ML19262C499

Forwards Request for Addl Info Re Fsar.Nrc Position on Full Load Testing of 4160-480 Volt Transformers & Electrical & Mechanical Matters Encl.Requests That FSAR Be Amended by 800430 to Reflect Responses

ML19262C499
Person / Time
Site:	Grand Gulf
Issue date:	01/22/1980
From:	Baer R Office of Nuclear Reactor Regulation
To:	Stampley N MISSISSIPPI POWER & LIGHT CO.
References
NUDOCS 8002140092
Download: ML19262C499 (35)

Text

'

~

• **Go o

UNITED STATES y, v. ( ( )

NUCLEAR REGULATORY COMMISSION

, g \\[ /.

E WASHINGTON. D. C. 20555 y:Q)

JAN 2 21580 Docket Nos. 50-416 and 50-417 Mr N. L. Stampley, Vice President Production and Engineering Mississippi Powr and Light Company P. O. Box 1640 Jackson, Mississippi 39205

SUBJECT:

REQUESTS FOR AEDITIONAL INFORMATION (Grand Gulf Nuclear Station, Units 1 and 2)

As a result of our review of the information contained in the Final Safety Analysis Report for the Granc Gulf Nuclear Station, Units 1 and 2, we have developed the enclosed requests for additional information. Included are questions on the Fire Prctection Program from the Quality Assurance Branch and the Auxiliary Systems Branch, a staff position concerning full load testing of 4160-480 volt trar.sformers from the Quality Assurance Branch, and electrical and mechanical questions from the Power Systems Branch.

We request that you amend your Final Safety Analysis Report to reflect your responses to the enclosed requests by April 30, 1980.

If you cannot meet this date, please advise us of the date you can meet as soon as possible so that we may consider the need to revise our review schedule.

Please contact us if you desire any discussion or clarification of the enclosed requests.

Si ncerely, f

I, M Rcbert L.'Baer, Chief Light Water Reactors Branct 2

Division of Project Managemt

Enclosure:

Requests for Additional Information ces w/ enclosure:

See next page 8002140 O

Mr. N. L. Stampley JAN 2 21980 Mr. N. L. Stanpley Vice President - Production Mississippi Power and Light Canpany P. O. B ox 1640 Jackson, Mississippi 39205 ces: Mr. Robert B. McGehee, Attorney Wise, Carter, Child, Steen and Caraway P. O. Box 651 Jackson, Mississippi 39205 Troy B. Conner, Jr., Esq.

Conner, Moore and Corber 1747 Pennsylvania Avenue, N. W.

Washington, D. C.

20006 Mr. Adrian Zaccaria, Project Engineer Grand Gulf Nuclear Station Bechtel Power Corporation Gaithersburg, Maryl and 20760

013.1 GENERAL You state in your Fire Hazards Analysis how various safety-related cable trays, conduit and equipment are separated by distance from its redun-dant counterpart, and the criteria that were used to establish barriers between these redundant trains.

However, it is essential that your fire hazards analysis also include the effects of postulated exposure fires involving permanent and/or transient combustibles (exposure fires) on systems, circuit cable trays or equipment required for sa fe plant cold shutdown which are separated only by distance (no fire barriers and with redundant trains 20 ft, or less from each other, as you listed in page 9A-21 o f the FHA).

Redundant trains within 20 ft. of each other, as a minimum, will be required to be protected by a nai f hour fire rated barrier as well as area automatic sprinklers.

This does not mean that in some instances, redundant trains separated by more than 20 ft. will not require additional protection.

In the fire hazards analysis your need to demonstrate assuming, f ailure of the primary suppression system, a fire on ins'talled or transient combustibles will not result in the loss of capability to achieve safe cold failure of the primary suppression system, a fire on installed or transient combustibles will not result in the loss of capability to achieve safe cold shutdotm. Where this cannot be demonstrated, an alternate means of assuming safe plant shutdown (cold shutdown) should be provided. Alternate shutdown will most likely be required for areas such as the upper and lower cable spreading rooms, and rooms 0C 205 and OC 208.

.~

m me

Demo.:s tra te :

(1) Safe shutdown from the main control room where a fire disables any remote shutdown panels, or any safe shutdown equipment inchtding conduit / cable trays controlled from remete locations.

(2) Safe shutdown from remite locations when the main control room is uninhabitable due to a fire or when fire disables safe shutdown equipment or cables in the cable spreading areas or rooms listed on your FHA page 9A-21.

Alternate shutdown capability need only be provided for the essential instrumentation, controls and equipment necessary to bring the plant to a hot standby condition.

Fire damage to systems necessary to achieve and maintain cold shutdown should be limited so that repairs can ce made and cold shurdown condition achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Attached (Enclosure 1) are our guidelines for alternate shutdown systems.

013.2 Page 9A-11, 3.0 Scope You state that only areas in seismic Category I structures were reviewed.

Show that any fire (transformer fire, hydrogen fire, storage fire, et:.1 outside of these seismic Category I structures will not prevent the plant from achieving safe cold shutdown.

013.3.

Page 9A-59, Item 7.2.2.13 It is our position as stated in Section C.6 g of STP APCSS 2.5-1 that the loss of the ventilation system to any safety-related battery roca should be alarmed and annunciated in the control room.

e

_3-013.4 Page 9A-60, Item 7.2.2.11 You state in your FHA that, "the complete operative loss of the emergency remote shutdown panels due to a possible fire could impair safe-shutdown ca pa bil i ty. "

It is our position that safety-related circuits in the control room and remote shutdown panels be isolated from each other such that the complete loss of one set of panels will not prevent from achieving safe shutdown.

Show how you will comply with this position in all affected areas of the plent.

013.5 Page 3A-73, Item 7.2.2.43 (a)

Provide details on the type and numoer of portable Class A and Class C fire extinguishers in the control room comclex.

(.b )

It is our position that you comply witn Section F.2 of STP APCSB 9.5-1, Appendix A, in that the concealed ceiling space should have fixed automatic total flooding Halon protection.

(c) Verify that the outside air intake (s) for the control room ventila-tion system are provided with smoke detection capability to alarm in the control room to enable manual isolation of the control room ventila-ion system and thus prevent smoke from entering the control room.

~

-4 013.5 Page 9A-74 Power Generation Control Complex (PGCC)

Verify that you comply with the interface requirements of NEDO 10466,

" Power Generation Control Complex Cesign Criteria and Safety Evaluation."

013.7 Page 9A-82, Item 7.2.3.2 Provide an automatic sprinkler system and a fire detection system to pre-tect each reactor coolant pump.

Verify that an adequate drainage system will be provided for all the runoff water.

013.8 Taole 9A-1, Sheet 5, Item D.1 (a)

It is our position that you comply with Section C.5.a.1 of BTP A?CSB 9.5-1 in that area fire detection systems should be provided for all areas that contain safety related equioment.

Show how you will comply with this position.

(b)

It is our position that you comply with Section E.1.a of BTP APC3B 9.3-1, Appendix A, in that each fire detection system should be equipped with an audible and visual alarm and annunciate in the centrol room.

Local audible alarms should also ce provided.

Show how you will concly wi:n this position, 013.9 Table 9A-1, Sheet 6, Item D.l(j)

Substantiate the fire resistance capability of the following items as they pertain to safety-related areas or high hazard areas by verifying that their construction is in accordance with a particular design that has been fire tested.

Identify the design, the test method used and the ac:ectance criteria.

5-(1 )

Rated fire barriers, including floor and ceiling cons

. tion and their supports, (2)

Fire damcers and fire doors, as well as how they are installed in the ventilation ducts that penetrate rated fire bar-f ers of safety-related areas; and (3)

Fire barrier penetration seals around ducts, pipes, cables, cable trays and in other openings (e.g. concrete joints sealers and fillers).

Verify that all seals are of the thickness specified in the tests, and tna: cables and cable trays are supported in a mann e similar to supporting arrangements used in any tests.

013.10 Table 9A-1, Sheet 7, Item D.3(c)

You state that water spraying onto cable trays wodd cause e ictrical faults at the cable termination points.

It is our position that yt comply with Section D.3.c of BTP APCSB 9.5-1, Appendix A, in na cabic ays should be designed to allow wetting down with deluge water witnout ele :rical faulting (i.e. use weatherproof terminal boxes or cabinets, if necessary).

013.11 Table 9A.1, Sheet 13, Item D.5 It is our position that you comply with Section 0.5(a) of BTP APCSB 9.5-1, Appendix A, in that a fixed emergency lighting sys em consisting of sealed beam units with individual (3-hour minimum) battery pcwer supplies be installed in all areas required for safe shutdown operations, including access and egress routes.

Verify that you will comply with our position.

f }h um, >

ff D

wk

1 013.12 Table 9A.1, Sheet 14. Item E.1(d)

Demonstrate that primary and secondary power for the alarm system can be maintained by; Using normal offsite power as the primary supply, with a 4-hour battery a.

supply as the secondary source.

b.

Having the capability for manual connection tc the Class lE emergency power bus within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of loss of offsite power.

013.13 Table 9A.1, Sheet 14 Item E.2(e)

Varify that the fire pumps can provide, in accorda ice with STp 9.5-1 Section 5.b.5, the largest firewater flow and pressure (based on 500 gpm for manual hose streams plus the largest design de anc of any sorinkler or deluge system as determined in accordance witn ';:3A 13 or NFPA 15) with the largest fire pump out of service.

..h Table 9A.1, Sheet 16, Items E.4 and E.5 For all Halon and CO suppression systems provide tne concentration and 2

soak time.

013.15 Table,9A.1, Sheet.19 Item F.14 Verify that the radwaste building is separated frem other areas of the plant by fire barriers having at least three-hour fire ratings.

7 013.16 Fire Frotection Program Procedures - General Verify that the plant fire brigade:

(1 ) Consists of five members during all shifts.

(2 )

Confirm that the fire brigade provides for local fire department participation in drills at least annually.

013.17 Page 93-24, Item 2.9.4,b.1 Two spare air bottles for each breathing unit are insufficient.

It is our position that you comply with Section 0.4.h of BTP APCSB 9.5-1, Appendix A, in that, in addition to the two spare air bottles, an onsite six hour sucply of reserve air should be provided and arranged to permit quick and c mplete replenishment of exhausted supply air battles as they are returned.

If compressors are used as a source of breathing air, only units approved for breathing air should be used, compressor should be operable assuming a loss of offsite power.

Special care must be taken to locate the compressor in areas free of dust and containments.

Indicate how you.will comply with this position.

O l

&C.arde STAFF POSITION SAFE SHUTOCWN CAPABILITY Staff Concem

uring the sta'"s evaluation of ' ire protection cregrams at

erating clants, one or more scecific clan; areas may be identi#ied in anien tne staff Oces not nave acecuate assurance nat a :cstala ed

' ire will not damage both reduncant divisions of shutcown sys* ems.

31s lack of assurance in safe snute:wn ca ability nas resulted m cne or bc:h of me folicwing situatiens:

Case A: The licensee has not adequately identified te systems arid ccmcenents recuired for safe snutdcwn and their location in scecific # ire areas.

Case 3: The licensee has not demonstrated nat the fire protection for specific olant areas will revent damage :: both redundant divisions Of safe shut cwn ccmconents icentified in these areas.

Ice Case A, the staf# has recuired that an acecuate safe shutd wn analysis be performed. This evaluation incluces ne identi#ica:icn Of ne systems required 'or safe snu:dewn anc re i:caticn of e

system c:mcenen s in ne clant. Where it is de emined by this avaluation mat safe snuncwn c mocnents of : = recundant divisiens tre located in ne same ' ire area, 2e If ensee 's recuired to :em::ns:rt e Ma 3 :cstulated fire will net damage boa divisi:ns or pr:vice al ema:e snute:wn cacability as in Case 3.

~ j....%

For Case 3, the staff mayJave recuired that an altemate shutd:wn

acacility be proviced C-is inde endent of me area of cencern 3r the licensee may have precosed such a cacacili y 'n lieu of

er ain additicnal fire protecti:n modifica:icns in 2e area. Tne s:ecific modifications associated with :ne area of c:ncern along wita

rer systems and ecui: ment alreacy inde:endent of me area fom te al tamate snut:cwn ca:abili ty.

For eacn slant, ne mocificati:ns neecec and

ne :: ::inaticns of sys: ems wnicn rovide ne snutdcwn functicns ay :e unicue for eacn critical area; hewever, the snutdcwn functions :rovided sneuld maintain plan arameters witnin me bcunes of :he limiting sa'ety consecuences deemed acceptacle for the design basis even:.

Staf' ?csition i

Safe snutcewn cacacility snculd be demcnstrated (Case A) or alternate shutdcwn cacability crovided (Case 3) in accordance with te guidelines cr0vided :elow:

1. Cesien Basis Event The cesign tasis event for considering the need for alterna:e snu::cwn is a cs:ulated # ire in a scecific fi'e area centaining recuncant safe snu:::wn cables /ecuipment in close proximity nnere s

a it nas been deternined nat fire protection means cannot assure nat safe shutdown capacility will te preserved. Tuo cases snould be considered: (1) offsite pcwer is availaole; and (2) offsite power is not availacle.

2-r

2. Limitine Safety Consecuences and Recuired shutdewn Functions 2.1 No fissicn product bcundary integrity shall be affected:

a.

No fuel clad damage; b.

No rupture of any primary c:olan: :oundary; c.

No ructure of the c:ntainment boundary.

2.2 The reactor coolant system : recess variables shall be within those predicted for a loss of normal ac pcwer.

2.3 The alternate shutdewn capacility snall be aole to acnieve ano maintain succritical conditions in :ne reactor, maintain reactor coolant inventory, achieve and maintain hot standby * ::nditiens (hot shutdewn' #ce 4 SWR) for an extended period of time, achieve cold shutdown

• c:nditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain cold shutdcwn c nditicns tnereafter.

As cefined in :ne Stancard Tecnnical Soecifications.

3. Performance 1cals 3.1 The reactivity c:ntro', functi:n snall be :aca:le of achieving and maintaining Ocid shutdcwn reactivity ::ncitiens.

)j 3.2 The react:r ::clant makeuo #uncticn shall be cacaole of maintaining :ne reac:ce c:olant level above One top of the core for 3WR's and in the pressuri:er for PWR's.

3.3 The reactor heat removal function shall be cacable of acnieving and maintaining decay heat removal.

3.4 The process menitoring functicn snail be ca:acle of

reviding direct readings of the process variables necessary to :er#crm and c:ntrol ne a:ove functions.

3.5 The succerting function-shall be ca:able of providing the crocess c: cling, lubricatien, etc. necessary to permit

ne coerati:n of the equipment used fer safe snutdown by the systers identified in 3.1 - 3.4

.3.5 The equi rent and systers used to acnieve and maintain hot stancby ::nditions (hot snJ::cwn # r a BWR) snould be (1) free of ' ire damage; (2) cacable of maintaining such c nditicas for an extended time :eriod lenger than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if :ne equi: ment required to achieve and maintain cold snutdown is no available due to fire camage; and (3) powered by an ensite emergency power system.

3.7 The equicment and systems used to achieve and maintain cold snutdcwn ::nditions shculd be es:ner free of fire damage or One fire damage to such systems snould ce limited sucn that recairs can be made and cold shutd:wn c:nditions acnievec within 72 hcurs.

Equi: ment and systems used criar to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the fire should be pcwered by an ensite cmergency ocwer system; :ncse used after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> gay be pcwered by a

3 offsite pcwer.

3.3 Bese systems need not be designed to (1) seismic categer/ !

criteria; (2) single f ailure criteria; or (3) cooe witn o:ner plan: accidents sucn as pi:e :reaks er stuck' valves

. Ap;endix A STp 9.51), except Onese :crtiens of these systems wnich interface with or impac existing safety sys: ems.

a. :WR E uiceent C-enera11v Necessar/ For Hot Standby (1) eactivity C ntrol Reactor trip capability (scram). Bora:icn ca: ability e.g.,

enarging pump, makeup pump or hign pressure injection pumo taking suction from concentrated berated water sucolies, and letdown system if. required.

(2) eactor Ccolant Makevo Reactor coolant T.akeuo capaoility, e.g., enarging :ue:s or the hign Oressure injecticn :um:s.

Pcwer Ocerated -ei f ef valves may be re:uired to reduce pressure : alicw use Of :ne hign ressure injection :um:s.

,, lant Svstem 3-essure Centrol D

(3) React:r

)

Reactor pressure c ntrol ca acility, e.g., cnarging :um:s s

or pressurizer heaters and use of the le::cwn systems if required.

(4)

Cecay Heat Removal Decay heat removal capability, e.g., Ocwer ::erated relief valves (steam generator) or safety relief valves f:r iea:

removal with a water sucoly and e-ergency or auxiliary feecwater cumos f:r makeuo Oc tne steam generat r.

Ser< ice water or c:Mer :um s may be required c provide water #:e auxiiiary feed uma sucticn if the c ndensate storage tank ca:acity is not adequate for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

enitorine !nstrumentatien

-(5)

P-0 cess v 3 ocess T.cnitoring cacaci'ity e.g., pressuri:er :ressure and

'evel, steam ger. era:ce ievel.

(5) Sucocrt.

Tne ecuipment required := succort vperaticn of the above described shutdcwn ecuiement e.g., c mconen cooling na:er service water, etc. and cnsite gewer sources ( AC, :C) ni:n

neir associated electrical distribution system.

l 5. PWR Ecui: ment Generally Necessary 'er Cold Shutdewn*

(1)

Reac ce Cool _ art _ System Pressure Reductien to Residual Meat Removai Systeg RHR) Cacas111:v Reactor cou. ant system :ressure educticn by c:olcewn using steam generator pcwer :erated relief /alves or a:m spneric cump valves.

(2) Cecay wen: Removal Cecay neat removal cacability e.g., residual heat rem 0 val system,, ccmconent cooling water system and service sa:er system to removal heat and maintain cold snut:cwn.

(3) Succort Succor: cacability e.g., ensite :cwer scurces ( AC 1 DC) or offsite after 72 hcurs and One associated electrical cistribution system to su:oly tre acove equi: rent.

E:ui: ment necessary in additien :: tra; alreadv Orovidec : ain ain not s:andby.

5. 3WR I;ui men 3enerallv Necessa-v :ce -c; Shut: wn (1)

Reactivi ty C:ntrol Reactor trip capability (scram).

(2)

Reac;cr C clan Makeuo

eactor c olant inventory makeu: cacaoility e.g., eac: r ::re isolation :coling system (RCIC) or :ne nign pressure ::alant injection system (HPCI).

(3)

eactor Pressure Centrol anc Decav 2 eat Removal

eoressuri:stien system valves :r safety relief valves # r dumo to :ne suppression ; col. The residual heat removal system in steam condensing mace, and service water system may also te used for nea: removal to the ultimate tel: sink.

(a)

Suceression : col Cooling Residual heat removal system (in suceression ecol :: cling mede) service water system to maintain hot shutdcwn.

(5) Frecess Vcnitoring

rocess scnitoring cacability e.g., react:r vessei level and Oressure and suceressi:n Occi temoerature.

t s

I

. 7

./

(6) Sue:or:

Succort cacability e.g., ensite acwer source (AC 5 C) and

neir associated distributien sys: ems to crevide f:r tne shutdcwn equipment.

7. 3WR Ecuitment Generallv Necessary For Cold Shutdewn*

At this :oint ne e ui: ment necessary for not snutdown has reduced

ne primary system cressure and temcerature to wnere the P.FR system may be placed in service in RER cooling mece.

(1)

ecav Heat Demoval Residual heat removal system in the RHR ::aling mcde, service water system.

(2) Succor

nsite scur:es ( AC & C) or offsite af ter 72 heurs and their ass:ciatec distributi:n systems :: rovi:e for shutcown equipment.

Equi: ment pr0vided in accitien to :na: for acnieving sc: snu::cwn.

3. Infor ation Eecuired :or Sta## Oevi ew w

(a)

escriptien of the systems or ;ortions nereof used to crovide the snutdown ca ability and mocifications recuired to acnieve ne alternate snutdown cacacility if recuired.

~

(b)

System design by drawings wnich snew 1creal and alterna:e snut:cwn c:ntrol anc ;cwer circuits, I ca:icn Of c:mpenents, and that wiring wnich is in he area anc :ne wiring wnicn is out of :ne area :nat recuired the alternate system.

(c) Verification ina: cnanges to safety systems will c. :

egrace safety systems.

(e.g., new isolation swit:r.es and ::ntrol swit:nes should. meet :esign criteria and standards in F5AR for electrical ecui: ment in :ne system that the switch is to be installec; :acinets ina: One swit:nes are to be mcunted in should also meet one sare criteria (F5AR) as other safety related cacire:s and

anels; to avoid inacvertent isolation f-em ne ::n:rol ecem, :ne isol.ation switcnes should be keylocked, Or alarmed in the :cntrol reem if in the " local" or " isolated" :osition.

eriodic checks shculd be made to verify switch is in :ne 3rcoer position fer normal oceration; and a single transfer switen er o:ner new device should not be a scur:e #cr a single failure to :ause ! css of reduncant sa#ety systems).

(0) Verifica:icn :na: wiring, inclucing : wer sources #cr :ne

ntrol circui: and ecui: ment oceration for the alternate

~'

snutdcwn me nod, is ince:encent of ecuicmen; wiring in

ne area to be avoided.

e e

.e i

• (e) Verificatten that alternate shutdown pcwer sources, including all breakers, have isolation devices en centrol circuits

ntt are routed througn the area to be avoided, even if the breaker is to be cpera:ed manually.

C') Verificatien :nat licensee precedure(s) have been develoced wnich describe :ne tasks to be :erformed to ef#ect the snut cwn me thod.

A summary of these procedures shculd te reviewed by the staff.

(g) Verification na: scare fuses are available 'or control circuits wnere :nese fuses may be recuired in su: plying

?cwer to c:ntrol circuits used for :ne snutdcwn metnod and may be bicwn by the effects of a caole spreading reem fire. The spare fuses snculd be lccated convenient Oc the existing fuses. The shutdown crecedure shculd inform :ne ::erator to check :nese fuses.

(n) Verificati:n :Nat the man:cwer recuired ic :erform tne snutdown functi:ns using One :recedures of (f) as well as to rovide fire brigade em:ers :: #i;n: :ne #4re is availacle as required by :ne fire Ori; ace :acnni:al s:eci fica:i cns.

't)

Verificati:n :na: adecuate ac:e::ance es:s are :erfor ed.

These snculd verify that: ecui:ren ::erates from the local c:n:rol statien wnen :ne transfer :r isolation switta is 31 :ed in :ne

• local" positien and :nat ne equipment canne. be c erated fecm the control recm; and tnat ecuia-men t cerates from the centr:! -Ocm :ut :annot be ccerated at ths local centrol station when :n? Oransfer or isolation switcn is in the " remote" posi:icn.

(j)

Technical 5:eci'icatiens Of the surveillance recuirements and limiting ::nditiens 'Or Oceration f:r :na ecuieren; no: alreacy ::vered by existing Tecn. Scecs.

cr exam le, if new isola:icn and c:n:rol swit:nes are accec to a servi:e water system, the existing Tech. Scec. surve111ance recuire-ments en :ne service water sys:em snculd acd a statement similar :: :ne folicwing:

"Ever/Mird :umo test snculd also /erify :na: the :uma starts fr:m the alternate shu:::wn station af ter moving all service sa:er system isolaticn switenes to the local control positicn.*

(k) Verifica:icn :nat the systems availa' le are adequate to :erf:rm the necessary shutdown functions.

' he functions recuired sneuld be :asec en previcus analyses, i' pessible (e.g.,

in :ne 5AR), sucn as a less of normal a.c. =cwer or snut:cwn on a Grouc I isolation (3WR).

The ecui ment recuired 'or :ne alternate :2:acility snould be :ne same er ecuivalent to

nat relied en in the above analysis.

e b

r t

9.

" 375I'53 m d 'el ced nd a e ia

. e re:af rs is.maf ntained on site.

.)

9 9

4 9

e

l 421.0 Quality Assurance 421.1 The Quality Assurance (QA) program for fire protection should (App. 9A) be under tae management control of the QA organization. This c,atrol consists of (1) formulating or verifying that a fire protection QA program incorporates suitable requirements and is acceptable to management responsible for fire protection; and (2) verifying the effectiveness of the QA program for fire protection through review, surveillance, and audit.

Revise Section C of Table 9A-1 in Appendix 9A to clarify that the QA program for fire protection is under the management control of QA, or provide an alternative position for the staff's evaluation.

421.2 Mr. Vassallo's letter of August 29, 1977 on fire protection (App. 9A) provides supplemental guidance on QA.

• 'odify Section C of Table 9A-1 in Appendix 9A to be responsive to the latest supplemental guidance on 2A for fire protection or provide an alternative for the staff's evaluation. We note that if the fire ;rotection QA pr: gram criteria are met as part of the QA prcgra-described in ::pical report '*,:L-TOP-1A, " Operational QA Manual." which meets Appendix B to 10 CFR 50, it is not necessary to submit a detailed description for NRC review.

9 l

422.0 Conduct of Operations 422.16 Identify the upper level offsite management position (s) which (App. 9A) has overall responsibility for the formulation, implementation, and assessment of the effectiveness of the station fire protection program.

422.17 Wile the Plant Manager is generally responsible for all activities (App. 9A) at the facility, describe any further delegation of these responsi-bilities for the fire protection program such as training, nintenance of fire protection systems, testing of fire protection equipment, fire safety inspections, fire fighting procedures, and fire drills.

422.18 Cescribe the authority of your Shift Fire Chief relative to that (App. 9A) cf your Shift Supervisors.

422.19 Cescribe the composition of your shift fire brigade in terms of (App. 9A) sumbers and job titles.

5 423.38 It has come to our attention that although some applicants had committed to Regulatory Guide 1.68, they did not intend to conduct full-load tests of some 4160-480 volt transformers supplying pouar to vital buses. Your test description in FSAR Chapter 14 does not contain suf ficient detail for us to detemine if you intend to conduct such a test.

It is our position that full-load tests of vital buses must be conducted including all sources of power supplies to the buses.

l'odify your test description tc indicate that this testing will be conducted in accordance with Regulatory Guide 1.68.

040.8r' S--*Mn 8.1.4.1.b of the FSAR says that there are three (3) physically (8.Ij independent circuits from the 500KV switchyard to the onsite electrical distribution system.

Figure 8.2-3 indicates that there are only two (2) circuits from the 500KV switchyard.

Cla rify.

040.81 In the first paragraph of FSAR Section 8.1.4.3 a " spare set of B0P trans-(8.1) formers" are mentioned. Are these in addition to those shown in Figure 8.1-1 or do you mean that these are included in the four BOP transformers shown (sucn as 80P XFMRS #12A and 12B)?

000.32 In FSAR Section 8.1.4.2.3.f it is stated that " provision is made for con-(8.1) trol (of the HPCS power system) from the control room and another locatial external to the control room".

Identify the other location.

040.83 SRP Section 8.1, III, 5, Revision 1, requires that criteria applicable to (8.1) the design should be identifief and the degree of conformance defined.

SRP Table 8-1 lists applicability of criteria to each FSAR section.

Each section of your FSAR Chapter 8 should mention confonnance (or exception)

all of the criteria of SRP Table 8-1.

This may be donc by a single comprehensive table in FSAR Section 8.1 which would be referenced by One sucsequent sections. Where exceptions, relative to the electrical power systems, are taken, these should be s3c_ifically noted and referenced to a detailed explanation.

! 040.84 In the table of contents of Appendix 3A, RG 1.93 is noted as "not (8.1)

App. 3A addressed in FSAR...." and RG 1.32 is noted a. N/A (page 3A-4).

However, in FSAR Section 8.1.4.4.1 and 3A/1.32-1, compliance with Regulatory Guides 1.93 and 1.32 is statad.

Correct Appendix 3A accordingly.

040.85 GDC-17 states that the safety function for each of the offsite systems (8.1)

(assuming the other system is not functioning) shall t,e to provide sufficient capacity and capability to assure that: (a) specified accep-table fuel design limits and design conditions for the reactor coolant pres-sure coundary are not exceeded as a result of anticipated operational cccurrences and (b) the core is cooled and containment integrity and other vita' functions are maintained in the event of the 00stulated accidents.

We require that the adequacy of the transformers (service and ESF) be verified by the voltage analysis at transient ano steady state. This is in order to assure that the transfomers are capable of starting and operat-ing the loads with the worst combined condition (the minimum expected grid voltage and the maximum combined loads).

?];36 3Rp Section 8.1, III,1 states that FSAR grid

...cescriptions should

.:. )

sta a whether facilities are existing or planned; if planned, the respec-tive completion dates should be provided." Drovide the completion status of the 500KV and ll5KV overhead lines.

040.87 Regulatory Guide 1.7', Revision 3, Section 8.2.2 specifies that the appli-(3.2) cant should " provide infomation and a discussion of grid availability, including the frequency, duration and cause of outages".

For the outage statistics given in AR Table 8.2-1, furnish the following infomation:

a) cause of each outage b) duration of each outage c) uodate the table to the present time

t f In FSAR Section 8.2.1.2 and Section 8.2.1.4 the acronym "tiAPSIC" is used.

040.88 (8.2)

Explain the meaning and the function of NAPSIC.

Explain how you comply with Regulatory Guide 1.3, revision 1, paragraph 040.89 (8.3)

C.9 with respect to first out alarm indication.

The chosen voltage setpoint and time delay associated with the undervoltage 040.90 (8.3) protection must assure that the safety related equipment is not subjected to a voltage below that recommended by the manufacturer and AftSI C84.1-1973 for a period of time long enough to cause malfunction and/or thermal Y

We require infomation regarding startingand operating characte'ristics, damage.

and themal capability of the safety related equipment in tems of the voltage current and time.

040.91 In the FSAR paragraph 8.3.1.1.4.2.10 it indicates :nat generator dif-(8.3) ferential current and engine overspeed are the only emergency protective devices for the HPCS diesel.

Figure 8.3-8 of the FSAR shows that lube oil pressure low (2 of 3 logic) and case pressure high (2 of 3 logic) also operate protective interlocks during an emergency for division I and II.

If this logic diagram also applies to the HPCS diesel exclain the discrepancy or provide the logic diagram for the HPCS diesei.

0a0. 92 FSAR Section 8.3.1.1.5.1 in de:cribing the RPS power supply states that (8.3)

...the power fecas to independent divisions are physically separated and feed four redundant buses." FSAR Figure 8.3-11 shows only two buses, "A" and "B".

Correct the contradiction.

1 043.93 In FSAR Table 8.2-3 " Lead Flow Studies" and Table 8.2-4 " Stability (8.2)

Studies", the results of analysis of contingencies and faults are stated as "no problem" and " stable". Define these terms more explicitly so as to provide greater assurance of the results of the analysis. Provide mini-mum or maximum voltage, transient durations, and other quantitative values to substantiate the conclusions drawn in Table 8.2-3 and 8.2-4.

040.94 Clarify the description in FSAR Section 8.2.1.2, regarding alarms for the (8.2) various problems that could occur involving the switchyard auxiliary sys-tems.

Identify the alarm indication and its location.

040. 95 In Section 8.2.1.1 on page 8.2-2, it is stated that "The ll5KV line does (8.2) not cross over or under any of the 500KV offsite power supply lines...".

However, from Figure 8.2-2, it appears that the 500KV line from Franklin to Grand Gulf does cross over the ll5KV line between Natchez S.E.S.

and Port Gibson. Confirm that it does or does not cross.

Provide further information on grid stability at Grand Gulf if the above mentioned 500KV line fell on top of the ll5KV line.

?j^. ~5 FSAR Section 8.3.1.1.4.1 page 3.3-11 provides information en centrols for

.2) diesel generators. Clarify the statement concerning the number and loca-tion of the local control stations for each diesel generator.

CaC. 97 Describe the actions and coerations you take to assure that a diesel generator (3.3) will respond to an automatic start signal after completion of and during a periodic test. Address the following:

Governor control settings Monitoring of Diesel Generator Sync-Speed setting

. C40.102 in FSAR Section 8.3.1.1.4.1.1.a.2 7 age 8.3-12, it a: pear: that the resisu ve (8.3) load was omitted from the tabulatet data in test 2; clarify. Also, provide the analytical method for obtaining the cumulative loads.

040.103 The load shedding and sequencing rtset operation is mentioned in Section (2.3) 8.3.1.1.3 page 8.3-5.

Regarding restoring of motors and valve operations following loss of offsite power, chrify and expand the description regard-ing reset operation since you state that, " reset is not a function of the I

presence or absence of bus voTtage".

040.104 In Table 8.3-5 of FSAR, it is statzd that the diesel generator start (3.3) signal is given at time 3 seconds follcwing LOCA.

In Table 6.3-1 the diesel generator start signal is gt/en at time 0 seconds.

Correct this discrepancy.

040. 105 Operating experience at certain nelear power plants which have two (3.3)

RSP cycle turbocharged diesel engines anufactured by the Electromotive Division (EMD) of General Motors driving emergency generators have experienced a significant number of turbocharger mechanical gear drive fail ures. The failures have occurred as the result of running the emergency diesel generators at no 1 sad or light load conditions for extended periods. No load or lightload operation could occur during periodic equipment testing or during accident conditions with availability of offsite power. When this equipment is operated under no load conditions insufficient exhaust gas volume is,enerated to operate the turbocharger.

s As a result the turbocharger is drien mechanically from a gear drive in order to supply enough combusion air to the engine to maintain rated

t

' 040.102 In FSAR Section 8.3.1.1.4.1.1.a.2 page 8.3-12, it a;: pear: that the resistive (8.3) load was omitted from the tabulated data in test 2; clarify. Also, provide the analytical method for 7btaining the cumulative loads.

040.103 The load shedding and sequencing reset operation is mentioned in Section (3.3) 8.3.1.1.3 page 8.3-5.

Regarding restoring of motors and valve operations following loss of offsite power, clarify and expand the description regard-ing reset operation since you state that, " reset is not a function of the presence or absence of bus voltage".

040.104 In Table 8.3-5 of FSAR, it is stated that the diesel generator start (8.3) signal is given at time 3 seconds following LOCA.

In Table 6.3-1 the diesel generator start signal is given at tir.e 9 seconds. Correct this discrepancy.

040. 105 Operating experience at certain nuclear power plants which have two

( 8. 3 :.

RSP cycle turbocharged diesel engines manufactured by the Electromotive Division (E.MD) of General Motors driving emergency generators have ex:erienced a significant number of turbocharger mechanical gear drive failures. The failures have occurred as the result of running the emergency diesel generators at no load or light load conditions for extended periods. No lead or light load operation could occur during periodic equipeent testing or during accident conditions with availability of offsite power. When this equipment is operated under no load conditions insufficient exhaust gas volume is generated to operate the turbocharger.

As a result the turbocharger is driven =echanically from a gear drive in order to supply enough combusion air to the engine to maintain rated

. speed. The turbocharger and mechanical drive gear normally supplied with these engines are not designed for standby service encountered in nuclear power plant application where the equipment may be called upon to operate at no load or light load condition and full rated speed for a prolonged period. The EMD equipment was originally designed for locomotive service where no load speeds for the engine and generator are much lower than full load speeds. The locomotive turbocharged diesel hardly ever runs at full speed except at full load. The EMD has strongly recommended to users of this diesel engine design against operation at no load or light load conditions at full rated speed for extended periods because of the short life excectancy of the turbocharger mechanical gear drive. unit normally furnished. No load or light load operation also causes general deterioration in any diesel engine.

To cope with the se are service the equipment is normally subjected to and in the interest of reducing failures and increasing the availability of their equipment EMD has developed a heavy duty turbocharger drive gear unit that can replace existing equipment. This is available as a replacement kit, or engines can be ordered with the heavy duty turbo-charger drive gear assembly.

To assure optimum availability of emergency diesel generators en demand, Apolicant's who have on order or intend to order emergency generators driven by two cycle diesel engines manufactured by EMD should be provided with the heavy duty turbocharger mechanical drive gear assembly as recommended by EMD for the class of service encountered in nuclear power plants. Confirm your compliance with this recuirement.

040.106 Provide a detail discussion (or plan) of the level of training proposed (3.3) for your operators, maintenance crew, quality assurance, and supervisory personnel responsible for the operation and maintenance of the emergency diesel generators. Identify the number and type of personnel that will be dedicated to the operations and maintenance of the emergency diesel generators and the number and type that will be assigned from your general plant operations and maintenance groups to assist when needed.

In your discussion identify the amount and kind of training that will be received by each of the above categories and the type of ongoing training program planned to assure optimum availability of the emergency generators.

Also discuss the level of education and minimum ex:erience requirements for the various categories of operations and maintenance personnel associated with the emergency diesel generators.

040.107 Periodic testing and test loading of an emergency diesel generator 13.3)

Sp in a nuclear power plant is a necessary function to demonstrate the Periodic ocerability, capability and availability of the unit on demand.

• ~ing coupled with good preventive maintenance practices will assure op imum equipment readiness and availability on de:.and. This is the desired goal.

To achieve this optimum equipment readiness status the the following recuirements should be met:

_9 1.

De equipment should be tested with a minimum loadtng of 25 percent of rated load. M lead or light load operation wiil cause incomplete combustion of fuel resulting in the formation of gum and varnish deposits on the cylinder walls, intake and exhaust valves, pistens and piston rings, etc., and accumulation of unburned fuel in the turbocharger and exhaust system. The consequences of no load or light lead operation are potential equipment failure due to the gum and varnish deposits and fire in the engine exhaust system.

2 Periodic surveillasce testing should be performed in accordance with the applicable NRC guidelines (R.g.1.108), and with the recommendations of the engint manufacturer. Conflicts between any such reccmmendations and the NRC guidelfnes, particularly with resoect to test frequency, hading and duration, should be identified and justified.

3.

Preventive maintenance should go beyond the normal routine adjest-ments, servicing and repair of components when a malfunction occurs.

Preventive mainterance should encompass investigative testing of comconents which have a history of repeated malfunctioning and require constant a :en: ton and repair. In such cases consideration should be given to replacement of those components with other

r

ducts which have a record of demonstrated reliability, rather than recetitive repair and maintenance of the existing components. Testing of the unit after adjustments or repairs have been made only confirms that the equipment is operable and does not necessarily mean that the root cause of the pr:biem has been eliminated or alleviated.

4 Upon completion of repairs or maintenance and prior to an actual start, run, and load test a final equip =ent check should be made to

. assure that all electrical circuits are functional, f.e., fuses are in place, switches and circuit breakers are in their proper position, no loose wires, all test leads have been removed, and all valves are in the proper position to permit a manual start of the equipment. After the unit has been satisfactorily started and load tested, return the unit to ready ~ automatic standby service and under the control of the control room operator.

Provide a discussion of how the above requirements have been implemented in the emergency diesel generator system design and how they will be considered when the plant is in commercial operation, i.e., by what means will the above requirements be enforced.

040.108 Tne availability on demand of an emer,ency diesel generator is (8.3)

RSP dependent upon, among other things, the proper functioning of its controls and monitoring instrumentation. This equipment is generally panel mounted and in some instances the panels are mounted directly on the diesel generator skid, Pajor diesel engine damage has occurred at some operating plants from vibration induced wear on skid mounted control and monitoring instrumentation his sensitive instrumentation is not made to withstand and functiot ately for prolonged periods under continuous vibrational stresses nor. ally encountered with internal combustion engines. Operation of senstive instrumentation under this environment rapidly deteriorates calibration,. accuracy and control signal output.

~

Therefore, except for sensors and other equipment that must be directly mounted on the engine or associated piping, the controls and monitoring instrumentation should be installed on a free standing floor mounted panel separate from the engine skids, and located on a vibration free floor area or equipped with vibration mounts.

Confinn your compliance with the above requirement or provide justification for noncompliance.

3 3.109 Exrand your discussion in paragraph 9.5.4 to include :he following (9.5.4) information for eacn type of engine:

1.

Useable capacity of the fuel oil s:orage tank 2.

Minimum capacity of the fuel oil storage tanks for post LOCA load demands.

. M0.110 The diesel generators are required to start autor.atically on loss of

'9.5.5) all offsite power and in the event of a LOCA. The diesel generator sets should be capable of operation at less than full load for extended periods without degradatton of performance or reliability. Should a LOCA occur with availability of offsite power, discuss the design provisions and other parameters that have been considered in the selection of the diesel generators to enable them to run unloaded (on standby) for extended periods without degradation of engine perfor.ance or reliability.

Expand your PSAR/FSAR to include and explicitly define the capability of your design with regard to this requirement for the "?CS diesel generator.

(SRP 9.5.5, Part III, Item 7).

-f' Previous question 040.55, part 3, askee ir your provision for removing 3

moisture in the HPCS diesel generator air starting system. Since this question was asked, a study by the University of Dayton has shown that accumulation of wacer in the starting air system has been one of the most requent causes of die el engine failure to start on demand. Condensation e

of entrained moisture in compressed air lines leading to control and starting air valves, air start motors, and condensation or moisture on the working surfaces of these components has caused rust, scale and water itself to cuild up and score and jam the internal working parts of these vital com-ponents thereby preventing starting of the diesel generators.

8 In the event of loss of offsite power the diesel generators must function since they are vital to the safe shutdown of the reactor (s). Failure of the diesel enc 4:.s tt start from the effects of meisture condensation in air starting systems a d from other causes have lowered their operational reliability to substantially less than the desired reliability of 0.99 as specified in Branch Technical Position ICSS (PSB) 2 " Diesel Generator Reliability Testing" and Regulatory Guide 1.108 " Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants."

In an effort toward improving diesel' engine starting reliability we require that compressed air starting system designs include air dryers for the removal of entrained moisture. The twc # air : yers most commonly used are the dessicant and refrigerant types. Of these two types, the refrigerant type is the one most suited for this application and therefore is pre-ferred. Starting air should be dried to a dew point of not more than 500F when installed in a nor. ally controlled 700F environment, otherwise the starting air dev point should be controlled to at least 100F less than the lowest excected ambient temperature.

Revise your design of the diesel engine air starting system accordingly, describe this feature of your design.

f

$ 040.112 Several fires have occurred at some operating plants in the area of

'?.5.7)

Sp the diesel engine exhaust manifold and inside the turbocharger housing which have resulted in equipment unavailability. The fires were started from lube oil leaking and accumulating on the engine exhaust manifold and accumulating and igniting inside the turbocharger housing.

Accumulation of lube all in these areas, on some engines, is apparently caused from an excessively long prelube period, generally longer than five minutes, prior to manual starting of a diesel generator.

This condition does not occur on an emergency start since the prelube period is minimal.

When manually starting the diesel generators for any reason, to minimize the potential fire hazard and to improve ecuip.en availability, the prelube period should be limited to a maximum of three to five minutes unless otherwise recomended by the diesel engine manufacturer. Confirm your compliance with this requirement or provide your justification for requiring a longer prelube time interval perior to manual starting of the diesel generators. Provide the ;relube tfee interval your ciesel engine will be exposed to prior to manual start.

. 040.113 An emergency diesel generato unit in a nuclear power piant is normally (9.5.7)

RSP in the ready standby rede unless there is a loss of offsite power, an accident, or the diesel generator is under test. Long periods on standby have a tendency to drain or nearly empty the engine lube oil piping system. On an emergency start of the engine as much as 5 to 14 or more seconds may elapse from the start of cranking until full lube oil pressure is attained even though full engine speed is generally reached in about five seconds. With an essentially dry engine, the momentary lack of lubrication at the various moving parts ecy damage bearing surfaces pro-ducing incipient or actual component failure with resultant equipment unavailability.

The emergency condition of readiness requires this eouipment to attain full rated speed and enable automatic sequencing of electric load within ten seconds. For this reason, and to improve upon the availability of this equipment on demand, it is necessary to establish as quickly as possible an oil film in the wearing parts of the diesel engine. Lubricating oil is nor ally delivered to the engine wearing parts by one or more engine driven pu==(s).

During the starting cycle the pump (s) accelerates slowly with the engine and may not sup:ly the required quantity of lubricating oil where needed fast enough. T: remedy this condition, as a minimum, an electrically driven lubricating oil pump, powered from a reliable DC pc-supply, should be installed in the lube oil system to operate in parallel with the engine

f L t.

driven main lube pump. The electric drisen prelube pump should operate onlyduring the engine cranking cycle ur untti satisfactory lube oil pressure is established in the engine main lube distribution header.

The installation of this prelube pump should be coordinated with the respective engine manufacturer. Some diesel engines include a lube of f circulating pump as an intregal part of the lube oil preheating system which is in use while the diesel engine is in the standby mode.

In this case an additional prelube oil pump may not be needed.

Confirm your compliance with the above requirement or provide your justification for not installing an electric preluce oil pump.