ML20070N728

Forwards Draft Responses to Instrumentation & Control Sys Branch 821005 Request for Addl Info.Gessar Amend Scheduled for Feb 1983 to Formalize Responses

ML20070N728
Person / Time
Site:	05000447
Issue date:	01/21/1983
From:	Sherwood G GENERAL ELECTRIC CO.
To:	Eisenhut D Office of Nuclear Reactor Regulation
References
MFN-008-83, MFN-8-83, RWS-001-83, RWS-1-83, NUDOCS 8301250589
Download: ML20070N728 (87)

Text

. .

GENER AL $ ELECTRIC NUCLEAR POWER SYSTEMS DIVISION GENERAL ELECTRIC COMPANY,175 CURTNER AVE., SAN JOSE. CALIFORNIA 95125 MFN 008-83 MC 682, (408) 925-5040 RWS 001-83 January 21, 1983 U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation Washington, D.C. 20555 Attention: Mr. D.G. Eisenhut, Director Division of Licensing

SUBJECT:

IN THE MATTER OF 238 NUCLEAR ISLAND GENERAL ELECTRIC STANDARD SAFETY ANALYSIS REPORT (GESSAR II) DOCKET NO. STN 50-447 Attached please find final draft responses to the Instrumentation and Control Systems Branch (I.;SB) questions in the Commission's October 5,1982 request for additional information. These responses reflect the NRC/GE information exchange meetings held in Bethesda October 14 & 15, 1982; San Jose December 7-9, 1982; and again in Bethesda January 11-13, 1983.

Most questions a e addressed in this transmittal. Responses to questions 421.06, 10, 11, 15, 24, 25, 29., 33, 43, 45, 46, 49 and 54 remain unchanged since their initial submittal on November 19, 1982. Therefore, they are final drafts and are not duplicated here.

In accordance with the schedule submitted on December 22, 1982, the remainder of the ICSB final draft responses will be sent on January 28, 1983.

An amendment is scheduled for February 1983 to formalize the responses, i

Sincerely, l

M b Glern G. Sherwood, Manager Nuclear Safety & Licensing Operation.

Attachments cc: M.J. Virgilio, NRC D.C. Scaletti, NRC .

L.S. Gifford, GE-Bethesda (Without Attachments)

F.J. Miraglia, (Without Attachments)

C.0. Thomas, (Without Attachments) 8301250589 830121 4PDR ADOCK 05000447

! PDR

421.01 QUESTION f f // ! L yy y y You indicate in Section 7.1.2 2, 7.1.2.3 and 7.1.2.4 of your FSAR that your statements regarding the applicability of the conformance of each of 3our proposed systems with the General Design Criteria (GDC), regulatory guides and the appropriate industry standards are included in Table 7.1-3 through 7.1-6.

Hnwever, Tables 7.1-3 through 7.1-6 are inconsistent with Table 7-1 of Section 7.1 of the Standard Review Plan (SRP).

Identify and deviations between Tables 7.1-3 through 7.1-6 of your FSAR an Table 7-I of the SRP.

421.01 RESP 0flSE The existing tables (7.1-3 through 7.1-6) were arranged consistent with the previous SRP = NUREG 75/087, Table 7-1.

However, these tables are in process of being revised with headings consistent with NUREG 0800, Table 7-1. Since there is actually less information required (ie, applicability of regulatory criteria is more specifically refined to appropriate systems), no deviations are anticipated. BTP applicability will not be indicated directly in the GESSAR II Tables. However a note will be provided to reference the response to question 421.02. Assessments for all BTP's in Table 7-1 will be provided in that response.

& &#meaaf.ntta & $k AG d fMIOy eAf gfn ~u.

f pk l

l l

N 2 37 Niict Os: $YLANO Se g C T~ ble 7. l- 3 RPS A@ ESF SXfrWS muurav RowqMem Mrucutiiry w,,g l j e CFR50 Affendsk A GPC3 S

Sustems SSA 1 4 IS I4 20 Li 1213 2y ss 29 34 Sr 38 91 lPEACTOR PROTEC-TION SYSTEM (RPS ~ X x x x x x x )( XX XX -

'T ENGINEERED SAFETY

) FE.ATURED SYSTEMS ECCS - X XXX XX x. X XX XXX CRv2CS' --- -

x yXX xXxxxX XXxXX MSP1.CS --

X XXxxXXXXX X Cantairument 3; r c"""' -

x xxxxxxxxx xx x Suppression

;"' '"" "' ' x xxxxxxxxx x xx SPMU - ~~

g gff (( XK [ ,

cc=S - -

x x x x xx xx x x x

( S=S - - - - - -

y xxxxxxxxx x x

• 2;t's*"ilu"'- v xxxxxxxxx X Secondary Con- , .

' s' ' "'"* 1 Control System x x x x x x x x x' x ._

Containment Isolation valve g 1,eakageControl)

Standby Power)

Sv=cc~

Diesel Cenera- 4.

3: (See

/

Toble F.l-!) .

(

tor Auxiliariasj Essential Servlee Water w System i CSF Area ,

Cooling

(

l Pneumatic j Fupply System ,K l

l i

tsa an Control _.

l Room INAC Control Dutiding Chilled t!ater "

System

[

I l

ng ,-

Dbie 7./- 3 (cour.)

RPS AND ESC SWTWS EMuuruv Reevu?'wn Mfucwury mwn 0i'nepe,.ddc'N.: .

1.h ?1.uz 'L.k,t ' Mi 17s 1 99 !.!#5 l !!T - '

Ccrr<ttfosdowy IllE 1 374 I972 3 8'{' I .3hA%

SH3teWf a I - ' I9'1f '

\l9751l'Yll i

\ l

• ~~ ~ *

. * -~

REACTOR PROTEC-Trow system spPsi-

.. )( X X X X X X .X )(..

ENGINEERED SAFETY ~

Od FEATURED SYSTt.MS ,,

CC. - X X X X X X X X X Cavics'. -

X X X X X X X X .K amCs

_.X.X X X X X X X X Containment .

• M***"'-- X X.X X X X X X X suppression Pool Cooling (

• maa X. , X X .X X .X X X X

/ SPMU - - - - - - -

X X X X X X X X X .. .

CCGCS --- - . - -

y y y y y Y Y l g

= = - ---

x x x x X x x x x -

p s

Ed:!'.';;i'n"'- .. x . . x x.x x K X X X . . _ _

secondary Con- , , , , , , , , , _ , , . , _ _ . , , , . . . . . . . , , . . . . . . . . . . . ... . . . . _ .

C" Control System . . .

Containment -- ~ *'- ~~

Isolation Valv LeakageControl) [ K / [

\

• StandbyPowerb

""c" oies.1cenera-1

-(se e Ta b le 8.I-I) tor Aus111 aries,

(

(

88 3' 'l ,, 9)*/

Essential ")

.) n:=' ""J" x x y: X X.X X X X

~ .

'Lt';' -

% X X X x X X X X

";;I'*n..em - X X.x x x x X >< X Main Control Room IIVAC h, ,, N k N [ [ ,

O Control eutiding

'ChilleJ tlater*"

't X X X X System ,.

[  % K )( X I

hicTE 5 -

I 6 e

• e *- *~c ce n Tor no o ~e e s to tc me ': .n f( n r In .su b.Tec t'*"s 1.1.1 4> 912.is s a v.i. 2. u . vee , e, . .r , e sp e c. r.c c. r. .-. <e . store ~-u .c e r>,_yr~>

s -. is s s .sesi. . e rp:

. m[ >c ssc3res o resiv'c r* 9"x' a

GESSM .E 22A 7ec'7 23[ NUClEAg I.St.AND REVC 7M 8/ E '7 / i' t l SAFE .SHUTPouk SY3 rems REGutArody REdu/REMENTJ ANLicAottiry Aqsppix '

f 4

~

jocFR 5~0 Anedox ^ GDCs Surtems SEA

• 2 '{ l3 l9 --

SAFE SHUTDOWN SYSTEMS ..

R 2ctor Core OIsolation X [ X X X Cooling System Stendby Liquid N N N y CIntrol Syst,em , -

RHR/Reacto'r

, Shutdown K / X X Cooling

+ _. _ ..

/ Remote Shutdown Sy:t.m g -

SAFETY-RELATED INSTRUMENTS [ be [ M -

F%r, E*ilC?'  : ._ _

j.21 C.47 153 f.6% t.75 j_.12. [,.105' J.12.

.. Y.

5ylf!C"'d%! _ 3'79 3FY 33F 274.-- ---

- ~'

89'1s 1974 '(115 19'11

~

sue sworoown ~~

systers Retetor Core i;;n**"caa2ia' x x X X X X X X l 'M"%! sun x x x X X.  %  % X l O' ' X X X l l"a%do %11n, X X X X X d Remote * $ down Syctea K

~

'##REME X, X X X X X X, X l

fforE.S

• I Generic Co wfor-s ec e stat eser#rs appe a r- in , subs ections 7 1 2 9, 7. /. 2 fo esd 7.f.2 II. Where ve9e rveCSectior.

In each ,s uste~s Hecthe comformanc e spreneer.r are s we=r BTI') ore onessee iv reste se to ques ev~yn n us,e ty.r b 2.tocrg So Ss a(s) e-e4g,re, use oE ZEEE - 29V I 971

CrE35AR .1L 238 VucLEAR t IJLAND 7'A 6LE 7. /-5' ornea wrws or avinw roa smry atseurey nearimmr muceu. / mm>

hi 1

1

--Susknc .EEA. 2 4 13 /?

OTHER SAFETY

SYSTD15

' Nortron Moni*

tiring System M [ [ [ [

O'tionMonitoring x x x x x

/ System

1. 4 a_.ryeling - ..

Intcriocks Function I Loc k.Rc7mP'.a .br*-* X X X X X (SeMy H efed petam) f

. Cont tu'^

._,- c.

K N N K r ene.t.ic,V.

RIcirculation I Pump Trip Sy: tem ruel Fool Cooling and W

• 1stnup System g

! Erywell/

11""uit"'er-+ x. X X X X System Cantainment and ' ~

Rotetor/

l Ausiliary/ Fuel \

Building Venti- @

Ittion and Pres-Curs Control /.

, System /

Containment Atmosphere Mont-P [ [ [

toring System

'"::e;;;';" %

Mon 1toring x X X X X

- _ _ - - _~

G-ESSAR X 238 Muct.EM Istup TA 6LE '7 f-5 (CONT.)

0THER S M TE p f $$dVIRE9 fgA $AfgTY REGulATo<Y RE d df/EM EMr3 A ffL /C A S/U r i ^1 A reig, NRC Regulatory Guid,Nn. fo22. l*l/Q / *$3 {e f 2 le7f {.fpf ' f, /fy Carraeponding 379 38Y ' 338 279 IErz standard /971 /974 j 97f f gq/

srsvtM OTHER SAFETY ,

SYSTEMS Neutron Moni-tcring system M K K K K K X A system

::a:n:;, - x x x x 4CET Se tecte= SpM -

($sfety hisTod portion)4 Rod Pattern g CIntrol System Recirculation y Pump Trip System Fu11 Pool Cooling --

tnd Cleanup ,

System Q Drytell/ ~'s Centainment

/ccuum Relief {'q

, System l' Containment and - -

Reactor /

Auxiliary Fuel - . - - - - -

Euilding ventilation )

cnd Pressure / %

Control \

System j C:ntainment ~(

Atmosphere Monitoring

[

Syttem suppression Poolj A Temperature /

4Monttoring

421.03 QUESTION In Section 7.1.2.10.18 of your FSAR, you provide information regarding the conformance of your proposed design with the guidance provided in Regulatory Guide 1.75. Discuss the details of your separation criteria for protection channel circuits, protection logic circuits and nonsafety-related circuits using one-line drawings, schematics or other drawings as appropriate, in light of the guidance provided in this regulatory guide.

421.03 RESPONSE Datails of the separation methods anc techniques are provided in GESSAR II, Chapter 8, as required by Regulatory Guide 1.70, revision 3 (See Subsections 8.3.1.1.5.1, 8.3.1.3 and 8.3.1.4).

Also, in conjunction with PGCC separation, see the NRC approved topical report = NED0-10466-A, as referenced in GESSAR II, subsections 7.1.2.10.18.E. 7.7.1.9.A. 7.7.2.9.B 8.3.1.4.1.2(6),

and 8.3.1.4.2.3.2(8).

-Physical separation of redundant Class lE circuits and devices / components is provided within each Class 1E control panel so that no single credible event can prevent the proper functioning of any Class lE system.

Separation is accomplished by mounting the redundant Class lE equipment on physically separated control panels. When operational design dicates the redundant Class IE equipment be in close proximity, separation is achieved by a fire-retardant barrier or an air space. Wiring is supported ir. a unner such that the designed air space I

would be maintained throughout the entire lile of the panel. Such Class lE control panels are located and protected in a manner such that a single credible event is limited to an internally generated fire.

l Examples of acceptable separation barriers are:

1. Two sheets of fire-retardant material separated by an air space or thermal i

insulating material '

2.

A single barrier with a one inch maintained air space or thermal insulating material between the components or devices and the barrier

3. Metallic conduit The minimum separation distance between redundant Class 1E equipment and circuits in-ternal to the control panels is established by analysis of proposed installation.

This analysis based on tests performed to determine the flame-retardant characteristics of the wiring materials, equipment, and other materials internal to the control board.

Where the control board materials are flame retardant and analysis is not performed, the minimum separation distance is 6 inches. Wherever the separation distances are not maintained, barriers are installed between redundant Class 1E wiring.

Under certain circumstances it is possible that various divisions of Class 1E circuits

, must enter the same device. This may occur with switches, a typical example being the reactor mode switch where four divisions come together. When common devices are used, the divisional wiring is separated by means of separation barriers between divisional wiring. Non-Class 1E circuits, within the Class 1E enclosures, which are in close proximity of the Class 1E wiring or devices, are treated as an associated circuits.

7 Associated circuits conform to the same requirements as applicable to the Class 1E 4 circuits such as cable derating, environmental qualification, flame retardance, splicing restrictions and raceway fill. Interface between divisional circuits, and divisional cnd non-divisional circuits, where required, is accomplished by means of optical isolators.

M Mme&j f go 974 , y d % 7A

% &, f A f ss M E .

• s e

I

I F/NAL PAAFT 421.05 QUESTION The information you provide in your FSAR discussing your conformance with Regulatory Guide 1.118 and IEEE Std 338 is insufficient. Accordingly, provide the following additional i informations

a. Discuss your proposed testing of response time, including the use of sensors, in relation to the guidance provided in Regulatory Guide 1.118 and Section 6.3.4 of IEEE Std. 338. Include in your discussion the effects of thermo wells, restrictions, orifices or other instruments in relation to the overall response.

b. Providp. examples and descriptions of typical response

time tests for the reactor protection system (RPS) and the ESF systems.

421.05 RESPONSE (for both a and b)

Regulatory Guide 1.118 and Section 6.3.4 of IEEE Std. 338 were reviewed and it was confirmed that the In GESSAR II design meets the intent of these guidelines. addition, we practice the state of the art in response time testing in that we comply with the EPRI study NP-267 dated October, 1976 (Sensor Response Tine Verification).

All ESF instruments (sensors and electronics) can be periodically response-time tested with the exception of gamma and neutron detectors which require a step or ramp change in gamma or neutron flux levels when compared to a suitable, agreed-upon flux-measuring standard. Such flux levels are usually high and there is no proven methodology acceptable in industry for sponse-time testing such devices. _

Response-time testing methods were reviewed at the GE/NHC meeting held in San Jose December 7-9, 1982 in conjunction with the response to this question. An example of the response time

. The NRC Peqvesred testing specification_ was presented i;;x: prrrid:f for 00 NRC --gy;yreviggfollowing t.'. additional p -

( information:

The techniques with ramps, steps, etc., used for response testing RPS instruments are as outlined in the GE preoperational test specification for the RPS. Acceptable response criteria which the teat must satisfy are based upon the response character-istics of the instruments that were assumed in the analysis.

flNAL PRAFT 421.07 QUESTION

( In footnote 2 to Appendix A of 10 CFR Part 50, we require the assumption that: " single failures of passive components in electric systems should be assumed in designing against a single failure." Accordingly, discuss how you consider passive failures in all safety-related instrumentation and control systems in your proposed facility. Provide assurance that passive failures were included in a failure mode and effects analysis (FMEA) performed in response to the concerns identified in Question 421.08.

421.07 RESPONSE Single failures of passive components in electric systems are assumed in the design of safety systems.

Passive electrical failures have been included in the GESSAR II FMEAs, in Appendix 15c.

f'

F /NA L MAFT 421.08 OUESTION

( We state our position in Section 7.3.2 of Regulatory Guide 1.70 that a FMEA should be a detailed analysis demonstrating that the appropriate regulatory requirements have been met. However, it is not clear in your FSAR if a FMEA addressing all credible failures has been performed. Verify that the appropriate FMEA's have been performed and address the following:

a. The FMEA is applicable to all ESF equipment.

421.08 a RESPONSE In accordance with Regulatory Guide 1.70, Appendix 15C provides for FMEAs on selected systems of Chapters 6,7 and 9. There are a total of 32 FMEAs; either completed in detail in Appendix 15C or identified as requiring the Applicant to provide. In addition, several interfacing systems are identified as requiring FMEAs to be provided by the applicant. The combination of the FMEAs detailed in Appendix 15C and those identified to be provided by the applicant is applicable to all ESF equipment.

421.08 b OUESTION

b. The FMEA is applicable to all design changes and modifications to date.

l 421.08 b RESPONSE As presented in Subsection 15C.O.6 the FMEA system-defining documents (electrical. instrumentation, and control drawings, and piping and instrumentation diagrams) utilized in conducting the FMEAs are annotated versions of the corresponding documents listed in Table 1.7-1. However, some of the Table 1.7-1 documents were revised (updated) after the FMEAs were completed. In each case the impact of the document update (s) was assessed and it was determined that the FMEA results were still valid.

421.08 c QUESTION

c. Provisions exist to assure that future design changes or modifications are included in the FMEA.

421.08 c RESPONSE To assure that future design changes or modifications are included in the FMEAs, a statement will be added to Subsection 15C.O.6 that commits the /pplicant to assess the impact of design changes or modifications, subsequent to the FDA. This will also be added to section 1.9 as an interface requirement. Drawings referenced in 1.7 and FMEA's shown in Chapter 15 will be consistant at the time of FDA.

FtMAL 421.09 QUESTION kr I Identify any nonsafety-related electrical equipment which is assumed in Chapter 15 of your FSAR to successfully operate to mitigate the consequences of anticipated operational occurrences and accidents. For each piece of equipment identified, provide the corresponding anticipated operational occurrence (s) and accidents for which that equipment is expected to function.

421.09 RESPONSE No assumption is made in the FSAR Chapter 15 about the operation of nonsafety - related electrical equipment to

, mitigate the consequences of accidents.

In the transient analvses, no assumption is made about the failure of the nonsafety-related electrical equipment unless that is the effect that is specifically being analyzed.

Unless specifically addressed in the analysis, the operation of the reactor recirculation, the feedwater, the main steam bypass and the pressure control systems are not assumed to malfunction during a transient.

In the feedwater controller failure - maximum demand transient, a nonsafety, reactor vessel high water level trip is used to trip the feedwater system and main turbine stop valves. However, a separate safety-grade high water level trip is used to trip the reactory The logic for the feedwater & turbine trip is two-out-of-three with the power for the sensors from three independant g ,, sources.

ht Turbine building cable routing for class 1E interfaces is hW l discussed in the response to question 421 38.

p 11 M'

t l

- Vf f W ( /

RECEIVEO, mrune Iousa sumes umrmem sammager ago Nr>.[23q8?

RW. STYb

\ .. . .

i

ember , 19 oct */

p/ !' ' '

l BE r .

e

,. m a 3D . ,K. ong Vill

/v -

5 FEM: . D. t M/ 54 Ext 621 MN SAR -'rsr - 421.

e fo ing a res nse trie ubj quest n.

~  %=-+ 4 Na21.3 2 QuesteE We BWR Owners Group sutznitted BWR Emergency Procedure Guidelines, Revision 2, by a letter dated June 1,1982 (BWROG8219) . Confirm the applicability of these guidelines to four proposed design. Review these guidelines to:

(1) insure tht the instrtunents identified in the guidelines are identified in Section 7.5 of your FSAR under post-accident monitcring; and (2) deter-mine the consistency of the requirements for instrinnentation accuracy c contained in these guidelines. For example, Item SP/Irl contains the

statement that

" Maintain the suppression pool water level between 12 ft.

6 in, and 12 ft. 2 in." Confirm that the accuracy of the suppression pool level instrument is consistent with this requirement. Caution #6 contains the statement that: "Whenever temperature near the instrtrnent reference leg...". Identify the ternperature instrtunentation you have provided to implenent this caution, t{21 (1 Recmonse l Re BWR Dnergency Procedure Guidelines (EPG), Revision 2, have been reviewed to veHf3 the adequacy of installed instrtunentation in the 238 Nuclear Island design both in terms of availability of instrtunentation and in terms of design criteria (includi 3 esase, suerses sad trecisise),

We availability of the existing instrtunentation and the adequacy of its range was reviewed as part of the Htanan Factors Engineering Systems analy-sis and is described in Chapter 18. Definition of EPG parameters which may require operator action was made as part of the Type A variable determina-tion for assessment of 238 Nuclear Island instrumentation against the requirements of Regulatory Guide 1.97. Wis discussion may be found in Appendix 1D.

Table 7.5-1 lists safety related display instrtunentation. Se parameters associated with following BWR/6 Emergency Procedures based on EPG's are shown in Table 18.2-3a. A comprison of these two tables shows that, with

( two exceptions, all EPG related parameters are included in Table 7.5-1.

We exceptions are Stanchy Liquid Control Tank Level and Condensate Storage Tank Level. Both of these instrinnent channels are specified as RG 1.97

v:

... SL u g "- '2 A

.Novembcr 1G, 1^02 (

4 pg.g1 RohkSE (C 0"YO Category 3 (refer to Table 1DA-1) which d>es not require a safety related classification. Thus including these instrtments on Table 7.5-1 would be inappropriate.

As Stated previously, the adequacy of instrumentation range to follow EPG's was reviewed as part of the Qiapter 18 Htnan Factors review. No instances were identified where the Emergency Procedures based on EPG's specified action at points outside the range of the installed instrtmentation.

Requirenents for instrtmentation accuracy are specified by the system designers based on intended use dar_ing routine operation and followino '

P design, basis eventaJ fiation these aci or just' ication o vi ons pirt of ' envi tal lifica on progr and is e # s

~

r _.

nsibiMty of th appli to aMr m. k <'

Details on each of the post-accident monitoring instrtnentation channels are to be found in A;pendix 1D.

r

\

l i

l t

1

o 6h --

421.14

~

We convey information based on operating experience to licensees and applicants by issuing Office of Inspection and Enforcement (IC)

Bulletins, Circulars and Information Notices (IEB, IEC and IEN).

Although only the IE Bulletins require written responses, we expect licensees and applicants to take appropriate action based on the information providedHn the Circulars and Information Notices which is applicable to their designs. Attachment 1 is a list of IE Bulletins, Circulars and Information Notices which are applicable to BWR's. Provide additional information on this matter which includes the following:

1. T> ,

a. Your procedures for determining the applicability of the various IEB, IEC, and IEIN to your facility.

b. .Your procedures or methods for factoring the applicable. information or criteria into your proposed design.

c. Details of specific design modifications including their implemen- '

.tation, resulting from your response to Items a and b above.

yzt.I4 RSSfoNSE (^ > h $

(see &essee E'i sunh I b r p reu, u ar a), n r ee v e o E A : = .  ;" ' M J

,t' ,^s : .~;, n c.  :  ; = .m u' ,&

t l

L

k 2.leld d dOESII0 _

4- fravede 2 4AK detailed analysis of your response to IEB 79-27 and IEB 80-06, including the results.

-m.

In responding to this question, provide a cross-reference to Question 421.48. (ro os onr3)

(

R E.Sp o n E H_ 'I I N cl Safe shutdown is assured through alternate paths for any electrical singis f ailure condition as shown on the attached figure. A detailed list of the busses providing power to the components used for the normal shutdown path and the alarms associated with the loss of these busses will be provided by the applicant as a response to IEb 79-27. The systems to be considered in this response are those shown on the attached figure,. g, g pg

$ec.Tsen e .. > A r Response to IEB 80-06 is contained in GESSAR specuda 10 4 M * / 'I l

l l

l l

l l

l l

l l

l l

o CEACTCQ AT NORMAL

. FULL POWER OPERATION l l NORMALCORE FIRST ALTERNATE SECOND ALTERNATE

. _5HUTOOWN PATH CORE SHUTDOWN PATH CORE SHUTDOWN PATH CM Cl C5 RECIRC FLOW RPS SCRAM SLC CONTROL (A) (C) (D)

I RMC5 CRO (S)

- -A----- q CO J

G RE SHUTDOWN COMPLETED _7-----

I I I

_ NORMAL ALTERNATE _ ALTERN ATE

_ COOL DOWN EOL DOWN COOL DOWN PATH PATH (OlV 1) PATH (DIV 18 & lit)

N Al A2 EXT.5 TEAM &

• HEATER VENT 5/DRAlids (E) l CONDEf 5 ATE &

CONDENSOR VAC. RCIC HPrt (F) (N) (R)

MAIN TURRINE &

STEAM SYPA55 SRV A SRV B (G) (0) (5) i i i CIRC WATER RHR A RHRR SUPPRESSION SUPPRESSION (H) POOL COOLING POOL COOLING i

(M (T)

FEEDWATER (J)

MAIN STEAM (K)

I __..

3

_ _HI.GH P.R E. .S.5.U. R_E

. _ COO _LDOWN CO MPLETE

, i 1 l SRV A SRV 8 (0) (5)

RHR SHtJf 00WN l l

, COOLING MODE (L) RHR LOOP A RHR LOOP B & C (M) (Q)

I I r

g,5HUTOOWN CO,OgOWN COMPLETE,D NOTE: Other variations of systems are pois;ble using RHRC (LPCI) ADS and LPC5.

elGUR E 1. . COLD SHUTDOWVN PATHS - _ ,_

7 natt

~

a ust.ly e GUESTTON

(

fy Nde A

$ At detailed analysis, including the results, of your response to IEIN 79-22 which you performed to assure that consequential control system failures in the event of a high-energy line break do not result in consequences more severe than those shown in your accident analyses in Chapter 15 of your FSAR.

(

Hniy e nev ass OH w t apwdt. L &ESSAA bet +, (*9 e

/

Item e. [ submit] a deta ed analysis, including the results, of your response to IEB 79-22 which yoy/ performed to assure that cpn' sequential control system failures in the event of a high-energy line break do not result in consequences

' more severe than hose shown in your accident' analysis in Chapter II of your FSAR.

Answer: Analys'is of other BWR plants has shown that, with the etception of the condenser veduum and f eedwater heaterMontrol components, systein interactions caused by ipe breaks do not result /in consequences more severe than the Chapter 5 event.

App priate guidance will be rovided in the interface quirements of GESSER S tion 1.9 so that feedwa r heater controls and con nsar vacuum components are ot physically located s h that single HELB condit ns would cause.their interaction.

FWA L PRA F T' goIn Table 3.2-1 of your FSAR, your provided a "Q-List" of structures, 421.17 (7.1) systems and components whose safety functions require conformance to (7.6) the applicable quality astcarance requirements of Appendix B to 10 CFR Part:50. Verify that all safety-related instrumentation and controls (I&C) described in Section 7.1 thru 7.6 and other safety-related I&C equipment used in safety-related systems are subject to your QA program Indicate how we may implementing the requirements of Appendix B.

determine which specific components shown in the electrical drawings ref erenced in Chapter 1.7 are classified as safety-related.

RESPONSE

All safety-related instrumentation and control (I&C) equipment described in Chapter 7 Sections 1 through 6 and other safety-related I&C equipment used in safety-related systems are subject to quality assurance programs whichimplementtherequirementsof10CFR50Appendh,perTableh 3.2-1 and Chapter 17.

I Electrical drawings identified in Chapter 1, Section 7 that contain saf ety-related components are so indicated on ~.he drawing. Specific safety-related components are identified by safety division classifications or special symbols as shown in Chapter 1, Figures N and 1.7-4.

l.7 -13

( m .w I

l

F IMA L M A F 7~

421.19 QUESTION Discuss your methodology and rationale for determining the setpoint values associated with the various leak detection systems (LDS) discussed in Section 7.6 of your FSAR. Discuss details of the manual bypass switch which will be used during testing of the leak detection system for the RCIC, including its conformance with the guidance provided in Regulatory Guide 1.47. Discuss the applicability of your response on this specific leak detection system to o?her such systems described in Section 7.6 of your FSAR.

421.19 RESPONSE Setpoint methodology and rationale for the Leak Detection System is the same as for the RPS and ESF systems addressed in question 421.18. At the GE/NRC meeting Decemb 639 ,1982, it was agreed between the NRC and GE to close thi$gquistion on the basis of the response to 421.18.

Tke m*"Unf *U poss Sui tek (ke3l ocked) 1.s placed ie rk e b y yn1r positio ne is t.en testing ft.e leeg defeetan feste used for RctC yystem igela toon. Couto-ol toe ** d u e< une c'r e tio n of

+ ls e by f*CJ C end t'tiets is frovided as "LD6tc A hV B V/As.r "

snd " Lo tic 6 IN BYPASS's Tkb bytess sud an runciatd., '

l e ff eks to e povTIon (teatr de tection) of the Rctc isolett n Iesic ,

asd does mt a ffect Rctc s p fe'1 ini tia tio*r oF c re +* tte s . Tkis stesugeeneuT meets ti.e inetent ef Reyle to+y Guide 1 47 t

l l

3 s f(MA L MAFT, V ,. ; l RE~ . w 421.20 uss in Chapter 7 of y;ur FSAR. tha d; sign crit;ria you hava ';. 7o pc-established to prevent trapping of air or noncondensable gases in p e n, the reactor pressure vessel instrument sensing lines. Discuss the applicability of these criteria to safety-related instrument sensing lines.

RESPONSE

dests The g crNeria to prevent trapping of non-condensible gases in the RPV ;=stra-cr

" sensing lines are as follows:

1) the instrument lines are required to be sloped downward from the -

. rise a's er the A ,r vessel to the sensors

• ereever41ocal instrument racks canabe locate y= 4 pookr ve n see prov;Jed.

such as to accomodate the] slopef lope of approximately 1" per foot is specified to assure that gas bubbles will migrate back into the RPV. Lesser slopes require [ engineering approval. The instrument line slope is required to be maintained through the drywell penetrations area except where structural interferences make it impractical to maintain the 1" per foot slope. In such cases) a per (q' foot slope ri,e alaisav=

isAallowed in this area.

2) Instrument lines for liquid service are required to be installed for self venting back into the process or be provided with high point vents to release trapped non condensibles after initial .

, g, pi., r ve., rs in the de well k*ve their-filling and thereafter if necessary. rn[e,,y,*7,,ff},,eP',j,dMfi de n 4d , , , g overo no Globe valves are required to be mounted with their stems horizontal to reduce the amount of gas that can be trapped in the valve body to a practical minimum.

Orifices in impulse lines are concentric to obtain optimum accommodation of venting and avoidance of plugging by foreign particles. The slight heel of non condensibles resulting from this practice does not introduce any instrument error.

21.20 3) Condensing chambers are connected to the RPV by 1" IPS minimum scont'd) nozzles which are insulated to within 18 inches of the condensing chamber, thus making the condensing area and the amount of condensate draining back to the RPV more uniform and predictable. The ele vn toon eve 4t.Q of the condensing chamber above the vessel instrument tap is limited to provide favorable conditions for the non condensibles to diffuse back into the steam volume so that the accumulation of non condensibles will not become high enough to impair the condensing

(

chamber,s function of maintaining the reference column level.

J Conservative analysis has detennined that with a condensing chamber located 4 feet above the vessel nozzle the maximum non condensibles partial pressure is less than 300 psi which would not reduce the

/

condensing rate unacceptabih since it would not prevent sufficient v

steam from condensing to maintain the reference level.

The foregoing measures are consistent with the safety functions perfonned by the vessel sensing lines.

l l

1

". Q - < N, F INA L M/ F7~ C' . ,'<iJ l'

. .+

a;6e:r G

Jone '.

tm

• c y' ' -

421.21 Provide impulse line routing criteria for safety-related T.\ STV' '

pressure and flow instrumentation.

RESPONSE

Safe.ty-related pressure and flow instruments sensing lines are required to be routed such that the single failure criterion is complied with and also such as to avoid unacceptable errors from trapped non-condensibles. Instrument lines are assigned to mechanical separation divisions and the instruments served by them are assigned to electrical divisions of the same number. In some cases it is necessary to serve more than one division of instruments from a single flow element. These special cases are analyzed on a case by case basis for compliance with safety criteria and shown to be acceptable.

Redundant sets of instrument lines for flow sensing (e.g., Leak Detection sensors) are required to be separated so that an event for which these lines provide sensory infonnation necessary to initiate the mitigating action cannot cause disabling of the sensing lines unless there is provided additional backup by means of diverse sensing or additional redundancy not affected by the same event. (An example of diverse backup is ambient temperature backup for excess flow sensors).

Redundant sensing lines are required to be physically separated except where convergence is unavoidable such as at the flow n d skutawn element itself as in the case of the main 4 steam flow sensors and the recirculation flow sensors. Each of these cases has been analysed to show that localized failure of redundant sen.;ing lines the Se bly b ehch does not impair A as explained = th; =t re,0e; in the fs//my :

O

421.21 (cont'd) 1. Main Steam Flow Sensing for Main Steam Isolation, Valve Closure:

/co w~ ~e r A main steam line break within the drywell Adoes not have to be sensed by the steam line flow sensors because the MSIY closure cannot isolate such a break. The high flow sensing is to protect against a break outside the drywell/ containment. The geg rett inside the sensing lines are widely separated outside theAcontainment, else c, iroiaa'e=0 they aregoutside thea steam tunnel and on opposite sides of it so they are not vulnerable to damage from the event they protect

• 9* t iS g , S tq7h. h,w

.. ,1 =ea ,+I,o,a

,,"*,'a e. Se=sI"s for Reic /Rotg s te* ~ is*!*fE*** v* ' C '*'"

3,t Recirculation Flow Sensors for Flow Reference Scram:

The instrument lines for Recirculation flow converge at a single sensing GI"$ pefft =n,ty fote.<rskt for_.qpipe whip or jets that could brea crimp an instrument line. It has been detennined that a break of sufficient magnitude to be considered damaging to these lines would be sufficient to increase the drywell pressure to the scram point very quickly and thus obviate any need for the flow reference scram to be operative.

Pressure sensing lines for the reactor vessel are also designed and routed to serve as reference pressure lines for the reactor pressure vessel level measurements. Therefore, they follow the sa venting, draining, and azimuthal dispersion and limited vertical /rkp 'in the L/

drywell as specified for the level reference lines. The routing criteria for these lines are as follows:

1. Redundant sets of instrument nozzles for reactor vessel level (pressure) are required to be widely dispersed around the periphery of the vessel. (Azimuths are 15*,165*,195*and345*).

2. Instrument lines are required to maintain divisional separation as they run radially from th vessel nozzles through the drywell and thence to local instrumrat racks located in the corresponding four quadrants of the containment.

421.21 3. Vertical elevation changes for the pairs of level sensing lines f'ont'd) g are required to be equal within + or - 1 foot inside the drywell where ambient temperatures can vary over a wide range. (from nonnal to LOCA environment) This practice results in automatic correction for drywell temperature effects and thus keeps errors resulting from varying water density predictably low.

4. Slopes of the instrument lines are required to be adequate for effective venting of non-condensibles and to penn1t etfective flushing. This is obtained by a slope of approximately 1" per foot 3 with Q" ree foot as an abulare minemem in lionited neces.

5. The vertical elevation difference from the condensing chambers to the drywell penetration is required to be not more than four feet to limit the potential error which might result from instrument line boiloff under condition in which the RPV is cooler than the drywell (in the event that the drywell is maintained above 212*F for a time sufficient to permit gross boiloff of the reference column.)

T a

F !s L 'f':'

4 $I ')3 _

G&

0 Sewx & /1<meef$$$la5; de{tGj- c4Cc yuj, . . ..f ..

R Wa Mgc- cemr).

Q. esp,ac

&gm 8 d2&rL t m 7 L&.~ 3 p pc.:.

O e

o e

e.g M

^ ~~ ~ - - " " - - _ _ , _ _ _ _ _-_

xts tivet N0'd 12 Ge; l 42l . '6 ~

$+< P.1 se.:

The basic elements of the decision making logic of the NSpS are standard l

MIL grade CPOS logic elements, in dual in-line epoxy packages, mounted on multilayer printed circuit cards.

CMOS logic was chosen for the NSpS application because of its high noise imunity compared to other types of solid state devices. With the CMOS devices powered by 12 vde, it takes an input greater than approximately 4 volts to switch the output on a low to high transition, and less than approximately 8 volts to switch on a high to low transition. Thus, noise spikes of consider-able magnitude can be tolerated on the input lines without causing erroneous logic states. As a comparison, TTL logic which must be operated at +5V has a low to high minimum threshold of approximately .7 volt.

Numerous design techniques have been utilized to reduce the possibility of any significant electrical noise being coupled into the logic circuitry.

All inputs and outputs that leave the N5pS cabinets are buffered and isolated, and internal wiring is routed to prevent " crosstalk" or radiated electromagnetic interference.

Specifically, prevention of electromagnetic conducted interference is accomplished in the following ways.

power Lines: Conduction of EMI via power lines to the logic elements is prevented by the use of switching power supplies which are speci-fied by the manufacturer to have a maximum noise spike of 62 mv.

In addition, each logic card has single pole filters on the power input to remove any remairing high frequency noise.

Input signal lines: Inputs from other separation divisions, and from nondivisional sources are processed through optical isolators which are also filtered on the input side. Inputs from same-division I sources such as the control room panels or field sources are processed through Digital Signal Conditioners (DSC's) which are filtered and

! optically coupled. Inputs to trip units are current loops and there-

[

j fore not vulnerable to EMI.

l l

., Page twc

/

Output signal lines: Outputs to actuated devices pass through load drivers which have pulse transformer coupling between input and output stages. Outputs to other logic eierer.ts in other divisions pass through optical isolators. A a8/#3 ovfpv& fc semate/ deWec are

• currerr loof] w%It tre net vulnerable, to Eh1Z.

Internal wiring: Interconnections between logic cards is on a backplane of wire wrapped teminals. The connections are made point to point so that groups of wires do not run in parallel for long distances. Power wiring is routed as far from signal wirirg as possible. The high current wiring of the drives to the pilot valve solenoids is run in conduit, as is the wiring for utility services (lighting).

Card layout: All signal inputs at the card level are buffered by a 100 K ohm resistor. The use of ground planes over large areas of the boards also insures electrically quiet circuitry.

All standards of good practice were applied during the design and con-struction of the solid state safety system to prevent any problem with EMI.

M% U h & . & Zr & EMI Kwtf((S&&% @ "g&; _

nuAd g A, p 4 Msts @ Q Q .

B

=

1 I

P(NAL PRhFT [1[a 421.26 In Section 7.2 of your FSAR, you indicata that int:rconnections between redundant safety divisions are allowable through isolation Ef T -

(7.1) devices. These isolating devices are used to maintain independence '

(7.7) between safety-related circuits and between safety-related and nonsafety circuits. Provide the following additional information:

a. Identify the types of isolation devices used.

b. Provide the details of the testing which has been performed, including the results, to ensure that the isolation devices provide adequate protection against EMI, microphonics, short-circuit failures, voltage faults and voltage surges.

c. Discuss the applicability of the tests performed in Item (b) above.

RESPONSE

a. Optical isolators are the principal devices used to provide physical and electrical isolation between safety-related circuits and between safety-related and non-safety circuits.

An4ofrui i solator is an optical coupler with a high degree of electrical and physical separation. The working parts consist of a LED (light Emitting Diode) photo receiver (photofbbnsi: tor or photo diode) pair separated by an optical barrier that will permit light to travel from the LED to the photo receiver, but will provide the necessary physical separation to satisfy USNRC Regulatory Guide 1.75.

The LED's are mounted near the edge of an input circuit card that also contains the appropriate excitation and logic circuitry; the card is slid into one side of a specially designed double-sided printed circuit card file. The output circuit card containing photo receivers and appropriate output circuitry is ides located on the opposite side. A refract ry g terjal ri3it The light to pass contains holes filled with clear quartz'g[b,ds4which p'e'b.etgen,'the t while providing the necessary impervious physical barrier. The printed circuit card file is designed to be mounted in a control panel wall or other bulkhead between redundant divisions or between divisional and non-divisional bays or ducts to provide signal continuity while maintaining electrical and physical separation.

Several different input and output circuit boards will handle a variety of input and output signal levels and characteristics. Some can be intermixed for maximum flexibility g fa minimum number of different card types.

6. TAM M & Qqs au .th i y Ab d?) &

i

RE' JVED.

N' 15 / '

421.26 RESPONSE (Cont'd)

PW 4 .

/

b. Optical isolators are tested to conform to the following requirements:

1. Provide electrical isolation between the input and output sides so that any abnormal circuit condition which occurs on one side will not affect the functional capability of circuitry on the other side. Electrical isolation between the input and output is sufficient so that a voltage of 5 kV applied to the input or output will not impair the function of devices on the other side of the barrier. The applicable require-ments of USNRC Regulatory Guide 1.75 are also satisfied.

2. Provide physical isolation between the input side and the output side so that any environmental abnormality (such as fire) that occurs on one side and affects circuit operation will be inhibited in affecting the functional capability of circuitry on the other side. The center barrier between the input and output sides of the isolator card file is designed usin special materials as are required to allow light to pass with negl ible loss while providing a physical barrier capable of preventing fire r other severe environments from having easier access between control panel divisions than if there were no isolators.

3. Provide the means of coupling between the input and output sides to allow electrical stimuli on the input side to produce the desired electrical response at the output.

4. The isolators are capable of operation within specifications when exposed to the following environments:

a. Temperature, humidity, pressure, and radiation according to the requirements spe@ied in FE" 3." .- &n5M I, .5edsen J II-

b. Seismic vibration according to IEEE 344 and the requirements specified in 6EssM y, SectJ, FSM 3.10 using standard plant response spectrum multi-frequency excita-tion while mounted in control panels in which used.

,prial

c. The41 solators have wide application and therefore meet codes and standards as separate equipment as well as part of system control panels in which they are to be located.

1. Institute of Electrical and Electronics Engineers (IEEE) sm: oest staana or IEEE 323-AQualifying Class lE Equipment for Nuclear Power Generating a.

Stations. ,g,g g, g,.

b. IEEE344MSeismicQualificationofClasslEEquipmentforNuclear Power Generatin Stations, .

g. IEEE 384-hitkria 19 Separationus of Class lE Equipment and Circuits.

UnireJ states

2. A Nuclear Regulatory Commission RC) f a. USNRC Regulatory Guide 1.75 (Physical Independence of Electrical l

Systems) Rev. 1.

! b. USNRC Regulatory Guide 1.89 (Qualification of Class lE Equipment for NuclearPowerPlants)

c. USNRC Regulatory Guide 1.100 (Seismic Qualification of Electrical Equipment for Nuclear Power Plants)

F/NAL PCAfr 421.27 00ESTION In our review of the Clinton application for an OL, we were gi 9', concerned about the seismic and enviror, mental qualification

.x of the analog trip modules (ATM) and the optical isolators J ,, . . O L (01). In response to that concern, the applicant stated that

, a qualification test of these devices is underway. State whether Lt.

• .". , the ATM's and the OI's proposed in your design are identical to

' ' those used in the Clinton facility. If not, discuss how they will be qualified.

421.27 RESPONSE The seismic and environmental qualifications of the optical isolators are fully discussed in the response to Question 421.26. The ATM's and optical isolators are identical to those used in the Clinton facility. They are qualified as part of the NSPS panel qualification program as was done for Clinton.

I l

l l

l

F iMA L DRAFT ~

421.28 00ESTION Provide a discussion in Section 7.1.2 of your FSAR of your proposed separation criteria for instrumentation and control equipment and components for the safety-related systems identified in Section 7.1.1. It is our position that these separation criteria should assure that safety-related equipment is not located in a steam leakage zone insofar as is practicable. Alternatively, they should be designed for short term exposure to the high temperature and humidity associated with a steam leak. In this regard, provide tne following additional information:

a. Identify the specific systems and the electrical equipment or components which are located in a steam zone and/or subjected to an abnormal temperature pressure, humidity or other environmental stress.

b. Discuss the safety-related function of the equipment and components.

c. Confirm that the equipment and components are included in your environmental qualification program.

421.28 RESPONSE Safety related equipment in all cases will be environmentally qualified for its safety function.

Physical separation and independence criteria and conformance for safety-related systems are discussed in f6AR sections 7.1.2.10.18 and 7.1.2.11.Mr. hES44IZ-1 Redundant divisions of electrical equipment and cabling are located in separate areas and/or are provided with spatial separation or barriers such that no single event can disable more than one of the redundant divisions or prevent safe shutdown.

Qualifications of electrical equipment and components, including equipment locations, environmental requirements, and method of qualification is contained in Sectic'. 3.11. (See Table 3.11-9).

l l

l f

hMA L PRA F T 421.30 QUESTION We discuss our requirements for anticipated transients without scram ( ATWS) in Volume 4 of NUREG-0460. However, we note that no description of the instrumentation and controls to implement these requirements for your proposed design has been provided in Chapter 7 of your FSAR. Accordingly, discuss your design and its conformance with our requirements in NUREG-0460 for ATWS. Identi fy all non-safety related equipment relied upon in your design to satisfy our ATWS requirements.

421.30 RESPONSE The GESSAR II design incorporates the safety-related Recirculation Pump Trip (RPT) as required by the NRC for the BWR. Its safety design basis is stated in Subsection 7.1.2.6.6 and the system technical descriptions and analysis are found in Subsections 7.6.1.6 and 7.6.2.6 respectively.

(dk f Y47 y W ff*

M ,

I l

l l

l -

/

RECIRCULATION PUMP TRIPS GESSAR II has two recirculation pump trip (RPT) design features for tripping the recirculation pumps in response to plant transients. One is known as the reactor protection system (RPS) end-of-cycle (EOC) RPT; the other is the anticipated-transient-without-scram (ATWS) RPT. These two RPT designs are described below.

EOC-RPT The RPS E0C-RPT trips the power supply from the motors for the recirculation pumps when the reactor protection system logic detects a turbine stop valve closure or a turbine cont.o1 valve fast closure event. The E0C-RPT function reduces the severity of the thermal transient that the fuel experiences for turbine / generator load rejection events. The E0C-RPT is a Seismic Category 1 and Class 1E system powered by the divisions of the 125V de power supplied to the RPS. Each of the four divisions of the E0C-RPT will take the RPS trip signal and supply it to the trip coil for one of the two in-series Class 1E circuit breakers on one of the two recirculation pump motor power supplies. That is, each recirculation pump has two in-series E0C-RPT breakers, each of which is fed by an RPS divisional trip signal. Although the initiation logics and inputs to the RPS trip are de-energized to trip, the final actuation signals from the RPS are energized to trip. RPS signals used to trip the recirculation high speed circuit breakers are also used to start the low frequency motor generator (LFMG) of the associated recirculation drive flow loop.

ATWS-RPT The ATWS-RPT trips the power supply from the motors for the recirculation pumps when a high reactor dome pressure or low water level condition is detected. The ATWS-RPT function reduces the maximum transient reactor pressure for ATWS events. Each recirculation pump power supply circuit breaker used by the ATWS-RPT is tripped by a redundant one-out-of-two relay logic, i.e. , one out-of-four logic fed by two level and two pressure switches is used on each pump. The wiring from these eight switches to LSF:rm/A122116*-1 1/5/83

the control room is separated from any RPS cabling, a.id the ATWS-RPT logic is located in different panels from the RPS. 125V dc nonessential power is used to energize the trip coil on the power supply circuit breakers. The ATWS-RPT logic also provides a trip signal to the LFMG power supply breaker associated with each recirculatianpump motor.

T l

l l LSF:rm/A122116*-2 1/5/83

~

15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM -

15.8.1 Requirements The issue of a postulated failure to scram the reactor following an anticipated transient, i.e., an anticipated transient without scram (ATWS), has been under consideration by'the.'NRC for some length of time. As a result of its assessment, the NRC has required the recirculation pump trip (RPT) feature for the BWR.

Plant requirements for ATWS in addition to the RPT have been pro-posed and are currently being reviewed by the NRC. .It is not clear what, if any, additional ATWS requirements will result from this review. It should be noted that the NRC has determined that the current risk from an ATWS event is acceptably small, and therefore any additional plant modifications would only be required for long-term resolution of the ATWS issue and such modi-fications need not satisfy the requirements for a design basis event.

15.8.2 Plant Capabilities The GESSAR II design utilizes diverse, highly redundant, and very reliable scram systems.

N these systems are frequently tested and would insert the control rods even if multiple component failures should occur, thus making the possibility of an ATWS event extremely remote.

The plant has the ATWS-RPT feature which prevents reactor vessel overpressure and possible short-term fuel damage for the most limiting postulated ATWS event. Subsequent to an ATWS event duum

, the long-term shutdown of the reactor can be accomplished by pither manual insertion of the control rods or baron injection into the vessel.

15.8-1 .

238 NUCLEAR ISLAND Rsv. 4 15.8.3 Additionni Modifientienn l

l Should the NRC mandate additional ATWS modifications, the GESSAR II design will be appropriately modified.

l 15.8-4 _

O

FINAL MAFT 421.31 QUESTION As a result of an event at the Brown's Ferry facility where a complete insertion of the control rods was not successful until after several attempts were made, we required design modifications related to hydraulic You indicatecoupling and level in Paragraph monitoring)to resolve this problem.of your FS 7.2.1.1.D.2(g cating level sensors provide scram discharge volume high water level inputs to the RPS. We conclude from this that your proposed system for monitoring the level of the scram discharge volume lacks diversity.

Discuss what modifications are planned to meet the recommendations of the Office for Analysis and Evaluation of Operational Data (AE0D) presented in NUREG-0785.

421.31 RESPONSE Scram discharge volume (SDV) level instrumentation is being changed to provide diversity in SDV high water level sensing. Necessary changes to GESSAR subsection 7.2.1.1.D.2(g) are shown on the attached sheets.

l l

1

GESSAR II 22A7007 238 NUCLEAR ISLAND Rev. 0 7.2.1.1.D.2.f System Description (Continued)

, The arrangement of signals within the trip logic requires closing of at least one valve in two or more steamlines to cause a scram. In no case does closure of two valves in one steam-line cause a scram due to valve closure. The wiring for position-sensing channels feeding the different trip channels is separated.

Main steamline isolation valve closure trip chan-nel operating bypasses are described in Subsection 7.2.1.1.D.4.(c).

(g) Scram Discharge Volume ,

j f} h &f,--

~~ ' Four nonindicating level senso rovide scram

' discharge volume high water level inputs t e reactor protection system. Each sensor provides an i to one instrument channel.

The sensors are arranged so no single event will prevent a reactor scram caused cram discharge volume high water level.

i.

With the predetermined scram setting, a scram is initiated when sufficient capacity still remains in the tank to accommodate a scram.

Scram discharge volume water level trip channel operating bypasses are described in Subsection 7.2.1.1.D.4 (d) .

The environmental conditions for the RPS are described in Section 3.11. The piping arrangement of the scram dis-charge volume level sensors is shown in Section 4.6.

(h) Drywell Pressure Drywell pressure is monitored by four non-indicating pressure transmitters mounted on instrument racks 7.2-12

Insert - Page 7.2-12 Four non-indicating float-type level switches (one for each channel) provide scram discharge volume (SDV) high water level inputs to the four RPS channels. In addition, a level transmitter and trip unit for each channel provide redundant SDV high water level inputs to the 4 RPS channels. This arrangement provides diversity, as well as redundancy, to assure that no single failure could prevent a scram caused by SDV high water level.

/eff Qusmot fINM VW W 421.34 In Section 7.2.1.1.0.6 of your FSAR. you indicate that pilot solenoids for the scram valves "are not part of the RPS" and that the RPS inter-faces with the pilot solenoids. Discuss this interface using detailed schematics and drawings as appropriate, including a discussion of the backup scram valves, their classification and their interaction or interface with the RPS.

[espa Nt r '

T)he sputuspekt al2.t. 34 Secrm) 1. 2 . I . l. b lr 'Do es m acw 17n+ 7 conrrLoz- Mo ns wb rw stRA+, Vkt.ver, Pts.or s'oLM*05 stsu b nttTIL Co M L' MW NdT PiHcr o T- 77tr~ S W . "

T~w" s+crukr/N4 bevices op. Lo,ss pseg egp.g suffyc ,, g ,g g o g, g To ?sovibe' os avrwvor rrv swwert 70 ne cocenvoiAr of -r w e - s c e ,e +1 estor- v+1.ues- nrz e ranrzr op rim eP.s", s s46.amvrt, triar nc7vnrvo wnce=s on ras sexes p/ror vkt.as .7%wses.Ves, Ar v a rrrerie..rste-wsios, w we pgrer or-res= seRS", Jor#nrriert orse to nsco a 6 x rx os - 777a C.unnus foo Deive- (TEb) Sr.rrve, . E w A/ronwa,e Gona a a.

O p ,7 ( Afc 0 ) of rite- C A b Cr s e e r s 4 SMiGG

%m ipitor Yes V6' Noticsf 42/Nrpot s 77te ,+r tz suP/Lf' 7e prar rw o scien+1 v'ts.ves osa - rowr HCO. 7%e sc,e4<r my VAzd8 Arm B&ack ScAMr nr/tstemcen- nrse. ,+vo e-n'/Mc6 17te~ krA '/D Th'G Tw a acAM rstz.yt5 psfeA.] as74 of tw pus sucecucaps of trw scem p/ coy p,rzog Af2 6~ blk-AJEF-6 /ih@ ,

~

560ses 7 A - 2.- I , 9A la o~b 7A / w w rrie-A <mv rr/sr u n o ,oiza e w o ,,- ,w,r prrb7tatees SVS Mrs'D W Solevoihs of )$e S r.: h t em p/ goy ygg,yt5 of rre- CAD sv.c.rsns1 The' NCU'r soub co*r**L Aobs "'n'*'t"6GD

'^' 7" pct 2 st~/-Af1 G 4 0 0 P s I n e 7k:s/ scs.es 6/ cup,17F i%ucit

/

70 i+t.L % *seLewU/bS oF- 17M KAAr's P/LorVittVb5 /su Asas aix./7potcco aV yr>s s:;7ssc w Sctzw 6/z ap o op- ;rt+'O //5*Lo40 Mziye72S, Gunset9, yarg ,cosvertyc sqt L- 'W' SJLewd'O.s op- 7M .5C49Fs **/ Lor stkr VES /^! 7irwr-3;tse nsg 6seoup s+12e- ccip72cLLGD BV 72<Jo b/Se oeeyy c to A-o J esu'e'9-S , r4 ro7?tt of s'Witzpo 4.onc p ga v ens sqf249; LI$ c'D ITD 42iN % W Po'UM J'O THG" N " Avh

- - . . n . . . . . . . . . .

2. 05~ $

(A/Q.1.hLl AewooMse toot.) ,

"B %Larxmrbs or-- rwar actsstesy P/w r y A s. sidaj p p- TroLg ngg G C 6 sAss 4 co podPs.

6bH oF Th17 Po02 LM410 DfLa t/GMg A sgry c.y",qyarp w s7pt 4 sripcic scpot spo op parcs?ves ors yrstp an w ne twose A blW $ePS 3/W/f/e Al . fd M ,eLt75 % s & fc F 6 E730c&

yppgr $ 5 4ostb Detts'93S sdA'b 771lmi svLeAJsixts JP prinsr st$nt'M JV4dY Vstt if25 AW 8't)&Jf 7577 3rts e.') ccA.sb/7NA45

,r,() 7292?~ f)stP 40 d/C$ esc" 677hWL dM 9000 N S DtW<t'svA's gv/ L t. C&v $6" 77)t3" /N70'1EUP77dAl dP- P08UG'R- '7D /$24. dP f1tL'~ b SdW'AS OF 4- Sf/EW 4stuup, 49 'b 7pe sp C 4 Af b t f A ))U $ //J IIYB'~*Wif 40 6 /C5 df- 677MtHFL- C P .7Ps%'"

ywp $ d1'1stf AJJA./6 $ N ok'Wof/cA,sr gutg c g ggg- yg~-

/AJ7E'?E UP770N #F ek.JeQt 7D sfG:. g,ce- 7?fti~ W 'ggLerasosDs gp l*- th-C' $stostt~ 45'L/%tt1 6)tC UP, W / M G fc W gtlRJ J'?)zr 7002. S N DJV/Ss/ Ads govb 7WG~ scssess stile?-

Vsfle/U" &l)LdAJ0)DS ef- L*MC/f' W/t9*1 6Adu? /f 77)tJS' 6f l A o p.w -o o r- or-7100 - 71Heen)-ysasco Das s6AJ coAsrvGu&fr7cw.

All p erTs of +iec HC U 's nn e tes ta b le _ 07 fouer so leasy ,n3 go e g rope,t3 tellessed (j_e., only one diersion o s tested et a tonee)f. recedure)

/s9t'~ Af/s9C'!!EVD S/ceTEW- $/)Deuf 7?JE" /N799CPPtCfS e F- 7?)t9-StS Losto het WMC *> i r7+ 75~r sigz.s/g5 , , , . yye- (ft,) ,

sySrn")'t Pit /dIt-- TD /ss s /4 avisewwnt77oss e p. p j, y jgyj(yg .7

/2c=v o mvD 8o 09//-/,se.,. o , A m n ;ge ,ea 5 swws 7av m rarr su/4L enn- Arrene- .irnr l &~CA$r ster MP&unnev7tme /9t- 6W/1$E. ktL t*v'LT/iert yscossso,o op- 7te ,sure7 wee-r ente sssusa co ncuseu.o u

,gs pe7L Aftf7C// B.

Foue zosse xevet. s/sm usec rv 7xie imo- Bos cons w u vern-s on.a .<uere suces .1 s enes- ar .we ,c-a /se sep.s Pte! /S/ #AJS , Eddb4 Nirssisa ./, /J%rs a Ja=cisp. edykss cessyr2cs

rous e - on imr smwa e m swervons ,ersoonrwa *)n e intr setzen pito7~ vm.vg solen.xsos , 7har owse ssonmc stnc-lbtynsr7($f2. /sU $/6/Jhs. CO N 7hr9 07 ,s # D 6u/ k N o9re pt pyyn"~ 6/6A/ACS s$2G~ s4r Lo6/C f.sveE tert D [o) , oNG"' af .irrtr s/6Aktes suitt

/NTt'E up7" is k utert- rv set L "A"csterAsoses /N scsem 6foss?/j 1775" 5 tE~o N b ov)L L /N7E78- Uf> 7 Pou/ e=1L 7'E' s92 L *8 " SvL en dJD.S l

/A) St'stshst 690JP 2- j !!/a~ 7?rrstb sustt /N7tr >e u rr .sy were.ru i

l - . - . _ . . . . __ _ . , , , __ _ . _ - . .

B e P.S~

h2.l.3N AeWicuss- M, )

1. L 'B 's n awa es su acee1 eaooa3 J ,eos/ ror rouan su/LL /Hin=R UP7' fe<>E72- TD ML '4 "soz.eaud /Ad sv sc %

G Gd 0 D Y . 'WL/' W Pt>UA Lossc Lovet as4W41 s O StG 511997^)4 h io M f5 D/VsisoP 1 M Mvu sN 991@r Ld6/C un m ,

,-e n,n?.,, n P nrL n s4e.t 'A s>LeAsasus iAsacx&e, esoups 2. esa i suo ro asL "A #6pLe%C:DS /H 6c/stes e goo Ps 3 ,eub ty', ,7]ttr~s buAE. a St6AsesS est< fo /W+17A/6 19eo / y At*5 psyscsod 3 Whe'A.! /A)

/

71157 LOCK L.dl/di- @vFLO (0) g7ppyr gjgg,, //)789t-UP7 77f6 NW92.

'fD sfLt.- ) "5'ols?Od>DS sp) gcp 6AoypS .5g9wb 2. pOVb 7D rLL. "BswLawusar io scoes GeosPs 9,*ws /. 7we' /*MW's pr>ug- s>6HitLS opt 4spAnpf neos s t fr's press,on 9/ , wrax sw fire to6 /c L.dV62 ttgle (a) gnyv, p/LL syyt9t.upT* Po w&R.

l qv stz. e. 'A " $3L ens os DS sN SCPAfs dAloJPS f'dvdb 3,ewp p g.st ",B "s'oLawo

• bs sa SY'#'+*' 6A'u PS / s**'b 2 .

I hTV~ ineWT* p/ar ;ntsP ss6WRt.s yo ritar Logo p4 vape$

co ynsott.JJ4 W 70m> ant. 70 7h*Er .52 seder sWLor s/st1.v6' wtexicics Do su o7 C7ticT Ac=PAesenrr 77stPs ep /No!VW#E.

ffS DivossuP 7Ptf A dd/C.S , 7'#c ptivse. .sydNPH:s oit 6AY4rwg

?>.4 M kJ? S *Dsy/ft'e N { A)/4 L ctM W 6 e' prec>1 A- 4cs6 /C f.cuy'g 2. ON6'{/),usUTP/PM W 73 s4- Le6sC f 641W ER20{0),

7R tPPG'D 6'f?hW' /F- 7775= .b/ V/S't'A.) / 7W/P 2-odsc A'the Adem) 7Nt M %r"D s eR- tP BorH 7fia= biu/s/ss.) 2. e.is DiesasoAs s 7pil' Losscs g4-se-G~ .5"/MUL 7?bubt' ids 4* /s.) s+ rMt/Psv Giubirron, j op tp Bo7?v 77ts- b/V///d A> 2- ewb LVs'/s/d As 9' 77LsP t o 6/cs W 5/HGL.7?!N6tivS GY /AJ A 71t # Ara c'o N D s7?os.,1, )ft-frAJA Z. 112tP s/6Assts.s fr es e y s :7pync - 7rysscE c??wcan /9PJ DIV*fidAJS s996 <s~rmtstreLy copp/ crop go fur stree-psf)*L-92 cA/7 PtoS- tr'71C# N S' D/V/S'usO.

s 7 t/g / i> M s's 6,u n s tvis,ss $h LVVot' son 2 du/Lt. esr=nse rv 7e'w t.ogic t. e,veyr kesto lo) s7?trE /F Ds V/Stu A.) 2. rtz oA/S sMs- Be2PO 7?tsPMb, of /P D/ V/S/ ENS 5 &Wb 'l /ht*'C' Ro7At stGOV /JEs// eD,#!C

/P DV/S#cus 3 nub / sMG" av79/ doww 79*sPs*6D. l/tE" FvA.-

3r(pAiME.$ ?*Ftd M k $ b/V/SsDN .$ 64.6/ L L C Y2tWN 6~ ~70 7'AY LOG'C L61/dl- Dwres (c) s7kre ie bivssio A) 3 sc.auc sm-s Ot!"300 11E t Pht'D , O fl.- /F D/V/ Sit;)DS fleva / r/stver- BefrY Been) i

f dP$

(fl1).54 M ws" " d l

%PPWb, OR. IP b80eG t Cho S Y RsVb 2 ftstVC Sow 66n) M IPP6*P, TN V RIt/M. S/4 N AL,s PY4 M $ N DJV/$/ssd Y Av44 c/tWeV6 G TC TRE~ Lo6/C 6 GV&'3 tK0(0) 57M76 /F bi V/Ksosu 4' s9s4 AIG Hss t$ser>t.) trair/GP, ok sa bivits o N S /re w o 2 mr Aury as a.s> 773/Ps't"O , #A l'= e/V/Cras u 3 /,4,vs & /Mvs p ar t y - d s- v A.) 795/t'/63

[W" ON/902 Ss6Nkt contsm/7 pF yrr15' rs Mkt. TPrP J.c 6/L Ss GNittS FYto M M N esy/.c scH ccereiAn't) ./

p s;r W rn*G FrNkt- DNo-owr-tif-tz<>d -pht'ew-rsdoce Ccw M 6u p ef3d N / W int ~t'6 dP i~? tar POWA- J/ t//fsd4's An77t- erncJ op- 77tn7 Fathe sY.sm 6pou' P.c fesc)L/5 y s4. br5/ 6N &#cfM*~*BV <*t;/ Sc/ TAM P/to7' wtz Vers of Ats. % ##+1 66dJPS ousL L of Acreses;zy ip g,v y 7N O OF 77127 Fc)t)/?- $/ $ b/V'sts o N Lodics /tt.G" 7gipfvD , s l Jo Sho**H1 de'Edus st=- osut>* s4- 3 /As/ te=~

~

$P$ todsc. s s 7M/ rs*rb . ./$w- A-ezos 77N6 cost & AtArroAl Rt-tP 4-oSir 43d"11* W'"'^ ' ~J?>tE~ /A'D/V/Dodz / /*S etvisissu fffPS tes/ b s77137 Ac'Yt'A7"70/) eF- 73'tr scA*4r's 14Lo 7-V A 1 V L' $ Cod L b dens 7 R6 ,Pe5c,4r4c-o s.ts ONE'-o 07-p,c -71J o r>Js c e con 8sA eo wsin p>tpr7M. ;rsad - our-of fvut 7N/ C6' coHd/NitrreA) 444,c, y~Ati,oes M w A2.Lak)$ yhte- f=vA'ms/sVAt- ,7bs77A4 ps- yaye- t=rA/stz.

A< 7Ust7vb &~2 e;*fsrW 4//2/A C> /

/t'43v7~ erAr7zerrdAJ warmar ssem7ws rire- w r 7 0 m va m St~/t Ar'1 ftN b 7'b7 /skt3 A /%%Bif6/4s7P- of SUQ&KS!*'l-Sc's % 1 5b?7~ /S GRen'72??t-- 77/sta.) e777st.-st. At op e'- o ur-ciP -7klo - 710tce'~ ,Dess6AJ op A yt.c o- our.- or - feius DE5/6 N <

i W /SMC $P 7)f15 h 04'/W W N Uf scie &#1 nues is ire so ew x so S<en e,no l Oc sonb bses wxs oe. rrz- #)5 ,e,ee vres 7v is,vig Pt' hoc'It- 70 7ah--saisen/ dibs os=- ?>ts 7sva 6enear seiestir YA'l V1.*5 sN TNc tWCW c)* s4- FUL/ f-e'?tC rD/ SW, frAE~GsLEA.Mso /P J/t'4'P strz**r vitt vs- Ct/ i c~

sit),<f oviec.

of L'Hensit==v i,a A .N @ o" 7 pip esvis7s o ,E p3

[ _ , , , ,

S~w.5' h/2,I.34 *=sw5# c*d bg y /StJ P) / O tt- btVikuN 2. povo sfr YRF 59946 fiMC A .kyV/6tef)

IN/ P UX t675 /N $ lf blW ISsod .$ $ L blWSto A) 4l, .? E" DLe-wp c/: /3ssctivP SC#st+1 Vk1t V6" O/- f//()$ ess/LL 6 6 6tsG93&t}s:s j/:: A- b>viSsosu 7?t/P er/S75 /N Af'S bivicio u 2. est nwkwa 3 mva er m~ s,*+te rrs c. 4 biVscam rosiP cvus

/Ar APS biaisisa 4/ oit. osaissis) /, &**c-siertrrip o r /7s.c-2 L W AJt4 b f f f 977)VC-K pr 737 11VO )$1CKup 64'/2A+1 VfLWt$

$44)CK' 72f7 /A S7Jt*A*C/A17 str/L Td/s*4 Y TD rsY *"

/

ed /4 c cc.pkp1 s+7/t MaarDW /?sVA M M $~R**G" 77M6=~ CW/fMVST T/rb=~ M/E- iN TPv~ .s~ct&#*7 M /t. /t %rt 9 & / t. W MD pf t u'WJti Art 6 ~ ofAE7~ sec 71sts" N$ AiA'emt<~'ts" 771 0 64ctdJP SW2&T V E t V P 3' 19 sv0 7?fri/L Sotea)dDs 49 cd M /> AJA9'N15 4P YMb- W st'im, J#S A4cMup ar,A&1 vet.s<a s r,o vo ypn:.rA?- ar>Larawsps y CLAts5'/PrW3 *AMs Nd 7" sHN#7 mas!' 30 Sm syg 90 cpek/7 /S 7?YM e~Ad >>U AIVV S4rtf7Y sestotYs4 Pie /x- Tim uft M cD 0P Thv" 4HC;MssP Sht&1 f4t Ve5, boe suLP fuVcr7t)sa /s ro B/hfs'57 :77/B~'197R /A) nyt;- scArog ,+rse

/k MP6*??- /997E9t- f- /Ce-?tc/Use accMt st/t> 7?f?Fr;/s ~c dos /V

7/p645 SCRM1 P/Lc7 6'41 Vh #>tf 19914.6D 70 tJP&Mst727 Ats'

,jpr soot?04 P W/M7?st- DeaAi&M6strtyro As o F iis pw o avtem/d>cs, YW Arie. Suff&tsD TD -rtje 1'av e Gese&>r Vit1virs j0ssouityvD p>tT?( 7?/nT*f/ lot VM V6 surLL S77s-L sr$'en/?vkt L-y >6 C E X /titu s 7lb s9s>b 7?fG As"SoCi&7VD (l4 N7foo L s4 b Asi4- <

'A7E' 77127 /Zv~?.tcro/3. cot ; , 77)t7te- 7 g suo 9G /hSM fert;7'r cciySfSut.nCG AsSoCr&rt D s317pf-777t~ f~n7LuRF dF so- F/N6t G" but7'l0AA*JsV COA /75GL see b 70 a)s'677-7~ V/A sY /-A+1 4 o 6/c. s% but b 7?/E~st*sWs RL o 7" Vitt V5' Ftryt-

72) ePc72 A-fE~ 799s D 4567W 8ACs*;'dP .52;strtsst Vitt / 8 5 ,$ d s'o fttit.17) OP&7e +7G~,1"?/e- CoArtitoL F2cb cAsi s'77s L AtG s

,s4/huUf2 L-Y /NfM7ETD iSV' .??tc~cis*'&?t-mst s//4- 77/c N0/2 Mkt- cad SFS7E*1 cb4neuLS, J73ctf6b : if2 /,3 4 Ske7C% .

't 2.1. 3 *f Sk*'7t 8

[ .,

. ._ ., - - . - , ya

~

3 g gb .

S f~ f A 11 IIys 1f ia r*- lg .

h-I li-1 f

_< S

!! F)5 p.

a - yS_-

43 yS -

x: - -

_V S

_r - _#3

+-(9[ ,

?g

)+  !

n - -

f)l. .. g , i

( t r ed4 am e(b;4-

-i -

f,-* .

rf .  :. p(.

7 ,3 7,,

j

~ ~ '

.. . ~~

!Y g b N , 3 s t3 4.M i

.g ai m '

" g#  :,

d fsf ( k '

[lso } Et _

'(E

, ,t * -

v 5' 4a .t ,' -

g

,8

• h, h

<Ee C '4 j'*7 1 I*

gi ft t

= MS M +

. 0<  : -~

ggi .

.g- , -

+

<' - 3;  : . y, -

t.

f  :  ; s

+ w n ga, '

- * . B s -

,c-c  ? e4 t -e

't

u. 3

.w

~ = W q Dz

+ w<

umb a

o g .-

c.

h.z :

+4 . 1Y 1  :

, ' ? Ec ~i_K P ; Eo 4 p ,

$.i h * $ i. ..

3=-

, o =s t .

o- - -

ifu,j RE ED I R% E 4 u,

s

"' We '6 l a , 6 {<,

-][I a  :

-, /\

+r . -

e .

g E5

%5kn .

f'HUS.(-( <--J'yD^) -(4 .

(.  ;.

_ . ..~_ g- . ::

L .

YS 13 8.2

%C -

~ -

Y3 --

Y3 40 -

1. C XS 3 M3 fj

~

'.. ,j '

fT T' [1 k

> m N w - M M gf jy

, 85 s

.ee p- e. -e e n om

':2 3 9 2 v 7 o

.?

1 1 ~.,.

T .a.

e o -

,y,,, .f 4

-.- d--- - -- 1

.at 4

4 -

,6 A

.a. s - =.< e ,- 2 em ,

(' i Y .T k. k... . hb b

$!I ige;-~ I 4ll 4 d 1 ji ";,5 d 1 I$! W -Ni

~'

g _W S

_XS _d_

2 _ys

_#1_- __

2

-is_-_WS.

H -

2 2 -

61 f j

- p-(-M i4- m b e g te

, jy .

fy Y .

.., 'p ' [I g - ...

it'll.b,i jt # l.IN,! .

d 5 N O

((iW(

[,8 Et # -( < - (-bi. .

].u k"

1-i.

-1M,p  % '-(-Kj mw dig tg 3

.. tu E. n.

s et ag

" +

~

hut

+? E .

%}

{ ,, , -

tp. n~I .

gg

,~ , a .I 1 M gy. .

e . ,

.. g .' % '

sh 23 7 f. s 00 e .

hb _

U

~>

t "

w t a s 1 j g

1: .,

3 ,

1

't ,

.l <e

+

C + 5 yc

,a o f-+-

+ # d

> 3

. ]W , go 4

o0i S f u. J '

i i-- *F.

z R* -

q 'f1e s -6 z -

9 '

.a J  %- 5 W'

• f y$h Q-D . !fa5 e

(!: +

E4 o7

1. 2 ED 8, &#

- a u. }

4. n he,

)su -< i j e =g

~ ' '

-3[I

{-3E . . .

A

++

w .

Ak ( l55 t,

+ .d7 ti # d ..,

< - -l[v#1 -

f-

}~ .

0 -

C --

XS ta vs -

c --

t. - ta ym - g -

k lI iY -go yk h k h

h h' .{

Us

' h. '%' '

45 %, .2 ~

.T o

+ g. +

1" 7 T2 34'7 J6

.:' -- T "3" dL .d e

,e 7 e

.o e & v e e 'T 'Tm c[e/ d r 2

• T 1 .? .? .Z.

O T -

T+ 4 4 e

e

6 M' .

421.35 In Figure 5.1-3C of your FSAR, you indicate that the RPV pressure and /

'7.7) - Y water level instruments use the same instrument lines. Identify all other instances where instrument sensors or transmitters supplying information to more than one protection channel,are located in a common instrument line or connected to 'a comon instrument tap. Verify that a single failure in a comon instrument line or tap (such as a break or a blockage) cannot defeat the required protection system redundancy.

Identify where instrument sensors or transmitters supplying information to both a protection channel and one or more control channels are located in a comon instrument line or connected to a common instrument tap.

Verify that a single failure in a comon instrument line or tap cannot cause an initiating event and also defeat protection channels or functions.

Provide a list of the shared equipment identified in response to these questions. Include the turbine stop valve / control valves as well as the RPV instrumentation in your analysis.

RESPONSE

The figure cited (5.1-3C) shows a part of the nuclear boiler system and its safety related level and pressure instrumentation and illustrates schematically the grouping of instruments on the four sets of instrument taps at the four different azumuths. The vessel level and pressure instruments of each single division are connected to the same tap.

This is consistent with the single failure criterion which assumes failure of an entire division of equipment as a Single Failure.

There are instances where ; single instrument line or tap serves instruments in more than one division of the protection system. These cases are:

1. Main Steam Line high flow sensorsfor isolation of large main steam line breaks outside containment.

2. Reactor Recirculation flow sensors for flow reference scram inputs.

3. RPV level sensors for RPS division 4 and HPCS division 3 level inputs.

4. The Main Turbine First Stage pressure taps providing power level infomation to the RPS to pemit scram on turbine trip above a specific power level.

Each of these four cases has been analyzed for single line break or blockage consequences and found to be acceptable as follows:

Each

1. Me, main steam flow sensing element has two sets of A P taps ///ao which run in divergent directions to two local instrument racks indde located outside the drywell on opposite sidesAthe containment outside es4aia meat h theasteam tunnel. Each local rack has two steam flow transmitters, which are assigned to different electrical divisions located on diffue[separatedsectionsofthesamerack.f#ostulatedinstrument linehilurecouldcausetwohighflowsignalstobedisabled.

Such a failure could not be the result of a main steam line break outside the containment because of the location of the instrument fert ll=essad j

racks. Therefore, the failure can be considered a random failure.

The remaining two channels of flow information emanating from the secondinstrumentrackprovide[thesignalstothe2/4logicwhich will initiate isolation as required by a large main steam line break.

These main steam flow taps serve no control functions.

Each

2. *%e Reactor Recirculation Line flow element is an elbow tap which 3

Ms two sets of instrument lines which run in divergent directions tw Na togl ocal instrument racks outside the drywell and in3different quadrants of the containment. Each set of instrument lines serves twoAP transmitters which are assigned to different electrical divisions =d e located on separate sections of the sub divided Itar local instrument rack. A postulated instrument line4f ailure could affect two of the four channels of flow infomation to the flow I

reference scram circuit but the remaining two operative channels would

provide the necessary 2/4 inputs to obtain a scram on the 2/4 logic :F low recirc flow were to occur. Instrument line damage in the l

vicinity of the elbow taps as a result of a LOCA induced pipe whip uoofd }

or jet could not result from a leak so small that it sewM-not Therefore, quickly raise the drywell pressure to the scram set point.

failure of these lines as consequences of a LOCA is not a safety concern.

These recirculation flow taps serve a rod block function but do not cause any active control action that would initiate a transient.

3. The division 4 RPV level sensors includes level, transmitters for the ,

HPCS system which is a Division 3 system. Therefore these transmitters have 24 VDC circuits from division f h into a Division 4 C44teF 7 e gses s'rr n i.ro pHE povrsto+

3- Tke DWiie 3 m'  :^ circuits are re;;ic;d to b?::p: :td from the Division 4 c e s W tset 4'W K (N rHC eters w <t c a nt w T circuits by ecprr.t e c' :;r;;gand routed in a Division 3 raceway,

+b' tt ' ^^ inu ..wiel yvasi 6v uncu 6v 6nc or Conduit j ^V8" Di"#CiO" ' ;ir:2 4 +c 4" *he i;i-it 3, C^J.;i,0Fjg-th: Ciii;i - /

M w.ta us e lu d n. . eJ. 1 ;;;.J;3 ;; t'e'/ '2nnnt Dose a threat to e.A 4w r 7

\' fo the Division 3 ;ir;;its. It is also noted that the HPCS has a separate set of sensors located on the other side of the vessel /

containment. The division 4 RPV level taps do not serve any control function.

! 4. The main turbine first stage pressure connections are not always

' separable into four separate taps because of physical constraints.

Where only two taps are available each tap serves two sensorsj l 6fecrimo or one in each of two divisions. Ther breaking of an instrument l

line can thus disable two sensors. However in the 2/4 logic the SensoY $

i two remaining operable beg would give the required two inputs to permit the turbine stop-valve-closure scram on pressure above their set point.

The first stage pressure taps provide input to tran:mitters used in the rod block circuits. Each tap serves one of the rod block circuits so failure of a tap could disable one of two rod block circuits leaving the other active. This failure would not initiate any transient that could cause a need for the first stage pressure safety signals.

o,e not shored since they

5. The Turbine Control Valve fast closure signalsAare taken from four separate taps. The only other instrument taps that serve both safety and control functions are the RPV level taps on divisions 1 and 2. The transient analysis covering a failure of one of these taps as an initiating event is covered in detail elsewhere but in sumary a single failure that could initiate a RPV level transient that exceeded nomal operating limits would cause either a high or low level scram which would not be disabled by an additional singla failure .s ia. c c fke tJ e ee * * '"'Ej opersk/e Jensee.s wev/c/ give to ini Tid te s c ra m.

the regoired */ iss puts Se*i%, .y_ q c _J i

l l

t 1 g#y [=twL DAFFT~ n :

Provide an evaluation of the effects of high temperatures on the 421.36 (7.1)

(7.7) reference legs of the water level measuring instruments resulting )

I l

from exposure to high-energy line breaks.

RESP 0NSE:

Exposure of the RpV level reference columns to the high ambient temperature associated with a High Energy line break will heat the column,et ==:t ; . -age Ag A. U.eiiiiol 6;im c m. . ., ;. . . ; d" S ;;;dntel.,10 . ~ .;t . Therefore, the water in the reference ste dvally column wil14approach the temperature of the drywell environment.

P aba"t ?0 .ir.std This temperature will depend upon the nature of the break. A large break will give a relatively low temperature (approx. 280'F) whereas a Small break will superheat the drywell to approximately F. This is the condition which is of greatest concern because in the small break case, it is expected that the vessel will be depressurized after a short time and vessel water temperature will then be lower than the reference column water so that the reference column will boil. The boiling will be rapid if the vessel depressurization is rapid and it has been determined that approximately 20% of the reference column exposed to the high drywell temperature could flash quickly. This is based on a vertical column and will be less for a sloping reference line such as exists in the drywell because the volume of

(

water per unit of vertical drop will depend on the slope which l

l 4 te l will typically be f ginch per foot compared with 12 inches per foot J

for a vertical pipe. After the initial rapid flashing there would l

t be a gradual boiling over a period of hours if the drywell ambient was maintained above the vessel temperature. Thus the reference column could be gradually depleted. The effect of this l

depletion will be limited by the vertical height differential between the reference level and the instrument line penetration through the drywell wall. This distance is limited by design

!(([ N [= to 4 feet so as to limit thefoil offlpotentialj error to not more than that equivalent to four feet of reference column. The error would be in the direction to make the indicated level higher than the actual level. This error will not' exist prior to the depressurization of the vessel because there will be no boiloff and the reference and variable legs will heat up at very nearly the same rate and thus compensate each other.

r >

It has been detennined that an error of the magnitude cited will not result in incorrect operator action or unsafe reactor conditions during recovery from LOCA.

f .

W k 3 a ag&, ,,d .*& Au%;

wx .6e sera a A 24 c.~v==J

1. M h' u

1 l

l FINAL PAA F T~

421.37 QUESTION Verify that there is sufficient redundancy in the water level instrumentation to prevent a sensing line failure (i.e., break, blockage or leak), concurrent with a random single electrical failure, defeating an automatic reactor protection or an ESF actuation.

421.37 RESPONSE In BWR/6 solid-state plants, the RPS logic is any 2-out-of-4 ,

channels to scram. Therefore, if one RPS channel reads errone-  !

ously high due to the instrument line failure and any additional  !

RPS channel is assumed to fail-short, there are still 2 remaining channels left to accomplish normal scram. Assuming an instrument line break in Division 1 (worst-case in the Grand Gulf analysis),

it is possible to fail either RCIC or HPCS by postulating the additional failure in ECCS busses 2 or 3 respectively. However, both systems cannot fail due to a single electrical failure and there will always be a normal Level 3 scram prior to automatic initiation of either (or both) high-pressure system.

The worst-case scenerio is postulated to be the reference line break coupled with HPCS failure. Normally, the operator would switch feedwater control from the bad instrument line to the good one as soon as the level mis-match is detected by the annunciator alarm. This would immediately restore normal water level. Should he neglect to do this, the water level would continue to drop until it reaches Level 2. This level would normally initiate both HPCS and RCIC and trip the recirc pumps.

Assuming the additional electric failure of HPCS, only RCIC will start. Since a successful scrameoccurred at Level 3, RCIC is sufficient to cause water level to turn around between Level 2 and Level 1 and rise; slowly filling the vessel as power decays. If still unattended, the vessel level will gradually increase until it reaches Level 8 which trips the RCIC turbine and assures closure of the main turbine stop valves. Thus, level will drop back toward Level 2 and the cycle will continue to repeat itself even slower due to residual heat decay occuring in the vessel, This will limit vessel level between Level 2 and Level 8 indefinitely until the operator takes the remaining shutdown action. The postulated scenerio therefore has no adverse safety consequences for BWR/6 solid-state plants.

See aise question ll2l 35 ed its ossociated respVn)c.

l l

?

I

QA A F" n F INA L 4 21.3 In Section 7.2.2.2.C..l.a of your FSAR, you state that the turbine stop (7.2) valve closure trip and the turbine control valve closure trip. are not guaranteed to function during a safe shutdown earthquake (S5E). We recognize that full conformance to the requirements of IEEE Std. 279 and the other standards referenced in IEEE Std. 279 is not possible in those plants where the turbine building is not a seismic Category It structure. These limitations are acceptable if you install a system which has adequate reliability. Accordingly, verify that the design of of IEEEtheseStd.

trips, 279up to the trip (solenoids, addressing: conforms

1) single failure to those (Section 4.2);sections (2)

Quality (Section 4.3); (3) Channel Integrity-(section 4.5 excluding seismic); (4) Channel Independence (Section 4.6); and (5) Testa.

bility (Section 4.10).

421 38 RESPONSE (1) GESSAR IIlection 7 2.2.2.C.1.b verifies that the design of these trips conforms to Section 4.2 (single fallure criterion) of IEEE Standard 279 Four separate divisions of turbine stop valve and control valve closure sensors and circuits provide trip signals to the Reactor Protection System. Trips from any two of the four divisions will cause an RPS trip (scram). Any single failure within the RPS will not prevent proper protective action at the system level when required.

(2) GESSAR II Sections 7 2.2.2.C.l.c and e verify that the design of

& (3) these trips conforms to Sections 4.3 (Quality of Components and Modules) and 4.5 (Channel Integrity), excluding seismic only within the turbine building,of IEEE Std 279 Theotilitgapplicantwill provide the information on the quality and integrity of the turbine stop valve and control valve closure sensors and circuits within the turbine building. Generally, GE requires all hardware which contributes to scram to be qualified per IEEE 279 (excluding seismic in the turbine building if desired by the M ill applicant).

' (4) GESSAR II Section 7 2.2.2.C.l.f verifies that the derign of f

these trips conforms to Section 4.6 (Channel Independence) of IEEE 279 The logic and control circuits for the four RPS divisions are independent and physically separated by barriers and/or distance.

The;4111Qa),plicantwillprovidetheinformationonchannel independence of the turbine stop valve and control valve closure sensors and circuits within the turbine building.

(5) The RPS logic and control circuits are testable up to the trip solenoid even during plant operation. GESSAR II Section 7 2.2.2.C.I.j verifies that the design of these trips conforms to Section 4.10 (Capability for Test and Calibration) of IEEE Std 279 The Mility/ "

applicant w311 provide information on the capability for test and calibration of the turbine stop valve and control valve closure trip sensors.

P

, ~ _ . , - - - , . , _ . , . _ _

421 38 a QUESTION Verify that your proposed design includes a highly reliable power source which assures availability of the system.

421 38 a RESPONSE The RPS is supplied by highly reliable class 1E power sources which assure availability of the system. See Figure 8.3-1 of GESSAR II for the class IE power sources; also Figure 7A.2-1 for their connections to the system.

421.38 b QUESTION Using detailed drawings, describe the routing and separation for this trip circuitry from the sensor in the turbine building to the final actuation in the reactor trip system (RTS).

421 38 b RESPONSE Usingdetaileddrawings,the:tility/dpplicantwilldescribethe routing and separation for this trip circuitry from the sensors in the turbine building, which is not a seismic category 1 structure, to their interfaces with the class 1E routed and separated circuits in the Nuclear Island buildingg which are seismic category I structures. The ret: ting and separation in the Nuclear Island buildings is discussed in GESSAR II Sections 7 2.1.1.D.7 (Separation) and 7 2.2.2.C.9 (IEEE Std 384-1974).

42138 c QUESTION Discuss how the routing within the non-seismically qualified turbine building provides assurance that the effects of credible faults or failures in these circuits will not challenge the reactor trip system and/or degrade the RPS performance. Your response should include a discussion of any isolation devices you have or may propose to install.

421 38 c RESPONSE In addition, the failure of any one See item (1) preceding.

division will not degrade RPS performance. The main turbine trip signals from the turbine building are optically decoupled from the RPS logics and circuits in the control room. Any failure in the main turbine trip sensors in the turbine building will not propagate to the RPS.

The turbine stop valve closure trip and turbine control valve closure trip are backed up by the reactor high pressure trip and the high neutron flux trip.

From above, the routing of the turbine trip signals does not degrade the RPS integrity and finction.

l 2-

[

I l

l 421.38 d QUESTION l The position indicator lights for the turbine stop valves are not part of the RPS. Provide details of the design interface areas using appropriate drawings. Provide your basis for assuring con- I formance to the requirements of Section 4.20 of IEEE Std. 279-1971.

421.38 d RESPONSE The uti!!'7p pplicant will provide the details of the design interface areas using appropriate drawings, and the basis for assuring conformance with Section 4.20 of IEEE 279-1971.

421.38 e QUESTION Identify any other sensors or circuits used to provide input signals to the protedtion system or perform a function required for safety which are located or routed through non-seismically qualified structures. This should include sensors or circuits providing input for a reactor trip and emergency safeguards equipment including safety-grade interlocks. Discuss the degree of conformance of your

design to 1EEE Std. 279 and its referenced standards.

421 38 e RESPONSE The turbine stop valve closure trip, the turbine control valve closure trip, and their bypasses based on turbine first stage pressure are the only sensors or circuits used to provide signals to the RPS or perform a function required for safety; which are locnted in and/or routed through a non-seismically qualified structure.

l l

l l

l

FlNAL pfU F7~

421.39 bpro In Section 7.3.1.1.2.K of your FSAR, you indicated that the -

(7.3.1) containment and reactor vessel isolation control system (CRVICS) is capable of operation during any unfavorable ambient conditions anticipated during nomal operation. Discuss the capability of the CRVICS to function during abnomal and accident conditions such high-energy line breaks.

RESPONSE

The CRVICS is made up of two separate divisions of equipment controlling two sets of valves; one set outside the containment and the other set on the inside of the containment with certain lines having their inboard valves within the drywell. All of the CRVICS valves close on low reactor vessel level and all except the MSIVs and those valves associated therewith (MS drain valves and Reactor Water sample) close on Drywell High Pressure. Isolation Q~ f,lu d valves within the drywell are r:;&:d to withstand the temperature and pressure and radiation conditions of all omal, abnormal and b

~ .--.). - - . . . .

LOCA. ith,a time limip/on the duration of , e LOCA en,vironme b s becau f their rt functi,o'n time f closure ori a LOCA si 1.

nce all th lvesthat,Iloseon ywell h h perssure st rt to pu close wherythe drywell pressure xceeds two psig they do not have

/

time to' reach LOCA,ilmbient ady

/

s stat Vconditions before they are

{cl d and the) isolatio mission / completed, f ^/

Consideration of localized damage to equipment as a result of a LOCA focuses attention on the inboh isolation valves and their ability to withstand jet forces and missiles associated with a LOCA.

While it is true that an inboard valve may be affected by such forces, it is beyond the design basis to impose a LOCA pipe break and more than one single failure beyond those which can be postulated as consequential. With this groundrule it is evident that the inboard

r 421.39 isolation valve failure as a result of consequential damages would (7.3.1) l (cont'd) not open a release path for radioactivity if the line involved were part of a closed system and had another isolation valve on the outside of the containment.

The following considers postulated damage to various inboard isolation valves and cites mechanisms of potential failures together with the isolation condition resulting.

MSIVS Nomally Open- Fail Closed Electrical or air service interruption may be impaired by LOCA.

The valves are capable of closure on loss of air or electric power or both. Additionally a third manually operated Motor Operated valve is provided.

MAIN STEAM DRAIN VALVES - Motor Operated Valves.

These valves are nomally closed during power operation but open during low power operation. Therefore, failures (electrical cable damage or mechanical damage to the operator) could open a release path to the main condenser if the outboard drain valve failure was the SAF. Because of this possibility, the MS drain valves inside the drywell are located in a $ ected area within the guard piped area of the main steam lines and considere gd t be out of the LOCA con equential damage zone.  %

Me ^ff :-

• l)d (A.-

.~,,

&1 .k...&dt*

.;; :n: S'; ' -

WSO-i

$$ A A*9?ig  ;;;ef. O e- ,f  %

tr ;iq f::: rg .. ,;.? ?: M _f:;_ .., _ r E.

,;r'+e+4aa -^'h;;h. (CI Tn .. E tu ... :fy the f;;;;v o 3 ato;.......t)c b SHUTDOWN COOLING Suction Valves, Nomally Closed MOV's.

Since the inboard valve is nomally closed and no electrical failure as a consequence of a LOCA can command the valve to open there is no release path established through this valve.

l 421.39 Reactor Water Cleanup Inboard Isolation Valve - Motor Operated. Fail-as-Is.

t7.3.1)

ont'd) Damage mechanisms include cable damage or mechanical damage to the operator rendering the valve incapable of closure.

In view of the fact that the portion of the RWCU system outside containment is closed system and also protected by a second isolation valve; no radiation release path will result from inboard valve failure and a single active failure. (or single passive failure provided the outboard valve operates.)

OTHER Inboard Containment Isolation Valves. Motor Operated, Nomally Open.

Closed cooling water, chilled water and air systems are examples of systems that could comunicate with the drywell atmsophere in the event of a LOCA and consequential breakage of one of these pipes.

The damage could also be postulated to damage the inboard valve but in each case the outboard valve and the closed system piping outside the containment would accomodate a single active failure or single passive failure without opening a release path to the environs.

421.41 QUESTION PiWA L DRAFT ~

In your discussion of the high pressure core spray (HPCS) system in Section 7.3.1.1.1.1.C of your FSAR, you state that the HPCS system provides water to the reactor as long as a high drywell pressure signal is present, regardless of the water level in the vessel. The control logic has been modified in the HPCS designs of other .BWR's (e.g. , Grand Gulf and Clinton) to stop the HPCS when the water level reaches the high level trip. This modification was implemented to prevent possible flooding of the steam lines and subsequent damage to safety / relief valves and the primary system piping. Discuss your proposed HPCS control and its " termination" logic.

421.41 RESPONSE The GESSAR II design is to be modified just like the other BWR's mentioned. Engineering Change Authorization (ECA) number 801203-1 is already in place to facilitate the change in the GESSAR II documenta tion. Attached is a mark-up showing how the text will be modified to delete the high drywell signal which inhibits the level 8 trip of HPCS. The HPCS Elementary and FCD will also be revised in accordance with this change.

GESSAR II 22A7007 238 NUCLEAR ISLAND Rsv. 0 7.3.1.1.1.1.C High Pressure Core Spray System Instrumentation epL and controls (Continued) transmitter provides an input to an analog trip module (ATM). The output trip signals from the analog trip modules feed into one-out-of-two twice logic. The initiation logic for HPCS sensors is shown in Figure 7.3-1.

Drywell pressure is monitored by four pressure transmitters (two in Division 3 and two in' Division 4). Instru-ment sensing lines that terminate outside the drywell allow the transmitter to communicate with the drywell interior. Each dry-well high-pressure trip channel provides an input into the trip logic shown in Figure 7.3-1. The trip logic inputs are electri-cally connected to a one-out-of-two twice circuit.

The HPCS system is initiated on receipt of a reac-tor vessel low water level signal or drywell high-pressure signal from the trip logic. The HPCS system reaches its design flow rate within 27 seconds of receipt of initiation signal. Makeup water is discharged to the reactor vessel until the reactor high water level is reached. The HPCS then automatically stops flow by closing the injection valve if the high water level signal is available,and dryuell prercure is below thc trip ;;tting.0-The system is arranged to allow automatic or manual operation. The HPCS initiation signal also initiates the HPCS Division 3 diesel generator. i Two ac motor operated valves are provided in the HPCS pump suction. One valve lines up pump suction from the condensate storage tank, the other from the suppression pool. The control arrangement is shown in Figure 7.3-1. Reactor grade water in the condensate storage tank is the preferred source. On receipt of an HPCS initiation signal, the condensate storage tank suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from the suppression pool 7.3-4

GESSAR II 22A7007 238 NUCLEAR ISLAND R;v. 0 .

7.3.1.1.1.1.C High Pressure Core Spray System Instrumentation and Controls (Continued)

The valves in the test line to the condensate storage tank are interlocked closed, if the suppression pool suction valve is not fully closed, to maintain the quantity of water in the suppres-sion pool.

4. Redundancy and Diversity The HPCS is actuated by reactor vessel low wat'er level or drywell high pressure. Both of these conditions may result from a design basis loss-of-coolant accident.

The HPCS system logic requires two independent reactor vessel water level measurements to concurrently indicate the high water level condition. When the high water level con-dition is reached following HPCS operationj and-Jiiucil prc:curc "-

J is below the trip ::tting, these two signals are used to stop HPCS flow to the reactor vessel by closing the injection valve until such time as the low water level initiation setpoint again is reached. Should this latter condition recur, HPCS will be ini-tiated to restore water level within the reactor.

5. Actuated Devices All motor-operated valves in the HPCS system are equipped with remote-manual functional test feature. The entire system can be manually operated from the main control room.

Motor-operator valves are provided with limit switches to turn off the motor when the full open or closed positions are reached.

Torque switches also control valve motor forces while the valves are seating.

The HPCS valves must be opened sufficiently to pro-vide design flow rate within 27 seconds from receipt of the initia- h tion signal.

7.3-6

GESSAR II 22A7007 238 NUCLEAR ISLAND Rnv. 0 .

fk 7.3.1.1.1.1.C High Pressure Core Spray System Instrumentation and Controls (Continued)

The HPCS pump discharge line is provided with an ac motor operated injection valve. The control scheme for this valve is shown in Figure 7.3-1. The valve opens on receipt of the HPCS initiation signal. The pump injection valve closes automatically on receipt of a reactor hich water level signal. aed't-uhan drywc_11 prcssure is bclcw the t w mettin M

6. Separation Separation within the Emergency Core Cooling System is in accordance with criteria given in Subsection 8.3.1.4.2. It is such that no single design basis event can prevent core cooling when required. Control and electrically driven equipment wiring is segregated into three separate electrical divisions, designa-MSk ted 1, 2, and 3 (Figure 8.3-1).

HPCS is a Division 3 system augmented by redundant Division 4 instrument channels (Figure 8.3-1). In order to main-tain the required separation, HPCS control logic, cabling, manual controls and instrumentation are mounted so that divisional sepa-ration is maintained. System separation is as shown in Table 8.3-1.

7. Testability ,

The high pressure core spray instrumentation and control system is capable of being tested during normal unit oper-ation to verify the operability of each system component. Testing of the initiation transmitters which are located outside the dry-well is accomplished by valving out each transmitter, one at a time, and applying a test pressure source. This verifies the 7.3-7

g.: - ~ "".:. ... . . . . .- -. .__ ..

GESSAR II 22A7007 R v. h 238 NUCLEAR ISLAND l

p.3.2.2.1 High Pressure Core Spray (HPCS) System (Continued) .

}

3 .

cpaning with the maximum differential pressure across the valve cxpected for any system operating mode, including HPCS pump shutoff hard. The valve opens within 12 see following receipt of a signal to open. This valve is normally closed to back up the inside tactable check valve for containment integrity purposes. A drain line is provided between the two valves. The test connection line io normally closed with two valves to assure containment integrity.

R: mote controls for operating the motor-operated components and diesel generator are provided in the main control room. The controls and instrumentation of the HPCS System are described, illustrated and evaluated in detail in Section 7.3.

e Tho HPCS System is designed to pump water into the reactor vessel over a wide range of pressures. For small breaks that do not rosult in rapid reactor depressurization, the system maintains reactor water level and depressurizes the vessel. For large breaks, the HPCS System cools the core by a spray.

If a LOCA should occur, a low water level signal or a high drywell pressu,rcsignalinktiatestheHPCSanditssupportequipment. The oystem can also be placed in operation manually.

The HPCS System is capable of delivering rated flow into the rocctor vessel within 27 sec following receipt of an autcmatic initiation signal.

Whan a high water level in the reactor vessel is signaled, the HPCS is automatically stopped by a signal to the injection valve

! to close, anics; L 3L a;; :;11 y.;;;u;; 3..ml moi;t;_ I f ;-

[ tip. Cry.: 211 precru ; sign;1 exirtr in ennjnnceinn w4eh a high re =t;. .. 1;<;l ;n,__l, m<m. muc u .. .ill continu; mutir 6.3-12

GESSAR II 22A700 238 NUCLEAR ISLAND Rsv. (, /p 6.3.2.2.1 High Pressure Core Spray (HPCS) System (Continued) k ______.., ..:p; f. The HPCS System also serves as a backup to the RCIC System in the event the reactor be:omes isolated from the main condenser during operation and feedwater flow is lost.

If normal auxiliary power is not available, the HPCS pump motor is driven by its own onsite power source. The HPCS standby power source is discussed in Section 8.3.

The HPCS pump head flow characteristic used in LOCA analyses is shown in Figure 6.3-3. When the system is started, initial flow rate is established by primary system pressure. As vessel ,

pressure decreases, flow will increase. When vessel pressure rpaches 200 psid*, the system reaches rated core spray flow. The HPCS motor size is based on peak horsepower requirements.

The elevation of the HPCS pump is sufficiently below the water level of both the condensate storage tank and the suppression pool to provide a flooded pump suction and to meet pump NPSH require-ments with the containment at atmospheric pressure and the suction strainer 50% plugged. The available NPSH has been calculated in-accordance with$b.egulatory Guide 1.1.

A motor-operated valve is provided in the suction line from.the suppressio'n pool. The valve is located as close io the suppres-sion pool penetration as pr etical. This valve is used (1) to isolate the suppression pool water source when HPCS System suction is from the condensate storage system, and (2) to isolate the system from the suppression pool in the event a leak develops in the HPCS System.

• psid = differential pressure between the reactor vessel and the suction source.

l 6.3-13 ___ ,,_ _ _ __

f OS/ r l' l

GCSSAR RNA L QUESTION 421.42 In Section 7.3.1.1.1.1 of your FSAR, you indicate that (7. 3) the HPCS sy1 tem will automatically initiate, if required, during testing with specific exceptions. Parts of the system which are bypassed or rendered inoperable are indicated in the control room at the system level.

In your response to Question 421.04, provide details relating to the HPCS system. Specifically, discuss the interlock which prevents HPCS injection into the reactor when test plugs are inserted during logic testing.

Resolve the discrepancy between your statements in Sections 7.3.1.1.1.1.C.7 and 7.3.2.1.C.1.j,

RESPONSE

421.42 The High Pressure Core Spray (HPCS) system is capable of being completely tested during normal plant operation.

Motor-operated valves can be exercised by the appropriate control relays and starters. Should HPCS be initiated during testing, valves will re-align, allowing high pressure core spray into reactor vessel. A motor-operated valve (MOV) test switch in control room removes the over-torque interlock bypass associated with !!OV's for j

testing. This is considered less reliable mode of operation, but does not prevent HPCS initiation (HPCS OUT OF SERVICE light illuminates in control room) .

During plant normal operation IIPCS system can be flow tested by discharging into condensate storage tank.

I

\

421.42 (Continued)

HPCS logic is tested by applying a test signal to each 7 analog trip module (ATM) in turn and observing that channel trip device changes state. Tc verify *ha* hathJL

=ci -^a+- ir en cut a f-ta v Laicc logic are fun.wivaal e t-pimg in tc;t b;;. i u::d to egciaLc the 1:gir as one '-J ett of en for vcrification of cingic cic;;nt functicef' If desired, the variable associated with the ATM can be varied and, in conjunction with the ATM output indicator light and appropriate instruments, both the transmitter and ATM outputs can be verified. In those cases where the sensor is disconnected from the process variable to allow testing, an out-of-service alarm will be indicated in control room by administrative action or automatically when analog comparator trip unit is in calibration. Test specification allows this system (division 3 power augmented by division 4 channels) to be down for testing during plant normal operation. The l

l HPCS OUT OF SERVICE light in control room will indicate HPCS is at degraded performance or inoperable during these

! conditions.

Though not implemented to meet the requirements of testability, the Automatic Pulse Test (APT) continuously I

and automatically performs end to end testing of all  ;

active circuitry. The APT improves availability of HPCS system by rinimizing time to detect and locato failures.

_ _ m

GESSAR II 22A7007

. 233 NUCLEAR ISLAND Rev. 0 7.3.2.1.2.C.l.i) Specific Regulatory Requirements Conformance (Continued)

The sensors can be calibrated by application of pressure from a

" low pressure source (instrument air or inert gas bottle) after closing the instrument valve and opening the calibration valve.

However, transmitter output is continually monitorable from the control room by observing meters on master trip units. Accuracy checks can be made by cross comparison of each of the four channels (A, E, B and F). For this reason, trans-mitters need not be valved out of service more than once per cpera-ting fuel cycle.

The trip units mounted in the control room are calibrated separately by introducing a calibration source and verifying the setpoint through the use of a digital readout en the trip calibration module, j) Capability for Test and Calibration (IEEE-279-1971, Paragraph 4.10)

1) HFCS HPCS control system is capable of being completely tested during normal plant operation to verify that eacn element of the system, active or passive, is capable of performing its intended function. Sens_ ors can be e..xerc.i..

sed by applying test p.ressures. / Tegia con be eurci;cd by mccnc cf plug-i.- tcyJ_:2.,i_tgp Q y? donc__es,i. conjunctivu with si 9gle .cr.ccr tc.La D Pumps can

. , be started by the appropriate breakers, stem 97 topumpagainstsy$hl injectionvalvesand/orreturntothe%f~ressionp thr st valves while the reactor is at pressure./ Motor-operated valves can be exercised by the appropriate control relays and starters, and all indications and annunciations can be observed as the system is tested. Check valves are testable by a remotely operable pneumatic piston. HPCS water will not actually be introduced into the vessel i except initially before fuel loading.

7.3-197

c

\ F(NA L PRAFT l

421.47 In Section 7.3.1.1.1.2.C of your FSAR, your briefly mention testing l of the automatic depressurization system (ADS) solenoid valves.

These valves cannot be fully tested with the plant at power. Provide i

l RE IV a discussion of your proposed method for integrated testing of these l valves and circuits, including the frequency of testing. Identify l

i y" 'I l , other ESF systems where either a portion of the actuation circuitry or the actuated device is not routinely tested with the actuation

- 3 circuits. Discuss your proposed method for integrated testing of the circuits and components, including the test frequency.

RESPONSE

Integrated testing of the ADS solenoid valves and circuitry is not performed with the plant operating at power which is consistent for safety systems where the

[

final actuating device (s) would cause temporary modification of plant processes such as fluid injection or discharges. The design provides for a functional partially integrated test without valve actuation. .This is supplemented by a 4 manual one-at-a-time valve test using associated actuation circuitrv from the transmittar trip units with the reactor shutdown but with sterd dome pressure equal or greater than 100 psig. This test interval is 18 months. Additionally, the transmitter / trip units that provide sensory inputs to the ADS are checked by control room personnel and the logic chain up to the solenoid is tested by the automatic pulse test performed by the self test sub-system and described l as the sixth test in the discussion in 7.1.2.1.6 Other saf ety system such as RPS, portions of CRVICS, MS-PLCS, HPCS, LPCS, RHR/LPCI, RHR/ containment spray mode, RHR/ suppression pool cooling mode, safety relief valves, and water positive seal' system likewise have components which are not activated or tested with a complete integrated testing procedure. Each of these systems has a modified test procedure that utilises a manual test which allows for independently checking-of individual components. This includes " verification of flow" tests by using the installed return piping such that the motore, pumps and valves are operated, with the associated installed senscrs and circuits monitored to verify proper operation. The injection, valves are checked in-dependently and separately by manual initiation. ,

F MAL MA F I~

421.48 OUESTION

In Section 7.3.1.1.1.2.C of your FSAR, you indicate that the ADS can be manually reset after initiation and its delay timers recycled.

The operator can delay or prevent subsequent automatic opening of the ADS valves if such delay or prevention is deemed prudent by the operator. Discuss the details of the manual reset capability, using appropriate drawings. Provide the following additional information :

a. The conditions and information which the operator used in making a judgement to exercise the manual over-ride of a subsequent automatic signal.

I b. Address the concerns identified in Question 421.14.

421.48 RESPONSE After receipt of an ADS initiation signal, the 105-second delay timers are started; the ADS valves will not open until the timers time out. Before time out, the operator may reset the timers for additional delay by activating the timer reset push buttons.

The delay in starting the ADS functions allows the high pressure systems sufficient time to arrest the decline of reactor water lever and refill the vessel, while allowing enough time for the low pressure systems to come up to rated conditions.

Resetting the ADS timers does not change the state of the initiating circuits, it merely extends the time delay before the ADS function.

takes place or until the initiating condition ceases.

The operator should base his decision to reset the timers on information provided by safety-related displays; i.e, reactor pressure, reactor water level, and water inventory make-up system performance.

w- --- - .

QUESTION f f(JA L MAf 7 421.51 You describe tl'e performance monitoring system in Section 7.7.1.5 of your FSAR.

(7.7.1) Provide the following additional information in this section:

a) Identify all safety-related parameters which will be monitored with the per-formance monitoring system during initial operation.

b) For each safety parameter identified above, provide a concise description of how its associated circuitry connects (either directly or indirectly by rneans of isolation devices) with the performance monitoring system circuitry. Where appropriate, supplement this description with detailed electrical schematics, c) Describe your proposed design provisions to prevent failures of the perform-ance monitoring system degrading safety related systems.

d) Provide the above information for the startup " transient monitoring system,"

if provided and distinct from the performance monitoring system.

RESPONSE

421.51 a) The following parameters in safety-related systems will be monitored during initial operation:

SYSTEM PARAMETERS Nuclear Boiler / Nuclear Steam Vessel Wide Range Level Supply Shutoff System (NBS) ADS /SRV Position ADS /SRV Initiation Signal MSIV's Position MSIV's isolation Trip Signal Vessel High/ Low Level Alarm RHR/ ADS /LPCS/HPCS Low Water Level Initiation Signals RHR/ ADS /LPCS/HPCS High Drywell Pressure Initiation Signals Neutron Monitoring System APRM Dutput (NMS) APRM Heat Flux LPRM Output i Recire. System Flow 1

421.51 (Centinued)

, _ SYSTEM PARAMETERS Reactor Protection System (RPS) Reactor Manual Scram Reactor Scram Trip System Residual Heat Removal System RHR System Flow (A,B,C)

(RHR) RHR Heat Exchanger iniet Temp (A,B)

RHR Heat Exchanger Outlet Temp (A,B)

RHR System Pressure Low Pressure Core Spray LPCS System Pressure System (LPCS) LPCS System Flow High Pressure Core Spray HPCS System Pressure System (HPCS) HPCS System Flow l

b) Isolation will be accomplished by means of opticalisolators.The isolation will be accomplished downstream of signal conditioning and analog to-digital conversion. Figure 1 demonstrates a typical signal flow from a safety system parameter to the non safety PMS. The optical isolators shall be qualified in accordance with Regulatory Guides 1.75 and 1.89. The isolators provide a means for preventing a fault in the non divisional wiring from affecting the safety-system circuitry. Figure 2 exhibits the power and signal connnections to the isolators.

c); To maintain the PMS as a highly reliable system, its normal power will be

, supplied from an uninterruptible power source (UPS). 'La addition, interfaces to safety system will be by means of isolation devices. Failures in the PMS will not affect safety-system operation other than possible erroneous operator Information.

S)'BasedIpon I cup (n't transient >rfonitoring requirem nts, the followifig safety dstems will have interface with the safety ransient monitbringapsIem:

Neut Monitoring S em Reactor Protec io'n Syst?m Nuclear Bo,ile)r System NuclearSteam Supply 5,hu off System /

Die Generator System j

. 6 kV Power,1)is,tribution System

, High Pressure' Core Spray System Residual at Remoysi'hystem The sint- f T>e-tie ~ t Mr.<lror; s Sy s tem is er te te 1-e n ewe d fn GEMM E dec ke. t becese fue q uem devy.t c ., d it s in terfa ces c o.< not he specified of t h i.r ti-s e .

421.51 (Ccntinued) 0' 6 g0 A conci1 description'of how cla the as h,ted circuitry i

connectsmerges with the a t up translent monitoriny ystem is inappropriate at this tim,e t>ecause s em design is not yet speci ied. Response at a later date/, after system design,

, ill be cessary to pr erly respond to this qu 10:1.E. p. " an-and C-ra mrtti p ide sys'=d-*Iha o - ,, f ff,._ , _1 7"_q f Yr Y

/ -

v ,y - ~t O

1 E X T E

R G UN U D O S S AI E L T B G AU ER T

CE A A N P C

\V I

F L AI N l

OT C s

E RUM PPE R

MT d X Y T L 9 OS VEF A ~ CYS l

N OA- S OI m "

E R S 1

I A V S

S L E DI A C N -

L C U O -

N N

=

J >

x DV l

I LO

@ AT CA I

T P

L O

OI S

!iI gI 1 l ll l I l I I l l l

)

L R A E

TN E O MI T v N O

I S

I VI AC R E D -

AT N O

P O N

\ YR /

L TP A E N F N

/ AI O OI S

S T I L A VI AL D C O I S

(

L P I E

Y N T A P

Pt I

Rp E)M u

T0U 1 A

All{ l A l

} ,

N { T N O N I

y E O I T - MT A NA I

T NI I

S

$( 'l

'l y

I AT TE NN OE CP R

C T P

LE N g H LR R C EK

HEU T ) MC E GWSS M

+

( UA RR I

L P

HY R R E X T

M DP S N

A I X

E

~

FIGvHE 2 .

COMPUTER OPTICAL ISOLATOR 9 @

_ COMPUTER POWER Vg (+12v)

SUPPLY (+28v)

LOGIC LEVEL OUTPUT SIGNAL INPUT (+28v)

V jRETURN V

\

\ Y (1 Y 421.57 QU he analyses discussed in Chapter 15 of your FSAR are intended to (7.7) demonstrate the adequacy of safety systems in mitigating antici-pated operational occurrences and accidents. Based on the con-servative assumptions made in defining these " design bases" events and our detailed review of these analyses, it is likely that they adequately bound the consequences of single control system failures.

To provide assurance that the design basis event analyses for your proposed design adequately bounds other more fundamental credible

, failures, provide the following additional information:

a. Identify those control systems whose failure or malfunction could seriously inpact plant safety. ,.

4%l> 0 3 Q6Sf6V.5E Control systems whose f ailure or malfunction could seriously impact plant safety are those that affect reactor pressure, water level, or power level. A list of those systems is attached frice=T to V8 U)

List 1 5'TSTEMS WHICH COULD AFFECT REACTOR PARAMETERS Condenser Air Removal Reactor Plant Component Cooling Water l

Turbine Plant Component Cooling Water Condensate Bearing Cooling Water

- Main Steam Isolation Valve Seal Circulating Water Turbine Building Equipment Drains Moisture Separator Vents and Drains Moisture Separator RHTR Vents and Drains Turbine Building Miscellaneous Drains Extraction Steam FDW Pump 4 Drive Lube Oil FDW Pump Recirculation Feedwater i Generator Leads Cooling I Generator Stator Cooling Water Generator Hydrogen and CO2 High-Pressure FDW Heater Drain Low-Pressure FDW Hester Drain

! Service Air Instrument Air O

1.

• List 1 (cont) l Main Steam Offgas Reactor Recirculation Control Rod Drive

. FDW Heater' Relief 3 rains and Vents Reactor Plant Sampling Turbine Plant Sampling Radweste Building Sampling Service Water .

Turbine Trips Turbine Generator E.H. Fluid System Turbine Generator Gland Seal and Exhaust Turbine Generator Lube Oil Unit Runback Turbine Generator Exhaust Hood Spray Reactor Water Cleanup Nuclear Boiler

(

l . Feedwater Control I Neutron Monitoring Steam Bypass and Regulation PR.OCE$6 RAggATto# ,VAo 9 Tog,i04 l ee.

~~

2.

i .

g uesT1oM y .3 l , 52. b Indicate which, if any, of the control systems id Item (a) receive power from common power sources.entified in The power sources considered should include all power sources whose failure or malfunction could lead to failure or malfunction of more than one cont,rol system and should extend to the effects of cascading power losses due to the failure.of higher level distribution panels.and load centers.

_l. 12I.5 2 b A53NN.SE 0 ffE 'ef J } l. 9 g GESM &.

C;ntrol systems whose failuke or malfunction uld seriously pact plant fety are thos that aff ect reactor pressure, water 1 vel, or power vel. A list of those s stems is attached. Previous analysis has shown that f these systems, the ones th t can produce react vity increases in conjunction wit delayed turbine trips due to single electrical bilures are the mo t critical syst s. Guidance will be provi ed in Section 1.9 t avoid common pow r or sensors in these systems.

M Y b l

t o

y9 l, g2, c GUES TreW Indicate which, if any, of the contr.ol systems identified in item (a) receive input signals from comon sensors. The sensors considered should include comon taps, hydraulic headers and im-pulse lines feeding pressure, temperature, level or other signals

.to two or more control systems. ~

I yzI5*2. c RES/WSE _

GH@ @ (La CrESSM 5, Actu:. l.9).

Arrac <a r . as o or,a e 7 S es Gr95$ ) u L. 0 6. A M C o+ d '~ t1 i Q UE e S O FF ou p ga g o ga c w a s.u p, P/M a g A4 S nTor-O Isu fmter b to & L/ O r /> SAL. N C tt I TI t- rf L. JA) $ TAJo n@TS O oV f sTSM 'G a

, (a m n 6 A) L-r HES 0} '

P l

(

y 2 l,53. d. G JE.ST7ed Provide your analysis to show that any malfunctions of the control system identified in Items (b) and (c) resulting from failures or malfunctions of the applicable commmon power source or sensors including hydraulic components, are bounded by the analyses in Chapter 15 and would not require action or response beyond the capability of operators or safety systems. Where credit is taken for operator action, identify the time available for such action.

Hy t . 52 d. )?E3/'sMSE

FitU L QUrr 4 .

421.53 In Section 11.5.2.1.2 of your FSAR, you indicate that if one channel in both the A and B trip logic is downscale in the reactor containment heating, ventilation and air-conditioning (HVAC) radiation mcnitoring system, system isolation is not possible. Your design is such that any one downscale trip sounds an alarm in the control room. Discuss the details of your design which are provided to preclude downscale

( trips in one channel in each logic from occurring simultaneously.

Discuss the required actions, either automatic or by the operator, including the procedures to be followed by-the operator if a channel in one or both logics is downscale. Indicate whether the details -

provided in this discussion are applicable to the other radiation monitoring systems identified in Section 11.5.2.1 of your FSAR.

~ -

The logic embodied in the reactor. containment heating, ventilation and air conditioning (HVAC) radiation monitoring system (see figure 7A.6-4K) is such that either a downscale

( trip or an upscale per channel will be sufficient to provide one half of the required signal for the interlock.

Figure 7.6-10C Note 7 also indicates that two-out-of-two high high/inop or downscale trips (in either A and D -

or B and C) will provide an interlock signal.

The procedure to be followed in case of a downscale trip will be provided in the technical specifications chapter of the Safety Analysis Report. Although the exact ..

procedure will need to be reviewed by the applicant, in general, the following is typical: With the requirements for the minimum number of Operable channels not satisfied for one trip system, place the inoperable channel in the tripped condition within one hour or establish Secondary

( Containment Integrity with the standby gas treatment system operating within one hour. With the requirements for the minimum number of Operable channels not satisfied for both trip systems, establish Secondary Containment Integrity with the standby gas treatment system operating

within one hour.

_ The details provided above are not directly applicable to the other radiation monitirong systems (i.e., containment space - refueling mode, fuel building ventilation exhaust, auxiliary building exhaust, standby gas treatment, shield 9, annulus HVAC, and control building HVAC) in Section 11.5.2.1 because these systems are configured with a onc-out-of-Wevn e trip logic 3.* )4 .c4ck of tuo diviJient, -

J 1

h$d .unzh h CLp& // su aZ4cY f hwe -

GCSSAR II 22A7007 238 NUCLEAR ISLAND Rev. O R by J41;

/

s v~ ".

11.5.2.1.2 Containment HVAC Radiation Monit: ring System P .. y ,

3

.g This system monitors the radiation level extsrior t.o the containment ventilation system exhaust duct. A high activity level in the ductwork couid be due to fission gases from a leak or an accident.

The system consists of four redundant instrunent channels. Each channel consists of a local detection assembly (a sensor and con-verter unit containing a GM tube and electronics) and a control room radiation monitor. Power is supplied tc each channel, A, B, C, and D from RPS buses E, F, G, and H, respe:tively. Channels A and D are physically and electrically independent of channels B and C. One two-pen recorder powered from the 120 VAC instrument bus J2 allows the output of any two channels :o be recorded by the use of selection switches. The detection assemblies are physically located outside and adjacent to the exhaust ducting upstream of the containment discharge isolatnn valves.

'g Each radiation monitor has two trip circuits: one upscale (high-Two out of two upscale / j high) inoperative and one downscale.

I l inoperative trips in channels A and C initia:a closure of the L i containment ventilation outboard isolation vCves and the drywell k I inboard isolation valves. The same condition for channels B and D initiates closure of the containment inboard valves and drywell )

9 outboard valves.

l

"_.' .3 t- , \h An upscale / inoperative trip is visually displayed on the affected radiation monitor and actuates a containment and drywell 5 ~~ v

< l ventilation exhaust high-high radiation control room annuniciator Ul \- . for the affected channel.

_y C

w

\

A downscale trip is also visually displayed :n the radiation monitor and actuates a downscale control roon annunciator common to all channels. An additional trip signal f:r high radiation l i

11.5-8

GE@M R EK dF27R W 238 NUCLEAR ISLAND Rev. O

"'. 5.2.1.2 Containment HVAC Radiation Monitoring System (Continued)

Larm is provided by the recorder and actuates a reactor building JL rint high radiatico control room annunciator. Each rediation

.itor visually displays the measured radiation level. f '

T. 5.2.1.2.1 Containment Space - Refuel Mode Radiation Monitoring Subsystem This system monitors the radiation level inside the containment 1::ve the top of the fuel pool. The radiation monitor elements tre located approximately 50 feet above the top of the pool in f:;r positions to facilitate detection of radioactivity instantly it the event of a fuel-handling accident.

e system consists of four instrument channels: A, B, E, and F.

I2:h channel consists of a detector, converter, and a main control A

(~s)  ::cm radiation monitor. All four channels are physically inde-cendent of each other, but channels A and E share the same power I:pply. Channels B and F also share a common power supply.

annels A and( }'ahe powered by the 120-vac RPS Bus E, Division 1.

annels B and F are powered by the 120-vac RPS Bus F, Division 2.

annels A and E are electrically independent of channels B and F.

A; a result there are two independent and redundant instrument

= ;s tems . The failure of one system does not affect the other.

II:h radiation monitor has two trip circuits: one upscale (high)/

_:cperative and one downscale. Both upscale and downscale trips are displayed on the appropriate radiation monitor and each one 1:tuates either the high or low main control room annunciator.

l A high radiation trip on either channel A or E initiates closure

f the containment exhaust air isolation valves and containment

-;pply air isolation valves for Division 1. A high radiation trip 11.5-9 l

t l

G RAL El IRIC CO.

Nuc! r Energy usiness Oper sons ENG EERING ALCULAT N SHEET

• UVBER

. DATE St.lBJECT BY SHEET Oc ufout ye tt, o asso, n . s. 2. i. 2.

(c Earh. ratdio.iten vwan' doc ha.s % trip circuits one. u.pca.\e e,wat on.e.

i downscade.. 'Two ou.t of two 4. rip in channe.\s A ad D; u)kie.h on a l pc chamel basis, vsaq be. cawseA b3 c:i.her a High High. raded. cow sgmak ,or a.,, clou>nsca.le sipal or ue. Qc<a.te swdc.k. viet W be.

Op< ate pation, ini+ca.tes closure. of tu containmed vestita. tim outboa<cL va.\ves ad tk:, d<gwell inboo.rci iso \ah va.\ve.s. The. same condi. tim 4< c.kanne.is BogC (nacates e\oss,e of w contain,nent.

inboarcL va.kes awel dr3wett odboa<d. vs.tves .

EAker avt qsca.ne. trip or the. Operoke sAh, not m he. Ghe< ate-psGn -for choc.ls A or 'D o.t.tu,a.tes n. Containmed. %t DNisiovt 1 or 9 High, High ScMa. tion er Loyerd've." mLa.<vw . "%e savwe.

condit% &c channet.s B or C cni.tiaAes ott ata<vn. cn<<copowdencg to TivMons a or 3 . The. u.pcate. Chigh - high) oda<rn is visu.a.g (whcateA.

, on the radiatio t montoc.

amd Q. downscale.

ar.tua.tes a. covst<n(trip cooy,t isamnuvto a.lso visaa.% 'ator'a.U. commewt be c.hannels.tod6 paged CLw adds.'tiona.L. alarm. si nal h hgh radia. tion is yovided ond. actuates

a. contee\ coe,n o.w num.u'a. toc co,n non. to au. c.kannels. CL <edutilog l wS.h c.kannels A,B, C. oc I) cau.ses, a i n h ig h. cet.t% asscoated

N 3k.V61.ta p I wo [ o.lavnt.

6me.k. caddi.htn wander assMy 44%s 4A. vvteasu.ved. (adia.tiovt level.

l l

i

)e i  !

es e s. e

_ _