbine-driven auxiliary feedwater pump (TDAFW) and its auxiliaries perform safety functions which can be performed by other Page 71 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS safety-related pumps. The service water (SW) pumps were analyzed as part of the seismic review (SEP Topic III-6) and modifications resulting from that analysis were performed based on current code requirements as discussed in Section 3.9.2.2.4.1.

3.2.2.5 Storage Tank Design It was requested that information be provided relative to the design of the refueling water storage tank (RWST), boric acid storage tanks, chemical and volume control system holdup tanks, component cooling water (CCW) surge tank, preferred auxiliary feedwater condensate storage tank (CST), and turbine-driven auxiliary feedwater pump (TDAFW) lube-oil tank. In addition to general code requirements, specific information included compressive stress requirements, and tensile allowables for biaxial stress field conditions. An evaluation was not performed for the condensate storage tank (CST), the chemical and volume control system holdup tanks, and the turbine-driven auxiliary feedwater pump (TDAFW) lube-oil tank, since they are not required to perform a safety function. Both the condensate storage tank (CST), which provides suction to the preferred auxiliary feedwater system, and the turbine-driven auxiliary feedwater pump (TDAFW), have functions which can be performed by other safety-related systems (the service water (SW) system and the standby auxiliary feedwater system, (SAFW) respectively). The failure of the chemical and volume control system holdup tanks would not release significant activity (failure would be bounded by a volume control tank rupture, which is analyzed in Section 15.7.1.2, and found acceptable).

It should further be noted that the component cooling water (CCW) surge tank has a 100-psig design pressure and it is reviewed as a pressure vessel. Since fracture toughness exemption (nominal thickness 5/8 in. or less) applies for this tank and the stress limits between current and present codes are comparable for Class 3 vessels, no additional analysis was required.

The refueling water storage tank (RWST), chemical and volume control system holdup tanks, waste holdup tank, and the boric acid storage tanks were analyzed as part of the seismic review (SEP Topic III-6) based on current code requirements. Each tank has been shown to meet required SEP seismic criteria. The refueling water storage tank (RWST) and boric acid storage tanks are discussed in detail in Sections 3.9.2.2.4.6 and 3.9.2.2.4.5, respectively.

Page 72 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS REFERENCES FOR SECTION 3.2

1. U.S. Nuclear Regulatory Commission, Quality Group Classification and Standards for Water, Steam, and Radioactive Waste Containing Components of Nuclear Power Plants, Regulatory Guide 1.26, Revision 3, February 1, 1976.

2. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topic III-1, Quality Group Classification of Components and Systems, dated December 30, 1981 (includes Franklin Research Center Technical Evaluation Report C5257-429).

3. U.S. Nuclear Regulatory Commission, Integrated Plant Safety Assessment, Systematic Evaluation Program, R. E. Ginna Nuclear Power Plant, NUREG-0821, December 1982.

4. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic III-1, Quality Group Classification of Components and Systems, dated June 25, 1982.

5. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic III-1, Quality Group Classification of Components and Systems, dated January 24, 1983.

6. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Integrated Plant Safety Assessment Report (IPSAR) Section 4.7, Classification of Structures, Systems, and Components, dated June 28, 1983.

7. U.S. Nuclear Regulatory Commission, Seismic Design Classification, Regulatory Guide 1.29, Revision 3, September 1, 1978.

8. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topic III-5B, Pipe Break Outside Containment, dated September 4, 1981.

Page 73 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.2-1 CLASSIFICATION OF STRUCTURES, SYSTEMS, AND COMPONENTS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

REACTOR COOLANT SYSTEM Reactor vessel ASME III Class 1 ASME III (1965) Class Ab Category I Class I Reactor vessel supports ASME III Subsection NF --- Category I Class I Steam generators, tube sidec ASME III Class 1 ASME III (1965) Class A Category I Class I Steam generators, shell sidec ASME III Class 2 ASME III (1965) Class C Category I Class I Pressurizer ASME III Class 1 ASME III (1965) Class A Category I Class I Reactor coolant pumps ASME III Class 1 ASME III (1965) Class A Category I Class I Reactor coolant piping, valves, and fittings ASME III Class 1 ASA B31.1 (1955) Category I Class I ASA B16.5 (1961)d Pressurizer relief tank ASME III Class 3 ASME III (1965) Class C Nonseismic Class II Page 74 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

SAFETY INJECTION SYSTEM Refueling water storage tank (RWST) ASME III Class 2 API-650 (1964) Category I Class I AEC TID-7024 (8/63)

MSS SP-66 (1964)

High pressure safety injection pumps ASME III Class 2 Westinghouse equipment Category I Class I Spec 676370e (7/29/66)

Accumulators with piping and valves to reactor coolant ASME III Class 2 ASME III (1965) Class C; Category I Class I system and from N2 supply ASA B31.1 (1955), ASA B16.5 (1961)d; Westinghouse equipment Spec 676448f (3/15/67)

Accumulator check valves ASME III Class 1 MSS SP-66 (1964)d Category I Class I Interconnecting piping and valves required to perform ASME III Class 2 ASA B31.1 (1955); Category I Class I safety injection function Code Case N-7; USAS B36.10 (1959)d; USAS B36.19 (1965)d; USAS B16.5 (1961);

MSS SP-66 (1964)d SAMPLING SYSTEM Piping and valves from reactor coolant system to 951, 953, ASME III Class 1 ASA B31.1 (1955) Category I Class I 955, 998 ASA B16.5 (1961)d Piping and valves from 951, 953, 955, 998, to 966 A, B, C ASME III Class 2 ASA B31.1 (1955) Category I Class I ASA B16.5 (1961)d Page 75 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

CONTAINMENT SPRAY SYSTEM Containment spray pumps ASME III Class 2 Westinghouse equipment Category I Class I Spec 676370e (7/29/66)

Piping and valves to containment spray system pumps ASME III Class 2 ASA B31.1 (1955) Category I Class I from refueling water storage tank (RWST) and spray ASA B16.5 (1961)d additive tank Spray additive tank ASME III Class 3 ASME III (1965) Class C Category I Class I Interconnecting piping and valves from containment spray ASME III Class 2 ASA B31.1 (1955) Category I Class I system pump discharge to containment spray system spray ASA B16.5 (1961)d nozzles Page 76 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

CHEMICAL AND VOLUME CONTROL SYSTEM Regenerative heat exchanger ASME III Class 1 ASME III (1965) Class A Category I Class I Nonregenerative heat exchanger-tube side ASME III Class 2 ASME III (1965) Class C Category I Class I Nonregenerative heat exchanger-shell side ASME III Class 3 ASME VIII (1965) Category I Class I Reactor coolant filter ASME III Class 2 ASME III (1965) Class C Category I Class I Volume control tank ASME III Class 2 ASME III (1965) Class C Category I Class II Charging pumps ASME III Class 2 Westinghouse equipment Category I Class I Spec 676370e (7/29/66)

Charging pumps accumulator ASME III Class 2 ANSI B31.7 (1968) Category I Class I Excess letdown heat exchanger-tube side ASME III Class 1 ASME III (1965) Class A Category I Class I Excess letdown heat exchanger-shell side ASME III Class 3 ASME VIII (1965) Category I Class I Seal water injection filter ASME III Class 2 ASME III (1965) Class C Category I Class I Seal water heat exchanger-tube side ASME III Class 2 ASME III (1965) Class C Category I Class I Seal water heat exchanger-shell side ASME III Class 3 ASME VIII (1965) Category I Class I Piping (loop B) letdown via regenerative heat exchanger ASME III Class 1 ASA B31.1 (1955) Category I Class I and letdown valves to and including letdown orifices ASA B16.5 (1961)d Holdup tanks ASME III Class 3 ASME III (1965) Class C Category I Class I Boric acid storage tank ASME III Class 2 ASME III (1965) Class C Category I Class I Page 77 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

CHEMICAL AND VOLUME CONTROL SYSTEM cont...

Boric acid filter ASME III Class 3 ASME III (1965) Class C Category I Class I Gas stripper packageg ASME III Class 3 ASME III (1965) Class C Nonseismic Class III ASA B31.1 (1955)

Deborating demineralizer ASME III Class 3 ASME III Class C Nonseismic ---

Piping (loop A) letdown line via excess letdown heat ASME III Class 1 ASA B31.1 (1955) Category I Class I exchanger to and including HCV 123 ASA B16.5 (1961)d Piping and valves from pump discharge to containment ASME III Class 2 ASA B31.1 (1955) Category I Class I isolation valve ASA B16.5 (1961)d Mixed bed demineralizer ASME III Class 3 ASME III (1965) Class C Nonseismic ---

Cation bed demineralizer ASME III Class 3 ASME III (1965) Class C Nonseismic Class I Piping from pump discharge via reactor coolant pump and ASME III Class 2 ASA B31.1 (1955) Category I Class I from HCV 123 to seal water heat exchanger ASA B16.5 (1961)d Remainder of interconnecting piping and valves with ASME III Class 2 ASA B31.1 (1955) Category I Class I exceptions following ASA B16.5 (1961)d Piping and valves of TCV 145 via demineralizer to valves ASME III Class 3 ASA B31.1 (1955) Nonseismic Class I 1106 and 1107 ASA B16.5 (1961)d Base removal ion exchanger ASME III Class 3 ASME III (1965) Class C Nonseismic Class I Cation ion exchanger ASME III Class 3 ASME III (1965) Class C Nonseismic Class I Ion exchange filter ASME III Class 3 ASME III (1965) Class C Nonseismic Class I Piping and valves from boric acid storage tank via boric ASME III Class 3 ASA B31.1 (1955) Category I Class I acid transfer pump and filter ASA B16.5 (1961)d Page 78 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

RESIDUAL HEAT REMOVAL SYSTEM Residual heat removal pumps ASME III Class 2 Westinghouse equipment Category I Class I Spec 676370e (7/29/66)

Heat exchanger-tube side ASME III Class 2 ASME III (1965) Class C Category I Class I Heat exchanger-shell side ASME III ASME VIII (1965) Category I Class I Class 3 Interconnecting piping and valves required to perform ASME III Class 2 ASA B31.1 (1955) Category I Class I residual heat removal function ASA B16.5 (1961)d COMPONENT COOLING WATER (CCW) SYSTEM Pumps ASME III Class 3 Westinghouse equipment Category I Class I Spec 676370e (7/29/66)

Heat exchanger ASME III Class 3 ASME VIII (1965) Category I Class I Surge tank ASME III Class 3 ASME VIII (1965) Category I Class I Interconnecting piping and valves ASME III Class 3 ASA B31.1 (1955) Category I Class I ASA B16.5 (1961)d SERVICE WATER (SW) SYSTEM Pumps ASME III Class 3 GAI Specification RO-2204 (1966) Category I Class I Piping and valves required for containment cooling inside ASME III Class 2 ASA B31.1 (1955) Category I Class I containment and outside containment up to first isolation ASA B16.5 (1961)d valves Remainder of piping and valves excluding those inside the ASME III Class 3 ASA B31.1 (1955) Category I Class I turbine building ASA B16.5 (1961)d Page 79 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

MAIN STEAM SYSTEM Atmospheric relief valves (two) ASME III Class 2 ASME III (1977) Category I Class I Class 2 Safety valves (eight) ASME III Class 2 ASA B31.1 (1955) Category I Class I Piping and valves comprising main steam lines extending ASME III Class 2 ASA B31.1 (1955) Category I Class I from the secondary side of the steam generators up to and ASA B16.5 (1961)d including the outermost containment isolation valve in each main steam line and connecting piping up to and including the first valve that is normally closed or capable of automatic closure during all modes of normal reactor operation Piping and valves from main steam line to auxiliary feed ASME III Class 2 ASA B31.1 (1955) Category I Class I pump turbine ASA B16.5 (1961)

FEEDWATER SYSTEM Interconnecting piping and valves comprising feedwater ASME III Class 2 ASA B31.1 (1955) Category I Class I lines extending from secondary side of steam generators ASA B16.5 (1961) up to and including the nonreturn valves 4003, 4004, 4000C, 4000D, 3992, and 3993 Page 80 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

PREFERRED AUXILIARY FEEDWATER SYSTEM (AFW)

Pumps-motor driven ASME III Class 3 ASME VIII (1965) Category I Class I Pump-turbine driven ASME III Class 3 ASME VIII (1965) Category I Class I Condensate storage tank (CST) ASME III Class 3 AWWA D100 (1965) Category I Class II Piping and valves from motor driven pump discharge to ASME III Class 3 ASA B31.1 (1955) Category I Class I valves 4000C, D, and including valves 4304 and 4310 ASA B16.5 (1961)

Piping and valves from turbine driven pump discharge to ASME III Class 3 ASA B31.1 (1955) Category I Class I valves 4003, 4004, and including 4291 ASA B16.5 (1961)d Piping to suction of Preferred auxiliary feedwater system ASME III Class 3 ASA B31.1 (1955) Category I Class I (AFW) pumps from condensate storage tanks (CST) to ASA B16.5 (1961)d valves 4014, 4017, 4016, and from service water (SW) system Turbine driven pump lube oil tank, pumps, and piping ASME III Class 3 ASA B31.1 (1955) Category I Class I Westinghouse equipment Spec 676428i STANDBY AUXILIARY FEEDWATER SYSTEM (SAFW)

Pumps ASME III Class 3 ASME III (1974) Category I Class I Class 3 Standby auxiliary feedwater system (SAFW) piping and ASME III Class 2 ASME III (1974) Category I Class I valves from and including valves 9706A and B to steam Class 2 generators Piping and valves to pump suctions from service water ASME III Class 3 ASME III (1974) Category I Class I (SW) system to and including valves 9707A, B; 9720A, B; Class 3 and 9709A, B Piping and valves to pump discharge up to valves 9704 A, ASME III Class 3 ASME III (1974) Category I Class I B and including valves 9710 A, B Class 3 Page 81 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Quality Classification Seismic Classification Structures, Systems, Codes and Standards Codes and Standards RG 1.29 Used in Plant and Components RG 1.26a Used in Plant Design Design (Historical)

CONTAINMENT ISOLATION SYSTEM Interconnecting piping and valves of the reactor coolant ASME III Class 2 ASA B31.1 (1955) Category I Class I pressure boundary that penetrate the containment up to and ASA B16.5 (1961)d including the outermost containment isolation valve STRUCTURES Containment, including access hatches, air locks, liner, NA --- Category I Class I penetration assemblies, fuel transfer tube penetration, and crane supports Auxiliary building NA --- Category I Class I Control building NA --- Category I Class I Spent fuel pool NA --- Category I Class I Intermediate building NA --- Category I Class I Diesel generator building NA --- Category I Class I Standby auxiliary feedwater system (SAFW) auxiliary NA --- Category I Class I building addition Screen house (service water (SW) portion) NA --- Category I Class I Turbine building NA --- Nonseismicj Class III

a. ASME III stands for the Boiler and Pressure Vessel Code,Section III, Division I, published by ASME, 1977 Edition, with addenda through Summer 1978.

b. PCR 2001-0042 - Reactor vessel closure head replacement - performed in accordance with Section XI Repair Replacement Program utilized ASME Section III, 1995 edition, with 1996 addenda.

c. Replacement steam generator pressure boundary and integral attachments are designed in accordance with ASME Section III, Subsection NB, Class 1 requirements, 1986, with No Addenda.

d. Information regarding code edition assumed because it was not available during SEP review.

e. Westinghouse Equipment Specification 676370 refers to ASME Code, Sections III, VIII, and XI, 1965; ASA B16.5, 1961; and Standards of the Hydraulic Institute, 1965.

f. Westinghouse Equipment Specification 676448 requires that all main seams of the accumulators are fully radiographed per ASME Code, Section 8, Paragraph UW-51.

g. Consists of preheater, stripper column with reflex condenser, and associated pumps, piping, and instrumentation. Westinghouse Equipment Specification 676428 also applies to pumps.

Page 82 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

h. A portion of the piping in the turbine building as shown in drawing 33013-1250, sht 1 of 3 is also ASME III.

i. In this case, Westinghouse Equipment Specification 676428 applies only to the pumps.

j. The turbine building was analyzed during the SEP and it was determined that the building could meet Seismic Category I requirements without failure. Those portions of the building required to maintain its overall structural integrity are now considered Seismic Category I.

Page 83 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3 WIND AND TORNADO LOADINGS 3.

3.1 INTRODUCTION

As part of the Systematic Evaluation Program (SEP), the NRC staff reviewed the design and construction of certain structures to determine their ability to resist the forces developed by straight winds and tornadoes. The SEP review identified certain limiting structural elements (Reference 1), which were then addressed by RG&E as part of the Ginna Structural Upgrade Program. The Structural Upgrade Program consists of a two-phase structural reanalysis program followed by installation of required modifications identified as a result of the analysis. (See also Section 3.8.) The structural reanalysis program and the resulting modifications are discussed in the following sections.

3.3.2 STRUCTURAL UPGRADE PROGRAM EVALUATION 3.3.2.1 Structural Evaluation Approach 3.3.2.1.1 Requirements The Structural Upgrade Program for tornadoes included the resolution of four interrelated SEP Topics:

II-2.A Severe Weather Phenomena.

III-2 Wind and Tornado Loadings.

III-4.A Tornado Missiles.

III-7.B Design Codes, Design Criteria, and Load Combinations.

The Standard Review Plan (SRP) Sections 3.3.1 and 3.3.2 and Regulatory Guides 1.76 and 1.117 include guidance relative to the need for nuclear power plants to withstand the effects of natural phenomena such as wind and tornadoes. At the time of design and construction of Ginna Station, the design criteria for nuclear power plants did not include tornadoes and other phenomena, such as extreme snow and tornado missiles, to the extent currently required.

Consequently, the existing design and construction of some structures important to safety may not meet current licensing criteria but are, nonetheless, capable of resisting loads to some level between the current criteria and those specified in the original FSAR.

3.3.2.1.2 Structural Evaluation Process The purpose of the Structural Upgrade Program evaluation was to determine the level of protection (tornado wind speed characteristics) that should be used as an appropriate backfitting basis for Ginna. In order to make this judgment, RG&E used a three-step process:

A. Determine the capability of the present Ginna structures, systems, and components to withstand tornado effects.

B. Determine the costs associated with backfitting tornado protection at several wind speeds up to that specified in current criteria.

Page 84 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS C. Define a reasonable level of tornado protection, based both on the costs associated with a range of tornado wind speed protection levels and on the range of probabilities of these tornado wind speeds.

The following process was employed for the initial Structural Upgrade Program evaluation:

AA. Define loads, load combinations, and initial acceptance criteria.

BB. Define assumptions.

CC. Evaluate the effects on the structure.

DD. Compare these effects to the original assumptions.

EE. Assess these effects as they pertain to plant shutdown.

FF. Estimate the costs associated with the repairs.

GG. Based on the cost and effects, recommend final input and acceptance criteria and the recommended degree of repair.

The evaluation was performed in two parts. First, a structural evaluation was performed to determine the capabilities of all plant structures to resist wind, snow, and tornado wind and pressures. Second, a determination was made of the minimum set of plant equipment required to bring the plant to a safe shutdown condition and the impact of postulated tornado missiles on that capability. Backfit costs were estimated in both evaluations and were then combined in a consistent fashion to provide a uniform level of protection for all phenomena.

3.3.2.1.3 Structural Evaluation Computer Program In order to perform a structural evaluation of this complexity, a complete evaluation of the main plant structures was made. This evaluation examined the interactions of the structures in the auxiliary, intermediate, turbine, diesel generator, and control buildings and the facade structure in order to distribute the loads throughout the entire structure in a manner that best simulates the actual field conditions. A separate evaluation was performed for the screen house. The computer program GTSTRUDL was used for the structural evaluation.

GTSTRUDL is a computer-aided structural engineering software system developed, maintained, and continuously researched at the GTICES Systems Laboratory, School of Civil Engineering, Georgia Institute of Technology.

3.3.2.1.4 Input Load Criteria Before the actual evaluation could be made, structural layout and load data were compiled.

Plan and elevation drawings of only the primary members and cross-bracing were made.

These drawings were reviewed in the field and checked to confirm that the member configuration and location on the drawings agreed with the field conditions. Member sizes were checked randomly to verify that the member sizes in the field conform to the drawings.

The plant drawings were reviewed to determine the service and live loads on each floor. A field verification was done for the whole plant, whereby typical floor bays were examined, the equipment on these floor bays were located, and an estimated service load calculated.

Page 85 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The estimated service loads also included the weights of pipes, cable trays, and conduits which are attached to the floors.

Dead loads were assumed to be the weights of the structure, fixed equipment, an allowance for permanently attached system components (e.g. pipe, duct, and cable trays), and an allowance for thermal effects and pipe reactions. Live loads were assumed to be as shown in specifications and drawings, minus whatever was allowed for permanently attached system components. Dead, live, thermal effects, and pipe reaction loads were applied as equivalent uniform loads where applicable through the slabs or decking into the main framing.

A 75-mph wind speed and 40-psf ground snow load were used as the "severe environmental loading" condition.

An "extreme snow load" of 100 psf was used as a basis for the evaluation.

The effects of the two NRC design-basis tornado missiles on equipment required for safe shutdown were also examined. The missiles, a 35-ft utility pole and a 1-in. diameter steel rod, were examined to determine the effect a missile strike would have on the equipment required to safely shut down the plant. The two missiles (pole and rod) were assumed to travel at a speed of 0.4 and 0.6 times the tornado wind speed, respectively.

A spectrum of tornado wind speeds was chosen from the "Tornado and Straight Wind Hazard Probability" report prepared by Texas Tech University (Reference 2). Wind speeds of 250 mph, 188 mph, and 132 mph were used. These wind speeds coincide with the Texas Tech estimates for a probability of recurrence of 1 x 10-7, 1 x 10-6, and 1 x 10-5 per year, respectively, at an upper 95% confidence level.

The wind speeds were converted into design pressures by utilizing the ANSI 58.1-1982 equation:

= q Gh Cp where: q= 0.00256 Kz (IV)2 Kz = velocity pressure coefficient I= importance factor V= fastest- mile wind speed Gh = gust response factor C = external pressure coefficient Differential pressures were calculated by using q = 0.00512 V2 where V represents the translational wind speed. Wind loads were applied uniformly to the plant structures.

3.3.2.1.5 General Assumptions Once the three tornado wind speeds were converted to design pressures, the following assumptions were made prior to applying these pressures to the structures:

Page 86 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS A. Metal siding and roof decking remain intact and attached to the main steel frame for all load conditions.

B. All external block walls remain intact for all load conditions.

C. Plant windows, louvers, and doors remain intact for all load conditions.

These assumptions maximize the loads transferred into the structures. From these assumptions, the wind and snow load combinations were then applied to the structures as uniform loads. Their influence was transferred to the main steel framing through the siding or decking.

In the evaluation, the columns were input with their orientation corresponding with the field condition. The columns were assumed to be braced against lateral buckling by floor beams or struts which are framed into the column centerlines. Columns on the building perimeter that have girts attached to their flanges were assumed not to be laterally braced by the girts against buckling on the columns subjected to axial loads. The effective lengths were usually considered to be the distance between floors in the plant for both the strong and weak axis under column buckling and lateral buckling due to beam action. Column bases were typically modeled as pinned connections (non-moment-resisting). Floor beams were assumed to be laterally braced for bending by the floor slabs and beam to column connections were generally modeled as simple pin type connections.

Girts and purlins were considered to be secondary members in this evaluation. For positive wind pressure, the outside flange of the girt is in compression. Under this condition, the siding was assumed to provide full lateral support along the compression flange. However, negative wind or differential pressures reverse the compression flange to the inside of the girt or purlin. For this type of loading, the unbraced length of the compression flange was assumed to be the distance between supports.

The typical connection at Ginna Station is a bolted connection. Beam to column connections, in general, consist of angles welded to the beam and bolted to the column. Connections in the trusses or cross-bracing consist of members bolted to gusset plates. The connection evaluation was done in accordance with the guidelines of the American Institute of Steel Construction (AISC) and using basic statics and engineering mechanics.

Column anchorages were evaluated for basic shear and/or tension loads within the guidelines of ACI 349 Appendix B.

3.3.2.1.6 Load Combinations and Acceptance Criteria Load combinations for severe, extreme and tornado loadings were evaluated, consistent with the NRC Standard Review Plan. The following load combinations were considered in this evaluation:

(1) D + L + Sn + W (2) D + L + Sn (3) D + L + Wt Page 87 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS where: D= Dead load L= Live load Sn = 100-year recurrence snow = 34 psf roof load for the power block, and 27 psf for the screen house W= 100-year recurrence wind = 75 mph for all structures Sn = Extreme snow = 100 psf Wt = Tornado wind loads as defined below, and corresponding to 250-mph, 188-mph and 132-mph tornado wind speeds.

Wt = Ww or, Wt = Wp or, Wt = Ww + 0.5 Wp Ww = tornado wind load Wp = tornado differential pressure load These load combinations have been broken into three categories. Load combination 1 is referred to as severe, load combination 2 is referred to as extreme, and load combination 3 is referred to as tornado.

Since a probability of occurrence for all these load combinations is considered to be very low, a 1.6S (1.6 multiplied by the allowable stress limit of the steel) acceptance criteria was used for the initial analysis.

A detailed discussion of loads, load combinations, and structural code comparisons were made as part of SEP Topic III-7.B. Details of the methods and results of that analysis are provided in Section 3.8.2.1.

3.3.2.2 Structural Evaluation The structural evaluation combined the use of GTSTRUDL with hand calculations in order to accurately analyze the structural capacities of the primary members, secondary members, connections and anchorages, and building shell. The main structural framework was analyzed using the GTSTRUDL computer program in order to determine the forces and moments in the members for each load combination. GTSTRUDL was also used to calculate the structural adequacy of the secondary members under the same loading conditions used in the primary member evaluation, only on a representative sampling basis. The end reactions found in the primary member evaluations were used to evaluate the connections and anchorages in the plant using a statistical sampling technique.

3.3.2.2.1 Primary Member Evaluation The analysis was performed using the computer program GTSTRUDL. Two three-dimensional structural computer models of the plant were developed. One model addressed only the screen house, which is separate from the main plant, while the other model consisted of the auxiliary, turbine, diesel generator, intermediate, and control, and the facade structure.

Page 88 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The models were developed by establishing a global coordinate system whereby only the main steel structures were described.

The models consist of columns, beams, cross-bracing, roof trusses, and other framing components of the structure that contribute to the horizontal strength of the plant. Main interior floor framing, adjacent buildings, and secondary components had their load influence input, but were not discretely addressed. Concrete floor and roof slabs (or decking) were assumed to be plate elements in the horizontal plane and were not developed in detail.

The plant structures were then analyzed for the load cases discussed in Section 3.3.2.1.6.

A software feature of the GTSTRUDL program is a means by which the resultant loads can be changed into stresses and checked to the AISC code. This procedure is done by assigning a number to each member in the computer model and inputting their respective properties (area, section modulus, radius of gyration, etc.). In the analysis, each primary member was checked in accordance with the Eighth Edition of the AISC code. The members which passed or failed the code check were listed, as well as a listing of the load combination which resulted in the overstressed condition.

3.3.2.2.2 Secondary Member Evaluation Secondary members are those members whose purpose is to transfer the load from the intermediate areas of the roof and walls to the primary framing. These members consist of roof purlins and girts. The analysis was performed using GTSTRUDL in a similar manner as done in the primary members evaluation; however, a representative sample of the girts and purlins was investigated instead of inputting each individual member. A sample size of 70 purlins and girts were checked with the AISC code. This representative sample addresses 95% of all the roof purlins and girts in the plant. The percentage of failures discovered in this evaluation was extrapolated to provide the number of failures expected for the 1100 actual purlins and girts.

3.3.2.2.3 Connections and Anchorages Evaluation The results of the primary and secondary member analyses were used to check the adequacy of the beam to beam, column to beam, column to base plate, and anchor bolt to base plate connectors, or simply, connections and anchorages. Since the plant contains approximately 6000 connections and 220 anchorages, a statistical approach was chosen in the review of these elements.

A statistical sample of 60 different connections was chosen and their associated axial and/or horizontal loads were applied and analyzed. Hand calculations and computer programs were used to check the strength of the bolts, welds, and clip angles for the applied loads. The resultant stresses were checked with the allowable stresses specified in the Eighth Edition of the AISC code. For those load conditions not addressed in the code (horizontal and axial loads occurring simultaneously), engineering mechanics were used to determine the adequacy of the connections. The results of this evaluation provided a percentage of overstressed connections which could be expected at a 95% confidence level. By multiplying this percentage by Page 89 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS the actual number of connections in the plant, an expected number of the connections that would not satisfy the acceptance criteria was determined.

A statistical sample of 53 anchorages in the plant was also chosen and evaluated using their associated loadings. A percentage of expected overstressed anchorages was found and multiplied by the total number of anchorages in the plant to determine the expected number of overstressed anchorages.

3.3.2.2.4 Exterior Shell Evaluation 3.3.2.2.4.1 Siding Throughout the reanalysis program it was assumed that the siding would remain intact for all wind speeds. By making such an assumption, the load distribution was transferred evenly across all the steel framework, thus maximizing the load on the framework, while removing the effects of the wind pressure directly on the internal walls and equipment. To verify this assumption, Pittsburgh Testing Laboratory performed pressure tests on three types of siding at Ginna Station. These three types of siding, as manufactured by Elwin G. Smith Corporation, are:

a. Ribwall

b. Shadowall

c. "B" panel system The ribwall panel system is located on the middle portion of the four sides of the facade structure while the corners of the facade consist of the shadowall panels. The rest of the plant is covered by the "B" panel system. A total of six tests were performed on each panel system. The six tests consisted of three positive and three negative pressure loadings. The positive tests represented a wind load from the outside of the structure while the negative tests represented pressure from the inside of the structure or a suction from the outside. The tests checked the failure load of the panels and the fasteners. Failure was defined as a loss of function resulting from tearing of the siding or failure of any or all of the panel connectors.

Once the siding pressure capacities were determined, calculations were done to determine the corresponding wind speed for various areas of the buildings.

The results of the tests are discussed in Section 3.3.2.3 and are explained in more detail in the Pittsburgh Testing Laboratory report transmitted to the NRC by Reference 24.

3.3.2.2.4.2 Concrete Masonry Block Walls The auxiliary, intermediate, control, and turbine buildings contain concrete masonry block walls. The interior block walls (building partitions) were assumed to contribute only their dead weight to the structure in the evaluation. No structural stiffness was considered.

For the purposes of this analysis, the exterior block walls were assumed to remain intact, contributing only their dead load, and were assumed to transfer the tornado wind loads into the steel structure. However, no credit for shielding or structural capacity to resist tornado forces was assumed for the block walls.

Page 90 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.2.2.4.3 Architectural Items Architectural items include doors, windows, and louvers. These items are not required to maintain their integrity in the Structural Upgrade Program.

3.3.2.3 Results of the Structural Evaluation This section presents a summary of the results of the analysis and discusses overstresses and failures in terms of number of members, general failure mode, and failure location for the various components of the structures. Failure does not mean collapse of a member or a mechanism but instead means the inability of such a component to meet the recommended acceptance criteria. The results are presented based on the five load combinations listed below as compared to the acceptance criteria discussed in Section 3.3.2.1.6.

A. Severe environmental (D + L + Sn + W)

B. Extreme snow (D + L + Sn).

C. Tornado winds of 132 mph (D + L + W132)

D. Tornado winds of 188 mph (D + L + W188)

E. Tornado winds of 250 mph (D + L + W250) 3.3.2.3.1 Primary Members 3.3.2.3.1.1 General The evaluation of the results of the various loading conditions on primary members was based upon the number of computer members rather than actual structural members. The number of failures shown are generally higher than the actual number of member failures.

This is especially true for columns where one structural member may be represented by several computer members, depending on the location of the bracing and struts. Model 1 (main plant structure) contained 3500 computer members and model 2 (screen house) contained 766 computer members (see Section 3.3.2.2.1). In the discussion below, the turbine building also includes the control building and the diesel generator rooms. Table 3.3-1 provides a summary of the primary member failures for each building as well as a description of the failures. The numbers shown are accumulative and indicate the total number of failures for all load cases considered rather than an incremental amount of failures for each specific load case.

3.3.2.3.1.2 Severe Environmental Conditions For severe environmental conditions, 168 primary members failed the acceptance criteria.

Approximately 50% of all the failures were in the turbine building. The majority of the rest were about equally spread between the intermediate/ facade building and the auxiliary building with only about 5% in the screen house. For this loading case about one quarter of the failures are beams overstressed in bending from snow loads combined with axial wind loads. The remaining failures are about equally spread between column and bracing elements.

Many of these failures, particularly for bracing, are not due to overstress but due to excessive kl/r values for compression members as allowed by codes.

Page 91 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.2.3.1.3 Extreme Snow Load Condition One hundred and forty-one members failed the extreme snow load condition. Ninety-eight of these also failed severe loads, resulting in an additional 43 or a total of 211 failed members.

About 50% of the additional failures occurred in the turbine building and about 25% each in the auxiliary and intermediate/facade area. Most of the additional failures were roof bracing members and roof truss members.

3.3.2.3.1.4 132-mph Tornado A total of 258 members failed the acceptance criteria for a 132-mph tornado including differential pressure effects. One hundred and seventy of these members had failed the severe and/ or extreme environmental effects. An additional 88 failed members were due to tornado wind only. Seventy percent of the additional members were in the turbine building and consisted primarily of cross-bracing elements and various chord members of the roof trusses. Minor failures (about 15%) occurred in the beams and bracing of the screen house at 132 mph. The remaining 15% were miscellaneous additional members in the auxiliary and intermediate/ facade building. Approximately 36% of the 88 members failed were the direct result of the differential pressure loadings.

Of the 299 members that failed load combinations 1 through 3, slightly more than 54% are in the turbine building, about 21% are in the auxiliary building, 18% are in the intermediate building/facade, and 7% are in the screen house.

3.3.2.3.1.5 188-mph Tornado A total of 332 members failed the acceptance criteria for a 188-mph tornado. This number included differential pressure failures which were projected using the 132 mph results.

Similar to the 132-mph tornado, 177 of these members failed the severe and/or extreme environmental effects resulting in an additional 155 failed members caused by the 188-mph tornado alone. The percentage of the 155 failed members was distributed as follows: 20%

for the combined auxiliary, intermediate, and facade structure; 55% for the turbine building and 25% for the screen house. Differentiating between a 132-mph tornado and a 188-mph tornado (67 additional members fail from 132-mph to 188-mph) the increased failures in the turbine building were 60% bracing, 40% columns; and in the screen house, 75% roof trusses and 25% bracing. The 20% of member failures located in all other buildings were found distributed evenly as beams and trusses. Approximately 38% of the 155 members failed were the direct result of the differential pressure loadings.

Of the 366 total members that failed the load combinations 1 through 4, slightly less than 52%

were in the turbine building, about 18% were in the auxiliary building, 18% were in the intermediate building/facade, and 12% were in the screen house.

3.3.2.3.1.6 250-mph Tornado A total of 658 primary members failed the acceptance criteria, including differential pressure failures, for the 250-mph tornado. As in the two previous tornado wind conditions, 178 of these members failed the severe and/or extreme environmental effects. Thus, for the 250-mph tornado wind, 480 failures were due to tornado wind alone. Of these 480 failures, 325 Page 92 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS failures occurred as a result of the 250-mph tornado loading over and above those found due to the 188-mph tornado results. Of the 325 additional failures, 22% were in the turbine building, 38% in the screen house, 16% in the facade structure, 15% in the auxiliary, and 8%

in the intermediate building. The majority of failures were bracing members, 32% of the 325, with 28% of the total being columns. The screen house roof truss system contributed 25% of the total by itself and the remaining 15% were composed of beams and other truss members.

Approximately 21% of the 480 members failed were the direct result of the differential pressure loadings.

Of the 691 total members that failed the load combinations 1 through 5, 38% were in the turbine building, 17% were in the auxiliary building, about 21% were in the intermediate building/facade, and 24% were in the screen house. A tabular breakdown by building and member type for failures caused by load combinations 1 through 5 is shown in Table 3.3-1.

3.3.2.3.2 Secondary Members For the extreme snow load of 100 psf, a few (21) isolated roof purlins became overstressed.

At a 132-mph tornado loading, approximately 60% of the total girts and purlins did not meet the acceptance criteria. These members were not considered to detach themselves from the main frame but experienced high stress levels and possible permanent deformations. The problems experienced by these members are due to tornado loads that create suction effects, and loads due to the differential pressure. For these load conditions, the bending stress allowables are low because of the large unbraced length of the compression flange.

When subjected to a 188-mph tornado, 77% of all secondary members experienced overload.

At a 250-mph tornado loading, 94% of the secondary members are overloaded and they would fail by bending or by failure of their connections to the main frame.

3.3.2.3.3 Connections and Anchorages As described in Section 3.3.2.2, the connections and anchorages were statistically sampled and then evaluated for the various load combinations.

The results for the connection analysis showed that 11% to 13% of the connections failed the acceptance criteria for the severe environmental, extreme snow, and the 132-mph tornado loading conditions. As the tornado wind speeds increased the total percentages of failed connections went to 23% for the 188-mph and to 39% for the 250-mph tornado loadings.

No anchorages failed under the extreme snow loading based on the downward loading direction. For anchorages under the severe environmental loading and the 132-mph tornado loading, 18% failed in one of the three conditions checked for anchorage capacity: anchor bolts, welds to base plates, or concrete capacity. This number increased to 50% and 75% for the increased tornado loadings of 188 mph and 250 mph, respectively.

Page 93 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.2.3.4 Exterior Shell 3.3.2.3.4.1 Metal Siding The results of the siding tests determined the ultimate failure loadings. These results were then correlated to locations on the various buildings at Ginna Station. It was determined that with minor modifications all the exterior siding would perform its function under a 132-mph tornado loading. As the tornado loading increased to 188 mph all of the screen house siding failed, 28% of the total siding in the auxiliary building and the intermediate building failed, 23% of the turbine building siding failed, and approximately 50% of facade siding failed.

When the 250-mph tornado loading results were calculated, 100% of the siding failed.

3.3.2.3.4.2 Roof Decking The roof decking is acceptable for the extreme snow condition except for a few isolated spans. For a 132-mph tornado the theoretical calculations show that the roof decking itself is capable of supporting loads associated with this tornado. However, the decking to purlin connection might not be able to resist the uplift loads. As the tornado wind speeds are increased to 188 mph and 250 mph the portions of roof decking predicted to fail are 41% and 100%, respectively.

3.3.2.3.4.3 Block Walls It was assumed that exterior block walls could not meet the structural requirement of the structural upgrade program.

3.3.3 TORNADO MISSILES AND SAFE SHUTDOWN APPROACH 3.3.3.1 Background In the NRC April 16, 1982, Safety Evaluation Report, relative to SEP Topic III-4.A (Reference 5), it was determined that the majority of plant structures, systems, and components required to ensure the integrity of the reactor coolant pressure boundary; the capability to shut down the reactor and maintain it in a safe shutdown condition; and the capability to prevent accidents which could result in unacceptable offsite exposures were suitably protected from postulated tornado-generated missiles.

Several items were identified, however, which required additional evaluation with respect to tornado missile protection. An evaluation of these issues, as identified in the Ginna Integrated Plant Safety Assessment Report, NUREG 0821, May 1982 (draft) and December 1982 (final), as well as a number of other items identified during the RG&E subsequent reviews, are provided in Section 3.3.3.3.

The two missiles required in the Safety Evaluation Report (Reference 4) to be evaluated were a steel rod, 1-in. diameter and 3-ft long, weighing 8 lb, and a wooden utility pole, 13.5-in.

diameter and 35-ft long, weighing 1490 lb. The velocity of the steel rod was assumed to be 60% of the tornado wind speed; the velocity of the wooden utility pole, 40%.

Page 94 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.3.2 Shutdown Methodology Rochester Gas and Electric has developed methods to achieve and maintain safe shutdown conditions following the postulated tornado strike. Certain assumptions of plant status and system unavailability were made.

3.3.3.2.1 Assumptions A. Offsite ac power is lost.

B. All equipment not protected from tornado effects is considered inoperable unless explained otherwise in Section 3.3.3.3. Also, if protection is not specifically provided, it is assumed that inadvertent operation due to ground or phase faults could occur.

C. Architectural details, such as the building shell components and secondary members, are not considered capable of withstanding tornado windspeeds; however, the failure mode of these items is such that they will not become damaging missiles.

3.3.3.2.2 Shutdown Details One train of safeguards equipment, which will serve to provide and maintain safe MODE 3 (Hot Shutdown), will be protected. Due to the nature and methodology of the shutdown systems being protected, MODE 5 (Cold Shutdown) can also be achieved.

The safe shutdown function will be performed as follows:

A. The reactor will automatically trip as a result of the loss of the unprotected 4-kV buses or other trip signal.

B. The turbine would trip, with resultant closure of the turbine stop valves. The operator would also close the main steam isolation valves from the control room, if they did not automatically close.

C. The diesel generators would automatically start and pick up the required loads. For purposes of this shutdown method, it is assumed that diesel generator 1B will be tornado protected. This would allow operation of all safeguards equipment associated with bus 16 (train B).

Since service water (SW) is not protected, the diesel might not have this source of cooling water. Modifications have been made to the diesel cooling system to permit an alternate water supply to be used from the yard fire loop.

D. The standby auxiliary feedwater system would provide cooling to the steam generator(s).

By using one of the main steam safety valves for venting to the atmosphere, a safe MODE 3 (Hot Shutdown) condition would be established. A 160,000-gallon DI water storage tank is available west of the standby auxiliary feedwater building which is used for standby auxiliary feedwater pump (SAFW) testing and serves as an additional source of condensate grade water. Following use of the contents of that tank, additional auxiliary feedwater could be provided from the yard fire loop.

E. Charging flow for inventory makeup of primary coolant would be available via the charging system. This function is presently tornado protected.

Page 95 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS F. In order to cool down, use of the atmospheric dump valves on the main steam header would be required. If the air or the backup nitrogen systems that control these valves could not be made operable because they are not tornado protected, these valves could be locally controlled.

G. To effect final MODE 5 (Cold Shutdown), the steam generators would be used as water-to-water heat exchangers. Using established procedures, the operators would fill up the steam generators and, in an orderly manner, achieve a MODE 5 (Cold Shutdown) condition to less than 200F. It is contemplated that this cooldown would occur over several days.

3.3.3.3 Required Components The structures, systems, and components required to be tornado-missile protected are those required to achieve and maintain safe shutdown conditions. Other systems considered for protection include the surface of the spent fuel pool (SFP), so that missiles and other large items would not cause unacceptable damage to the fuel assemblies; the reactor coolant pressure boundary and main steam and feedwater lines, to prevent major primary and secondary system breaks; and items whose failure could cause unacceptable inadvertent operation or failure of safety-related equipment.

The RG&E proposed resolution of these items is as follows:

3.3.3.3.1 Refueling Water Storage Tank (RWST)

An analysis of missile effects (utility pole and steel rod) and wind pressure effects due to a 188-mph tornado, was performed for the refueling water storage tank (RWST). It was determined that a minimum safety factor for any of these load combinations is 1.18. For the refueling water storage tank (RWST) perforation analysis, the perforation formula contained in EPRI report NP-769, which accounts for the energy absorption due to deformation of the relatively soft utility pole missile, was used. For the steel rod, the Ohte Formula from the Strength of Steel Plates Subjected to Missile Impact was used (Reference 5).

3.3.3.3.2 Electrical Buses 14, 17, and 18 Bus 14 is located on the operating floor of the auxiliary building and could be subject to damage from tornado missiles. However, safety-related bus 16, located on the intermediate level of the auxiliary building, is protected from tornado missiles, and would be available in the event of a tornado.

Buses 17 and 18 are located in the screen house. The operating floor of the screen house is not protected from the effects of tornadoes including missiles. However, RG&E has made modifications which will eliminate dependence on the service water (SW) system to achieve and maintain safe plant shutdown. Thus, no protection for buses 17 and 18 is required.

Rochester Gas and Electric has also investigated the potential for damage to buses 17 and 18 causing failure of required electrical equipment, such as a diesel generator. In order to eliminate the potential damage from fault currents, RG&E installed a new feeder breaker between diesel generator 1B and bus 17 located in diesel generator room 1B.

Page 96 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.3.3.3 Main Steam Lines A and B, and Main Feedwater Lines A and B An analysis of the effects of the tornado missiles on the steam lines, feedwater lines, supports, and attached piping and valves at both 132 mph and 188 mph has been completed.

3.3.3.3.3.1 Results - Steel Rod The main steam line, main feedwater line, as well as attached piping and valves, are all thick-walled items and would not be perforated by the steel rod impact. Damage to valve operators could prevent subsequent operation; however, no loss of pressure integrity would result.

Thus, secondary system integrity would be maintained. The effect of damage to piping supports was also investigated. It was determined that damage could occur causing possible loss of support. However, damage to one support member would not result in a loss of overall support to the piping system. Thus, the main steam and feedwater lines would not be expected to lose support function to the point of failure.

In order to maintain safe shutdown, decay heat removal via one safety or relief valve would be required. Although no guarantee is available that the safety or relief valves would be operable following a steel rod strike, RG&E does not believe it would be credible to postulate simultaneous failure of all 10 safety and relief valves. Thus, RG&E is confident that decay heat removal capability via one safety or relief valve would exist following a tornado.

3.3.3.3.3.2 Results - Utility Pole Based on the results of the analysis for the 188-mph tornado, the Ginna Station main steam lines and main feedwater lines will not be perforated by the utility pole.

The results confirmed both piping systems will withstand the effects of tornado wind and missile loads combined with normal operating loads within the acceptance criteria of Service Level D of ASME NC 3600 for Class 2 piping. In performing this analysis, it was conservatively assumed that snubber restraints were ineffective in resisting the tornado wind.

It was also conservatively assumed that any snubber restraint impacted by the utility pole missile would fail. It was determined that there would be some permanent, but not unacceptable, deformation of both piping systems if impacted by the utility pole missile.

3.3.3.3.3.3 Failure of Block Walls RG&E has also committed to evaluate the possible damaging effects on the steam and feedwater lines, due to failure of block walls. The block walls are located at the entire level in the intermediate building where the steam and feedwater lines are located. Based on the tornado missile evaluation, RG&E determined that local protection for the main steam isolation valve operators and solenoid valves and the preferred auxiliary feedwater system check valves were required. Protective structures were installed to protect these components (see Section 3.8.4.5.8), and the main steam isolation valve control cables were rerouted so as not to be susceptible to damage from failed walls.

Page 97 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.3.3.4 Surface of the Spent Fuel Pool An analysis has been performed for RG&E by Pickard, Lowe, and Garrick, Inc., entitled "Criticality Analysis for the Spent Fuel Storage Racks." It has been calculated that, even if the utility pole caused displacement of a fuel storage box, such that several fuel storage boxes were adjacent, a Keff of significantly less than 0.8894 would result, with borated water of 2000 ppm in the pool (such is the case). Rochester Gas and Electric has also performed an analysis to determine the effects of a utility pole missile on the spent fuel assemblies. As provided in the RG&E proposed amendment to the Ginna Technical Specifications submitted by letter dated January 18, 1984 (Reference 6), it has been determined that the worst-case utility pole strike would not result in offsite radiological consequences greater than the guideline exposures of 10 CFR Part 100. See Section 9.1.2.7 for additional information.

Rochester Gas and Electric has modified the block wall on the north side of the spent fuel pool (SFP) to prevent damage to the spent fuel due to failure of the block wall. Calculations indicate that failure of the other block wall in the vicinity of the spent fuel pool (SFP) (west side) would not adversely affect the integrity of the fuel such that offsite radiological consequences would exceed 10 CFR 100 guidelines. Detailed calculations were completed as part of the Structural Upgrade Program.

3.3.3.3.5 Diesel Generators and Their Fuel Supply Rochester Gas and Electric determined that additional protection was required for the doors and roof of a diesel generator room. Based on that analysis, the diesel generator building was modified to withstand seismic and extreme snow loads and to protect the building from external flooding and tornado winds and missiles. The modifications included construction of a new north face missile wall and a new roof structure. The north face missile wall included pressurized, missile-resistant, and watertight equipment and personnel doors and is constructed of reinforced concrete 4 ft north of the existing north wall of the diesel generator building. The existing east and west walls were extended in reinforced concrete to meet the new north wall. The new reinforced-concrete slab roof covers the entire building including the new north face missile wall. The existing north wall and portions of the roof were left in place. The diesel generator building was modified to be capable of withstanding wind pressure, differential pressure, and missile loads associated with a 132-mph tornado and to remain stable at a windspeed of 188 mph. "Capable of withstanding" means with no significant damage and "remain stable" means that the building will remain functional.

3.3.3.3.6 Relay Room The east wall of the relay room is light gauge metal siding. Since the room contains vital safety-related equipment, RG&E committed to provide protection of this room from tornado winds and missiles, extreme snow, and design-basis flooding.

This protection has been accomplished by building a reinforced-concrete structure on the east end of the relay room. This structure is an enclosed space adjoining the east wall of the relay room that is approximately 14 ft wide by 40 ft long, extends from grade up to the control room floor, and is enclosed by a concrete roof slab. This structure has been designed for the above loads and the operating-basis earthquake and safe shutdown earthquake.

Page 98 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.3.3.7 Service Water System Rochester Gas and Electric has performed an evaluation of alternative shutdown methods, which do not require use of the service water (SW) system, to achieve and maintain safe shut-down. The methods include use of fire hose connections to the diesel generator and standby auxiliary feedwater system from the yard loop or from other sources as necessary. Thus, RG&E does not intend to provide tornado protection for the service water (SW) system.

3.3.3.3.8 Standby Auxiliary Feedwater System Although the standby auxiliary feedwater system is protected by the standby auxiliary feedwater building, the discharge piping is routed through the auxiliary building. All of the discharge piping for the C pump is located on the intermediate level of the auxiliary building, and thus protected from tornado missiles, except for a small elbow section. This small section of piping is protected by concrete walls on the south and east sides and by the reactor makeup water tank on the north and west. The C pump and valves are associated with the power supply and distribution equipment (bus 14) that are not tornado-protected.

The portion of the discharge piping for the D pump that is located in the auxiliary building operating level is not tornado-protected.

Power supply and distribution equipment (bus 16) for the D pump and valves are protected.

Necessary changes were made to the standby auxiliary feedwater system to provide protection against tornado missiles. System isolation was provided for a postulated break in the D pump discharge piping so that the steam generator A can be fed via the standby auxiliary feedwater cross-connect piping. A motor-operated valve (MOV-9746) was added to the discharge line of D pump downstream of valve 9701B and the cross-tie containing valves 9702C and D. This provides a means of isolating the unprotected section of the D pump discharge header in the auxiliary building so that the D pump can feed train C through the existing cross-tie. Use of the protected bus 16 power supply for the D pump and active components can be utilized in the event of damage to bus 14. See Section 3.3.3.3.2. The alternative water supply from the yard fire hydrant loop to the standby auxiliary feedwater system is protected from tornado and missile damage. The line from the fire loop runs underground and terminates in the standby auxiliary feedwater building at a fire hose connection. The alternative water supply can be used by connecting an available length of fire hose between the fire hose connection and the connection point in the standby auxiliary feedwater system (see Section 10.5.2.3).

3.3.3.3.9 Instrumentation Rochester Gas and Electric anticipates that some primary and secondary instrumentation may require rerouting from unprotected areas in the intermediate building to the intermediate floor of the auxiliary building.

Sufficient instrumentation will be provided for the operator to monitor safe shutdown conditions.

Page 99 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.3.3.3.10 Cable Tunnel An opening exists between the cable tunnel and the operating level of the intermediate building. This opening, which is 7 ft x 7 ft, begins 6 ft above floor level, and extends to just below the ceiling. The opening is shielded from tornado missiles on the south, east, and west directions by virtue of being below grade. From the north, major equipment in the turbine building, such as the condenser, will block virtually any missile. Based on the size of the cable tunnel opening, and the shielding now in place, RG&E does not believe any additional protection is warranted.

3.3.4 DESIGN TORNADO 3.3.4.1 Introduction Based on the analyses, RG&E attempted to determine what level of tornado protection should be considered to be appropriate for use as a design-basis tornado for the Ginna facility. The design wind speed was chosen, considering many factors, including the cost of providing protection for increasingly severe tornado wind speeds and missile effects, and the potential safety benefit derived from the increasing capacities.

The cost of modifications increases substantially as the tornado wind speed is increased from a probability level of 10-5 to 10-6 to 10-7. This is not unexpected, since the forces increase as the square of the wind speed. Rochester Gas and Electric has also attempted to consider the added safety benefit which would be derived by designing protection to increasingly severe wind speeds. Some additional safety benefit would exist as specific protection measures were increased; however, because of the substantial safety protection available for the most important plant structures and systems, such as the containment, control complex, and preferred auxiliary feedwater, the incremental safety benefit, although not quantified, is expected to increase only slightly with protection for increasing wind speeds. This is especially true when considering the additional materials capacity available in the plant structures not accounted for in the analysis, the lack of credit taken for safety system separation, and inherent wind and missile damage resistance.

Based on the following justifications, expected modification costs, and the safety level provided by the modifications to be implemented, RG&E recommended that protection be provided for a tornado of 10-5 (132 mph) (Reference 3).

3.3.4.2 Safety Assessment Rochester Gas and Electric believes that the safety afforded by protection to a wind speed associated with a probability of 10-5 per year is adequate. The probability level selected is considered congruent with the protection levels associated with other severe natural phenomena, such as earthquakes and flooding, and with postulated events, such as pipe breaks. This level of protection is also compatible with the draft NRC secondary safety goal of a probability of 10-4 per year of core melt. Rochester Gas and Electric believes that the tornado risk will be only a small fraction of the total core melt risk. It is important to note that there is conservatism even in the 10-5 value selected as the backfitting design basis for Page 100 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS tornado protection at Ginna. First, the 10-5 wind speed is associated with the upper 95%

confidence level, rather than the median. At a median level, the selected wind speed would have a probability on the order of 10-6 per year. Secondly, many of the structures, systems, and components required for safe shutdown, such as the containment, control building, and preferred auxiliary feedwater system, will withstand wind speeds significantly higher than those associated with the 10-5 level. Finally, the method of analysis to determine current protection, and any subsequent modifications, is conservative. Tornadoes are postulated to strike the plant from all directions, and thus no credit for shadowing, or physical separation, is claimed. Tornadoes are postulated to strike with equal intensity throughout the plant, thus seemingly affecting all structures, systems, and components with equal intensity concurrently.

Actually, only a fraction of the plant would see the most intense characteristics of the tornado, and residual strength is expected in the Ginna structural and equipment elements beyond that assumed in the analysis. These conservatisms are described in more detail in Section 3.3.4.3.

Rochester Gas and Electric has determined that backfitting to a tornado level associated with a 10-5 tornado wind speed, at the upper 95% confidence level, will provide a significant level of plant protection. Further conservatisms inherent in the selection of tornado characteristics and the analysis process provide confidence that the risk associated with a tornado strike of this magnitude would be only a small fraction of the overall risk associated with the operation of Ginna Station.

3.3.4.3 Reserve Plant Capacity An examination of the results of the standard evaluation was made in order to establish an approximate value of the reserve capacity of the plant framing after completion of the structural upgrade.

A. Theoretical physical properties of the materials that exist in the structure and those that are used for analysis are typically lower than the actual values. For example, A36 steel has a minimum yield strength of 36 ksi but typically the actual yield values are higher.

B. The structural upgrade would be done to ensure that there are no actual failures in the primary structural framing. This means that the buildings generally would be upgraded based on elastic behavior, i.e., strains below the yield stress. In reality, steel structures are capable of absorbing a large amount of energy above the yield strain of the material. For mild steel, the ratio of strain at rupture to strain at first yield is as much as 100 times the yield strain value. This ductility feature of steel implies that gross and sudden failures will not occur at design levels although permanent deformations may result.

C. The application of loads for analysis purposes is conservative. The live loads used in the analysis are those that are defined for design considerations. In reality, the full live load on all floors will not occur simultaneously. However, for the analysis and evaluation, the full live loads were applied. These loads are vertical and contribute to the total state of stress in the beams and columns.

D. The evaluation examined the plant for tornado winds applied in four directions (north, east, south, and west). The number of overstressed members which were found as a result of the 132-mph wind speed is the total of all failures found in all four directions. The Page 101 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS recommended upgrade will modify all these primary members regardless of the wind direction. The actual occurrence of a tornado would affect the plant from only one direction. Therefore, the upgraded plant will have inherent conservatism because the actual number of members experiencing high loads for a single direction tornado will be less than the total number that will be upgraded.

E. The analyses that were performed assume that the building response is completely elastic.

In most steel structures, local plastic deformations will occur in conjunction with the elastic response of the main frame system. For bolted steel structures such as those at Ginna Station, some degree of slipping will occur in the connections when they are loaded with these extreme loads.

The combination of local deformations and slipping in the connections will absorb some of the total load that is applied to the structure and lessen the total stresses predicted by the elastic analysis.

F. The results of the evaluation have shown that of all the tornado wind speed components, the differential pressure had the most significant impact on the secondary members and exterior shell. At the design tornado wind speed of 132 mph, certain areas of the plant siding and secondary members experience large deflections and minor failures, primarily along the edges and corners of the roof. Rochester Gas and Electric has proposed to allow the secondary members and siding to fail, since they will have no consequence on the overall plant integrity. However, the failures of these areas of the exterior shell will tend to relieve the differential pressure by providing additional venting of the structure along with the existing vent area in all the buildings. The vent area will reduce, if not eliminate, the loads created by the differential pressure. The result will be an immediate stress relief for all the plant structures.

3.3.4.4 System Reserve Capacity In addition to the structural reserve capacity expected to be available, due to material specifications and analytical methods, substantial conservatisms were incorporated into the safety system analysis assumptions.

In terms of tornado wind and missile protection, RG&E has assumed that, unless specifically analyzed for or denoted otherwise, failure of an unprotected system or structure would occur.

Generally, no credit has been taken for the protection inherent in the equipment itself to resist tornado winds. In fact, the majority of items would not experience the peak wind characteristics of the design-basis tornado. Thus, realistically, separation of components and the equipment capability would lessen the number of failures.

For tornado missiles, RG&E has assumed that all equipment not tornado-missile protected could be damaged. Actually, for the design-basis wind speeds expected, only the lightest objects would be capable of experiencing the aerodynamic forces to actually become missiles. These lighter objects would not be expected to cause substantial damage. Also, shadowing of components would be expected to be highly effective in ameliorating missile damage.

Page 102 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Further, for tornado missiles, it is assumed that there is an equal probability of damage to all unprotected equipment. On a probabilistic basis, this would not be expected to occur. The probability of a tornado missile striking small objects would be expected to be significantly lower than the probability of the tornado itself, which is already considered a 10-5 to 10-6 per year event. Therefore, on a realistic basis, additional safety margins exist for tornado missile protection.

3.3.5 STRUCTURAL UPGRADE PROGRAM 3.3.5.1 Introduction The general approach proposed by RG&E was found acceptable, as noted in the NRC SER of August 22, 1983 (Reference 7), with certain outstanding items yet to be resolved. Also, concurrence with the general approach, design inputs and evaluation criteria was issued as a result of the recommendations of the Advisory Committee for Reactor Safeguards (ACRS) in an April 9, 1984, letter to the Honorable Nunzio J. Palladino, Chairman of the USNRC (Reference 8). Certain technical issues were resolved and certain changes made in input assumptions, acceptance criteria, and analytical methodology in the following areas:

A. Changes were made to the criteria as deemed appropriate during the course of the more detailed engineering analysis conducted for the RG&E recommended design tornado.

B. The criteria and judgments that were used to assess the capability of the upgraded structure to remain stable at tornado speeds above the RG&E recommended tornado (up to approximately 200 mph).

C. Open items discussed in the Technical Evaluation Report dated August 2, 1983 (Reference 9).

D. Outstanding issues related to SEP Topic III-7.B.

E. ACRS concern on diesel generator operability due to differential pressure effects.

The above items are discussed in more detail in the following sections.

3.3.5.2 Criteria Changes Additional reviews of the results of the initial evaluations were performed. The purpose of these additional reviews was to provide a more exact estimate of the type and location of the overstressed components. A two-stage approach was used for these reviews to better predict the actual components requiring modifications and the extent of overstress.

3.3.5.2.1 First Stage Review The first approach was to provide a more detailed engineering review of the results of the initial analysis. Primary members were reviewed on an individual basis to determine if the computer-predicted stresses for the overstressed members were correct or if these members could be shown to be acceptable using a more detailed engineering analysis. Connections and anchorages were reviewed for the purpose of defining specifically where the overstresses occurred. The number of overstressed connections and anchorages initially reported were Page 103 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS based on statistical samples which were found, based on this reevaluation, to be overly conservative.

The following list summarizes the bases used in the first approach to reduce the quantities of overstressed components:

A. The screen house was deleted from the scope since this structure is not required to achieve plant shutdown.

B. The computer model was reviewed for compatibility with the actual structure since the computer model tended to idealize the actual structure (by the use of simplifying conservative assumptions).

C. The turbine building operating floor maintenance live load was reduced from 1000 psf to 100 psf since the larger load is only present during turbine/generator maintenance when the plant is already in the shutdown mode.

D. The members with excessive kl/r ratios were evaluated to determine the actual load carrying capability of the members.

E. Modifications for those members whose failure would not damage required safety equipment were deleted.

F. Individual or groups of actual anchorages were evaluated instead of using a statistical projection.

G. Individual or groups of actual connections were evaluated instead of using a statistical projection.

3.3.5.2.2 Second Stage Review The second approach modified the original evaluation criteria. Any components found over-stressed after the first evaluation were reevaluated considering three criteria changes.

A. Live load reductions.

The criteria for all floors, other than the turbine building operating floor, reduced the live loads to 25% of the loads shown on the construction drawings. This criteria change is consistent with live load reductions used for other extreme loading conditions and also is consistent with current industry practice.

B. Increased yield stress.

The original evaluation criteria specified that the minimum specified yield stress (FY) of the steel be used. The structural steel specifications for the Ginna plant require the use of A36 steel (FY = 36 ksi). This criteria change will take advantage of normally higher yield stresses in the steel, and also account for the plastic versus elastic shape factors. The new criteria applied a factor of 1.2 to FY.

C. Reduction or elimination of tornado differential pressure.

The original evaluation criteria specified a tornado-induced differential pressure of 0.4 psi.

This differential pressure would exist only for a completely sealed structure. The previous evaluation took no credit for existing openings (doors, windows, heating, ventilating, and Page 104 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS air conditioning vents, etc.) which would provide venting of the buildings and thereby reduce or eliminate the effective differential pressure. The new criteria will account for the existing areas. Where possible, additional vent area will be added to either reduce or eliminate the differential pressure loads.

3.3.5.3 Stability Evaluation In order to demonstrate that the ultimate plant capacity was actually greater than the level of the recommended design tornado, a stability evaluation was performed. This evaluation assumed that the structures were upgraded to withstand the tornado windspeed of 132 mph and the other extreme loads previously mentioned. The assessment was performed using the component maximum strength and employing the following criteria:

3.3.5.3.1 Primary Members Primary members were evaluated for stability by assessing the members for the actual loads associated with the 188-mph tornado wind speed and using the maximum strength that those members could develop. The allowable compressive load for column members was assumed to be equal to the theoretical buckling load. For bending elements, the allowable load was based on the theoretical lateral buckling stress.

Allowable tension stress on the members was assumed to be equal to the minimum specified yield strength on their gross area or 80% of the ultimate strength on the effective net area.

All other allowable stresses not covered above were evaluated to a 1.6S x 1.2 acceptance criteria where S is as defined in AISC.

The following criteria were also used in the overall stability assessment:

A. Column Research Council plastic design formulas were used to evaluate columns.

B. A diagonal brace (in compression) in a cross-braced bay was considered to support its buckled load because the complimentary tension brace prevents excessive deflection.

C. Compression member lengths were evaluated using an effective length factor that was more representative of the actual details.

3.3.5.3.2 Connections and Anchorages Connections and anchorages for the primary members evaluated for stability which did not meet the 1.6S x 1.2 criteria specified in the SRP, were evaluated using the following criteria.

For connections:

A. The plastic bending capacity of double clip angles was used.

B. Higher bolt shear stresses for threads out of shear plane were used.

C. A compression diagonal brace is considered to support its buckled load because the complementary tension brace prevents excessive deflection thereby reducing the load on the tension brace connection.

Page 105 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS D. For some bracing members containing numerous bolts, the fixity of that brace was assumed to be between a fixed end condition and a pinned end condition. An effective length factor of 0.65 was used which increased the compression capacity of the member, thereby reducing the load on the complementary tension member and its connections.

For anchorages:

A. The ultimate shear and tensile strengths for anchor bolts were used.

B. The plastic bending capacity of double clip angles was used.

C. The beam pockets in the control building were considered to be capable of restraining the beam after anchor bolt failure.

3.3.5.4 NRC Technical Evaluation Report (SEP Topic III-2) Open Items The following were responses to the issues raised in the NRC Technical Evaluation Report dated August 2, 1983 (Reference 10).

3.3.5.4.1 Effective Tornado Loadings Atmospheric pressure change "RG&E made a commitment to reexamine the calculation for atmospheric pressure changes and will apply the appropriate value in the structural loadings."

The atmospheric pressure drop used by RG&E in the evaluation for a 132-mph tornado was 0.4 psi. Franklin Research Center calculated a pressure drop of 0.46 psi using the minimum translational speed of 5 mph noted in Regulatory Guide 1.76. The translational speed corresponding to a 0.4 psi pressure drop is 12.8 mph. The regulatory guide only provides guidance that the minimum translational speed be used in regard to the ultimate heat sink calculations for the plant. Use of the minimum speed for structural design considerations is not specified by Regulatory Guide 1.76. The 12.8 mph translational speed was originally judged reasonable and it is thus considered that the 0.4 psi pressure drop is acceptable.

Windborne missiles "RG&E has made a commitment to reexamine the effects of tornado-induced missile impacts on the primary structural members throughout the Ginna facility in its final analysis."

Rochester Gas and Electric commissioned a study, "Utility Pole Tornado Missile Trajectory Analysis," by Dr. Larry Twisdale of Applied Research Associates. In that study it was concluded that wind speeds lower than approximately 150 mph could not provide the necessary aerodynamic lift required for a utility pole to become an airborne missile. Thus, at a wind-speed of 132 mph, it was determined that there would be no adverse effect on the primary framing of Ginna structures due to a utility pole missile. At higher wind speeds approaching 200 mph, it was considered credible that a utility pole missile could become airborne for short distances. However, the probability of a utility pole missile damaging the primary Ginna structures at high wind speeds becomes increasingly small, since the probability of a high wind speed (10-5 at 132 to 10-6 at 188 mph) must be coupled with the Page 106 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS probability of actually hitting a primary structural element (this was estimated to be about 25% in the study, based on an area ratio to effective missile length distribution function).

Thus, it is estimated that the probability of actually hitting and damaging a primary member is less than 10-6, and thus is not of concern with respect to tornado protection design efforts.

3.3.5.4.2 Structural Loadings Effective structural pressures "RG&E has made a commitment to examine the local effects of peak pressures on primary members in the final analysis."

Rochester Gas and Electric has committed to upgrade the structure to withstand the effects of a 132-mph tornado on a stress basis. In addition, a commitment has been made to assure stability of the structure to the 188-mph wind speed. Since the average pressure associated with the 188-mph tornado is approximately the same as the peak pressure associated with the 132-mph tornado, ensuring stability (and thus, ensuring that all safety functions are met) at the average pressure for the 188-mph tornado is in effect the same as designing for the peak pressure associated with the 132-mph tornado.

3.3.5.4.3 Structural Acceptance Criteria Roof deck "RG&E stated that the roof decks will be reexamined for potential buckling under extreme environmental loadings. The capacities of the roof decks will be modified accordingly."

The evaluation of the roof decking done in the Structural Upgrade Program considered that the allowable stresses associated with the steel roof decking found at Ginna Station would be increased by 1.6 in accordance with the Standard Review Plan for extreme load cases. Based on information found in the American Iron and Steel Institute (AISI), "Specifications for the Design of Cold-Formed Steel Structural Members," a theoretical buckling stress for the roof decking has been estimated to be greater than the actual yield stress of the material. Stress levels found in the roof decking as a result of the extreme snow load are, in nearly all cases, less than the allowable stress of the steel decking multiplied by the 1.6 allowable overstress.

For the remaining areas where the stress levels were found to be greater than the Standard Review Plan allowable stresses, the actual stress was still found to be less than the yield stress of the material. It is RG&Es conclusion that since all of the stresses associated with the extreme snow load were found to be less than the yield stress of the material (and concurrently less than the theoretical yield stress of the material), local buckling of compression areas of the decking will not occur.

3.3.5.4.4 Structural Systems Control building "RG&E has made a commitment to reexamine the control building east wall for the structural upgrade."

Page 107 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The east wall of the relay room (part of the control building) has been modified to withstand wind and tornado loadings, including missiles. The east wall of the control room was found capable of resisting these loads (Reference 10).

Diesel generator building "RG&E has made a commitment to reexamine the reinforced concrete structures of the diesel generator building in the final analysis."

The diesel generator building has been modified to withstand wind, tornado, including missiles, and seismic loadings.

3.3.5.5 SEP Topic III-7.B, Loads, Load Combinations, and Design Criteria The RG&E initial submittal, dated May 27, 1983 (Reference 11), defined all applicable loads and load combinations considered limiting for the concrete and steel safety-related structures at Ginna Station. In the NRC Safety Evaluation Report of August 22, 1983 (Reference 7), it was determined that the proper load combinations had been used in the structural reevaluation of Ginna structures.

The application of the wind and tornado loads was applied as a constant uniform load over the height of each structure, instead of stepping the wind pressure as stated in ANSI A58.1-1982.

These loads were applied to the windward, leeward, sides, and roofs of all buildings, using the appropriate pressure coefficients. It was determined that the variations in the total load transferred into the structure by this assumption was small and would not affect the results of the overall analysis.

A related issue was a comparison of the steel and concrete codes used in the original Ginna design versus current codes. The following comparisons were made:

• AISC 1980 (Reference 12) versus AISC 1963 (Reference 13).

• ACI 349-80 (Reference 14) versus ACI 318-63 (Reference 15).

• ASME Section III, Division 2, 1983 (Reference 16) versus ACI 318-63 (Reference 15).

These comparisons were documented in the NRC SER of January 4, 1983 (Franklin Research Center Report TER C5257-322) (Reference 17). Rochester Gas and Electric responded to this report in letters dated April 22, 1983 (steel structures) (Reference 3) and May 27, 1983 (concrete structures) (Reference 11). The comparison showed that, for tornado-related loadings, all required safety-related structures either were able to meet currently required factors of safety, were shown to meet margin-to-failure criteria through detailed calculations, or were to be provided with additional reinforcement as part of the Structural Upgrade Program. For seismic loadings, it was determined that all concrete code changes were acceptable, except for the shear walls in the diesel generator buildings. These walls were to be further evaluated in conjunction with the Structural Upgrade Program (see Section 3.8.2.1).

Seismic loadings for steel structures were not specifically analyzed by RG&E. Rochester Gas and Electric considers that the main structural elements were determined to be suitable by virtue of the overall Lawrence Livermore Laboratory analysis, documented in NUREG Page 108 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS CR-1821 (Reference 18), which was approved by the NRC (Reference 19). The steel code changes concerning coped beams, moment connections, and steel embedments will be evaluated relative to the extreme seismic loads and load combinations, in conjunction with the overall Structural Upgrade Program.

Scuppers were installed in accordance with the RG&E May 27, 1983, submittal the NRC (Reference 11).

3.3.5.6 Diesel Generator Component Operability During the ACRS presentation, questions were raised concerning operability of diesel generator components (such as the day tank) due to the tornado differential pressure of 0.4 psi.

RG&E conducted an evaluation and concluded that no operability restrictions exist due to the expected 0.4 psi differential pressure.

3.3.5.7 Conclusions Based on a review, audit, and plant inspection, the NRC concluded that the evaluation and resolution of SEP Topics III-2, Wind and Tornado Loadings; III-4.A, Tornado Missiles; III-6, Seismic Design Considerations; and III-7.B, Load Combinations, were acceptable. The NRC also concluded that the RG&E analysis and implementation of the Structural Upgrade Program were acceptable (Reference 20).

The following modifications and analyses are the principal ones accomplished as part of the Structural Upgrade Program.

A. All primary structural steel framing, including their connections and anchorages, found to be overstressed when subjected to the following design loads have been modified to resist these loads: 132mph tornado windspeeds and 100 psf extreme snow load. They have also been modified as necessary to maintain integrity for 188-mph tornado windspeeds. These modifications were included in the auxiliary building, turbine building, intermediate building, control building, and facade structure.

The acceptance criteria for the steel components that have been upgraded for the 132-mph tornado loads, the severe snow and wind loads, and the extreme snow load is 1.6 S, where S is the required section strength based on elastic design methods and allowable stresses defined in AISC 1980. This applies to primary members, primary connections, and steel portions of primary anchorages (excluding the anchor bolts).

The acceptance criteria for anchor bolts and the concrete portion of the anchorages that have been upgraded for the 132-mph. tornado loads, the severe snow and wind loads, and the extreme snow load are in accordance with ACI 349 Appendix B.

The acceptance criteria for loads associated with the 188-mph tornado are that there is no loss of ultimate safety function.

The following modifications have been completed in the intermediate building restricted area side:

1. Low roof supports.

2. Structural members on all levels.

Page 109 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS B. Backdraft dampers were designed and installed in the auxiliary building north wall in order to eliminate the effects of differential pressures associated with the design-basis tornado.

These dampers were only required in the auxiliary building. The backdraft dampers relieve the differential pressure caused by the tornado by means of automatic louvers that remain closed during normal operations. The louvers are seismically attached to the Seismic Category I auxiliary building structure; however, the louvers themselves are nonseismic.

The louvers are designed to relieve a differential pressure of 0.4 psi at a pressure drop rate of 0.1 psi per sec. The louvers will open when air pressure outside the building is 0.4 psi less than the pressure inside. The louvers consist of six 3 ft x 6 ft panels for a total surface of 108 ft2.

C. No exterior shell or secondary member modifications were required on the basis that their failure would not damage required safety equipment (Reference 21).

D. The required safe shutdown equipment is protected from tornado missiles.

E. As part of the review of SEP Topic III-7.B, the shear walls in the diesel generator building were reevaluated relative to seismic forces. The diesel generator building was modified as part of the Structural Upgrade Program to withstand wind and tornado loads, including missiles, severe weather, design flooding, and seismic loads.

F. Certain modifications or protection from potential damage due to block wall failure were provided for the main steam and feedwater piping and associated valves, main steam isolation valve control cables, and the spent fuel assemblies.

G. Operability restrictions of diesel generator components due to differential pressure effects was evaluated and found to be negligible.

H. The east wall of the relay room (part of the control building) has been protected as part of the Structural Upgrade Program by a structure that will withstand wind and tornado loadings, including missiles, extreme snow loads, design-basis flooding, and operating basis earthquake and safe shutdown earthquake loads. The east wall of the control room is capable of resisting these loads (Reference 22).

I. As part of SEP Topic III-7.B and as noted in an RG&E letter of August 19, 1983 (Reference 23), certain code changes concerning coped beams, moment connections, and steel embedments in all buildings have been evaluated relative to seismic loadings.

3.3.6 INTERMEDIATE BUILDING BLOCK WALL REINFORCEMENT In compliance with NRC Order EA-12-049, Ginna has developed beyond design basis strategies to allow the station to cope following an extended loss of AC power (ELAP) coincident with an external event (Earthquake, Tornado, or External Flood). Ginnas current design basis safe-shutdown strategy following a seismic or tornado event requires the plant to reach Mode 3. However, NRC Order EA-12-049 requires Ginna to achieve cold shutdown (Mode 5) following each of these external events.

The Intermediate Building houses several components required to complete these strategies.

In the Intermediate Building Basement, cable trays containing key instrument channels pass from the protection of the cable tunnel, a Seismic Category I and Tornado-Missile Protected, subterranean structure to the containment penetrations located at the northeast of containment. However, the cabling for these loops leaves the protection of the cable tunnel Page 110 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS within the cold side of the intermediate building basement before reaching the containment penetration splice boxes.

Additionally, on the main steam header, the atmospheric relief valves must be locally operated to ensure a timely cool down and therefore needs to be protected.

Due to the relatively low capacity of the unreinforced Intermediate Building block walls, wall sections, required to maintain their structural integrity, have been reinforced to withstand the applied loads from tornado missiles or tornado winds, and capable of withstanding seismic loads. In general, the Intermediate Building block walls, in areas that require reinforcement, have been covered with 1/4 steel plate attached to additional structural framing. The steel plate and framing prevent tornado missiles or sections of falling block wall from impacting equipment required to support the beyond design basis mitigating strategies.

Page 111 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS REFERENCES FOR SECTION 3.3

1. U.S. Nuclear Regulatory Commission, Integrated Plant Safety Assessment, Systematic Evaluation Program, R. E. Ginna Nuclear Power Plant, NUREG 0821, December 1982.

2. U.S. Nuclear Regulatory Commission, Final Evaluation of SEP Topic II-2, Wind and Tornado Loadings, April 21, 1982.

3. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

Structural Reanalysis Program, dated April 22, 1983.

4. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topic III-4.A, Tornado Missiles, R. E. Ginna Nuclear Power Plant, dated April 16, 1982.

5. Electric Power Research Institute, Strength of Steel Plates Subjected to Missile Impact, Sixth Smirt Conference, NP-769, 1981.

6. Letter from J. E. Maier, RG&E, to H. R. Denton, NRC,

Subject:

Application for Amendment to the Operating License, Attachment B, dated January 18, 1984.

7. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Integrated Plant Safety Assessment Report, Sections 4.8, 4.11, and 4.17.1, dated August 22, 1983.

8. Letter from J. Ebersole, ACRS, to N. J. Palladino, NRC,

Subject:

Recommendations of the Advisory Committee Regarding the Ginna Structural Reanalysis Program, dated April 9, 1984.

9. U.S. Nuclear Regulatory Commission, Technical Evaluation Report, NRC Docket 50-244, August 2, 1983.

10. Letter from R. C. Mecredy, RG&E, to C. Stahle, NRC,

Subject:

Structural Upgrade SER, R. E. Ginna Nuclear Power Plant, dated January 25, 1989.

11. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic III-7.B, Design Codes, Criteria, and Load Combinations, dated May 27, 1983.

12. American Institute of Steel Construction (AISC), Manual of Steel Construction, Eighth Edition, 1980.

13. American Institute of Steel Construction (AISC), Manual of Steel Construction, Sixth Edition, 1963.

14. American Concrete Institute (ACI), Code Requirements for Nuclear Safety-Related Structures, ACI 349-80.

15. American Concrete Institute (ACI), Building Code Requirements for Reinforced Concrete, AIC 318-63.

16. American Society of Mechanical Engineers,Section III, Division 2, 1983.

Page 112 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

17. Franklin Research Center, Technical Evaluation Report, Wind and Tornado Loading, TER-C5257-400, December 2, 1981.

18. Lawrence Livermore Laboratory, Seismic Review of the R. E. Ginna Nuclear Power Plant as Part of the Systematic Evaluation Program, NUREG/CR-1821.

19. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Seismic Design, Construction, and Component Integrity, dated January 7, 1981.

20. Letter from A. Johnson, NRC, to R.C. Mecredy, RG&E,

Subject:

Supplemental Safety Evaluation - Systematic Evaluation Program/Structural Upgrade Program at R. E. Ginna, dated November 15, 1989.

21. Letter from C. Stahle, NRC, to R. W. Kober, RG&E,

Subject:

Safety Evaluation Report on the Structural Upgrade Program, dated March 24, 1987.

22. Letter from R. W. Kober, RG&E, to C. Stahle, NRC,

Subject:

Structural Upgrade SER, R. E. Ginna Nuclear Power Plant, dated May 26, 1987.

23. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic III-7.B, Design Codes, Design Criteria, and Load Combinations, dated August 19, 1983.

24. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

Structural Reanalysis Program, SEP Topics, II-2.A, III-2, III-4.A and III-7.B, dated May 19, 1983.

Page 113 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.3-1 PRIMARY MEMBER FAILURES PER LOADING COMBINATION Loading Combinationa Building Member Type Severe Severe + Severe + Sn Severe + Sn Severe + Sn Sn + Wt (132) + Wt (188) + Wt (250)

Auxiliary Columns 20 23 25 25 39 Beams 21 22 24 26 38 Bracing 6 14 14 15 36 Truss 0 0 0 0 0 Total 47 59 63 66 113 Columns 17 19 19 20 60 Beams 10 12 13 18 22 Bracing 2 7 12 12 37 Truss 4 7 10 15 25 Total 33 55 54 65 144 Turbine, Columns 16 17 34 44 51

Control, Diesel Beams 5 5 6 6 7 Bracing 57 72 87 104 154 Truss 2 5 34 35 52 Total 80 99 161 189 264 Screen Columns 2 2 2 2 31 House Beams 4 4 4 4 10 Bracing 2 2 6 12 20 Truss 0 0 9 28 109 Total 8 8 21 46 170 Totals 168 211 299 366 691

a. See Section 3.3.2.1.6 for definition of loading combinations.

Page 114 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.4 WATER LEVEL (FLOOD) DESIGN 3.4.1 FLOOD PROTECTION 3.4.1.1 Flood Protection Measures for Seismic Category I Structures 3.4.1.1.1 Introduction The general plant grade at Ginna Station is about 270 ft msl, with the exception of the area between Lake Ontario and the turbine building where the grade level is at elevation 253 ft.

The plant is protected from lake flooding by a breakwater with a top elevation of 261 ft, which prevents site flooding due to high water levels in the lake and lake storms from being a significant concern. The probable maximum flood originally considered in the design of Ginna Station was caused by Lake Ontario water and resulted in a flood level of 250.78 ft, later (1973) revised to 253.28 ft. During the Systematic Evaluation Program (SEP), flood protection from Deer Creek flooding was evaluated and a design flood level based on a Deer Creek discharge of 26,000 cfs was established (Section 2.4). The NRC staff considered this an acceptable level of protection, in conjunction with the Structural Upgrade Program (Section 3.8) and emergency procedures for installation of flood protection devices (Reference 1).

3.4.1.1.2 Lake Ontario Flood Protection The 261-ft msl breakwater which protects the plant from lake flooding is a stone revetment constructed in two reaches. They are an approximately 420-ft long west reach and an approximately 400-ft long east reach. The east and west reaches are separated by the 20-ft wide circulating water discharge canal. The stone revetment was initially constructed with two layers of 5-ton minimum armor stones laid upon a 1.0 vertical to a 1.5 horizontal sideslope to a minimum elevation of 257.0 ft msl. Because of the high lake levels that were predicted for Lake Ontario during the early 1970s, the crest elevation of the revetment was raised to a minimum of 261.0 ft msl by placement of cap stone along the top of the revetment.

As part of SEP Topic III-3.C, the NRC staff reviewed the design of the revetment and concluded that the original revetment design was adequate. Also, the Army Corps of Engineers was requested by the NRC to provide a technical opinion of the adequacy of the existing revetment.

The Buffalo District Corps of Engineers reviewed the design of the revetment. After visiting the site to inspect the revetment they concluded that it appeared to be structurally sound and stable with no evidence of any major structure stability program; and based on its performance to date, the anticipated durability and survivability of the revetment as constructed should exceed the life of the plant (Reference 2). The Corps recommended that RG&E implement a monitoring program in order to detect future movement of the armor stone. RG&E implemented an inspection program which was reported to the NRC by Reference 3.

Page 115 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.4.1.1.3 Deer Creek Flood Protection A Deer Creek discharge of 26,000 cfs corresponds to an elevation of 273.8 ft msl on the west and south side of the auxiliary building (west channel flow), 272.0 ft on the north and east side (east channel flow), and 256.6 ft msl on the north yard at the turbine building and screen house. R.E. Ginna agreed to provide protection to this level (Section 2.4.7).

Portable flood barriers have been installed in the auxiliary building for use in the event of flooding from Deer Creek. The flood barriers consist of a panel with a pair of inflatable gaskets on the sides and across the bottom. The panels slide into frames installed around the auxiliary building personnel access doors and the rollup vehicle access door. Air flasks located in the auxiliary building are used to inflate the gaskets. When the flood barriers are not in use they are mounted on brackets on the wall next to the doors they serve, except the rollup door barrier, which is mounted next to the 1G fan.

Emergency procedures provide for installation of the flood barriers and for connection of the alternative cooling water supply to the diesel generator (Section 9.5.5), assuming service water will be lost as a result of flooding of the screen house. The emergency procedures are to be instituted prior to the Deer Creek discharge flow reaching 10,000 cfs which corresponds to approximately 7.4 ft above the bridge level on the access road crossing Deer Creek to the station. The procedures conservatively institute the flood protection when the water rises above the handrails on the bridge.

The diesel generator building is protected from flooding from Deer Creek at a flood flow of 26,000 cfs by watertight doors in the building north wall.

See Section 2.4.3.4 for a discussion of beyond-design-basis reevaluated flood hazards, performed in response to the accident at Fukushima Dai-Ichi.

3.4.1.2 Permanent Dewatering System Ginna Station does not have a permanent dewatering system. The design-basis ground water level used in the original design of Ginna Station was 250 ft msl, which is approximately 20 ft below grade at the upper portion of the station. A ground water monitoring program was implemented from 1983 through 1987 to verify the design-basis ground water level and, as a result, the design-basis ground-water level was revised to 265.0 ft msl. It was determined that below grade safety-related structures were designed to withstand ground-water levels at grade (270.0 ft msl). See Section 2.4.10.1.

The Ginna design provides for no backfill against the containment wall. The excavation around the major portion of the vessel is graded to ensure slope stability of the in-place material under all conditions. At a limited portion of the circumference where grade level is maintained adjacent to the containment, there exists a retaining wall spaced 2 ft to 6 ft clear of the containment wall designed specifically to resist all earth pressure due to backfill. No provision is made to prevent ground water from penetrating the void created between the retaining wall or earth and the containment wall. The opening between the retaining wall and the containment wall is covered with a concrete slab to ensure that the void is not filled with debris. Where the exterior walls of the containment are exposed to ground water, the walls from the edge of the ring girder up to elevation 235 ft are waterproofed with a bitumastic membrane system reinforced with glass fibers. In addition, prior to the Page 116 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS application of the membrane courses, the angle at the intersection of the wall and ring girder was further reinforced with glass fabric.

3.4.2 FLOODING DUE TO FAILURE OF TANKS In the SEP Integrated Plant Safety Assessment Report (NUREG 0821), Topic IX-3, Section 4.25.3, the NRC staff expressed a concern that failure of tanks in the auxiliary building could flood out safety-related equipment in the lower levels of the building. An RG&E evaluation determined that the total volume of all nonseismic tanks in the auxiliary building was 208,703 gal. The evaluation showed that, based on the 70,000-gal capacity of the residual heat removal pit (i.e., the lowest point in the building), and the net free surface area of the auxiliary building basement of 4813 ft2, the failure of nonqualified tanks in a seismic event would result in a water level of 3 ft 10 in.

Loss of both residual heat removal pumps had been previously evaluated in conjunction with the fire protection review and it was determined that the plant could achieve and maintain MODE 5 (Cold Shutdown) conditions utilizing alternate methods (Reference 4).

However, the water level resulting from a failure of all non-qualified tanks would be greater than the height of required safe shutdown equipment. As a result, RG&E qualified the three chemical and volume control system holdup tanks and the waste holdup tank to Seismic Category I. Therefore, the resulting maximum water volume which could be discharged onto the auxiliary building floor in the event of failure of the remaining nonqualified tanks is 93,803 gal. This would result in a maximum water level of only 8 in.,

which is below the elevation of the bottom of the safety injection pump motor of 20 in.

With the qualification of these tanks, the NRC staff determined that the issue of internal flooding due to seismic qualification of tanks was adequately resolved for the Ginna plant (Reference 5).

The vendor supplied demineralization system in the auxiliary building (Section 11.2.2.13) was evaluated for its potential effects on plant flooding. For the purposes of the auxiliary building flooding analysis, this system resulted in a maximum water volume increase of 0.2 in., which would result in a maximum water level of 8.2 in. Since this new calculated maximum water level is below the 20-in. elevation of the bottom of the safety injection pump motor, the basis for the acceptance of the flooding analysis has not been changed.

The reactor water makeup tank and the two monitor tanks were not seismically qualified per the original plant design. These three tanks have been modified to add seismically qualified structural reinforcement which eliminates their contribution to the estimated flooding volume.

3.4.3 ROOF DRAINAGE The low roof sections of the intermediate and auxiliary buildings; the control building, diesel generator building, and screen house roofs; and the turbine building parapets have been provided with scuppers designed to ensure that any rainwater, resulting from a design-basis storm, would not accumulate on the roofs and cause damage. The scuppers are located so that their outflow will not damage any surrounding plant structures or equipment. The flow from the scuppers will not discharge on equipment or structures required for safe shutdown.

Page 117 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The design-basis storm is a 24-hour rainfall totaling 19.17 in. of rain, with a 1-hour maximum of 6.11 in. The combined flow of all the scuppers on each roof is designed to handle at least this flow.

Generic Letter (GL) 89-22 (Reference 6) informed licensees that higher rainfall intensities over shorter time intervals and smaller areas should be considered. As part of the RG&E Individual Plant Examination for External Events (IPEEE) submittal, RG&E calculated the roof de-watering capabilities relative to the revised probable maximum rainfall (Reference 7). As a result of this analysis (Reference 8), the Control Building roof de-watering capabilities were modified to ensure design roof loads would not be exceeded in the event the new probable maximum rainfall were to occur.

The design maximum level the rainfall is allowed by the scuppers to accumulate on the roofs is 1.6 ft. This depth of rainfall would produce a load of approximately 100 lb/ft2, which is equal to the maximum winter precipitation for a storm with a probability of 1 x 10-4 recurrence interval (SEP Topic II-2A). A 100 lb/ft2 load was found in the structural upgrade program to be the maximum load the roofs could support without effecting the margins of safety of the structures.

Page 118 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS REFERENCES FOR SECTION 3.4

1. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Integrated Plant Safety Assessment Report, Section 4.5, Plant Flooding by Deer Creek, R. E. Ginna Nuclear Power Plant, dated August 19, 1983.

2. Letter from G. P. Johnson, Corps of Engineers, to Project Officer, NRC,

Subject:

R. E.

Ginna Nuclear Generating Plant, Town of Ontario, NY, dated December 10, 1981.

3. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

Draft NUREG 0821, R. E. Ginna Nuclear Power Plant, dated August 25, 1982.

4. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Fire Protection Rule, dated April 11, 1983.

5. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Integrated Plant Safety Assessment Report (IPSAR) Section 4.25.3, Flooding Due to Failure of Tanks, R.

E. Ginna Nuclear Power Plant, dated July 8, 1983.

6. Generic Letter 89-22, Potential for Increased Roof Loads and Plant Area Flood Runoff Depth at Licensed Nuclear Power Plants Due to Recent Change in Probable Maximum Precipitation Criteria Developed by the National Weather Service, dated October 19, 1989.

7. Letter from R.C. Mecredy, RG&E, to G.S. Vissing, NRC,

Subject:

Individual Plant Examination for External Events (IPEEE), High Winds, External Floods and Transportation Accidents, dated December 21, 1998.

8. Design Analysis, DA-CE-98-153, Revision 1, Roof Scupper Capacity Check, dated September 22, 1999.

Page 119 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.5 MISSILE PROTECTION 3.5.1 INTERNALLY GENERATED MISSILES 3.5.1.1 Introduction 3.5.1.1.1 Design Criteria Systems containing hot pressurized fluids are carefully checked for potential sources of missiles where such missiles could be directed toward engineered safety features. Suitable engineering and quality control are applied to the design, manufacture, and installation of components to prevent the generation of missiles where such missiles could adversely affect the intended functioning of engineered safety features.

Thus, a design criterion is that components of the pressurized systems defined above are not missile sources. Prevention of missiles is accomplished by identifying all potential sources, investigating to ensure design adequacy in preventing missile generation, redesigning where the investigation discloses inadequate safety margins for missile prevention, and providing a suitable quality assurance program to avoid unanticipated deficiencies and ensure that design margins are preserved.

3.5.1.1.2 Systematic Evaluation Program As part of the Systematic Evaluation Program (SEP Topic III-4.C), a detailed review of internally generated missile effects was conducted.

Missiles which are generated internally to the reactor facility (inside or outside containment) may cause damage to structures, systems, and components that are necessary for the safe shutdown of the reactor or for accident mitigation or may cause damage to the structures, systems, and components whose failure could result in a significant release of radioactivity.

The potential sources of such missiles are valve bonnets and hardware retaining bolts, relief valve parts, instrument wells, pressure containing equipment (such as accumulators and high-pressure bottles), high speed rotating machinery, and rotating segments (i.e., impellers and fan blades). Turbine missiles are addressed in Section 3.5.1.2.

The acceptability of the design of structures, systems, and components for protection against internally generated missiles is based on meeting General Design Criterion 4. Additional guidance is contained in Regulatory Guide 1.13, Spent Fuel Storage Facility Design Basis, Revision 1, December 1975, and Regulatory Guide 1.27, Ultimate Heat Sink for Nuclear Power Plants, Revision 2, January 1976.

Systems and components needed to perform safety functions (safe shutdown or accident mitigation) are listed below and discussed in Section 3.5.1.3.

• Reactor coolant system.

• Emergency Core Cooling System (ECCS).

• Containment heat removal and atmosphere cleanup systems.

• Chemical and volume control system (some portions).

Page 120 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

• Residual heat removal system.

• Component cooling water (CCW) system.

• Service water (SW) system.

• Diesel-generator auxiliary systems.

• Main steam system (some portions).

• Feedwater and condensate systems (some portions).

• Auxiliary feedwater systems.

• Standby auxiliary feedwater system.

• Ventilation systems for vital areas.

• Combustible gas control system.

• Refueling water storage tank (RWST).

Systems whose failure may result in release of unacceptable amounts of radioactivity are as follows:

• Spent fuel pool cooling and cleanup system.

• Sampling system.

• Waste disposal system.

• Containment purge system.

• Instrument and service air systems.

Additionally, electrical systems that are necessary to support those fluid systems needed to perform safety functions are noted in the following list.

• Diesel generators.

• Station batteries.

• 480-V switchgear and relay rooms.

• Control room.

• Cable spreading room.

Based on a safety review pursuant to SEP Topic III-4.C (Reference 1), the NRC staff has concluded that the design of Ginna Station for protection from internally generated missiles meets the intent of General Design Criterion 4 and the guidance from Regulatory Guides 1.13 and 1.27.

3.5.1.2 Turbine Missiles 3.5.1.2.1 Introduction Failure of turbine disks and rotors can result in high-energy missiles that have the potential for resulting in damage to plant safety features. There are two areas of concern:

Page 121 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Design overspeed failures.

These are related to the material quality of the turbine disks and rotors, inservice inspection for flaws, and chemistry conditions that could lead to stress-corrosion cracking.

Destructive overspeed failures.

These are related to the reliability of the electrical overspeed protection system, the reliability of and the testing program for turbine stop valves and turbine control valves, and the inservice inspection of these valves.

The purpose of evaluating the potential for turbine missiles is to ensure that all structures, systems, and components important to safety either have adequate protection by means of structural barriers or have an acceptably low probability of damage. Criteria for evaluating missile protection are contained in General Design Criterion 4. Additional guidance is contained in Regulatory Guide 1.115, Protection Against Low Trajectory Turbine Missiles, Revision 1, July 1977; and Regulatory Guide 1.117, Tornado Design Classification, Revision 1, April 1978.

3.5.1.2.2 Turbine Inspection Program Low-pressure turbine disk cracking in Westinghouse turbines has been experienced at several operating plants. As a result, an RG&E turbine inspection program (References 2 and 3) was developed to provide an acceptably high degree of assurance that turbine disks will be inspected before cracks can grow to one-half the size that could cause disk failure at speeds up to the design speed (see Section 10.2.3.4). Ginna LLC performs testing of the turbine overspeed protection system to provide assurance that the system will remain operable and thereby limit the likelihood of overspeed beyond design conditions (Reference 7), based on the criteria in WCAP-11525 and WCAP-11529 (Reference 6). These tests are described in Section 10.2.3.4.4.

The turbine supervisory instrumentation monitors turbine vibration, eccentricity, and differential thermal expansion and alarms abnormal conditions (Section 10.2.1.4).

3.5.1.2.3 Systematic Evaluation Program Topic III-4 All the systems needed for the safe shutdown of the plant are either inside or shadowed by the concrete containment building, located below the turbine pedestal, or are out of the turbine low trajectory missile strike zones. In addition, many of the systems have physically separated redundant components. On this basis, the NRC staff, in the Safety Evaluation Report (SER) for SEP Topic III-4.B considered that the probability of a low trajectory missile striking any of the safety-related systems is acceptably low.

The probability of turbine high trajectory missiles striking the safety-related systems is obtained by multiplying the conservatively estimated turbine failure and missile ejection rate, 10-4 per year, by the strike probability density per turbine failure, 10-7 per ft2, and by the horizontal area occupied by the systems. A conservative estimate of the area occupied by these systems is 12,000 ft2. The turbine failure rate of 10-4 is also conservative because of the use of a historically observed turbine failure data set. Some of the reported failures involved Page 122 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS old turbine designs and fabrication techniques which have been improved in currently produced turbines (a new turbine rotor was installed at the Ginna plant during the 1979 MODE 6 (Refueling) outage). The resulting probability of high trajectory missile strikes is found to be on the order of 10-7 per year, and the total strike probability from low and high trajectory missiles is conservatively estimated to be less than 10-6 per year.

Based on the above figures, in the SER for SEP Topic III-4.B, the NRC staff considered that the overall probability of turbine missiles damaging Ginna Station and leading to consequences in excess of 10 CFR 100 exposure guidelines is acceptably low (Reference 4).

Due to plant uprate, the maximum allowable turbine overspeed setpoint was reduced from 110% to 109.3%. The overspeed setpoint is used to ensure that the maximum turbine over-speed does not exceed 120% of turbine design speed (1800 rpm).

3.5.1.3 Effects of Internally Generated Missiles on Systems and Equipment 3.5.1.3.1 Systems Needed to Perform Safety Functions 3.5.1.3.1.1 Reactor Coolant System The reactor coolant system serves as the pressure retaining boundary for the reactor coolant and is comprised of a reactor pressure vessel and two parallel heat transfer loops. Each loop contains one steam generator and one pump, connecting piping, and instrumentation. The pressurizer and associated safety and relief valves are connected to one of the reactor hot legs via the surge line. Pressurizer spray lines and associated valves are connected to the top of the pressurizer from one of the reactor coolant cold legs. The purpose of the pressurizer is to maintain primary coolant pressure and compensate for coolant volume changes as the heat load changes. All components of the primary coolant system are located within the containment building. Overpressure protection is provided to ensure the coolant system pressure does not exceed design limits.

The reactor closure head and the reactor vessel flange are joined by forty-eight 6-in. diameter studs. It is unlikely that any of the studs would become a missile since they are not subjected to direct reactor pressure and, therefore, are not exposed to sufficient pressure to create an accelerating force sufficient to cause them to become missiles.

The pressurizer safety and relief valves, which are mounted atop the pressurizer, have the potential for becoming missiles. However, the position of the pressurizer within a concrete compartment is such that any missiles generated because of a failure of these valves would not be likely to damage other components or piping of the reactor coolant system. All valves on the pressurizer spray line are located within the loop or pressurizer compartments, and thus would not be expected to damage any safety-related equipment in the event of a valve failure.

In 1995, the three missile shield blocks on top of the pressurizer compartment were reconfigured from the original design to allow air flow through the compartment. This modification was supported by an evaluation which determined that the repositioned blocks would still protect vital equipment in the containment from the effects of internally generated Page 123 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS missiles and released high energy fluid or steam should a piping failure occur in the pressurizer compartment.

Control rod drive assemblies are mounted on the top of the reactor vessel and are considered an extension of the reactor vessel head. A 1.25-in. thick steel missile shield is placed over the control rods during operation as protection against missile damage to safety systems caused by impacting control rod drives or reactor vessel head studs.

Instrumentation requires some penetration into the reactor coolant system. These penetrations are small and generally take the form of welded wells. Because of their size and orientation, serious damage to the reactor coolant system is highly unlikely.

The possibility that missiles may result from destructive overspeeding of one of the primary coolant pumps in the event of a pipe break in the pump suction or discharge was also reviewed. Potentially damaging impeller missile ejection from the broken pipe is minimized by a massive steel pump casing. Generation of missiles from overspeed of the motor, flywheel, and impeller of the reactor coolant pump is addressed in Section 5.4.1.

The two steam generators have manways held in position by studs on the primary and secondary sides of the shell. These small diameter studs are subject only to stored elastic energy and thus are not considered to be credible missiles.

In summary, relative to the reactor coolant system, the likelihood of missile generation and resultant damage is minimized by equipment design features, component arrangement, and compartmentalization.

3.5.1.3.1.2 Emergency Core Cooling System (ECCS)

The Emergency Core Cooling System (ECCS) serves as the means of injecting water for core protection in the event of reactor coolant system water loss. The Emergency Core Cooling System (ECCS) is comprised of the high-pressure safety injection system, the residual heat removal system (for low-pressure safety injection), and accumulator tanks. High-pressure safety injection flow and accumulator flow are directed to the reactor coolant system through the two cold-leg reactor inlet pipes. The high-head system consists of three pumps, each rated at 300 gpm. Two passive accumulator tanks containing borated water, pressurized with nitrogen to 700 psig, are provided inside the containment building. The residual heat removal system injects directly into the reactor vessel upper plenum via two nozzles on opposite sides of the vessel. The low-head residual heat removal system consists of two pumps, each rated at 1560 gpm.

The suction source of water for the high-head pumps is the refueling water storage tank (RWST). The refueling water storage tank (RWST) is not missile protected; however, the only internally generated missiles that could potentially affect the tank would originate at component cooling water (CCW) system and service water (SW) system valve locations.

Both of these systems are low-pressure, cold water systems with insufficient internal energy to generate any missiles of consequence.

The high-pressure and low-pressure piping systems are separated from each other outside containment, taking suction from opposite sides of the refueling water storage tank (RWST).

Page 124 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS One train of each of these systems is routed together in the auxiliary building. The redundant trains of these systems are routed separately. Once inside the containment, separation of the individual injection lines is provided. Each train of the residual heat removal and high-pressure safety injection piping is routed in opposite directions inside the containment.

Injection headers are located outside the missile barriers. Individual injection lines connected to the injection headers pass through the missile barriers and then connect to the reactor coolant system.

The most likely sources of missiles in the Emergency Core Cooling System (ECCS) are the residual heat removal and high-pressure safety injection pumps. The high-pressure safety injection pumps are 350-hp horizontal multistage centrifugal pumps operating at 3550 rpm.

The residual heat removal pumps are 200-hp horizontal single-stage centrifugal pumps operating at 1770 rpm. These pumps have a thick steel casing, making it highly improbable that a source of missiles, such as a broken impeller, would penetrate the casing to cause any damage.

The residual heat removal pumps are located in the residual heat removal pit, separated from other safety-related equipment. During MODES 1 and 2, the portions of the system upstream of the isolation valves are isolated from the high-pressure reactor coolant system, and are therefore not subjected to forces which might cause a missile to be generated. If a missile were generated as a result of pump failure during normal reactor shutdown, it would affect only the residual heat removal system. The residual heat removal system could be isolated and the reactor maintained in a stable shutdown condition, using the steam generators, until repairs could be made.

The high-pressure safety injection system is also normally cold and not at sustainable high pressure. With these conditions a leak or break would not result in significant thrust forces.

Thus, it is not expected that missiles would be generated. Pressure boundary valves, which are subject to high pressure, have backseats which should prevent missile generation.

Two accumulators, located on separate sides of the containment are situated behind the steam generator missile shielding. Accumulator missile sources are not oriented towards any other safety-related equipment.

Because of the functional design features, separation, and component design provisions of the Emergency Core Cooling System (ECCS), the system will be capable of performing its intended functions considering internally generated missile sources as discussed above.

3.5.1.3.1.3 Containment Heat Removal and Atmosphere Cleanup Systems The containment heat removal and atmosphere cleanup systems consist of two independent systems: the containment air recirculation system, and the containment spray system. The containment air recirculation system consists of four fans and heat exchangers, as well as two charcoal filter units. The containment spray system consists of two spray pumps, with associated piping, ring headers, and nozzles. The source of water for the containment spray system is the refueling water storage tank (RWST).

Page 125 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The four containment fan cooler units are positioned in pairs on opposite sides of the containment. Because of this separation, it is unlikely that a single missile could cause failure of more than one pair of these units. The spray system headers and nozzles are split into redundant trains. The spray nozzles are located high inside containment. Therefore, it is not likely that any missiles would reach these components. Should a number of the nozzles be damaged, containment cooling would still be provided using nozzles in the redundant train and by the fan cooler units.

The spray system pumps are located in the auxiliary building, near the high-pressure safety injection pumps. However, the orientation of the high-pressure safety injection pumps to the spray pumps is such that damage to the spray pumps is highly improbable in the unlikely event of missile generation from any of the high-pressure safety injection pumps. There are no high energy lines in this vicinity that could be a source of internally generated missiles.

Further, the spray system itself is not under pressure during MODES 1 and 2. It is therefore concluded that no failure due to internally generated missiles is expected for the containment spray system.

The containment heat removal and atmosphere cleanup systems, considering their redundant features and separation, will be capable of performing their design function from the standpoint of internally generated missiles.

3.5.1.3.1.4 Chemical and Volume Control System The chemical and volume control system controls and maintains reactor coolant system inventory and purity through the process of makeup and letdown, and provides seal injection flow to the reactor coolant pump seals. The letdown portion of the system consists of a regenerative heat exchanger and a nonregenerative heat exchanger to cool the reactor coolant letdown and three parallel orifice valves to reduce the pressure. The coolant is passed through purification and deborating demineralizers, as necessary, where corrosion and fission products are removed. The coolant is then routed to the volume control tank. Seal return flow passes from the reactor coolant pump seals, through a containment isolation valve and the seal-water heat exchanger, before returning to the volume control tank.

The seal return line is at low pressure and temperature. The charging pumps draw from the volume control tank and inject into the reactor coolant system, both through the normal makeup path and via the reactor coolant pump seals.

Borated water from the boric acid storage tanks can be added to the reactor coolant system by injection from the charging pumps. The boric acid storage tanks are protected from internally generated missiles by virtue of their location within concrete cubicles.

The most likely source of missiles in the chemical and volume control system would be generated in the letdown line and charging line on the reactor coolant system side of the regenerative heat exchanger, in portions of the chemical and volume control system connected directly to the reactor coolant system, and in the chemical and volume control system letdown piping up to the nonregenerative heat exchanger.

Page 126 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The only equipment that needs to be considered with respect to potential missiles from the chemical and volume control system letdown line is selected cable trays; however, potential missile sources are located remotely from safety-related cable trays.

Valve stems are the only potential missile sources associated with the charging line inside containment and the letdown line outside containment. However, the valves all have backseats and would not be expected to be a source of missiles. There are no other potential missile sources in the vicinity of these portions of the chemical and volume control system.

The chemical and volume control system is adequately protected from the effects of internally generated missiles.

3.5.1.3.1.5 Residual Heat Removal System This system is discussed as part of the low-pressure safety injection portion of the Emergency Core Cooling System (ECCS) in Section 3.5.1.3.1.2.

3.5.1.3.1.6 Component Cooling Water System The component cooling water (CCW) system is a closed system with two motor-driven pumps rated at 150 hp and 2980 gpm, and two shell and straight tube heat exchangers. Heat transferred to the component cooling water (CCW) system is removed by the service water (SW) system and released into Lake Ontario.

The component cooling water (CCW) system removes heat from the residual heat removal heat exchangers, engineered safety features pump seals and jackets, chemical and volume control system and sampling heat exchangers, reactor coolant pump seals, bearings and motors, reactor support cooling pads, waste gas compressors, and the items in the waste and boric acid systems.

This system would be an unlikely source of missiles due to its low operating temperature and pressure. Other potential missile sources near the component cooling water (CCW) system have not been identified. However, if a missile were to cause a failure of the component cooling water (CCW) system, residual heat removal could be accomplished via the preferred auxiliary feedwater system and steam generators until repairs to the component cooling water (CCW) system could be made.

The component cooling water (CCW) system is adequately protected from internally generated missiles.

3.5.1.3.1.7 Service Water System The service water (SW) system consists of four 5300-gpm capacity vertical motor-driven pumps located in the screen house. The original motors installed on the service water (SW) pumps were rated at 300-hp. The motors were replaced between 1995 and 1997 with 350-hp motors. The system is designed such that there are two redundant safety-related trains, each capable of supplying one set of required safety-related equipment. As a result of plant uprate two (2) Service Water (SW) pumps from either train are required to provide the necessary safe shutdown and postaccident safety functions for design bases LOCA. These pumps, Page 127 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS located approximately 7 ft apart, take suction from and discharge to the ultimate heat sink (Lake Ontario).

The system piping is routed underground from the screen house to the other structures. The two service water (SW) headers can be tied together via normally closed redundant manual valves. Separation of safety and nonsafety loads is provided via redundant isolation valves.

The service water (SW) pumps are not considered likely sources of missiles due to their enclosure (casing) and submergence in the service water (SW) pump bay, and their low operating speed and pressure.

Also located in the screen house is one diesel-driven and one motor-driven fire pump. These pumps are not normally in operation and therefore are considered unlikely sources of internally generated missiles.

There are no potential sources of missiles in the vicinity of the service water (SW) system as the piping enters the various buildings, with the exception of that portion which enters the intermediate building. In this building, the only high-pressure system in the vicinity of the service water (SW) system is the steam generator blowdown system.

The service water (SW) system meets the requirements for protection from internally generated missiles.

3.5.1.3.1.8 Diesel-Generator Auxiliary Systems The two diesel generators are located in separate diesel-generator rooms, located off the north side of the turbine building. These are low speed engines with no high-pressure hydraulic systems.

Due to separation of redundant portions of the system, and the segregation of the system as a whole, the system meets the design requirements with respect to internally generated missiles.

3.5.1.3.1.9 Main Steam System The main steam system consists of two steam generators with two steam lines which connect in the intermediate building prior to entering the turbine building. Each steam line has four main steam safety valves, an atmospheric dump valve, a steam admission valve to the turbine-driven auxiliary feedwater pump (TDAFW), a main steam isolation valve, and a nonreturn valve, all located in the intermediate building, upstream of the junction of the two lines.

The main steam lines are of heavy walled construction, and are unlikely to be damaged by internally generated missiles. The main steam components are routed in a fashion so as to utilize plant structures for missile protection. Should a missile cause damage to the main steam system downstream of the isolation valve, the valve would close and the plant would shut down. If damage occurs either to the isolation valve or upstream of the valve, safe shutdown can be accomplished. A steam line break accident has been evaluated in Section 15.1.5.

The main steam system will be capable of performing its design function, considering internally generated missiles.

Page 128 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.5.1.3.1.10 Feedwater and Condensate Systems The main feedwater system consists of two motor-driven feedwater pumps which deliver water to the steam generators. Condensate from the hotwell is pumped by three 50% capacity motor-driven condensate pumps, through the hydrogen coolers, air ejectors, gland steam condenser, and then through several stages of preheating. The feedwater then passes into the containment and into the steam generators. The only area of concern for this system is that portion between the main feedwater isolation valves and the steam generators.

Due to the protection afforded by surrounding equipment, missile damage to this portion of the feedwater system is unlikely. However, if damage to this area were to occur, the preferred auxiliary feedwater system or the standby auxiliary feedwater system (SAFW) could provide the necessary feedwater flow to the second steam generator in order to effect safe shutdown.

No additional protection is needed for the feedwater and condensate systems to protect them from the effects of internally generated missiles.

3.5.1.3.1.11 Preferred Auxiliary Feedwater System The preferred auxiliary feedwater system consists of two 100% capacity motor-driven auxiliary feedwater pumps (MDAFW), each directing flow to one steam generator, and a 200% capacity turbine-driven auxiliary feedwater pump (TDAFW), which directs flow to both steam generators. The design flow of the motor-driven pumps is 200 gpm; the turbine-driven pump is 400 gpm. The primary suction source of the pumps is from the condensate storage tanks. If necessary, the service water (SW) system will provide an unlimited water supply to these pumps.

The most likely source of missiles would be from the pumps. The turbine-driven pump is separated from the motor-driven pumps by a concrete enclosure/barrier. Separation is provided such that a postulated missile will not damage both trains associated with the motor-driven pumps. Therefore, in the unlikely event that a missile is generated, each train of the system is sufficiently separated to ensure system performance.

However, in the event that the preferred auxiliary feedwater system becomes unavailable due to a missile strike, the standby auxiliary feedwater system (SAFW) is capable of delivering the required feedwater flow to the steam generators to safely shut down the plant. No additional missile protection is needed for the preferred auxiliary feedwater system.

The preferred auxiliary feedwater system, through redundancy and separation, meets the design requirements with respect to internally generated missiles.

3.5.1.3.1.12 Standby Auxiliary Feedwater System (SAFW)

The standby auxiliary feedwater system (SAFW) consists of two 100% capacity pumps and piping which directs the flow from one pump to one steam generator. A cross-connect would allow each pump to feed either steam generator. The system would be used only in the event of a failure of the preferred auxiliary feedwater system. The standby auxiliary feedwater system (SAFW) is remotely located from the preferred auxiliary feedwater system such that Page 129 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS a failure in the preferred auxiliary feedwater system would not affect the ability of the standby auxiliary feedwater system (SAFW) to safely shut down the plant.

The standby auxiliary feedwater system (SAFW) needs no additional protection against the effects of internally generated missiles.

3.5.1.3.1.13 Ventilation Systems for Vital Areas As part of the original design, safety-related pump motor coolers provide ducted air, cooled by service water (SW), to the rooms which contain the safety injection and containment spray pump motors, and to the residual heat removal pump and charging pump rooms. In 1992, service water (SW) to the room coolers for the safety injection and containment spray pump motors was blanked off (see Section 9.4.9.1).

The control room is air conditioned by its own ventilation system that is described in Section 6.4.

Ventilation for the two battery rooms is provided by an independent air conditioning system.

This system takes suction from the air handling room and discharges from the battery rooms through the turbine building to the outside.

The ventilation systems are low-pressure systems, and therefore are not considered to be sources of potential missiles. There are no sources of missiles in the vicinity of the control room, battery room, or pump room ventilation systems. Though ductwork can be penetrated by missiles, the total cooling capability is not lost for any area and time is available for action to restore adequate ventilation.

The ventilation systems for vital areas will be capable of performing their design function, considering internally generated missiles.

3.5.1.3.1.14 Combustible Gas Control System Redundant hydrogen recombiners located on opposite sides inside the containment have been provided. Since the hydrogen recombiner is not normally in operation, it is not considered to be a source of missiles. The system is not needed to shut the plant down. Should a missile strike the system, its repair could be scheduled in a timely manner so as not to interfere with plant operation. The NRC has removed from the Ginna Technical Specifications the requirements related to hydrogen recombiners and hydrogen monitors (Reference 8).

3.5.1.3.2 Systems Whose Failure May Result in Activity Release 3.5.1.3.2.1 Spent Fuel Pool Cooling System The spent fuel pool (SFP) cooling system is designed to remove heat from the spent fuel pool (SFP), which is generated by stored spent fuel. The system was originally designed as a single train system, consisting of a pump, demineralizer, filter, and heat exchanger. See Section 9.1.3.1 for an update of the system configuration. Heat is removed from the system by the service water (SW) system.

Page 130 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The spent fuel pool (SFP) cooling system is a low-pressure system and is unlikely to generate missiles. The system arrangement is such that the spent fuel pool (SFP) itself could not be damaged. If the spent fuel pool (SFP) cooling system was damaged, the large thermal capacity of the pool would maintain temperatures below design (180F) for many hours. As a means of alternate cooling, six (6) spent fuel pool (SFP) cooling loop options, as listed in the Technical Requirements Manual (TRM), provide 100% cooling capability (under normal operation) before any excessive heatup occurs.

The spent fuel pool (SFP) cooling system is capable of performing its function, considering internally generated missiles.

3.5.1.3.2.2 Sampling System The sampling system provides samples for laboratory analysis to evaluate reactor coolant, feedwater steam system, and other reactor auxiliary systems during MODES 1 and 2. Samples are routed in an area away from other required safety-related equipment and into a separate room. Shielding is provided for the sampling lines. The likelihood of missiles causing damage to the sampling lines is very small. The sampling system meets the design requirements with respect to internally generated missiles.

3.5.1.3.2.3 Waste Disposal System The entire waste disposal system is a low-pressure system, and is thus an unlikely source of missiles. The most likely sources, the gas decay tanks, are separated from other safety-related systems. The failure of a gas decay tank is a design-basis event which has been analyzed.

Resultant doses are within allowable limits.

In addition, missile damage to other portions of the system will not affect the safe shutdown of the facility. This system is adequately protected from the effects of internally generated missiles.

3.5.1.3.2.4 Containment Shutdown Purge System The containment shutdown purge system is provided to purge the containment during cold or MODE 6 (Refueling) shutdown. The system consists of ductwork, dampers, fans, and filters.

The normal operating pressure of this system is low, and therefore this system is considered an unlikely source of missiles. Ductwork and components are routed away from potential missile sources. If missile damage were to occur, ample time to perform repairs would be available. The missile protection provided for the system is, therefore, acceptable.

3.5.1.3.2.5 Instrument and Service Air Systems The instrument and service air systems consist of four air compressors (three instrument air, one service air), four aftercoolers, four air receivers as well as air dryers, prefilters, and filters.

Two instrument air compressors are of the vertical type, with the use of oil-free cylinder construction. The third instrument air compressor and the service air compressor are two stage oil free rotary screw air compressors. The instrument air systems are cooled by the service water (SW) system. The service air compressor is air cooled.

Page 131 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The air systems are not safety-related. All equipment controlled by the air systems is either not required to operate for safe shutdown or accident mitigation, or fails in the safe position upon loss of air.

The air systems are low-pressure systems which operate between 115 psig and 125 psig. The greatest potential missile generators are the air compressors and air receivers. However, these components are located in the turbine building away from safety-related equipment.

The instrument and service air systems are not required to perform safety-related functions, and the design, with respect to internally generated missiles, will not prevent safety-related systems from performing their design functions.

3.5.1.3.3 Electrical Systems The effects of missile generation on cabling, cable trays, instrumentation, and control panels associated with systems needed to perform safety functions were also evaluated during review of the systems discussed above.

3.5.1.3.3.1 Diesel Generators See Section 3.5.1.3.1.8.

3.5.1.3.3.2 Station Batteries The two station batteries are in separate rooms, both of which are located away from potential missile sources. Should a missile originate from the batteries themselves, the walls that separate the two rooms will prevent missile penetration. The separate rooms for the two station batteries provide adequate protection from internally generated missiles.

3.5.1.3.3.3 480-Volt Switchgear Two 480-V load centers comprise the engineered safety features electrical system. The load centers are located in separate rooms, on different floors within the auxiliary building. There are no piping or pressurized sources near these rooms which could pose a potential missile source. Therefore, adequate protection from internally generated missiles has been provided.

3.5.1.3.3.4 Control Room Piping, pressurized sources, or rotating machinery are not located within the control room.

Ventilation ductwork is routed into the control room. Damaging missiles from the ventilation system are considered unlikely. There are no missile sources which could affect the proper functioning of the control room.

3.5.1.3.3.5 Cable Spreading/Relay Room The cable spreading room (or relay room) does not contain any piping or other pressurized sources, or rotating equipment which might produce missiles. The fire protection system in this room is low pressure and thus is not capable of generating damaging missiles. There are no potential missile sources in this area that could affect safety functions.

Page 132 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.5.2 EXTERNALLY GENERATED MISSILES 3.5.2.1 Tornado Missiles Ginna Station has been assessed (SEP Topic III-4.A) to determine the ability of the plant to withstand the impact of tornado missiles. The purpose of the assessment was to verify that structures, systems, and components necessary to ensure (1) the integrity of the reactor coolant pressure boundary, (2) the capability to shut down the reactor and maintain it in a safe shutdown condition, and (3) the capability to prevent accidents that could result in unacceptable offsite consequences, can withstand the impact of a spectrum of tornado missiles.

Criteria for evaluating missile protection are in General Design Criterion 4. Additional guidance on tornado missiles is contained in Regulatory Guide 1.117, Tornado Design Classification, April 1978, and Regulatory Guide 1.78, Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, June 1974.

As noted in Section 3.3, the design-basis tornado at Ginna Station has a maximum wind speed of 132 mph. For this wind speed, the design-basis missile is a steel rod, with 1-in. diameter, 3-ft length, 8-lb weight, and 116 ft/sec velocity striking at all elevations. A wooden utility pole is considered as a missile in some analyses, but is not a required design basis missile since a study showed that wind speed of 132 mph lacks the aerodynamic lift needed to make the pole airborne. Further discussion is found in section 3.3.5.4.1 and References 9, 10, &11.

As a result of the analysis in response to SEP Topic III-4.A, RG&E as part of the Structural Upgrade Program discussed in Section 3.3, modified the facility to provide adequate tornado protection for those systems required to perform the safety functions discussed above. The specific modifications to provide protection from tornado missiles are discussed in Section 3.3.

3.5.2.2 Site Proximity Missiles 3.5.2.2.1 Design Criteria The potential for site proximity missiles, including aircraft, was evaluated to verify that safety-related structures, systems, and components will not be jeopardized. The acceptability of the design of the facility for protection against site proximity missiles was based on meeting the requirements of General Design Criterion 4.

3.5.2.2.2 Nearby Hazardous Activities The potential for hazardous activities in the vicinity of Ginna Station is addressed in Section 2.2.

As indicated there, little industrial activity is situated near the plant. The distances to the nearest land transportation routes (about 1700 ft to the nearest highway, and 3.5 miles to the nearest railroad) are far enough to result in low risk from potential missiles caused by transportation accidents. Similarly, the nearest large gas pipelines (about 6 miles away) do not pose a missile threat to the plant. Major Lake Ontario shipping routes (about 23 miles from the plant) are not close enough to present a credible missile hazard from lake traffic. There are no military facilities or activities near enough to the plant to create a missile hazard.

Page 133 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.5.2.2.3 Aircraft Hazards The potential for aircraft becoming missile hazards has also been evaluated. Operation of the Williamson Flying Club airport and commercial air traffic in and out of Rochester, New York, via two federal airways, 2.5 and 10 miles from the plant site, were considered. Flight activity in an Air Force restricted area in the vicinity of the plant site was also evaluated.

The Williamson Flying Club airport is a small, privately owned general aviation facility located approximately 10 miles east southeast from the plant. The airport is used for general aviation activities such as business and pleasure flying and for agricultural spraying operations. As of 1981, there were 5,000 operations per year at the facility. The small number of operations is substantially less than the criteria in Section III.3 of Section 3.5.1.5 of the Standard Review Plan (SRP), and is sufficiently small that in the SER for SEP Topic II-1.C (Reference 5) the NRC staff determined that these operations are not a potential hazard.

Monroe County Airport in Rochester, New York, is located about 25 miles south-west of the plant and is the nearest airport with scheduled commercial air service. Low altitude federal airways V2 and V2N (the current FAA designation is airway V483, vice V2N) pass about 10 miles south and 2.5 miles southwest of the plant, respectively. The low altitude federal airways, V2 and V483, serve about 10 flights per day. Almost all flights use V2, with V483 being used only occasionally. The probabilities for an airline crash at Ginna from these airways are 5.1 x 10-8 for airway V2 and 1.4 x 10-8 for airway V483. Because both airway probabilities are less than the 1 x 10-7 acceptance criteria, the NRC concluded in the Safety Evaluation Report for SEP Topic II-1.C, dated September 29, 1981, that the probability of a commercial air traffic crash at Ginna Station is acceptably low.

Air Force Restricted Area R-5203 is located about 8 miles north of the plant site. Whenever flight activity is conducted by the Air Force within area R-5203, radar surveillance is maintained by the 174th Fighter Wing, the 108th Tactical Control Group, or possibly the Cleveland Air Route Traffic Control Center. Pilots rely upon on-board navigational equipment to maintain their presence within the specified limits of the restricted area. Pilots can also be advised if their aircraft stray beyond their limits by the radar surveillance unit covering the area at the time. The restricted area is used daily for military flight training which includes high-speed interceptor training maneuvers, operational flight checks, and air-to-air fueling. The altitude ranges in 1981 were from 2,000 to 50,000 ft above the surface.

There is also an inactive slow-speed low altitude military training route (SR-826) which passes about 6 miles west of the plant. Route SR-826 is not currently a military controlled air space. Acceptance criterion II.2 of SRP 3.5.1.6 states that, for military air space, a minimum distance of 5 miles is adequate for low level training routes, except those associated with unusual activities, such as practice bombing. Air Force Restricted Area R-5203 is about 8 miles from the site at its closest boundary, and no unusual activities such as practice bombing take place. The inactive slow-speed low altitude military training route SR-826 is about 6 miles from the plant. Therefore, this criterion is met.

Page 134 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS REFERENCES FOR SECTION 3.5

1. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Systematic Evaluation Program Topic III-4.C, Internally Generated Missiles, dated February 17, 1982.

2. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Turbine Disc Cracking (Safety Evaluation), dated August 28, 1981.

3. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

Turbine Disc Cracking, dated September 16, 1981.

4. Letter from D. L. Ziemann, NRC, to L. D. White, Jr., RG&E,

Subject:

SEP Topic III-4.B, Turbine Missiles, dated April 18, 1979.

5. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topic II-1.C, Potential Hazards Due to Nearby Transportation, Institutional, and Military Facilities - R. E. Ginna, dated September 29, 1981.

6. Westinghouse Electric Corporation, Probabilistic Evaluation of Reduction in Turbine Valve Test Frequency, WCAP-11525 (Proprietary) and WCAP-11529 (Non-Proprietary),

dated June 1987.

7. 0236-0076-CALC-001, Rev. 0, MPR Calculation - Risk Assessment of Steam Turbine Valve Test Interval Extension, dated November 23, 2016.

8. Letter from D. M. Skay, NRC to M. Korsnick, R. E. Ginna Nuclear Power Plant, LLC, "Amendment Eliminating Requirements for Hydrogen Recombiners and Hydrogen Monitors Using Consolidated Line Item Improvement Process," dated May 5, 2005.

9. Letter from R. W. Kober, RG&E, to D. M. Crutchfield, NRC,

Subject:

Structural Upgrade Program, dated 7/13/84 (CMIS record ID "RG005699").

10. Appendix C to Structural Reanalysis Program "Utility Pole Tornado Missile Trajectory Analysis" (CMIS record ID "RG004925.00C") dated May 19, 1983.

11. Letter from A. Johnson, NRC, to R. C. Mecredy, RG&E,

Subject:

Supplemental Safety Evaluation - Systematic Evaluation Program/Structural Upgrade Program at R. E. Ginna, dated November 15, 1989.

Page 135 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6 PROTECTION AGAINST THE DYNAMIC EFFECTS ASSOCIATED WITH THE POSTULATED RUPTURE OF PIPING This section describes the design features of Ginna Station that protect essential equipment from the consequences of postulated piping failures both inside and outside containment.

Analyses were conducted in accordance with guidance and criteria set forth in the December 18, 1972, AEC letter (Reference 1) concerning high-energy pipe breaks outside containment and the Systematic Evaluation Program Review for Topics III-5.A and III-5.B related to pipe breaks inside and outside containment, respectively.

The analyses showed that, with certain modifications proposed by Ginna Station, 10 CFR 50, Appendix A, General Design Criterion 4 was met, in that all structures, systems, and components are designed to accommodate the effects of and are compatible with the environmental conditions associated with MODES 1 and 2, maintenance, testing, and postulated accidents, including loss-of-coolant accidents. These structures, systems, and components are protected against dynamic effects (including the effects of missiles, pipe whipping, and dis-charging fluids) that may result in equipment failures and from events and conditions inside and outside the nuclear power unit.

Pipe ruptures were postulated at arbitrary intermediate locations in addition to terminal ends and high stress and high usage factor locations as required at the time by Branch Technical Position (BTP) MEB 3-1 of Standard Review Plan Section 3.6.2 in NUREG 0800. Pipe whip restraints and jet impingement shields were installed as necessary to mitigate the effects of these arbitrary intermediate pipe ruptures. Generic Letter 87-11 (Reference 2) dated June 19, 1987, revised BTP MEB 3-1 to Revision 2 to eliminate the requirement to postulate arbitrary intermediate pipe ruptures and permitted the elimination of pipe whip restraints and jet impingement shields installed to mitigate the effects of arbitrary intermediate pipe ruptures.

3.6.1 POSTULATED PIPING FAILURES IN FLUID SYSTEMS INSIDE CONTAINMENT 3.6.1.1 Evaluation Procedure 3.6.1.1.1 Pipe Selection A list of piping lines inside containment which normally or occasionally experience high-energya service conditions are presented in Tables 3.6-1 and 3.6-2. These lines were evaluated for the effects of potential pipe breaks (Reference 3). The tables exclude those lines which have been recognized not to present a significant safety hazard. These exclusions are as follows:

A. Lines which are of a 1-in. diameter or less according to Regulatory Guide 1.46 and guidance from Reference 4.

a. High-energy piping is defined as piping with operating temperatures 200 F and higher or operating pressures 275 psig and greater.

Page 136 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS B. Lines which meet Branch Technical Position ASB 3-1, Standard Review Plan 3.6.1, for protection against postulated piping failures.

C. Lines which are at reduced pressure and temperature during MODES 1 and 2.

3.6.1.1.2 Effects-Oriented Evaluation An effects-oriented approach was utilized for evaluating the consequences of most potential high-energy line breaks. This approach postulates a high-energy pipe break inside containment anywhere along the line and analyzes the capability of the remaining systems to safely shut down the reactor. The following assumptions were made:

A. Pipe whip can occur only in the section of pipe which is attached to a sustained high-energy source. Credit is taken for all closed or automatically closed valves in the piping section which could terminate flow to the break. For example, only the segment of safety injection piping between the reactor coolant system and the check valve closest to the reactor coolant system is analyzed for whip. Safety injection piping upstream of the check valve will not whip, even though pressurized, because of the lack of a sustained energy source.

B. It is acceptable for a break, which results in a loss of coolant from one of the loops, to damage mitigation equipment for the broken loop because the unbroken loop is available for Emergency Core Cooling System (ECCS) functions.

C. Pipe of a given section modulus will not cause a loss of function in pipe of equal or larger section modulus, as a result of pipe whip or jet impingement.

Acceptance criteria for the effects-oriented evaluations are as follows:

AA. The reactor can be shut down and cooled using equipment available following the pipe break.

BB. Analysis of the event, or a more limiting event, demonstrates that the effects of the break yield doses less than 10 CFR Part 100 values.

A spectrum of loss-of-coolant accidents and a main steam line break have been analyzed and shown to have acceptable consequences (Chapter 15). Those analyses remain valid following high-energy line breaks inside containment as long as the minimum equipment assumed in the analyses remains operable.

3.6.1.1.3 Mechanistic Evaluation Other evaluation techniques were considered to evaluate breaks that could not be shown to have acceptable consequences using the effects-oriented approach alone. For example, a mechanistic approach based upon breaks at locations of highest stress in the piping segment may result in acceptable consequences because these breaks are remote from required equipment or because the broken pipes are contained. This approach also analyzed failure mechanisms to demonstrate that the consequences were acceptable. For example, a broken pipe assumed to whip in an effects-oriented analysis may be shown to have sufficient strength to resist whipping using mechanistic methods.

Page 137 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.1.2 Required Equipment Systems, components, and equipment required for safe shutdown and to mitigate the consequences of postulated piping failures were reviewed to determine their capability in performing these functions when exposed to the effects of postulated high-energy piping failures.

These systems are listed below.

High-energy line breaks inside containment result in, or have the same effect as, loss-of-coolant accidents or steam or feedwater line breaks of various sizes. The engineered safety features, including the safety injection system, are required to mitigate the effects of these events.

This equipment includes the following:

• High-pressure safety injection.

• Low-pressure safety injection.

• Containment spray.

• Containment fan coolers and service water.

• Essential instrumentation.

• Auxiliary feedwater.

• Containment sump recirculation.

Other items to note concerning mitigation equipment are as follows:

A. Some breaks in the accumulator piping produce neither loss-of-coolant accident nor steam or feedwater line break effects. These accumulator line breaks require only normal systems to maintain a stable plant safe shutdown condition.

B. The low-pressure safety injection system is the portion of the residual heat removal system used to pump water to the injection nozzles in the reactor vessel.

C. All of the pumps for required systems are located outside the containment. The entire auxiliary feedwater system, except for standby auxiliary feedwater (SBAFW) injection piping, is outside containment.

D. Most lines connected to the reactor coolant system have at least one normally closed or automatically closed valve inside a loop compartment or are routed so that the compartments prevent breaks in one loop from affecting the other loop. Mitigation equipment to the unbroken loop is, in most cases, unaffected.

3.6.1.3 Safety Analysis 3.6.1.3.1 Single-Failure Considerations 3.6.1.3.1.1 Introduction The only active components in engineered safety feature systems inside containment which are required to operate or change position are the containment fan coolers and the motor-operated isolation valves in the low-pressure safety injection system. Thus, these are the Page 138 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS only components which must be considered as potentially being affected by high-energy pipe breaks and which must also meet the single-active-failure criterion.

Single active failures of engineered safety feature pumps, valves, or power supplies outside containment have been shown previously in Emergency Core Cooling System (ECCS) analyses (Section 6.3) to have acceptable results. Passive failures of engineered safety feature equipment, including the maximum pump seal leakage or failure of a check valve, will be less limiting than the complete loss of a pump or power supply. The systems have been designed to accommodate such passive failures.

3.6.1.3.1.2 Containment Fan Coolers Two of the containment fan coolers are located remotely from all postulated high-energy pipe breaks and will not be damaged by a break. The other two fan coolers are near only the 2-in.

steam generator blowdown lines but will not be damaged as explained in Section 3.6.1.3.2.

3.6.1.3.1.3 Low-Pressure Safety Injection Isolation Valves The two low pressure safety injection isolation valves are located on opposite sides of the reactor cavity shield wall, outside the loop compartments, and could be damaged only by a limited number of other high-energy lines. The only sustained high-energy source lines near the low-pressure safety injection lines are the accumulator lines. For all breaks in lines other than the accumulators or in the low-pressure safety injection lines themselves, neither of the isolation valves will be affected and no single failure will reduce the functioning of required equipment to less than the required minimum. An accumulator line break outside either of the loops (postulated using an effects-oriented approach) which could rupture a low-pressure safety injection line, or a low-pressure safety injection line break as the initiating event, will effectively result in a 4-in. hot-leg loss-of-coolant accident. The accumulator line break will not be more severe because a check valve inside the loop compartment prevents reactor coolant system blowdown through the accumulator line. Analysis of a 4-in. loss-of-coolant accident shows that reactor coolant system pressure remains well above the shutoff head of the low-pressure safety injection pumps and thus the transient is terminated without the use of the low-pressure safety injection system. Failure of one low-pressure safety injection isolation valve following damage to the other will have an inconsequential effect since one high-pressure safety injection pump delivers sufficient flow to mitigate the event.

Additionally, for long term post-LOCA cooling following a 4-inch hot leg break, the low-pressure safety injection system is not required to prevent boron precipitation.

3.6.1.3.2 High-Energy Line Break Effects 3.6.1.3.2.1 Introduction The discussion of the effects of high-energy line breaks in this section is restricted to the dynamic effects on mechanical and electrical equipment. The environmental effects on electrical equipment is discussed in Section 3.11 concerning the environmental qualification of electrical equipment per 10 CFR 50.49. The analyses of the high-energy lines presented in Tables 3.6-1 and 3.6-2 are summarized below. The results have been reported in References 3 and 5 through 8.

Page 139 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.1.3.2.2 Alternate Charging The line segment of interest is approximately 2 ft of 2-in. pipe in the loop A compartment between the reactor coolant system cold leg and the check valve. Alternate charging (identified as auxiliary charging) is not normally used so isolation valves inside and outside containment are normally closed. In addition, all three charging pumps are positive displacement pumps. For this reason, and because the design flow of a charging pump is only 60 gpm, no sustained high-energy source exists upstream of the check valve and thus, the pipe upstream of the valve will not whip. A break between the reactor coolant system and the check valve will be confined to the loop A compartment and will result in a small loss-of-coolant accident.

Mitigation equipment inside containment that may be used to mitigate loop A loss-of-coolant accidents is safety injection to loop B, low-pressure safety injection to either vessel nozzle, containment fan coolers, and containment spray. All of this equipment is remote from the break and is isolated by compartment walls. No unacceptable consequences will result from the pipe break, assuming check valve operability. If it is assumed that the check valves inside loop A were inoperable, since Ginna Station does not conduct periodic testing of these valves, the cabling for one of the two low-pressure safety injection valves could be affected by pipe whip upstream of the check valve. A single active failure of the other low-pressure safety injection valve would result in a loss of low-pressure safety injection. However, high-pressure safety injection would still be available to mitigate the small break loss-of-coolant accident. The NRC, in the Safety Evaluation Report of June 28, 1983, found this issue to be acceptably resolved (Reference 9).

As part of the Ginna power uprate, operation of one low pressure safety injection isolation valve is required following a cold leg small break LOCA to prevent the possibility of boron precipitation during the long-term post LOCA recirculation phase. Consequently, pipe whip of the alternate charging piping causing damage to the low head safety injection (SI) isolation valve cabling is unacceptable. Based upon a review of the piping stresses in the alternate charging piping upstream of the reactor coolant system (RCS) check valve, it has been determined that none of the piping stresses exceed the criteria specified in BTP MEB 3-1 for identifying pipe locations where pipe breaks must be postulated. Therefore, based on the relaxed criteria presented in Generic Letter 87-11, no intermediate break locations in the vicinity of the low head SI isolation cabling need to be postulated. Additionally, there are no piping terminal ends in the vicinity of the routing of the low head SI isolation valve cabling.

Therefore, there are no pipe break locations in the alternate charging line that would damage the low head SI isolation valve cabling due to pipe whip. Consequently, for any break location in the alternate charging piping that needs to be postulated per MEB 3-1, one train of low head SI would be available to support long term cooling of the RCS following the limiting single active failure.

3.6.1.3.2.3 Residual Heat Removal Pump Suction Breaks in this line are considered only between the reactor coolant system and the loop A innermost isolation valve inside containment (MOV 700) in accordance with Standard Review Plan 3.6-1. This line segment is within the loop A compartment. Piping downstream of the isolation valve will not whip because this piping is isolated from the reactor coolant system and there is no sustained high-energy source connected to the piping during power Page 140 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS operation and most shutdown operations. Breaks in the piping upstream of the isolation valve would result in a loss-of-coolant accident with the potential for the piping that is attached to the reactor coolant system to whip.

Also, the effect on containment integrity had not been analyzed for a break in this line which could impact the component cooling water (CCW) system piping to the reactor support coolers. The CCW system is considered a closed loop inside the containment. Therefore, in Reference 27, Ginna Station submitted a leak-before-break analysis (Reference 28) for this line. The NRC in Reference 29 concluded that while the results of the NRC differed from the results obtained by Ginna Station, the NRC agreed with Ginna Stations conclusion that leak-before-break had been demonstrated for the analyzed portions of the residual heat removal (RHR) system. The NRCs conclusion was predicated on the leakage detection system inside containment being able to reliably detect 0.25 gallons per minute of leakage within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

The NRC further stated that Ginna Station may remove consideration of dynamic effects associated with the postulated rupture of the analyzed portions of the residual heat removal (RHR) system piping from the licensing basis.

3.6.1.3.2.4 Reactor Coolant Pump Seal-Water to Seals The seal-water inlet lines to both reactor coolant pumps are pressurized to nominal operating pressure from the containment wall to the reactor coolant pumps. Both lines are fed by positive displacement charging pumps and are throttled outside of containment to an 8-gpm flow. Check valves near the reactor coolant pumps inside the loop compartments prevent backflow in the seal-water inlet lines. Breaks in the lines between the containment wall and the check valves will not result in pipe whip because there is no sustained high-energy source from the positive displacement charging pump because of limited flow. Breaks in the lines between the reactor coolant pumps and the check valves will be contained within the loop compartment. Mitigation of the break effects may be accomplished by the adjustment of charging and letdown flow or Emergency Core Cooling System (ECCS) actuation. All of the required piping of the mitigation systems is at least as large as the seal-water inlet lines and, particularly in the absence of any pipe whip, will not be disabled by the break. No unacceptable consequences will result from the pipe break.

3.6.1.3.2.5 Letdown Line Letdown from the reactor coolant system is from loop B through the regenerative heat exchanger and letdown orifices inside containment. The letdown is a high-energy line over its entire length inside containment although the temperature is reduced downstream of the regenerative heat exchanger and the pressure is reduced downstream of the orifices. A break in the 2-in. letdown line will result in a small loss-of-coolant accident from loop B.

Mitigation equipment inside containment which may be used to mitigate loop B loss-of-coolant accidents is safety injection to loop A, low-pressure safety injection to either vessel nozzle, containment fan coolers, and containment spray. Low-pressure safety injection, safety injection, and containment spray lines are in the vicinity of the letdown lines. The low-pressure safety injection and containment spray lines each have a section modulus much greater than the letdown line and therefore will not be affected by a broken letdown line.

Letdown piping between the reactor coolant system and the outermost isolation valves inside containment has a section modulus greater than that of loop B safety injection piping in the Page 141 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS vicinity and therefore could cause damage to loop B safety injection piping. This portion of the safety injection system is not required to mitigate the effects of the loop B loss-of-coolant accident, however. Letdown piping downstream of the orifices and outermost isolation valves inside containment is routed near safety injection piping to loop A. These lines have a greater section modulus then the letdown piping; thus, all the required mitigating equipment will remain effective following the break.

The letdown line is located in the basement of containment and is routed in the vicinity of safety-related cable trays and conduit. An evaluation of the possible effects of a postulated failure of the letdown line was performed and it was concluded that additional protection of certain instrumentation was required. In order to ensure that safety injection is initiated and reactor coolant system pressure can be monitored, certain instrumentation cables for pressurizer pressure, pressurizer level, and reactor coolant wide-range pressure were rerouted from the basement level to the intermediate floor elevation of containment. This modification was coordinated with the 10 CFR 50, Appendix R, historic, fire protection review.

3.6.1.3.2.6 Charging Line The 2-in. charging line is fed from positive displacement pumps and is a high-energy line over its entire length inside containment. The normal charging path is through the regenerative heat exchanger flow control valve and check valve near cold-leg B. An alternative path is through the regenerative heat exchanger, flow control valve, and check valve near hot-leg B. Breaks in the lines between the check valves and the containment wall would produce no pipe whip or significant impingement because of the lack of a sustained high-energy source from either end of the rupture, assuming credit is taken for check valve operability. Loss of charging flow will result in a minor loss of reactor coolant system inventory through the reactor coolant pump seals. This loss can be compensated for by alternate charging or the consequences can be mitigated by the Emergency Core Cooling System (ECCS). The Emergency Core Cooling System (ECCS) equipment would not be affected because of the lack of a sustained high-energy source supplying the break to cause pipe whip or significant impingement. The alternate charging line is remote from the break.

The effects of breaks between the reactor coolant system and the check valves will be a small loss-of-coolant accident with all whipping pipes confined to the loop B compartment. The mitigation equipment inside the containment which may be used to mitigate loop B loss-of-coolant accidents is high-pressure safety injection to loop A, low-pressure safety injection to either vessel nozzle, containment spray, and containment fan coolers. All of this equipment is remote from the break, outside the loop B compartment walls. No unacceptable consequences will result from the break.

In order to take credit for the operability of the charging line check valves, the NRC required that Ginna Station conduct a check valve operability testing program. In lieu of such a commitment, Ginna Station chose to provide sufficient analysis or compensating measures such that no credit for the check valves was necessary. As noted in the NRC Safety Evaluation Report for Integrated Plant Safety Assessment Report (IPSAR), Section 4.13 (Reference 9), the effects of a failure of the charging line check valves result in consequences identical to those of a letdown line break. Modifications (instrument rerouting) for the postulated letdown line break will thus also ameliorate the effects of the postulated charging line breaks with failure of the check valves to operate.

Page 142 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.1.3.2.7 Steam Generator Blowdown Lines The 2-in. steam generator blowdown lines exit from the steam generators at elevation 255 ft, above the lower support structure for the steam generators. The lines exit from the loop compartments and are routed above the intermediate floor to the containment penetrations.

A break in either of the blowdown lines will result in a small feedwater line break accident.

Auxiliary feedwater is entirely outside containment. Other engineered safety feature equipment which may be needed to mitigate the accident, except service water (SW) and two of the fan coolers, is on the basement elevation and is separated from the blowdown lines by large reactor coolant system component steel support structures and a concrete floor. The fan coolers are on the same elevation as the blowdown lines. In Reference 26, a piping stress analysis was performed, which verified that the highest pipe stresses in the blowdown lines are in locations away from the fan coolers and service water (SW) lines. Therefore, by using the relaxed criteria presented in Generic Letter 87-11 and its attached BTP MEB 3-1 (Revision 2), consideration of blowdown piping breaks in the vicinity of these components is not required.

The steam generator blowdown lines were also evaluated for effects on safety-related cable trays and conduit. The B blowdown line passes near this safety-related cable tray and conduit. Calculations were performed to evaluate the stresses in the B line as part of the piping Seismic Upgrade Program. The stresses in the line are lower than 0.8 (1.2Sb + SA);

thus, breaks need only be postulated at the terminal ends and the two intermediate highest stress locations. Neither breaks at the terminal ends nor at the intermediate high-stress locations, which are located inside the loop compartments, will damage required safety-related instrumentation. No unacceptable consequences will result from a steam generator blowdown line break.

In the early 1990s, the majority of the 2-inch steam generator (SG) blowdown piping inside containment for SG "A" was replaced with 3-inch piping. As part of the plant modification that replaced the original 2-inch piping with 3-inch piping, a stress analysis for the 3-inch piping was performed (Reference 36). This stress analysis included an evaluation of pipe stress per the requirements of BTP MEB 3-1 to determine the piping locations for postulating pipe ruptures. The results of the analysis determined that there were no intermediate pipe locations that had stress levels that exceeded the value specified in BTP MEB 3-1 for identifying required break locations. Therefore, based on the relaxed criteria presented in Generic Letter 87-11, no intermediate break locations were postulated in the SG "A" 3-inch blowdown piping. Only breaks at terminal ends were postulated and none of these break locations were in the vicinity of the fan coolers or SW piping inside containment.

3.6.1.3.2.8 Main Steam and Feedwater Lines The main steam and feedwater lines are above the operating floor and separated by at least one concrete floor from all engineered safety feature equipment and piping inside containment, except the containment spray headers and spray rings. The containment spray headers, rising along the containment walls, are remote enough from the main steam and feedwater lines so as not to be struck by broken lines. The spray rings are attached to the containment dome and are high enough above the main steam and feedwater lines that they Page 143 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS will not be struck. The two steam generators are on opposite sides of the containment, far enough apart so that a broken pipe on one steam generator will not affect the other. The feedwater lines have a smaller section modulus than the main steam lines. A rupture of a feedwater line will not cause the main steam line to rupture.

The main steam and feedwater lines are generally separated vertically by 20 ft or more.

Ruptures in a main steam line which could produce pipe whip will cause motion in the plane of the pipe that will not carry it into the feedwater line. Nevertheless, if a main steam line rupture is also postulated to cause a feedwater line break, it is not expected that the consequences would be unacceptable or even more severe than those resulting from just a main steam line rupture. The total mass and energy release will be smaller than for a main steam break alone because there will be no auxiliary feedwater flow to the broken loop and because the average enthalpy of the escaping fluid will be less, due to reduced heat transfer during the transient. Secondary fluid will escape both as steam and as liquid feedwater and will remove less heat than the main steam line break alone.

Because an effects-oriented evaluation of the main steam and feedwater lines could not rule out the potential for a ruptured line striking the containment wall, a mechanistic evaluation of the main steam line was performed. The analysis methods used made evaluation of the main steam line a conservative envelope for both main steam and feedwater line rupture effects upon the containment wall. The thrust force applied by the escaping fluid to the pipe was calculated by multiplying the initial pressure by the pipe cross-sectional area. The steam line force calculation thus enveloped the feedwater force calculation. The evaluation of pipe whip effect on containment wall integrity was performed for both main steam lines A and B. The piping stress analysis results from the Ginna Station seismic upgrade program were used in the evaluation. The piping break locations were postulated at the following locations:

a. Terminal ends of piping run.

b. Sections where S01 + SEJ > 0.8 (1.2Sh + SA), where the occasional loads are due to normal and upset (operating-basis earthquake) conditions.

c. A minimum of two intermediate locations of maximum stress.

Since none of the combinations S01 + SE exceeded the stress limit, circumferential breaks were assumed at the two intermediate points of maximum stress.

The instantaneous thrust force generated by the flashing steam-water mixture was calculated according to the methods described in "Structural Analysis and Design of Nuclear Plant Facilities," J. D. Stevenson et al., ASCE, 1980 (Reference 10).

This thrust force results in piping moments that may exceed the ultimate plastic moment at a local cross section. A plastic hinge may be formed and the kinetic moment of the thrust force may accelerate the pipe toward the containment wall.

The dynamic characteristics of the pipe required to evaluate its penetration in the containment wall for those locations where the wall is struck are:

1. The striking velocity of the pipe vo.

Page 144 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

2. The effective pipe diameter d= (Equation 3.6-1) where: AC is the contact area.

3. The pipe weight W.

4. The pipe shape factor N.

These variables were evaluated for the postulated break cases. In the evaluation, the effect of the existing pipe supports and the crane structure were neglected to maximize the impact upon the wall. This is conservative since these restraints tend to decelerate the pipe motion and, therefore, decrease the striking velocity vo.

The analyses evaluated the structural integrity of the wall considering overall wall response and evaluated the total pipe penetration depth in the wall.

The containment liner plate was not considered in the evaluation of the containment shell integrity. Characteristics of the wall were based upon prestressed concrete detailed drawings for the R. E. Ginna Nuclear Power Plant. The modified National Defense Research Committee (NDRC) formula was used for penetration depth calculations. In addition, the evaluation considered the response of the reinforced-concrete wall system to resist penetration from a deformable missile. The characteristics of the missile were used to develop an applied force time-history and an analysis for the overall response to the force was carried out as for an impulsive load. The analytical methods used are outlined in Reference 10.

The analysis results for penetration depth (X in inches) using the NDRC formula were as follows:

a. For break location in main steam line A: X = 13.96 in.

b. For break location in main steam line B: X = 3.48 in.

The analysis for missile penetration into the wall considering overall wall response resulted in Xm/Xc = 1.352. This is considerably less than the allowable ductility ratio for impulse loads for flexure in structures. The rectangular impulse load considered aa. Collapse load of slab = 29,649 K.

bb. Plastic hinge moment = 2360 in K/in.

cc. Duration of impulse load = 0.00098 sec.

The conclusion of the analysis was that, even neglecting the 3/8-in. steel liner plate, structural integrity of the containment shell is ensured.

Main steam or feedwater line ruptures could result in a pipe whip which strikes the containment crane support structure. The crane is supported by eight vertical columns and horizontal bracing. A complete loss of one support column will not cause the crane to fall.

Page 145 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS As part of the mechanistic evaluation discussed above, it was determined that the two highest stress locations between the terminal ends of the B main steam line which were postulated to break are not located along the pipe where it passes between the crane supports. Breaks at the terminal ends also will not impact the crane supports; therefore, it was concluded that the dynamic effects of a main steam line break will not cause crane failure.

3.6.1.3.2.9 Residual Heat Removal Pump Discharge Line Breaks in this line are considered only between the reactor coolant system and the loop B innermost isolation valve (MOV 721) inside containment in accordance with Standard Review Plan 3.6.1. This line segment is within the loop B compartment. Piping upstream of the isolation valve will not whip because no sustained high energy source is connected to the piping during power operation and most shutdown operations. Breaks in the piping down-stream of the isolation valve would result in a loss-of-coolant accident with the potential for piping that is attached to the reactor coolant system to whip. Therefore, a leak-before-break analysis was submitted to the NRC for review and approval (Reference 28). This was approved by NRC SER dated February 25, 1999 (Reference 29), as noted in Section 3.6.1.3.2.3.

3.6.1.3.2.10 Standby Auxiliary Feedwater Lines Breaks are considered in this line between the steam generators and the check valves inside containment. These 3-in. line segments are attached to the feedwater lines near the steam generators and are above the operating floor. A break in these lines will result in a small feedwater line break. Auxiliary feedwater flow to the unbroken steam generator feedwater line will not be affected. All of the engineered safety feature equipment is remote from these lines. No unacceptable consequences will result from a break in these lines.

3.6.1.3.2.11 Accumulator Lines and Branch Lines The accumulator branch lines greater than 1-in. diameter are two 2-in. level instrument taps, one 2-in. line to the reactor coolant drain tank, and one 2-in. high-pressure safety injection discharge line connected to each accumulator line injecting to the reactor coolant system.

During operation, when the accumulators are pressurized, the lines to the reactor coolant drain tank are isolated approximately 5 ft from the accumulator tanks. The instrument tap lines run vertically along the side of the accumulator tanks.

The safety injection lines discharge into the accumulator lines near the shield wall outside each compartment with a check valve in the line 10 ft or less from the point of intersection with the accumulator line. Breach of the accumulator line due to a safety injection line pipe break will not result in a loss-of-coolant accident because of the check valves inside the compartment. The safety injection lines, if broken, could impact or impinge upon the 4-in.

low-pressure safety injection lines; however, the section modulus of the low-pressure safety injection lines, shown on Table 3.6-3, is larger than that of the safety injection lines. The low-pressure safety injection lines will not be damaged to the extent that loss of function occurs and check valves in the lines will maintain the reactor coolant system pressure boundary.

Operation and shutdown of the plant can be accomplished using the normal charging and letdown paths, which are remote from these break locations, or by charging and letdown Page 146 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS through the reactor coolant pump seals. Seal injection to the reactor coolant pump A passes through the area containing the safety injection branch line to loop A; however, the seal injection line has a larger section modulus than the safety injection line and will not incur damage that will cause loss of function as a result of the break.

Breaks in the 10-in. accumulator lines inside the loop compartments between the reactor coolant system and the accumulator line check valves would result in a loss-of-coolant accident; the effects of pipe whip or impingement will be confined to a single loop compartment. All of the mitigation equipment, including safety injection to the unbroken loop, low-pressure safety injection to the vessel nozzles, containment fan coolers, and containment spray, is outside the compartments and remote from the breaks.

Breaks in the A accumulator line between the accumulator tank skirt and the loop compartment walls will not, by themselves, result in a loss of primary coolant. The check valve located inside the loop B compartment will prevent loss of primary coolant. Only accumulator fluid will be lost as a result of the break. Interaction with other equipment is acceptable, provided the interaction does not cause loss of primary inventory or interfere with maintaining the plant in a safe shutdown condition; therefore, equipment required only for mitigation of loss-of-coolant accidents or large secondary system breaks need not remain functional for the accumulator break. The following equipment was eliminated from consideration:

• Containment spray line.

• High-pressure safety injection line.

• Low-pressure safety injection valve control circuits.

• Fan coolers.

However, the following equipment required further evaluation and is discussed below.

• Low-pressure safety injection line.

• Residual heat removal outlet line.

• Instrumentation circuits.

The A accumulator line stresses have been determined in the Seismic Piping Upgrade program (Section 3.9.2.1.8). Stresses in the line are low and, generally, are only 10% to 25%

of allowable. Thus, breaks need only be defined at the terminal ends and at the two highest stress intermediate locations. The two terminal break locations are at the reactor coolant loop and inside the accumulator skirt. As discussed earlier, breaks inside the loop compartment will not affect the required mitigation equipment. The terminal end break inside the accumulator skirt will not damage any equipment or circuits required for safe shutdown.

In order to comprehensively address potential dynamic effect concerns from the accumulators both lines "A" and "B," Ginna elected to perform a detailed fracture mechanics analysis for these lines and submit it to the NRC for review and approval (Reference 31 and 32).

The ASME Code Class 1 portion of the accumulator A piping extends from the RCS loop cold leg nozzle to check valve 867A and motor-operated valve 721 (nodes 856 through 960).

Page 147 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS This portion of the accumulator A piping also serves as part of the RHR system. All the nodal locations on the affected portion, with the exception of Node 856, were considered in the LBB evaluation of the RHR system piping, which the staff approved in a safety evaluation dated February 25, 1999. Therefore, the scope of the LBB evaluation for the accumulator A line in the application involves a short pipe segment that includes only Node 856, which is located at one end of check valve 867A.

The scope of the LBB evaluation for the accumulator B line includes only the elbow between the cold leg nozzle of the RCS loop (node 60) to check valve 867B (node 80), excluding the valve itself. There is no flow in the accumulator lines during normal operation, including no possibility of cold in-leakage past the insolation valves, and complex system transients are not involved.

The accumulator piping for both A and B is constructed from ASME Code,Section II, material classification SA-376, Type 316, stainless steel. The welds are fabricated with stainless steel electrodes (ASME IX filler material E316) using the SMAW process. The welds in both accumulator lines do not contain Alloy 82/182 material, which is susceptible to stress-corrosion cracking. The piping is schedule 160 with a nominal diameter of 10 inches.

The operating pressure is 2235 psig and the operating temperature is 550 F.

Leak Before Break (LBB) Methodology Draft SRP 3.6.3 and NUREG-1061, Volume 3, specify that the LBB approached should not be applied to high energy piping that has experienced stress-corrosion cracking, water-hammer, or, low-and high-cycle fatigue. Ginna established that no active degradation mechanisms (flow accelerated corrosion and stress-corrosion cracking) were expected in the accumulator piping segments. Ginna referenced an NRC report, NUREG-0927, in which it was stated that the probability of water hammer occurrence in the affected portions of the accumulator system is very low. In addition, Ginna has implemented Electric Power Research Institute (EPRI) guidelines TR-106438, "Water Hammer Handbook for Nuclear Plant Engineers and Operators'" May 1996, to prevent and mitigate water hammer events at Ginna. As for fatigue, Ginna demonstrated by fatigue crack growth analysis as discussed below that fatigue will not be a significant problem for the accumulator lines.

NUREG-1061, Volume 3, recommends that actual plant-specific material properties be used in the LBB evaluations. Ginna determined that actual archival materials for the accumulator piping is not available, therefore the least favorable material properties from the EPRI Ductile Fracture Handbook, 1989, was used as basis for flaw acceptance criteria in the ASME Code,Section XI.

The material properties of interest for fracture mechanics and leakage calculations are the modulus of elasticity, the yield stress, the ultimate stress, the Ramberg-Osgood parameters for describing the stress strain curve, the fracture toughness, and the power law coefficient for describing the material J-Resistance curve. In the analysis, the least favorable of the base metal and weld metal properties were used to obtain conservative results.

Considering the highest stress locations coincident with the worst material properties, Ginna identified the following limiting locations for the LBB analysis, for the accumulator A pipe, Page 148 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS the critical location is the weld between the pipe and check valve 867A (node 856). For the accumulator B pipe, the two critical locations are the weld joint between the accumulator B pipe and the cold leg nozzle (node 60), and the weld joint between the accumulator pipe elbow and check valve 867B (node 80). These nodes were considered for the analysis because they are located at welds in a tee and elbow and consequently reflect high stresses due to the stress intensification effects. In addition, the SMAW weld properties at these nodes will provide the most conservative critical flaw and leakage flaw sizes because of its low toughness and susceptibility to thermal aging.

At the three criteria locations, Ginna calculated the leakage flaw sizes using loading associated with normal operating conditions, including axial forces and moments due to pressure, dead weight, and thermal expansion. Ginna calculated the length of a through-wall circumferential flaw which would generate a leakage rate of 2.5 gpm, which is 10 times the leakage detection capability of 0.025 gpm at Ginna.

Ginna calculated the critical flaw sizes at the critical locations using elastic-plastic fracture mechanics with the J-integral method. The pipe loading applied to the cracks were axial forces and moments of normal operating and faulted conditions. Including safe shutdown earthquake and seismic anchor motion loads. Ginna used the "absolute sum" method to add the individual axial forces and moments into the combined axial forces and moments.

Ginna performed a fatigue crack growth analysis to determine the sensitivity of the accumulator lines to the postulated small cracks when subjected to the various transients.

Cracks of various depth and aspect ratios were assumed. The fatigue crack growth analysis showed that in 60 years the fatigue crack growth is insignificant. The analysis also showed that the crack will grow though-wall before extending in length significantly. This indicates that leakage will occur before safety margins are exceeded.

The NRC staff confirmed that the proposed pipe segments in accumulator lines A and B can be shown to exhibit LBB behavior consistent with the guidance in Draft SRP 3.6.3 and NUREG-1061, Volume 3. The NRC noted that Ginna has shown that: (1) a margin of 10 exists between the calculated leak rate from the leakage flaw and the leak detection capability of 0.25 gpm; (2) a margin of 2 or more exists between the critical flaw and the flaw having a leak rate of 2.5 gpm; (3) fatigue crack growth in 60 years has been shown to be insignificant.;

(4) loadings are applied to postulated cracks and pipes consistent with SRP 3.6.3; and (5) there are no active degradation mechanisms associated with accumulator lines A and B.

The effect of a break in the accumulator level measurement taps on nearby instrument circuits has been evaluated. It had been determined that the A accumulator level tap is in the vicinity of safety-related cable trays and conduit. A break in this 2-in. line was evaluated, and, as a result, safe shutdown instrumentation was rerouted away from the dynamic effects of the postulated break.

3.6.1.3.2.12 Auxiliary Spray Line The 2-in. auxiliary spray line is not normally used for pressure control and the isolation valve is normally closed. There is a check valve inside the pressurizer compartment. Breaks in the line between the reactor coolant system and the check valve will result in a small loss-of-Page 149 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS coolant accident. The effects of the break will be limited to the pressurizer compartment.

None of the engineered safety feature equipment, including safety injection to loop B, will be affected by the break.

Breaks in the line upstream of the check valve will have minimal effect. Reactor coolant system blowdown is prevented by the check valve and the positive displacement charging pumps will not provide a sustained high-energy source to cause pipe whip or significant impingement. The loss of charging flow and mitigation of the accident effects as a result of the break are discussed in the charging line item above. Further, a failure in the check valve to operate will have results which are bounded by the effects of the postulated letdown line break.

3.6.1.3.2.13 Reactor Coolant System Asymmetric blowdown loads resulting from double-ended pipe breaks in the main coolant loop piping are not considered as a design basis for Ginna Station. Reference 11 provided the NRC safety evaluation of information submitted by Westinghouse for a group of plants that included Ginna Station to resolve Unresolved Safety Issue A-2, asymmetric loss-of-coolant accident loads. The evaluation concluded that the asymmetric loss-of-coolant accident loads need not be considered as a design basis provided certain conditions were met. By Reference 12 Ginna Station submitted information regarding the capability of installed leakage detection systems to detect a 1-gpm leak within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. By Reference 13 the NRC concluded that the leakage detection systems at Ginna Station met the criteria specified in Reference 11. See Section 5.4.11.1.2.

3.6.1.3.2.14 Pressurizer Surge Line A fracture mechanics analysis was performed of this line, so that the dynamic effects associated with pipe rupture would be outside the design basis of the plant. The submittals were provided in References 31 and 32, and approved in Reference 33.

The 10-inch pressurizer surge line connects reactor coolant system (RCS) hot-leg B to the bottom of the pressurizer. The line is run along the loop B compartment wall and an exterior vertical wall of the refueling canal before turning upward to connect to the bottom of the pressurizer. Rupture of the line may require operation of the nearby low-pressure safety injection, high-pressure safety injection, and containment spray to mitigate the loss-of-coolant accident. These lines, although nearby, are mostly routed on the underside of the refueling canal which is above the basement floor. The surge line and mitigating equipment pipes are on walls which are normal to each other at an exterior corner over most of the pipe run.

The scope of the LBB evaluation for the pressurizer surge line coves the entire line from the primary loop nozzle junction to the pressurizer shell nozzle. The surge line was fabricated from wrought austenitic stainless steel, American Society of Mechanical Engineers Boiler and Pressure Vessel Code (ASME Code) material classification SA-376, Type 316, and does not include any cast materials.

The piping welds were fabricated from stainless steel using gas tungsten arc welding (GTAW) and/or shielded metal arc welding (SMAW). None of the welds contain Alloy 82/182 material; therefore, primary water stress-corrosion cracking (PWSCC) is not a concern for Page 150 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS the welds. There is a stainless steel safe-end piece between the nozzle and reducer at the pressurizer, therefore, primary water stress-corrosion cracking (PWSCC) is not a concern for the welds. There is a stainless steel safe-end piece between the nozzle and reducer at the pressurizer nozzle location. The outside diameter of the pipe is 10.75 inches and the minimum wall thickness is 0.896 inch.

Leak Before Break (LBB) Methodology Draft SRP 3.6.3 and NUREG-1061, Volume 3. Specify that the LBB approach should not be applied to high energy piping that has experienced stress-corrosion crackling, water hammer or low-and-high-cycle fatigue. Ginna has established that no active degradation mechanisms (e.g., flow accelerated corrosion, stress-corrosion cracking, fatigue) were expected in the subject piping segments. Also, it has been established that no unanalyzable loading events (water hammer) would be expected to occur in the surge piping segments, and that there has been no service-induced crackling or wall thinning in the surge lines of Westinghouse PWRs.

As part of the Ginna inservice inspection program, welds in the pressurizer surge line are periodically inspected. During the 2003 refueling outage, based on the liquid penetrant test, there were indication on the outer diameter surface of the weld that connects the safe-end to the pressurizer surge nozzle. A boat sample was removed from a section containing a number of indications and examined to determine the root cause of the indications. The root cause was attributed to hot cracking, which developed during original construction. Similar indications were observed during the 2005 refueling outage inspection of the same weld. The indications were ground out until the linear indications disappeared. It appears that the indications were not service-induced and not caused by any active degradation mechanism.

The mechanical properties of the surge line at room temperature were obtained from the manufacturer's certified materials test reports. The minimum and average tensile properties were calculated by using the ratio of the ASME Code,Section II properties at various operating temperature. The representative minimum yield strength and minimum ultimate strength at operating temperature were used for the flaw stability evaluations and the representative average yield strength was used for the leak rate predictions.

Based on consideration of the highest stress locations coincident with the worst material properties, Ginna identified three bounding locations at nodes 1020, 1120, and 1280 for the LBB analysis. Node 1020 has the highest stress and is located at the weld joint between the surge line and the hot leg. Node 11220 has the second highest stress and is located at the weld at the end of the bend of the pipe. Node 1280 has the third highest stress and is located at the weld joint between the surge line and pressurizer nozzle.

At the three limiting locations, Ginna calculated leakage flaw sizes using loading associated with normal operating conditions, which included axial forces and moments due to pressure, dead weight, and thermal expansion. Ginna also calculated the length of a through-wall circumferential flaw at the three weld locations that would generate a leakage rate of 2.5 gpm. This evaluation was based on the crack morphology parameters (surface roughness and number of turns) associated with fatigue cracks. Comparing a leak rate of 2.5 gpm to a detection capability of 0.25 gpm within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, a margin of 10 was achieved, which satisfies the LBB criterion in Draft SRP 3.6.3.

Page 151 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS In recent industry experience, improved fuel integrity and reduced RCS radioactivity levels have caused the gaseous channel of the containment atmosphere radiation monitor to become less effective for RCS leakage detection. The detection of RCS leakage could take longer than is required in the plant technical specifications. In light of the experience, the NRC staff asked Ginna (Reference 34) whether the current leakage detection capability of 0.25 gpm at Ginna can still be maintained and satisfy Regulatory Guide (RG) 1.45, "Reactor Coolant Pressure Boundary Leakage Detection Systems," May 1973. Ginna cited its previous LBB application submittal and associated staff review for the residual heat removal (RHR) system piping in 1998 (References 28 and 29). In a letter dated August 8, 1998 (References 35)

Ginna stated that the particulate monitors were demonstrated to be capable of detecting very small leak rates, even with robust fuel. Ginna did not credit the gaseous monitors to meet the 0.25 gpm within 1-hour detection capability, although the monitors are a useful backup. The second credited leak detection system is inventory balance. In Reference 29 the NRC staff approved the LBB application for the RHR system piping. In the NRC staff's safety evaluation, the staff found that the 0.25 gpm detection capability is acceptable because Ginna has a relatively small containment volume, effective recirculation of air in the containment, and the second generation of R-11 detector. For the current LBB application on the surge line, the staff also found that the leakage detection capability of 0.25 gpm is acceptable based on the previous information submitted.

Ginna calculated the critical flaw sizes for the 3 bounding locations based on limit load analysis, which follows the net section collapse criterion in NUREG-1061, Volume 3. The loading from the faulted conditions, which include normal operation conditions in conjunction with safe shutdown earthquake and seismic anchor motion loads was used. The severe transients such as thermal stratification and forced cooldown (also known as pressurizer reflood) were included. In the critical flaw calculation, the "absolute sum" method was used to add the individual axial forces and moments into the combined axial forces and moments. When analyzing the stainless steel weld using a limit load approach, an additional factor (Z-factor) was incorporated to account for the generally lower toughness and low load carrying capacity of the SMAW welds. Ginna applied the Z-factor to increase the applied loads and thus reduce the critical flaw size, which would be conservative. The ratios between the critical flaw size and the leakage flaw size for the bounding locations maintained a factor of 2, which satisfied the guidance in Draft SRP 3.6.3.

Ginna also performed a fatigue crack growth analysis to determine the sensitivity of the surge line to the postulated small cracks when subjected to the various transients. Five cracks were assumed at the reducer between the surge line pipe and pressurizer nozzle. The initial flaws were assumed to be 10% of the wall thickness with an aspect ratio (crack length to depth) of 6 to 1. The result showed that the maximum final crack size after 60 years was insignificant.

The flaw growth through the pipe wall is not expected to occur and it was concluded that fatigue crack growth is not a concern.

It has thus been confirmed that the surge line can be shown to exhibit LBB behavior consistent with the guidance in Draft SRP 3.6.3 and NUREG-1061, Volume 3. Ginna has shown that: (1) a margin of 10 exists between the calculated leak rate from the leakage flaw size and the detection capability of the leakage detection system; (2) a margin of 2 or more exists between the critical flaw size and the leakage flaw size having a leak rate of 2.5 gpm; Page 152 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS (3) loadings are applied to postulated cracks and pipes consistent with SRP 3.6.3; (4) fatigue crack growth in 60 years has been shown to be insignificant; and (5) there are no active degradation mechanisms associated with the surge line.

3.6.1.3.2.15 Pressurizer Spray Lines The pressurizer spray nozzle is fed with 3-in. lines from each loop through isolation valves inside the pressurizer compartment. The line from loop B is routed entirely within the loop B compartment and the pressurizer compartment. The line from loop A passes outside the loop A compartment near the accumulator and high-pressure safety injection lines to loop A and near a low-pressure safety injection and containment spray line before entering the pressurizer compartment. A rupture in either of the pressurizer spray lines will result in a small loss-of-coolant accident. All of these lines, with the exception of the 2-in. portion of the high-pressure safety injection line, have a section modulus greater than that of the pressurizer spray line and will not incur damage that will cause loss of function. For a break in either of the spray lines, the mitigating equipment inside containment which may be required is safety injection to the unbroken loop, containment fan coolers, and containment spray.

Safety injection to the unbroken loop and the containment fan coolers are remote from all break locations in both loop A and loop B spray lines. The containment spray lines are remote from breaks in the loop B line but could be affected by the loop A line. The containment spray line has a larger section modulus than the pressurizer spray line and will not incur damage that will cause loss of function.

Reach rods for the containment sump valves to the low-pressure safety injection pump suction lines are also in the area which may be affected by the loop A spray line. These valves are open and are inactive in the accident sequence. If breaks occur where damage can be done to the sump valve reach rods, flow may be restricted. A mechanistic evaluation of the pressurizer spray line from loop A, which passes near the reach rods, was performed and showed that breaks need not be postulated near the reach rods.

3.6.1.3.2.16 Pressurizer Safety and Relief Lines The high-energy portions of the pressurizer safety and relief piping are the lines from the top of the pressurizer to the safety and relief valves. These lines are all less than 10 ft in length and are contained entirely within the pressurizer compartment. Ruptures in any of the lines will result in a small hot-leg loss-of-coolant accident. All of the engineered safety feature equipment required to mitigate the effects of the break is outside the compartment and will not be affected. No unacceptable consequences will result from the pipe break.

Page 153 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.2 POSTULATED PIPING FAILURES IN FLUID SYSTEMS OUTSIDE CONTAINMENT 3.6.2.1 Introduction and Summary 3.6.2.1.1 Initial Evaluation In December 1972, the NRC staff sent letters to all power reactor licensees requesting an analysis of the effects of postulated failures of high-energy lines outside of containment (Reference 1).

In response to that letter, Ginna Station submitted an evaluation of the effects of postulated high-energy line breaks outside of containment on November 1, 1973 (Reference 14). As a result of that evaluation and subsequent follow-up evaluations, Ginna Station committed to perform station modifications and to implement an augmented inservice inspection program to mitigate the effects of postulated pipe breaks (Reference 15). The augmented inservice inspection program was approved by the NRC in Amendment 7 to the Ginna operating license (DPR-18) by letter dated May 14, 1975 (Reference 16). The station modifications were as follows:

1. An augmented inservice inspection program was initiated to further reduce the probability of a main feedwater or steam line rupture.

2. A standby auxiliary feedwater system was (SAFW) added to further improve steam generator feedwater reliability and specifically to substitute for the preferred auxiliary feedwater in the low probability that preferred auxiliary feedwater pumps are damaged due to nearby high-energy pipe breaks within the intermediate building.

3. Check valves were added to existing preferred auxiliary feedwater lines near the connections to the main feedwater lines to minimize the preferred auxiliary feedwater piping that is pressurized during MODES 1 and 2.

4. Two parallel remotely operated valves were added to a crossover line between the motor-driven pump discharges to provide additional auxiliary feedwater makeup capability.

5. A large metal plate jet shield was installed underneath the main steam header in the intermediate building to protect the service water (SW) piping from a postulated crack in the main steam line. Jet impingement shields were added to protect vital equipment including containment isolation valves, motor generators, transfer switches, cable trays, terminal boxes and wiring, pressure transmitters, and reactor trip breakers. Also, jet shields were added to protect main steam bypass valves and piping, and at other locations.

6. Instrument cabling was relocated to areas that will not be affected by postulated high-energy pipe breaks.

7. The heating and ventilation system was modified to withstand postulated high-energy pipe breaks without further endangering the capability to safely shut down the plant.

8. In the east end of the cable tunnel, the cable tray which connects the intermediate building and the control building air handling room was sealed with a barrier and fire resistant materials. The cable tray which connects the control building air handling room and the relay room was also sealed with fire resistant materials.

Page 154 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

9. Openings around pipes and cable trays that pass through the areas required for safe shut-down of the plant were sealed to prevent steam leakage into these areas in the unlikely event of steam or feedwater line breaks in the turbine building.

10. Steam generator blowdown lines were rerouted through the subbasement to minimize the potentially detrimental effects of breaks in these lines within the intermediate building.

11. Sufficient floor grating was installed at manholes to guard against flooding of safety-related equipment in the intermediate building resulting from an assumed feedwater line break.

12. Steam line pressure and feedwater flow transmitters were relocated away from the locations that could be affected by postulated high-energy line breaks.

13. Pressure-shielding steel diaphragm walls were installed at the control building-turbine building wall and at the diesel building-turbine building wall to ensure continued operability of safety-related equipment following a postulated high-energy pipe break in the turbine building.

3.6.2.1.2 Systematic Evaluation Program Reevaluation In addition, certain modifications were made as a result of the Systematic Evaluation Program reevaluation of the effects of pipe breaks outside containment. These are summarized below:

1. Hose connections from the fire water system have been installed to provide an alternate source of cooling water for the diesel generators that is independent of the service water (SW) system. This responded to the possible damage to the power supplies to all service water (SW) pumps from high-or moderate-energy line breaks in the screen house.

2. The doorway between the mechanical equipment room and the battery rooms was replaced with a watertight wall. A water relief valve was provided between the mechanical equipment room and the turbine building. The evaluation had shown that a moderate-energy line crack in the service water (SW) piping located in the mechanical equipment room could result in the flooding of both battery rooms.

3. Pipe whip and jet impingement protection is being provided for the 6-in. heating steam line riser located on the intermediate floor of the auxiliary building to protect safety-related electrical equipment in the vicinity of the riser.

4. Heating steam lines have been removed from the relay room and air handling room in order to maintain a mild environment for the purpose of environmental qualification of electrical equipment in the rooms.

5. A spare charging pump breaker and feeder breaker for bus 16, stored in an area not subject to a heating or process steam line break, and spare power cable which can be routed from bus 16 to the charging pump were provided in order to restore power to the charging pump in the event that either the breakers or power feeds fail as a result of a postulated break in the steam heating line in the auxiliary building. The later environmental qualification of the charging pump and power supply breakers at bus 16 eliminated the need for the spare breakers. The spare power cable is still required, and is stored in an area outside the auxiliary building. See Section 3.6.2.5.1.8 for details of these modifications.

Page 155 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.2.2 Evaluation Procedure 3.6.2.2.1 Initial Evaluation The initial evaluation in response to the NRC December 1972 letter (Reference 1) was accomplished as discussed in the following paragraphs.

Piping lines were divided into three categories: high energy, moderate energy, and low energy. High-energy lines were those that exceeded 200F and 275 psig, moderate-energy lines were those that exceeded 200F or 275 psig, and low-energy lines were those that did not exceed 200F or 275 psig. Only those lines that were in the same building or in the proximity of safety-related equipment required for safe shutdown were considered in the review. The lines reviewed are listed as follows:

Lines Considered Energy Level Main steam Intermediate and turbine buildings High Intermediate and turbine buildings High Preferred auxiliary feedwater Intermediate building Low Steam supply to preferred auxil- Intermediate building Low iary feedwater pump turbine Steam generator blowdown Intermediate and turbine buildings High Charging line Auxiliary building Moderate Plant steam Auxiliary, intermediate, and turbine Moderate buildings The lines considered high energy were evaluated for the effects of longitudinal and circumferential (full-diameter) breaks. The lines considered moderate energy were evaluated for the effects of crack breaks. The lines considered low energy were not postulated to break. The effects of full-diameter breaks considered were whip, jet impingement, pressurization, environmental, and flooding. The effects of crack breaks considered were jet impingement and environmental.

Main steam and feedwater line postulated breaks were reviewed to determine the equipment required to bring the plant to a safe shutdown. Should a major main steam line break occur, reactor trip, preferred auxiliary feedwater system operation, and isolation of main steam and main feedwater would be initiated. Following a major feedwater line break, reactor trip and preferred auxiliary feedwater system operation would be initiated. For these postulated breaks, cooling would be accomplished by feedwater addition through the preferred auxiliary feedwater system. The equipment required to bring the plant to a safe shutdown following main steam or feedwater pipe ruptures was listed.

Page 156 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.2.2.2 Systematic Evaluation Program Reevaluation The reevaluations of the effects of pipe breaks outside containment, in response to SEP Topic III-5.B, involved the comparison of Ginna Station with the then current NRC criteria for pipe breaks outside containment as set forth in Standard Review Plans 3.6.1 and 3.6.2 and Branch Technical Positions ASB 3-1 and MEB 3-1. Current criteria define a high-energy fluid system as one where the maximum operating temperature is greater than or equal to 200F or the maximum operating pressure is greater than or equal to 275 psig. In the initial (1972) review, a high-energy system was one in which both temperature and pressure exceed 200F and 275 psig, respectively. All other piping is considered moderate-energy piping in accordance with current criteria. An effects-oriented approach to determine the acceptability of plant response to pipe breaks, i.e., each structure, system, component, and power supply which must function to mitigate the effects of the pipe break and to safely shut down the plant was examined to determine its susceptibility to the effects of the postulated break. Break effects considered were compartment pressurization, pipe whip, jet impingement, spray, flooding, and environmental conditions of temperature, pressure, and humidity.

The SEP reevaluation of pipe breaks outside containment considered the zones within the plant which contain systems required for safe shutdown and/or systems required to mitigate the effects of postulated pipe breaks. These zones were the screen house, diesel-generator rooms, intermediate building (elevation 293, 278, and 253 ft), turbine building (elevation 289, 271, and 253 ft), control room, relay room, battery rooms, mechanical equipment room, and auxiliary building (elevation 271, 253, and 235 ft).

The safe shutdown systems which were examined from the standpoint of protection from pipe break effects were identified in the NRC staffs SEP Safe Shutdown Review for Ginna.

These systems included the following:

• Reactor Trip System (RTS).

• Auxiliary feedwater system.

• Main steam safety, isolation, and atmospheric dump valves.

• Service water (SW) system.

• Chemical and volume control system.

• Component cooling water (CCW) system.

• Residual heat removal system.

• Instrumentation for shutdown and cooldown.

• Emergency power (ac and dc) and control power for the above systems and components.

The evaluations were conducted as described in Sections 3.6.2.3 and 3.6.2.4 to determine the possible break locations and effects associated with the postulated failure of the piping.

Page 157 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.2.3 Analysis Criteria 3.6.2.3.1 December 18, 1972, AEC Letter Evaluation Criteria For those lines outside containment a mechanistic analysis to determine break locations was performed in response to the AEC letter of December 18, 1972 (Reference 1), requesting general information related to the consideration of the effects of piping system breaks outside containment. The criteria used in that evaluation is presented below.

The mechanistic evaluation was as follows. Design-basis breaks in straight or curved pipes of a 4-in. diameter or greater were assumed to be either longitudinal or circumferential, with the break area equal to the flow area of the pipe. Design-basis breaks at branch points were assumed to be circumferential in the branch and longitudinal in the run with the break area equal to the flow area of the branch. The criteria used to select design-basis break locations were as follows:

A. Postulated breaks at terminal points (anchored, rigid attachment to equipment, or anchor extensions).

B. Postulated breaks at branch points.

C. Postulated intermediate breaks between terminal points whenever the primary stress (pressure, weight, operating-basis earthquake) plus secondary stress (thermal) exceeds 80% of (Sh + SA), or where secondary stress alone exceeds 80% of SA.

D. As a minimum, two intermediate breaks between terminal points were selected at locations of highest stress.

Crack breaks were postulated at adverse locations in moderate and high-energy piping and were assumed to be one-half the pipe diameter in length and one-half the pipe wall thickness in width.

3.6.2.3.2 Systematic Evaluation Program Criteria In response to the NRC SEP review, an effects-oriented approach was used to reevaluate the analyses and its conformance with current criteria. The criteria utilized in this approach was selected from that used in the NRC Standard Review Plans 3.6.1 and 3.6.2 and associated Branch Technical Positions ASB 3-1 and MEB 3-1 (Revision 1). Excerpts from that criteria are as follows:

3.6.2.3.2.1 High-Energy Fluid Systems Piping

1. Breaks and cracks need not be postulated in those portions of piping from containment wall to and including the inboard or outboard isolation valves provided they meet the requirements of the ASME Code,Section III, Subarticle NE-1120 and the additional design requirements specified in MEB 3-1.

2. Breaks in Class 1 piping (ASME Code,Section III) should be

a. At terminal ends.

Page 158 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

b. At intermediate locations where the maximum stress range as calculated by Equation 10 and either Equations 12 or 13 of paragraph NB-3653, ASME III, exceeds 2.4 Sm.

c. At intermediate locations where the cumulative usage factor exceeds 0.1.

d. If two intermediate locations cannot be determined by b. and c. above, two highest stress locations based on Equation 10 should be selected. If the piping run has only one change or no change of direction, only one intermediate location should be postulated. As a result of piping reanalysis, the highest stress locations may be shifted; however, the initially determined intermediate break locations need not be changed unless one of the following conditions exist. (Note: This requirement was changed by Generic Letter 87-11, which eliminated arbitrary pipe break locations.)

1. Maximum stress ranges or cumulative usage factors exceed the threshold levels in

b. or c. above.

2. A change is required in pipe parameters such as major differences in pipe size, wall thickness, and routing.

3. Breaks at the new highest stress locations are significantly apart from the original locations and result in consequences to safety-related systems requiring additional safety protection.

In such conditions, the newly determined highest stress locations should be the intermediate break locations.

3. With the exceptions of those portions of piping identified in item 1 above, breaks in Class 2 and 3 piping (ASME Code,Section III) should be postulated at the following locations in those portions of each piping and branch run.

a. At terminal ends.

b. At intermediate locations selected by one of the following criteria:

1. At each pipe fitting (e.g., elbow, tee, cross, flange, and nonstandard fitting),

welded attachment, and valve. Where the piping contains no fittings, welded attachments, or valves, at one location at each extreme of the piping run adjacent to the protective structure.

2. At each location where the stresses exceed 0.8 (1.2 Sh + SA) but at not less than two separated locations chosen on the basis of highest stress. Where the piping consists of a straight run without fittings, welded attachments, or valves, and all stresses are below 0.8 (1.2 Sh + SA), a minimum of one location chosen on the basis of highest stress. As a result of piping reanalysis, the highest stress locations may be shifted from original calculations. (Note: This requirement was changed by Generic Letter 87-11, which eliminated arbitrary pipe break locations.)

4. Breaks in non-nuclear class piping should be postulated at the following locations in each piping or branch run. (Note: This requirement was changed by Generic Letter 87-11, which eliminated arbitrary pipe break locations.)

a. At terminal ends of the run if located adjacent to the protective structure.

Page 159 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

b. At each intermediate pipe fitting, welded attachment, and valve.

5. If a structure separates a high-energy line from an essential component, that separating structure should be designed to withstand the consequences of the pipe break in the high-energy line which produces the greatest effect at the structure irrespective of the fact that the above criteria might not require such a break location to be postulated.

6. Leakage cracks should be postulated in ASME Code,Section III, Class 1 piping where the stress range by Equation 10 of Paragraph NB-3653 exceeds 1.2 Sm, and in Class 2 and 3 or nonsafety class piping where the stress by the sum of Equations 9 and 10 of Paragraph NC/

ND 3652 exceeds 0.4 (1.2 Sh + SA). Non-safety class piping which has not been evaluated to obtain similar stress information shall have cracks postulated at locations that result in the most severe environmental consequence. (Note: This requirement was changed by Generic Letter 87-11, which eliminated arbitrary pipe break locations.)

3.6.2.3.2.2 Moderate-Energy Fluid System Piping

1. Fluid Systems Separated from Essential Systems and Components.

A review of the piping layout and plant arrangement drawings should clearly show that the effects of through-wall leakage cracks at any location in piping designed to seismic and nonseismic standards are isolated or physically remote from essential systems and components.

2. Fluid System Piping in Containment Penetration Areas.

Leakage cracks need not be postulated in those portions of piping from containment wall to and including the inboard or outboard isolation valves, provided they meet the requirements of the ASME Code,Section III, Subarticle NE-1120, and are designed such that the maximum stress range does not exceed 0.4 (1.2 Sh + SA) for ASME Code,Section III, Class 2 piping.

3. Fluid Systems in Areas Other Than Containment Penetration.

a. Through-wall leakage cracks should be postulated in fluid system piping located adjacent to structures, systems, or components important to safety, except where exempted by Section 3.6.2.3.2.1, item 1 above and item 4 below or where the maximum stress range in these portions of Class 1 piping (ASME Code,Section III) is less than 1.2 Sm, and Class 2 or 3 or nonsafety class piping is less than 0.4 (1.2 Sh +

SA). The cracks should be postulated to occur individually at locations that result in the maximum effects from fluid spraying and flooding, with the consequent hazards or environmental conditions developed.

b. Through-wall leakage cracks should be postulated in fluid system piping designed to nonseismic standards as necessary to satisfy that the functional capability of essential systems and components will be maintained after the piping failure, assuming a concurrent single active failure.

4. Moderate-Energy Fluid Systems in Proximity to High-Energy Fluid Systems.

Page 160 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Cracks need not be postulated in moderate-energy fluid system piping located in an area in which a break in high-energy fluid system piping is postulated, provided such cracks would not result in more limiting environmental conditions than the high-energy piping break.

5. Fluid Systems Qualifying as High-Energy or Moderate-Energy Systems.

Through-wall leakage cracks instead of breaks may be postulated in the piping of those fluid systems that qualify as high-energy fluid systems for only short operational periods but qualify as moderate-energy fluid systems for the major operational period.

3.6.2.3.2.3 Type of Breaks and Leakage Cracks in Fluid System Piping

1. Circumferential Pipe Breaks.

The following circumferential breaks should be postulated individually in high-energy fluid system piping at the locations specified above.

a. Circumferential breaks should be postulated in fluid system piping and branch runs exceeding a nominal pipe size of 1 in., except where the maximum stress range exceeds the limits specified in Section 3.6.2.3.2.1, items 2 and 3, but the circumferential stress range is at least 1.5 times the axial stress range. Instrument lines, 1-in. and less nominal pipe or tubing size should meet the provisions of Regulatory Guide 1.11.

b. Where break locations are selected without the benefit of stress calculations, breaks should be postulated at the piping welds to each fitting, valve, or welded attachment.

Alternatively, a single break location at the section of maximum stress range may be selected as determined by detailed stress analyses (e.g., finite element analyses) or tests on a pipe fitting.

c. Circumferential breaks should be assumed to result in pipe severance and separation amounting to at least a one-diameter lateral displacement of the ruptured piping sections unless physically limited by piping restraints, structural members, or piping stiffness as may be demonstrated by inelastic limit analysis (e.g., a plastic hinge in the piping is not developed under loading).

d. The dynamic force of the jet discharge at the break location should be based on the effective cross-sectional flow area of the pipe and on a calculated fluid pressure as modified by an analytically or experimentally determined thrust coefficient. Limited pipe displacement at the break location, line restrictions, flow limiters, positive pump-controlled flow, and the absence of energy reservoirs may be taken into account, as applicable, in the reduction of jet discharge.

e. Pipe whipping should be assumed to occur in the plane defined by the piping geometry and configuration, and to initiate pipe movement in the direction of the jet reaction.

2. Longitudinal Pipe Breaks.

The following longitudinal breaks should be postulated in high-energy fluid system piping at the locations of the circumferential breaks specified in item 1 above.

a. Longitudinal breaks in fluid system piping and branch runs should be postulated in nominal pipe sizes 4-in. and larger, except where the maximum stress range exceeds Page 161 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS the limits specified in Section 3.6.2.3.2.1, items 1 and 2, but the axial stress range is at least 1.5 times the circumferential stress range.

b. Longitudinal breaks need not be postulated at

1. Terminal ends.

2. At intermediate locations where the criterion for a minimum number of break locations must be satisfied.

3. Longitudinal breaks should be assumed to result in an axial split without pipe severance. Splits should be oriented (but not concurrently) at two diametrically opposed points on the piping circumference such that the jet reactions cause out-of-plane blending of the piping configuration. Alternatively, a single split may be assumed at the section of highest tensile stress as determined by detailed stress analysis (e.g., finite element analysis).

4. The dynamic force of the fluid jet discharge should be based on a circular or elliptical (2 D x 1/2 D) break area equal to the effective cross-sectional flow area of the pipe at the break location and on a calculated fluid pressure modified by an analytically or experimentally determined thrust coefficient as determined for a circumferential break at the same location. Line restrictions, flow limiters, positive pump-controlled flow, and the absence of energy reservoirs may be taken into account, as applicable, in the reduction of jet discharge.

5. Piping movements should be assumed to occur in the direction of the jet reaction unless limited by structural members, piping restraints, or piping stiffness as demonstrated by inelastic limit analysis.

3. Through-Wall Leakage Cracks.

The following through-wall leakage cracks should be postulated in moderate-energy fluid system piping at the locations specified in Section 3.6.2.3.2.2 above. (Note: This requirement was changed by Generic Letter 87-11.)

a. Cracks should be postulated in moderate-energy fluid system piping and branch runs exceeding a nominal pipe size of 1 in. These cracks should be postulated individually at locations that result in the most severe environmental consequences.

b. Fluid flow from a crack should be based on a circular opening of area equal to that of a rectangle one-half pipe diameter in length and one-half pipe wall thickness in width.

c. The flow from the crack should be assumed to result in an environment that wets all unprotected components within the compartment, with consequent flooding in the compartment and communicating compartments. Flooding effects should be determined on the basis of a conservatively estimated time period required to effect corrective actions.

3.6.2.3.2.4 Assumptions In analyzing the effects of postulated piping failures, the following assumptions should be made with regard to the operability of systems and components:

Page 162 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

1. Offsite power should be assumed to be unavailable if a trip of the turbine-generator system or Reactor Trip System (RTS) is a direct consequence of a postulated piping failure.

2. A single active component failure should be assumed in systems used to mitigate consequences of the postulated piping failure and to shut down the reactor, except as noted in item 3 below. The single active component failure is assumed to occur in addition to the postulated piping failure and any direct consequences of the piping failure, such as unit trip and loss of offsite power.

3. Where the postulated piping failure is assumed to occur in one, two, or more redundant trains of a dual-purpose moderate-energy essential system (i.e., one required to operate during normal plant conditions as well as to shut down the reactor and mitigate the consequences of the piping failure), single failures of components in the other train or trains of that system need not be assumed, provided the following: The system is designed to Seismic Category I standards, is powered from both offsite and onsite sources, and is constructed, operated, and inspected to quality assurance, testing, and inservice inspection standards appropriate for nuclear safety systems. Examples of systems that may, in some plant designs, qualify as dual-purpose essential systems are service water (SW) systems, component cooling systems, and residual heat removal systems.

4. All available systems, including those actuated by operator actions, may be employed to mitigate the consequences of a postulated piping failure. In judging the availability of systems, account should be taken of the postulated failure and its direct consequences such as unit trip and loss of offsite power, and of the assumed single active component failure and its direct consequences. The feasibility of carrying out operator actions should be judged on the basis of ample time and adequate access to equipment being available for the proposed actions.

3.6.2.3.2.5 Effects of Piping Failure

1. The effects of a postulated piping failure, including environmental conditions resulting from the escape of contained fluids, should not preclude habitability of the control room or access to surrounding areas important to the safe control of reactor operations needed to cope with the consequences of the piping failure.

2. The functional capability of essential systems and components should be maintained after a failure of piping not designed to Seismic Category I standards, assuming a concurrent single active failure.

3.6.2.4 Analysis in Response to December 18, 1972, AEC Letter 3.6.2.4.1 Rupture Load Analysis In response to the December 18, 1972, AEC letter, the rupture loads for the main steam and feedwater piping systems outside containment were generated for each postulated pipe break location considering circumferential and longitudinal pipe ruptures. Analytical considerations included the numerical solution of the continuity, momentum, and energy, and state equations for every volume associated with the break using the computer coded solution PRTHRUST. Furthermore, the effects of both wave and blowdown thrust components were considered and credit was taken for flow limiters, pipe friction, and restrictions in the line.

Page 163 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS In the development of the thrust-time curves, it was also postulated that the break occurred instantaneously and that the fluid condition inside the pipe was taken as the maximum pressurization conditions. The rupture loads were calculated up to a maximum time of 0.5 sec after the rupture. Thrust forces on branch lines were assumed as 1.26 PA for steam and 2.0 PA for fluid where P is the initial pipe stagnation pressure and A is the pipe flow area when no blowdown calculation is used.

3.6.2.4.2 Main Steam System Load Analysis The transients were developed for the thrust forces during the first 0.5 sec after the longitudinal and circumferential breaks in the main steam piping system. These results were generated assuming that the stop and Main Steam non-return check valve in the steam lines remain inactive during the first 0.5 sec. The results indicated that the maximum thrust force is developed within the first 0.0005 sec after the break. This peak is the result of rapid acceleration of the steam at the break location before the limiting condition imposed by hydrodynamic and thermodynamic aspects of the flow field are achieved. As the depressurization wave moves upstream the flow rate decreases and consequently the forces decrease rapidly reaching a state where it becomes relatively constant.

These data were used as forcing functions in investigating the dynamic response of the ruptured pipe.

3.6.2.4.3 Feedwater System Load Analysis The thrust forces on the feedwater piping due to circumferential and longitudinal breaks were calculated for the first 0.5 sec after the pipe rupture. Certain breaks were evaluated based on two fluid conditions inside the feedwater piping, i.e., MODE 3 (Hot Shutdown) and full load, because of the uncertainty as to which condition represents the most severe case. The most severe loading profile was used in further developments of the investigation.

3.6.2.4.4 Jet Impingement Load Analysis Circumferential and longitudinal breaks in the main steam and feedwater piping result in the formation of jets which might impinge on safety-related structures, systems, or components.

The configuration of the jet arising from longitudinal and crack breaks is such that the jet axis is perpendicular to the axis of the pipe and the orientation is about any point along the circumference of the pipe. For jets generated by circumferential breaks, the jet axis is parallel to the pipe axis and the orientation is always in the direction of the axis of the ruptured pipe.

For jet impingement effects on known targets, the following factors were considered:

• Break type, geometry, and orientation of jet axis.

• Jet expansion of 25 degrees.

• Target geometry and distance from jet.

• Fluid conditions.

Page 164 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.6.2.4.5 Pipe Whip Analysis for Main Steam and Feedwater Piping 3.6.2.4.5.1 Analytical Methods The piping dynamic response analyses were performed using the PIPERUP computer program. This program performs nonlinear elastic-plastic pipe whip analyses of three-dimensional piping systems subjected to dynamic time-history for any functions. The piping is modeled as an assemblage of straight and curved-beam finite elements. The analysis is conducted by integrating the system equations of motion with time.

Each pipe element is initially represented in the program as a combination of three subelements, whose sum stiffness equals the elastic stiffness of the pipe. During the analysis, if computed loads at a point are detected to exceed the yield capacity of the pipe, one of the three subelements is hinged; thus, the stiffness of the remaining two subelements corresponds to the strain hardening modulus of the material. The analysis is then continued: if the computed loads are later detected to exceed the ultimate capacity of the pipe, the second subelement is hinged, leaving a single subelement with a very small stiffness. Prediction of a plastic collapse mechanism, or pipe whip, is based on detection of excessive deflections.

The material properties used in the analysis were taken from ASME Code,Section III, for the piping materials at operating temperatures. Lower bound material property values were used to predict piping response.

The PIPERUP program has the capability to represent a flexible support with an initial gap between the pipe and its support. This feature was used to model conditions of pipe impact on structural components such as walls, floors, pipe sleeves, and columns. Evaluation of structural failure of such components was based on reaction loads computed by the program.

In cases where pipe whip would impact other safety-related equipment, such as cabling and instrumentation, failure of that equipment was automatically assumed to occur.

For circumferential (guillotine) breaks, response of piping on both sides of the break was considered. For longitudinal breaks, loading at any critical orientation about the circumference of the pipe was considered.

The thermal hydraulic blowdown thrust loads input to the piping dynamic response analyses were obtained using the PRTHRUST program, as described in Section 3.6.2.4.6.

3.6.2.4.5.2 Results of Analysis The intermediate building structure was shown to be generally incapable of resisting the pipe whip effects of most postulated main steam and feedwater pipe breaks within the building.

Also, analyses of the main steam and feedwater anchor assemblies showed that these elements would be overstressed due to the breaks, and reactions from the anchor loading were shown to be excessive for the basic structural steel framing of the intermediate building.

Although the control building is somewhat remote from high-energy piping, it was determined to be possibly damaged by a main steam line pipe whip because the facade columns would not be effective in restraining the pipe whip.

Page 165 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Because of these potential effects of the postulated main steam line and feedwater line breaks, an augmented inservice inspection program was proposed by Ginna Station and implemented to protect against potential damage. This program consisted of radiographic examination of all welds at the design-basis break locations in the main steam and feedwater lines and at other locations where a failure would result in unacceptable consequences. Presently, volumetric techniques are employed. The augmented inservice inspection program is described within the High Energy Program section of the Inservice Inspection (ISI) Program document. This High Energy Program is designed to preclude design bases or consequential main steam or feedwater pipe breaks.

Certain consequential main steam and feedwater line breaks in the turbine building were also calculated to possibly produce pipe whip damage to the intermediate building. Thus, these break locations were included in the augmented inservice inspection program. Modifications to systems, components, and structures to preclude damage to safety-related equipment required for safe shutdown are discussed in Section 3.6.2.1.

3.6.2.4.6 Blowdown Analysis 3.6.2.4.6.1 Main Steam Blowdown Analysis The thermal-hydraulic analysis of the main steam blowdown was performed utilizing the PRTHRUST computer code. A model of the main steam analysis was constructed to represent the major pieces of equipment in the main steam system with their interconnecting piping and adjoining systems (condensate and feedwater). The model includes inventories of steam and water, piping flows, and heat sources applied on a control volume basis. Main steam line volumes were selected to account for segments between the elbows on either side of the postulated break point.

The main steam system blowdown analysis was conducted for both the short-term effects (i.e., pipe thrust) and the full duration transient (compartment differential pressures and building environment). The short-term transient blowdown (0.5 sec) is unaffected by the initiation of trip devices to mitigate the consequences of the accident due to their reaction time. The analysis was performed for break locations where double-ended (circumferential) guillotine ruptures were postulated, as well as for longitudinal breaks equal to the pipe cross-sectional flow area. In all cases, a break flow discharge coefficient of 1.0 was used for maximum blowdown flow rates.

The long-term blowdown is a continuation of the short-term analysis considering the effect of trip device activation. The long-term transient was carried out assuming the worst-case single active component failure. The results of this analysis were used to determine structural loadings.

3.6.2.4.6.2 Feedwater Blowdown Analysis The PRTHRUST digital computer code was used in analyzing the feedwater blowdown transients. The system was represented by an assemblage of control volumes connected by flow paths or junctions. The effects of valves, pumps, heat exchangers, and check valves are included in the code. In addition, the program allows the operation of active devices to be Page 166 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS triggered by time or by physical signal such as pressure. The feedwater lines were divided so that volume size and junction location would provide optimum system representation for the particular case being analyzed.

It was assumed that for the duration of these analyses, the feedwater pumps would continue to operate and that flow would be a function of head (until automatic trips were initiated). It was further assumed that for the duration of these analyses, an unlimited supply of water at constant pressure was available at the feedwater pump suction. Both main feedwater pumps were combined and modeled as a single pump. The results of this analysis were used to determine structural loadings.

3.6.2.4.7 Compartment Pressurization Analysis 3.6.2.4.7.1 Main Steam Line Ruptures The pressure-temperature transients resulting from a rupture of a main steam line in the intermediate and turbine buildings were investigated. These transients were calculated by using the main steam blowdown model to provide mass and energy flow into control volumes representing the intermediate building and turbine building with associated vent areas. The pressure transients were used in the structural evaluation described in Section 3.6.2.5.1.

3.6.2.4.7.2 Building Pressurization for a Branch Line Rupture Small branch connections not included in the inservice inspection program had to be considered from a building pressurization standpoint. The worst-case branch rupture would be a 6-in. line (0.181 ft2) leading from the main steam header. The steady-state steam flow that would issue from the postulated break (277 lbm/sec) is considered to transfer all of its latent heat of condensation to the surrounding air within the intermediate building. The resultant increase of air pressure would drive relief flow out of the building vent areas on an incremental steady-state basis. While this method of analysis is extremely conservative (because relative humidity is not taken into account), it provides an upper bound for intermediate building pressure. With an intermediate building vent area of 155 ft2, this method of analysis gives 0.08 psi maximum intermediate building pressure, which is below the allowable limit. The plant uprate to 1775 MWt slightly increases the main steam system operating pressure at full power. This increase in pressure results in a slight increase in the steam blowdown rate and corresponding intermediate building pressurization. However, the increase in intermediate building pressure due to uprate is small and is still well below the allowable limits.

Building pressurization within the turbine building due to a branch line rupture is negligibly small; therefore, no damage is predicted for the adjacent control building or intermediate building from a branch rupture or crack break within the turbine building. See Section 3.6.2.5.1.4 for results of the structural analysis for pressurization of the turbine building.

3.6.2.4.8 Flooding Analysis 3.6.2.4.8.1 Intermediate Building Flooding An intermediate building flooding analysis due to a postulated feed system rupture was Page 167 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS performed. With slight modifications (new drainage provided) there is no danger of damage to nuclear safety-related equipment due to flooding caused by a feedwater line rupture. The NRC was also concerned about possible flooding in the intermediate building subbasement due to a postulated high-or moderate-energy line failure. Ginna LLC considered this not to be of concern because present routine walk-through inspections of the intermediate building would detect a pipe leak long before there was any danger of flooding safety-related equipment. If the postulated leak occurred at a level above the subbasement, leakage into the subbasement via the floor drains would be obvious during the routine once-per-shift walk-throughs. Even a large secondary-side break would result in only a 2-ft depth of water in the subbasement. If the leak were in the service water (SW) piping located in the subbasement of the intermediate building, there would be a significant time interval between the initiation of the crack and the flooding of safety-related equipment. The intermediate building subbasement has a volume of approximately 50,000 ft3. With a service water (SW) leak rate of about 640 gpm, it would take over 9.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to begin flooding the basement level. It was considered that a sizable leak rate such as this would be detected visibly or audibly by personnel during the walkthroughs, or by personnel monitoring the control board (the 640-gpm leak would be a significant fraction (10%) of the service water (SW) pump flow).

There are two sump pumps in the subbasement. Sump high water level alarms sound in the water treatment room. Even if the basement elevation was flooded, safe shutdown would not be prevented. Based on this and the other information provided above, the NRC staff concluded that there are adequate means to warn of flooding conditions in the subbasement and, therefore, no modifications are required.

3.6.2.4.8.2 Screen House and Turbine Building Flooding Protection is provided to protect safety-related equipment in the screen house and the turbine building from flooding because of leaks in the circulating water system. The protection consists of float switches in the circulating water pump pit in the screen house and in the condenser pit in the turbine hall with redundant two-out-of-three logic for tripping the circulating water pumps. Permanently installed, Seismic Category I dikes are in the screen house, and elevated doorways are between the turbine building and the control building to contain the water that may escape from the circulating water system. The design of these protective features is described in Section 10.6.2.9.

3.6.2.5 Systematic Evaluation Program Analysis 3.6.2.5.1 Zone Reevaluation Performed as Part of the Systematic Evaluation Program Review The Systematic Evaluation Program included a review of the facility with respect to current Standard Review Plan criteria as well as a reevaluation of the original criteria and resolutions.

3.6.2.5.1.1 Screen House Service water (SW) system or fire system moderate energy line cracks and heating steam line breaks could result in the loss of the service water (SW) system by damaging 480-V electrical buses 17 and 18 or their associated electrical motor control centers and cabling. Loss of the service water (SW) system would result in a plant trip because of the loss of several Page 168 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS components cooled by the service water (SW) system such as the reactor feed pump lube-oil systems, circulating water pumps, and the component cooling water (CCW) system. In accordance with current criteria, a pipe break that results in a reactor or turbine trip results, in turn, in a loss of offsite power. To supply ac power following a loss of offsite power, redundant emergency diesel generators are available; however, the diesel generators are supplied with cooling water by the service water (SW) system. Therefore, the postulated pipe break could cause the total loss of ac power at the plant, and reactor core decay heat removal would be dependent on the turbine-driven auxiliary feedwater pump.

To conduct a plant cooldown following a fire that causes a loss of the service water (SW) system with no offsite power available, Ginna Station has developed a procedure, which requires the installation of fire hoses from the yard hydrant system to provide the diesel generators with cooling water and to provide additional water to the preferred auxiliary and standby auxiliary feedwater pumps for steam generator makeup water. While the fire hoses are being installed, the turbine-driven auxiliary feedwater pump (TDAFW) can be used to add water from the condensate storage tank (CST) to the steam generators for decay heat removal.

After a diesel generator is operable, additional preferred auxiliary feedwater pumps and the reactor coolant system charging pumps can be operated as required.

The procedure can be used for the pipe break case even if the turbine-driven auxiliary feed pump is assumed to fail. Without feedwater addition, the steam generators can remove decay heat for approximately 35 minutes before they are boiled dry. This time could be used to make up the temporary diesel-generator cooling connections to start a diesel generator and a motor-driven auxiliary feed pump.

The NRC concluded that any further modification of the screen house to provide additional protection from pipe break effects for service water (SW) system components or for buses 17 and 18 is not required (Reference 17) (SEP Topic III-5.B).

3.6.2.5.1.2 Intermediate Building Flooding from pipe breaks in the intermediate building would flow via open stairways and hatch gratings to the subbasement of the intermediate building. Sufficient drainage area is available so that no appreciable buildup of water would occur on any floor of the intermediate building except for the subbasement. No equipment necessary for safe shutdown or flood mitigation is located on this level, but if the flooding condition went unchecked, the intermediate building 253-ft elevation could be affected. Equipment on this elevation includes the preferred auxiliary feedwater pumps and the reactor trip breakers. If this equipment were flooded, a reactor trip would occur and the preferred auxiliary feedwater system would be inoperable. The standby auxiliary feedwater system, which is not located in the intermediate building, would still be operable even if a loss of offsite power occurred.

Postulated ruptures of the main steam or feedwater lines in the intermediate building would cause pressurization within the building. The intermediate building is a steel frame structure with walls constructed of concrete blocks and floor slabs of 5-in.-thick reinforced concrete.

The peak pressure following the pipe break was determined by using the PRTHRUST computer program. Considering the existing vent area of approximately 140 ft2, the pressure Page 169 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS inside the intermediate building reaches a maximum of 15.6 psig at 1.5 sec after the 36-in.

main steam header breaks.

In analyzing the reinforced-concrete slabs subject to pressurization, yieldline theory was employed in calculating their maximum load carrying capacity. This theory takes into consideration the inelastic behavior of the reinforced-concrete elements.

The limit load capacities of the steel beams and girders were determined by plastic analysis.

The concrete block walls were analyzed as plates with an ultimate net compressive strength of masonry (fm) of 528 psi, per ASTM C90 and a tensile strength of (Equation 3.6-2) equal to 207 psi. The lateral uniform pressure required to fail the wall in bending with tension controlling was determined for the block walls. The critical shear was also checked.

The roof of the intermediate building is constructed of galvanized steel decking. Local buckling governs the pressure capacity of these panels.

All structural components in the intermediate building, with the following exceptions, are capable of withstanding the internal pressures in the building caused by the postulated breaks.

The exceptions are the concrete block walls and the beams and decking of the high roof of the intermediate building. The pressure capacities of these components are 1.0 psi and 0.85 psi, respectively, as compared to the predicted pressure differentials of 15.6 psi and 15.47 psi.

Because of the severe consequences of postulated main steam and main feed line breaks in the intermediate building and because plant modifications to prevent these consequences were not practical, a two-part program to reduce the vulnerability of the plant to a high-energy line break in the intermediate building was undertaken. The first part of the program was the augmented radiographic inspection program to provide added assurance that postulated large main steam and main feedwater line breaks would not occur. The second part of the Ginna Station program was to move essential equipment from the intermediate building into locations unaffected by a high-energy line break in the intermediate building, shield equipment from the effects of the high-energy line breaks, or provide additional equipment. The intent of this program is to preclude the large (greater than the equivalent of 6-in. diameter) breaks and acceptably mitigate the small breaks. A summary of plant modifications installed and equipment relocated is provided in Section 3.6.2.1.

3.6.2.5.1.3 Turbine Building Main Steam and Main Feedwater Line Breaks Postulated main steam and main feedwater system high-energy line breaks in the turbine building could result in the 24-in. main steam lines whipping into the intermediate building at an elevation which could result in damage to the B main steam line safety valves, the atmospheric dump valves, and the turbine-driven auxiliary feedwater pump (TDAFW) steam supply line. Also, breaks in the main steam line or main feedwater lines could result in pressurization of the turbine building itself. The pressurization of the turbine building could Page 170 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS adversely affect those areas adjacent to the turbine building in which safe shutdown or pipe break mitigating equipment is located.

In order to reduce the probability of postulated main steam and main feedwater line breaks in the turbine building a two-part program similar to that described for the intermediate building was undertaken.

The NRC-approved augmented inspection program was applied in the turbine building to main steam lines larger than a 12-in. diameter and several locations on the 20-in.-diameter main feedwater header. The inspection program limits the breaks which must be considered to be a 12-in. main steam or 20-in. main feedwater line break, which are the largest potential double-ended breaks in locations which are not inspected. Of these, the 20-in. main feedwater line is more limiting. To protect the areas adjacent to the turbine building from the effects of high-energy line breaks, pressure diaphragm walls between the turbine building and the control room, relay room, battery rooms, mechanical equipment room, and diesel-generator rooms were installed. The design differential pressure for these walls is 0.7 psi for the control room and 1.14 psi for the other spaces.

The pressure resulting from a 20-in. main feedwater or 12-in. main steam line break in the turbine building is sufficient to cause failure of the turbine building/intermediate building concrete block walls (design pressure 0.13 psid). If these walls failed, the following systems and components could be damaged by falling cinder blocks or adverse environmental conditions: one containment purge exhaust fan on the intermediate building 298-ft elevation, the preferred auxiliary feedwater system steam supply valves on the intermediate building 278-ft elevation, and the preferred auxiliary feedwater system turbine-driven pump, reactor trip breakers, and reactor rod control motor-generator sets on the intermediate building 253-ft elevation.

The purge exhaust fan is not required to function to mitigate a high-energy line break outside containment. The rod control motor generators and reactor trip breakers fail safe if damaged and would not prevent a reactor trip (core shutdown). The preferred auxiliary feedwater system function is required for a safe shutdown; however, the standby auxiliary feedwater system has been installed to accomplish this function if a high-energy line break disables the preferred auxiliary feedwater system. The turbine-driven auxiliary feedwater system pump is not specifically required to operate following a postulated high-energy line break since, even if offsite power were assumed to be lost, the redundant emergency diesel generators would be available to power the two standby auxiliary feedwater system pumps or the remaining two preferred auxiliary feedwater system pumps, all of which are driven by electric motors. Only one of these four motor-driven pumps is required for a plant shutdown and cooldown.

3.6.2.5.1.4 Structural Analysis of the Turbine Building for Pressurization The turbine building is a steel frame structure with walls constructed of girts and galvanized sheet steel. Floor slabs are made of reinforced concrete.

The two largest high-energy lines within the turbine building are the 36-in. and the 24-in.

main steam lines. However, these pipes are covered by the augmented inservice inspection Page 171 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS program which precludes all breaks except the crack break. This program reduces the maximum break area for these pipes to under 0.10 ft2.

The two largest high-energy lines subject to a double-ended rupture are the 20-in. feedwater line and the 12-in. main steam line, both on the mezzanine level of the turbine building.

These two lines were analyzed in detail to determine their mass and energy release following a postulated pipe rupture (Reference 18).

The worst-case break of the 20-in. feedwater line is a double-ended rupture (1.755 ft2) while the plant is operating at full power conditions. To maximize mass and energy release, the break location chosen was in the 20-in. line just downstream of the No. 5 feedwater heaters.

This location maximizes the available energy and inventory for the short-term release from the feedwater system. Determination of this mass and energy release was made using the FLASH (References 19 and 20) computer code series assuming a 1-msec break opening time and Moody flow with a 1.0 multiplier.

Since the turbine building pressurization is a short-term phenomenon (less than 1.0 sec), only short-term mass and energy release from the feedwater break is required. Therefore, no provision was made for feedwater pump trip or Main Feedwater Regulating Valve (MFRV) closure. To further ensure maximizing the mass and energy release, a single failure of one downstream check valve, 3992 or 3993, was assumed and no credit was taken for the flow limiter just upstream of these check valves.

A double-ended rupture (0.71 ft2) of the 12-in. main steam dump to the condenser while the plant is in the MODE 3 (Hot Shutdown) condition was analyzed as the worst main steam line break. The break location chosen was just downstream of the 36-in. header. Mass and energy release from this break was also determined using the FLASH computer code series assuming a 1-msec break opening time and Moody flow with a 1.0 multiplier.

Since only short-term mass and energy release data is required, no provision for safety valve closures was made. To maximize the available inventory from the condenser side of the break, a steam dump isolation valve was assumed to fail.

The turbine building response to a pipe rupture within the building itself was analyzed using a three-node model and the COMPARE (Reference 21) computer code. Both the feedwater and the main steam breaks occur in the western half of the mezzanine level of the turbine building.

Node one of the model represented both the mezzanine and the basement levels of the turbine building, since flow area between the two levels is large. The operating level of the turbine building was represented by node two. The outside environment corresponded to node three.

Results of the analysis showed that the 20-in. feedwater breaks cause the most severe pressure transients within the turbine building. Calculated pressure differentials were determined to be 0.46 psid for the operating level and 0.85 psid for the mezzanine/basement level. The plant uprate to 1775 MWt increases the calculated turbine building peak differential pressures of the operating floor and the mezzanine/basement floors to 0.49psi and 0.91psi, respectively.

Pressure differentials used for structural design of the turbine building steel diaphragm walls Page 172 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS are 0.70 psid for the operating level and 1.14 psid for the mezzanine/basement levels (see item 13 in Section 3.6.2.1). The steel diaphragm walls are at nearly opposite ends of the turbine building from the high-energy piping and therefore not subject to damage from pipe whip or jet impingement that could accompany the high-energy pipe break. The NRC concluded as a result of their safety evaluation of the structural adequacy of the turbine building steel diaphragm walls and of the results of the analysis reported in Reference 16 that the structural criteria and design methods for the steel diaphragm walls are adequate to ensure safe shutdown of the reactor following a high-energy pipe break in the turbine building (Reference 22).

In addition to installation of the steel diaphragm walls at the control building-turbine building wall and the diesel generator building-turbine building wall, the turbine building structure was reinforced to withstand the pressurization resulting from the 20-in. feedwater and 12-in.

main steam dump line breaks.

3.6.2.5.1.5 Battery Room/Mechanical Equipment Room Flooding A service water (SW) system or fire main system postulated failure in the mechanical equipment room was considered capable of flooding both battery rooms and result in a loss of all emergency dc power. No sump level or flood alarms are installed in this space or in the battery rooms, which were originally connected to the mechanical equipment room via normally closed nonwatertight doors. The non-watertight door between the air handling room and the B battery room has been replaced by a wall to preclude flooding the battery rooms and a water relief valve has been installed between the mechanical equipment room and the turbine building.

3.6.2.5.1.6 Auxiliary Feedwater Line Breaks on the 253-Ft Elevation of the Intermediate Building The preferred auxiliary feedwater system discharge lines from the pumps in the intermediate building (253-ft elevation) to the B main feedwater header run along the north wall of the intermediate building at approximately the 270-ft elevation. A break in this line, which is a high-energy line, could result in pipe whip or jet impingement on cable trays and containment electrical penetrations in that area. (The steam lines for the turbine-driven auxiliary feedwater system pump are also in this area but are not considered high-energy lines since they are not pressurized during normal plant conditions.) However, since the standby auxiliary feed-water system is routed completely separate from the preferred auxiliary feedwater system, safe shutdown could be accomplished following postulated auxiliary feedwater line breaks.

3.6.2.5.1.7 Relay Room and Air Handling Room Crack breaks in the plant heating steam lines could cause high temperatures and high humidity in these rooms. The effects of these crack breaks were found to be acceptable because of the existence of temperature monitors for the detection of the failure. However, RG&E decided that it would be necessary to maintain the room as a mild environment for the purpose of the environmental qualification of electrical equipment as required by 10 CFR 50.49. Therefore, the heating steam lines were cut and capped or welded shut outside the Page 173 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS control building thus removing the source of high energy from the rooms. The steam heaters in the air handling room were replaced with electric resistance heaters.

3.6.2.5.1.8 Auxiliary Building Postulated breaks in steam heating or process steam lines in the auxiliary building in the vicinity of safety-related equipment, such as an electrical bus, motor control center, or cable trays and conduit, could affect the operability of required safe shutdown equipment due to dynamic effects (jet impingement and pipe whip). Also, the general steam environment, although not expected to be severe throughout the entire auxiliary building, could possibly affect additional equipment required for safe plant shutdown.

In order to maintain a safe plant shutdown, the turbine-driven auxiliary feedwater system, which would not be affected by a high-energy line break in the auxiliary building, would be available to maintain preferred auxiliary feedwater flow to the steam generators, and thus maintain a safe shutdown condition. The condensate storage tanks (CST) have sufficient capacity to maintain auxiliary feedwater flow for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The other sources of auxiliary feedwater described in Section 3.6.2.5.1.1 would also be available, since they are located away from the auxiliary building. Thus, auxiliary feedwater and cooling water would be available indefinitely.In addition to auxiliary feedwater addition, a source of charging flow would be required to maintain inventory. For this purpose, the charging pumps would be used. The charging pumps, motors and A variable frequency drive (VFD) are located in the basement of the auxiliary building, in a separate concrete room, and thus are protected from the direct effects of a steam line break. Fire protection modifications for the charging room seal off major openings in the doors, windows, and ventilation penetrations. The environmental effects of the postulated steam line break are 150°F, 0.1 psig. This is not a significant steam environment for the charging pumps/motors which are required to withstand the adverse environment, per 10 CFR 50.49, and have margin for operation even following exposure to these effects. The B and C charging pump motor VFDs are housed in a separate concrete room, adjacent to the charging pump room. The VFDs can be exposed to temperatures up to 158F (Reference 37) and would be available for use following the isolation of the steam line break and restoration to ambient conditions. Any valves required to inject flow could be manipulated manually. The only equipment that might be affected by direct effects of the steam line breaks could be the charging pump and power supply breakers at bus 16 (intermediate floor of the auxiliary building), and power and control cabling in the basement of the auxiliary building. In order to resolve these issues, Ginna Station provided pipe whip and jet impingement protection for the 6-in.

steam line risers, located on the intermediate floor of the auxiliary building. The charging pump/motor and power supply breakers at bus 16 were environmentally qualified for operation in the auxiliary building environment. The possibility of damage to the charging pump B power feed from bus 16 exists from direct impingement in the event of rupture of one of the 2-1/2-in. steam heating lines in the auxiliary building basement. Consequently, Ginna LLC maintains a spare cable which could be routed from bus 16 to the charging pump motor VFDs. The spare cable is stored in an area outside the auxiliary building. The control wiring and the DC power source for the breakers are not required because each breaker can be closed manually.

Page 174 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The breaker for charging pump A is located at bus 14 on the operating floor of the auxiliary building. Bus 14 is not in the vicinity of a process steam line and is unlikely to be affected by the dynamic effects of postulated steam pipe breaks, and thus provides defense in depth for the credited B charging pump. Commitments were established to make the B charging pump available within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

It is estimated that the auxiliary building could be restored to ambient conditions and the spare power cable for the charging pump could be installed in less than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. While a source of charging is expected to be available (i.e., charging pump 1A-bus 14), the spare cable, routed from bus 16 to the charging pump motor VFDs, provides the credited inventory control function. The NRC found the proposed method of achieving safe shutdown and the proposed actions to counter the effects of the postulated pipe breaks in the auxiliary building to be acceptable (Reference 17). The qualification of the charging pump and power supply breakers at bus 16 eliminated the need for the spare breakers referred to in Reference 17.

3.6.2.5.2 Main Steam Safety and Relief Valves 3.6.2.5.2.1 Pipe Failures in the Intermediate Building Postulated main feedwater line breaks in the intermediate building could result in jet impingement on the main steam safety and relief valves. The jet from a crack in the B main feedwater line (upstream of the check valve) could impinge on the A main steam safety valves and atmospheric relief valves such that the valves inadvertently open. The opening of these valves would be roughly equivalent to a 1-ft2 steam line break size, which is within the spectrum of steam line breaks analyzed in UFSAR Section 15.1.5.

The A main feedwater line would be isolated to limit the blowdown and the standby auxiliary feedwater system would be actuated to provide feedwater to the B steam generator. The check valve would prevent the flow from being diverted out the cracked portion of the feedwater line. All necessary equipment to mitigate the event and reach safe shutdown is outside the intermediate building and thus would be unaffected by either the feedwater line failure or the steam blowdown. The cooldown could be controlled by operation of the steam safety or relief valves on the (unaffected) B main steam line.

Another consideration was a postulated crack in the A main feedwater line in the Intermediate Building. It is possible but not likely for the resulting jet to impinge on the safety valves and relief valves for both the A and B steam lines. The A steam line is closer to the A feedwater line than is the B steam line and thus could provide some shielding of the jet from the feedwater line crack. The nearest steam relief component associated with the B steam line is approximately 60 feet from the A feedwater line. At this distance the jet pressure from the feedwater line based on a 10-degree half angle of expansion for the jet is approximately 0.14 psi. This jet pressure is not sufficient to cause a break in the 6" inlet pipes to the B steam line safety and relief valves. Therefore, the potential damage to the main steam line from a crack in the A main feedwater line would be limited to the A steam line safety and relief valve components. If as a bounding assumption, all of the A steam line safety and relief valves are assumed to experience a Page 175 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS complete severance of their 6" inlet pipes, the resulting main steam header break area would be approximately 1 ft2. Since this break area is within the spectrum of steam line breaks analyzed in the UFSAR Section 15.1.5, the consequences of this break are bounded by the results discussed in UFSAR Section 15.1.5. Since steam breaks in the B steam line header are not expected for this scenario, long term cooling of the RCS can be performed by using the B steam generator. As with a postulated crack in the B main feedwater line all the necessary equipment to mitigate the event and reach safe shutdown is located outside of the Intermediate Building and thus would be unaffected by either the feedwater line break or the steam blowdown.

3.6.2.5.2.2 Pipe Failures in the Turbine Building Rupture of a main steam or main feedwater line in the turbine building could lead to building pressurization in excess of the capacity of the block wall between the turbine and intermediate buildings. Failure of the wall could result in blocks falling on nearby equipment and piping in the intermediate building. The blocks could potentially cause a loss of integrity of the main steam safety and relief valves. Damage to the main steam safety and relief valves would not prevent safe shutdown, as long as the main steam isolation valves remained operable, and auxiliary feedwater flow could be maintained to the steam generators. In such an event, the total break area would be approximately 2 ft2, which is substantially smaller than the design-basis steam line break area of 4.37 ft2. Thus, reactor coolant system pressure, temperature, and reactivity responses would be enveloped. Auxiliary feedwater would be provided by the standby auxiliary feedwater system (operator action time of 14.5 minutes is assumed). Other emergency functions, such as safety injection system actuation, would be unaffected by damage to the intermediate building. Auxiliary feedwater injection, with relief through the openings in the steam lines, would continue until the residual heat removal system could be placed into operation, at which time normal cooldown to MODE 5 (Cold Shutdown) could commence.

In order to ensure safe shutdown capability in the event of the block wall failure in the intermediate building, RG&E has performed the necessary analyses and modifications in conjunction with the Ginna Station Structural Upgrade Program to:

a. Ensure that the main steam lines and feedwater lines would not lose their structural integrity.

b. Protect the main steam isolation valves and accessories, as needed, to ensure operation.

c. Protect the normal motor-driven and turbine-driven auxiliary feedwater connections to the main feedwater lines, up to and including the check valves. This will ensure that standby auxiliary feedwater, which connects to the feedwater lines inside containment, would be routed to the steam generators.

As part of the Steam Generator Replacement Project, a flow venturi was installed in the main steam outlet nozzle for each steam generator. The flow venturis were sized with a flow area of 1.4 ft2. This decreases the maximum credible design basis steam line break from 4.37 ft2 assumed during SEP to 1.4 ft2. This break size is smaller than the 2.0 ft2 break conservatively assumed during the SEP review to assess the impact of the failure of the Intermediate Building Page 176 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS masonry block walls following a steam line break in the Turbine Building.

Based on a review of the physical arrangement of equipment and piping in the Intermediate Building and an engineering assessment of the consequences of a block wall failure, the failure of the masonry block walls would not develop sufficient force to cause complete severance of the 6" schedule 80 carbon steel piping between the 30" main steam lines and the main steam safety valves and the atmospheric relief valves. Consequently, the 2 ft2 steam line break scenario assumed during the SEP review is overly conservative. A less conservative but still bounding scenario of the consequences of the block wall failure is the complete severance of all main steam piping connections 3" and smaller in both 30" main steam headers. This scenario would result in a 12" Turbine Building steam line break (1.1ft2) as the initiating event; and, a subsequent 0.2 ft2 Intermediate Building steam line break in each of the 30" main steam headers. The total break area would be 1.1 ft2. The consequences of this steam line break scenario have been analyzed consistent with the assumptions used for steam line breaks as discussed in UFSAR Section 15.1.5; and, the RCS response for this break scenario are bounded by the UFSAR Section 15.1.5 design basis steam line break.

3.6.2.5.2.3 Decay Heat Removal Following Blowdown from Both Steam Generators As discussed above, postulated breaks in the turbine or intermediate buildings could, in the worst case, result in opening steam safety and relief valves on both main steam lines. The rate of emptying of the steam generator would depend on how many valves open, plant initial conditions, and availability of the preferred auxiliary feedwater system.

It is possible that the steam generators could be emptied in this event. In order to depressurize and cool the primary system sufficiently to permit operation of the residual heat removal system, decay heat removal through the steam generators must be reestablished.

The effect of adding auxiliary feedwater to a hot, dry steam generator has been considered.

Rochester Gas and Electric presented results that showed that with 40 cycles of such feedwater addition, the usage factor on the tubes is still very low (Reference 23). This analysis provides assurance that the primary-secondary boundary will be maintained. The replacement steam generators (RSGs) were also evaluated for a limited number of cycles of cold main feedwater or auxiliary feedwater into a hot, dry steam generator (Reference 30).

This evaluation demonstrated that the stresses in the vessel as a result of this transient remained lower than ASME Code Service Level D allowables. This evaluation did not address the tubing since the replacement steam generator (RSG) lattice grids preclude denting and subsequent locking at the supports and therefore do not impose a large axial restraint force on the tubes.

Should the preferred auxiliary feedwater system be unavailable due to the break effects (steam environment in the intermediate building), the standby auxiliary feedwater system would be manually actuated. Should the steam generator become ineffective as a heat sink, the capability exists to establish feed and bleed through the reactor coolant system for decay heat removal. The Westinghouse Owners Group Emergency Response Guidelines, approved by the NRC in Reference 24, provide for such a contingency. As part of the Three Mile Island Page 177 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Action Plan, NUREG 0737, Task I.C.1, the Ginna Station emergency procedures were modified in accordance with these guidelines.

3.6.2.5.2.4 Conclusions The NRC has concluded that RG&E has demonstrated that given a postulated pipe failure in the intermediate or turbine building that damages main steam relief and/or safety valves, the consequences can be mitigated and a safe shutdown condition can be attained and that jet impingement shielding or protection from the effects of block wall failure for these components is not required (Reference 25) (SEP Topic III-5.B).

Page 178 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS REFERENCES FOR SECTION 3.6

1. Letter from A. Giambusso, AEC, to E. J. Nelson, RG&E,

Subject:

Postulated Pipe Rupture Outside Containment, dated December 18, 1972.

2. Letter from F. V. Miraglia, Jr., NRC, to All Operating Licensees, Construction Permit Holders, and Applicants for Construction Permits,

Subject:

Relaxation in Arbitrary Intermediate Pipe Rupture Requirements (Generic Letter 87-11), dated June 19, 1987.

3. Letter from L. D. White, Jr., RG&E, to D. L. Ziemann, NRC,

Subject:

SEP Topic III-5.A, dated September 12, 1979.

4. Letter from D. G. Eisenhut, NRC, L. D. White, Jr., RG&E,

Subject:

Pipe Breaks Inside Containment, dated September 7, 1978.

5. Letter from L. D. White, Jr., RG&E, to D. L. Ziemann, NRC,

Subject:

SEP Topic III-5.A, High Energy Line Breaks Inside Containment, dated February 9, 1979.

6. Letter from L. D. White, Jr., RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic III-5.A, Effects of Pipe Break on Structures, Systems, and Components Inside Containment, dated October 1, 1981.

7. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic III-5.A, High Energy Line Breaks Inside Containment, dated March 16, 1983.

8. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

SEP Topic III-5.A, High-Energy Line Breaks Inside Containment, dated April 22, 1983.

9. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

IPSAR Section 4.13, Effects of Pipe Break on Structures, Systems, and Components Inside Containment for the R. E. Ginna Nuclear Power Plant, dated June 28, 1983.

10. J. D. Stevenson, et al., Structural Analysis and Design of Nuclear Plant Facilities, ASCE, 1980, Sections 4.7 and 6.4.1.

11. Letter from D. G. Eisenhut, NRC, to R. W. Kober, RG&E,

Subject:

Safety Evaluation of Westinghouse Topical Reports Dealing with Elimination of Postulated Pipe Breaks in PWR Primary Main Loops (Generic Letter 84-04), dated February 1, 1984.

12. Letter from R. W. Kober, RG&E, to W. A. Paulson, NRC,

Subject:

Generic Issue A-2, Elimination of Postulated Pipe Breaks, R. E. Ginna Nuclear Power Plant, dated October 17, 1984.

13. Letter from D. DiIanni, NRC, To R. W. Kober, RG&E,

Subject:

Asymmetric Blowdown Loads, dated September 9, 1986.

14. Letter from K. W. Amish, RG&E, to A. Giambusso, AEC,

Subject:

Effects of Postulated Pipe Breaks Outside of Containment Building, dated November 1, 1973.

Page 179 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

15. Letter from L. D. White, Jr., RG&E, to D. L. Ziemann, NRC,

Subject:

High Energy Line Breaks Outside Containment, dated June 27, 1979.

16. Letter from R. A. Purple, NRC, to L. D. White, Jr., RG&E,

Subject:

Amendment No. 7 to Provisional Operating License No. DPR-18 for the R. E. Ginna Nuclear Power Plant, dated May 14, 1975.

17. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Integrated Plant Safety Assessment Report Section 4.14, Pipe Break Outside Containment, R. E. Ginna Nuclear Power Plant, dated April 21, 1983.

18. Letter from L. D. White, Jr., RG&E, to D. L. Ziemann, NRC,

Subject:

Pressure Shielding Steel Diaphragm, R. E. Ginna, dated May 17, 1979.

19. J. A. Redfield, J. H. Murphy, and V. C. Davis, FLASH-2: A Fortran IV Program for the Digital Simulation of a Multinode Reactor Plant During Loss of Coolant, WAPD TM-666, April 1967.

20. T. A. Porsching, J. H. Murphy, J. A. Redfield, and V. C. Davis, FLASH-4: A Full Implicit Fortran IV Program for the Digital Simulation of Transients in a Reactor Plant, WAPD TM-840, March 1969.

21. R. G. Gido, C. I. Grimes, R. G. Lawton, and J. A. Kudrick, COMPARE: A Computer Program for the Transient Calculation of a System of Volumes Connected by Flowing Vents, LA-NUREG 6488-MS, September 1976.

22. Letter from D. L. Ziemann, NRC, to L. D. White, Jr., RG&E,

Subject:

Amendment No.

29 to License No. DRP-18, dated August 24, 1979.

23. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

Steam Generator Sleeving, dated May 24, 1983.

24. Letter from D. G. Eisenhut, NRC, to All Operating Reactor Licensees, Applicants for an Operating License, and Holders of Construction Permits for Westinghouse Pressurized Water Reactors,

Subject:

Safety Evaluation of Emergency Response Guidelines (Generic Letter 83-22), dated June 3, 1983.

25. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Integrated Plant Safety Assessment Report, Section 3.3.1.1, Pipe Break Outside Containment, R. E.

Ginna Nuclear Power Plant, August 16, 1983.

26. W. A. Massie and M. J. Harper, Piping Stress Analysis Report, SDTAR-80-05-12, Revision 1, Steam Generator Blowdown System, Section 200, Westinghouse Electric Corporation, Nuclear Technology Division, March 1981.

27. Letter from R. C. Mecredy, RG&E, to G. S. Vissing, NRC,

Subject:

Rochester Gas &

Electric Corporations 50-244/97-201-03 Inspection Report, dated November 11, 1997.

Page 180 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

28. Structural Integrity Associates, Inc. Report SIR-97-077, Leak-Before-Break Evaluation of Portions of the Residual Heat Removal (RHR) System at R. E. Ginna Nuclear Power Station, dated August 1997.

29. Letter from G. S. Vissing, NRC, to R. C. Mecredy, RG&E,

Subject:

Staff Review of the Submittal by Rochester Gas and Electric Company to Apply Leak-Before-Break Status to Portions of the R. E. Ginna Nuclear Power Plant Residual Heat Removal System Piping (TAC No. MA0389), dated February 25, 1999.

30. Babcock & Wilcox International, BWI Report No. 222-7705-LR-02, Revision 0, dated January 1996.

31. Letter from Ginna Station to NRC, "Fracture Mechanics Analysis per GDC-4,"

dated September 30, 2004.

32. Letter from Ginna Station to NRC, "Application of 10CFR50.90 Process for Use of Fracture Mechanics Analysis per GDC-4," dated May 28, 2005.

33. Amendment No. 32, letter from NRC to Ginna Station, "Amendment Re:

Application of Leak-Before-Break Methodology for Pressurizer Surge Line and Accumulator Lines," dated September 22, 2005.

34. Letter, NRC to Ginna Station, "Request for Additional Information (RAI) Regarding R.E. Ginna Nuclear Power Plant Fracture Mechanics Analysis," May 2, 2005.

35. Letter from R.C. Mecredy, RG&E, to Guy S. Vissing, NRC, "Response to Request for Additional Information (RAI) Relating to Leak-Before-Break (TAC No.

MA0389)," dated August 6, 1998.

36. NUS Report NUS-5302, "Pipe Stress Analysis of the Steam Generator Blowdown Piping from Steam Generator 1A to Containment Penetration 321 (SGB-100),"

Revision 0.

37. Robicon, Robicon W-Series W120 and W120CP Enclosed Drives with Advanced Operator Panel 1.0 Hp to 200 Hp, Edition 03/2011.

Page 181 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.6-1 LINES PENETRATING CONTAINMENT WHICH NORMALLY OR OCCASIONALLY EXPERIENCE HIGH-ENERGY SERVICE CONDITIONS Normal Maximum Operating Conditions Penetration Number Line Size (in.) Designation Pressure (psi) Temperature ( F) Remarks 120 1 Accumulator N2 700 a Vented during normal operation.

102 2 Charging 2250 a No jet or whip upstream of check valve (alternate)b 383A; consider only line between reactor coolant pressure boundary and valve 383A.

140 10 Residual heat removal, out b 360 350 Consider only reactor coolant pressure boundary to valve 700; see SRP 3.6-1.

108 3 Reactor coolant pump seal < 100 200 Normally operated < 200o F, alarmed at water, out 190o F.

106 2 Reactor coolant pump seal 2250 a water, in b 110 2 Reactor coolant pump seal 2250 a water, in b 110 3/4 Accumulator test 1500 a Normally depressurized during test.

112 2 Letdown b 600 380 Higher pressure and temperature upstream of orifices and regenerative heat exchanger.

100 2 Charging b 2250 a Higher temperature downstream of regenerative heat exchanger.

206 3/8 Sample, pressurizer liquid 2250 650 Eliminate because of size.

206 3/8 Sample, steam generator 1000 550 Eliminate because of size Page 182 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Normal Maximum Operating Conditions Penetration Number Line Size (in.) Designation Pressure (psi) Temperature ( F) Remarks 205 3/8 Sample, reactor coolant hot leg 2250 650 Eliminate because of size system 207 3/8 Sample, pressurizer steam 2250 650 Eliminate because of size.

207 3/8 Sample, steam generator 1000 550 Eliminate because of size.

301 2 Unit heater steam 150 340 Decommissioned and welded shut in 1995.

303 1 Unit heater steam 150 340 Decommissioned and welded shut in 1995.

322 2 Steam generator blowdown b 1000 550 321 2 Steam generator blowdown b 1000 550 401 30 Main steamb 1000 550 402 30 Main steam b 1000 550 403 14 Feedwater b 1000 435 404 14 Feedwater b 1000 435 111 10 Residual heat removal, in b 360 350 Consider only reactor coolant pressure boundary to valve 721; see SRP 3.6-1.

119 and 120 3 Standby auxiliary feed b 1000 435 Consider only main feedwater line to check valves 9705A and B.

a. Indicates normal maximum temperature is less than 200 F.

b. Indicates those lines to be considered for potential high-energy line breaks.

Page 183 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.6-2 LINES INSIDE CONTAINMENT BUT NOT PENETRATING CONTAINMENT WHICH NORMALLY OR OCCASIONALLY EXPERIENCE HIGH-ENERGY SERVICE CONDITIONS Normal Maximum Conditions Line Designation Size (in.) System Pressure (psi) Temperature (F) Remarks Primary system --- Reactor coolanta 2250 600 Consider safety injection branch lines between reactor coolant pressure boundary and the first check valves.

Accumulator and branch --- Safety injection 700 b Consider 2-in. branch lines to reactor linesc coolant drain tank only up to valves 844A and B.

Auxiliary sprayc 2 Chemical volume 2250 350 and control Pressurizer surgec 10 Reactor coolant 2250 650 Pressurizer spray 3 Reactor coolant 2250 650 Pressurizer deadweight 1/8 Reactor coolant 2250 650 Eliminate because of size.

Tester tube flange leakoff 3/8-3/4 Reactor coolant 2250 600 Eliminate because of size.

Excess letdown 3/4 Reactor coolant 2250 600 Eliminate because of size.

Reactor overpressure 1 Reactor 800 b Eliminate because of size.

protection N2 lines overpressurization Pressurizer safety 4 Reactor coolant 2250 600 Consider only lines from pressurizer to valves 433 and 434.

Pressurizer relief 3 Reactor coolant 2250 600 Consider only lines from pressurizer to valves 430 and 431C.

a. Reactor coolant system piping breaks are being evaluated under NRC Task Action Plan A-2.

b. Indicates normal maximum temperature is less than 200 F.

c. Indicates those lines to be considered for potential high-energy line breaks.

Page 184 of 769 Revision 28 5/2019

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.6-3 CONTAINMENT PIPE DATA Pipe Line Size Schedule Section Affected Portion of System (in.) Modulus Safety injection 4 80 4.27 Penetration to T feeding hot and cold legs.

Safety injection 2 80 0.73 T to motor-operated valves 878A, B, C, and D.

Safety injection 2 160 0.98 Motor-operated valves 878A, B, C, and D to reactor coolant system or accumulator lines.

Low-pressure 10 40 29.90 Penetration to nozzle branch lines.

safety injection Low-pressure 6 40 8.50 Branch lines to motor-operated safety injection valves 852A and B.

Low-pressure 6 160 20.03 Motor-operated valves 852A and B safety injection to reducer.

Low-pressure safety injection 4 160 5.90 Reducer to nozzle.

Containment 6 40 8.50 All piping except spray rings.

spray Containment 4 40 3.21 Spray rings.

spray Containment 3 40 1.72 Spray rings.

spray Revision 28 5/2019 Page 185 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Pipe Line Size Schedule Section Affected Portion of System (in.) Modulus Seal water 8 40 16.81 All piping except connections to coolers.

Letdown 2 160 0.98 Reactor coolant system to valves 200A and B and 202.

Letdown 2 80 0.73 Downstream from valves 200A and B and 202.

Steam 2 80 0.73 All.

generator blowdown Main steam 30 80 >700 All.

Feedwater 14 100 118 All.

Reactor coolant 3 160 2.88 All.

Revision 28 5/2019 Page 186 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7 SEISMIC DESIGN 3.7.1 SEISMIC INPUT 3.7.1.1 Introduction 3.7.1.1.1 Original Seismic Classification Structures, systems, equipment, and components related to plant safety are required to withstand the design-basis earthquake. These structures, systems, and components are placed in the applicable seismic category depending on their function. The original classifications of all components, systems, and structures of Ginna Station for the purpose of seismic design were Class I, Class II, or Class III as recommended in:

1. TID 7024, Nuclear Reactors and Earthquakes, August 1963.

2. G. W. Housner, "Design of Nuclear Power Reactors Against Earthquakes," Proceedings of the Second World Conference on Earthquake Engineering, Volume I, Japan, 1960, pages 133, 134, and 137.

Class I Those structures and components including instruments and controls whose failure might cause or increase the severity of a loss-of-coolant accident or result in an uncontrolled release of excessive amounts of radioactivity. Also, those structures and components vital to safe shutdown and isolation of the reactor.

Class II Those structures and components which are important to reactor operation but not essential to safe shutdown and isolation of the reactor and whose failure could not result in the release of substantial amounts of radioactivity.

Class III Those structures and components which are not related to reactor operation or containment.

All components, systems, and structures classified as Class I were designed in accordance with the following criteria:

A. Primary steady-state stresses, when combined with the seismic stress resulting from the response to a ground acceleration of 0.08g acting in the vertical and horizontal planes simultaneously, are maintained within the allowable working stress limits accepted as good practice and, where applicable, set forth in the appropriate design standards, e.g., ASME Boiler and Pressure Vessel Code, USAS B31.1 Code for Pressure Piping, ACI 318 Building Code Requirements for Reinforced Concrete, and AISC Specifications for the Design and Erection of Structural Steel for Buildings.

B. Primary steady-state stresses when combined with the seismic stress resulting from the response to a ground acceleration of 0.20g acting in the vertical and horizontal planes Revision 28 5/2019 Page 187 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS simultaneously, are limited so that the function of the component, system, or structure shall not be impaired as to prevent a safe and orderly shutdown of the plant.

All Class II components were designed on the basis of a static analysis for a ground acceleration of 0.08g acting in the vertical and horizontal directions simultaneously. For Ginna Station, there were no Class II structures.

The structural design of all Class III structures met the requirements of the applicable building code which was the State Building Construction Code of the State of New York, 1961. This code did not reference the Uniform Building Code.

3.7.1.1.2 Seismic Reevaluation 3.7.1.1.2.1 Scope of Reevaluation The NRC conducted a seismic reevaluation of Ginna Station commencing in 1979 as part of the Systematic Evaluation Program (SEP). The reevaluation was conducted by the Lawrence Livermore National Laboratory for the NRC. The scope of the reevaluation was limited to identifying safety issues and to providing an integrated, balanced approach to backfit considerations in accordance with 10 CFR 50.109, which specifies that backfitting will be required only if substantial additional protection can be demonstrated for the public health and safety. The seismic reevaluation centered on the following:

a. An assessment of the integrity of the reactor coolant pressure boundary; i.e., major components that contain coolant for the core and piping or any component not isolable (usually by a double valve) from the core.

b. A general evaluation of the capability of essential structures, systems, and components to shut down the reactor safely and maintain it in a safe shutdown condition, including removal of residual heat, during and after a postulated safe shutdown earthquake. The assessment of this subgroup of equipment can be used to infer the capability of such other safety-related systems as the Emergency Core Cooling System (ECCS).

3.7.1.1.2.2 Reevaluation Criteria Rochester Gas and Electric Corporation (RG&E) supplied a list of mechanical and electrical equipment necessary to ensure the integrity of the reactor coolant pressure boundary and to safely shut down the reactor and maintain it in a safe shutdown condition during and after a postulated seismic event. Rochester Gas and Electric Corporation also listed the criteria that it considered appropriate for evaluating the seismic classification of Ginna Station structures, systems, and components (Reference 1). The criteria reflected plant-specific requirements, not the more general light-water reactor standards currently in effect. They were as follows:

A. Seismic classification will be restricted to those structures, systems, and components required for safe shutdown, and to maintain reactor coolant pressure boundary integrity, and to prevent other design-basis accidents which could potentially result in offsite exposures comparable to the guideline exposures of 10 CFR 100. These latter systems and components include, for example, the steam, feed-water, and blowdown piping up to the first isolation valve, and the spent fuel pool (SFP), including fuel racks. Also included are Revision 28 5/2019 Page 188 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS all structures, systems, and components not required to function, but whose failure could irreversibly prevent the functioning of required safe shutdown equipment or cause a design-basis accident. Seismic design of these items will ensure a very low probability of failure in the event of a safe shutdown earthquake.

System boundaries, for purposes of seismic reevaluation will be considered to terminate at the first normally closed, auto-close, or remote-manual valve in connected piping.

B. Safe shutdown is defined as the capability to control residual heat removal under all plant conditions resulting from a seismic event (with the consequential loss of function of non-seismic equipment) and a loss of offsite power. Safe shutdown may be the maintenance of an extended MODE 3 (Hot Shutdown) condition, or a gradual cooldown to MODE 5 (Cold Shutdown) conditions. For Ginna Station, safe shutdown assumes gradual cooldown and depressurization in the event of a safe shut-down earthquake.

The safe shutdown earthquake was the only earthquake level considered in the reevaluation because it represents the limiting seismic loading to which the plant must respond safely.

Because a plant designed to shut down safely following a safe shutdown earthquake will be safe for a lesser earthquake, investigation of the effects of the operating-basis earthquake was deemed unnecessary.

In 1979, RG&E commenced a seismic piping upgrade program for Ginna Station to upgrade the seismic design of certain piping systems to current industry standards for Seismic Category I.

3.7.1.2 Design Response Spectra The Ginna Station was originally designed for an operating-basis earthquake characterized by a peak horizontal ground acceleration of 0.08g and for a safe shutdown earthquake with a peak horizontal ground motion of 0.2g. Peak horizontal and vertical accelerations were assumed to be the same. The response spectra used were those developed by Housner (Reference 2) and are shown in Figures 3.7-1 and 3.7-2. The site seismology is described in Section 2.5.2.

For the SEP reevaluation a safe shutdown earthquake with a peak horizontal ground motion of 0.2g was used. Two-thirds of that value was used for the vertical component. The response spectra used was that given in Regulatory Guide 1.60. It is noted that the site-specific ground response spectra (Figure 3.7-3), recommended by the NRC (Reference 3) for SEP evaluation of the seismic design adequacy of Ginna Station, indicates a peak horizontal ground motion acceleration of 0.17g, less than the 0.2g value used.

3.7.1.3 Design Time-History In the design of Ginna Station the seismic accelerations were computed as outlined in TID 7024 (Reference 4) and the Portland Cement publication (Reference 5). Response spectra developed by Housner (Reference 2) were used as described in Section 3.7.1.2.

During the SEP reevaluation, a time-history method was used to generate in-structure response spectra for the interior structures. Only horizontal excitations were included in the analysis. The input base excitation was a synthetic time-history acceleration record for which Revision 28 5/2019 Page 189 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS the corresponding response spectra were compatible with the 0.2g Regulatory Guide 1.60 spectra. Response spectra associated with two orthogonal horizontal base excitations were generated independently at equipment locations and then combined by the square root of the sum of the squares method. Peaks of the spectra were broadened 15% in accordance with current practice.

3.7.1.4 Critical Damping Values Table 3.7-1 lists the damping values used for the original Ginna Station seismic design together with those from Regulatory Guide 1.61 for the safe shutdown earthquake and those values recommended in NUREG/CR-0098 (Reference 6) for structures at or below the yield point. The damping values used in the original design of Ginna Station are lower than current design levels. One reason is that the design damping values were used for the operating-basis earthquake, and the design loads were increased for the safe shutdown earthquake evaluation in direct proportion to the ratio of the two values of Amax (0.08g and 0.2g). Because higher response and, consequently, increased damping are expected for the safe shutdown earthquake, a significant degree of conservatism was typically introduced over current practice.

A comparison of the response spectrum developed by Housner for 2% damping with the 7%

spectrum from Regulatory Guide 1.60 indicates the relative magnitudes of the response of bolted steel structures and equipment designed to Ginna versus current criteria. Similarly, the 0.5% spectrum for the original design and the 3% spectrum from Regulatory Guide 1.60 may be used to compare expected levels of response for base-level-mounted large piping for the two criteria. Figure 3.7-4 shows these comparisons. Similarly, expected levels of response for base-level-mounted large piping for the two criteria can be made by comparing the 0.5%

Housner spectrum and the 3% Regulatory Guide 1.60 spectrum.

The NUREG/CR-0098 damping values are those recommended for the SEP reevaluation.

The reason for permitting higher damping values is discussed in Reference 6. Although there are limited data on which to base damping values, it is known that the Regulatory Guide 1.61 values are conservative to ensure that adequate dynamic response values are obtained for design purposes. The lower values in the NUREG/CR-0098 column of values in Table 3.7-1 in most cases are close to the Regulatory Guide 1.61 values. The upper values in the NUREG/CR-0098 column are best-estimate values believed to be average or slightly above average values; these values are recommended for use in design or evaluation for stresses at or near yield, and when moderately conservative estimates are made of the other parameters entering into the design or evaluation.

3.7.1.5 Supporting Media for Seismic Category I Structures All Ginna Station Seismic Category I buildings except the control building and diesel generator building are founded on solid bedrock. The foundations of the control and diesel generator buildings were excavated to the surface of bedrock. Lean concrete or compacted backfill was placed on the rock surface to a depth whereby the elevation of the top of the fill material was coincident with the elevation of the bottom of the concrete foundation of that particular building. Thus, all Seismic Category I buildings have rigid foundations. The turbine building foundation is a concrete mat supported by compacted fill material. See Section 3.8.5.

Revision 28 5/2019 Page 190 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.2 SEISMIC SYSTEM ANALYSIS 3.7.2.1 Seismic Analysis Methods 3.7.2.1.1 Original Seismic Analysis The following method of analysis was applied to the original seismic Class I structures and components, including instrumentation in the original Ginna Station design:

A. The natural periods of vibration of the structure or component were determined.

B. The response acceleration of the component to the seismic motion was taken from the response spectrum curve at the appropriate period.

C. Stresses and deflections resulting from the combined influence of normal loads and the seismic load due to the 0.08g earthquake were calculated and checked against the limits imposed by the design standard.

D. Stresses and deflections resulting from the combined influence of normal loads and the seismic loads due to the 0.2g earthquake were calculated and checked to verify that deflections did not cause loss of function and that stresses did not produce rupture.

The maximum response acceleration of a structure or equipment item was read from the response spectrum for selected values of damping and a fundamental natural frequency. The frequency was either

• Calculated from a mathematical model,

• Measured from a plastic model (the case of the reactor coolant system),

• Estimated by experience, or

• Selected to be conservative (the peak of the spectrum was used).

From the mass of the structure or equipment and the maximum response acceleration, the equivalent static force was obtained. The equivalent static force, which represents the total dynamic effect, was then distributed along the system according to a selected shape (an inverted triangle for the containment) or according to the mass distribution. The static response to this equivalent static force was taken to be the seismic response of the system.

Responses to horizontal and vertical ground accelerations were calculated separately, then combined by direct addition in most cases.

The containment and the residual heat removal system pipe line from the reactor coolant system loop to containment were analyzed by both the equivalent static and the response spectrum methods.

The seismic Class I piping systems were analyzed by a lumped mass approach. The number of masses lumped between any two supports was based upon the spacing interval and increases with the length of the spacing interval. Every mass was given an acceleration equal to the maximum response from the response curve with 0.5% of critical damping, i.e., 0.8g for 0.2g ground acceleration. Each piping system with its supports was modeled as a three-dimensional frame and the loads given by the mass times the acceleration were applied at each lumped mass along three directions, two horizontal and one vertical, separately. The Revision 28 5/2019 Page 191 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS moments and torque for each of the three loading directions were then obtained by stiffness analysis. The stresses were calculated at critical points in the piping and its supports for each loading direction. The stresses in the piping were found by using the USAS B31.1 formula (Equation 3.7-1) where: S= stress MX, MY, MZ =moments about the two horizontal directions and the vertical direction Z= section modulus At each point the stresses obtained for the two horizontal loadings were conservatively combined by the square root of the sum of the squares. This value was then conservatively combined with the stress obtained for the vertical loading by direct addition.

3.7.2.1.2 Seismic Reevaluation The seismic analysis methods changed greatly from the time of the design of Ginna Station to the SEP reevaluation. The original seismic analysis was primarily by the equivalent static method based on an estimated fundamental frequency of the structure. Response spectra were used primarily to predict the peak acceleration of the fundamental mode. The check of the static design analysis of the containment building was the only analysis that involved a multi-mode system.

Current analytical techniques and computer models at the time of the SEP reevaluation had increased considerably the sophistication and level of detail that could be treated. A complete dynamic analysis of complicated structural systems such as the interconnected building complex could be done conveniently and inexpensively.

For the SEP reevaluation, seismic analysis of the building complex was performed by the finite element method using the computer program SAP4.7 A three-dimensional mathematical model of the building complex was developed. The frequencies and mode shapes of the structural system were obtained from the computer analysis. After the frequencies and mode shapes were obtained, the structural responses were computed by the response spectrum method. The seismic input was defined by the horizontal spectral curve of the safe shutdown earthquake specified in Regulatory Guide 1.60 for 10% structural damping and 0.2g peak ground acceleration.

Two structural models were analyzed, one with half the bracing area (half-area model), one with the full bracing area (full-area model). For each model, two analyses were performed, one with the input excitation in the north-south direction, the other in the east-west direction.

The current licensing requirements would typically require load combinations different from those considered when Ginna Station was designed. The seismic reevaluation concentrated Revision 28 5/2019 Page 192 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS on the original design combinations with primary attention devoted to the seismic margins.

Other current assumptions and criteria are discussed in the following sections in comparison with those used in the design and analysis of Ginna Station.

3.7.2.2 Natural Frequencies and Response Loads The frequencies and the ten largest modal participation factors of the full-area and half-area models are listed in Table 3.7-2. The modes with low frequencies were those dominated by steel parts of the structural system (i.e., the framing system) and the high-frequency modes were dominated by the concrete structures (i.e., the control building and the basement structures of the auxiliary building). Since several high frequency modes had significant modal participation factors, they were included in the dynamic analysis especially in computing the in-structure response spectra.

3.7.2.3 Procedure Used for Mathematical Modeling A three-dimensional mathematical model for the building complex was prepared for the computer program SAP4 (Reference 7). All steel frames were modeled by beam elements.

The models rigid diaphragms for all roofs and floors were represented by the rigid restraint.

The two-story concrete substructure of the auxiliary building and the control building were modeled by equivalent beams. The four shear walls of the diesel-generator building were represented by four elastic springs attached to the north frame of the turbine building at the diesel-generator building roof. The masses of the service building roof were lumped to the turbine and intermediate buildings. All other masses were lumped to the centers of gravity of floors or roofs.

3.7.2.4 Soil-Structure Interaction Soil-structure interaction was not considered in the design of Ginna Station. Sophisticated methods of treating soil-structure interaction exist; however, for structures that are founded on competent rock, as is Ginna Station, the effects of soil-structure interaction are considered relatively small. There is little radiation damping, and consideration of rock foundation compliance results in only slight increases in the periods of response of a structure when compared with the fixed-base case. It was expected that any variation in load that results from neglecting soil-structure interaction would be well within the accuracy of the calculations.

This would be especially true for the containment structure, in which the walls are attached to the foundation rock by rock anchors. Therefore, soil-structure interaction was not taken into account in the seismic reevaluation.

3.7.2.5 Development of Floor Response Spectra A direct method was applied to generate seismic input spectra for equipment at various locations in the structure (References 8 and 9). The method treated the earthquake input motions and the response motions as random processes. The response spectrum at any location in the structure was derived from the frequency response function of an oscillator, the frequency response function of the structure at that location, and the input ground response spectrum. This method avoided the troublesome task in the time-history approach of selecting the proper corresponding time-history input for the specified spectrum. The in-structure spectra generated from the half-area and full-area models were enveloped to give Revision 28 5/2019 Page 193 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS the final spectra (Figure 3.7-5). If peaks were still obvious at structural frequencies, spectrum-widening techniques in accordance with current practice were then applied to ensure 15% broadening to account for modeling and material uncertainties.

3.7.2.6 Combination of Earthquake Directional Components The original design of Ginna Station structures involved the combination of a vertical and horizontal load, usually on an absolute basis. Current recommended practice is to combine the responses for the three principal simultaneous earthquake directions by the square root of the sum of the squares as described in Regulatory Guide 1.92. There is only a small difference between the two combination methods for circular plant structures like the containment building, which is the only structure for which a dynamic analysis was originally performed.

3.7.2.7 Combination of Modal Responses For the SEP evaluation a detailed dynamic analysis using the response spectrum method was performed. In each analysis (east-west and north-south direction), 44 response modes were used and the individual modal responses were combined by the square root of the sum of the squares method.

3.7.2.8 Interaction of Nonseismic Structures with Seismic Category I Structures A complex of interconnected buildings surrounds the containment building. Though contiguous, these buildings are independent of the containment building. The auxiliary, intermediate, control, and diesel-generator buildings are Seismic Category I structures, and the turbine and service buildings are nonseismic structures (see Figure 3.7-6). In the original analysis, each Class I structure was treated independently. For the SEP reevaluation the interconnected nature of the buildings was considered an important feature, especially in view of the lack of detailed original seismic design information. Therefore, both Class I and Class III buildings were included in the reanalysis model. Gilbert Associates, Inc., developed separate models for the auxiliary and control buildings in 1979. The basic assumptions and model properties for these two buildings were adopted and incorporated into the reanalysis.

The auxiliary, intermediate, turbine, control, diesel-generator, and service buildings form an interconnected U-shaped building complex that is mainly a steel frame structural system supported by concrete foundations or concrete basement structures. A typical steel frame is made of vertical continuous steel columns with horizontal beams and cross bracing. The connections are typically bolted. The braced frames serve as the major lateral load-resisting system. Several such steel frames connect various parts of different buildings, which makes the building complex a complicated three-dimensional structural system. The compositions and interrelationships of the buildings in the complex are described in Section 3.8.4.

The principal lateral force-resisting systems of the interconnected building complex are the braced frames. Several such systems tie all buildings together to act as one three-dimensional structural system. It was, therefore, necessary to model these buildings in a single three-dimensional model to properly simulate interaction effects. The results of the reevaluation are discussed in Section 3.8.4.

Revision 28 5/2019 Page 194 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.2.9 Use of Constant Vertical Static Factors Vertical responses in the SEP evaluation were obtained by taking 13% (0.2g 2/3) of the dead load responses.

3.7.3 SEISMIC SUBSYSTEM ANALYSIS 3.7.3.1 Seismic Analysis Methods 3.7.3.1.1 Original Design 3.7.3.1.1.1 Piping and Tanks Most of the original piping systems were analyzed by static methods, primarily the equivalent static method. Seismic input for these analyses were based on the Housner ground response spectra (Figures 3.7-1 and 3.7-2). Peak spectral accelerations were taken from the curves for those components for which the natural frequency was estimated. If natural frequencies were unknown, the maxima of the curves were used.

Exceptions to the static analysis approach included the analysis of

a. The residual heat removal system line from the reactor coolant system loop A to the containment penetration.

b. The main steam line from steam generator B to the containment penetration.

c. The reactor coolant system.

Two response spectrum analyses of the residual heat removal system line were performed.

One analysis used the response spectra in Figures 3.7-1 and 3.7-2 as input; the other used a response spectrum that was a modification of the 0.5% damping spectrum in these figures to account for building effects at the steam-line elevation.

Both static and dynamic analysis were performed on the main steam line of loop B inside the containment. The modified response spectrum used for the residual heat removal system line analysis was also used for this dynamic analysis.

The reactor coolant system was qualified by tests using a plastic model. Input was a sinusoidal wave for the vertical direction and each of the two horizontal directions, independently. The plastic model output (mode shapes and frequencies) was then used as input, along with the Housner spectrum, to a three-dimensional mathematical model of the primary coolant loop.

The piping lines of the safety injection system were analyzed by selecting the peak of the 0.5% critical damping response spectra corresponding to the 0.2g maximum potential earthquake. Concentrated forces at selected locations on the pipe line were applied with the force equal to the product of the concentrated lumped mass and the maximum acceleration from the response spectra. Combination of bending stress, Sb, and torsional stress, St, is made according to the USAS B31.1 formula, 2 t S = (S + 4 S 2)1/2.

b Revision 28 5/2019 Page 195 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The analysis of tanks was performed in the manner set forth in TID 7024, taking into account the possible dynamic effects resulting from the sloshing of the water. The techniques are set forth in Chapters 5 and 6 of TID 7024. Shell stresses and support stresses were limited to those permitted in the pressure vessel codes and the structural steel standards of AISC.

Selected tanks were subsequently reanalyzed as part of the SEP (see Section 3.9.2.2.4).

Seismic Class I components were qualified on an individual and often generic basis.

Qualification of the major equipment items (Reference 1), such as the steam generator, control rod drive mechanism, reactor internals, reactor vessel, and pressurizer, are summarized in the following.

3.7.3.1.1.2 Steam Generator The original series 44 steam generators were evaluated to a set of generic loads including seismic. The seismic loads were based on envelope horizontal response spectra for 1%

equipment damping shown on Figure 3.7-7 for the operating-basis and safe shutdown earthquakes. The generic curves were based on an envelope of floor response spectra of eleven plants with Westinghouse nuclear steam supply systems. The dynamic analyses are by the response spectrum method with the steam generator idealized by lumped masses inter-connected by three-dimensional beam elements (Figure 3.7-8). In 1996, the steam generators were replaced. See Section 5.4.2.3 for updated information.

3.7.3.1.1.3 Control Rod Drive Mechanisms There are 29 equivalent model L-106 control rod drive mechanisms attached to the reactor vessel head adapters for the plant which were installed by PCR 2001-0042 during the 2003 refueling outage. The original model L-106 seismic analysis of the mechanisms consisted of two phases. The first phase involved comparing the results of a computer analysis of the mechanism for internal pressure and thermal loads with the ASME Section III stress allowances. The results of the comparison were used to derive the allowable seismic bending moment for the mechanism. In the second part of the analysis, a lumped mass beam model of the control rod drive mechanism system was used to calculate the bending moments at various locations on the assembly resulting from seismic loading. These calculated bending moments were compared with the allowable seismic bending moment for the mechanism.

The seismic design basis used for the original drive mechanisms was 0.8g in both the horizontal and vertical directions. For these loads the bending moments throughout the mechanism were below the allowable bending moments. The results of the second phase of the analysis were used in the design and analysis of the control rod drive mechanism seismic support mechanism.

Equivalent L-106 control rod drives provided by PCR 2001-0042 are evaluated for seismic conditions in Reference 11.

3.7.3.1.1.4 Reactor Internals The Ginna reactor internals assembly is a standard 12-ft, two-loop assembly (Figure 3.9-9) that was qualified on a generic basis. The qualification analysis used a linear response spectra analysis with a lumped mass beam finite element model as shown on Figure 3.7-9. The input Revision 28 5/2019 Page 196 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS for the analysis was the response spectra for the Kansai plant as shown on Figure 3.7-10.

Two cases were considered in the analysis: first, where the modal contributions were combined by the square root of the sum of the squares and; second, where the modal contributions were summed by the absolute method. Two models were evaluated, one with horizontal and rotational stiffness representing the soil as shown on Figure 3.7-9 and the second model where a fixed base was assumed. In both cases, 5% damping was used for the concrete and 1% for the internals. In the vertical direction, a single degree of freedom model, uncoupled from the horizontal direction, was used. Stresses were obtained by adding horizontal and vertical responses absolutely.

3.7.3.1.1.5 Reactor Vessel Seismic analysis of the reactor vessel was performed by applying a steady-state acceleration to the piping and calculating the resulting nozzle reactions. Stress calculations for the following three cases were performed:

a. Design seismic plus thermal loads.

b. No loss of function seismic plus thermal loads.

c. Design seismic plus thermal plus interaction loads.

Accelerations of 0.08g and 0.2g were used for design (operating-basis) and no-loss-of-function (safe shutdown) earthquakes, respectively.

3.7.3.1.1.6 Pressurizer A stress report for the pressurizer was completed and issued in 1969. The report contained a seismic analysis of the pressurizer shell, the support skirt, the support skirt flange and the pressurizer support bolts. Loads for these evaluations were developed by combining the internal pressure, thermal loads, weight, upper head nozzle loads (i.e., spray, safety, and relief nozzles), and static seismic loads. The seismic analysis was conducted generically for the heaviest Westinghouse pressurizer model. Two cases were analyzed: an operating-basis earthquake and a safe shutdown earthquake. However, for both cases the safe shutdown earthquake acceleration of 0.48g horizontal and 0.32g vertical were used for evaluation. The accelerations were applied statically at the center of gravity of the pressurizer.

In 1973, a more detailed evaluation was performed of the pressurizer skirt and shell (Reference 10). For that evaluation the loads applied to the skirt were the equivalent of 10 times the operating-basis earthquake loads and 14 times the safe shutdown earthquake loads outlined above. The results contained only the primary membrane and bending stresses. The 4-in. nozzles of the pressurizer were also evaluated. For the nozzle evaluations internal pressure stresses were combined with the stresses resulting from the pipe loads including seismic loads and the results were compared with ASME Code allowables. Design condition allowables were used for analysis involving operating-basis earthquake and emergency condition allowables were used for the safe shutdown earthquake.

The heaters for the pressurizer were qualified on a generic basis (Reference 10). The qualification procedure used an equivalent load of 37.5g for the safe shutdown earthquake and Revision 28 5/2019 Page 197 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 30g for the operating-basis earthquake. The fundamental frequency of the heater rods was greater than 33 Hz.

3.7.3.1.2 Seismic Reevaluation For the SEP reevaluation, the seismic input was defined by means of in-structure or floor response spectra which were generated either by the direct method or by means of a time-history analysis. The spectra were normally smoothed and the peaks broadened to account for modeling and material uncertainties.

In-structure response spectra were generated for both the interconnected building complex and the containment building. In both cases, in-structure spectral curves were smoothed, and the peaks were widened 15% in accordance with current practice. As described in Section 3.7.2.1, two mathematical models of the interconnected building complex were analyzed to bracket the behavior of the braced frames: a half-area model that simulated buckled bracing; and a full-area model that simulated unbuckled bracing. Envelopes of spectra generated from the two models by the direct method were used for reanalysis of equipment. In-structure response spectra for the containment interior structures were generated from time-history analyses of the mathematical model.

Response spectra were generated at the equipment locations and floor centers of gravity indicated in Table 3.7-3 and shown in Figure 3.7-11. At each location, two orthogonal horizontal spectral components were computed at three different equipment damping ratios (3%, 5%, and 7%). Since the vertical dynamic amplification was judged to be negligible, all vertical floor spectra were considered to be the same as the ground input spectra with 0.13g peak acceleration.

The in-structure response spectra generated for equipment analysis are shown in Figures 3.7-12 through 3.7-28. The horizontal in-structure spectra of the containment interior structure are oriented in the directions of S62E and N28E. Spectra outside the containment building are in the north-south and east-west directions.

For mechanical and electrical equipment, a composite 7% equipment damping was used in the evaluation for the 0.2g safe shutdown earthquake. For piping evaluation, the equipment damping associated with the safe shutdown earthquake was limited to 3%.

For the SEP reevaluation, components were grouped as active or passive and rigid or flexible.

Then, a representative sample of each group was evaluated to establish the seismic design factor of safety or degree of adequacy for that group. In this way, seismic design factors within groups of similar components were established without the detailed reevaluation of hundreds of individual components within each group.

A representative sample of components was selected for review by one of two methods:

A. Selection based on a walk-through inspection of the Ginna facility by the NRC SEP seismic review team which selected components as to the potential degree of seismic fragility for components of that category.

Revision 28 5/2019 Page 198 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS B. Categorization of the safe shutdown components into generic groups such as horizontal tanks, heat exchangers, and pumps; vertical tanks, heat exchangers, and pumps; motor control centers and motors.

Based on the detailed review of the seismic design adequacy of the representative components discussed above, conclusions were developed as to the overall seismic design adequacy of Seismic Category I equipment installed in Ginna Station.

The seismic analysis of the components selected for the SEP review, as well as the components that are representative of the generic groups of safety-related components is described in Section 3.9.2.2.4 for mechanical components and Section 3.10.2.1 for electrical components. Tables 3.9-12 and 3.10-2 contain the list of these components and the reason for their selection.

3.7.3.2 Basis for Selection of Frequencies The components and distribution systems were designated as flexible or rigid in developing the magnitude of the seismic input for component evaluation. Designation of rigid or flexible components for Ginna was complicated by the fact that many components were supported in the auxiliary and reactor buildings by concrete structures, which had high fundamental frequencies between 15 and 25 Hz, while other components were supported by steel superstructures, which had fundamental frequencies between 6 and 11 Hz. Equipment supported at or near grade was subject to nearly the ground response, with a peak response acceleration in the 2 to 9 Hz range. Therefore, components that had fundamental frequencies greater than 20 Hz and were located on grade or supported by structural steel could be considered rigid since there was little amplification in this region of the applicable response spectra. Similar components supported by concrete structures would be at or near building resonance and were considered flexible. For flexible components whose fundamental frequencies were less than twice the dominant building frequencies, the seismic inertial accelerations were typically 5 to 15 times the safe shutdown earthquake peak ground acceleration, depending on:

• Potential resonance with the supporting building structure.

• Structure and equipment damping levels.

• Equipment support elevations.

3.7.3.3 Use of Equivalent Static Analysis Equivalent static analysis was used for the seismic analysis of several components. For those components that were classified as rigid, with a fundamental frequency of 33 Hz or more, peak floor accelerations were used. For flexible components peak response acceleration from the appropriate in-structure response spectra were used.

3.7.3.4 Three Components of Earthquake Motion Response spectra were generated at the equipment locations and floor centers of gravity. At each location, two orthogonal horizontal spectral components were computed. Since the vertical dynamic amplification was judged to be negligible, all vertical floor spectra were considered to be the same as the ground input spectra with 0.13g peak acceleration.

Revision 28 5/2019 Page 199 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.3.5 Combination of Modal Responses The various Seismic Category I mechanical equipment and components were seismically qualified by analyses in which static loads equivalent to the accelerations in the response spectra were applied. As such, the question of combining modal responses did not exist. The same conclusion is true for those piping systems which were analyzed either using model techniques or by using equivalent static loads. The three piping systems that were analyzed using response spectrum are the (1) residual heat removal system, (2) main steam line, and (3) charging system. The original analyses used the square root of the sum of the squares of modal components. However, in response to NRC IE Bulletin No. 79-07, when a reanalysis was performed, the absolute sum of the modal components was used. Several additional seismic analyses of piping systems were performed subsequently. Either the square root of the sum of the squares or the absolute sum method were used for combining the modal responses. Both are acceptable.

3.7.3.6 Analytical Procedures for Piping The original Ginna Station design did not utilize dynamic computer analyses for seismic qualification of Seismic Category I piping. The reactor coolant system piping was seismically qualified using a combination of model testing and analysis. Seismic Category I piping 2-1/2 in. nominal pipe size and larger was seismically qualified using equivalent static analyses.

Seismic Category I piping 2-in. nominal pipe size and smaller was seismically qualified using support spacing tables. Dynamic analysis of sections of the A residual heat removal and B main steam piping were performed solely to verify the equivalent static analysis method.

However, modifications or additions to piping systems at Ginna Station since initial operation were seismically qualified using dynamic analyses. Some small piping was seismically qualified using equivalent static analysis or spacing table techniques.

As a result of IE Bulletin No. 79-07, new dynamic analyses were performed for sections of the A residual heat removal, B main steam, and charging system piping. The reanalyses were based on as-built piping system isometrics and support information. The details of these analyses are described below and in Section 3.9.2.1.2.

Additional analyses were also performed for the pressurizer safety and relief lines. Details of the analytical methods and analysis are provided below and in Section 3.9.2.1.4.

Reanalysis of critical safety-related piping 2-1/2 in. and larger was performed under the Seismic Piping Upgrade Program discussed in Section 3.7.3.7.

3.7.3.6.1 Residual Heat Removal System Line from Reactor Coolant System Loop A to Containment A sketch of this run is shown in Figure 3.7-29. Idealized lumped mass models were developed and analyzed dynamically. The analysis was made by assigning three translational and three rotational degrees of freedom to each lumped mass point with each mass point representing a geometrically proportional amount of the total system mass.

Elastic characteristics of the system include the translational and rotational stiffnesses; the rotational elastic characteristics are carried into the reduced stiffness matrix that is inverted Revision 28 5/2019 Page 200 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS and forms, with the mass matrix, the dynamic matrix. Following normal mode theory, the natural frequencies, mode shapes, and participation factors are computed to yield the dynamic system characteristics. These characteristics are then combined with the appropriate shock spectra to yield the DAlembert reverse effective forces on the system for each mode. The modal forces are then used to compute the stresses per mode. The stresses are summed on a root mean square basis for final comparison to code allowable stresses.

More than 70 modes have been analyzed for their response to earthquake excitation. The Housner 0.5% critical damping ground response spectrum normalized to 0.2g was used. This spectrum was considered adequate because of the location of this pipe run, low in the containment.

For the location of maximum stress, the stress values were calculated at three points on the pipe cross section, the bottom, one side 90 degrees away, and half way between these two.

First the stresses due to the two bending moments and one torsional moment on the pipe were calculated. Then for each of the three points, the root mean square of the stresses acting at the point for the significant modes (first three) was calculated. To this was added the dead weight stress, and then the result multiplied by the stress intensification factor, as the location of maximum stress was the end of an elbow. The pressure stress was added to this result in order to obtain the total additive longitudinal stress. The total maximum stress was calculated, considering the torsional shear stress and using the formula for maximum principal stresses.

Re-analysis of the Residual Heat Removal system piping was performed under the Seismic Upgrade program. Additional information may be found in Section 3.7.3.7.

3.7.3.6.2 Steam Line from Steam Generator B to Containment A dynamic modal analysis was run on the steam line of loop B on lines similar to that just described. The lumped mass model of the piping, supports, and snubbers are shown in Figure 3.7-30.

Re-analysis of the Main Steam system piping was performed under the Seismic Upgrade program. Additional information may be found in Section 3.7.3.7.

3.7.3.6.3 Pressurizer Safety and Relief Lines 3.7.3.6.3.1 Analytical Methods The analytical methods used to obtain a piping deflection solution consisted of the transfer matrix method and stiffness matrix formulation.

The piping system models, constructed for the WESTDYN computer program, were represented by an ordered set of data which numerically describes the physical system.

The spatial geometric description of the piping model was based upon the isometric piping drawings and equipment drawings. Node point coordinates and incremental lengths of the members were determined from these drawings. Node point coordinates are put on network cards. Incremental member lengths were put on element cards. The geometrical properties along with the modulus of elasticity (E), the coefficient of thermal expansion (a), the average Revision 28 5/2019 Page 201 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS temperature change from the ambient temperature (delta T), and the weight per unit length (w) were specified for each element. The supports were represented by stiffness matrices which define restraint characteristics of the supports. Plotted models for various parts of the safety and relief valve discharge piping are shown in Figure 3.7-31, Sheets 1 through 5.

3.7.3.6.3.2 Transfer Matrix Method The static solutions for deadweight and thermal loading conditions were obtained by using the WESTDYN computer program. The fundamental transfer matrix for an element is determined from its geometric and elastic properties. If thermal effects and boundary forces are included, a modified transfer relationship is defined as follows:

(Equation 3.7-2) or T1Bo + R1 = B1 where the T matrix is the fundamental transfer matrix as described above, and the R vector includes thermal effects and body forces. This B vector for the element is a function of geometry, temperature, coefficient of thermal expansion, weight per unit length, lumped masses, and externally applied loads.

The overall transfer relationship for a series of elements (a section) can be written as follows:

B1 = T1Bo + R1 B2 = T2B1 + R2 = T2T1Bo + T2R1 + R2 B3 = T3B2 + R3 = T3T2T1Bo + T3T2R1 + T3R2 + R3 or (Equation 3.7-3)

Revision 28 5/2019 Page 202 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.3.6.3.3 Stiffness Matrix Formulation A network model was made up of a number of sections, each having an overall transfer relationship formed from its group of elements. The linear elastic properties of a section were used to define the characteristic stiffness matrix for the section. Using the transfer relationship for a section, the loads required to suppress all deflections at the ends of the section arising from the thermal and boundary forces for the section were obtained. These loads were incorporated in the overall load vector.

After all the sections were defined in this manner, the overall stiffness matrix, K, and associated load vector needed to suppress the deflection of all the network points was determined. By inverting the stiffness matrix, the flexibility matrix was determined. The flexibility matrix was multiplied by the negative of the load vector to determine the network point deflections due to the thermal and boundary force effects. Using the general transfer relationship, the deflections and internal forces were then determined at all node points in the system. The support loads, F, were also computed by multiplying the stiffness matrix, K, by the displacement vector, , at the support point.

The lumping of the distributed mass of the piping systems was accomplished by locating the total mass at points in the system which appropriately represented the response of the distributed system. Effects of the pressurizer motion on the piping system were obtained by modeling the mass and the stiffness characteristics of the equipment in the overall system model.

The supports were again represented by stiffness matrices in the system model for the dynamic analysis. Mechanical shock suppressors which resist rapid motions were considered in the analysis. The solution for the seismic disturbance employed the response spectra method.

From the mathematical description of the system, an overall stiffness matrix, K, was developed from the individual element stiffness matrices using the transfer matrix, KR, associated with mass degrees of freedom only. From the mass matrix and the reduced stiffness matrix, the natural frequencies and the normal modes were determined. The modal participation factor matrix was computed and combined with the appropriate response spectra value to give the modal amplitude for each mode. Since the modal amplitude was shock direction dependent, the total modal amplitude was obtained conservatively by the absolute sum of the contributions for each direction of shock. The modal amplitudes were then converted to displacements in the global coordinate system and applied to the corresponding mass point. From these data the forces, moments, deflections, rotation, support reactions, and piping stresses were calculated for all significant modes.

The seismic response from each earthquake component was computed by combining the contributions of the significant modes.

Revision 28 5/2019 Page 203 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.3.7 Seismic Piping Upgrade Program 3.7.3.7.1 Program Scope Commencing in 1979, a reanalysis of selected Class 1 piping systems was performed for the seismic piping upgrade program, which resulted from SEP Topic III-6.

The purpose of this program was to upgrade certain Seismic Category I Piping systems at Ginna Station to more current requirements and to provide a seismic data base for use with modifications, the inservice inspection program, and NRC requests for information.

Portions of the following piping systems were included in this program:

• Reactor coolant system

• Main steam

• Main feedwater

• Auxiliary feedwater

• Safety injection

• Residual heat removal

• Containment spray

• Steam generator blowdown

• Service water (SW)

• Component cooling

• Standby auxiliary feedwater

• Chemical and volume control

1. Auxiliary spray

2. Letdown

3. Seal-water

4. Charging 3.7.3.7.2 Piping Selection Criteria The criteria for the selection of lines to be included in the program were as follows:

A. Only piping that is considered Seismic Category I as identified by the safety class and seismic boundaries shown on the Ginna Station P&IDs.

B. Main runs of piping included shall be based on the following criteria:

1. Main runs of piping which are 2-1/2 in. and larger and critical 2-in. piping.

2. Main runs that provide the fluid flow path to/or from equipment required for safe shut-down and loss-of-coolant-accident mitigation based on the Systematic Evaluation Program. Equipment does not include instrumentation.

Revision 28 5/2019 Page 204 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

3. Selected additional main runs, which are a primary part of the systems included in the upgrade program.

C. Branch lines included shall be based on the following criteria:

1. Branch lines shall be included in the analyses as necessary to determine the local effects of the branch lines on the main runs and to ensure adequate flexibility exists in the branch line to prevent local overstress in the branch due to main run displacements.

2. Branch lines whose section modulus is greater than 15% of the main run section modulus shall be included in the analysis for an appropriate distance and/or number of supports

3. Branch lines whose section modulus is less than 15% of the main run section modulus do not need to be explicitly included in the analysis.

3.7.3.7.3 Selected Lines The lines selected to be analyzed and modified as necessary are identified below.

The load combinations, associated stress limits, and conclusions for these lines are discussed in Section 3.9.2.1.8. Pipe supports for these lines are discussed in Section 3.9.3.3.

3.7.3.7.3.1 Reactor Coolant System

a. Primary loop.

b. Surge line.

c. Pressurizer spray lines from the cold legs to the pressurizer.

3.7.3.7.3.2 Main Steam

a. The 30-in. lines from both steam generators through the penetrations and up to the main steam isolation valves.

b. Inlet piping up to safety and relief valves.

3.7.3.7.3.3 Main Feedwater The 14-in. lines from the steam generators through the penetrations and up to check valves 3992 and 3993.

3.7.3.7.3.4 Auxiliary Feedwater

a. The discharge lines from the two motor-driven pumps and the turbine-driven pump up to the main feedwater connections, and branches to valves 4304, 4310, including by-pass lines containing valves 4493 and 4494.

b. The condensate and service water (SW) suction lines from the pumps to check valves 4014, 4016, 4017, and to valves 4013, 4027, and 4028.

Revision 28 5/2019 Page 205 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.3.7.3.5 Safety Injection

a. The 10-in. safety injection accumulator discharge lines to the cold legs.

b. Safety injection pump suction lines from the refueling water storage tank (RWST) through valves 896A and B and 825A and B to the three pumps.

c. The safety injection pump discharge lines from the three pumps to the safety injection accumulator discharge lines and to the two hot leg connections.

d. The boric acid lines from the boric acid storage tanks to the safety injection pump suction line.

e. The 4-in. alternate safety injection suction line from valves 1816A and B to the pump.

f. The 10-in. low-head safety injection suction from the refueling water storage tank (RWST) to valve 854.

g. The 6-in./8-in. header from the refueling water storage tank (RWST) to valves 857A, B, and C.

h. The 8-in. suction lines from containment sump B to valves 850A and B and the 6-in. branch lines to valves 1810A and B.

i. The low head safety injection lines from valves 852A and B to the reactor coolant system.

3.7.3.7.3.6 Residual Heat Removal

a. The 10-in. suction lines from the loop A hot leg to the two residual heat removal pumps.

b. From valves 850A and B to the residual heat removal pumps.

c. From valve 854 to the suction header.

d. The two pump discharge lines through heat exchangers and to the common 10-in. return.

e. The 10-in. return through penetration P111 and to the B cold leg.

f. The discharge cross-connect including valves 709C and D.

g. The heat exchanger bypass line including valves 712A and B.

h. The two lines from the residual heat removal heat exchanger outlets to valves 857A and B and 1816B.

i. The recirculation line from the residual heat removal return through valve 822B to the residual heat removal suction line.

j. The two lines from the residual heat removal return to valves 852A and B.

3.7.3.7.3.7 Containment Spray

a. The two suction lines from the refueling water storage tank (RWST) header to the spray rings.

b. The two containment spray pump discharge lines and spray rings.

c. The two eductor lines from the containment spray pump discharges to the pump suctions.

d. The spray additive lines from the tank through valves 836A and B and to the two eductors.

Revision 28 5/2019 Page 206 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.3.7.3.8 Chemical and Volume Control System

a. The auxiliary pressurizer spray line from the connection at the regenerative heat exchanger outlet line to the pressurizer spray line.

b. The letdown line from the reactor coolant system through the regenerative heat exchanger, through the nonregenerative heat exchanger, through valve TCV 145 to the volume control tank.

c. The 4-in. header from the volume control tank and the 3-in. suction lines to the three charging pumps.

d. The three charging pump discharge lines to the acoustic filter.

e. The 2-in. charging lines from the acoustic filter through the regenerative heat exchanger to both the hot and cold leg connections.

f. The 3-in. seal water header from the acoustic filter and the 2-in. lines to the reactor coolant pump seals.

g. The 2-in. seal-water return lines from the reactor coolant pump seals and the 3-in. return header through the seal water heat exchanger to the volume control tank. This includes 3/4-in. piping through flow transmitters 175, 176, 177, and 178.

h. The 4-in. line from the refueling water storage tank (RWST) through valves LCV 112B and 358 to the charging pump suction header.

3.7.3.7.3.9 Steam Generator Blowdown The 2-in. and 3-in. lines from the steam generators through the penetrations to the isolation valves.

3.7.3.7.3.10 Service Water System

a. The inlet piping to both diesel generators including the cross-connection between the diesels, the 16-, 14-, and 10-in. supply to the turbine building up to valve 4613.

b. The outlet piping from both diesel generators to an anchor point outside the diesel generator room.

c. The 20-in. supply lines and header inside the auxiliary building.

d. The 18-, 14-, and 6-in. supply lines from the 20-in. header to the two component cooling water heat exchangers and the spent fuel pool (SFP) heat exchanger.

e. The normal discharge lines from the component cooling water heat exchangers and the spent fuel pool (SFP) heat exchangers including the 20-in. discharge line inside the auxiliary building.

f. The 3-in. supply and normal discharge headers to and from the safety injection system pumps and equipment coolers in the auxiliary building (includes piping through valves 4738, 4739, and 4739A).

g. The 16-in. and 14-in. supply headers inside the intermediate building. Including piping through valves 4640, 4623, 4639, and 4756.

h. The 10-in. supply to the turbine building up to valve 4614.

Revision 28 5/2019 Page 207 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

i. The 4-in. supply lines to the preferred auxiliary feedwater pumps.

j. The 2-1/2 in. and 8-in. supply and discharge lines to and from the 1A, 1B, 1C, and 1D containment ventilation cooling coils and fan motors.

k. The 2-1/2 in. supply and discharge lines for the reactor compartment coolers, including piping through valves 4625, 4626, and 4624.

l. The 6 and 4-in. supply to the air conditioning water chillers up to the isolation valves 4663 and 4733.

m. The common discharge header for the ventilation coolers up to an anchor point outside the intermediate building.

n. The service water (SW) pump discharge piping inside the screen house including the 4-in.

cross-tie.

o. The 4-in. supplies from the loop to the C and D standby auxiliary feedwater (SAFW) pumps including the 4-in. cross-tie.

p. The 4-in. test suction line through valves 9707A and B and the 1-1/2-in. branch line through valves 9720A and B.

q. The 1-1/2-in. supply to standby auxiliary feedwater room cooling units A and B.

r. The discharge from the standby auxiliary feedwater room cooling units to the 14-in. normal return line and to the 20-in. alternative discharge line.

3.7.3.7.3.11 Component Cooling Water

a. The 14-in. suction header and 10-in. suction lines to the component cooling water pumps.

The component cooling water pump discharge lines to the component cooling water heat exchangers.

b. The 4-in. and 6-in. component cooling water surge tank line.

c. The 10-in. and 14-in. supply headers out of the component cooling water heat exchangers.

d. The 10-in and 14-in. supply lines to both residual heat exchangers.

e. The 10-in. and 14-in. return lines from the residual heat exchangers to the component cooling water pumps suction header.

f. The 2-in. supply and return lines to the residual heat removal pump coolers.

g. The 14-in. and 8-in. supply and return headers servicing the reactor coolant pumps and reactor supports.

h. The 3-in. and 4-in. supply and return lines to both reactor coolant pump motors.

i. The 6-in. supply and return lines for the reactor supports from the 2-in. headers to penetrations 130 and 131.

j. The 2-in. supply and return lines for the excess letdown heat exchanger from the 8-in.

header to penetrations 124 and 126.

k. The 6-, 4-, and 2-in. supply and return lines for the nonregenerative heat exchanger and the seal-water heat exchanger.

l. The 2-in. supply and return lines for both the containment spray and safety injection pumps.

Revision 28 5/2019 Page 208 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.3.7.3.12 Standby Auxiliary Feedwater The 3-in. discharge from standby auxiliary feedwater pumps (SAFW) C and D through the penetrations to the A and B main feedwater lines, including the 3-in. cross-tie and the 1-1/2-in. lines to both minimum flow orifices.

3.7.3.7.4 Codes and Standards The original design of Seismic Category I piping at Ginna was done to USAS B31.1.

The piping code, USAS B31.1, was updated on June 30, 1973, revising the piping stress analysis formulas and stress intensification factors. The primary stress equations are similar to those given in the ASME Section III Code of that time. The stress intensification factors given in the 1973 version of the code were expanded to include more fittings than in the previous edition, as well as higher values for certain existing fittings. In the piping system Seismic Upgrade Program, the ANSI B31.1 Code, Summer 1973 Addenda, was used primarily, with the following exception. The piping criteria did not consider the B31.1 Summer 1973 Addenda stress intensification factors for butt and socket welds, since they are constrictively higher than the original design basis 1967 B31.1 stress intensification factors.

The design, materials, fabrication, installation, and examination of piping modifications required as a result of this reanalysis are done in accordance with ANSI B31.1.

3.7.3.7.5 Analytical Procedures The analytical procedure used for the piping analysis is described in the following.

3.7.3.7.5.1 General The piping/support systems are evaluated incorporating three-dimensional static and dynamic models which include the effects of the supports, valves and equipment. The static and dynamic analysis employs the displacement method, lumped parameters, stiffness matrix formulation, and assumes that all components and piping behave in a linear elastic manner.

The response spectra model analysis technique is used to analyze piping.

Seismic analyses incorporate the Gilbert Associates, Inc., developed response spectra for both the operating-basis and safe shutdown earthquake cases. Spectra are derived from buildings and elevations applicable to the individual analysis lines.

The seismic analyses are based on the operating-basis earthquake and safe shutdown earthquake being initiated while the plant is at the normal full power condition.

3.7.3.7.5.2 Damping Values The seismic pipe stresses are determined using seismic loads generated considering the piping systems to have the following damping values.

Small diameter piping systems, diameter less than 12-in.

For operating-basis earthquake the damping value is 1%.

Revision 28 5/2019 Page 209 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS For safe shutdown earthquake the damping value is 2%.

Large diameter piping systems, diameter equal to or greater than 12 in.

For operating-basis earthquake the damping value is 2%.

For safe shutdown earthquake the damping value is 4%.

For a coupled system with different damping and different structural elements, such as would be the case in analysis with coupling between concrete structures and welded steel components, the method used for damping is either to (1) use the damping that results in the highest load, (2) inspect the mode shapes to determine which modes correspond with a particular structural element, and then use the damping associated with that element having predominant motion, or (3) use composite modal damping value for each mode, which is calculated by weighting the damping in each subsystem by the amount of strain energy in each subsystem.

An acceptable alternative to the listed damping values is to apply the values given in ASME Code Case N-411. These values are applicable to both Operating Basis Earthquakes and Safety Shutdown Earthquakes and are independent of pipe diameter.

3.7.3.7.5.3 Combination of Modal Responses For piping systems interconnected between floors of a structure and/or building, the envelope of the respective floor response spectra is used in the seismic analysis.

The piping was analyzed for the simultaneous occurrence of two horizontal components and one vertical earthquake input component. The response spectra associated with each earthquake component are applied in each direction separately. The combined modal response for each item of interest (e.g., force, displacement, stress) resulting from each component analysis will be combined by the square root of the sum of the squares method.

For each seismic analysis, the total seismic response is obtained by combining the individual modal response (in each direction) utilizing the square root of the sum of the squares method.

The combination of modal responses is in accordance with one of the following:

a. Regulatory Guide 1.92.

b. Subsection 3.7.3.4 of Westinghouse RESAR-41, as described below.

c. NUREG 1061 Volume 4, Section 2, as described below.

For systems having modes with closely spaced frequencies, the above method is modified to include the possible effect of these modes. The groups of closely spaced modes are chosen such that the difference between the frequencies of the first mode and the last mode in the group does not exceed 10% of the lower frequency. Combined total response for systems which have such closely spaced modal frequencies are obtained in accordance with Regulatory Guide 1.92 or, as an acceptable alternative, the following method.

Frequency groups are formed starting from the lowest frequency and working toward successively higher frequencies. No frequency should be included in more than one group.

Revision 28 5/2019 Page 210 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS The resultant unidirectional response for systems having such closely spaced modal frequencies is obtained by the square root of (a) the sum of the squares of all modes, and (b) the product of the responses of the modes in various groups of closely spaced modes and associated coupling factors. The mathematical expression for this method with R as the item of interest is:

(Equation 3.7-4) where: Ri = resultant unidirectional response for direction i; i=1, 2, 3 Rij = absolute value of response of direction i, mode j N= total number of modes considered S= number of groups of closely spaced modes Mj = lowest modal number associated with group j of closely spaced modes Nj = highest modal number associated with group j of closely spaced modes K= coupling factor with (Equation 3.7.5)

(Equation 3.7.6)

(Equation 3.7.7) where: K = frequency of closely spaced mode K (rad/sec)

K = fraction of critical damping in closely spaced mode K td = duration of the earthquake (seconds)

Total response, RT is Revision 28 5/2019 Page 211 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS (Equation 3.7-8)

For "Multiple Supporting Piping Systems" utilizing the independent support motions response spectrum method of analysis, the total response for the system is obtained in accordance with NUREG 1061 Volume 4, Section 2, as summarized in the following:

aa. For inertial or dynamic components.

The inertial or dynamic component group responses for each direction are combined by the absolute sum method. Modal and directional responses for these component groups are combined by the square root sum of the squares method without considering closely spaced frequencies.

bb. For pseudostatic components (e.g., anchor motion).

Calculate the maximum absolute response for each support group and then combine their effects by the absolute sum method for each input direction. Directional responses are then combined by the square root sum of the squares method.

cc. For the total response.

Determine the total response by combining the dynamic and pseudostatic responses by the square root sum of the squares method. Since consideration of closely spaced frequencies need not be considered when applying this analysis method, either directional or modal components may be combined first.

dd. High frequency modes.

High frequency modes (>33Hz) are combined algebraically as described in NUREG 1061 Volume 4, Section B.2 of Appendix B. The effects of the high frequency modes are combined with the effects of the low frequency modes (33Hz) by the square root of the sum of the squares method.

3.7.3.7.5.4 Safe Shutdown Earthquake Stresses The analyses performed for piping and supports do not include stresses resulting from safe shutdown earthquake induced differential motion. These stresses are secondary in nature, based on ASME code rules for piping (NB-3652, NB-3656, F-1360) and component supports (NF-3231). The safe shutdown earthquake, being a very low probability single occurrence event, is treated as a faulted condition. Therefore, consistent with present ASME philosophy, the secondary stresses associated with the safe shutdown earthquake induced differential motion are not evaluated when performing seismic analysis per the response spectrum method. The basic characteristic of these stresses is that they are self-limiting. Local yielding and minor distortions will satisfy the initial conditions that caused the stress to occur.

Operating-basis earthquake induced differential motion is considered.

Revision 28 5/2019 Page 212 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.7.3.7.5.5 Small Piping Analysis For small piping (2 in. and smaller) as an option to dynamic analysis, either the equivalent dynamic or static rigid range approach can be used. If the small piping system has a low operating temperature, then the pipe lines can be analyzed using equivalent static loads based on spacing table techniques. The static rigid range approach is used for rigid piping systems, which are defined as having natural frequencies greater than 33 Hz. In this case, the piping system is analyzed with static equivalent loads corresponding to acceleration in the rigid range of the applicable response spectrum curves. Both horizontal and vertical static equivalent loads are applied to rigid piping systems. The response of the piping system for two orthogonal horizontal directions and one vertical direction are combined on a square root of the sum of the squares basis.

For any piping that can be shown to be rigid (lowest natural frequency greater than 33 Hz), as an option to performing a dynamic analysis, the static rigid range approach may be used.

3.7.3.7.5.6 Branch Line Analysis The following branch line analytical procedure and criteria are used.

a. The branch line is not included in the run model if its section modulus is 15% or less of the run section modulus.

b. For branch lines which have section moduli greater than 15% of the run section modulus, the branch line is modeled initially for a distance of 15 ft 0 in. If it is later determined by the piping analyst that additional modeling information is required, it is provided and included within the analysis model.

c. In the run analysis where the branch line has not been included, the branch allowable bending moments are included. Using B31.1 Summer 1973 Addenda, Formula 12, the branch allowable moment is expressed as follows:

MBR = Branch Allowable Moment (Equation 3.7-9)

d. For branch lines that are not included in the model, supports within 10 ft of the run are noted since a support near the run pipe could affect the branch line flexibility.

3.7.3.7.5.7 Piping Beyond Scope of Upgrade Program Piping which extends beyond the scope of the seismic upgrading program effort is included within the analysis only as it affects fluid lines within scope. In general, piping is modeled for a distance which covers a minimum of one rigid support in each of the three global directions. Case-by-case judgments are made when the above is insufficient or infeasible.

Out-of-scope piping is analyzed to the same general guidelines and criteria as the in-scope piping, once its inclusion has been deemed necessary. Analysis of nonseismic portions of the out-of-scope piping may be done to allowable stresses equivalent to the ASME Code Service Revision 28 5/2019 Page 213 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Level D allowables, providing the in-scope piping meets all seismic upgrade criteria requirements. Piping or support modifications are recommended for the out-of-scope segments when the qualification and/or safe operation of the upgraded piping mandates. Support load evaluations comply with the above guidelines and criteria established for the piping being supported.

3.7.3.7.6 Piping System Models Piping Modeling Techniques for Static Analysis The piping system models are represented by an ordered set of data, which numerically describes the physical system.

The spatial geometric description of the piping model is based upon the as-built isometric piping drawings and equipment drawings. Node point coordinates and incremental lengths of the members are determined from these drawings. Node point coordinates are input on network cards. Incremental member lengths are input on element cards. The geometrical properties along with the modulus of elasticity, E, the coefficient of thermal expansion, , the average temperature change from ambient, delta T, and the weight per unit length, w, are specified for each element. The supports are represented by stiffness matrices, which define restraint characteristics of the supports.

A network model is made up of a number of sections, each having an overall transfer relationship formed from its group of elements. The linear elastic properties of the section are used to define the characteristic stiffness matrix for the section. Using the transfer relationship for a section, the loads required to suppress all deflections at the ends of the section arising from the thermal and boundary forces for the section are obtained. These loads are incorporated into the overall load vector.

After all the sections have been defined in this manner, the overall stiffness matrix, K, and associated load vector, to suppress the deflection of all the network points, is determined. By inverting the stiffness matrix, the flexibility matrix is determined. The flexibility matrix is multiplied by the negative of the load vector to determine the network point deflections due to the thermal and boundary force effects. Using the general transfer relationship, the deflections and internal forces are then determined at all node points in the system. The support loads, F, are also computed by multiplying the stiffness matrix, K, by the displacement vector,

, at the support point.

The models used in the static analysis are modified for use in the dynamic analyses by including the mass characteristics of the piping and equipment.

The lumping of the distributed mass of the piping systems is accomplished by locating the total mass at points in the system which will appropriately represent the response of the distributed system. Effects of the equipment motion are obtained by modeling the mass and the stiffness characteristics of the equipment in the overall system model when required.

The supports are again represented by stiffness matrices in the system model for the dynamic analysis. Hydraulic shock suppressors that resist rapid motions are considered in the analysis.

Revision 28 5/2019 Page 214 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS From the mathematical description of the system, the overall stiffness matrix, K, is developed from the individual element stiffness matrices using the transfer matrix, KR, associated with mass degrees-of-freedom only. From the mass matrix and the reduced stiffness matrix, the natural frequencies and the normal modes are determined.

The effect of eccentric masses, such as valves and extended structures, are considered in the seismic piping analyses. These eccentric masses are modeled in the system analysis and the torsional effects caused by them are evaluated and included in the total system response. The total response must meet the limits of the criteria applicable to the safety class of the piping.

3.7.3.7.7 Valve Model Valves are included in the piping system model. The model employed reflects non-rigid behavior as well as rigid behavior. For rigid valves, the model used consists of a rigid beam element from the center of the run pipe to the center of gravity of the valve. The mass of the valve should be located at the valve center of gravity. For non-rigid valves, the model should have two masses.

3.7.3.7.8 Equipment Model Where the stiffness and mass of the equipment attached to the piping will influence the piping system being analyzed, the piping model must include the equipment effect. This is accomplished by including in the piping model a model of the equipment to the detail necessary.

3.7.3.7.9 Interaction Effects Interaction of other piping systems is considered when their response will affect the response of the line being analyzed. The reactor coolant loop is included in the piping system model to the extent of detail required. If the lines being analyzed are relatively small diameter and/or low temperature, the reactor coolant loop need not be included in the model. This is because these lines are so flexible that the reactor coolant loop deflection will not include significant stresses in the lines, or that the reactor coolant loop response characteristics will not cause exciting forces different from those associated with the inner containment building.

Where branch piping is attached to the piping being analyzed, its effect on the piping of interest is accounted for by modeling in accordance with the criteria for branch lines given earlier.

3.7.3.7.10 Support Model Supports are modeled as equivalent stiffness matrices within the piping analysis models (Section 3.7.3.7.6).

3.7.3.7.10.1 Deviations Deviations from the analyzed support design parameters are permissible from an analysis standpoint provided the following acceptability guidelines are maintained.

a. Support stiffnesses.

Revision 28 5/2019 Page 215 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

1. Increasing the stiffness of a previously rigid support is acceptable. Rigid is defined in Section 3.9.3.3.3.3.

2. Revisions when original stiffness is below rigid are acceptable when revised values are 15% of original stiffness.

b. Support locations.

Acceptable Deviations:

1.

Pipe Size Tolerancea 4 in. Greater of nominal pipe diameter or 3 in.

6 in. Nominal diameter of pipe

a. Twice these tolerances permitted for spring hangers, constant force supports, and axial supports.

c.

Support directionality.

Acceptable deviation: 5 degrees.

Any noncompliances with these guidelines will be assessed on a case-by-case basis to determine the effect on the analysis results.

3.7.3.7.10.2 Support-Welded Attachments Welded lugs are permissible for use on supports that do not act perpendicular to the pipe centerline and where slippage must be prevented. The design of acceptable welded attachments or lugs must be in accordance with the following geometric restrictions.

a. The attachment material, weld material, and pipe material have essentially the same moduli of elasticity and coefficients of thermal expansion.

b. (Equation 3.7-10) where 2L1 is the width, 2L2 is the length of the welded attachment measured along the surface of the run pipe, and r is the mean pipe radius.

c. The attachment is made on straight pipe, with the nearest edge of the attachment weld located at a minimum distance of rt from any other weld or discontinuity. The mean pipe radius is r and t is the nominal pipe wall thickness.

d. Do/t 100 where Do and t are the outside diameter and nominal pipe wall thicknesses of the run pipe respectively.

Revision 28 5/2019 Page 216 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS

e. The use of fillet welds for pipe attachments is normally acceptable. Full penetration welds will be specified in certain high temperature, high load situations.

Stanchions are small pipe segments welded to the run pipe and used for support. The support must be welded to the run pipe with a full penetration weld. The "branch" portion will have a zero pressure stress. The ratio of stanchion mean radius to pipe mean radius will govern the choice of applicable stress intensification factors used within the piping qualification. If this ratio is greater than 0.5, welding tee factors will be used; if it is less than or equal to 0.5, the larger of welding tee or branch factors will be used.

Supports requiring lugs or stanchions will be designed such that stress amplification is minimized. Exceptions to this criteria will be investigated on an individual basis.

An exception to the component standard supports stiffness capabilities is made in the case of U-bolt type supports, for the Seismic Upgrade Program effort. Finite element analysis evaluations provided the basis for U-bolt support stiffness values and load capabilities.

Rod hangers are generally single acting vertical supports; in the upward direction, they are susceptible to an early buckling condition. Stiffnesses, therefore, in the upward direction are minimal. Consideration of this condition will be made within the applicable analysis of piping systems with rod hangers included, such that the upward motion of a piping section at the location of these supports will cause support inaction. If stress acceptability is verified with support inactivity in the upward direction, the continued use of single acting rod hangers is satisfactory. If it is found that double-acting support is required for piping qualification, the replacement of rod hangers with struts will be recommended.

3.7.4 SEISMIC INSTRUMENTATION A strong motion accelerograph is installed in the subbasement of the intermediate building at elevation 237 ft. This location was chosen rather than the basement of the containment since it more easily facilitates periodic surveillance of the instrument (this would be difficult should the instrument be located in the basement of the containment) and the retrieval of the shock record can more readily be made. The response of the accelerograph located in the basement of the intermediate building will be virtually the same as one located in the basement of the containment. The elevations of the basement floors of both the containment and intermediate building are within 2 ft of one another and both basement mats are supported upon the underlying Queenston formation.

Revision 28 5/2019 Page 217 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS REFERENCES FOR SECTION 3.7

1. Letter from L. D. White, Jr., RG&E, to D. L. Ziemann, NRC,

Subject:

Systematic Evaluation Program, Seismic Review, R.E. Ginna, dated April 3, 1979.

2. G. W. Housner, "Design of Nuclear Power Reactors Against Earthquakes, "Proceedings of 2nd World Conference on Earthquake Engineering, Volume I, Japan, 1960.

3. Letter from D. M. Crutchfield, NRC, to SEP Owners,

Subject:

Site Specific Ground Response Spectra for SEP Plants Located in the Eastern U.S., dated June 17, 1981.

4. United States Atomic Energy Commission, Nuclear Reactors and Earthquakes, TID 7024, 1963.

5. J. Blume, N. Newark, and L. Corning, Design of Multistory Reinforced Concrete Buildings for Earthquake Motions, Portland Cement Association.

6. N. W. Newmark and W. J. Hall, Development of Criteria for Seismic Review of Selected Nuclear Power Plants, U.S. NRC, NUREG/CR-0098, 1978.

7. S. J. Sackette, User Manual for SAP4, A Modified and Extended Version of the U.C.

Berkeley SAP IV Code, Lawrence Livermore National Laboratory, UCID 18226, 1979.

8. M. P. Singh, "Generation of Seismic Floor Spectra," Journal of Engineering Mechanics Division, ASCE, EM5, October, 1975.

9. M. P. Singh, "Seismic Design Input for Secondary Systems," ASCE Mini-Conference on Civil Engineering and Nuclear Power, Session 11, Boston, Massachusetts, Volume II, April 1979.

10. P. P. DeRosa, et al., Pressurizer Generic Stress Report, Sections 3.1, 3.2, 3.4, 3.7, Westinghouse Electric Corporation, Tampa Division, 1973.

11. T. M. Wiger, Framatome ANP, "Ginna Nuclear Power Plant, Control Rod Drive Mechanism Pressure Housing Assembly, Appurtenances ASME III, Class 1 Design Report" dated May 19, 2003.

Revision 28 5/2019 Page 218 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.7-1 ORIGINAL AND CURRENT RECOMMENDED DAMPING VALUES Critical Damping (%)

Structure or Ginna Regulatory Guide 1.61 NUREG/CR-0098a Component (Safe Shutdown (Yield Levels)

Earthquake)

Prestressed 2 5 5 to 7 concrete Reinforced 5 7 7 to 10 concrete Steel frame 1 or 2.5 4 or 7 10 to 15 Welded assemblies 1 4 5 to 7 Bolted and riveted 2.5 7 10 to 15 assemblies Vital piping 0.5 2 or 3 2 to 3

a. See Reference 6.

Revision 28 5/2019 Page 219 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.7-2 MODAL FREQUENCIES OF THE INTERCONNECTED BUILDING MODEL Frequency (Hz)

Mode Number Half-Area Model Full-Area Model 1 1.8 (3.4, 12.9) 2.3 (7.4, 12.6) 2 2.0 (10.2, 0.2) 2.4 (8.5, 4.7) 3 2.1 2.8 4 2.4 3.1 5 2.6 3.2 (7.4, 0.6) 6 2.8 3.4 7 2.9 3.4 8 3.3 3.6 9 3.4 3.9 10 3.6 4.0 (6.3, 1.4) 11 4.0 4.3 12 4.2 4.3 13 4.2 4.6 14 4.4 4.6 15 4.7 5.4 16 5.6 6.7 17 6.1 6.9 (12.7, 6.4) 18 6.5 (6.4, 4.5) 7.0 19 6.6 7.3 20 6.7 (8.4, 8.5) 7.4 21 6.9 (10.3, 7.2) 7.5 22 7.0 8.0 23 7.8 9.7 (5.1, 8.3) 24 9.3 10.4 25 9.5 (5.4, 8.4) 10.6 26 10.4 10.9 27 10.8 11.1 28 11.1 11.7 Revision 28 5/2019 Page 220 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Frequency (Hz)

Mode Number Half-Area Model Full-Area Model 29 11.2 12.1 30 12.2 12.8 31 13.5 14.0 32 13.8 16.4 33 16.4 16.7 34 17.8 (2.4, 6.6) 17.8 (2.3, 6.5) 35 18.5 18.6 36 19.3 19.5 37 21.1 (0.1, 27.1) 21.2 (0.1, 27.1) 38 22.9 (26.9, 0.1) 22.9 (26.9, 0.1) 39 27.0 27.2 40 33.5 33.6 41 41.2 41.2 42 45.1 45.7 43 57.8 57.8 44 60.4 (6.7, 0.0) 60.4 (6.7, 0.0)

NOTE:Numbers in parentheses are the 10 largest modal participation factors in the east-west and north-south directions, respectively.

Revision 28 5/2019 Page 221 of 769

GINNA/UFSAR CHAPTER 3 DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS Table 3.7-3 EQUIPMENT AND LOCATIONS WHERE IN-STRUCTURE SPECTRA WERE GENERATED FOR THE SYSTEMATIC EVALUATION PROGRAM Building Equipment Elevation (ft)

Containment interior structures Pressurizer PR-1 253 Control rod drive 253 and 278 Steam generator SG-1A 250 and 278 Steam generator SG-1B 250 and 278 Coolant pump RP-1A 247 Coolant pump RP-1B 247 Auxiliary building Platform center of gravity 281.5 Heat exchanger (35) 281.5 Surge tank (34) 281.5 Boric acid storage tank (40 B) 271 Operating floor center of gravity 271 Control building Basement floor center of gravity 250 Relay room floor center of gravity 269.75 Control room floor center of gravity 289.75 Revision 28 5/2019 Page 222 of 769