ML20050B070

Forwards Responses to 811117 Request for Info Re Instrumentation & Control Sys,Per Reg Guide 1.118.Response Completes Action Items,Per 811216-17 & 820113-14,0217-18 Meetings

ML20050B070
Person / Time
Site:	Perry
Issue date:	03/22/1982
From:	Davidson D CLEVELAND ELECTRIC ILLUMINATING CO.
To:	Schwencer A Office of Nuclear Reactor Regulation
References
RTR-REGGD-01.118, RTR-REGGD-1.118 NUDOCS 8204020556
Download: ML20050B070 (75)

Text

{{#Wiki_filter:, a il Po DOA 's s.O e CL E VE L A P4D OH.o 44101 e TE.LE PnONE (2161622 9fs)0 e tLLUv;N ATiNG BLDG e 55.NBLIC SOU ARE 4 Datwyn R. Davidson M. t s+ 1 :. f,f r.T v, f t V 6 P.Gita f mP G A*,'; L L As fi4 Ut T K;N e 4 March 22, 1932 Mr. A. Cchwencer Chief, Licensing Branch I;o. 2 Division of Licensing U. C. Iluelear Regulatory Com:cission Washington, D. C. 20555 Perry Iluelear Power Plant Docket IIos. 50-4ho; 50-441 Eesponse to Request for Meeting - Instrumentation and Control Systems

Dear Mr. Schwencer:

This letter and its attachment is submitted to provide draft responses to several of the concerns identifed in your letter dated !!ovember 17, 1981. A meeting was held with members of the Instrumentation and Control Systems Branch on February 17 and '8 to discuss these concerns and identify action items. This submittal completes our responses to your letter of Ilovember 17, 1981, and the action items resulting from the meetings held on December 16 and 17, 1981; January 13 and 14, 1992, and February 17 and 18,1982. Very Truly Yours, e U Wn f Dalwyn 1. Davidson Vice President System Engineering and Construction DRD: mlb cc: Jay Gilberg , 1 John Stefano p Max Gildner g J. Mauck g .g-g g0 79 7 APR 011982P 61 \\ b u nm nu.m anas C s L ice amun m - 0-T14G s, / ~ g 82040205S6 820322 PDR ADOCK 05000440 A PDR

421.01 Section 7.1 of the FSAR contains no references to the branch technical positions listed in Table 7.1 of the Standard Review Plan. The FSAR should identify and justify any exceptions taken to these brancia technical positions. Also, Regulatory Guide 1.47 is repeated twice in Table 7.1 whereas Regulatory Guide 1.75 is not included.

Response

This item was discuared. See revised Table 7.1-3.

421.03 Various instrumentation and control system circuits in the plant (including the reactor protection system, engineered safety features actuation system, instrument power supply distribution system) rely on certain devices to provide electrical isolation capability in order to maintain the independence between redundant safety circuits and between safety circuits and non-safety circuits. Therefore, provide the following information: a. Identify the types of isolation devices which define the Class IE boundary for interfaces between the safety circuits. b. Provide the acceptance criteria for each isolation device identified in response to part a above. c. Describe the type of testing that was conducted on the isolation devices to ensure adequate protection against EMI (i.e., noise), short-circuit failures, voltage faults, and/or surges. fjesponse Two general types of devices; relays and optical isolators, are used to provide isolation between Class IE circuits of two divisions or between Class IE and Non-Class IE circuits. Relays Relays are used to provide contact to contact or coil to contact isolation. Relays qualified for use as isolation devices are tested to verify the relays will satisfactorily perform their Class IE safety functions under:

1) the full usage of input voltages at given environmental conditions 2) the full range input voltages for normal environmental conditions at given seismic "G" accelerations for individual locations within the plant.

T 421.03 Response (Cont'd) Tests are also performed to verify that. the relays can provide separation of their redundant segments so they can perform their safety-related functions in an intense fire. The test consists of generating a 10,000 Btu fire with a 600 C temperature spike in which each of the relay types utilized for isolation was immersed. Acceptance criteria is that a failure would not. occur in any of the contact or roil circuits. Test results have been acceptable for all relay types. gptical Isolators Optical isolators consist of a thermal barrier on both sides of which are positioned input and output. isolator cards. Each signal which is transmitted from the input. side to the output side is optically coupled by means of an LED, a quartz rod on a phototransistor. The quartz rod acts as a light pipe and provides a separation distance of approximately one inch between active components. The acceptance criteria for it.olator cards is their ability to provide electrical isolation to 5,000 V and to provide thermal isolation in terms of protection against the spread of fire. During testing input signals and power supplies are varied over their full range. These have been determined to be the only special condit. ions the isolators would experience during a DBE.

421.04 For several of the protection systems, Table 7.1.3 does not verify compliance with General Design Criteria 19, 20, 21, 22, 23, 24, and 29 as required by Table 7.1 in the Standard Review Plan. Provide justification as to why these criteria do not apply if, indeed, they do not.

Response

This item was discussed. See revised Table 7.1-3.

421.05 Discuss the design provisions for conducting response time tests in accordance with R. G. 1.118. Iduati fy safety-related systems that do not have provisions for response time testing. Discuss the techniques to be used to periodically measure safety-related sensor time responses.

Response

Perry will periodically conduct time response tests in accordance with R. G. 1.118. Time response testing of sensors will be conducted in conjunction with the testing of their respective safety-related { l instrumentation channels so that the time response characteristics of both the l l sensor and the entire channel can be verified to be within specified limits. Types of sensors to be time response tested include: } Resistance Temperature Detectors 2. Pressure Sensors 3. Differential Pressure Sensors All sensors required by Technical Specifications will be tested using a direct method for determining time response characteristics or by using an indirect method of equivalent validity. The specific measurement techniques to be used to determine the time response of the sensors are st.ill being evaluated. The following types of sensors will not be' time response tested due to the impracticality of insitu testing using present technology: 1. Thermocouples 2. Neutron tioni tors a. SRtis b. IRtis c. LPRtis

421.05 Response (Cont'd) All testing described above shall be conducted by a trained plant personnel as a part of the Perry Plant Time Response Testing Program. All equipment required for the testing program shall be maintained traceable to the National Bureau of Standards, The only safety related RTD's and TC's which are mounted in protecting a. wells are: 1. 1&2P42-N050A&B which provide indication and alarms of ECCWS loop temperature. These are type E thermocouples. 2. OP42-N320A,B&C which control the ECCWS outlet temperature of the Control Complex Chillers. These are RTD's. b. The Leak Detection System utilizes type "E" thermocouples mounted without

wells, c.

The following safety related HVAC systems utilize RTD's mounted in ducts without protecting wells to control outlet air temperature. (M15, M23, M25, M32, M43.) Since these systems are not required to respond to an accident condition and normal temperature changes are quite slow, response time testing should not be required.

421.09 Identify where instrument sensors or transmitters supplying information to more than one protection channel, to both a protection channel and control, or to more than one control channel, are located in a common instrument line or connected to a common instrument tap. The intent of this item is to verify that a single failure in a common instrument. line or tap (such as break or blockage) cannot defeat required protection system redundancy.

Response

a. The turbine first. stage pressure is available from only two taps on the turbine. The Rod Control and Information System (RC&IS) and Reactor Protection System (RPS) share these taps. Tap 1 C71-N0528, C7-N052C CLIN 054B, C11-N054D Te7 2 C71-N052A, C71-N052D Cll-N054A, C11-N054C l. The RPS (C71) instruments are assigned to scram trip logic channels in accordance with the letter suffix of each transmitter's tag number. Since the RPS logic is A or C and B or D it can be seen that failure of tap I will not defeat the scram function since logic channels A and D are available via tap 2. Likewise logic channels B and C are available upon failure of tap 2. Based on the above, failure of a single first stage pressure tap cannot defeat the turbine stop valve or turbine control valve fast closure trips. Ample instrumentation in the form of annunciators and trip unit readouts are provided to alert the operator to malfunction or I erroneous inputs to logic channels due to sensing line failure. I 2. The Rod Control and Information System is a two division system. Transmitters Cll-N054A and Cll-N054C form one channel. Transmitters A and C are different ranges, with A providing low

421.09 Response (Cont'd) pressure alarm and trip and C providing high pressure trip. Cll-N054B and Cll-N054D form the other channel. Therefore, failure of a single first stage pressure tap will not defeat the Rod Control and Information System function. b. The other common instrument line is on the condcasate storage tank level instrumentation. Present design has all four RCIC (E51) and 11PCS (E22) transmitters sharing a common line. Since these transmitters provide automatic switch over of each system from the Condensate Storage Tank to the Suppression Pool on a 1 out of 2 logic in each system the design will be changed to place one transmitter from each system on a separate sensing line and tap. This will assure that a single failure of a sensing line will no' defeat the automatic switch over function in either system. Ample instrumentation in the form of annunciators and trip unit readouts are provided to alert the operator to malfunction or erroneous inputs due to sensing line failure Present design New design Tap 1 E22-N054C & G E22-N054C E51-N053A & E E51-N053A Tap 2 Pil-N020 P11-N020 E22-N054G E51-N053E Note: Pil-N020 is condensate system wide range level indication.

A discussion of the Equipment Protection Assembly (EPA) systems is 421.14 f not given in FSart Section 7.2. Also, the EPA assemblies are not shown in Figure 7.2-1, the reactor protection system instrumentation and control diagram. Discuss the EPA system and how it meets IEEE 279.

Response

A detailed discussion of the Equipment Protection Assembly (EPA) can be found in l'erry FSAR Section 8.3.1.1.5.1 on page 8.3-36. Revised section 7.2.2.2 is attached. The drawing that reflects EPA's is 762E427BA, Rev. 2. '1 E b i I + 1 t t ~ c g-- -sr,, -w

421.16 The statement is made that prudent operational limits for each safety related variable trip setting are selected with sufficient margin so that a spurious scram is avoided. Please provide a detailed discussion and/or reference to the nettiodology used in determining safety system setpoints.

Response

Setpoints are established as shown on the attached chart. After the analytical limit is set, allowances are made for instrument and calibration accuracy to determine the technical specification limit. This allowance is made for the maximum instrument drift that could occur to get the nominal setpoint. Maximum instrument drift covers any causes that could lead to drift including environmental conditions. i s t 8 I l r l l

INSTRUMENT SETPOINT SPECIFICATION BASIS I SETPOINT/LI!!ITS l ?!OP MAX ?!AXIMUM ALLOWABLE AL SL l STEADY STATE LICENSED VAtt'E/TECl! ANALYTICAL DESIGN l SPEC Lit!IT Ll!!!T SAFETY 3 OPERATING OPERATING POINT lit!IT l LIf1I T S l NORf!AL TRIP SETPOINT [-= MARGINS FOR

• OPERATIONAL -**- AVA I LABI L I TY --* *-NON-LER RANGE =

PROCESS

• - SAFETY TRANSIENTS READOUT ANALYSIS ACCURACY THANSIENTS FACTORS DETERf!!NING IIARGI NS A. PERTURBATIONS A. MAX DRIFT A. MAX DRlFT A. SENSOR AND A.

LIMITING DURING PLANT DURING CAL-DURING CAL-COMPONENT TRANSIENT ?!ANEUVERS IBRATION IllRATION ACCURACY B. CONSIDER B. PROCESS NOISE PERIOD PERIOD B. SENSOR AND I NS TRU!!ENT C. CONSIDER COMPONENT Tit!E INSTRUMENT CALIllRATION

RESPONSE

tit!E RESPONSE CAPABILITY C. ALLOWANCE FOR cal.- CUI.ATIONAL !!ODEL UNCERTAINTIES l

failure modes and effects analysis has been 421.19 Verify that a performed for each of the ESF systems identified in Section 7.3.1.

Response

Appendix 15A of the FSAR contains a system level Failure Modes and Effects Analysis (FMEA) of essential protective sequences. t 1 I h 4 I l l

421.21 Discuss the testing procedures for the pilot solenoid valves which control compressed air to the ADS relief valves.

Response

This item was di,+ .ed with the staff. Two SRV's minimum are required for normal shutdown. The adequacy of the solenoid test was discussed and is addressed in detail in question 421.72. 1 e f

=. ~ _ _. i i j 421.23 From the discussions provided in Sections 6.3.2.2.3, 6.3.2.2.4, 7.3.1.1.1.3, and 7.3.1.1.1.4, it is not clear whether or not the LPCS and LPCI injection valves are interlocked to prevent them from opening unless reactor pressure is low enough for injection to be possible. Provide more information concerning the operation of these valves. Also, there are discrepancies in the FSAR as to whether differential or gage (absolute) pressure transmitters are used for the interlocks. For example, Section 7.3.1.1.1.3 and i 7.3.1.1.1.4 imply differential pressure transmitters are used. However, the P&I diagram for the LPCS system, Figure 6.3-8, i does not show a differential pressure transmitter near the injection valve. ~i

Response

I The present Perry design of the high pressure / low pressure interface of the low pressure ECC lines is illustrated in Figure 5.4-13, Sheet 2. The pressure I interlock (a pressure transmitter / trip unit between the testable check valve and the motorized injection valve) is designed to be functional during test opening of the MOV. Automatic initiation of the low pressure ECCS by the LOCA signal will bypass the interlock and immediately open the MOV'S. The differential pressure transmitters mentioned on pages 7.3-8 and 7.3-10 were not used in the Perry design and the FSAR. Revised pages are attached to reflect current design. As a result of recent NRC concerns with regard to protecting low pressure piping upstream of the MOV, CEI commits to modify the existing interlock circuitry. The modification will remove the LOCA signal bypass. Thus, the MOV will be interlocked shut for all pressures greater than 450 psi. The j above modification will change the results of the App K analysis. It is estimated that the worst case PCT could rise by 40*F from the current 2115 F PCT. This value is still well below the PCT limit of 2200'F. The FSAR will be revised to reflect this change. t l t 1 i _ -. - - -. - -,, -, ~.. _., ~ _., - -.,

1 i 421.28 Discuss how the RilRS-Containment Spray Cooling ?! ode initiation system conforms to Paragraph 4.17 of IEEE Standard 279-1971 concerning mann.nl initiation capability. Discuss initiation of both loops. ljesponse The response to this question is provided in revised Secton 7.3.1.1.4. f, J 4 f i } 4 .,n e-,.,

l 421.29 Can the automatic initiation of the emergency recirculation mode of the Control Complex !!VAC system be bypassed? If so, describe the desi;;n features.

Response

This item was discussed and the Staff had two additional items. A list of shared safety related systems is attached. The control room heating coils involved are identified on Figure 6.4-1. The SCR controllers are zero voltage switching. l l l I

SHARED SAFETY RELATED SYSTEMS FSAR CROSS REFERENCE POWER EUPPLY LOCATION OF System Section Page Figure Unit Div Control ISD.(3) O G61 Fuel Pool Cooling and Clean Up 9.1.3 9.1-23 9.1-9 1 1&2 1,2,C/ LOC 1,2,C/ LOC 7.6.1.7 7.6-20 C$ if M23 MCC, SWGR & Misc. Elec. Equip. Area 9.4.1 9.4-5 9.4-1 1 1&2 LOC C IIVAC 7.3.1.1.8 7.3-30 E d M24 Battery Room Exhaust 9.4.1 9.4-6 9.4-1 1 1&2 LOC C 7.3.1.1.8 7.3-30 M25 Control Room ifVAC 6.4.2 6.4-4 6.4-1 1 162 C C 7.3.1.1.7 7.3-28 M26 Control Room Emerg. Recire. 6.4.2 6.4-6 6.4-1 1 1&2 C C 7.3.1.1.7 7.3-29 M28 Emerg. Closed Cooling Pump Area. 9.4.5 9.4-53 9.4-12 1 1&2 LOC C Cooling 7.3.1.1.10 7.3-37 Fuel IIandling Area Ventilation ( ) 9.4.2 9.4-19 9.4-4 1/2 1&2/1 C C M40 7.6.1.9 7.6-25 P42 Emergency Closed Cooling 9.2.2 9.2-16 9.2-3 1 1&2 1,2,C 1,2,C 7.3.1.1.6 7.3-25 Control Complex Chilled Water ( 9.4.4 9.4-85 9.4-20 1/2 1&2/1 C C P47 7.3.1.1.7 7.3-28 P49 ESW Screen Wash 9.2.1 9.2-8 D302-214 1 1&2 LOC LOC 7.3.1.1.6 7.3.26 P45 ESW( ) 9.2.1 9.2-4 9.2-1 1 1&2 LOC 1,2& LOC 7.3.1.1.6 7.3-26 NOTES: 1. 1,2,L refers to unit 1, unit 2 and common control room panels respectively. Common control room panels are located in the Southwest corner of unit I control room. LOC refers to local control panels nearby the equipment controlled. 2. Systems M40, P47 have C loop equipment powered from unit 2 ESF Div. 1.

421.31 Discuss how the design of the Annulus Exhaust Gas Treatment System conforms to Paragraph 4.11 of IEEE Standard 279, concerning channel bypass or rer.ioval from operation for purposes of maintenance or testing.

Response

The Annulus Exhaust Gas Treatment System consists of two 100 percent redundant trains of equipment. One train is normally operating and the other is in standby with auto start on failure of the operating train. Technical Specifications will contain limits on the time the standby train can be out of service. l i l i j

l s 421.35 Demonstrate-that the Safety Relief Valve (SRV) low-low setpoint fonction is adequate assuming a single failure.

Response

The response to this question was provided by LRG-II position paper dated i 12-3-81 and elidorsed by a letter f rom D. R. Davidson to J. R. tiiller dated 12-21-81. l f -s a 4 4 h f

l s i r / f 421.36 Describe the electrical power supply arrangement, air supply design features, and any interlocks associated with control and operation of tue safety relief valves. This should include a { discussion of the design bases for the capacity of air reservoirs used to operate the valves. ~ 4 Responsh Section6.8discussesthesizingofsafetyrelatedjnstrumentairreceivers which supply the automatic depressurization system (ADS) accumulators. Section 5.2 discusses the sizing of the ADS accumulators. The power supply is Division 2, 125 volt d-c (B208-011, Slaet C04). The actuation logic is shown on Figure,7.3-3 sheet 5. 4 4 I l / b . + = Y 1 g 'i' - i s e 7" m

421.38 Using detailed system schematics, describe the sequence for periodic testing of the: a) main steamline isolation valves. c b.) main feedwater isolation valves. c) main feedwater control valves (safety features). t dJ HCIC system. f The discussion should include features used to insure the availability of the safety function during test and measures i taken to insure that equipment cannot be left in a bypassed 1 condition after test completion. I

Response

This item was discussed. The staf f had no further questions at this time. i ,/ 4 A 9 4 / i e t 1

1 i l [ i 421.39 Demonstrate that the containment isolation system satisfies the single failure criterion and that the redundant j instrumentation and control systems provided meet Branch Technical Position ICSB No. 3.

Response

This item was discussed with the staff. The staff agreed to review Table 6.2-32. No further action is required at this time. 4 i i b i f i . _ ~., _ _. _

421.40 Clarify the descriptions of the temperature monitoring circuits which initiate containment and reactor vessel isolation. Describe how the system satisfies the requirements of IEEE Standard 338, R. G. 1.22 and GDC 21. lesponse j i Conformance to IEEE Standard 338 is presented on a system basis in Section 7.3.2.1.3 as part of the discussion of Regulatory Guide 1.22 comp 1iance. The temperature monitoring circuits which initiate containment and reactor vessel isolation are described in Sections 7.3.1.1.2.b.4, 7.3.1.1.2.b.9, and 7.3.1.1.2.b.10. J l ) S l 3

421.45 The statement is made that the suppression pool suction valve automatically opens if a high water level is detected in the suppression pool. Does this imply that valve F1 will close automatically at this time?

Response

This item was discussed with the Staff. The level sensing lines from the condensate storage tank to the level transmitters are seismically supported and heat traced to prevent freezing. Low temperature of these lines is alarmed in the control room. The alarm is separate from the heat trace power source. 4 4 l s l l

421.47 Please discuss the following relative to the remote shutdown system: l-a. Design basis for selection of instrumentation and control equipment on the remote shutdown panel. b. Location of manual transfer switches and remote shutdown panel (include layout drawings, etc. ), c. Design criteria for the remote shutdown panel instrumentation, including manual transfer switches. d. Description of control of access to the displays and j cont.rol s located outside the control room. Description of isolation and separation provisions. This c. should include the design basis for preventing electrical interaction between the control room and remote shutdown equipment. f. Description of control room annunciation of whether devices are under local or remote control. g. Description of any communication systems required to coordinate operator actions. h. Description of testing to be performed to verify the capability of maintaining the plant in a safe shutdown condition from outside the control room.

Response

This item was discussed with the staf f, additionally the only system under RSS control which has an automatic ESF function is RIIC Loop "A". All other automatic actuations of ESF functions will operate normally. The remote

421.47 Response (Cont'd) shutdown panel has instrumentation for monitoring the reactor vessel water level so if the LPCI is required the operator can manually align Ri!C Loop "A" for LPCI. 4 I .l i O

421.48 General Design Criterion 19 requires potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures. Provide a summary of the procedures used to achieve cold shutdown from outside the control room. Include a list of the systems required for cold shutdown from outside the control room and the location of the panels where these system controls are housed. Show how the cold shutdown procedures meet the single failure criterion.

Response

a. PERRY NUCLEAR POWER PLANT REMOTE SlfUTDOWN SYSTEM SINGLE FAILURE CRITERION PRESENT DESIGN, I&C FROM REMOTE SIIUTDOWN ADDITIONAL I&C TO MEET SINGLE FAILURE PANEL CRITERION RCIC Nothing additional - assume automatic (Div. 1, turbine and valves) operation of IIPCS to maintain RPV water level ADS Controls for same 3 valves using the (Div. 1, on 3 solenoids) Div. 2 solenoids on local panel in Div. 2 swgr. room. RilR Controls for equivalent Div. 2 pump (Div. I pump and valves and flow and valves from Div. 2 swgr. room. indication) RilR Div. 2 flow indicator on local panel in Div. 2 swgr. room. ESW Controls for equivalent Div. 2 pump (Div. I pump and valves and flow and valves from Div. 2 swgr. room. indication) ESW Div. 2 flow indication for RllR "B" ll/X and ECCS "B" II/X on local panel in Div. 2 swgr. room. ECC Control for equivalent Div. 2 pump (Div. I pump and flow indication) from Div. 2 swgr. room. ECC Div. 2 flow indication on local panel in Div. 2 swgr. room Misc. Indicators for equivalent Div. 2 Div. 1 Recorders for: parameters on local panel in Div. 2 swgr. room. RPV level RPV pressure Drywell pressure Drywell temperature Suppression pool level Suppression pool temperature

4 421.48 Response (Cont'd) b. The present remote shutdown panel location and the proposed loation for new controls in the Division 2 switchgear room are served by the flCC, switchgear and miscellaneous area llVAC system. This system is j independant of the control room IIVAC system. a t The 1123 system is discussed in Section 7.3.1.1.8 page 7.3-31 and shown on Figure 9.4-1. Additional discussion is provided in Section 9.4.1.2 page 9.4-5. i 1 i c. Indicators for ADS valves and ADS controllers will be located together on i one panel. i w

421.48 Response (Cont'd) d. In response to the NRC staff's new position on remote shutdown it was requested to verify as safety grade all inst ruments associated with the remote shutdown panel. Review of the present design reveals the following: SAFETY RELATED System Readout Sensor Power Source E51(I) No Yes Yes E12 No Yes ies B21 No Yes Yes P42 No No No p45 No No No D23( No No No NOTES: 1. E51 RCIC flow controller and indicator are fully safety related. 2. D23 recorders provide drywell and supression pool level, pressure and temperature recording.

421.49 The staff has recently issued Revision 2 to Regulatory Guide 1.97, " Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident." This revision reflects a number of major changes in post-accident instrumentation, and includes specific implementation requirem. cts for plants in the operating license review stage. Discuss the schedule for complying with this Regulatory Guide.

Response

This item was dicussed with the Staff. A formal response on CEI's position on R.G. 1.97 Rev. 2 will be provided at a later date.

421.51 Explain why the discussions given in Section 7.5 identify measured variables which are not listed in Table 7.5-1 as providing verification of proper system operation.

Response

A review of the text of Section 7 5 and Table 7.5-1 was made and the following corrections made: a. Section 7.5.1.4.2.1.b has been deleted. These indications are not required for safety related display indications. b. Added the following at the end of Section 7.5.1.4.2.4.c, "Each channel is recorded in the control room". c. Revised Table 7.5-1 page 7.5-15. The changes are primarily the addition of a meter which was described in the text but omitted from the table for format convenience. d. Revised Table 7.5-1 page 7.5-14, added items described in the text but omitted from table. Indication of various functions described in the text by the process c. computer and/or annunciator are not included in the table as these devices are not safety related and no operator action is taken based only on their indication. They were included in the text to enhance the overall understanding of the available information.

421.54 During normal and emergency conditions it is necessary to keep low pressure systems that are connected to the high pressure coolant systems properly isolated in order to avoid damage by overpressurization or the potential for loss of integrity of the low pressure systems and possible radioactive releases. Discuss how each of the low pressure to high pressure interfaces in your design conform to the requirements of Branch Technical Position ICSB No. 3. Also, discuss how the associated interlock circuitry conforms to the requirements of IEEE Standard 279. The discussic-n should include illustrations from applicable drawings.

Response

The Perry design of the RHR System Suction Valve Interlocks consists of analog pressure transmitters which measure reactor pressure and transmit signals proportional to the pressure value to a solid state trip unit and a visual indication. This design permits on-line monitoring of the transmitter outputs and analog indication in the control room so that cross comparison of the output values can be made between channels and other control room pressure indications. Technical specifications will require a channel check of these systems to be made each shift. In addition, the trip units are located in the control room for case of calibration and testing. The trip units provide interlocks which allow the operator to open the valves under permissible conditions. There are two isolation valves in the suction line which have divisionally separated controls. These valves are not automatically opened valves but are manually controlled pressure interlocked valves. Each valve control circuit has two of the pressure interlocks described above, either of which will prevent the valve from being opened. Therefore, it would require a failure of all four transmitted trip unit channels to permit operation of the valves manually. The trip unit setpoints are set at 135 psig, which is a factor more than 3 times less than the pressure rating of the piping and would require four such failures of the trip channel to permit operating these valves at unacceptably high pressure conditions.

421.54 Response (Cont'd) In addition to these automatic protection features, administrative controls will not permit placing the RHR system in the shutdown cooling mode until the reactor pressure has been reduced to less than 135 psig. The pressure indications used for determining reactor pressure are located on the main control panel and are different from those used in the overpressure protection trip system. 4 4 1 e J 4-l

421.59 Several major plant control systems whose functions are not essential for plant safety, i.e., NSSS process computer system, reactor water cleanup system, gaseous radwaste system, reactor water cleanup system, gaseous radwaste system, and process sampling system, are not discussed in Section 7.7. Also, the discussion on non-safety leak detection systems is incomplete. Discuss the need to amend Section 7.7 of the FSAR to include descriptions of the above systems.

Response

The response to this question is provided in revised Section 7.7.1.

421.63 Identify the non-safety grade equipment used to mitigate the effects of Anticipated Transients Without Scram (ATWS). Include a discussion of the AfWS recirculation pump trip (ATWSRPT).

Response

The response to this question is provided in revised Section 15.8,1. 4 i 1

421.64 By NRC letter to you dated flay 11, 1981, we transmitted questions concerning for ICSB generic issues. Discuss your schedule for formally answering these generic issues as specified in the above letter.

Response

The response to this question will be provided by August 20, 1982.

421.65 The following questions relate to the instrumentation and controls for the Emergency Service Water (ESW) system and the Emergency Closed Cooling Water System (ECCWS): (a) Provide a list of the signals that automatically initiate each of the ESW loops and each of the ECCWS loops for each unit. Clearly identify those cases where signals from one unit are used to initiate operation of components of the other unit. (b) According to the discussion in FSAR Section 7.3.1.1.6c, following a LOCA signal from either Unit 1 or Unit 2, the Unit 1 ECCWS loops are ac'ivated to provide cooling water to the control complex chillers. Illustrate, by means of drawings, how the initiation signals from the two separate units are tied together into the Unit 1 ECCWS control circuitry. Also, discuss the power sources provided for the Unit 1 ECCWS when Unit 1 is shut down. (c) With the exception of the llPCS room cooler, all of the branches in each of the three ESW loops are provided with flow indication and alarm circuitry in the control room. The flow element provided for the IIPCS room cooler apparently has only two pressure test connections and is used only for initial flow balancing in the C loop (See FSAR page 9.2-15). Discuss how the operator is alerted to any malfunctioning of the llPCS room cooler when the llPCS System is activated. (d) Many of the components cooled by the ECCWS (i.e., RIIR room coolers and RilR pump seals) have only local temperature monitors and flow elt.ments with pressure test points located on the discharge side. No temperature or flow indications or alarms are provided in the control room. Discuss how an operator is alerted to a malfunction in any of the ECCWS cooling branches. t

421.65 (page 2) Continued (e) In the review of the drawings for the ECCWS (system P42) and the ESW System (system P45), it was noted that the drawing list was f ar from complete. For example, in the ECCWS, no drawings were provided or listed for the flow controls located on the discharge of the control complex chillers; also, no drawings were identified for the surge tank level instrumentation. In the ESW System, no drawings were provided or listed for the RIIR heat exchanger flow and temperature instrumentation. Discuss the present design status of the instrumentation and control circuitry provided for the ECCWS and the ESW System. (f) The P&I diagrams for the ESW System are shown on Figure 9.2-1, sheets 1 through 4 of the FSAR. All sheets are labeled as Unit 1. Should sheets 3 and 4 be labeled as Unit 2? If so, correct accordingly. (g) State whether or not the instrumentation and control circuitry provided for the ECCWS and the ESW System conform to all of the requiresents of IEEE Standard 279. Identify all exceptions.

Response

a. ESW Initiation Signals: Un:t 1 'A' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 1 LOCA. Unit 1 'B' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 2 LOCA.

421.65 (page 3) Continued Unit 1 'C' System: Auto Start upon receipt of Unit 1, Div. 3 LOCA. Unit 2 'A' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 1 LOCA. Unit 2 'B' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 2 LOCA. Unit 2 'C' System: Auto Start upon receipt of Unit 2, Div. 3 LOCA. ECCWS Initiation Signals: Unit 1 'A' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 1 LOCA. Unit 1 'B' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 2 LOCA. Unit 2 'A' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 1 LOCA. Unit 2 'B' System: Auto Start upon receipt of Unit 1 or Unit 2, Div. 2 LOCA. b. Unit 1 or Unit 2 combined LOCA signals are generated by paralleling a Unit 1 LOCA signal with a Unit 2 LOCA signal through the use of isolation relays. The resulting signal is relayed into the ECCWS System as a " Combined LOCA" signal. Ref: Drawing B-208-055 Sheets A07, A08, A100, A101, A102, A103 Drawing B-208-173 Sheets 01, 02, 03, 04, 11 through 18

421.65 (page 4) Continued c. Malfunctioning of the !!PCS room cooler is detected by low flow alarm on the llPCS diesel heat exchanger due to diversion of water to a leak or by high ambient temperature alarm in the IIPCS room (refer to Figure 9.4-13) if the malfunction were due to blockage. In addition, the IIPCS diesel heat exchanger flow indicator and the llPCS emergency service water pump "C" discharge pressure indicator and low alarm in the control room could be used to verify either malfunction. All of these alarms and indicators are in the control room. Also, any significant leakage would be collected in the llPCS drainage pit and alarmed in the control room on high level (refer to Section 9.3.3.2, page 9.3-11, and Figure 9.3-11, and Figure 11.2-1, sheet 4). d. The operator is alerted to malfunctions in the ECCWS branches as follows: 1. liigh pump room ambient temperature alarm in the control room would indicate malfunction due to blockage of the room cooler units (refer to Figure 9.4-13). 2. Malfunction of the RllR pump seal cooler by blockage would lead to accelerated deterioration of the seal which would be detected by increases and alarms in the pump room ambient temperature and room drainage pit level. 3. Any significant leakage in any ECCS pump room would be collected in the room's drainage pit and alarm in the control room on high level. (Refer to Section 9.3.3.2, page 9.3-11, Figure 9.3-11 and Figure 11.2-1, sheet 4). 4. Leakage from the ECCWS is also indicated by frequent makeup high and low level alarms monitored in the control room.

l i 421.65 (page 5) Continued I l e. The flow controls on the discharge of the control complex chillers are described in Section 7.3, page 7.3-28, and Section 9.2, Figure 9.2-3 and shown on Drawings 208-173, Sheets 203, 204, and Drawing 258-173, Sheet 200. NOTE: The drawing that Figure 9.2-3 is based on has been revised and now correctly shows the temperature sensor for this control on the outlet of the chiller. It will be provided in a future amendment. The ECCWS surge tank instrument is described in Section 7.3, page 7.3-27; Section 9.2, page 9.2-18, Figure 9.2-3 and shown on Drawings 208-173, Sheet 23 and 258-173, Sheet 23. The RilR heat exchanger flow and temperature instrumentation is described in Section 5.4.7, page 5.4-13 and shown on Drawing 208-055, Sheets A06, A10, and 258-055, Sheets A06, A10. f. Figure 9.2-1, Sheets 3 and 4 are incorrectly labeled as Unit 1, they are corrected to indicate Unit 2. g. Yes, they do conform to all of the regairements of IEEE Standard 279. e

l 421.66 Justify having a level transmitter on only one of the two RIIR heat exchangers for the RIIR steam condensing mode. Is this level transmitter provided with a condensing pot to accommodate steam condensing?

Response

Level transmitters are installed on two of the four RilR heat exchangers for use in the steam condensing mode as described in Section 5.4.7.2.6b page 5.4-45. Only one heat exchanger per loop is required (Section 5.4.7.1.1.5) in this mode. The level transmitters (N008 A&B) are installed with diaphragm seals and capillary on each sensing line. The IcVel transmitters are safety grade.

i i l a 421.67 The third paragraph on Page 7.2-3 of the FSAR refers to Figure 7.6-6 as showing the eight NMS logics associated with 1 the HPS. However, Figure 7.6-6 actually shows the power range monitor detector assembly location. Provide the appropriate figure and change the figure number accordingly. Repoonse The reference to Figure 7.6-6 on page 7.2-3 is incorrect. The page is revised to correctly reference Figure 7.6-2, Sheet 1. I 4 I 1

421.68 Discuss the interlocking requirements that must be satisfied before the operator can manually initiate the suppression pool cooling mode of the R11RS.

Response

The only time an operator cannot initiate suppression pool cooling mode is during the first 10 minutes following a LOCA. During that time the bypass valve E12/F048 around the heat exchanger is interlocked open on a 10 minute timer. Af ter that the valve may be closed and suppression pool cooling initiated. Value E12/F048 is interlocked open during the 10 minutes just following a LOCA because core cooling is more important and desirable than cooling the suppression pool water. i 1 i i

i 421.69 Discuss the suppression pool temperature monitoring instrumentation. State whether visual or audible alarms are provided to alert the operator is the pool temperature exceeds the limit required for initiation of the suppression pool cooling mode. No such alarms are shown on Sheet 4 of Figure 7.3-5.

Response

The operation of the suppression pool temperature monitoring instrumentation was discussed with the staff based on the discussion in Section 7.6.1.8, page 7.6-23. It was noted that the drawings which show the Containment Atmosphere Monitoring System (D302-881 and D352-881) were inadvertantly omitted from the FSAR. These are added as new Figure 7.6-7, Sheets I and 2 in Section 7.6 and referenced in Section 7.6.1.8. The staff had no further questions. b

421.70 According to Page 5.4-43 of the FSAR, the steam condensing mode of the RJIRS is considered part of the ECCS. I!oweve r, no discussion of this mode of operation was found in Section 7.3. Provide a discussion describing the operation of the steam condensing mode. Include in the discussion how the system is initiated and the interlock.rergui rements.

Response

The steam condensing mode of the RilRS is not considered a part of ECCS. The operation of this mode was discussed w'ith the staff based on the discussion in Section 5.4.7.2.6b page 5.4-45. The staff had no further questions. l l l \\ I ' l ~ 4 i i \\ m

• p O

+b D v

421.71 The following questions relate to the Drywell Vacuum Relief System discussed in Section 7.3.1.1.14: (a) page 6.3-96 references Section 3.8.3 for more information on the Drywell Vacuum Relief System. No discussion on this system was found in Section 3.8.3. Resolve this i s discrepancy. 7 (b) In comparing the R& ids for the Hydrogen Mixing System (D-302-831, Figure 6.2-62) and the Drywell Vacuum Relief System (D-912-606), the motor-operated valves on the two drawings appear to have the same identification number (MCV F010A and MCV F010B); however, the check valves in series with these valves have different numbers. Resolve this apparent discrepancy. (c) In the disucssion on system operation (Page 7.3-43), the statement is made that the valves close automatically on a i j containment isolation signal. However, examination of the logic on Figure 7.3-12 reveals that r is is not the case a j 'j if the manual control switch is in the open position. j' Using Figure 7.3-12 as a reference, provide a more detailed discussion concerning the operation of the 4 drywell vacuum relief system. Resolve the apparent discrepancy mentioned above.

Response

a. The reference on page 6.2-96 to Section 3.8.3 is incorrect. This page has been revised to correctly reference Section 7.3.1. A b. Fig'ure 6.2-62 is System M51 and Figure 7.3-10 is System M16, M17. The identification numbers on each figure are prefixed with the system s designation (M51,.M16). Therefore the valves F010A and F010B are completely' separate and different items. i w' -. g \\, 3 3 y t, .L -

4 b 421.71 (Cont'd) c. The manual control switches referred to are spring return to a center or neutral position. Therefore, the LOCA containment isolation signal cannot be inadvertantly defeated by the position of the manual control t switch. A note is added to "igures 7.3-11 and 7.3-12 to clarify the operation of manual switches. f.: /' o / a .e / s

• p

/' 0 I s- .~ l 1 i

i" provides ample time for the operator to initiate the mixing subsystem (Figure 6.2-64). The operator is alerted again by another annunciator alarm at 3.5 percent hydrogen by volume. The second alarm serves as a backup and still provides time for the operator to initiate the mixing systems before hydrogen concentrations exceed the limits of Regulatory Guide 1.7. Absence of this second alarm after starting the mixing subsystem is a confirmation of the ef fectiveness of the mixing subsystem. These setpoints have been conservatively selected considering all instrument errors and accuracies. On high hydrogen concentration signal from the hydrogen analyzers, the mixing subsyster,is manually started. Prior to starting the mixing compressors, the pressure in the drywell and containment is equalized by automatic opening of the py drywell vacuum relief valves. See Section 7.3.1 for f urther details of the DVR se N system. The mixing subsystem will be operated manually from the control room ss because mixing will not be required for a number of hours af ter the LOCA. The discharge control valve for each mixing compressor is normally closed, opens automatically when the compreseor starts, and closes automatically when the ]. compressor is stopped. The operation of the mixing system is electrically locked 1 out wheneven a LOCA signal is present. Days after the LOCA, the mixing system becomes ineffective in maintaining the hydrogen concentration below the combustible limit. At this time, if the hydrogen analyzer indicates that the concentration has increased to approximately 3.5 volume percent, the hydrogen recombiner subsystem is manually started from the control room. in the unlikely event that the redundant hydrogen recombiners fail to maintain the hydrogen concentration below 4 volume percent, the containment will be purged after operator initiation from the control room, as discussed in Section 6.2.5.2.4. Instrumentation for the purge subsystem consists of a flow controller for the purge line to the annulus exhaust filters. A high + j flow alarm on the purge line alerts the operator to the high flow condition. l All lines in the system that connect the drywell with the containment vessel have isolation valves which close automatically on LOCA signal. Manual initiation and' - test operation is overridden by the LOCA signal. During normal plant operation, these. isolation valves are closed. The hydrogen recombiners do not require any 6.2-96

I I GDC NO. 30 29 26 27 26 25 24 23 22 21 20 X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X ~2 ~ r'a X X X X X to X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X (1)This table provides information as to the applicq For degree of conformance of those requirements, re( Sections 7.1, 7.2, 7.3, 7.4, 7.5 and 7.6. I t \\ l

t l TABLE 7.1-3 h0DESANDSTANDARDSAPPLICABILITYINDEX FOR CONTROLS AND INSTRUMENTATION (l) 19 15 13 12 10 5 4 3 2 1 Reactor Protection (Trip System - RPS X X X X X X X X X X + X X X X X X X CRVICS X X X X X X X X X ECCS X X X X X X X X X NMS X X X X X X X X Rod Pattern Control System X X X X X X X X Process Radiation Monitoring X X X X X X X Containment Cooling & Purif. System X X X X X X X Control Complex HVAC X X X X X X X Standby Power Systems X X X X X X X Emergency Water Systems X X X X X X X X X RCIC 3, X X X X X X X Standby Liquid Control System ? X X X X X X X Containment Atmos. Monitoring System 2{ X X X X X X X X Leak Detection Systems ry X X X RHRS Shutdown Cooling Mode 98 X X X X X X X Fuel Pool Cooling System X X X X X X X MSIV Leakage Control System X X X X X X X Containment Vacuum Relie f X X X X X X X Drywell Vacuum Relief System X X X X X X X RHRS Containment Spray Cooling Mode X X X X X X X Remote Shutdown System X X X X X X X X Recirculation Pump Trip X X X X X X X RHRS Suppression Pool Cooling Mode X X X X X X X Suppression Pool Makeup System X X X X X X X Pump Rooms Cooling System X X X X X X X ESF Bldg. and Area 11VAC System X X X X X X Fuel Handling Area Ventilation X X X X X X Off-Cas Building Exhaust System X X X X X X X Combustible Gas Control System {j .s N T ility of requirements to the systems. r to the analysis portions of n t

i ) Reg. Reg. Reg. Reg. Guide Guide Guide Guide 1.75 1.78 1.80 1.89 X X X X X X X X X X X X E a X X X X X X A X X y X e's X X u e X X X X X X X X X i \\ l

1 TABLE 7.1-3 (Cont'd) TODES AND STANDARDS APPLICABILITY INDEX FOR CONTROLS AND INSTRUMENTATION Reg. Reg. g Guide Guide l?{ 1.95 1.96 Reactor Protection (Trip) System - RPS CRVICS ECCS NMS Rod Pattern Control System Process Radiation Monitoring Containment Cooling and Purification System X Control Complex ilVAC Standby Power Systems Emergency Water Systems RCIC Standby Liquid Control System Containment Atmospheric Monitoring System Leak Detection Systems RllRS Shutdown Cooling Mode Fuel Pool Cooling System X MSIV Leakage Control System Con ta inment Vacuum Relie f Drywell Vacuum Relief System RilRS Containment Spray Cooling Mode Remote Shutdown System Recirculation Pump Trip RilRS Suppression Pool Ceoling Mode Suppression Pool Makeup System Pump Rooms Cooling System ESF Building & Area HVAC System Fuel llandling Area Ventilation Off-Cas Building Exhaust Syntem Combustible Gas Control System I l

p l t I I I BTP Branch Technical Position (BTP) No. 26 6 es t r0 00 L X l r I I o L

TABLE 7.1-3 (Cont'd) CODXS AND STANDARDS APPLICABILITY INDEX FOR CONTROLS AND INSTRUMENTATION BTP BTP BTP ETP 22 21 20 3 j X X Reactor Protection (Trip) System - RPS X X CRVICS X X X ECCS X X NMS X Rod Pattern Control System X X Process Radiation Monitoring X X Containment Cooling and Purification System j X X Control Complex HVAC X X Standby Power Systems X X Emergency Water Systems X X RCIC X X Standby Liquid Control System D X X Containment Atmospheric Monitoring System %( X X Leak Detection Systems (( X X X X RHRS Shutdown Cooling Mode T X Fuel Pool Cooling System X X MSIV Leakage Control System X X Containment Vacuum Relief X X Drywell Vacuum Relief System X X RHRS Containment Spray Cooling Mode Remote Shutdown System X X Recirculation Pump Trip X X RHRS Suppression Pool Cooling Mode X X Suppression Pool Makeup System X X Pump Rooms Cooling System l X X ESF Building and Area HVAC System X X Fuel Handlin'g Area Ventilation } X Off-Gas Building Exhaust System X X Combustible Gas Control System 1 e 1 4 l

1. Neutron Monitoring System (NMS) Neutron flux is monitored and initiates a reactor scram when predetermined 1imits are exceeded. NMS i ns t rinnenta ti on is described in Section 7.6. The NMS sensor channels are part of the NMS and not the RPS; however, the NMS logic is part of the RPS. Each NMS-IRM logic receives its signals from one IRM channel, and each APRM logic receives its signal from one APRf! channel. The output logic of the APRM and the IRM are combined to actuate the HPS trip circuit. The Nt!S logics are arranged so that failure of any one logic cannot prevent the initiation of a high neutron flux or simulated thermal N N scram. As shown in Figure 7.6-2, Sheet 1 eight NMS logics are x Cf associated with the Reactor Protection System. Each Reactor Protection 4 System trip channel receives inputs f rom two neut.ron monitoring system logics. For the initial fuel load, high-high flux trip inputs from each SRM are combined with IRM and APRM trips to produce a noncoincident reactor neutron monitoring system trip. Following the init.ial fuel loading, this noncoincident trip is removed. The NMS logic contacts for IRM and APRM can be bypassed by selector switches located in the control room. APRM Channels A, C, E and G bypasses are cont rolled by one selector switch and Channels B, D, F and 11 bypasses are controlled by a second selector switch. Each selector switch will bypass only one APRfl channel at any time. IRM Channels A, C, E, aad G and Channels fl, D, F, and 11 are bypassed in the same manner as the APRM channels. Ilypassing either 1 (out of 4) APRM or 1 (out. of 4) IRM channel will not ) inhibit the neutron monitoring system from providing protective action when required. ) 7.2-3

'fhe RPS is highly reliable and will provide a reactor scram in the event of anticipated operational occurrences. 7.2.2.2 Conformance to IEEE Standards The following is a discussion of conformance to those IEEE standards which apply specifically to the RPS system. Refer to Section 7.1.2.3 for a discussion of 4 IEEE standards which apply equally to all safety related systems. The s non-essential RPS power and its electrical protection assembly (EPA) are og b discussed in Section 8.3.1.1.5.1. a. IEEE Standard 279 Criteria for Protection Systems for Nuclear Power Generating Stations - The RPS design complies with the requirements of 4 IEEE-279. The following is a discussion of specific conformance. 1. General Functional Requirement (IEEE Standard 279, Paragraph 4.1) The RPS automatically initiates the appropriate protective actions, whenever the conditions described in Section 7.2.1.1.b reach predetermined limits, with precision and reliability assuming the full range of conditions and performance discussed in Section 7.2.1.2. 2. Single Failure Criterion (IEEE Standard 279, Paragraph 4.2) Each of the conditions (variables) described in Section 7.2.1.1.b is monitored by redundant sensors supplying input signals to redundant trip logics. Independence of redundant RPS equipment, cables, instrument tubing, etc. is maintained and single failure criteria preserved through the application of the PNPF separation criteria as described in Section 8.3.1 to assure that no single credible event can prevent the RPS from accomplishing its safety function. 3. Quality of Components and Modules (IEEE Standard 279, Paragraph 4.3) For a discussion of the quality of RPS components and modules, refer to Section 3.11. 7.2-20

Reactor vessel water level (Trip Level 1) is monitored by two redundant level transmitters. Drywell pressure is monitored by two redundant pressure I transmitters. The vessel level trip unit relay contacts and the drywell pressure trip unit relay contacts are connected in a one-out-of-two twice logic arrangement so that no single instrument failure can prevent initiation of LPCS. The LPCS components respond to an automatic initiation signal simultaneously (or sequentially as noted) as follows: I 1. The Division 1 diesel generator is signaled to start. 2. The normally closed test return line to the suppression pool valve M0F012 is signaled closed. l 3. When power (offsite or onsite) is available at the LPCS pump motor bus, the LPCS pump is signaled to start. 2x M J b 4. The LPCS pump discharge flow is monitored by a differential pressure i [ transmitter. When the pump is running and discharge flow is low enough 1 to cause pump overheating to occur, the minimum flow return line valve M0F011 is opened. The valve is automatically closed if flow is normal. i The LPCS pump suction from the suppression pool valve M0F001 is normally open, the control switch is keylocked in the open position, and thus requires no automatic open signal for system initiation, i The LPCS pump and injection valve are provided with manual override l controls. These controls permit the operator to manually control the system subsequent to automatie initiation. l 1 I 7.3-8

i 1 The Division 1 LPCI (Loop A) receives its initiation signal from the LPCS logic. 2 4 1hc LPCI system components respond to an automatic initiation signal simultaneously (or sequentially as noted) as follows (the loop A components are controlled from the Division I logic; the loop B and C components are controlled from the Division 2 logic): 1. The Division 2 diesel generator is signaled to start from the loop B 1 and C initiation logic. i 2. When the offsite power or the diesel generators are providing power to the pump motor buses, sequential loading is provided. This is f accomplished by delaying the start of LPCI pumps A and B by 5 seconds while allowing the LPCS and LPCI pumps to start immediately. n A< 3. The following normally closed valves are signaled closed to ensure {I proper system lineup: 4 l j (a) The RilR heat exchanger discharge to RCIC valves M0F026 A, B, and A0F065 AB. 1 1 } (b),The RHR heat exchanger flush to suppression pool valves M0F0ll A, B. j 1 2 i l d 7.3-10

1 a 7.3.1.1.4 RHRS-Containment Spray Cooling Mode (RCSCM) - Instrumentation and Controls Containment Spray Cooling Mode Function a. l l The containment spray cooling mode is an operating mode of the RHR system. It is designed to provide the capability of condensing steam in the i suppression pool air volume and/or the containment atmosphere and removing heat from the suppression pool water volume. The system is automatically or manually initiated when necessary. b. Containment Spray Cooling Mode Operation Schematic arrangements of system mechanical equipment is shown in f Figure 5.4-13. RHR system component control logic is shown in Figure 7.3-5. Elementary diagrams are listed in Section 1.7.1. Plant layout drawings are shown in Section 1.2. Operator information displays are shown in Figures 5.4-13 and 7.3-5. i' The Containment Spray Cooling Mode is initiated automatically or manually. LPCI flow is diverted to either the dr;ywell or the suppression pool by upening valves M0F028A, B or M0F024A, B and closing M0F048A, B. I l The iollo' wing conditions must exist before containment spray can be initiated: 1. The LOCA signal which automatically initiated LPCI must still exist. 2. Drywell high pressure is monitored by two redundant pressure l transmitters. One of the two transmitters must indicate high pressure. J l 3. The containment pressure must exceed 9 psig or higher. r-d -r< 4. A 10-minute delay after LOCA is detected. 3-Initiation of the containment spray automatically closes the LPCI injection valve M0F042 A, B. t 7.3-23

11a nua l initiation is provided at the system level by separate armed push button switches. Ifigh drywell pressure sensors in a one cut of two configuration y cr: provide a permissive for the manual initiation. The start of the "B" loops is delayed by 90 seconds after initiation, while the "A" loop starts immediately h 1 after initiation. l 7.3-23a

CONTMT. TO ouTSIDE ATOM. Dirr. PRESS. > 0. 0 P S I D MANUAL CONTROL LOCA SWnTCH IN CLOS E. MANUAL CONTROL I SOL ATION g SWITCH IN SI G N A l-I ' cPEN gj) CCHTMT.To ouTSIDE ATOM. DIFF. PRESS. p 7 < O.O PSID l ir pq ir 9i r U 1r r VALVE pa LLv cPEN VALVE FULLY CLOSED LIMlf SWITCH LIMIT SWITCH i 1r f S EAL-IN SEAL-at4 ir 1r U p U ir 1r GREEN RED =(yyp IHotCATING I N DICATING LI GHT LIGHT n 4 q C if re a 17 M rr i mo m OPEN CLOSE E7 gy MCV MCV m ua n,, nD c 02 r1 O rt E IC I rv < m 2s d;O Z L.J HC 7 m h rh NOT E: @r]x n (1) MANUAL CONTROL SWITCHES ARE SPRING RETURN H ON$ g gm TO NEUTRAL OR CENTER POSITION. a 5 0, O ar Z -4

LOCA ISCLATl!N $1&NAL Y 1r DRYWELL/CCHTMT". _ DI FF. PRES S. < 0.0 PSID 1 1r C',, r - D RYWELL o N T M T. D I FF. p ESS, 2 0.0 PSIO. MANUAL COMTit0L SwlTcH IH OPEM {i r _ mag, c,gy, N SWITCH IN C'0 I 1r1r 0) y 1 VALVE CutLY CPO4 VALV. FULLY LIMIT SWITCH l,Ir CLOSED LIMIT ]D 1( Sk/sTCH MANU A L COMTROL. If SwlicH IN CLoSF UI $gg.pg SEAL-lH 'E} SEAL-IN n y 3 'f ] '1P li ir 1 7 ir RED GREEN tn e INDICATING IN DIC ATIN G M M 1 LIGHT LIGNY $) y$ = 14 , r m oo _. z = 1, DH rm< if nz opgg MANUAL LOCA CLOS E J3 H r Erc MCV ISCLATioH CVERIDE. MW C" mn AND AMBER n$ $$F SNDICATING LIGHT cE y;O -5 a5" y t* JS QmO N oo g rg N[ Jo$ 55, nF NOTE: z (1) MANUAL CONTROL SWITCHES ARE SPRING RETURN TO NEUTRAL OR CENTER POSITION.

4 The DBA-LOCA serves as the envelope accident sequence event to provide and demonstrate the plant's post-accident tracking capabilities. All other accidents have less severe and limiting tracking requirements. i The following process instrumentation provides informatioa to the operator after a DBA-LOCA to monitor reactor conditions. The plant protection /ESF system electronic trip system (Section 7.1.3) provides continuous control room indication of e,r; variable monitored by the RPS, ECCS, CRVICS and RCIC. Each variable is sensea o> an analog transmitter that continuously transmits a signal proportional to the variable range, to a trip unit located in the control room. A milliammeter located on each trip unit displays the transmitted signal. The ammeter allows visual cross-checking between instrument channels to verify operability and variable level. 7.5.1.4.2.1 Reactor Water Level N() Two wide range water level signals are transmitted from two independent differential pressure transmitters and are recorded on two, two pen recorders. One pen records the wide range level and the other pen records the reactor pressure as stated in Section 7.5.1.4.2.2. The range of the recorded level is from the top of the feedwater control range (just above the high level, turbine trip point) down to a point near the top of the a active fuel. J J J ,a 4 7.5-3 ..._.._.,_ _ _ _.. _.... _. - _. _. _ _. ~.. - - - _ _ - - _. _. _.

positive differential and high negative differential pressure. Drywell pressure narrow range and wide rai.ge measurements are recorded in the control room and the narrow range measurement is indicated and annunciated in the control room. Containment pressure is also measured with redundant. channels, with each channel being indicated, recorded, and annunciated in the control room. Additional redundant channels of instruments are used for extended range measurement of containment pressure with the signals recorded in the control room. b. Drywell and Containment Temperature t!onitoring Temperature signals from sensors located in the drywell and the containment are recorded in the control room. A common alarm for high drywell temperature and a common alarm for high containment temperature for each channel are annunciated in the control room. One temperature sensor from each channel in the drywell and the containment has its signal indicated in the control room. c. Suppression Pool Temprature f!onitoring Each chan,nel of the suppression pool temperature sensors transmits the sensors' signals to temperature switches and then to two and four position selector switches located on the post accident monitoring panel A suppression pool temperature is selected and indicated on a single indicator located on the ECCS benchboard. A common alarm for each channel on high suppression pcol temperature is annunciated in the control room. Each channel is recorded in the control room. 4-d. Suppression Pool Water Level There are four suppression pool level transmitters and four instrumentation channels. One level sensor in each channel measures wide range and the other narrow range level. Each channel is indicated and recorded in the control room. 7.5-7

I I SAFETY RELATED DISPLAY I System Parameter Rod Control Control Rod Position i and l Information Control Rod Scram Valves Neutron Po<er Range Neutron Monitoring Flux Source Range Count Rate Nucleat Reactor Vessel Pressure Boiler Reactor Vessel Water Level v, g RCIC Relief Valve Initiation Circuit RCIC RCIC Flow RCIC Isolation Valve RCIC Discharge Pressure Relief Valve Discharge Pipe Temperature Emergency IIPCS Flow Core Cooling IIPCS Discharge Pressure LPCS Flow RIIR Flow (LPCl and Shutdown Cooling) RilR Service Water Flow ECCS Pumps { ECCS Valves j i

f TABLE 7.5-1 3STRUMENTATION (DISPLAY INSTRUMENTATION FOR SAFETY-RELATED SYSTEMS) 1 Number Type of of Readout )!ca dout Channel. Range. Location ights 2 per rod N/A CR l' inhts I per valve N/A CR + Recorder 2 0 to 125% CR 6 Neter 4 10'I to 10 CPS CR j!ccorde r 2 0 to 1500 psig CR l hecorder 2 -160" to +60" CR ights 2 N/A CR Nk eter 1 0 to 800 gpm Ch 4 iights 2 N/A CR eter 1 0 to 1500 psig CR Q ecorder 1 0 to 600 F CR eter 1 0 to 8000 gpm CR eter 1 0 to 1500 psig CR eter 1 0 to 10,000 gpm CR deter 1 per loop 0 to 10,000 gpm CR )Dete r 1 per loop 0 to 10,000 gpm CR Status I set per N/A CR }.i ght s pump I Position 1 set per N/A CR { Li ght s valve J l

i l l System Pa ramete r MSIVLC MSIVLC Steam Line Pressure (Low) MSIVLC Steam Line Pressure (High) Containment / Drywell Pressure Drywell (Wide) Monitoring i Drywell Pressure (Harrow) Containment Pressure i Containment /Drywell i Differential Pressure 2 N Drywell Temperature 1 i G Drywell Temperature Containment Temperature I Co~ntainment Temperature Suppression Pool Level [ (Narrow) Suppression Pool Level (Wide) J Suppression Pool Temperature i l Isolation Valves Emergency Water ESW Loop Inlet [ (Emergency Temperature Service Water, (ESW); Emergency ESW Loop Pressure f i Closed Cycle Cooling, (ECC)) ESW Flow to HPCS -{ Diesel Hex ESW Flow to Stby ( Diesel Hex l' L_

r l l TABLE 7.5-1 (Continued) l Number ype of of Readout eadout Channels Range Location r leter 1 30" lig to 10 psig CR l .le t e r 1 0 to 100 psig CR I ecorder 2 -15 to 35 psig CR ecorder/ Meter 2 -5 to +5 psig CR t;ccorder/ Meter 2 -50 to +20 psig CR eter 2 -10 to +10 psig CR ecorder 2/(3 locations 50 to 350 F CR each) eter 2 50 to 350 F CR l ecorder 2/(4 locations 50 to 200 F CR cach) eter 2 50 to 200 F CR 9 ccorder/ Meter 2 -2 to +3 feet CR } l scorder/ Heter 2 -6 to +6 feet CR acorder/ 2/(8 locations 50 to 250 F CR NOTE: Single meter selectable ster each) on one of 8 locations osition I set per N/A N/A ights valve eter 1 each loop 0 to 100 F CR ter 1 each loop 0 to 160 psig CR ter 1 each loop 0 to 1000 gpm CR i L L eter 1 each loop 0 to 1200 gpm CR

l 4 7.6.1.8 Containment Atmosphere Monitoring System - Instrumentation and Controls a. System Function l The containment atmosphere monitoring system instrumentation and controls os N) (Figure 7.6-7) are intended to detect and aid in the prediction of the I $4 progression of abnormal occurrences inside the containment and to monitor the containment after postulated accidents. i t b. System Operation [ 4 r All safety related pressure and temperature channels are recorded with the recorder appearing on the post-accident monitoring panel in the control room. i i Redundant temperature sensors are located in the drywell, containment, and j suppression pool. Each channel of suppression pool temperature sensors transmits the sensors' signals to temperature switches and then to two and four position selector switches located on the post-accident monitoring i panel for providing selection of suppression pool temperature indication on f I a single indicator located on the ECCS benchboard. A common alarm ior each channel for indication of high suppression pool temperature is annunciated in the co'ntrol room. Temperature signals from sensors located in the drywell and the containment -i are recorded in the control soom. A common alarm for high drywell i temperature and a common alarm for high containment temperature for each channel are annunciated in the control room. One temperature sensor from e each redundant channel in the drywell and one from each channel in the containment has its signal indicated in the control room. I Drywell/ containment dif ferential pressure is measured and indicated in the control room for each channel. Each channel also has separate annunciators in the control room for high positive dif ferential and high negative I i 6 7.6-23

i i 1 / /* V'

. /

.-.J._. t 2 s. lj? 4: -, ,.....(..,yj ..) w....., .J ... f., n,- l k.. n I n.., _"~.I ~1. ' 'l<**a._ a.,. + ~ =....... + s.. d., z.a., . ~. ni --: z +. ,%'y m' l h ----% f~~)- J, l 4 *.., eg..

,,, )

cC .i. 9 y?.). . n._ 2 =. Q. s_,.... ~., w. c_ . e,,. ~. +.,...,. n

6...., <. _ ep_....,

r.,.

,. ~. - m. 4 m, r _., I !r..b,t;EGI.h ! F' ism,FA2Ly m.*, r> (.j T g. e I bL i.sg,----,, i e.- d ~ i&iCIFh li ultE63 --g

smic ~i : !

ave. ja. m. _.. _e _ _ _ ~ y ~,l, u, E.~ e ,.r-., 9 --.a r ca : I,V O i, u, , t-s d,W,'"r /,'k', I. ., / \\ _,.,.~a. t 7,n.. ~.._..d'.s.,z. - - . t @4, ,1 ..'.e-e.... ~., ,,,.,m, _ _ g. ,I i i _ _ _ _ _ _ _ _ _ _ g,,,g.3

a. g..._..

i, i g. 4 -~ = m. *$ <M9; ,;_ z..- ~

. q g.g.

.:..

i ..w 4,g, c.y~ n L.::_%.et.c;-'1p =' i rm., / v o -a n c

, n, =.,.

v.,w. - - ~. q,.,,, r i m i . f... f. /w. v [ij.. a

v i

7,9 s., ___i__,a-- i , ; p. ,i i 4_,,,,,,, -4, ,..,.,[,' .e.'__[_...,....c TT_. l l f .. /.i m( - _ Y.h.s.._/.s'.'. .,.Lp t m ( S'Qi'$.'. ll,', _.r...u i ( a. l /a o.c [. pw. a _., c.=__; i.. n; 4.~~"~~1 ( E E -w#c _. P. s. ) ?( I I' W -- ---_, g9.,..,~.e. _a ! ; i-

• A.A & n
• j 4:u.g.w ~.

e x e..s I r, u- ), l m " A31,e %e...j'. i, s s !i @GGGC: !! .i e. i. i btbl 1 i \\ h

l e i i b Ute.:o h--n-.ee. [.', ? r-- - d.as es'. NN

h.,

[., 8 ,,,,,,, e c _ L _.o s..+a. 1 se. s* y .-o.mos 0*; I *r + s..F.J_**u. a.rm bs .e 3.a;..%f.o ey w. i

e..

8i ru, /N v,,,,,g" r --*h. e., .. ~. ,, a l,,*' *y O. l - j.is ( s. s.(,l,, g N. s...e .n. 4 ..) , c8 l f. pa. l l I-- , m, r... #, hA"* ,4 ..e uw. ge H. g,, S,O", If.. ~ - b '. # *I.s l -.s.... e.+ ' 'I t* i -j r - ** $-4 4+ ---.gh I -n \\n o~a'., - -.d.e oc h-M ,a i.w.i s., -q,.. f s *ee. i 70 3 ran ,s. Y t-.es- [f i m = 3 [ l',.d. D ** L N}lW a d "8***' j o.... ~... s N [ -I' ,, g e M, w/ 6.f - - = = u r - - '.,., # - ' j %g (,w,.*1 ./ P4* T* & PGO. f Er.46.' q,, ,,, sI1 e s ,s., & n,g..g v,., n. & n. 2.. m,..;-grm.y * ,-v ~ g r ere21 mo ' Ih' h, t '[ .P-+ -c. w i . 8 ,v 't - ~ ae g, WL ~E L.4..h

• • 9

' M 1 _ SE 6 r l P.- e -.6 ' ~ 1 4> .. e.. 6 ---.--__----.- - - - - _..----- 6 1 I a l 1. - /$x.. m t .,= :,e- ,, -, _... m,., _ _, .,.,c...,, .. ~...., c,a.:.. m i i ~ .s 1.,....m ~.~? _..., "h $ _ l.1 ** **=- t{.t-r m. h { c m..L Q (W' .~ .s n..i.g * '

.M

.fo C. , g - + - - /Si; .a. s _c . e.< =. T g C. pL1-7.,.., i.a.r,..---.<..d r.o. --4. ; s.r w g ,.,.a... i v .w.,._--sen. '*3*

• • • • v l -.

~(A, t a em t d ,_p ' y.e. '.s.Q. 7'- p ~ A .._ a 7.* ...C. g ,s ,o r y

• -w G...c /g am..

u. g 1 s .4 p' v . a + s- - __;..,.. ,<.a

e..v.. ~.

W-. w..om v ,,.....+.u.,. i .,3 - - - - - - -, g g +- ,m...,.,,,....m.,,...,.,,,m.... o. i 5 w....,. _,e(;g i 4_1. -s '* .l 4,.

5..'.'*.,,,p y A M,- - -

c;3 ~;;;$ r- .i.,..,u

e. -- =>

.s ,m l i oc ve .u... me & - W,,,A ' I d, r -= ~ -i n.. . s.ve. l J' "' aam ' _ _. _. _ _ _ _ _ _. _1 g-- rw i**'_- ''i-L.... '..n .., er. i 1 -v m -T I i i i cri... = n .......e l ,Q ,n j .c..... i --V _a_ l eg--- de s_. i, _.., " se, m co. r - wettasi sutiv Ptt aTro 6 t e e. u./ w t r___. i

c....m. r-A * '.=.?*." h

a..

e t. e n i' i i t.___. %y. J,'@m'1= ". --...i,. ".*rM. i i e a e a i, ,.r ~ --- ~ e q. :, At* n.m e. Mr., 4x n w e y,y,.../, f.my i"m~L, ~ m i v s s a.as i,,. a - r ue. . y p. k"- 4 M.N l l . h x' yg...rv, e .- i Y' M. PERRY NUCLE AR POWER PLANT 5 hk' H D,; e,*.-7g ' =C ANpp THE CLEVELAND ELECTRIC m Y ILLUMINATING COMPANY D' 6' A' b l Containnent Atmosphere !!cnitoring Systen. Unit 1 Figure 7.6-7 (Sheet 1 of 2) (GAI Dwg. D-302-381) .i

I, l ~ 1 /.. g _., u._- ~ @ c,, li{ - m=do._ un ,... p .... ~,, e _.g,. g_..., Ax. =__4 .. s., (, _--_.9 p. l _,1_ . g _-4 n o._ t_pg c ....C*--4 ( L-* p.g_. pw4N>-- uz ./ i'

• "*ra u ]

$-, %? !$+14,'-5e @----+ h b.,& 8 m 1 .Q ,r s.,q '. d%. - g ii Nu, - ,g bl r4 a t 3. ; _, _ _ '** _ _

• .)

l _) 'me

• • • 5 q _ ': _ _
• s nise arrv*

.*..**e (. a _si.osI% }a r. s' ,e ) s. %s m, _ f,",*,R, was \\ ~ * ~= n C3 -~ l l a-- "'" "' (A _ I ! "Y _ _ _ ??"'?' '""'tMrs = = i f

• -*a~,e s,=.--......

z .,:r c ~ -=r -(o e----3 _b Q- -,...hj*** ""'** 2a ** 4 y._aq3f _ %==e a_q-. - q F.1 4 .. ~u -.A..m,~, f,.t. _,, _ ,,,,,.o. _.e,j I 7f g r_ I 1*"' *** WN f.s. os uy, j -- 9 ( - -c; I L.k l L I i w% r ~ <tn'*- $ ~ }, l G."hp ,. _Q.1 - - -(,,'%.av l l s. L .I k. n _ a.h_ >-h,".'.. 7.',[.h. 6> '"(y t ~ . ~. k C ['" - -( h4,(5A y \\ y j \\m/

e__,

t____.__ ,.______3, pt (,l,Q _ psy <t'."__._..i 4w.o i y gy A gy L_ ( M :f (v ws-h..h-d f I f f U 4+H 4,,c " (y>~ - 4 h v.m %. g~ AAAA ~- J O.k - w f ,s.. i m ~ - hrid I._ [M.._..T.; N o .s Q@@)$ ;;;.. as C% '.1,v.-C.a,-e ww- -- - ~. kL&L r i

r -- 4.I. N..,_ ,i ) .2__.43. a x "'" r-raia did '"3" M.? h,,.. (i;# _, u e = 9 p.M.']..,

7. _IL.

-- wn. -s =t... s. % p,__ m b m 3%5"- r,:a a x m 4to

• '*v..;

~ g---- M g@,,lr -y. ] ~~- Q,. v , 8" ,,,._. I, j f a. } ' - 4.., m.=== u, p_ / 6hr_% ~ p e 4 (N'T**4-..'.h a - g _ _ _d,4__.f._ 9 < 3_ ru- .m.O' / m <, ~ s., _,. _ j e @., -(T 7,>. M. g % - T fI,"- [i.,, & @ D'^:: y hy = e.. -1 ) ~ d !. Ed y -_ gy. & h~.Mpe 3 ' -- d I . "* & h ' a<=.a j r .m. lf r c-I ws. t: os. o yh; cm.,e a._...

n. s.=

w ~ [ l Ph I

t. _ _ _ t _ _ _ _ _ _ _ _~* _ _ _'":_d

~' ~' a ~ _ _ _ _ _ _ _. 8m., i j

5. _

l 8*O

1. ~"

9 6Tf *. ~ s = ; e... e.g=.tc;.:"" '--- 7 TC,,", = ,= b' @~~ b'4b,( g ,yi . 6, {l.&_.._"oN, v --(h 5 A---%** Y.) 7 ,___ E _...... M. 't. s o> " TTM g d6< =. M. 8c h "(.",4.=--h...~hI-$,,_gy- - t.) N " =_ - (7., t,. <. G 1._y fL,..,1..u-L.,,o --,c.+--------' 3,s a y-w 2 --k = ,,,,,,n ,o L,,.3-i ,,,,.,,,,. ~ ~ .1 -. ~ - - - - - - - > = = - i , l /*,D s a - e ms==me. m.ese.ea m.e=masee.e4 ,f[ l .,g,f L D ' g r.. mean. e e a e.e semis n, b_,3.,vh - *.ff'i 8' ~ ** ' I a== = *. me.cn s.- e r-r-- masses on. me e.us <. %ea~2- ' ='.= :=~~ ~ .s e m_s,-R.-3 ---~ ..s?' ro@'i'k %M h v.en q ~ T} t 4,,,,,,' wee 4.e.seem..e. e.e.n e e suwe e.: e i w (,. r, .am en m er ee* *== = s.a. use sem r" NOCL( AR SAF(TY REL AT(0 p__._ p i m.,, _r v ns =,r----m i Mr ?% l 4.#, -w\\.'.,,m,L I b.s aw"*s".) *... _f.nt. f'**. ' I**-- V'A ' 14). fff I 8 ...I'..*.. a d@, Q,,h {' b ',",,},7,~}g'p',.': e. 'I A*% 1Ci w s sasa ,1{ E+,pM,.d;...,[-~. s ~ =. ^= . =.. a' b;:. s =J,g["hll b@en**' ; A a ** PERRY NUCLEAR POWER PL ANT ~' = N,. %Ja ~""$~ I1 ~. - e, THE CLEVELAND ELECTRIC i, g4gf ILLUMIN ATING COMPANY Containment Atmosphere I Monitorint, System, Unit 2 Figure 7.6-7 (Sheet 2 of 2) } (GAI Dwg. D-352-881) } J

t, \\ s. ,\\ l .'3 s s e 7N ~ CONTROL' SYSTEM 5 NOT REQUIRED FOR SAFETY 3 .s A 4_ 1 1 7.

7.1 DESCRIPTION

3 y \\. Sect' ion 7.7 describes instrumeatation and controls of major plant control systems whose funct.io,ns aretnot essential for the safety of the plant. The systems c include: [ ~ a. Leak' Detection i s ,s ~ b. Rod Control a. .cormation (RC&IS) ~ c. Recirculation-Flow Control System ,w ( ~ d. Fe'edQater Control System Steam Bypass and Pressur'e Regulating System e. f. Refueling Interlocks g. Reactor Water Cleanup System h. ' Process Sampling System M i. ' Gaseous Radwaste System 4 j. NSSS Process Computer l 3, p- ] Refer to Tables 7.7-1 andi 7.7-2 for systen design and supply responsibility and g g similarity to licensed reactors, respectively. p

7. y.-

g A R' nctor Vessel llead heal Leak Detection - 7.7.1.1 e m Pressure between the inner and outer reactor vessel head seal ring is sensed by 1 ~byq pressure, transmitter. If tnciinnef-seal fails, the pressure at the pressure ,s t'rEn_smitter is the vessel pressure and the associated trip unit will trip and p actuate an alarm. The plant will continue to operate with the outer seal as a backup, and the inner seal can be repaired at.the next outage when the head is s removed. If both the ' inner and outer head seals fail, the leak will be detected by an increaseg n drywell temperat.uEe and pressure. i i k I? + h i I s 4 f g s. 7.7-1 !I mi f i

/ 7.7.1.1.1 Safety / Relief Valve Seal Leak Detection Thermocouples are located in ttte discharge exhaust pipe of the safety / relief valve. The temperature signal goes to a multipoint recorder with an alarm and will be activated by any temperature in excess of a set temperature signaling that one of th'e safety / relief valve seats has started to leak., 9 [ r d I 0 e J e 4 7.7-la

i 7.7.1.7 Design Differences Refer to Table 7.7-2 for a list of instrumentation and control system designs and their similarity to designs of other nuclear power plants. 7.7.1.8 Process Computer System - Instrumentation a. System Function The function of the process computer system is to provide a quick and accurate determination of core thermal performance; to improve data reduction, accounting, and logging functions; and to supplement procedural requirements for control rod manipulation during reactor startup and shutdown. b. System Operation The central processor performs various calculation, makes necessary interpretations, and provides for general input / output device control and d <r buffered transmission between I/O devices and memory. An automatic priority interrupt (API) module provides processor capability to respond rapidly to important process functions and to operate at optimum speed. Core memory is a random access type utilizing a 24-bit word and operating at a 800 nanosecond cycle time. A processor parity check feature is capable of stopping computer operation subsequent to completing an instruction in which a parity error is detected. The core memory has suitable shutdown protection to prevent information destruction in the event of loss of power or incorrect operating voltage. Capability is provided to maintain real time by utilizing necessary calendar type programs to compute year, month, day, hour, minute, second, and cycle. This is done automatically except in the event of a processor shutdown. In this case the operator is required to update the computer with the correct time when restarting the system. i i l i i 7.7-39 l l

l F l Bulk memory consists of serial access magnetic drum and disc, and is used for storing all programs and data. Capability is provided to protect selectable portions of bulk memory against infor1ation destruction caused by an inadvertent attempt to write over the programs or by a system power l failure. 1 The peripheral equipment is divided into two classifications; I/O equipment used to read data into and out of the computer and, output equipment which is used only for data output, storage, display and alarm. 1 The peripheral I/O equipment consists of one operator keyboard located in j the control room, one I/O typewriter, one magnetic tape unit, one card i reader, and operator keyboard with video term!nal, all located in the ccmputer room. i The output only peripheral devices include; two periodic typewriters, one as j n turbine diagnostic typewriter, one on-demand typewriter located in the j m control room and one alarm typewriter and three color video terminal 4 displays, located in the control room. Additional output equipment consists of a card punch, a line printer, two digital displays and two trend l recorders. The process I/O hardware consists of an analog input scanner, a digital I/O controller, corresponding I/O terminations and signal conditioners. The analog scanner accepts analog signals from plant instrumentation and ccnverts them to digital representation for use in the computer. The digital I/O controller senses plant contact actuations by groups and is used to read status information from plant instrumentation, including alarms and l binary code signals. Intermittent signals and pulse type inputs are sensed by automatic program interrupt change detection hardware in the central processor and allow immediate processing of information that might otherwise i I be lost if digital scanning were used. The controller also provides latched digital outputs to operate displays. i 7.7-39a

During routine operation the operator uses a keyboard located in the main control room to enter information into the computer and for requesting various special functions from it. Information f rom the computer can be directed by the operator to video terminal displays, digital displays, trend recorders or alare. typer. The programming and maintenance console is used by programmers and maintenance personnel to permit necessary control of the system for troubleshooting and maintenance functions. This console is a part of the central processor located in the computer room. The process computer system has self-checking provisions. It performs diagnostic checks to determine the operability of certain portions of the system hardware and performs internal programming checks to verify that input signals and selected program computations are either within specific limits or within reasonable bounds. m c A All the computer equipment, except for peripherals, is designed for y continuous duty from 0 C to 50 C, and 5 percent to 95 percent relative humidity ambient. The peripherals are designed to operate under more restrictive environmental conditions..All components are installed in air conditioned rooms. f The processor is capable of checking each analog input variable against two types of limits for alarm purposes: 1. Process alarm limits are determined by the computer during computation or as preprogrammed at some fixed value by the operator, and 2. A reasonableness limit of the analog input signal level programmed. The alarming sequence consists of a typewriter message and video monitor message for the variables that exceed process alarm limits. A variable that is returning to normal is signified by a typewritten message. l t l f l l l 7.7-39b

4 i The process computer provides to the operator a means of monitoring, displaying and recording both NSS and B0P events. These functions are performed by the following software 1) status alarm monitor, 2) sequence annunciator, 3) digital trend, 4) post data recall, 5) core performance ) calculations, 6) balance of plant performance calculations and 7) turbine and generator log. The status alarm monitor, monitors digital signal inputs for change of status. For NSS Primary variables the scan rate is 1 per second for 48 inputs. The program stores within one scan cycle of real time the time of occurrence of a change in status. A change of status is defined by the operator prior to the event. If a change is detected the program will alarm, consisting of a printed message. The message will include the time when the change was first detected together with a functional description of the process variable and its abnormal status. The operator can on demand request a listing of all process variables which are currently in the abnormal process states .e The sequence annunciator monitors up to 128 primary NSS variables and records to a resolution of 4 milliseconds in chronological order any abnormal event. These events are logged on an output typer whenever 64 contact changes have been sensed or 30 seconds have elapsed since the first det,ected change. Status designates the nature of the input event, j description of the signal and time to the nearest millisecond. i 3 The digital trend program monitors up to 120 NSS primary variables ~ (selectable signal inputs or calculated variables) and store at preselected intervals the time and values for the group selected. The interval rates are selectable 5 minute, one shot (on demand) and 60 minute. The output is available on demand in log format. The post data recall program is capable of monitoring 16 NSS primary analog variables, and 48 BOP primary analog variables. The 16 NSS variables are updated every 5 seconds with a past history recording period of 5 minutes I and a post trip recording period of 5 minutes. The 48 BOP variables are 7.7-39c -c- ---.,-e

f updated every 75 seconds, with a past history recording period of 30 minutes 4 and a post trip recording period of 30 minutes. The output will be automatically logged, and once output is initiated the log will run to completion. The core performance calculation is the total core thermal power calculated from a reactor heat balance. Total power is then distributed to every six-inch segment of each fuel assembly by calculation. Using plant inputs i of pressure, temperature, flow, LPRM levels, control rod positions, and the I calculated fuel exposure. Interactive computational methods are used to establish a compatible relationship between the core coolant flow and core power distribution. The results subsequently are interpreted as local power at specified axial segments for each fuel bundle in the core. After calculating the power distribution within the core, the computer uses appropriate reactor operating limit criteria to establish alarm trip settings (ATS) for each LPRM channel. These settings are expressed as mo maximum acceptable LPRM values to which the actual scanned LPRM readings are compared. The scanned LPRM, when exceeding the ATS, will sound an alarm and thereby assist the operator to maintain core operation within permissible 2 thermal limits established by prescribed maximum fuel rod power density and minimum critical power ratio criteria. The core power distribution calculation sequence is completed periodically and on demand. The sequence requires 10 to 20 minutes to execute. Subsequent to executing the program the computer prints a periodic log for record purposes. Each LPRM reading is ordinarily scanned once per minute. During power level changes, as sensed by a rod withdrawal or by an APRM channel, the scan rate is increased to once every 5 seconds. This fast core monitoring during power level changes is initiated automatically by the processor and, together with appropriate computational methods, provides nearly continuous re-evaluation of core thermal limits with subsequent modification to the LPRM ATS based on the new reactor operating level. Execution of these rapid 7.7-39d

. _ ~ - - l l I I i computations does not exceed 3 minutes and yields ATS values that are l conservative with respect to the more accurate periodic power distribution i calculation, which requires up to 20 minutes to execute. This range of surveillance and the rapidity with which the computer responds to reactor l changes permit more rapid power maneuvering with the assurance that thermal operating limits will not be exceeded. Flux level and position data from the Traversing In-core Probe (TIP) 4 equipment are read into the computer. The computer evaluates the data and determines gain adjustment factors by which the LPRM amplifier gains can be altered to compensate for exposure-induced sensitivity loss. The LPRM l amplifier gains are not to be physically altered except immediately prior to a whole core calibration using the TIP system. The gain adjustment factor computations help to indicate to the operator when such a calibration procedure is necessary. Using the power distribution data, a distribution of fuel exposure es increments from the time of previous power distribution calculation is "2 s ] determined and is used to update the distribution of cumulative fuel O exposure. Each fuel bundle is identified by batch and location, and its exposure is stored for each of the axial segments used in the power distribution calculation. These data are printed out on operator demand. Exposure increments are determined periodically for each quarterlength i section of each control rod. The corresponding cumulative exposure totals are periodically updated and printed out on operator demand. The exposure increment of each local power range monitor is determined periodically and is used to update both the cumulative ion chamber exposures and the correction factors for exposure-dependent LPRM sensitivity loss. These data are printed out on operator demand. The computer provides on-line capability to determine monthly and on-demand isotopic composition for each one-quarter-length section of each fuel bundle in the core. This evaluation consists of computing the weight of one 7.7-39e i

_= i neptunium, three uranium, and five plutonium isotopes as well as the total uranium and total plutonium content. The isotopic composition is calculated 4 for each one quarter length of each fuel bundle and summed c ccordingly by bundles and batches. The method of analysis consists of relating the computed fuel exposure and average void fraction for the fuel to computer stored isotopic characteristics applicable to the specific fuel type. The output is on punched cards which can be used off-line in combination with the card reader and the line printer to obtain a printed record. The cards also permit flexibility in transmitting the data to other offline devices for additional data processing. Balance of plant calculations provide a means of implementing calculations which give meaningful indications of nuclear steam supply, turbine, condenser, feedwater heater, moisture separator, and overall plant performance. The program also will nrovide unit operator factory daily and { monthly summaries. Such summaries it :lude plant capacity factor, average N .s power level, gross electrical energy generated, and unit load factor. All calculations will be executed and the results presented or atored every 10 minutes provided the plant is on-line, and power levels are high enough to ensure meaningful results. The turbine and generator logging program will be capable of monitoring 48 primary vpriables from B0P. The program has the ability to detect the occurence of a preselected turbine load, and monitor continuously at I second intervals the turbine speed. The output will be a daily or preselected load log once every 24 hours or at some preselected load condition At startup, the l'og is printed every minute from the time of turning gear disengagement and during turbine run-up, synchronization, and loading periods until some presclected load is reached. Should a turbine trip occur, the turbine speed is printed 54 times at I second intervals. The printout of turbine speed is 12 seconds before and 12 seconds after the trip. l 7.7-39f f ~ _ -.. _ -. _

7.7.2 ANALYSIS Refer to the safety evaluations in Chapter 15 and Appendix 15A. Chapter 15 shows that the systems described in Section 7.7 are not used to provide any design basis accident safety function. Safety functions are provided by other systems. Chapter 15 also evaluates all credible control system failure modes, the effects of those failures on plant functions, and the response of various safety related systems to those failures. The major plant control systems described above have no direct interface with any safety related systems and, thus, control system failures, other than those described in Chapter 15, have no effect on the safety related systems. e 7.7-39g

TABLE 7.7-1 DESIGN AND SUPPLY RESPONSIBILITY FOR NON-SAFETY RELATED SYSTEMS GE GE Design Supply Others 1. Rod Control & Information System X X 2. Recirculation Flow Control System X X 3. Feedwater Control System X X X 4. Steam Bypass and Pressure X X X Regulating System 5. Refueling Interlocks X X 6. Reactor Water Cleanup System X X 7. Process Sampling X X %h 8. Caseous Radwaste X X s' Ct 9. NSSS Process Computer X X D 7.7-40

a TABLE 7.7-2 i { SIMILARITY TO LICENSED REACTORS FOR NON-SAFETY RELATED SYSTEMS Plants Applying l for or Having i Construction Instrumentation and Controls Permit or Opera-Similarity (System) ting License of Design I 1. Rod Control and Information Grand Gulf Size diff-System erence 2. Recirculation Flow-Control Grand Gulf Capacity i System differences to accommo-date vessel size differ-erence 3. Feedwater Control System Grand Gulf Capacity differences i 4. Steam Bypass and Pressure Regulating System A I h 4 i ? i l S. Refueling Interlocks Grand Gulf Same for PNPP 6. Reactor Wcter Cleanup Grand Gulf 7 7. Process Sampl's. c.h l 8. Caseous Radwasts Grand Gulf N4 9. NSSS Process Computer Grand Gulf NSSS base g function similar 4 I;- i I i 7.7-41 I

9 \\ l I i. i V 1 t v... p, f t . :.,i l ,,a.-. ' a< t r,@F f ~. ,.,,,..:. r s, 1 ,n,,,. ....r. t..< p 4, '..-.a 8;.,. .i (?

• G.

4 g, .V a r... *.s f.-. ,j 6. (n. s .... !* A .,,.,.,,; ^ n, s g ', [p,,< 7-t f p.

J,',

f ,4.. i, j a e.,. 5,s. -e. )..,. + : T e m,, a ....-s. -,r 'I.

r,,-

-.y -. e,,..o u.., v.N /,,5 ~- -ea(, - b "'E 4

• vg g $, /...

'y'*"_- 5, 98

• se

,g A W. p s au e g,.u '. e N% 8 W ,u-- I P' *9'MM I ) i ~,,, ', ,.. - * ~ t. -e i =ie=g, ; r~

n

v /-~ 1 3 t. 3 7" +, e '.

i.. e -

e e W.8 . d'i (] ', / . Jj - Q-) p',- pg 3 ._.'.I -a. h.r ::, ..* L. s '. -.. 1* '. b. .L. '.'c,, w .y 4 ~ ..~. Mff g l ON h g , _bfOWt %g ggW g., =,ha4 $ Bf,4 -' l 1. l4 ~ {' >.;;g ]; .-~,.; :.,- g.,. .) + i I s t 1 4 -- e -~4 7g e, d1 m g g A.. 1 O r a y g a 4 5 .. e ,a .) g y.. 4.. s. i.. aI _J ,.s., 4 L._ ,_ I. i 6 6 g o s {f(I i? -[e II,. s e s. u e 5 i f Mg,. 4 t . e I "a. g. Ia g 9 $ e g6F l w .t. (Mr.

• }

1 I i

I i i s

2. ** a l

l I J. 6 ,g =. es tG [, t. ()i .(.h UAih p fc' t n m?.a s - .w.t' fi 3 l t---+ g,gr ? -w,c Wrrr'n "mq'. v 8d6 ,.ww+- r j l ii4. t- - i, J _.._-+1-L - t j w. i t d I t st ang. (._ !.. s i e..... s a._ p .j i e o g ea 1 - (y c. i t e....s . ~. c I 1f r . e e .'.0 } i l1 i g a. ,.. e as e w I -.v. .t._ (.L. 3 l l Etl j' '.c h, ,l . ( ),_ . is,. s t?. a st v y P gg [. l .u. i

• e

..e. ...w. -aw is. A met E A8 'WETY Rita'f 0 L,,, ..,v. .,n...... - -. _II 1. ..,. m......m..,. .4.. ~.,.. ..o... . i jK PERRY NUCLE AR POWER PL ANT ANpp; THE CLEVELAND ELECTRIC N ILLUMINATING COMPANY l Emergency Service Water System, Unit 2 Figure 9.2-1 (Sheet 3 of 4) (GAI Dwg. D-352-791) i

l 1 - s 8 i os.se e a.m r. m g-a .I. i ~ e ss.. dF d til 9 se e, -.4W8 r3 g)3 y ( me. n e. f

• i fyr r eg a

i .e 4 ?%.* ' i W9_NQ'A' Y

• T' t'

e P.'r y+ mam 4,e, s++.m oi.w (r - LO;+b. <4..... ,d L s, i I p,3, p, 6 - **** ha 4s \\ es. v8 ..'.. _ s.. v. e4 * ~ i 0 fn -m 3 e e-

/*, s 7, - r, u. r.w. a

(_, i \\ r,7 i r. , t,yj -* y,.t.J D}f . ~~J r. rtwe. s - - - -i C %[ s (4 ~,r esq$ g qu+ e-. e mace e..,rr 4

g. 3 p#.

m. w.m <' s... W), v. e 1** . w.n.... - i I ) I l m i ) L

• J

~ 248AI E "8 N 8 # Y"- k j 3 k ,,J.. ir - g dj T

j {'

_,-;d I y y. u-u= ~l' ' '.C, Uly is n' .c. > I ~ v <- n k4.S+-lt t pg k 4%F %# % T d WT %3 4i 76IN 4. g q' +- g,.. L gf ...c =. g mv..<,; p - +. m 1 I U -s -w.... 1 r m y. e s+ -ge f g jy,

• I'

} ~ 4 .- _ _ f u..s. e - k,,,,,

• =1, 4
• s.. _ _ _. _.

i j ' gg 4 g,, -- - i n d.4. Y h 4 91 E a -a ry,l e a tsw. j ((flestetim Wo 9 6Tu4 s re y e m twes t s I l 1

P

c.,.

t:::'m 1 4., I. /....J,, c ...... ~s... <,3.,, i--., f e- ~. g 8,, 6 -- u .. bw,* m... t.. y ( n ~.. n l l D $f .:h'., c*r I 'l.en 0)/,, i t.. t '* ii a e yL ,+.. g y i. -3 r, .i~. y h '.e - aJimm.mmme..w - 4 y..:: s ,-rpi r, a ~S r b, 7,"',,,., 's oc q . I. ' O' gC.7..N y.t y g, . L....,.4 "p g A . /;' 9 e 1 ,,s~ i q ~~.v..o ~-,- 4 g '.l .y',* g w.,M / ,,, 1 g, m i and,.',,j,); g e w.> w

• -. +.

x,, -a ..J. -.= y 3, .? i u 4.. ';.6. C3.g e. <k :.. g. 'am) ,4. ),._ {. ,, 4.

• ~.: 5

,,-...U = :.. %L -.,, w. c 4..~. r.. i ao.......,,.,,, ..,s.:v. 33 l m. }._I ..$.1A.)y[ *, Y %

n.n.

w .w. e,. @a. ~ , 4.+ Ja %J,. me. t we. .S .<>n.

e..

= 1 I E.- J

• Til G e.%.

I eI

---

+,

~ r-* ._,n'. f -.ge ' J --0.., ' mW

a n "M,.* j.). I..'e a

r-Gm 4k.... .3.... r.e 'r

• Td g

.h,'.%. I ( Hs4 DATA ~F-j, C.D :. j"$. 9.;: ,{, .g... ms? O F-J,e, W ur4 ., J. ". ,+. -. -.s s .m 4 i ' x m.;. (4.~ .. f.! " - 7,,,,,a. y I 4 p 1 s,., ,,w (..y. .c,.,s. _.a... 1 ,.. 6;m w ( .., % ~, r--*< (.a. ...r-,

(2 p'..

i 1 f.., s ,, a s......~.....,_, x a e .'i.:I.n..' '.. '.. i,..

","';'--***'""'=

{. 4 :; j , p., 6* /. O a. n g~ .n, est..,, ,1 i A W.. n.., .T,, ',T,b' p..l, 7.s) s.,,, u-1, J l U .a

a u,.o g5,.

.. d. y......,,t,. y y/" . = =........,

p. y S

~ ~. >..... q J'1 4.

• • "" a.l

).3.o a g 'ne.a .*.=..====.s t e 1 3 + r .....~...=<.. .u ~ ..~.~..s., .,,v . n.. y i c' 4 r-M. ns. e 8 J *t4.,, F~.. .is o., 'r -.. ~

• w

m.. -j l

• -.T

} 0,.::g **~* ~V a v m. .aaran wtry marto y A = ...'u.. ( ' f u

e. -.

.L.. 41

.... em A.3 . v. m t.3 %'.".,-t'5* * '~ =... L '.' ? w n t ..-..,..,v. I g. PERRY NUCLEAR POWER PLANT l pNppi THE CLEVELAND ELECTRIC l hj ILLUMIN ATING COMPANY Emergency Service Water System, Unit 2 Figure 9.2-1 (Sheet 4 of 4) I (GAI Dwg. D-352-791)

15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS) 15.8.1 CAPABILITIES OF PRESENT BWR DESIGN TO ACCOMMODATE ATWS The Nuclear Regulatory Commission is considering how to reduce the future risk to the public resulting from the postulated event of no reactor scram during an anticipated transient, i.e., an ATWS. The probability of an ATWS has been assessed to be significantly less than the probability of a design basis event. Because it is so extremely remote, the NRC will require some specific changes to the plant hardware rather than treat ATWS as a design basis event like other Chapter 15 events. These hardware changes in conjunction with ex' sting plant systems will act to prevent or mitigate an ATWS. For example, the Recirculation Pump Trip (RPT) will quickly reduce reactor power following l an ATWS. If the Reactor Protection System (RPS) should fail to cause a scram during a transient, the Alternate Rod Insertion System will provide the needed scram with electrical equipment that has a diverse design from the RPS. As a backup to these two highly reliable scram systems, the Standby Liquid Control System can be used to inject boron into the reactor and, thus, achieve subcriticality. These systems provide prevention and mitigation for an ATWS as described in the GE ATWS mitigation report, NED0-24222, Vol. 2. The RPT is a non-safety grade system which causes the reactor recirculation M pumps to be aqtomatically tripped on either a high reactor vessel pressure q signal, or a low vessel water level signal by tripping the main breaker. The [{ pressure devices and water level switches are arranged in a one out of two lI logic to each recirculation pump. 15.8-1}}