ML20071E401
| ML20071E401 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 03/04/1983 |
| From: | Bradley E PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC |
| To: | Schwencer A Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 8303100205 | |
| Download: ML20071E401 (157) | |
Text
4
/
PHILADELPHIA ELECTRIC COMPANY 2301 MARKZT STREET -
P.O. BOX 8699 EDWARD G. BAUER. JR.
ND GE AL UNSEL (2151841-4000 EUGENE J. BRADLEY ASSOCIATE GENERAL COUNSEL DON ALD BLANKEN PUDOLPH A. CHILLEMI March 4, 1983 E. C. KIRK HALL T. H. M AHER CORNELL PAUL A'JERDACH ASSISTANT GENERAL COUNSEL EDWARD J. CULLEN. JR.
JOHN F. KENNEDY. JR.
ASSISTANT COUNSEL h!r. A. Schwencer, Chief Docket Nos. 50-352 Licensing Branch No. 2 50-353 Division of Licensing U. S. Nuclear Regulatory Commission Washington, DC 20555
Subject:
Limerick Generating Station, Units 16 2 Request for Additional Information (RAI) from NRC Instrumentation and Control Systems Branch
Reference:
Letter, A. Schwencer to E. G. Bauer, Jr.
dated August 25, 1982
Dear Fir. Schwencer:
Transmitted herewith are draft responses and FSAR page changes related to the subject RAIs. This material is provided in draft form ct the request of bir. Virgilio, NRC staff reviewer, in advance of a meeting the week of blarch 14, 1983. We plan to formally incorporate these responses and page changes into the FSAR subsequent to the blarch 14 meeting.
Very truly yours,
"""T'"'"""
Copy to: See Attached Service List hp. 0/*b,Go t
0303100205 830304 PDR ADOCK 05000352 A
g
/
cc: Judge Lawrence Brenner (w/o enclosur :)
Judge Richard F. Cole (w/o enclosule) l Judge Peter A. Morris (w/o enclosure)
Troy B. Conner, Jr., Esq.
(w/o enclosure)
Ann P. liodgdon (w/o enclosure)
Mr. Frank R. Itrnano (w/o enclosure)
Mr. Robert L. Anthony (w/o enclosure)
Mr. FAwin I. Iewis (w/o enclosure)
Judith A. Dorsey, Esq.
(w/o enclosure)
Charles W. Elliott, Esq.
(w/o enclosure)
Mr. Alan J. Nogee (w/o enclosure)
Robert W. Mler, Esq.
(w/o enclosure)
Mr. Thctnas Gerusky (w/o enclosure)
Director, Pennsylvania Emergency Management Agency (w/o enclosure)
Mr. Steven P. Hershey (w/o enclosure)
James M. Neill, Esq.
(w/o enclosure)
Donald S. Bronstein, Esq.
(w/o enclosure)
Mr. Joseph H. hhite, III (w/o enclosure)
Dr. Judith H. Johnsrud (w/o enclosure)
Walter W. Cohen, Esq.
(w/o enclosure)
Robert J. Suganran, Esq.
(w/o enclosure)
Rodney D. Johnson (w/o enclosure)
Atcmic Safety and Licensing Appeal Board (w/o enclosure)
Atcmic Safety and Licensing Board Panel (w/o enclosure)
Docket and Service Section (w/o enclosure)
)
OUESTION 421.4 (Section 7.1)
Several previously reviewed BWR installations (e.g., Grand Gulf, i
Perry) included a start-up transient monitoring system to provide recordings of selected parameters during the start-up and warranty testing.
There is no information in the FSAR which describes this type of system.
If this system, or any similar i
system, is intended for use in the Limerick units, provide the following information:
4 a.
Identify all safecy-related parameters which will ne monitored with the transient monitoring system during initial operation.
b.
For each safety parameter identified above, provide a concise description of how its associated circuitry connects leither directly, or indirectly by means of isolation devices) with the trancient monitoring system circuitry.
Where appropriate, supplement this description with detailed electrical schematics.
i c.
Describe provisions of the design to prevent failures of the transient monitoring system from degrading safety-related systems.
()
RESPONSE
The startup transient monitoring function will be provided at Limerick by the Emergency Response Facility Data System (ERFDS).
[
This system consists of input signal multiplexers, two central processors and several CRT and other peripherals.
The only part of this system which is Class 1E is the input multiplexers.
They are located in the Control Structure and are seismically and i
environmentally qualified.
They provide a digital optical output via fiber optic cables to the ncn-Class 1E portion of the system.
This optical link is several thousand feet in length and only J
multiplexers and wiring of one safety division are located in a common enclocure.
This arrangement assures that any failure of the non-safety related portions of the ERFDS will not adversely affect the safety related instrument loops which it monitors.
1 In addition to the parameters required by Regulatory Guide 1.97 Rev.
2, as discussed in Section 7.5, the ERFDS will monitor the following safety related parameters:
APRM I
Scram Signals 3
\\
4 421.4-1
DRAFT LGS ~FSAR O
e HPCI, Initiation, Speed, Discharge Pressure, EGM Output, Ramp Output, Flow Controller Output, Steam Line AP RCIC parareters same as HPCI
[
RHR heat exchanger level and pressure i
RCIC suction pressure control output i
a 1
d 4
>; O i
J 1
1 t
s i
O 421.4-2
.. ~....... - - - -. - - -.. - -,.
-, ~ - - -... _... _ _
\\_/
OUESTION 471.7 (Sections 7.1 and 7.7)
Some of the primary methods the Staff uses to convey informaticn to licensees and applicants based on operating experience are Office Of Inspection and Enforcement (IE) Bulletins, Circulars and Information Notices.
Although only the IE Bulletins require written responses, the staff expects licensees and applicants to take appropriate action (s) on the information provided in the Circulars and Information Notices applicable tc their design.
Included in Attachment 1 is a list of IE Bulletinc, Circulars and Information Notices that are applicable to BWRs.
Provide a discussion which includes the following:
1.
Procedures for-determining the applicability of the IEB, IEC, and IEIN to your facility.
2.
Procedures or rethods for factoring the applicable information or criteria into the Limerich design.
3.
Details of specific design modifications and their implementation resulting fror items 1 and 2.
4.
Detailed analysis and results for IEB 79-27 and IEB
'~
( >T 80-06.
5.
Detailed analysis and results for IEIN 79-22 to assure that consequential control system failures following a high energy line break do not result in event sequences more severe than those shown in the FSAR accident analyses (Chapter 15).
RESPONSE
1.
The procedure that is used for evaluating and processing IEB's, IEC's and IEIN's at Limerick is Appendix X to the Limerick Quality Assurance Plan (OAP), a copy of which is attached.
2.
As noted in Section X-4.2.1 of the Limerick Ouality Assurance Plan, the responsible group is responsible for determining what actions are required to address the concerns of each IEB, IEC or IEIN.
These actions are noted in the response to the Project Manager.
As per Section X-4.2.7, the Project Manager indicates in a log the corrective action needed to close out each item.
That item is only closed when the final action is complete.
('#)
3.
The PECo IE Bulletin, Circular and Info Notice Log which records the status of each item is maintained by the Project 421.7-1 s
DRAFT LGS FSAR nV Manager as per the specified procedure of the Limerick OA Plan.
A copy of this log showing the status of the IE Bulletins, Circulars and Infc Notices contained in Question 421.7 is provided.
For all items which are shown as completed, the' actions / evaluations requested in the subject document have been completed and documented.
For those item which are still open, further action / evaluation is required.
It is our intention to either close out or develop an action plan for the open items prior to full load.
4.
The detailed response and analysis for IES 79-27 is contained in the response to SRAI-15.
The evaluation requested fcr IEE 80-06 has not yet been completed.
Both the architect-engineer and the NSSS supplier have been instructed to proceed with this evaluation.
It will be completed as well as any resultant modifications prior to fuel load.
5.
A copy of the analysis performed in response tc IEIN 79-22 is attached.
b>
~-
m.J 421.7-2
~~
1._..-.
~... _ _ -.
/JT7 net /n r a r n is itz I 7 LG5U2 DRAFT ma I (v)
FROOD GE R)E 7300IES$3 520 II 3 12:INI, Clangs 20157C2v.C G51;0!!CES
- - =- -
EEV.
FROJ. MGF.
MGR. QA DATE DATE Pl. ACED NO.
SIGNATURE /CATE SIGNATURE /DATE ISSUED IN EFFECT CCF.MENTS 0
signed 3/5/75 signed 3/5/75 3/13/75 3/13/75.
New subject -
.~.ev:.s e. to.a clu:. 2 Signed 9/2h/76 l 10/29/76ll 1
Signed 10/13/76 11/05/76 IE Circule:s.
Editorial chstge.
g 8
q rt!/
d ~'g
- ))[j/ ]A,..b", -
l Added respe:sibil lt-a M(
/
10/19/77,l 10/26/ 7 te Circ. is req'd when oc resp::se 0l -] ll c * * ~17
'l n
g,/ud/ )//h/-...-
V 3
G 3/23/79 3/23/73
[CiSedt05? ate i
. e r:s - A,,s I:-
j 3jy yy
/
fematic: N:tieer
- /. 7 f g
$N h
p))/g 2/27/e1 2/27/c-Added cc to Las h
Resids=t t
- spec,or I-L.2.6
~
Al23 [/
4 9
s g
-.s g, a e f, er 2 e
I-1 Eerfsion 5 0s y,.,, - -
y-
-w
---w n-_
,.-.y
- -.-p y
---m----wiim-
,-,-m
=
-7 wi
-.g&
m-m
[]lFtsC(1:1r
~
1,,,,,
n\\_/
AFPINDII I FP0CIDUPE
?OR PBOC?SSING CSN9C.TE 3?llETI2J, CIECDLAPS ANp_ INFO?.9h2JQN N0? ICES I-1.0
?.gy.g.s_a X-1.1 The purpcse of this procedure is to provide specific instructions to PICO personnel for:
I-1.1.1 Processing IE Sulletins,' Circulars and Infors ation Notices ubich require a response to the USNBC, and for preparing and processing the responses necessary to address the actions requested by such IE Bulletins, Circulars and Notices.
X-1.1. 2 Processing IE Bulletins, Circulars and In f orz e.tio n Notices which do not require a response to the USNEC and recording the actions taken by PECO in regard to such IE Sulletins, Circulars or Fotices.
pd s
Y-2.0 Sco e I-2.1 This procedure provides instructions to PIco personnel for processing United States Nuclear Eegulatory Corsission (SRC) Inspection and Enforcenent (II) Bulletins, Circulars and Notices applicable to Linerick Generating Station which are received by PECO Ingineering and Research Oepartnent Management.
X-3.0 Eackcround X-3.1 An II Sulletin is issued to a class of licensees requesting specific actions as a result of safety related equipnent design inadecuacies, defects, operating inadequacies, zalfunctions, or failures of a generic nature that have occurred at a similar II Bulletins usually l
facility or operation.
I-2 Revision 5 B
O i
1
.a-DRAFT LC-S Q AP
- f
( 'n 0-require a written response to the USNFC and such Bulletins state the infor ation required in the report as well as the date by which the report must be submitt,ed.
I-3.2 ~
II Bulletins are supplecented by IE Circulars and Information Notices as ccnaunication media where the subject ratter is of lesser significance or it:ediacy.
IE Circulars and Notices usually do not require a written response to the USNBC, however,'
licer.see action is still required, and docu:entation of that action is kept in PECO files as described herein.
l l
I-4.0 Procedure I-4.1 Feceivine and Processine II Belletins, Circu3ar_s and Notices I-4.1.1 II Bulletins, Circulars and Notices for LGS are normally sent by the NRC to the Vice President, Engineering and Eesearch Department, and are then transzitted to the PECO LGS Project nanager for g-)
action.
(,j I-c.1.2 Upon receipt of aa IE Bulletin, Circular, or Sotice the PECO Project Eanager shall perform the following:
X-4.1.2.1 Eecord the IE Br.lletin, Circular or Notice nusber and necessary information in a register or log which shall be naintained to adequately identify the status and close out of each IE Bulletin, Circular or Notice.
The register shall indicate whether or not a response is required.
I-4.1.2.2 Using the project Document Control Form (LCF),
assign a PECO group responsible for preparing the writter response (s) to the IE Bulletin, Circular, or Notice and assign others (as appropriate) for co: ents.
I-3 l
Revision 5 l
\\ p]
\\~
I l -
l
+ -
DRAFT 1GS^1?
>)
Although a particular IE B031etin, Circular or Notice may not require a response, a responsible PECO gr~oup will still be assigned so that any co::ents from reviewers can be co:sidered.
See paragraph I-4.3 for the bandling of JE Sulletins, Circulars or Notices which do not require a response to the USNBC.
I-4.2
,Piep,a r_i,n c and_Processino Restonses I-4.2.1 Che responsible PECO group is responsable for preparing the nu:ber of written responses necessary to completely address the action (s) requested by the IE Belletin, Circular or Notice within the tin e (s) specified by the NRC, utilizing input fron other PICO personnel, other organirations, and pri:e contractors, as required.
I-4.2.2 If more than one response is required to co:pletely address the action (s) requested by an IE Bulletin, Circular, or Notice each subsequent response shall be prepared and prccessed in accordance with this procedure.
(%
(,)
507 E:
If all the inf ormation required to satisf actorily respond to an IE Bulletin, Circular or Notice is not or will not be available within the time stated by the NRC, the PECO Project Manager will so inform the manager, ga who will request an extension from the N?C Begion I, and docusent this request.
I-3.2.3 When sufficient information is available, the responsible group shall prepare the response to the 53C.
Che form and content of the response shall be appropriate for the signature of the Office of the vice-President, Engin eeri ng and E esea rch, and shall provide an accarate and f actual response which aid: esses the action (s) requested by the IE Bulletin, Circrelar or Noticc.
I-4
?.evision 5
(
LGSQaP
?
fh
\\_) ' Z -4. 2. 4 Copies of the response, approved by the responsible group's srpervisor, should be tra nsnitted situlteneously in draft form to the PECO Project Manager, the office of the appropriate Division l
Hea d (s),,and the MaLager, CA for review and Co2:ent.
I-4.2.5 Draft copy recipients shall submit' any coczents to the responsible PECO group within 3 working days of the draft date, unless otherwise specified.
I-4.2.6 If a draft response was distributed, the responsible PICO group shall resolve or include a21 co:1ents received, and prepare the formal response for subsittal to the PICO Prcject Manager.
4 Oocu ent Control Forms from the responsible and consenting groups shall be returned to the Project Manager by the responsible PECO group at this tine.
I-4.2.7 The PECO Project Manager, if he approves the response, shall trans:it the formal response to the of fice of the appropriate Division Head (s) and then l
to the Ma nager, Q A for review and approval.
All approvals are signified by initialling the yellow file copy.
The Project Manager then updates the IE f'NJ Sulletin, Circular and Notice register or log with the inf ormation necessary to reflect the current status of the 13 Bulletin, Circular or Notice, and notes any f ollow up actions reguired <
I-4.2.6 The Manager, CA shall then process the PECO response for signature by the Office of the Vice-President. Engineering and Research.
The response shall be sent to the N3C Region I, unless otherwise specified in the IE Bulletin, Circular or Notice, with copies to any other NRC offices specified in the 22 Bulletic, Circular or Notice and to the LGS Site 5esident NBC Inspector.
I-4.2.9 See the attached sanples which include 1) an II Eulletin, 2) a cover letter, and 3) a response.
I-5 Revision 5 s
... ~..... _ _ _._
DRAFT L3SQAP p.
5 i
I-4.3
.I.R. Er3J.e.t.jrs.,_C1 c la_rg_,o;- Not i ce s No ;_?egujf,Sg. A J
E+.<:ense to D55PC I-4.3.1 Che responsible FICO group shall deter:ine the applicability of the Bulletin, Circular or Notice to the Lirerick Generatina Station and shall take appropriate action which is responsive to the Bulletin, Circular or Notice.
Che respo sible PZCC group shall cLtain input froc Sechtel or GZ, as necessary.
X-4.3.2 Che responsible PICO group, after cc:pleting I-4.3.1, shall annotate their DCF or attach:ents thereto with the following infors ation and return their DCF (and attachments if any) to the PECO Project Zanage:r:
I-n.3.2.1 A state:ent as to whether or not the Bulletin, 4
circular or Notice is applicable to Limerick and the basis used to make this detertination.
I-4.3.2.2 A complete description of the action taken in response to the Bulletin, Circular or Notice if applicable to Limerick.
If the Bulletin, Circular i ()
or botice is asplicable to Limerick but no PECO
^
artion is needed, state why this is so.
Eecords of telecons, letters, reports, etc. shall be attached te, or referenced on, the DCF.
x-c.3.3 Che Project Manager shall update the IE Sulletin, circular or Notice register or log to reflect the current status and shall file the DCF and any attarhrents in the Project File.
O r
i X-A Revision 5 O
.===-
- -aa.:x.
[
UNITED STATES hWLe_G U.M ATORY CCWISSION
/
OfflCE OF INSDECTION AND ENTGROEMENT WASHINGTON, D. C.
20555
~
IE Bulletin No. 75-10 Cate: June 27, 1978 Fase 1 of 2 SER3EX-PATERSON HYOPAULIC SHOCK Sl$ PRESSOR ACCUMULATOR SPRING COILS Cescription of Circurstances:
During the cor. duct of hyd-tulic shock supp essor (snutber) functional testing and seal replace.ent programs at saveral licer. sed facilities, a nat4r of brcken accrulator spring coils have been found in early n:de!
{
5ergsn-Paterson hydraulic snubbers. The attached extract frora a Eergen-l Fatersen advisory letter, dated April 6,1978, itates that a breken acct:~.alator spring alone would not render the snubber incapable of perforcing its design function; h:weser, the broken spring could cause internal de.4;e to the acetmiatcr which could result in unit incperability.
~
t l
The subject snubbers are of the external pipe design with serial nunbers j
a87.000 to 515,000 and F60,655 through F75,000.
The accumulator springs in these snubbers are basically carbon steel and were coated with a petre-cheical rust preventative by the vendor.
Despi+a this initial pittective coating, thcse springs found broken exhibited advanced stages of corrosicn. The factcrs which caused the spring cortcsicn are unde-j m
l tere.ined, c
l Bergen-Fatersen has reco r. ended that corrosion susceptible accumulater spring ceils be replaced with tefloa coated or stainless steel coils dering the next refueling shutdown.
l Action to be Taken by Licensees:
)
For all p wer reactor facilities with an operating license or a con-struction permit:
i 1.
If you have received the enclosed Bergen-Faterscn letter add-assing the accu,ulator spring problem, and if you have i
these units installed or in ready spares at your facility, it is requested that you describe what corrective action you have talen or plan to take to assure that the operability of snutbers in safety related systems is not impaired.
It is also requested that you describe the condition of any springs that were observed during the pericrr.ance of the corrective action.
502:.I 1 - II E"2 IC X-7
'I Ievisien 3
i'O i
~
~
DRAFT IE Bulletin No. 78-10 Cate: Jur.e 27, 1978 Fase 2 of 2 O
V 2.
If you have rot re:eived the enciesed Berge.-Faterson letter, it is requested t'et yeu describe what action you plan to take if the subfect sches are installed or in ready spres at your facility to assure that the optrability of snubbars in safety related systa.s is not im; aired.
3.
If the snubbers are currer.tly installed in safety related systems, it is rmested that you identify t'eir iccation in year respctse to this Bulletin.
4.
"epcrt in writing within 45 days for facilities with an operating license and within 60 days for facilities with a construction 4
permit, your plan of action and schedule with regard to Items 1 and 2.
Reports should be su'.c.itted to the Director of the appro-priate ha; Regional Office and a copy should be fonarded to the NRC Office of Inspection and Enfcrce ent, Division of Reactor Ogrations Inspection Washington D. C.
20555.
j l
l Approved by G'O, 51S0225 (R0072); clearan:e expires 7-31-80. Approval was given under a bianiet clearance specifically for identified ger.eric problems.
ATTACMENT:
Extract fm. Ber;e.-Pat.rson letter dated A;ril 6,1975 i
I i
i S;rr'2 1 (co!C.)
I-8 Es:Lsion 5
me-
+.e.....
..,e
_ - +
m r.,-
..--,.---4
-y.-r---
v-
DRAFT
~~
Attachtant t
Estract fr:m Ecrsan.Fatarson Adviscry Letter 1
SL5 JECT:
B/P Hydraulic Snutbers HSSA Accuwlator Sprir.g Addsory Letter 4
43ntiectn:
Earg:n-Faterscn advises that broken accumulator spring coils have been found in a n.r.ber of early redel hydraulic snubbers at the time when units were being disesw.bied for seal replacw_nt purposes. The ear 1~v models noted are identified as being the external pipe design having serial nurbers between 487,000 and 515,000 and F60,635 through F75,000.
These units were initially furnishad with nusic wire or chrome silicone i
spring material both coated with a rust p eventative.
All later external pipe design units were initially furnished with springs having the same raterial as noted abcve; bcwever, all coils were teflon coated. Our current model units are furnished with stainless steel coils.
Both the -
teflon coated and stainless coils have been found to give satisfactory 4
service.
I It is specifically pointed out that a unit renains functional even with 4
a brcken spring; hcwever, the possibility does exist that the debri,s frc:- a broken spring coil could in fact cause da age to the Accumulator Fisten U-Cup Seal resulting in pessible leakage of fluid.
The remote n
i U pcssibility for the Accu ulator Piston to become ja. red in the tube also exists although, hcwever, this has not been experienced.
4 Bergen-Fatersen has issued this advisement to make users aware of the pessibility of broken accumlator springs and recc r. ends that units I
having uncoated coils be refitted with either teflon coated or stainless steel coils at the next refueling shutdce.
1 Very truly yours, BER3EN-PATERS ~sN PIPESUPPORT CORP.
1 Attachment I Fage 1 of 1
(
SnT_I 1 (02,T.)
O 1-*
Revision 5
DRAFT
~
Q"ALIri ASSU2.GOE ge s23 291 y_er smr JUL 171978 E.0%:
E. R. Valters 20:
V. S. I:yer, Vice Fresident I gL eering e.=d P.es esreh Depart ent S T E02: h?.0 F.egic: I letter dated fume 27, 1978 Re: II Bulleti: No. 78-10
" Serge:-Patterso: Eri aulie Shock Suppressor A :::ulater Spring Ceils" Li:erick Generating Statics, II:its 1 and 2 GO,. 1_1 ( _r n.n *:
,..;-10}
,7,_c
~e 4
O>
itte:hed f:r 7:r review and sig.ature is PEOC resp::se to t e h
sut'ee b :1'. etic. T is respense is due back to the NRO on or before A;. gust 28,1976.
After signing, please retr this caterial to the Que'ity issurse e Sectics fer distributie: and file.
E. R. Valters
-- i a
.w w g Attachment
~-
Cc~py to:
R. 1. Mulford E. R. Valters/Loce.1 Tile Prcject File
- y T 2 - C "'.=__. '.7".C_.
e s
X-10 Revision 5
= *
- m e
.m e--
PH! LADE LPHIA ELECTitlC COM PANY
~ ["N '-
23C1 MARKET STRF.ET i.- Q l
FHIL A DELP H: A. PA.15101 l
e2:ne414500 v s.se-cm JUL IS 1978
..a.... m.
l l
Mr. 3:yce E. Grier, Director, Region I Unit ed States Nuclear Regulatory Co :Tission l
631 Fark Avenue-i Kir.g of Fr.:ssia, FA 19406 S'.'33ECT :
NRC Region I Letter dated June 27,197E RE: IE Bulletin No. 78-10 Eargen-Faterson Hydraulic Shock Suppresser l
Accumulator Spring Coils Lirerick Generating Station - Units 1 and 2 j.
Decket Mos. 50-252 and 50-353 FILE:
GOVT 1-1 (II Fulletin 78-10) l
Dear Mr. Grier:
i l
Thiladelphia Electric Co:pany has recieved IE Bulletin Nc. 75-10 swire.itted with the subject le tter re:eived on' June 26, 1978.
We have deter-ined that no Bergen-Paterson shock suppressors have beer.
I erdered for use at Limerick Generating Station. In the event that any Bergen-Faterson shock suppressors are ordered in the future, they would be i
of a later design than the ones referenced in the bulletin.
Based on the above, we plan no further action on this itec.
Sincerely, l
V. S. Boyer Dt'.G /dhi Copy to:
U. S. Nuclear Regulatory Comission Office of Inspection and Enforcerent Division of Reactor Operation,s Insp_ection Washington, D. C.
20555 l - f ES?.?.0 IGS Resider.t Ir.s;ectt; 8 O)
- (
SAMPLE 3 - ESPONSE I
'11 Revision 5 i
l
- ~, _ _ _ _ _...,,......, -.,
..u.
b.
e yewr@
70 y2/J DRAFT
- sSvE D;cE: NOV 113E2.
Ie
- 3 0 0CK GC U ATEG STATIG; (nv)
ST;ms sm.w US NPC IE Bulletins (74-4A to e tc) l l
IE Circulars (76-01 to date) l II Inforation !dtices (79-01 to date)
A33Rr.1:C:Q:S l
j P = Project D = P x r Flant Design Section S=
Services l
C = Civil Section N = lb: lear & E xirr ncntal section I = Industrial Section l
E or EE = Electrical E gi,eering Divisic.
E cr FIS = Ressarch Division CO = Construction Division E = 35chtel Fo.:sr Corpcration i'
GI = Ceneral Electric Cxpany E? = Electric Fr Mu nion Dcpar'_ c.t
!E'D = Ib ha.dcol Division FE S = Fers3.ael & L*d.2stric.1 Relations, Erplo;mt Divisio.
CL = C?e dcal laharatory SA = Safety De,reat ent SC = S= m ity Division
@. = E&R 0;ality Assurance D a. -
s r ww f ~essrs.
- 17. C. ItDa-iel J. H. Long i
l H. G. DeVoss J. J. Clarey J. S. F*e par G.11. leitch l
E. C. Kistncr A. R. Diederich H. R. Kalters P. K. Pavlides (E. F. S;rost.
U. J. Mindick l
R. H. Ic?Je' R. A. tblford l
David Parano J. P. Gibhrs JoPa lbskawitz R. F. R>&n S. J. Kowalski J. !!. Corcoran i
TW':rtk 10/25/82-1
)
)
1 e
1 i
lwe m ~.,v.~.~.t m.e*:-.er7:.,.:r y y a.- m q p 1 p ; y,pp.p > y y y n ~ ;- :. m,
1
hf
)0 N M H*t1EN Y G W
Q2 /. 7 e
ELECrRICK.. ENCINEERING DIVISION D
p r
N3-1, 2301 Mark 2t Street IS gf gm NRC IE Information Notice 79-22 Qualification of Control Systems limerick Generating Station, Units 1 and 2
. The subject IE Information Notice discusses the ef fects of r.dverse In en rironments on non safety-related control systems and components.
response to the Notice, this study identified those areas of the Station which may be subjected to high temperatures, pressures, humidity or flooding due to high energy line breaks. The systems associated with non. safety-related instru=entation and control components in those areas were then identified and analyzed to determine if their failure could impact the protective functions performed by safety-related systems. The term " systems" as used in this study ref ers to the systems shown on the P&ID drawings 8031-M-01 through M-96.
The areas identified in this study may be subjected to a high energy line break (HELB) which is defined as involving a piping system which has The a temperature greater than 200*F or a pressure greater than 275 psig.
systems which contain high energy pipes are:
Main Steam Condensate gs
(_)
Feedwater F.esidual Heat Removal Reactor Core Isolation Cooling High Pressure Coolant Injection Reactor Water Cleanup Core Spray Control Rod Drive Aux. Sterm Reactor Recirculation Standby Liquid Control The areas Ohich may be af fected by an HELB are:
Control Building (Area 8), Elevations 180 and 200 Reactor Building (Areas 11, 12, 13, 14, 15, 16, 17, 18), Elevatiens 177. 201, 217, 283, 313 Turbine Building (All areas and elevations)
Primary containment The areas of the Control and Reactor Buildings affected by an HELB are limited by the use of steam flooding dampers, steam and water tight doors and the sealing of all floor and wall penetrations. Through the use of these the ef fects of an HELB are limited to specific rooms located ir the
- measures, above areas. Becauce these measures are generally not utilized in the Turbine Euilding, it is assumed that an HELB in that structure will affect all instrumentation and control components in the Turbine Building. The expec t ed environmental effects of an HELB are shown on Architectural Drawings A-305 to A-311.
-m..
._..-.,r..-
-.i.n
,.w m, %3,i g, a. r.
s*v
l The following is a compilation of the systems containing non safety-O related components in the areas identified above and an evaluation of V
the impact of their failure on the performance of safety-related syster.3.
CONTROI E'JILDING Ar'en 8. E1. 180 Evaluation Cascous Radwaste Recombinction A
Service k'ater F
. Area 8, El. 200 Solid Radwaste - Collection & Processing B
Plant Process Radiation Monitoring B
- Area Radiation Monitorir.g B
REACTOR El'ILDING Area 12. El. 177 Liquid Radwaste Collection C
Reactor B!dg. Equip. Drain Surp Purp C
Ecactor Bldg. Floor Drain Surp Pu p C
Area 15, El. 177 High Pressure Coolant Injecti n B
Residual Heat Renoval D
Reactor Core Isolation Cooling E
Area 16, El 177 Residual Heat Screval B
Area 11 El 177 i
Area 15, E1. 201 l
Figh Pressure Coolant Injectien B
Residual Heat Renoval D
Reactor Core Iselation Cooling E
4{p?s!:"
~
DRAFT REACTOR BUILDING CON'T n
l';.. J
(,)
Area 16, El 201 Evalua tien Residual Heat Recoval L
Area 11, El 217 Reactor Recirculation F
Nuclear Boiler Instrumentation F
Drywell Chilled Water F
Area 12, El 217 Nuclear Boiler Instrumentation F
Reactor Recirculation F
Arca 15 El 217 Nuclear Boiler Instrumentation F
Eigh Pressure Coolant Injection B
Pri=ary Containment Atmospheric Control B
Reactor Recirculation F
Centainment Atcospheric Control B
Residual Heat Re= oval B
Area 16. El 217 Nuclear Boiler Instrumentacien F
("]
Reactor Core Isolation Coolinp B
x>
rryvell Chilled Water B
Reactor Recirculation F
Kesidual Eeat Renoval B
Area 11, El 283 Reactor Water Clean up F
Nuclear Boiler Vessel Instrumentation B
Area 12, El 283 Nuclear Boilcr Instrumentation B
Cere Spray B
Residual Heat Renoval B
Arec 15 El 233 Feactor Water Clean up F
Reactor Enclosure liVAC B
Area 11, El 313 l (
Clean Up Filter /Demineralicer F
l
(^,
l
( _/
Area 15. El 313 l
Clean up Filter /Denineralizer F
nn,w w w.e n. -- - - ~~
gr DRAFT c.
1
+
TURBINE EUILDIN" The Turbine Building is not segregated into steam-tight ro' oms.
The main condenser area is scaled water-tight up to El. 223. All other areas of the building are open without steam-tight doors or dampers.
For this reason, a high energy line break within the Turbine Building can be assuced to have the potential to affect all instru:nentation within that building. Because all of the instrumentation within the Turbine Building is non safety-related, all of these systems must be analyzed by this study.
SYSTEM EVALUATION Main Steam F
Extra' tion Steam F
e Vents, Drains & Heaters G
Condensate G
Air Renoval & Sealing Steam F
Condensate & Refueling Water Storage F
Circulating Water F
Turbine Enclosure Cocling Water F
Compressed Air H
Condensate Filter Demineralizer I
Lube Oil F
Fire Protection F
Process Sanpling F
Plant Process Radiation Monitoring J
Generator E Cooling F
2 Reactor Recirculation F
Control Rod Drive Eydraulics B
Liquid Radvaste Collection C
Casecus Radwaste Recombination F
Turbine Enclosurc EVAC F
Dryvell Chilled Water F
Plant Heating Steam F
,q C/
.h J $ '. p h ape he p 6 em e-sh**
4 4w 4.m-
'N
- N*"
k ~.-
DRAFT i
-s-PRIMARY CONTAINMENT All systems with non safety-related instrumentation inside primary containment are analyzed below because they will be affected by an EELS withfa that structure.
SYSTEM EVALUATION Dryvell hTAC B
Reactor Recirculation F
Turbine Enclosure Cooling Water F
Rod Position Indication F
Neutron Monitoring System B
Orywell Chilled Water B
Containment Atmospheric Control B
Nuclear Boiler Instrumentation D
Liquid Radwaste Collection E
Fuel Pool Cooling & Cleanup B
No other areas of the plant contain high energy pipes.
n
()
EVALUATIONS A.
A bret of the steam supply line to the recombiner preheater could cause the recombiner aftercondenser drain valves to remain open.
This would drain the contents into the =ain condenser until low af ter-condenser level alar =s in the control room. No safety-related system would be ippacted.
B.
The operation of this system will not be affected by the failure of its non safety-related components in this area.
C.
Failure of these components could prevent operation of the Floor Drain and Equipment Drain Sucp Pumps. This failure would eventually cause a surp high level alarm in the control room.
Overflow lines are provided to link the two tanks together to channel overflow from one tank to the other.
Failure of the affected instruments will not af fcet the operation of any safety-related systems.
D.
Failure of the non saf ety-rela ted RER system co:ponent s in this area vill not affect the RER system in the performance of its safety function.
The HELB in this compartment which causes a failure of the non saf ety -
related components can be assumed to also cause failure of the safety-related components in that compartment.
In this case, the redundant RHR syste components in a separate compartment will not be affected and therefore, the RHR system will perfore its safety functions.
a l
l 1
l x-
~
D? AFT
-e-w E.
An HELB in the RCIC compartment will affect both the safety-related and non safety-related components and would cause a failure of the RCIC system. The effects of the HELB are contained within the compartment and will not af fect other safety systems.- The HPCI systen can be used as a back-up to the RCIC system.
F.-
Any ciectrical or control failures of the components of this system in this area will not af fect the performance of any safety-related cystems.
C.
Failure of co=ponents in this system could cause loss of feedwater. Upon this occurrence, safety-related systems will automatically start operatior..
No failures within these non safety-related syste=s will prevent the safety-related syste=s from perforcing their intended function.
H.
An HELB in the Turbine Euilding could cause an influx of highly hurid air into the instrument and service air systems with the sicultaneous loss of the instrusent air dryers and moisture separators.
If this occurred without failure of the compressors, it could cause an increase in the c isture content of the air to the receiving instru=ents. So=e of the receiving instruments are safety-related air operated containment isolation valves. Their actuators are nor= ally charged and discharge stored air in order to close the valve. Any excess humidity which could enter the cc pressed air syste= would collect in the air receivers and would not be transmitted to the valves until they had closed and were given a signal to re-open. For this reason, the failures of this
' s' syste= described abcVe will not affect the performance of any safety-related systens.
I.
An HELB in the Turbine Building could cause the Condensate Filter /
Ie=ineralizer local centrol panel C116 to experience 100% humidity conditions at 0.75 PSIG. This environment is not sufficiently severe to cause simultaneous failure of the controls of the Filter /Demineralizer backwash drain valves. Sinultaneous failure of these valves could cause the transfer of a large a.ount of water to the Backwash Receiving Tank, causing the tank to everflow within a watertight compartment. Any failures within this syste: vill not affect the performance cf any safe ty-related systems.
J.
All radiation conitors which are required to prevent or monitor releases cf radioactivity to the environment are Class IE.
Failure of non safety-related radiation r.onitors will not prevent or af fect the operatien of saf e ty-rela ted coni tors or systems.
EFS:ab 3/12/81 Omew -
OUESTION 421.8 (Section 7.1).
i TSAE Table 1.11-1 references Section 7.1 for details of the Limerick design in relation to control room position indication of manual (handwheel) valves in the ECCS.
Discuss the provisions
.of your design to determine proper positioning of manual valves.
RES ?O','SE The Limerick design provisions for the proper positioning of manual valves is discussed in Section 6.3.2.9.
4 f
O G
4 P
i O
421.8-1
, -. _.. ~. _ _.
instrumentation available to the operator i,s discussed in more detail in Chaptec 5 and Section 6.2.
6.3.2.9 Correct Positioning of Manual Valves Con' sideration has been given to the possibility that manual valves in the ECCS might be left in the wrong position when an accident occurs.
Table 6.3-7 provides a complete listing of manual valves within the ECCS and lists the methods for assuring correct positioning.
Remote indication in the control room is not required for critical ECCS manual valves unless they are located in primary containment and therefore are not accessible for survey during normal plant operation.
(Critical ECCS manual valves are those that provide system isolation, other than vent, drain, or test
~
cennection valves, or are located in the main flow paths.)
The positions of those critical valves that are not provided with i
remote position indication in the control room are administratively controlled and have the following additional protection features:
a.
Manual valves in the main ECCS flow paths and manual system isolation valves for ECCS pump suction piping are physically locked in their normal position; access to the keys is controlled administratively.
i r'g
(_j b.
All other manual ECCS isolation valves are redundant to 1
provide double isolation.
Table 6.3-7 lists only those manual valves that are related to the ECCS function of those systems.
Thus, the only manual valves in the RHR system that were evaluated are those associated with LPCI mode.
The boundary of the LPCI mode piping also includes all piping associated with the suppression pool cooling mode.
i Vent, drain, or test connection valves are identified in the
" function" column of Table 6.3-7 and are manually closed.
Such valves are not critical to the ECCS function, and administrative' 4
controls such as pre-startup valve lineup checks suffice to reasonably ensure that such valves will not degrade ECCS performance.
In addition, many of these valves are redundant or locked in position, and test connections are capped.
The position of each manually operated valve will be identified in a valve checkoff list.
When verification of system operability is required, performance of the valve checkoff list in conjunction with the applicable lineup procedure is one method which may be used.
When cperability is verified in this manner, an independent verification of valve lineup will be accomplished by redundant performance of each valve checkoff list used.
Use of a lineup procedure with its associated valve checkoff lists will not be the exclusive method available for verification of operability, but can
~
j be used in any circumstance and supersedes the other methods discussed below.
If valve positions are to be changed for i
6.3-28a
surveillance or maintenance purposes, the procedure or other administrative control will have steps requiring return to normal valve lineup prior to completion.
The shift supervis6r will not i
consider the syttem operable until all valves identified within the boundaries of the surveillance / maintenance activities have been i
returned to the position specified in the valve checkoff list.
If
]
valve positions in the ECCS are changed for I
l
}
I t
4 i
i l
O 6.3-28b
O O
O i
DRAFT i'
toS,SAR I
(Page 4 of 4)
{
l TABLE 1.11-1 (Cont'd) f i.
IMPLEMENTATION APPLICABLE D&TE BRANCH EP. SECT 19tf HILE L*48 EECHON REZERENCE l
r 4.
9/01/76 SEB 3.8.4 Air Blast Loade 3.8.4 I
l S.
10/01/76 SED 3.5.3 Tornado Miesile Impact
- 3. 5 l
6.
6/01/77 RSB
- 6. 3 Passive Failures During Long-Tera 6.3.1 Cooling Following IDCA i
7.
9/01/77 RS8 6.3 control Room Position Indication of 6.3.2.9 and 1
Manual (Handwheell Valves in ECCS Table 6.3-7 l
{
8.
4/01/77 RSB 15.1.5 Iong-hrm Recovery from Steamline Not applicable Break: Operator Action to Prevent to Limerick i
overpressurization (PWR) l i
9.
12/01/77 RSB 5.4.6 Pump operability Requirements 5.4
- 5. 4. 7 8
f 6.3 i
10.
3/28/78 RSB 3.5.1 Gravity Missiles, vessel Seal Ring
- 3. 5 t
Missiles Inside containment 11.
1/01/77 AB
- 4. 4 Core Thermal-Hydraulic Analysis 4.4.4 12.
1/01/78
,PSB 8.3 Degraded Grid Voltage Conditions 8.3 13.
6/01/76 CFB 6.2.1.2 Asymmetric Loads on components Located 1.12.3 Within Containment Sub-compartments r
14.
9/01/77 CSB 6.2.6 Containatnt Leak Testing Program 6.2.6 15.
1/01/77 CSB 6.2.1.4 Containment Response Due to Main Steam Not applicable Line Break and Failure of MSLIV to Close to Limerick 16.
11/01/77 ASB 3.6.1 6 3.6.2 Main Steam and Feedwater Pipe Failures
- 3. 6 17.
1/01/77 ASB 9.2.2 Design Requirements for Cooling Water 9.2.2 to Reactor Coolant Pumps i
18.
8/01/76 ASB 10.4.7 Design Guidelines for Water Hammer in Not applicable Steam Generators with Top Feedring Design to Limerick (BTP ASB-10. 2) 4 19.
1/01/76 ICSB 3.11 Environmental Control Systems for Safety-3.11 l
Related Equipment l
(
- 8 Regulatory Guides included in the RRRC and NRR lists are addressed in Section 1.8 (alversion in ef fect as of the date of Ref 1.11-2 i
i
OUESTION 421.10 (Section 7.7)
The. analyses reported in Chapter 15 of the FSAR are intended to demonstrate the adequacy of safety systems in mitigating anticipated operational occurrences and accidents.
Based on the conservative assumptions made in defining these
" design bases" events and the detailed review of the analyses by the staff, it is likely that they adequately bound the consequences of single control failures.
To provide assurance that the design basis event analysis for Limerich adequately l
bounds other more fundamental credible failures, provide the following:
(1)
Identify those control systems whose failure or malfunction could seriously impact plant safety.
1 (2)
Indicate which, if any, of the control systems identified in (1) receive power fror common power sources.
The power sources considered should include l
all power sources whose failure or malfunction could lead to failure or malfunction of more than one control system and should extend to the effects of cascading
(_)
power losses due to the failure of higher level distribution panels and load centers.
l (3)
Indicate which, if any, of the control systems l
identified in (1) receive input signals from common l
sensors.
The sensors considered should include common Taps, hydraulic headers and impulse lines feeding l
pressure, temperature, level or other signals to two or l
more control systems.
1 I
(4)
Provide justification that any malfunctions of the l
control systems identified in (2) and (3) resulting from failures or malfunctions of the applicable common power source or sensor including hydraulic components are bounded by the analyses in Chapter 15 and would not require action or response beyond the capability of operators or safety systems.
I
RESPONSE
PECo has contracted GE to perform a Control System Failure Analysis using the methodology employed for the Mississippi Power and Light, Grand Gulf Evaluation Report on Control System failure.
This report has been found satisfactory by the NRC in
()
addressing this same concern on the Grand Gulf docket.
The 421.10-1 i
.~'.
+,.
i -
DRAFT
^
1
)
,ie' program.~is~ scheduled to start in' January 1983 and to be completed i
in July 1983, with a final report by September 1983.
I-j i'
i
)~
J t
{
i l
l 7
1 i
n 4
6 i-i i
G I
i t
)
I i
i 1
i l
6 421.10-2
... - -... - - ~. - -.. ~.
\\J OUESTION 421.11 (Section 7.7)
Section 7.7.1.1.3.1.5 of the FSAP indicates that the RPV pressure and water level instruments use the same instrument lines.
Identify all other cases where instrument sensors or transmitters supplying information to more than one protection channel are located in a common instrument line or connected to a common instrument tap.
Verify that a single failure in a common instrument.ine or tap isuch as break or blockage) cannot defeat required protection system redundancy.
Identify where instrument sensors or transmitters cupplying information to both a protection channel and one or more control channels are located in a common instrument line or connected to a common instrument tap.
Verify that a single failure in a commen instrur.ent line or i
tap cannot defeat required separation between control and l
protection.
RESPONSE
Response to this question will be addressed in conjunction with the Control System Failure Analyses referenced in the response to
(}
Question 421.10.
i
[
l t
L p
421.11-1
i DRAFT l
Section 7.7.1.1.3 of the FSAR identifies design criteria for the l
Reactor Pressure Vessel instrument. sensing lines to prevent trapping of air or noncondensable gas.
Discuss the applicability l
of this criteria to safety-related instrument sensing lines.
RESPONSE
l The instrument line slope criteria discussed in Section 7.7.1.1.3 l
is applicable to all instrument lines including the safety l
related systems.
Section 7.7.1.1.3 has been changed to clarify RPV sensing line design criteria.
i i
l h
1 l
l l
l l
l I
I O
421.15-1
.- _._., _..-__.~...~.. _...___ ___ _._-_ _-.......,_ _
Afst 1. I b LGS-FSAR
,m 4
k-)
7.7.1.1.1 RPV System Identification 7.7.1.1.1.1 General The purpose of the reactor vessel instrumentation is to monitor the key reactor vessel operating variables during plant operation.
These instruments and systems are used to provide the operator with information during normal plant operation, startup, and shutdown.
They are monitoring devices and provide no active power control or safety functions.
7.7.1.1.1.2 RPV Classification The systems and instruments discussed in this section are designed to operate under normal and peak operating conditions of system and ambient pressures and temperatures, and are classified as not related to safety.
7.7.1.1.1.3 RPV, Reference Design Table 7.1-2 lists the reference design information.
The reactor vessel instrumentation is an operational system and has no safety function.
Therefore, there are no safety design differences (g
between this system and those of the referenced design
(/
facilities.
This system is functionally identical to the referenced system.
7.7.1.1.2 RPV Power Sources Nonsafeguard instrumentation is powered from a 120 Vac 60 Hz instrument bus.
Safeguard pressure, differential pressure, and level transmitter and trip unit channels are powered from divisional 24 Vdc buses that are energized by 120 Vac/24 Vdc power supplies.
Some of these power supplies are energized from the appropriate 120 Vac divisional instrument bus, and the others are energized from the 125 Vdc instrument bus for the division via a 125 Vdc/120 Vac inverter.
See Sections 7.2, 7.3, and 7.4 for more discussion of the safeguard (divisional) power sources.
7.7.1.1.3 RPV Equipment Design For safeguard and nonsafeguard sensing instruments located below the process tap, the sensing lines slope downward from the process tap to the instrument about 1/2 inch / foot (the design minimum is 1/4 inch / foot, which is allowed for those lines that cannot be sloped a minimum 1/2 inch / foot because of obstructions) so that air traps are not formed.
Where it is impractical to locate the instruments below the
/~T process tap, the sensing lines ascend vertically for at least 36
\\-)
inches of process connection up to a high-point vent located at 7.7-3 l
DRAFT LGS FSAR OUESTION 421.16 (Section 7.1, 7.7)
Provide an evaluation of the effects of high temperatures on the reference legs of the water level measuring instruments resulting from exposure to high energy line breaks in your design.
RESPONSE
Generic studies and studies for other BWRs similar to Limerick have shown that the potential inaccuracy which could occur under the unusual condition of very high drywell temperature characterized by postulated high energy line breaks is acceptable from a safety standpoint.
a confirmatory Limerick study will be completed in April 1983 and will be reported to ICSB.
O 1
i i
i 421.16-1
DRAFT H
OUESTION 412.18 (Section 7.4)
Section 7.4.1.1-and Section 7.4.1.2.1.2 of the FSAR provides details on the design criteria and classification of the RCIC and Standby Liquid Control System (SLCS).
It is not clear if the RCIC is classified as safety-related.
However, the SLCS is considered as not being required to meet the safety design basis requirements of the plant safety systems.
Recent BWR application (e.g., Shoreham and Perry) have indicated that all portions of the SLCS required for the injection of fluid including the switch used to initiate the system are safety-related and the heaters, indicator lights and alarms are not safety-related.
It is further indicated that all the equipment required for the RCIC system to perform its safety function of injecting water is safety-related.
Even though the RCIC 1r not part of the ECCS network, the staff has considered it a safety-related syster similar to that of the auxiliary feedwater system in a PWR.
'Considering the information provided above, discuss in detail the
(~T design criteria and classification of the RCIC and SLC systems in Al your design.
RESPONSE
i Although the RCIC is not an ECCS or an ESF system, it is a system that may be used for the safe shutdown of the reactor, and it is classified as safety-related.
On a network basis, the RCIC is backed up by the HPCI for the safe shutdown function.
Therefore, RCIC as a system by itself is not required to be redundant and meet the single failure criterion.
The RCIC system is provided with Class 1E power source.
The electrical components are classified as safety-related and seismic Category I.
The system is capable of initiation and l
operation independent of ac power.
Electrically, the RCIC is l
divisionally separated from the HPCI.
The system is automatically initiated on redundant (low reactor water level) but not diverse signals.
The entire system is also operable manually from the control room.
O J
l l
412.18-1
("r
'z_) -
Th'e SLC is a special capability backup system independent of and diverse to the control rods for shutting down the reactor if
' multiple failures prevent the control rods from inserting.
As a system by itself, the SLC is not required to be redundant and meet the single failure criterion.
All portions of the standby liquid control system required for the injection of fluid including the initiation switch.are safety-related and seismic Category I.
The power buses, pumps, and explosiva operated injection valves are redundant so that a single component may be removed from service for maintenance during plant operation.
The SLC pumps, valves, heaters, explosive injection valves, and associated controls are powered from Class 1E power supplies.
The SLC system is physically and electrically separated from the control rod drive system.
The SLC system is manually operable from the control room.
O l
I l
l l
l l
l 412.18-2
. -. ~
DRAFT LGS FSAR OUESTION 421.19 (Section 7.7)
Section 7.7 of the FSAR indicates that the Rod Sequence Control System (RSCS) is utilized to restrict rod worths for the-design basis rod drop accident and the Rod Block Monitor (RBM) is utilized to prevent erroneous withdrawal of control rods to prevent local fuel damage.
Discuss the rationale and basis for not including these systems or portions of these systems as safety-related.
Also discuss their interfaces with safety-related portions of your design (e.g.,
APRM, refueling interlocks, etc.).
RESPONSE
The rod sequence control system (RSCS) acts to prevent withdrawal of an out'of-sequence control rod, to prevent continuous control rod withdrawal errors during reactor startup, and to minimize the core reactivity transient during a rod drop accident.
The consequences of a rod withdrawal error in the startup range were generically analyzed in NEDO-23842, demonstrating that the licensina basis criterion for fuel failure is still satisfied
(])
even when the RSCS fails to block rof withdrawal.
Thus, the RSCS, which is a subsystem of the non-safety-related reactor manual control system (RMCS), is not safety-related.
The safety action required for the continuous control rod drop incident (a reactor scram) is provided by the safety-related intermediate range monitor (IRM) subsystem of the neutron monitoring systems (NMS).
If the core flux scram trip setpoint is reached during a flux transient, the IRM will both block further rod withdrawal and initiate a scram.
Furthermore, a second safety-related NMS scram trip, supplied by the average power range monitor (APRM),
can terminate the core power transient.
The RSCS does not interface with safety-related systems.
Refueling interlocks are not considered safety-related.
The rod block monitor is designed to prohibit erroneous withdrawal of a control rod during operation at core high power levels.
This prevents local fuel damage under permitted bypass and/or local power range monitor (LPRM) detector chamber failure conditions and prevents local fuel damage during a single rod withdrawal error.
Because local fuel damage poses no significant threat relative to radioactive release from the plant, the RBM is a power generation system and is not used for accident mitigation.
Although the RBM does not perform a safety-related function, in 1
(])
the interest of plant economics and availability, it is designed 421.19-1
)
DRAFT LGS FSAR to meet certain salient design principles of a safety system.
These include the following:
a.
Redundant, separcte, and isolated RBM channels.
b.
Redundant, separate, isolated rod selection information; including isolated contacts for each rod selection pushbutton providing input to each RBM channel, c.
Independent, isolated EBM level readouts and status displays fror the RBM channels.
d.
A mechanical barrier between Channels A and B of the manual bypass switch.
e.
Multiple manual RBM channel bypass is prohibited by switch design.
f.
Independent, separate, isolated rod block signals from the RBM channels to the RMCS circuitry.
g.
Failsafe design; loss of power initiates a rod block.
h.
A trip of either RBM channel initiates a rod block.
(
The RBM interfaces with the following safety-related systems:
a.
LPRM:
Separate, isolated LPRM amplifier signal information is provided to each RBM
- channel, b.
Flow Signal:
Separate and electrically isolated recirculation flow inputs are provided to the RBM for trip reference.
c.
APRM System:
Independent, separata, isolated APRM reference signals are supplied to each RBM channel for trip reference.
I
.,/
421.19-2
OUESTION 421.20 Identify any "first-of-a-kind" instruments used in or providing inputs to safety-related systems.
Also include any microprocessors, multiplexers or computer systems which are used in or interface with safety-related systems.
RESPONSE
The requested information is provided below.
"First-Of-A-Kind" Instruments Tvpe Manufacturer Model Use Pressure Switch ITT Barton 580A2 Various Microprocessors, Multiplexers, Computer Systems
()
Type Manufacturer Model Suppression Pool Temperature Simmonds Precision Radiation Monitor Process General Atomic RM-80 l
Radiation Monitor Digital High Range General Atomic RM-80 t
Radiation Display General Atomic RM-23 Radiation Monitor (RMDS)(2)
Digital Equip Corp PDP-11-34 Radiation Monitor (MMDS)(2)
Digital Equip Corp VAX-11-780 I
ERFDS Analogic ANDS 4810 ERFDS Analogic ANDS 4820
?
i (1) Radiation monitoring display system O
(2) Meteorological monitoring display and reporting subsystem
-o.
421.20-1 i
-OUESTION 421.25 Section 7.6.2.6 of the FSAR describes the requirements for the Containment Inc.trument Gas System (CIGS-ADS) control.
It is indicated that the CIGS-ADS provides a backup supply of instrument gas to the safety-related' ADS valves in case the non-safety portion of the CIGS is unable to do so and may be required for long term operation.
Discuss the operation, functional components, interfaces and design criteria using detailed drawings as appropriate.
Include the following in your discussion:
a)
Separation requirements and implementation at the safety /non-safety interfaces.
l b)
Basis for not meeting the single failure criterion.
c)
Details of conformance to R.G.
1.89.
1
()
d)
Details of conformance to R.G.
1.47.
RESPONSE
Sections 7.6.1.6 and 7.6.2.6 have been changed to discuss the r
operation, function, interfaces, and design criteria of the CIGS-ADS system (Figure 9.3-2).
I l
l
[
t l
()
421.25-1 r
I
.~,._._._.-._ _ _.... - _
\\/
The passive channel signal is available for use, should a component of the active channel fail.
The SRV temperature monitoring system provides a backup for the SRVPI system.
Diversity does not apply.
7.6.1.5.7 SRVPI Testability Proper operation of SRVPI channels can be checked during plant operations without disabling another channel.
7.6.1.5.8 SRVPI Environmental Considerations The SRVPI system is designed to operate under both environmental and seismic conditions as outlined in Sections 3.11 and 3.10.
7.6.1.5.9 SRVPI Operational Considerations 7.6.1.5.9.1 General Information When there is flow through an SRV, the associated flow noise, if of sufficient magnitude, will actuate an alarm in the control room to alert the operator of an open SRV.
7.6.1.5.9.2 SRVPI Reactor Operator Information
(
The open/not open status of each SRV is provided for the operator in the control room, as well as a common annunciator indicating an open SRV.
7.6.1.5.9.3 SRVPI Setpoints The setpoints for SRVPI are determined individually for each SRV using information obtained during system installation and plant operations.
Cross-talk measurements are conducted to ensure that an alarming SRV will not cause another SRV to alarm.
7.6.1.6 Containment Instrument Gas System-Automatic Depressurization System Control (CIGS-ADS) - Instrumentation and Controls l
7.6.1.6.1 CIGS-ADS Description The CIGS-ADS consists of nitrogen bottles, pressure controls, and instrumentation and associated piping which tie into the two instrument gas supply headers to the ADS valves as shown in Section 9.3.1.3 and Figure 9.3-2.
In the event that the non-safety-related CIGS header is unable to supply gas to its ADS valves for use during long-term shutdown cooling or vessel venting, the gas supply for that header is automatically switched l
to its CIGS-ADS gas bottles.
Each CIGS-ADS header supplies s
)
instrument gas to its respective ADS valves.
One set of ADS
(~>T valves and its gas supply will meet the requirements for the backup long-term shutdown cooling path.
l 7.6-46 l
i'A /. A f LGS FSAR 7.6.1.6.2 CIGS-ADS Initiating Circuits The CIGS-ADS is initiated by a pressure switch which senses low pressure in the respective ADS gas supply header.
The system can l
also be initiated manually.
7.6.1.6.3 CIGS-ADS Logic In the event that low pressure is sensed in a ADS gas supply header, a pressure switch causes a solenoid-operated valve ir. the supply line from the CIGS to close and a solenoid-operated valve in the CIGS-ADS supply to that header to open.
Those actions may be controlled manually from the control room.
7.6.1.6.4 CIGS-ADS Bypasses There are no bypasses in the CIGS-ADS.
7.6.1.6.5 CIGS-ADS Interlocks The CIGS-ADS is interlocked with the non-safety-related CIGS so that only one system at a time will provide instrument gas to the ADS valves.
7.6.1.6.6 CIGS-ADS Redundancy and Diversity Diversity is not required for CIGS-ADS.
The CIGS-ADS is redundant in that each header is supplied by its own gas supply and separate divisional safeguard power.
7.6.1.6.7 CIGS-ADS Actuated Devices The solenoid-operated shutoff valves in the CIGS supply line and the solenoid-operated shutoff valves in the CIGS-ADS supply line are actuated by this system.
7.6.1.7 Safeguard Pipino Fill System (SPFS) - Instrumentation '
and Controls 7.6.1.7.1 SPFS Description The SPFS pumps take suction from the suppression pool by way of the core spray suction line and discharge into the emergency core cooling system (ECCS) pump discharge lines to maintain these lines in a full condition.
In this capacity, they are a backup to the condensate transfer system, which is the primary water source for keeping the ECCS discharge lines full.
The SPFS pumps also discharge into the feedwater lines to provide a water seal in the event of any line break other than a feedwater line break inside containment.
The SPFS is a supporting system to the ECCS.
7.6-47 l
V O
7.6.2.6 Containment Instrument Gas System - ADS Control (CIGS-ADS) - Controls and Instrumentation 7.6.2.6.1 CIGS-ADS General Functional Requirements Conformance The following analysis demonstrates how the CIGS-ADS meets the safety design bases identified in Section 7.1.2.1.2.9.
l The CIGS-ADS provides a backup supply of instrument gas to the ADS valves in the event the CIGS is unable to do so, This l
function is safety-related in that the ADS valves may be required for long-term operation.
i l
O 7.6-107 l
l
Gl. RS A
()
7.6.2.6.2 CIGS-ADS Specific Regulatory Requirements Conformance 7.6.2.6.2.1 CIGS-ADS Conformance to Regulatory Guides 7.6.2.6.2.1.1 ClGS-ADS Regulatory Guide 1.29 (1978) - Seismic Design Classification All controls for the CIGS-ADS are seismic Class 1.
7.6.2.6.2.1.2 CIGS-ADS Regulatory Guide 1.30 (1972) - Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation f
See Section 8.1.6.1.
7.6.2.6.2.1.3 CIGS-ADS Regulatory Guide 1.47 (1973) - Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems A low-pressure alarm in the control room alerts the operator to low pressure in either set of nitrogen bottles.
l 7.5.2.6.2.1.4 CIGS-ADS Regulatory Guide 1.53 (1973) -
Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems O
Section 7.1.2.5.12 gives the degree of compliance.
l 7.6.2.6.2.1.5 CIGS-ADS Regulatory Guide 1.89 (1974) -
Qualification of class IE Equipment for Nuclear Power Plants Section 8.1.6.1 gives the degree of conformance.
'l 7.6.2.6.2.1.6 CIGS-ADS Regulatory Guide 1.100 (1977) - Seismic Gualification of Electrical Equipment for Nuclear Power Plants See Section 3.10.
7.6.2.6.2.2 CIGS-ADS Conformance to 10 CFR Part 50, Appendix A, General Design Criteria (GDC) 7.6.2.6.2.2.1 (CIGS-ADS) GDC 1 - Quality Standards and Records This system is built in accordance with an established quality assurance program.
l l'
7.6-108 l
&lAS
~
(
LGS FSAR nO 7.6.2.6.2.2.2 (CIGS-ADS) GDC 2 - Design Bases for Protection 4
Against Natural Phenomena Compliance is discussed in Section 7.1.2.6.2.
l 7.6.2.6.2.2.3 (CIGS-ADS) GDC 3 - Fire Protection Compliance is discussed in Section 7.1.2.6.3.
l 1
7.6.2.6.2.2.4 (CIGS-ADS) GDC 4 - Environmental and Missile i
Design Bases Compliance is discussed in Section 7.1.2.6.4.
l l
7.6.2.6.2.2.3 (CIGS-ADS) GDC 20 - Protection System Functions The transfer from the instrument gas compressors (CIGS) to the CIGS-ADS as the gas source for the ADS valves is initiated automatically by a low pressure sensor in the respective header.
l 7.6.2.6.2.2.6 CIGS-ADS GDC 21 - Protection System Reliability and Testability The system is redundant on a system level; i.e.,
each gas source O
supplies sufficient ADS valves to accomplish the safety function.
Testing during normal operation is possible without disrupting
)
operation of the CIGS.
7.6.2.6.2.2.7 (CIGS-ADS)
GDC 22 - Protection System Independence l
Diversity is not required for this system.
l i
7.6.2.6.2.2.8 (CIGS-ADS) GDC.23 - Protection System Failure Modes On loss of instrument air or electric power, the system fails i
into an alignment that supplies backup nitrogen to the ADS l
valves.
7.6.2.6.2.2.9 (CIGS-ADS GDC 24 - Separation of Protection and Control Systems The CIGS-ADS has no plant control functions.
7.6.2.6.2.2.10 CIGS-ADS GDC 29 - Protection Against Anticipated Operational Occurrences The CIGS-ADS is designed to withstand anticipated operational occurrences by seismic and environmental qualification as j
described in Sections 3.10 and 3.11.
lO 7.6-109 l
.., _ ~
va/.a5 h
{
('s q,)
7.6.2.6.2.2.11 (CIGS-ADS) GDC 57 - Closed System Isolation Valves The CIGS-ADS has an isolation valve located in the supply line outside the containment at the penetration.
This valve closes on a containment isolation signal.
The isolation signal may be by means of a keylocked switch.
The isolation valve may also be manually operated from the control room.
7.6.2.6.2.3 CIGS-ADS Conformance to Industry Standards 7.6.2.6.2.3.1 CIGS-ADS IEEE 279-1971 -
Criteria for Protection Systems for Nuclear Power Generating Stations 7.6.2.6.2.3.1.1 CIGS-ADS General Functional Requirement IEEE 279-1971 (Paragraph 4.1)
On low supply pressure from the CIGS receivers, automatic transfer is effected to the CIGS-ADS gas bottles.
The system is effective over the range of environmental conditions cited below:
a.
Power supply voltages:
Equipment is designed to operate within the range of voltages specified in Section 8.3.1.
b.
Power supply frequency:
Equipment is designed to
(])
operate within the range of power supply frequencies specified in Section 8.3.1.
c.
Temperature:
The system is operable at all temperatures that can result from a design basis LOCA.
d.
Humidity:
The system is operable at all humidities, including steam, that can result from a LOCA.
e.
Pressure:
The system is operable at all pressures resulting from a LOCA.
f.
Radiation:
The system is operable at all radiation levels expected for any design basis LOCA.
g.
Vibration:
The system will tolerate the conditions stated in Section 3.10.
h.
Malfunction:
The system will tolerate a single failure at the system level.
i.
Accidents:
The system will continue to operate during and following any design basis accident.
j.
Fire:
The system will tolerate raceway fires in a single divisior..
l 7.6-110 l
l
4'st/.A f
\\
s-)
k.
Explosions:
Explos'.ons are not defined in design bases.
1.
Missiles:
The system will tolerate any single missile destroying raceway, cabinet, or equipment in one
)
division.
m.
Lightning:
Lightning damage to the electrical division powering the outboard isolation will render the system inoperative if the valve is closed on loss of power.
n.
Floods:
The plant is not subject to flooding, as discussed in Section 3.4.
o.
Earthquake:
The system will tolerate conditions stated in Section 3.10.
p.
Wind and Tornado:
All control equipment is located in a seismic Class I structure.
See Section 3.3 for wind loadings.
1 q.
System response times:
The system response times are within the need to initiate alternate gas supply to the i
ADS valves.
g r.
System accuracies:
Accuracies are within those needed for correct action.
4 s.
Abnormal ranges of Sensed variables:
Sensors are i
designed for the expected ranges and rates of change of variables.
7.6.2.6.2.3.1.2 CIGS-ADS Single-Failure Criterion IEEE 279-1971 (Paragraph 4.2)
A single active or passive electrical or control failure will not prevent the CIGS-ADS from performing its design safety function.
7.6.2.6.2.3.1.3 CIGS-ADS Quality of Components and Modules IEEE 279-1971 (Paragraph 4.3) 1 l
All safety-related components are selected on the basis of suitability for the application.
A quality assurance program is implemented.
7.6.2.6.2.3.1.4 CIGS-ADS Equipment Qualification IEEE 279-1971 (Paragraph 4.4)
The CIGS-ADS safety-related controls and instrumentation are qualified according to the requirements outlined in IEEE 323-1971 as highlighted in Section 7.1.2.7.4.
The qualifications criteria 4
O are identified in Sections 3.10 and 3.11.
The parameters identified cover normal, abnormal, and accident environments.
7.6-111 l
i l
7.6.2.6.2.3.1.5 CIGS-ADS Channel Integrity IEEE 279-1971 (Paragraph 4.5) 4 The CIGS-ADS meets the channel integrity objective by using the design features described in the other paragraphs of this section.
7.6.2.6.2.3.1.6 CIGS-ADS Channel Independence IEEE 279-1971
}
(Paragraph 4.6) 4
{
The CIGS-ADS is a two-train system.
The control, i
instrumentation, and power circuits to each train of the system are physically and electrically separate from electrical channels
}
in the other division.
i-i 7.6.2.6.2.3.1.7 CIGS-ADS Control and Protection System j
Interaction IEEE 279-1971 (Paragraph 4.7)
The CIGS-ADS has no interaction with the plant control systems.
j Control room annunciator circuits taking input from this system are electrically isolated from the system and cannot impair its i
operability.
l 7.6.2.6.2.3.1.8 CIGS-ADS Derivation of System Inputs IEEE 279-1971 (Paragraph 4.8)
()
The CIGS-ADS is initiated by low pressure in the ADS gas supply i
header, from a pressure switch in each header.
l j
7.6.2.6.2.3.1.9 CIGS-ADS Capability for Sensor Checks j
IEEE 279-1971 (Paragraph 4.9) i l
The pressure sensors for the CIGS-ADS can be checked by j
introducing a substitute input and observing system initiation.
7.6.2.6.2.3.1.10 CIGS-ADS Capability for Test and Calibration,
IEEE 279-1971 (Paragraph 4.10) i The pressure sensors used for system initiation can be tested and l
l calibrated during power operation.
i 7.6.2.6.2.3.1.11 CIGS-ADS Channel Bypass or Removal from l
Operation IEEE 279-1971 (Paragraph 4.11) l The two CIGS-ADS trains are separate electrically and physically.
Removal of a component for maintenance prevents the operation of one train; however, operation of the other train is unaffected.
The CIGS-ADS cannot be bypassed because all control is manual.
I
!, ( )
1 1
7.6-112 l
}
-e--,---
e,
-,_,w-
,-,-e-,,-,-e,n--,.,s
-wwmw,.m,,,,-,c.w,,,-,m
--,,-,-,,m--,
ev--y,e,
Our LGS FSAR i~(Z) 7.0.2.6.2.3.1.12 CIGS-ADS Operating Bypasses IEEE 179-1971 (Paragraph 4.12) i There are no operating byparses.
7.6.2.6.2.3.1.13 CIGS-ADS Indication of Bypasses IEEE 279-1971 (Paragraph 4.13) i A system out-of-service annunciator will be manually brought up by administrative procedures whenever system tests are performed.
1 i
7.6.2.6.2.3.1.14 CIGS-ADS Access to Means for Bypassing j
(IEEE 279-1971, Paragraph 4.14) l Access to components of the CIGS-ADS is controlled by administrative procedures.
i l
7.6.2.6.2.3.1.15 CIGS-ADS Multiple Setpoints IEEE 279-1971 j
(Paragraph 4.15)
This paragraph is not applicable.
I 7.6.2.6.2.3.1.16 CIGS-ADS Completion of Protective Action Once it is Initiated IEEE 279-1971 (Paragraph 4.16)
The CIGS-ADS, once initiated, will perform its protective action l
to completion.
The operator must reset the system to normal j
status.
1 i
7.6.2.6.2 3.1.17 CIGS-ADS Manual Initiation IEEE 279-1971 j
(Paragraph 4.17)
The CIGS-ADS can be manually initiated.
l 7.6.2.6.2.3.1.18 CIGS-ADS Access to Setpoint Adjustments, Calibration and Test Points IEEE 279-1971, j
(Paragraph 4.18)
I Access is controlled by administrative procedures.
7.6.2.6.2.3.1.19 CIGS-ADS Identification of Protective Action IEEE 279-1971 (Paragraph 4.19) j The positions of valves 11. the CIGS-ADS is indicated in the control room.
Low gas bottle pressure is alarmed.
7.6.2.6.2.3.1.20 CIGS-ADS Information Readout IEEE 279-1971 (Paragraph 4.20) i Valve position and low gas bottle pressure provides information
(])
to assure the operator of correct operation.
7.6-113 l
(
)
OUESTION 421.27 (Sections 7.1 and 7.7)
Section 7.1.2.2.3.2.2(d) of the FSAR states that the instrumentation and control equipment and components for the safety-related systems identified in Section 7.1.1.2 are not located in a steam leakage zone " insofar as is practicable" or are designed for "short-term exposure to the high temperature and humidity associated with a steam leak."
a)
Identify the specific systems and the electrical equipment or components which are located in a steam zone and/or subjected to an abnormal temperature, pressure, humidity or other environmental stress.
b)
Discuss the safety-related function of the equipment and components.
c)
Confirm that the equipment and components are included in the environmental qualification program.
RESPONSE
()'
PECo will provide a Preliminary Environmental Qualification Licensing Report for Limerick by May 1983.
The report will identify the specific systems and the safety-related electrical equipment located in a potentially harsh environment area of the plant.
In addition, a component evaluation worksheet for each safety-related electrical equipment component will be included as part of the report.
This worksheet will include safety-related function of the equipment.
Final report is planned to be issued in September 1983.
(s b
421.27-1
. ( b
' (/
OUESTION 421.2_8 (Section 7.2)
Section 7.2.1.1.4.7 of the FSAR indicates that pilot solenoids for the scram valves "
'ot part of the RPS" and that the RPS interfaces with the p.
olenoids.
Discuss the interface area j
using detailed schematics and drawings as appropriate.
Include in the discussion the backup scram valves, their classification and their interaction or interface with the RPS.
l l
RESPONSE
The pilot solenoids for the scram valves are part of the hydraulic control unit (C11-D001) of the associated control rod in the control rod drive system.
The backup scram valves (C11-F110A & B), classified as non-essential, are also not part of the reactor protection system, but are part of the control rod drive system.
! I)
The function of the pilot scram valve solenoids and the backup l\\#
scram valves, and t. heir interface with the RPS, are discussed in L
Sections 7.2.1.1.4.7 and 7.2.1.1.4.8, and detailed in Figure 7.2.1 (sheet 1).
l l
l l
()
I 421.28-1
I
. tL __1.._-..___
../. _..
_. l1
,g a I t
n p
It 3
cVer:W-._i I
a f
n s..~'
1
\\
A Ig i
,..o.,.
m,w..
s %.
- c..,r.=
._n..
w..
.uw
.m
..m
.u..
/
\\i t.1, '<=/
\\JL c=
M.T w.4 a.
Twees.aae.w.
e.eis d 59tWP f Tw&M e.mdveek it es.
et*.6esca vu sa.ac a st er?
An a mesmas a 1 3 ein. e _ 's pe & a r.*
\\=. " =~ /
'3 Y,=,
<~ l l
e
.s.
f.t -
vu s.e m.,
, L,
... ~
Staet pee SS suras s-* w
\\ n. t <= /
b.
.6 O t
.DwWTTts0 89 ses
=
\\ -. 990'T10.d/
amm em a p.
1 i
E I RACJAC. 8%m88Capf Lp? gm&AESA l
REC 44C 8%msp CJEC.mT Dagaman j
sa te e s Ts>
t antea)vKs q
a.it ca s ta Q
u6a-t aus oew.cs (
acca.
P f(j s
3L creame puu* Tse,- systru A
~
Typeca6 ran systsam e, sea.+ss escene ne ()
f
. t cm ACA
.f Ce
- Nc=
(a (m
(a a
g 3*
i
- n
,,m,e,,a,,
f. m e, n,,
3 1
8 are A vasesto ener a Tweepts I
l e
I c.u 4,,
cr, g.
'l i u.#es t' g, a.
cs esy tc
. execal g,
J 9
3 i
t..
e J.
O F
a 3
L f.
ei aj
.:~*.
[ & ( ! '71
/
- r f, 2.../.
- :c-.
..._.4 k.
w
... i..s.n. =- 2:
V
~r ~
t u= E....i. 4 f; ;,
4
- A Tr.. _.,..:..;-: -
6 u,-
. _~:---- -
l s)o'
- ** h[.".E
..*Q ..-~. O I I y1 = 3 $ 1 0 i,, I O l y O h,~ gp 3 l 8
.. ~ il N 'O ! I '8 l 99 _ l Osentat$tutvoes [7/ 9 E,.s a.;;, c- 'l .~ w -- s' l 8 -.--.. - ~ [ -- Ti. &T*. r.^..r.e_a m. etret..sw a.vsv.ra.._. l I I s 1 i t,> = Id ei .e= P 1>
- D x.1.
.s i DRAFT i t- ' dr ~. I 2 I -e P P i. ..w u -.., .a t tu ' 'e, -..u.. as m,, e orenom a ~. s - - ~. 1 @ [ m{ M 4.ameA w M. nm , Ah a 72 . hJ,,. -. _9 ( o f 4.. e ~~ e.. i..wans 1 so i qui e in p 3 e g ...S. e. .ee T l
p. l* i l; (*., a l ', -) _.2, a
- .~.
-= = a % ,g
- 15
/ \\ / - / s i d I'* 8 9* y l -e# i 4 P l ;- l *- g f 3 k e.,== l i P 4 D g e 'd -g,
==- . a surenmpus 6 l ans mance g w g egg, g&q*fe **Nh Esta na u _awsmaf*. - A na se e< 4. l 8
== % sa a *w g .7 4)
- ) 4) 4 4
,U l T - - o M.. .:_"" "T* 1 _. h. !!! Ti \\. i f .. R. -- E! El.Di --L m; m1..,10.. h :1 5' h s.*. 5 8 i* 19 '~ _.1 v w mee servue w pumme e temerT 1) e.I N as !k E "A es N " l "o" m m /- J u '4 L., m l -mm- ,, e h$ wa s LD*OJ:T asuws emns3 etam e SR SMN T 2-M M se Y grsamt M 6 s uew. e p bassua f g ,s s e I e, gena'9 l l - h i a_ p. 2 yx.e.u bW h, i l 96 4 g l n === l 1 T t e r l a-se om. 1 l' l l 1 = a dl o Il. a 4 . enntee - l ,, ti" w se w D'*:wn. t.1... oa. '. _,.] j-l
- e e
v ovamm I g-lT... ' **4e j i p (g
- LW S*
m aim m.- ~e t. e' .Aj p 2 r I l g t W.- a 1 m b ma.a e C $**sei A mM 7 [ AALC.Wes4AT04 ' i ce ,g~ ;,g.,,,, i s p3 q f.% n. ~.-..d .4.,4-J.----- ,3
- s. [ ~-
J. 1;?. a l T. en, g'. ; * * ". p e
l. ,UNEPJ C#( (a 49.. _u., S.,4tK I,, i.. m.---,,. m i i.s.._ _.".T.C.it P.E.E.FTE* TION SW1,.4 - r.f 8E.".= *=,. h.6 a 3 1 i s_.. i %_. L .uu
- r...........
i e. 'i N s...................... .....m.. .e ...u6....t....t. ...I N ......ii..e...is... e,.i. ,( ei. \\ ...t..ia!.i..... ..;.....==.
- a. -.+..
mi........s..... g.;r., a ;.,;7g,;.. g; y., ;.3=.:~.,,g;g, .".=.",...,;,::r;;;.;:p;g.ja; :..;.t. 6..... _e s. -i........ e... i p i.,.'. i... "'t.mk. " '.Y.T ' l";:."fd..; "". ".I. TJ **.;' **
- "Y
- r. -..isi
..i.6 6.ie.. at* .. ~. -....i.,ei.iei !.#.........i g. =.:::.,;,r,.;y,,y.7.,:.;.,.g.:.;, .g.::=,= m
- ..a;;,,,,,; ; ;.;;-
- ::,a. :. r..-g;.;./7;.
- i, i. i e i.,., e i. t.,... e i.,. t e.
= "a
- *)
u". ".
- .........#.......).i
- 1 c.
- .i.....i.......i i
4-
- .,ia.#...i...i
~.......... f ig r lllllll I a. .~ ee......... v .sa i i . ~ e. .... us.5.s. ..........m...... e ..-..m. r. k 11 ./ m,,%,,,,,,,,,,,, .m.i r. m, u.....e........ 4 .. 4 4 .....m............ ,) .).)l ) .) f. E*- 6.m. _q_~_ n..... m..-m-..~"m.== 20:"." "*::'.J..l"2.:.". :*.,..::. = M .~*a= m - --. Q.. '!' .;;.,,,.1t....l y-l* r:. p .a {t. 3y Q,e.9e .*I .m= .u. m. .,...e e a 3 g }. a s. = = - .m. amas t u.=.v m.... 'n -m .L m .-m-... 1 5 C 3 m- [ t. %._J dd i i e.. u i ,_.1.e g mn:.rs..w meu.. m. - { tda.KS edeos. l
- N. [.'
"'"I'* Y g. DE .M. S. 4 q f.. f- . b...= S-g - Li ,_..L.# g ..u_- l Mk ~..") q v 4 Q 4 .+ ..e, 6. T i.o '14.. MO .A .#. Ang] ..M. g g l . =t
- b. 6 so g
- f. ec.
- s. vo.v o sc a
7 q! \\.
== f ko.,
- .4*
ma [=.1 1 m.~ N 4 .=" iaw m- \\ I.a.....~ or w& gf a #1* 'i.' :."' ',s.&.. -t....N, }"*N.?,.- pg h o l t-... .w. f, c..'.t:; ,- n - n p+ e t ..T 2 .y N
..---i-.i
.i b uk ~.m-4 m o n o
- , f,
( f== eo ' N l a e_tu so. I' f o* *- h lgp.A _ _ -}_ _., e; ___y m m t.
- t. _.
le, en f e.' "f ar me' f , "f 'a i enFI2r e.g7 a . an6 7
- . a a
'T e+ u.a L...j
- t...
1 .eSTITV - =-- J f u. s._..- a y . %.. m a.,a rure ,g**- n .= W I n.a*= es. s ,s_asr_uo _ _ _ _ _ _ _ . =m o.'g a c m., es--, 1. _L _. ll O'"* iJ .acr n,_.i... c =--t _ k _.._ _ - +, ; .m 1
== i M.j m t, r;;, n l r f 'P Ya " S. l- ' Y "wMc J t.. L.. 7 g L t' W, - -....- 5 I. m.c-..._ E-C M J.- e a 8 a.m,r o am e .. s s. ia P".4 ped.,. b.e _o rg I a ar mn g c. s. -=- -l 4 h---1 t 84 W A-.-- ._._.5 g l .gn et.c,mn (,.*# ~ yi ; t 7 .e"==.'. 6'.' S s.af LA &.34 .= .6 y i f a.n r.tum gm. m emE 4 .C E - """ %.et-u, aC-e =. A rl, as,w ~a.rc r.m .[ -s un P. te l l CD.P.T a's f.J 98d l g me g g .: e e V s / vv. es 9.* er a
- same e
J. t:w _m } = -., l., i w e e et.em e% m.s 9 Twoop a g g e fve GP 6 sw cs a MIL c e y M.3 6 gy w.g C :.- l t 4.- = = 9 P WM f s
- w-s.W nc n_
e b E!.~.u. [. 1 1 F. g Q L-
- g y
e p.d W -/*..T,.#,. 7y,- * * . a. .U:{a s - i M r ... s s.9.1 - h ,. 3 g, e
g d I.' E *' @ h. t . d, P6 ge, 9 l st t t 93 NOS e. n ~, s, I 1 ,_EAC.TCf3 BmCTECTICN 94TWho at t / b t-t! ur =a u > s ce-s essetta. r I I amipeg aaus e. age inst = a=*-*w ? p mv vo can,av sie u.me,. om .me acm e ans a. x , _ _ _ _....________J m,m, -.. _ _. _._ _ _r. st ,._____.f. 1s=rm.... i.lj .W ee.r--- '-- w 4,- r c r
- r. r
.w _--*-c 2 25 g, .c .a ,,,,,,,3 r- - - - hjh EN I. E
- O l
{ i -..i. ,4.2 . L. . A: -==-- w e I L ______"'____l. Pr"t > maa.*o. sur s e g:t g _f. _g-g= .r _ _ _ f.-r = r > a-- 4 - :, -g We's as t : s e IT' f[_ _.____ _ L..
- a g.
o t p-*8*** 1
- I.)
* *a are. e-O & '"'D*o-b 0- ";d %~. ee V ,,J msh.7.,.. 's" 2 ssa pse kV,,,'"'" sur 2, d ,,,,,) =..,,,,l 'e---_ - _ -* -i 7 m 6 L s r,. E.' l' .g e e D--* , g g
- g
.<,.marsam wuun-s n A M m.ac==Y. amN" a Yw '/ N ,r t f w 1,, _ -w-: s > .J y V 62 l wq __4 -a = c4 w am g, r_____ j _4__,3 7 3 .,,,,s l r t l t 4 evs aa j IIW _ a s,-; * > g W f___ W o'aN'. !$% @_r go Q i pg,T,
- g. g',r-'g*c/wif.
1
,' z'.-
,4.
g4
,.g.,7 g
g
< ;_ _ _ _ - -
.d;,g.$y
- s
- -(
" yst."w 3 z% A ~ e
- n.h 5
b a [ . san,e A e.t e a p -j -- ) eQ T~ T -a t L s 8 9
- v. I l
} Y, a 1?
- 2-a.c w
h. I !I3 ,H h,,l.i. T,"*
- 3, 0 <f 3
T 't E '8 3 ) ; "- ) ee I b i ~ 4,,, a a[3-v -7 "~'** I f_ M. (et la !1 350 ( as vatsp acna-ma tem aCNa-W &a*'E *b 0 9C33 Sand A4 waas gws at ma vege gh The Wet & ha TUh8 aCN4-pm, I p M N D ~ I ilil Ic, e Iriisti i..g6 i ,l ,i a* -.j t----- .4,,,4 !!!4+1 j i M,,,W; ,=..me cans u.r c +-as --=4 n,. u -, I8 ,,y c.# .--w = 1 escsw as nie a. , OKasW (.9 Of. h7WLV ! escaw acmena hwT S } B- , esca marte 3 u.._ emasan e.sven. - annaCGA g e4 M g 44 { BG 4 I ou p r f i -_h g W.-.
- 5i+!as m"d40 "'i B,6'5Es' EGi%;
r 4 "i 5+E. * ! 'h.. J l'~ N,,h[, 4_,:._ . %., :: u- -;st. m ' cI '_ . i ii. is i is
,h --- o p :...._ / a a m 7 .Q ~m e {'i i iw o. .s a r~ ,.e.. ,. 1 Tr=-7 c =. Eh w u .,en.. w a M [ a < eu s Q. =. 4 n k....%1 *.'i, -=
- =p.
"Ei .c e s I fa
- ,*t;;*
rg;*,,7 ald'.A utss es, ~
- ' - * * ~
h tow tm*Tlt s ette <to ceS.eg ps. L te thEt gwg. .F $,1 cm q-. W Ca*.J %8 9 ye.g emene H ( :Si& LS 6 'f' C 994 3 tatt mapatashe C ASt 4 Chal ta c. &E1, ELF. i, t= M N vu. O Fli' = me. .m m a
- =.... sam
~~ ~ C SM E M d v e IE,.ETCE g e, .nfs.s b geg e tens , g n, %ee " L '% % *D nou ( 644 m MSe ! Vi g"$k
- N
- l c sm a.
I r-g- e S =ic i tv..,, s t e w c ( m 4 A" O N [ g ._ / l i.... r--7 ~ i 6w j=e== l i..c., ,um im <,. m o =
- esvaa
- O.,P *
- M==
9o.==m &.a
====m i ns= =
- i--
g hve. w,,0 _C_A iamevue i =ne== s ve N fr'8 G l t M l.WP 6 8 &# l' h $h. O N2Jrd U M es w cm cm em + n a a a e a e a on 1 h s w em sw een== nmas use f=umane sw i-eaa.m. en.a* ens i ames.m w =-.m.a. we.* 3, d a g wiums eu.swe n JmN, ...oe h gygp g MA.** .n.vy tm.e J. e ,w %
- s
.... a 9**e46 M W 939 N .. -lW .IN NN .MM {N ?5a b M 'Y e n ' 3 $%G Y'm
- N*' O b l') n %.3g-sy..: - V-~ ~
~~->] D th W,rd O I r e b n i=:-, ~~
b d, r, r. t .o e t In, t is sonnen-g j,j.7_o;g,[ ~ l r- ) e. '9"LM as.IcToct per.n.stT.idN. 9" ITEM l p b L. e m._ [_ e A. eds.CC _f e .~, 4 l I 8 I E ~ ~. /'sa n.au...Q. ~ l ] f @l w k 4.,,, s
- f. ;3 4
'. I 2? t.1,3, m cio oer u.s - i L. a a a ---a wen.. (~J ?'** g f':. g g,4 w .si.num v , c. / v4 s.= c. 1 i [ I I 3 I .r =, i = - M e-ruo 5 me.r, as.c. J .~.wa. I hiu / 4==*<= / g ,u,c l y) y I =
- =1
[ e 4 2 is ., e. s,..c.x p 6 .=. 8 ~ ,= -cr ) s e, c a.e e c. / .c vue a b,. .o-W',. i a f
- \\
l'M*i's a\\
- '..-o
) w". ".Jr ** ': h eg _, i cm / U*f,.
- c. /
4 I C"* k p) k. ~ ! 5 g.m. c. / ..c,... \\ -l:=. \\
- ':..~J
' ::: ','.=. 4 G / e.o. s ec. .s g r.g*t 3 } .,uur 4 j...o i. e c. j pa
- .a-
- umo, u co p
'nsu' 7 ~*J'l' *'.'" EC. *"?.'" <.n. .u I C, ma I I i u, p 'c*.*= 8 .n newe,I .e w a,! l..ci.es.
- -.*a.
l p .m >. I I i' L.a A '*'
- D. 4'1 L h' %l
..".u 4 Q.-- .c. cm. c.:.-l Q.-. .c c.w.c.e. { u533 o sw.e . 'I i .l I n* i .l V 1-3 i e a ii. l t I a , w 8',g: . -un i i i L_,_ui. ~. ~ =
- w.. m,
m i l
- g. l i
e ..i e i e ,. _. -. 1 e..._..__._, i sa.==-no 1 'h* l t i i i h6 c= / ,at. cx.,c. sc .r svu..nacw u useev...s o h. I i i i i;ll ," *. t,. I I .h... L./ so . c.=> -.u .. u.... u c um.... \\i,N = / @'.. e l i, . o. u. ar, am. @ L.__ i e i i I o
- .l
,.,,,o.,u.,,...,.. e e.-- -. g ;,_,, _ )I> D.a = Le,., I I I i 1,. i i ., _. ~.. r 1" i-1P P a . en . c. . cr h" 7l gy..m.., i - l "_"ll.".**
- ::l;,.,.'*,,,a_e;
..a., i.!u% ie. :;r,,,,in; *:.a u. m. <7 'W"*"?., m. r.i'Y,.;.it..*" e."2,,f,.'aiP,,',", k"1 lIn:,,c. sif.r.a. "..J ; C"~/d u
- nb c.
l l.::'m i u
- r.. u e..
eu + L l l. v.,,...;.L~. - g f ~.T ....%,,_.r...>r.,,p., -x i. s.: _:
- 1) -...
(,,1 j 6_ e 6 no a a 3ni e ta 6 ,ia a p - ~ ~ - - -
l I:>ItsLI:1r o LGS FSAR , -O OUESTION 421.29 (Section 7.2) i Section 7.2.2.1.1.1.9 indicates that the condensing chambers and all essential components of the control and electrical equipment l are either similar to those that have been qualified by tests for other facilities or additional qualification tests have been j conducted. The FSAR also indicates special precautions are taken to ensure the operability of the condensing chambers and the inboard MSIV position switches for a reactor coolant boundary pressure (RCPB) break, inside the drywell. Confirm that the condensing chambers and MSIV position switches are included in the environmental qualification program. Discuss the differences between the qualified control and electrical equipment which are similar to those used in your design and the additional tests that have been conducted. In addition, provide the details of 4 the precautions taken to ensure the operability of condensing chambers and the MSIV position switches. l
RESPONSE
i The MSIV posf* ion switches have been included in the environmental teos program applied to other safety related instrumentation and control devices located in the drywell in accordance with IEEE 323-1974 and Regulatory Guide 1.89. The condensing chambers are code vessels controlled by ASME code rather than being subjected to qualification tests which are applied to electrical equipment. While they are not included in i i the same qualification program as the position switches, they will be seismically qualified. 3 i The precautions taken to ensure operability of condensing ) chambers during a LOCA event are as follows: The condensing i j chambers on the reactor vessel are physically separated by i dispersing them around the periphery of the vessel at four different azimuths. The routing of the lines from the condensing j chambers is such as to avoid convergence where there would be a i potential for common damage as a result of a LOCA. The slopes of t the instrument lines from the condensing chambers to the drywell penetrations are kept to a minimum consistent with adequate i venting of noncondensibles and air back into the chamber so that the vertical elevation difference within the drywell is kept to a 4 practical minimum. In addition, the condensing chambers are connected to the vessel with a pipe sized to allow ample cross section for condensate drainback and free exchange of steam and noncondensibles between the vessel and the condensing chamber, to prevent any possibility of condensate binding or excessive (]) noncondensible buildup that could prevent adequate condensing of steam to keep the reference leg filled. l 421.29-1
DRAFT LGS FSAR () The MSIV position switches are not required to initiate a scram on an RCPB break within the drywell. Therefore, they are not required to be protected from damages that might result therefrom. Drywell high pressure provides the scram signal for this condition, obviating the need for MSIV " closure scram". 3 Therefore, no special precautions are required to ensure operability of the MSIV position switches during an RCPB break 4 j inside the drywell. However the following features give a high degree of assurance that they could give a valid signal during an RCPB break if called on:
- 1) distribution of the position switches among the four valves (one on each inboard valve and one on each of the outboard valves), 2) housing each of the switches in a separate cast steel condulet switchbox, 3) qualifying them 1
for the LOCA environment (pressure and temperature and radiation) j and 4) use of fail-safe logic. i The MSIV closure scram logic is three-out-of-four inboard or three-out-of-four outboard valves closed 10% or more to cause scram. The valve position switch circuit is fail-safe in that a broken wire will give a channel trip signal. 1 1 l ) l l 1 1 l 3 4 l l 5 421.29-2
DRAFT LGS FSAR OUESTION 421.30 (Section 7.7) Verify that there is sufficient redundancy in the water level instrumentation to prevent a sensing line failure (i.e., break, blockage or leak) concurrent with a random single electrical failure from defeating an automatic reactor protection or engineered safety feature actuation.
RESPONSE
( Based on comparisons of the Limerick water level instrumentation design and the designs of other BWRs for which it has been demonstrated that there is sufficient redundancy to accommodate the postulated off-design event identified in this question, it is believed that the Limerick design evaluation, which is l underway, will confirm the adequacy of the water level I instrumentation for this plant. The study will be completed in April 1983 and will be reported to ICSB. I r~N LJ ./"; V 421.30-1
DRAFT LGS FSAR ('T \\/ OUESTION 421.31 (Section 7.3) ) Section 7.3.1.1.2.12 of the FSAR indicates that the Primary Containment and Reactor Vessel Isolation Control System (PCRVICS) is capable of operation during unfavorable ambient conditions anticipated during normal operation. Dis uss the capability of the PCRVICS functioning during abnormal and accident conditions such as high energy line breaks.
RESPONSE
The capability of primary containment and reactor vessel isolation control system safety-related electrical equipment to j operate during unfavorable ambient conditions is being evaluated as part of the Limerick Environmental Qualification Program described in the response to Question 421.27. i f O f 421.31-1
DRAFT LGS FSAR () OUESTION 421.32 (Section 7.1, 7.3) Provide a detailed discussion on the methodology used to establish the trip setpoint and allowable value for each Reactor Protection System (RPS) and Engineered Safety Feature (ESF) channel. Include the following information: a) The trip value assumed in the FSAR Chapter 15 analyses. b) The margin between the combined channel error allowance and the total channel error allowance assumed in accident analysis. c) The values assigned to each component of the combined channel i error allowance (e.g., process measurement accuracy, sensor calibration accuracy, sensor drift, sensor environmental allowances, instrument rack drift) the basis for these values, and the methodology used to sum these errors, i d) The degree of comformance to the guidance provided in R.G. 1.105 Positions C.1 thru C.6.
RESPONSE
The following discussion relates to the generic methodology used i for the establishment of BWR protective instrument setpoints for the instrumentation employed in the reactor protection system, isolation actuation systems, emergency core cooling systems, and rod block systems as delineated in the BWR Standard Technical Specifications. The details are also necessarily generic; Limerick's recommended setpoints will not be initially submitted to the NRC until late 1983. Key definitions, the relationships between various limiting values and setpoints, and examples of typical BWR setpoints and bases are provided in the attachment to this response. a) Where a functional unit (parameter) setpoint in the Plant Technical Specifications is directly associated with an j accident or transient described in Chapter 15, the trip value used in the safety analysis is, in general, the analytical limit as defined in the attachment to this response. Not all technical specification parameters have an associated 4 analytical limit; in those instances, a design basis limit is i used. Design basis limit setpoints are usually based on evaluation of operating plant experience and engineering judgment. i b) Recommended Limerick setpoints will, in general, be derived O. from instrumentation performance characteristics that meet or 421.32-1 i .i - - ~ - - -
DRAFT LGS FSAR () exceed the design values specified in appropriate design i documentation. Design values of instrumentation accuracy, calibration accuracy, and drift have been selected so as to conservatively circumscribe expected actual state-of-the-art 4 instrument performance. Because of this, it is likely for many setpoints that there may be an additional margin between the instrumentati.on design basis (akin to " total channel 3 error allowance" assumed in safety analysis) and the edepted l setpoint basis (akin to " combined channel error allowance"). I a c) Design procedures provide three general methods that have been found to be appropriate for the establishment of recommended instrument setpoints and limits in a consistent and repeatable manner. These three methods are (1) computation, (2) engineering judgment, and (3) historical a data. The methods are applied independently; however, portions of the computational method may be incorporated into the other two methods. 4 The design instrumentation requirements involved in the 4 4 computational method are instrumentation accuracy, calibration accuracy, and drift. In general, (using the definitions in Part A of the attachment) the allowable value (tech. spec.) is established so there is a high probability l of providing the trip action (nominal trip setpoint) before () the process variable reaches the analytical limit in the case i where maximum drift has occurred. The nominal trip setpoints and allowable values are also } reviewed and evaluated to ensure that they will not result in an unacceptable level of licensee event reports and i " spurious" reactor scrams or unwarranted system initiations due to normal operational transients. Probabilistic goals are suggested in the design procedure. Revisions to the setpoints, when deemed necessary, are permitted and may be i based on operational data or more rigorous statistical evaluation, or prudent engineering considerations that may extend beyond the conservative design basis. The engineering judgment method is applied, e.g., to the IRM neutron flux scram, because there is no sophisticated basis for differentiating between nominal trip setpoint and the technical specification limit (see attachment). l A number of trip setpoints have noncritical functions or are intended to provide trip actions related to gross changes in I the process variable. These setpoints have been historically established as acceptable for regulatory and operational i j requirements. Their continued recommendation is the third method (historical data) employed. This method is only valid j p where governing conditions are essentially unaltered from i %) I 421.32-2
DRAFT LGS FSAR r' (_) those previously imposed and functional adequacy has been historically demonstrated. Recommended Technical Specification instrument setpoints are formulated by statistical combination of design instrumentation requirements. The values are considered to bound instrument performance with equal to or greater-than 95 percent probability assuming a normal distribution. The j relationships are, in general, in accordance with the ) following equations: i l 1. Tech. Spec = Analytical Limit t / Accuracy 2 + Calibration 2 2. Nominal Trip Setpoint = Tech. Spec Drift. i Further discussion of the relationships between error components and the~ design error allowance is in Part C (Proprietary) of the attachment to this response. Some representative BWR setpoints are tabulated in part D of the attachment; these are typical BWR values, not Limerick specific. d) Regulatory Guide 1.105 was not a design basis for Limerick. () Conformance by pocition number is asscssed as follows: C.1 Margins are allowed for instrument inaccuracy, calibration uncertainties, and instrument drift. C.2 Instruments are chosen to provide the required accuracy and calibration capability. C.3 Instruments are chosen to perform the required functions before they may saturate. C.4 Instruments are chosen and qualified to perform to the design requirements under the design environments. C.5 The margins allowed between nominal trip setpoints and the analytical limits are sufficient to account for instrument drift and errors. C.6 The assumptions used in establishing the setpoint values and margins are documented in the various system design documents. O 421.32-3
LGS FSAR ) (f ATTACHMENT Part A - Definitions 1. safety limit / criteria: Generally the design limit on a process variable that is necessary to reasonably protect the integrity of physical barriers that guard against uncontrolled release of radioactivity. 2. analytical limit (or design basis limit): The value of the sensed process variable prior to which a desired action is to be initiated to prevent the process variable from reaching the associated design safety limit. 3. allowable value (tech. spec): The limit prescribed as a license condition on an important process variable. 4. nominal trip setpoint (tech. spec): The intended calibration point at which a trip action is set to operate. 5. operational limit: An operational value considering limiting normal operating transient experience. 6. maximum (minimum) operatino point: The extreme value of the process variable anticipated during normal steady state () operation. 7. licensee event report (LER): A report which must be filed with the NRC by the utility when a technical specification limit is exceeded. 8. operational transient trip: A trip occurring due to the spectrum of normal operation transients or due to the limiting normal operating transient when no safety constraints are compromised. Part B - Limit Relationships The relationship between the nominal setpoint and the various limiting values is shown on Figure 421.32-1. Starting with the safety limit at the right, the first margin extends to the analytical limit (or design basis limit). This margin accounts for uncertainties in the design analysis but excludes design instrumentation allowances. (Note: Given the i state-of-the-art, it is often not practical to identify and remove all instrument related margins.) The next margin is between the analytical limit and the allowable value of the parametric setpoint, and accounts for identified instrumentation errors and calibration capability. (Note: Design O values of instrumentation accuracy and calibration accuracy are ] l 421.32-4
DRAFT LGS FSAR () specified in design documentation and are normally supported by cumulative field experience derived from similar applications and environmental conditions and test data (see Part C).) The remaining margin which is of interest from a safety standpoint is that shown between the allowable value and the nominal trip setpoint. This margin covers instrument drift that might occur during the established surveillance period. (Note: The determination of design values of instrumentation drift is largely dependent on the specific application as discussed in Part C (Proprietary) and are specified for a period of time equivalent to or greater than the surveillance test interval.) If during the surveillance period an instrument dr'ifts from its setpoint in a nonconservative direction but not beyond the allowable value, instrument performance is still within the requirements of the plant safety analysis. In this case, an LER would not be required. The margin between the nominal trip setpoint and the extreme steady state operating value provides for conservative direction setpoint drift and transient parameter overshoots and instrument " noise" that may be present. This margin functions to minimize unwarranted or spurious system trips. (Note: Design procedures provide extensive guidance for evaluating the impact of nominal trip setpoint value on plant availability.) Part C - Discussion of BWR Design Error Allowances (PROPRIETARY) General Protective instrument setpoints are established to ensure that there is a high probability that protective safety trip functions will occur at values of the measured parameters that are consistent with the plant safety analysis or design basis. Regulatory Guide 1.105 supports this objective of requiring that each setpoint include an identified allowance for the accuracy limit of the instrument, the calibration capability, and the potential drift of the setpoint between calibration checks. Instrument accuracy can be specified and qualified to meet the specification. A calibration margin can be allocated based on generally available state-of-the-art equipment to be used by the operator. -The determination of an adequate allowance for instrument setpoint drift is more complex. Methods of establishing an adequate drift margin have been found to be largely dependent on the specific application. Regardless of the basis for the setpoint drift allowance, however, its adequacy must be demonstrated empirically and consistently in the field. It follows that this essential criterion will be met when successive calibrations show that the setpoint remains within the allowable value. It is clear that, with this condition 421.32-5
DRAFT LGS FSAR G l,/ satisfied,' the precise contributions from factors to the overall s drift is not of prime importance. Instrument Accuracy Instrument accuracy is a specified system design requirement and is usually taken to represent two standard deviations of the accuracy at the trip level of the process variable. The accuracy used in the margin calculations is applicable to the normal plant environmental conditions. Evaluations performed to date indicate that there is considerable conservatism in the design analysis to accommodate the effects of harsh environments, instrument performance and/or harsh environmental conditions can be evaluated based on results of the applicants' equipment environmental qualification program. The design value encompasses all instrumentation devices (sensors, signal conditioning circuitry, and trip units) in the i " loop" value established for a subject trip. The accuracy of a loop (x) is, in general, derived by calculating the square root i of.the sum of the squares of the accuracies of the independent component in each loop as follows: i i X = va2 + b2 + ....n a j O where a, b, and n are device tolerances. The design values may be adjusted based on test data or in-service experience and reverification of consistency with the plant safety analysis. Calibration Accuracy t It is assumed that the plant operator will calibrate the instrumentation with an accuracy equivalent to the instrumentation resolution. This is necessary because specific i data related to the plant operators calibration procedures, I calibration equipment, and calibration equipment maintenance are not available. The instrumentation resolution is normally taken i to represent open standard deviation (ec) of the design instrument calibration at the trip signal of the process variable at the assumed environmental conditions. Device allowances are l generally combined by the SRSS method. Drift The maximum design drift (D) is an amount equal to the instrumentation drift expected during the surveillance test interval. It is based on conservative evaluation of both test 73 data and in-service experience. U 421.32-6 ) t
DRAFT LGS FSAR A (_/- Actual observed drift will differ'from plant to plant due to environmental factors, maintenance procedures, and trip surveillance frequencies. Consequently, as actual drift data is accumulated, the Technical Specification nominal trip setpoint can be adjusted to reflect the instrumentation performance. Methodology used in establishing drift allowances is strongly dependent on the specific application. A good example is afforded by the BWR reactor protection system, which has many instrumented functions that may cause a reactor scram. An examination of these functions with an emphasis on instrument drift demonstrates the individual nature of the issue. The IRM scram function is a backup to the APRM scram outside the "RUN" mode, i.e., in the less than 15% power range. The design basis is essential to provide a monitoring facility that overlaps with the'SRM and APRM systems. This overlap is checked (Tech Specs) during plant startup and shutdown. A nominal scram setpoint of 120/125 is used and applies to all ranges of the instrument as power is increased. An instrument drift (electronics only) of 2/125 is used to monitor electronic performance between successive surveillance checks. (Instrument full scale is 125 divisions). No attempt is made to calibrate the IRMs in terms of a power measurement due to the large variations that result whenever a control rod is moved near to O. the sensor. It follows that the setpoint drift from this source far outweighs any other drift considerations. As stated, electronic drift is checked, and clearly sensor drift is of little concern in this application. The APRMs use the LPRMs as the source sensors. The LPRM sensitivity varies with exposure and these sensors are affected by changing control rod pattern. To offset these effects, the APRMs are calibrated at least weekly against a heat balance. Thus, these major drift effects are satisfactorily accounted for withcut the requirement for evaluation of LPRM sensor drift. As in the case of the IRM3, the APRM electronics are allocated a drift allowance, in this case 2%. The high frequency of calibration of the overall measurement removes any significant concern for drift. ] In the case of main steam line isolation valve closure, a mechanically attached position switch must function within the first 10% of main valve movement towards closure. Examination of the mechanical design shows that drift is virtually impossible. However, a 1% drift allowance is made, which is an allowance for measurement differences when successive surveillance checks are made. No electronics are involved. For the main steam line radiation high scram, no credit is taken for this scram function in the plant safety analysis. The O setpoint for this function is more correctly related to the 421.32-7 )
DRAFT LGS FSAR ) detection of a rapid and significant fission product release from I the fuel to the coolant, such as might result from the postulated f kJ For this accident i; and highly improbable rod drop accident. i The condition, the safety analysis assumes a scram for the APRM. design drift allowance for the main steam line radiation monitors was chosen to ensure that the trip setpoint would remain within the allowable value over the period between surveillance tests. i This allowance is based on field experience over many years with the same measurement application. The turbine stop valve closure scram is derived in most cases from position switches, which are mechanically coupled to follow ~ Because of the mechanical nature of main stop valve movement. 3 rift is not expected, although an allowance is the measurement, provided. No electronics are involved. The turbine control valve fast closure scram is obtained from pressure switches that measure the loss of oil pressure at the main turbine control valve actuator disc dump valves. The design i requirement is that the scram shall be basis (safety analysis) initiated within 20 or 30 milliseconds after main control valve initial movement, depending on product line. The scram obtained l i in this way results in scram initiation in advance of main control valve initial movement. Furthermore, a wide range of the pressure switch setpoint is available from which the scram is O' initiated. Consequently, drift in this setpoint is of little l concern because excessive drift would still allow the scram to l occur before it is actually required. The scram discharge volume - water level high scram is based on measuring water level in the scram discharge volume by means of float switches or analog pressure transmitters. For float i l switches, drift is not applicable due to the mechanical nature of the measurement. The analog transmitters are treated in the same Two way as other water level measurements mentioned below. points relative to this measurement may be noted.
- Firstly, considerable margin exists in the setpoints to be used on account i
is not a of the excess discharge volume available, thus drift significant concern. Secondly, earlier indications are given at lower levels (alarm, followed by rod block) that alert the operator, and this scram function does not have a setpoint that is used in the transient analysis. For reactor vessel steam dome pressure-high, reactor water level and drywell pressure, similar considerations are made with regard to instrument setpoint drift. Many reactor years of operational experience exist for each application in identical situations and environments. This cumulative experience is used to establish overall drift allowances that, in conjunction with appropriate surveillance (calibration) intervals, ensure that allowable {]) setpoint values are not violated. 421.32-8 l
DRAFT LGS FSAR_ O rart o - Representative Setpoints A representative group of typical BWR setpoints and instrumentation allowances is summarized in Table 412.32-1. The paragraphs that follow the table are typical " bases" statements for the selected setpoints. e O O 421.32-9
DRAFT LGS FSAR () TABLE 412.32-1 4 SELECTED INSTRUMENTATION SETPOINTS AND ALLOWANCES Analytic or i Design Drift Functional Trip Allowable Basis Allowance Unit Setpoint Value _ Limit Accuracy Calib 18 Mo. } Reactor Protection System Reactor Vessel Dome Pressure - 1037 1057 1071 12.0 psi 6.0 20 psi i High psig psig psig psi Reactor Vessel Water Level - Low -129.0" -036.0 -149" 12.0" 4.0" 7.0" MSL 30 x 3.6 x DB 20% 20% 20% Radiation - full full High power power bkgr. bkgr. j IRM i Neutron Flux 1 { High 120 Div. 122 Div. DB 41 Div. Div. 2 Div. j Isolation Actuation System HPCI System j Supply l Press. - 104 90 DB 4.0 psi 4.0 8.0 psi Low psig psig psi i i Main Steam Line + l Tunnel-High Temp 421.32-10
DRAFT LGS FSAR ) Reactor Vessel Steam Dome Pressure - High Referring to Table 412.32-1, the indicated allowance for accuracy is that of the sensor as established by the purchase specification. The calibration capability shown is compatible with the instrument accuracy and resolution. The design drift allowance has been chosen to enable the effective trip setpoint to remain within the allowable value over the period between surveillance (calibration) tests, and is based on cumulative field experience derived from virtually identical applications and enviconmental conditions. Again referring to the table, the differential between the allowable value and the analytical limit is obtained as the square root of the sum of the squares of the sensor accuracy and overall calibration capability. The differential between the trip setpoint and the allowable value is equa) to the design drift allowance. Reactor Vessel Water Level - Low The determination of values for accuracy, calibration and drift relative to this function is made in a similar manner to that described for the reactor vessel steam dome pressure - high. Main Steam Line Radiation - High () Referring to Table 412.32-1, the indicated allowance for accuracy relates to that of the entire measurement channel as established by the design / purchase specification. The calibration capability shown is compatible with the instrument accuracy and resolution. The design drift allowance has been chosen to enable the effective trip setpoint to remain within the allowable value over the period between surveillance (calibration) tests, and is based on field experience with the same measurement over many years. The plant safety analysis does not rely on this measurement, consequently an analytic limit is not defined. The choice of actual setpoint for this parameter is more correctly related to the detection of a rapid and significant increase in fission product release from fuel to the coolant, such as might result from the postulated control rod drop accident. The current setpoint value has resulted from several changes based on operating experience to date. For the rod drop accident, the plant safety analysis considers reactor scram to occur from the APRM neutron flux measurement. The main steam line radiation instrumentation provides the signal for main steam line isolation valve closure. Intermediate Range Monitor, Neutron Flux - High Referring to Table 412.32-1, the indicated accuracy is that of the electronic channel alone and reflects a value that has /~T consistently been shown to be adequate for this function. \\_/ Specific overall accuracy and calibration capability is not 421.32-11
DRAFT LGS FSAR A\\J required for this measurement because the design basis calls only for overlap of the IRM ranges with those of the SRM and APRM functions. The IRM scram is a backup only to the APRM in the low power (<15%) range. The design instrument drift allowance has been chosen to enable the trip setpoint to remain within the allowable value over the period between calibration tests of the instrument electronics alone, and is based on cumulative field experience derived from similar applications and environmental conditions. 4 HPCI Steam Suoply Pressure - Low Referring to Table 412.32-1, the indicated values for accuracy, calibration and drift are determined in an identical manner to that described for the reactor vessel steam dome pressure - high of the reactor protection system. However, in this case the application of these instruments does not require reference to an analytic limit, particularly in view of the larger error margins available. This is evident from Table 412.32-1 where the differential between the trip setpoint and the allowable value significantly exceeds the design drift allowance. It follows that these instruments can have setpoints allocated largely on the basis of extensive operating experience. {} HPCI Steam Line Tunnel - High Temperature Referring to Table 412.32-1, the indicated allowance for accuracy relates to the bi-metal switch employed in this application and 3 is based on the purchase specification requirement. The calibration allowance is compatible with the switch accuracy and is also based on the use of a standard thermocouple that is calibrated each time before use in calibrating the switches. The design drift allowance is based on operating plant data from identical applications of this switch under closely comparable environmental conditions. The design drift allcwance determines the differential between the trip setpoint and the allowable value. The allowance for accuracy and calibration is taken as i the SRSS of these values and is used to establish the differential between the allowable value and the analytic limit. i i I 421.32-12
l 1 O O O l i SETPOINT/ LIMITS MOP OL AV AL SL M AX OPE R ATING OPERATIONAL TRIP SETPOINT ALLOW AB LE ANALYTICAL SAFETY POINT LIMIT (TECH SPE C) VALUE. LIMIT LIMIT / CRITERIA (TECH SPEC) OPER A. PROCESS SAFETY MARGINS FOR + TIONAL 9 AVAILABILITY
- NON-LER R ANGE ++ READOUT +4-ANALYSIS +
TRANSIENTS ACCURACY TRANSIENTS F ACTORS DETERMINING MARGINS: A. PE RTURB ATIONS A. SENSOR AND SIGN AL A.SFNEOR AND SIGNAL A. SENSOR AND A. LIMITING DURING PLANT CONDITIONING DRIFTS CONDITIONING DRIFTS COMPONENT TR ANSIE NT M ANEUV E RS. BETWEEN SURVEILLANCE BETWEEN SURVEILLANCE ACCURACY. R. CONSIU ER B. PROCESS NOISE. ICAllBR ATION) TESTS. (CAllBR ATION) TESTS. INSTRUMENT C. CONSIDER INSTRU-TIME RESPONSE. i MENT TIME RESPONSE. C. ALLOWANCE FOR CALCULA. TION AL MODEL UNCERT AIN TIES. D. SENSOR AND -n 5 COMPONENT d CAllBRATION C y 2 3 C CAPABILITY, m z g CA Z m U Tm f* 2 I 1 m -4 m Q ) U OT $h
- 2 dd
> *" "2 1 z>$ om G55 79 zm m1 roo DO m m J m-x 4 -4 I $5 M i I i I 1
DRAFT LGS FSAR I%/ OUESTION 421.33 (Section 7.1 and 7.6) Section 7.1.2.5.5 and 7.1.2.5.11 of the FSAR provide conflicting information in relation to oypass and inoperable status indication. Discuss in detEil the design of the bypassed and inoperable status indication using detailed schematics. Include the following information in the discussion: 1. Compliance with the recommendations of R. G. 1.47 and R. G. 1.22 Position D.3a and 3b, 2. The design philosophy used in the selection of equipment / systems to be monitored, including auxiliary and support systems, 3. How the design of the bypass and inoperable status indication systems comply with positions B1 through B6 of ICSB Branch Technical Position No. 21, and 4. The list of system automatic and manual bypasses within the BOP and NSSS scope of supply as it pertains wo the recommendations of R. G. 1.47. (~) 5. Include details relating to the general information provided in Section 7.2.2.1.2.3.1.14 of the FSAR during the discussion.
RESPONSE
The design of the bypassed and inoperable status indication is described below, a. Compliance to Regulatory Guide 1.47 is discussed in revised Section 7.1.2.5.11 and in the analysis sections of the systems to which Regulatory Guide 1.47 is applicable (listed below). D.3a The indications of system inoperability provided under the guidelines of Regulatory Guide 1.47 are used by the operator to prevent, through administrative procedures, the bypassing of a redundant channel of a protection system. The conditions that render the system inoperable during test are annunciated. The conditions that automatically bring up the out-of-service alarm are identifiable to the operator in the control room by means of the out-of-service status light. k_) 421.33-1
DRAFT LGS FSAR rN V D.3b A manual out-of-service _ switch is provided to annunciate any bypass condition that does not automatically energize the system out-of-service annunciator. A single status light indicates that the annunciator has been manually actuated. Individual indication for each manually-induced inoperability is not provided. b. In accordance with the requirements of Regulatory Guide 1.47, bypassed and inoperable status indication has been provided for all plant protection. systems. These systems are listed below. Also listed are the conditions that cause annunciation of system inoperability. All auxiliary and supporting systems to protection systems are monitored as part of the protection system availability in accordance with Regulatory Guide 1.47. The inoperability of these support systems causes the actuation of the out-of-service annunciator for the protection system that these systems support. A status light is provided to indicate that the inoperability of the support system is the cause of inoperability of the protection system. O~ Equipment monitored within a protection system is that equipment which, when bypassed or removed from service, will cause inoperability of a redundant portion of the protection system. Bypass or removal of equipment will I automatically initiate the system level out-of-service annunciator and illuminate a status light on the system control panel indicating the cause of the out-of-service condition. i Equipment that is bypassed or removed from service not more than once per year is not monitored. A manual out-of-service switch is provided for this equipment and for other equipment that cannot be monitored. c. Conformance to BTP ICSB 21 is discussed below, by position: B1. Individual indicator lights are arranged together on a control room panel to indicate what function of the system is out of service, bypassed, or otherwise inoperable. All bypass and inoperability indicators both at a system level and component level are grouped only with items that will prevent l a system from operating if needed. () B2. Limerick has only one control room. When a protective function of a shared system is bypassed, 421.33-2 ~
DRAFT LGS FSAR O it is annunciated on the annunciator panel for the shared system, and status indication for the system is provided on the control panel for the shared system. B3. As a result of design, preoperational testing, and startup testing, no erroneous bypass indication is anticipated. Capability for cancelling bypass indications is not provided. B4. These indication provisions serve to supplement-administrative controls and to aid the operator in assessing the availability of compocent and system level protective actions. This indication does not perform a safety function. B5. All circuits are electrically independent of the plant safety systems to prevent the possibility of adverse effects. B6. The out-of-service annunciators can be tested by depressing the annunciator test switches on the control room benchboards. Each status indicating light can be tested by depressing the light () assembly. d. The system automatic and manual bypasses are listed below. 1. Pump breaker control power V/V 2. Pump breaker not connected 3. Pump breaker tripped 4. Loss of power relay logic 5. Loss of power control valve 6. System in test 7. Trip unit in calibration or failure 8. Loss of power trip unit or out of file. 9. Manual out of service 10. Loss of HVAC 11. Critical valve not in correct position 0 12. Transfer switch out of position 421.33-3
DtAFT LGS FSAR (& V 13. Emer D/G not ready to start 14. Loss of control power 15. System isolation signal 16. Turbine trip 17. Pump overload trip For the specific alarms that are associated with a system, refer to the' functional control diagram for that system as listed in Chapter 7 figures and to the schematics E-648 as listed in Table 1.7-1. Systems monitored in accordance with Regulatory Guide 1.47 are as follows: FSAR Fiaure 1. Reactor Protection System 7.2-1 2. Emergency Core Cooling System 7.3-7 & 7.3-9 3. Primary Containment & Reactor-Vessel () Isolation Control System 7.3-8 4. Main Steam Isolation Valve-Leakage Control System 7.3-8 5, Residual Heat Removal System - Containment Spray Mode 7.3-10 6. Residual Heat. Removal System - Suppression Pool Cooling System 7.3-10 7. Combustible Gas Control System 7.3-8 8. Reactor Core Isolation Cooling 7.4-1 9. Residual Heat Removal System - Shutdown Cooling Mode 7.3-10
- 10. High Pressure-Low Pressure System Interlocks 7.3-10
- 11. Leak Detection System 7.3-8
- 12. Neutron Monitoring System 7.6-1
- 13. Containment Instrument Gas System /
Automatic Depressurization System 7.3-8 e. Details of the administrative procedures that control access as a means for bypassing are contained in Section 7.2.2.1.1.1.8. 421.33-4
p_)1 O Iv = =.. s d a i W /. 5 5, i s f f '\\ DRAFT 1 - = ^ = i 1 TABLE 1.7-1 (Cont'd) (Page 14 of 27) gltAWIpG NUM333 TITLE 33Y DATE '? E-591, sh 5-7 Schematic Diagram Diesel-Generator control & Auxiliaries - 18 2 Units 1 8-21-81 E-648, Sh 1 Schematic Diagram safety Sys Bypass /Inop Status Indication Circuits - 18 2 Units 4 12-23-82 1 j E-648, Sh 2 Schematic Diagram Safety Sys Bypses/Inop status indication Circuits - 1 & 2 Units 3 12-23-82 8 i E-648, Sh 3 Schematic Diagram Safety Sye Bypass /Inop Status Indication Circuits - 1 & 2 Units 5 2-9-83 l l; E-649, sh 1 Schematic Diagram Saf ety System Annunciator Auxiliary Relay Circuits - 1 & 2 Units. 15 6-23-82 ? f E-649, Sh 2 Schematic Diagram Safety System Annunciator Auxiliary Relay Circuits - 1 6 2 Units 6 6-23-82 t j E-649, Sh 3 Schematic Diamram Safety System Annunciator Auxiliary Relay Circuits - 1 & 2 Units 5 6-23-82 4 j E-649, Sh 4 Schematic Diagram Safety System Annunciator Auxiliary Relay Circuits - 1 & 2 Units 3 6-23-82 1 E-649, Sh 5 Schematic Diagrael Safety System Annunciator Aur111ary Relay Circuits - 1 S 2 Units 2 11-21-80 E-649, Sh 6 Schematic Diagram Cafety System Annunciator Auxiliary Relay Circuits - 18 2 Units 4 6-23-82 E-649, Sh 7 Schematic Diagram Safety System Annunciator Auxillery Relay Circuits - 1 & 2 Units 4 6-::3-82 E-649, Sh 8 Schematic Diagram Safety System Annunciator Auxiliary Relay Circuits - 18 2 Units 3 6-23-82 }f E-649, Sh 9 Schematic Diagram safety System Annunciator Auxiliary Relay Circuits - 1 8 2 Unita 2 6-23-82 E-64 9, Sh 10 Schematic Diagram Safety System Annunciator Auxiliary Relay Circuits - 1 & 2 Unite 3 6-23-82 E-686, Sh 1 Schematic Diagram BVAC Miscellaneous Safeguard Instrumentation - 1 & 2 Units & Conson 10 11-9-81 E-686, Sh 2 Schematic Diagram HVAC Miscellaneous Safeguard Instrumentation - 18 2 Units & Common 7 11-9-81 i E-686, Sh 3 Schematic Diagram BVAC Miscellaneous Saf >puard Instrumentation - 1 8 2 Units & Cr==<=> 7 7-2-82 r E-686, Sh 4 Schematic Diagras BVAC Miscellaneous safeguard Instrumentation - 1 & 2 Units & Common 6 11-9-82 } E-686, Sh 5 Schematic Diagram HVAC Miscellaneous Satequard Instrumentation - 1 S 2 Unite S Common 8 11-9-81 E-686, Sh E ScMaatic Diagram RVAC Miscellemeous Safeguard Instrumentation - 1 & 2 Units & Common ,2 11-9-81 i i E-686, Sh 7 schematic Diagram RVAC Misa11aneous safeguard Instrumentation-- 1 & 2 Units & Common 6 11-9-31 E-686, Sh 8 schematic Diagram RVAC Miscellaneous Safeguard Instrumentation - 18 2 %its & Common 6 11-9-81 E-686, Sh 9 Schematic Diagram HVAC Miscellaneous Safeguard Instrumentation - 1 & 2 Units & Common 7 11-9-81 i E-686, Sh 10 Schematic Diagram MVAC Miscellaneous Safeguard Instrumentation - 1 & 2 Units S Common 6 11-9-81 _..t
- O O
a.n O ~~ 3 1 DRAFT w.E,EA. TABLE 1.7-1 (Cont'd) (Page 16 of 27) i ) DeAWING Nun 3Ep TITLE gy Q&13 h + F i E-1036 Electrical Details Spray Pond Pump structure 5 5-13-82 ,' E-1055 Lighting cable spreading acco Unit I s 2 Above El. 254'-0* 2 1-29-82 E-1056, Sh 1 Lighting cable Spreading Roon Unit 1 6 ' 2 Above E1. 254'-0* 5 11-4-81 j N E-1056, Sh 2 Light.ing cable Spreading Roon Unit 1 & 2 Above E1. 2548-0* 5 11-4-81 { E-1060 Lighting peactor Enclosure - Unit 1 Above El. 177*-0* 8 5-3-77 [ ) E-1061 Lighting Reactor Enclosure - Unit 1 Above E1. 201'-0' f 1-27-82 1 l E-1062 Lighting seactor Enclosure - Unit 1 Above E1. 2178-0* 9 2-6-78 9 E-1043 Lighting Beactor Enclosure - Unit 1 Above El. 2538-0* 12 7-21-81 j l E-1064 Lighting Beactor Enclosure - Unit 1 Above El. 283a.0" 6 2-19-82 h E-1065 Lighting Beactor Diclosure - Unit 1 Above El. 313e.0* 9 10-8-81 1 E-1066 Lighting Beactor Enclosure - Unit 1 Above El 3528-0* 8 11-24-80 i 1 E-1067 Lighting Diesel-Generator Baalosure Unit 1 J@ove E1. 217e.08 6
- 5-26-82 j
E-1075 Lighting Control Rocus Above El. 2698-0* 12 7-10-82 f 4 E-1076 Lighting Aus111ary Equipment Room Above El. 289'-08 8 7-10-82 f E-1080 Lighting Beactor Enclosure Unit 2 Above 51, 1778-0* 4 10-10-77 I E-1081 Lighting Reactor End:Losure Unit 2 Above Elp 201e-08 4 12-17-76 g E-1082 Lighting anactor Enclosure Unit 2 Above E1. 2178-0* 5 7-27-77 l E-1083 Lighting heactor Enclosure Unit 2 Above 51. 253'-0* 5 10-12-77 k E-1084 Lighting Beactor Enclosure Unit 2 Above' El. 2838-0* 3 11-21-77 f 'o 1 E-1085 Lighting Reactor Enclosure Unit 2 Above El. 313s-0* 8 3318-Os 6 1-26-79 i ? E-1086 Lighting anactor Enclosure Unit 2 Above El 352'-0* 7 11-26-80 7 t E-1087 Lighting Diesel-Generator Enclosure Unit 2,Above E1. 217e.0* 6 3-17-81 1 E-112 Raceway Layout - Turbine Enclosure - Unit 1 Columns a-H & 5-12 (Area 1) 25 2398-08 24 6/18/82 I { \\ F E-1121 Raceway Layout - Turbine Enclosure - Unit 1 Columna B-M $ 5-12 (Area 13 El. 269'-88 14 , 9/10/82 8 l ,\\ f I. E-1124 Raceway Layout - Turbine Enclosure - Unit 1 Columns N-J & 5-12 (Area 63 E1. 2698-0* 20 7/6/82 i \\ I. i .i e t } +
4'AI. 53 LGS FSAR 6 ..O).. 's 7.1.2.5.8 Conformance to Regulatory Guide i.32-February 1977, . Criteria for Safety-Relat.ed Electric Power Systems for Nuclear Power Plants Refer to Section 8.1.6.1 for a discussion of this guide. ~ 7.1.2.5.9 Conformance to Regulatory Guide 1.40-March 1973, Oualification Tests of Continuous-Duty Motors Installed Inside the Containment of Water-Cooled Nuclear Power Plants There are no continuous-duty motors installed inside the containment that are part of the instrumentation and control systems. 7.1.2.5.10 Conformance to Regulatory Guide 1.45-May 1973, Reactor Coolant Pressure Boundary Leakage Detection Systems i The reactor coolant pressure boundary leakage detection systems are provided to detect and, to the extent practical, identify the location (s) of the source of reactor coolant leakage. t 4 l Conformance to Regulatory Guide 1.45'is discussed in Section 5.2. (') 7.1.2.5.11 Conformance to Regulatory Guide 1.47-May 1973, Bypassed and Inoperable Status Indication for Nuclear Power plant Safety Systems l Equipment monitored within a protection system is that equipment which, when bypassed on removed from service, will cause inoperability of a redundant portion of the protection system. Bypass or remova) of equipment will automatically initiate the system level out-of-service annunciator and illuminate a status light on the system control panel indicating the cause of the out-of-service condition. / I All auxiliary and supporting systems to protection systems are monitored as part of the protection system availability in accordance with Regulatory Guide 1.47. The inoperability of these support systems causes the actuation of the out-of-service annunciator for the protection systems that these systems support. A status light is provided to indicate that the inoperability of the support system is the cause of inoperability of the protection system. The bypats indication system is designed and installed in a manner which precludes the possibility of adverse affects on the plant safety system. The bypass indication system is electrically isolated from the protection circuits so that the failure or bypass of a protective function is not a credible ( consequence of failures in the bypass indication system and the i 7.1-59 l m
tA' /. 3 3 LGS FSAR (~' bypass ir.dication system cannot reduce the independence betwcen j. redundant safety systems. Regulatory Position C.1, C.2, and C.3: Aut.omatic indication is provided in the main control room to inform the operator that a system is inoperable. Annunciation is provided to indicate that a system or part of a system is not operable. Individual lights indicate what part of the system is out of service. Manual actuation is provided to cover situations j which cannot be automatically annunciated. For example, the l reactor protection (trip) system, and the containment and reactor vessel-isolation system have annunciators lighting and sounding 1 whenever one or more channels of an input variable are bypassed. j Bypassing is not allowed in the trip logic or actuation logic. Instruments which form part of a one-out-of-two twice logic i system can be removed from service for calibration. Removal of i the instrument from service is indicated in the main control room j by manual actuation of the system out-of-service annunciator. Regulatory Position C.4: 1 All the annunciators can be tested by depressing the annunciator test switches on the control room benchboards and can be brought O-up by manual switches as discussed in Regulatory Positions C.1, j C.2, and C.3. l The following discussion expands the explanation of conformance to Regulatory Guide 1.47 to reflect the importance of providing t i accurate information for the operator and of reducing the possibility for the indicating equipment to adversely affect its monitored safety system. J Individual indicator lights are arranged together on a a. l control room panel to indicate what function of the system is out of service, bypassed or otherwise inoperable. All bypass and inoperability indicators both at a system level and component level are grouped j only with items that will prevent a system from j cperating if needed. l b. As a result of design, preoperational testing, and startup testing, no erroneous bypass indication is l anticipated. c. These indication provisions serve to supplement administrative controls and aids the operator in } assessing the availability of component and system level protective actions. This indication does not perform a safety function. l J i s 7.1-60 l
=.. 'fA / 3 3 g D2 AFT 'as rs= d. A.ll circuits are electrically independent of the plant safety systems to prevent the possibility of. adverse effects. ~ e. Each indicator is provided with dual lamps and car. be periodically tested. 7.1.2.5.12 Conformance to Regulatory Guide 1.53-June 1973, Application of the Single Failure Criterion co Nuclear Power Plant Protection Systems Limerick is in conformance with this guide which provides that protection systems meet Section 4.2 of IEEE 279-1971, in that any single failure within the protection systems will not prevent proper protective action at the system level when required. Conformance is achieved by specifying, designing, and constructing the engineered safety features to meet the single failure criterion, Section 4.2 of IEEE 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations," and IEEE 379-1972, "IEEE Trial-Use Guide for the Application of the Single-Failure Criterion to Nuclear Power Generating Station Protection Systems." See Sections 7.2, 7.3, 7.4, and 7.6 for a discussion of conformance for each system. A\\# 7.1.2.5.13 Conformance to Regulatory Guide 1.56-July 1978, Maintenance of Water Purity in Boiling Water Reactors The reactor water cleanup system (RWCU) instrumentation is in conformance with Regulatory Guide 1.56. Further discussion is provided in Sections 7.7.2.8.2 and 5.4.8. Conformance of the condensate filter /demineralizer system is discussed in Section 10.4.6. 7.1.2.5.14 Conformance to Regulatory Guide 1.62-October 1973, Manual Initiation of Protection Actions Limerick is in conformance with this guide which provides that manual initiation of each protective action at the system level be provided, that such initiation accomplish all actions performed by automatic initiation, and that protective action at the system level goes to completion once manually initiated. In addition, manual initiation is by switches readily accessible in the control room, and a minimum of equipment should be used in common with automatically initiated protective action. Means are provided for manual initiation of the primary containment and reactor vessel isolation control system, the emergency core cooling systems, and for RPS scram at the system (]) level through the use of armed push buttons, as described below: 7.1-61 l 4 --y,--i----a ,-y --,-y-9-mw,- m-y,----,,m---q wyge-=g--,i---+-wm-t*t+
,w.-y-y-e-ww-r
i 1 DRAFT l LGS FSAR q l ~ OUESTION 421.34 (Section 7.4) Section 7.4.1.1.3.1 and 7.4.1.1.3.2 of the FSAR provide i descriptions of automatic initiation during test and conditions l resulting in system isolation for the Reactor Core Isolation Cooling (RCIC) System. Concerns in these areas have been identified in items 421.38 and 421.40 for the HPCI system. AddreGs the concerns identified in the above referenced items for the RCIC system.
RESPONSE
l The following conditions interfere with normal RCIC operation: a. The RCIC flow controller auto / manual feature in manual mode maintains RCIC flow rate at set value; operator can switch back to auto if required. 1 b. Operator initiation of closure of (ither or both inboard / outboard isolation valves (RCIC out-of-service annunciator sounded in control room) renders RCIC system () inoperable. i c. RCIC test switch in F012 or F013 position and test plug J1 inserted results in RCIC system being inoperable. Depending on whether test switch is in F012 or F013 position, one of the two series discharge valves are interlocked closed, preventing reactor core isolation cooling. RCIC DIV 1 TEST l STATUS alarm light in control room illuminates. Section 7.4.1.1.3.1 has been modified for clarity. The following conditions are RCIC equipment (turbine) protective functions: a. Turbine overspeed trip (mechanical & electrical) (one-out-of-one logic trip) 6. High turbine exhaust pressure trip (one-out-of-two logic trip) c. RCIC turbine excessive moisture protective flow reduction at reactor vessel water level 8 (one-out-of-two-twice logic trip) d. Low pump suction pressure trip (one-out-of-one logic trip) e. RCIC isolation trip (one-out-of-two logic trip) 1. Steam supply line high flow 421.34-1
DRAFT LGS FSAR \\_) c 2. High turbine exhaust pressure 3. High steam piping area temperature 4. Low steam line pressure i Precautions taken to preclude a spurious RCIC **irbine shutdown or system isolation are as follows: 1 1. Use of coincident isolation trip logic circuits. 2. Use of time delay in logic of trip circuits (Reference Question 421.5(f) II.K.3.15) 3. Use of reliable, qualified instrumentation and control components. l 4. Use of trip settings far enough from normal operating valves to reduce Spurious trips, yet protect equipment l from damage. The interlock logic for E41-F011 is as discussed in Question 421.40(c). l The series RCIC test return valve E51-F022 and the HPCI test return to condensate storage valve E41-F011 are closed, unless () opened by the operator for the RCIC flow test. If during flow test a low reactor water level condition occurs, I RCIC initiates and E51-F022 closes. l Also, tu either RCIC pump suction valves E51-F029 or E51-F031 is fully open, RCIC valve E51-F022 and HPCI valve E41-F011 will automatically close. l l l [ l l 421.34-2 l
9'A /. M LGS FSAR g () are capable of individual functional testing during normal plant s-operation.- With the following exceptions, the control system provides automatic return from fest to normal operating mode if system initiation is required: a. The flow controller in manual mode. This feature is required for operation flexibility during system operation. This mode is annunciated by the manual out-of-service alarm, b. Steam inboard / outboard isolation valves closed. Closure of either or both of these valves requires operator action to properly sequence their opening. An alarm sounds when either of these valves leaves the fully open position. c. If the pump discharge valve test plug is inserted and the switch is in the test position for either valve, this condition is annunciated by "RCIC out of service". 7.4.1.1.3.2 RCIC Initiating Circuits Reactor vessel low water level is monitored by four indicating-({) type level sensors that sense the difference between the pressure to a constant reference leg of water and the pressure that is due to the actual height of water in the vessel. The sensing lines for the RCIC sensors are physically separated and tap off the reactor water vessel at widely separated points. The RCIC system is initiated only by low water level using a one-out-of-two twice logic. The RCIC system is initiated automatically after the receipt of a reactor vessel low water level signal and produces the design flow rate within 30 seconds. The system then functions to provide design makeup water flow to the reactor vessel until the amount of water delivered to the reactor vessel is adequate to restore vessel level, at which time the RCIC system automatically shuts down. The system will automatically restart if the level returns to the low level trip point. The controls are arranged to allow remote-manual startup, operation, and shutdown. The RCIC turbine is functionally controlled as shown in Figure 7.4-1. The turbine governor limits the turbine speed and adjusts the turbine steam control valve so that design pump discharge flow rate is obtained. The flow signal used for i automatic control of the turbine is derived from a differential pressure measurement across a flow element in the RCIC system pump discharge line. l 7.4-3 l
4/Al.3'/ LGS FSAR O The turbine is automatically shut down by tripping the turbine trip and throttle va.lve closed if any of the following conditions are detected: a. Turbine overspeed b. High turbine exhaust pressure c. RCIC isolation signal from logic "A" or "C" d. Low pump suction pressure l e. Manual trip actuated by the operator l Turbine overspeed indicates a malfunction of the turbine control mechanism. High turbine exhaust pressure indicates a condition that threatens the physical integrity of the exhaust line. Low pump suction pressure warns that cavitation and lack of cooling can cause damage to the pump that could place it out of service. A turbine trip is initiated for these conditions so that if the causes of the abnormal conditions can be found and corrected, the system can be quickly restored to se vice. The trip settings are selected far enough from normal values so that a spurious turbine 4 trip is unlikely, but not so far that damage occurs before the turbine is shut down. Turbine overspeed is detected by a s). standard turbine overspeed mechanical device and an electrical device on the tachometer. Two pressure sensors are used to detect high turbine exhaust pressure. The logic for either sensor will initiate turbine 4 shutdown. One pressure sensor is also used to detect low RCIC system pump suction pressure. High water level in the reactor vessel indicates that the RCIC system has performed satisfactorily in providing makeup water to 1 the reactor vessel. A further increase in level could damage the RCIC system turbine as a result of gross carryover of moisture. The reactor vessel high water level s(tting that closes the steam supply valve to the turbine is near the top of the steam separators and is sufficient to prevent gross moisture carryover to the turbine. Four level sensors that sense differential pressure are arranged in a one-out-of-two-twice logic configuration. Low steam line pressure in the supply line to the turbine i indicates loss of motive force for the turbine, therefore the isolation valves are closed to shut down the turbine. Pressure sensors are monitoring the reactor vessel pressure []y produced in the supply line to the turbine. Trip conditions ^ 7.4-4 l r
1 DRAFT LGS FSAR g \\_.) OUESTION 421.35 Discuss the methodology and considerations used to determine the setpoint values associated with the various leak detection systems included in Section 7.6 of the FSAR. Discuss details of the manual bypass switch used during testing of the RCIC-LDS and its conformance to the guidance provided in Regulatory Guide 1.47 and the applicability of this response to other LDS in Section 7.6 of the FSAR.
RESPONSE
The general methodology used for setpoint determination for leak detection systems is the computational method discussed in the response to Question 421.32. The considerations used to compute the high flow isolation and the high temperature and high differential temperature are discussed in Section 5.2.5.2.2. The heat balance for the area under consideration for the temperature sensor location is established for normal load, and that area is evaluated for various leak rates. The alarm and isolation 7s setpoints are computed and checked by this method. O The manual bypaso switch bypasses the temperature leak detection signal from the RCIC isolation logic. The RCIC isolation is arranged such that a trip of any one of the temperature switches results in RCIC isolation and RCIC turbine trip. The bypass switch allows testing isolating the RCIC system. Administrative control is provided by a two-position keylock bypass cwitch, with the key removable in the normal position. Separate switches are provided for each of the redundant devisions. Divisional level of bypass is indicated automatically in the control room when the respective divisional switch is placed in bypass position. System level annunciation of "RCIC system out of service" is automatically annunciated in the control room when either of the bypass switches is placed in the bypass position. The RCIC isolation function will still be available from the redundant logic. Manual capability to actuate system level annunciation of "RCIC system out of service" is provided by separate NORMAL-INOP switches for the redundant divisions. Annunciation will occur when either of the divisional switches is placed in the INOP position. The RCIC bypass switch and the RCIC system is in conformance to Regulatory Guide 1.47. The HPC1 leak detection system has a bypass switch that serves the same capacity as the RCIC bypass switch. All of the comments made for the RCIC system are applicable to the HPCI system. The HPCI () system conforms to all of the requirements of Regulatory Guide 1.47. 421.35-1
DPsAFT LGS FSAR (~'y-t- The main steam line leak detection system has no manual bypass switch because the MSIV isolation logic is A.or C and B or D. This permits testing of a single channel without affecting the isolation function or causing inadvertent isolation. Annunciation of " Reactor isolation system out of service inboard" and " Reactor isolation system out of service outboard" is manually provided by individual " NORM-INOP" switches. The RWCU-LDS used no manual bypass switch. Annunciation of RWCU isolation system out service is by manual switches. The logic i used results in isolation if the flow sensor or if any of the temperature sensors trip. Testing can cause isolation of the RWCU system. This does not present a problem because isolation of the RWCU system does not prevent any safety function. l O l { i l l l O 421.35-2 l
DRAFT LGS FSAR g V OUESTION 421.37 (Section 7.2) Section 7.2.2.1'.2.3.1.5 of the FSAR states that the turbine stop valve closure trip and the turbine control valve closure trip are not guaranteed to function during an SSE event. The NRC staff recognizes that full conformance to IEEE 279 and associated standards is not possible in those plants where the turbine building is not a seismic Category I structure. The acceptability of these limitations is subject to the implementation of a system which is as reliable as reasonably achievable. To assure adequate reliability, verify that the design up to the trip solenoids conforms to those sections of IEEE 279 concerning single failure (Section 4.2), Quality (Section 4.3), Channel Integrity (Section 4.5 excluding seismic), Channel Independence (Section 4 6), and Testability (Section 4.10). Further: a. Verify that the design includes a highly reliable power source which. assures availability of the system. b. Using detailed drawing, describe the routing and (_s) separation for this trip circuitry from the sensor in the turbine building to the final actuation in the reactor trip system (RTS). c. Discuss how the routine within the non-seismically qualified turbine building is such that the effects of credible faults or failures in this area on these circuits will not challenge the reactor trip system and thus degrade the RPS performance. This should include a discussion of isolation devices. d. Section 7.2.2.1.2.3.1.19 of the FSAR indicates that the position indicator lights for the turbine stop valves are not part of the RPS. Provide details of the design interface areas using appropriate drawings and basis to assure conformance to IEEE 279-1971, Section 4.20. e. Provide justification for the exception taken in Section 7.2.2.1.2.3.9 of the FSAR to IEEE 384-1974 and Regulatory Guide 1.75 for the turbine stop valve and control valve fast closure trips. j f. Identify any other sensors or circuits used to provide input signals to the protection system or perform a function required for safety which are located or routed through non-seismically qualified structures. This (]) should include sensors or circuits providing input for 4 reactor trip, emergency safeguards equipment such as 421.37-1
DRAFT LGS FSAR 7U safety-grade interlocks. Discuss the degree of conformance to IEEE 279 and associated standards. 1
RESPONSE
The design of the RPS using the turbine stop valve closure and turbine control valve closure trips conforms to IEEE 279 excluding the seismic requirements in section 4.5. a. The design of the RPS uses a highly reliable power supply, UPS, as described in Section 7.2.1.1.3 and shown in Drawing E-32 which is listed in Table 1.7-1. b. The cables for the turbine stop valves and fast closure valves are run in protective conduit from the sensor to the seismic Category I qualified auxiliary equipment room. Each channel is run in its own conduit which provides the required separation. Starting at the sensor is a flexible metallic conduit section which is connected to a rigid steel conduit section leading to the flooring. The cables are routed in PVC conduit embedded in the floor from the turbine enclosure to the (-) auxiliary equipment room, wnich contains the reactor trip system. Drawings showing the cable routing, listed below have been added to Table 1.7-1: E-1112 E-1121 E-1124 E-1125 E-1183 The applicable sensors shown on E-1112 are: 2S01-104A thru D PS01-102A thru D c. The routing of the four cables, each in its own separate run, to the trip sensors in the turbine enclosure for the turbine stop valve and turbine valve fast closure trips is such that the only credible failures that will challenge the system are: 1) a safe shutdown earthquake (SSE), 2) a turbine missile, and 3) a high energy line break (HELB). The expected failure mode caused by these events would be loss of the sensors due to opening or loss of continuity, which would result in a reactor () trip. 421.37-2 1 = - -, -.,.,
DRAFT LGS FSAR 1 'V If the trip sensors failed closed or shorted due to the. fault, the reactor pressure and reactor power trips, which are diverse,- will still function to prevent damage to the reactor. Shorting of a single sensor would not prevent protective action by the other sensors. If a sensor circuit opened, the signal would be a trip from that input. d. A turbine stop valve closure trip will be indicated if an RPS channel is tripped by a two-out-of-four valve closure combination. This information is displaye.d on panel 1AC803 (reactor control annunciator panel) and on the main turbine annunciator panel (1BC807). The closed j position of each turbine stop valve is also indicated in the control room using a position switch independent of those used in the RPS logic and powered.from a separate i electrical power source. I e. The RPS conforms to IEEE 389 except for the requirement that redundant sensors and their connections to the l process syste= be sufficiently separated to ensure that l functional capability of the protection system is maintained despite any single design basis event or resulting effect. The above does not apply to the -s ' (_) turbine stop valve and ccntrol valve fast closure trips in a nonseismic turbine enclosure during or after an SSE, as discussed in Section 7.2.1.2.8. f. Sensors In Non-Seismicallv Oualified structures l PT01-1N052A->D Turbine stop valve bypass Turbine Enclosure l PT01-1NO76A->D MSIV pressure trip input Turbine Enclosure PT01-1NO75A->D Condenser Vacuum Turbine Enclosure TE41-1NOO11A->D Leak Detection Turbine Enclosure TE41-1NO13A->D Leak Detection Turbine Enclosure TE25-115A->D Leak Detection Turbine Enclosure TE25-116A->D Leak Detection Turbine Enclosure i TE25-117A->D Leak Detection Turbine Enclosure TE25-118A->D Leak Detection Turbine Enclosure l TE25-119A->D Leak Detection Turbine Enclosure l l The degree of conformance to IEEE 279 and associated l standards are discuFrad in Section 7.3.2.2 for the leak [ detection system, Se.cion 7.2.2.1.2 for turbine stop valve bypass, Section 7.2.2.1.2 for the MSIV pressure trip, and Section 7.3.2.2 for condenser vacuum. '( ) l 421.37-3
O O m30 DRAFT m,,,, f TABLE 1.7-1 (Con t* 8) (Page 17 of 27) DRAWING NUMBER TITLE Egy g E-1125 Raceway Layout - Turbine Enclosure - Unit 1 Columns N-J S 12-19.2 (Area 7) El. 2698-0" 26 4/22/82 l E-1141, Sh 1 Raceway Layout - 1 Unit J Wall Elevation Looking North Cole. 9-3-23. El. 1628-08 16 6-23-78 217'-0" E-1141. Sh 2 Raceway Layout - 1 Unit J Wall Elevation Inoking North Cols. 9-3-23. E. 162'-0" 20 7-15-82 217'-0" E-1142 Tray Layout - Turbine Enclosure Unit 1 S '2 Columns N-J & 19.2-26 (Area 83 4 8-8-80 Auxiliary Equipment Room Sections E-1143 Tray Layout - Turbine Enclosure Unit 1 & 2 Columns N-J & 24.5-26.6 (Area 88 1 6-28-79 Auxiliary Equipment Room Sections E-1144 Raceway Layout - Turbine Enclosure - 1 & 2 Unita Mh Wall Elevation Looking North 10 6-6-80 Columns 19.2-25.5 El. 217'-0* - 318 e.0" E-1145 Raceway Layout Wrbine Enclosure Elevation Mh Wall Icoking South Columns 12 6-18-82 19.2 to 26.8 El. 2178-0" to 3048-0 I E-1146 Raceway Layout - Turbine Enclosure 1 Unit Sections and Details 6 s-29-82 E-1147 Raceway Layout Turbine !!hclosure 1 & 2 Units Plans of "Mh Wall" from El. 217'-0e 4 12-17-80 to 300'-0" E-1148 Raceway Layout Turbine I!hclosure Sections and Details of "Mh" Wall 3 12-13-79 E-1149, Sh 1 Raceway Layout - Turbine Enclosure 1 Unit Section and Plans of 0J.4 Wall 14 '1-8-82 E-1149, Sh 2 Raceway Layout.- Turbine Enclosure 1 Unit Section and Plans of 19.4 Wall 9 10-29-81 E-1150 Raceway Layout - Reactor Enclosure 1 Unit Columns J-G & 14.1-18.5 (Area 11) Plan 19 7-16-82 El. 1778-0* Slab & Above E-1151 Raceway Layout - Reactor Enclosure 1 Unit Columns J-G & 18.5-23 (Area 128 Plan 't 1 7-16-82 E1. 1778-0" Slab & Above E-1152, Sh 1 Raceway Layout - Reactor Enc-losure 1 Unit Columns G.D. E 14.1-18.5 (Area 15) 27 8-13-82 1 Plan El. 177'-0* Slab & Above l 1 E-1152, Sh 2 Raceway Layout - Reactor Enclosure 1 Unit Columns G.D. S 14.1-18.5 (Area 15) 22 5-24-32 1 Plan El. 177'-0* Slab & Above .l i E-1153 Raceway h yout - Reactor Enclosure 1 Unit Columns G.D. 5 16.5-23 (Area 16) 20 4-15-82 1 Plan El. 177'-08 Slab 8 Above E-1154 Raceway Layout - Reactor Enclosure 1 Unit Columns J-G & 14.1-18.5 (Area 11) 26 7-19-82 { Plan El. 201'-0 8 Slab & Above 1 I
DRAFT LGS FSAR ,9V OUESTION 421.38 ~(Section 7.3) Section 7.3.1.-l.1.1.2 of the FSAR indicates that the HPCI system will automatically initiate, if required, during testing with specific exceptions. Parts of the system that are bypassed or ~ rendered inoperable are indicated in the control room at the system level: In your discussion of. Item 421.22 include details relating to the HPCI system. Specifically discuss the interlock which prevents HPCI injection into the reactor when test plugs are inserted during logic testing (Section 7.3.1.1.1.9).
RESPONSE
The following conditions interfere with HPCI system operation: a) The HPCI flow controller auto / manual feature in the manual mode sets the HPCI system at selected flow rate; the operator can select auto if required. (~N b) Operator initiation of closure of either or both ~ inboard / outboard isolation valves (HPCI out-of-service annunciator sounded in control room) renders the HPCI system inoperable. c) HPCI test switch in F006 or F007 position and test plug J6 inserted results in the HPCI system being inoperable. ~ Depending on whether the test switch is in F006 or F007 position, one of the two series discharge valves are interlocked closed, preventing high pressure core injection. HPCI OUT-OF-SERVICE annunciator sounds in the control room in indicate HPCI in test. Section 7.3.1.1.1.1.2 has been changed for clarity, i i f 4 ( i 421.38-1
s 4'a/,3lif. 1 LGS FSAR p 1 7 -s. k_) i 7.3.1.1.1.1 High-Pressure Coolant Injection (HPCI) System - 4 Instrumentation and Controls 7.3.1.1.1.1.1 HPCI System Identification I When actuated, the HPCI system pumps water from either the 1 condensate storage tank or the suppression pool to the reactor vessel via a core spray line. The HPCI system ir.cludes one turbine-driven pump, one de-motor-driven auxiliary oil pump, one gland seal condenser condensate pump, one gland seal condenser 4 blower, automatic valves, control devices for this equipment, sensors, and logic circuitry. The arrangement of equipment and control devices is shown in Figures 6.3-7 and 6.3-8. These figures identify non-safety-related parts of this system. i 7.3.1.1.1.1.2. HPCI Equipment Design Pressure and level transmitters used in the HPCI system are located on racks in the reactor enclosure and at the condensate storage tank. The only active component for the HPCI system that is located inside the primary containment is the inboard HPCI system turbine steam supply line isolation valve. The rest of !] the HPCI system control and instrumentation components are i (' located outside the primary containment. Cables connect the sensors to control circuitry in the control structure. Although the system is arranged to allow a full flow functional test of the system during normal reactor power operation, the test j controls are arranged so that the system can operate l automatically to fulfill its safety function regardless of the j test being conducted. There are three exceptions: a. Auto / manual initiation on the flow controller. This l J feature is equipped for operator flexibility during system operation. b. Steam inboard / outboard isolation valves. Closure of i either or both of these valves requires operator action to properly sequence their opening. An alarm sounds 1 when either of these valves leaves the fully-open i position. s I c. Other parts of the system that are bypassed or otherwise deliberately rendered inoperable are indicated in the control room at the system level, including the pump . discharge valve test plugs inserted and the switch in j test position for either valve. J ({} 7.3.1.1.1.1.3 HPCI Initiating Circuits ( 7.3-3 l
DRAFT LGS FSAR OUESTION 421.39 (Section 7.3) Figure 7.3-7 of the FSAR indicates that the HPCI system is designed in accordance to IEEE 279-1971 insofar as practical. Identify all exceptions to IEEE 279-1971 and provide justification for each exception.
RESPONSE
Compliance with IEEE 279-1971 for the HPCI system is discussed in Section 2.3.2.1.2.3. The HPCI system does not meet single failure criteria by itself, but in conjunction with the ADS and low pressure system (CS, LPCI), which comprise the ECCS network, does meet the criteria. f i O 421.39-1 1
i D?< AFT LGS FSAR (_) OUESTION 421.40 (Section 7.3) Sections 7.3.1.1.1.1.3 and 7.3.1.1.1.1.7 of the FSAR identify conditions which are monitored and trip the HPCI turbine stop valve and isolate the system if their set points are exceeded. The logic to actuate the trips varies from one-out-of-one to two-out-of two coincidence. Discuss the details of the design, using appropriate drawings, including the following: a. Identify which conditions are considered equipment (turbine) turbine protective functions. b. In addition to your discussion in response to item 421.5(f)II.K.3.15 concerns, discuss the precautions taken in your design to preclude spurious isolation of the HPCI system for the conditions identified in (a) above. c. Discuss design of the interlocks for valve F011 with the suppression pool suction valves for the HPCI and RCIC during testing and automatic realignment on receipt of an initiating signal. Include the automatic re-alignment from the condensate storage tank to the () suppression pool. RESPONSj a. Th* following conditions initiate HPCI turbine protective functions: 1. High turbine exhaust pressure (one-out-of-tw6) 2. Low HPCI pump suction pressure (one-out-of-one) 3. High reactor water level (one-out-of-two-twice) 4. Turbine overspeed signal (one-out-of-one mechanical) 5. HPCI auto-isolation signals (one-out-of-two--see below) HPCI AUTO - ISOLATION SIGNALS Steam Supply Line - High Flow High Turbine Exhaust Diaphragm Pressure e High Steam Piping Area Temperature 421.40-1
DRAFT LGS FSAR ,-U e Low Steam Line Pressure ~ b. Precautions taken to preclude spurious HPCI system turbine isolation are: 1. Using coincident logic isolation trip circuits 2. Using trip time-delay circuits (see response to Question 421.5(f)II.K.3.15) 3. Using reliable, qualified instrumentation and control equipment. 4. Selecting trip settings far enough from normal operating valves to avoid spurious trips, yet close enough to protect equipment. c. The HPCI test return to condensate storage line valve E41-F011 is normally kept closed except during HPCI or RCIC system flow testing. If during testing either a low reactor water level or high drywell pressure condition initiates HPCI system operation, valve E41-F011 and in series test return valve E41-F008 are automatically closed. Upon RCIC initiation, in series (])) test return valve E51-F002 is signalled to close. In addition, if either of the HPCI or RCIC pump suppression pool suction valves E41-F041 or F042 or E51A-F029 or F031 is fully open, HPCI valve E41-F011 is automatically closed. The primary source of water for the HPCI is the condensate storage tank. The HPCI system will realign to suppression pool suction upon receipt of a condensate storage tank low level or suppression pool high level signal. Either of these signals open the HPCI suppression pool suction valves E41-F041 and F042, which in turn sends a signal to close the condensate storage tank suction valve E41-F004 when both are fully open. l h i 421.40-2
DRAFT LGS FSAR N__) OUESTION 421.41 (Section 7.3) Section 7.3.1.1.1.3.7 of the FSAR indicates that the containment Spray (CS) pump motors are provided with over-load and under voltage protection. Discuss the concerns identified in item 421.40 for equipment protective functions which may preclude the 1 operation of a safety-related system when required for these items and any others (equipment or component protection) where automatic (safety signal) and/or manual operation is precluded unless permissive conditions are satisfied.
RESPONSE
The equipment protective functions provided for the core spray pump motor and all other safety-related motors are set to sense only equipment damaging conditons and are set to override any transient condition that may cause a spurious trip. A discussion of the equipment protective functions provided for the safety-related motors and of the design precautions taken to preclude spurious operation of these protective functions (_) follows: a. Equipment Protective Functions Section 8.3.1.1.2.11 discusses the protective functions that are provided for electrical equipment. The section also outlines the setting pickup and time coordination procedures that are used to avoid spurious trips and to ensure selective coordination. As outlined in Section 8.3.1.1.2.11, the core spray and other 4kV pump motors are provided with overload alarm, locked rotor, short circuit, ground fault, and bus undervoltage protective devices. These protective devices are qualified Class 1E and are set to sense definite equipment damaging conditions. b. Precautions Taken To Avoid Spurious Trips The protective devices provided for the safety-related i motors are set in accordance with Section E.3.1.1.2.11 and are consequently insensitive to transients that may cause spurious trips. l c. Safety-Related Motor Operated Valves () All safety-related motor operated valves have overload relays that are sized to detect motor damaging 421.41-1
l DRAFT LGS FSAR l( I overloads. On detection of an overload, the overload relay initiates an alarm in the control room. To ensure the eeailability of safety-related MOVs, the overload tripping circuits are bypassed when the valves are performing automatic safety functions, as discussed in Section 8.3.1.1.2.11f. All safaty-related MOVs and their associated controls l are qualified Class 1E. l i i l O l l () l 421.41-2
D? AFT LGS FSAR g () OUESTION 421.42 (Section 7.3) ~ Section 7.3.1.1.1.2.4 of the FSAR indicates that the ADS can be manually reset after initiation and its delay timers recycled. The operator can delay or prevent subsequent automatic opening of the ADS valves if such delay or prevention is prudent. Discuss details of the' manual reset capability, using appropriate drawing, and include the following: a) The conditions and information which the operator utilizes to exercise the manual over-ride of a subsequent automatic sigr.al, b) Address the concerns identified in item 421.7.
RESPONSE
a) On receipt of an ADS initiation signal, the 105-second delay timers are started; the ADS valves will not open (.) until the timers time out. Before time out, the operator may reset the timers for additional delay by activating the timer reset pushbuttons. The delay in starting the ADS functions allows the high pressure systems sufficient time to arrest the decline of reactor water level and refill the vessel, while allowing enough time for the low pressure systems to come up to rated conditions. Resetting the ADS timers does not change the state of the initiating circu' ts; i t merely extends the time delay before the ADS function takes place or until the initiating condition ceases. The operator's decision to reset the timers should be based on information provided by safety-related displays; i.e., reactor pressure, reactor water level, and water inventory makeup system performance. b. The concerns, identified in item 421.7, are understood to be concerns addressed in IE Bulletin 80-06 regarding () ESF reset controls. 421.42-1 ~ -,____...___,,m ,s.
DRAFT LGS FSAR U In this respect, all actuated (open) ADS air-operated valves will return to their normal (closed) position if L both ADS reset buttons dedicated to valve closure are depressed. If, however, the ADS initiating signal-has not reset or the signal recurs, a subsequent time-delayed ADS trip and valve opening logic sequence will commence. Resetting both ADS divisional reset circuits is an acceptable operating procedure to prevent or limit inadvertent ADS valve actuation. This procedure is considered to be a deliberate operator action and the [ only expedient means to close the ADS valves. l i i l t s_- t I I L i i i. I t O l 421.42-2 1
4 DRAFT LGS FSAR (- OUESTION 421.43 (Section 7.3) Section 7.3.1.1.1.2.9 of the FSAR does not address testing of the ADS solenoid valves. Provide a discussion on method and frequency for integrated testing of these valves and circuits. Identify other engineered safety feature systems where either a portion of the actuation circuitry or the actuated device is not routinely tested with the actuation circuits, and discuss the method and frequency for integrated testing of the circuits and components.
RESPONSE
Integrated testing of the ADS solenoid valves and circuitry is i not performed with the plant operating at power, which is consistent for safety systems where the final actuating device (s) would cause temporary modification of plant processes such as fluid injection or discharge. The technical specifications, Chapter 16, provide for a functional partially integrated test without valve actuation. The transmitter / trip units that provide sensory inputs to the ADS are checked by station personnel. The (~') logic chain up to the solenoid is tested by manually inserting a trip signal and observing the trip logic lights which indicate both continuity of the solenoid circuit and proper trip logic operation. The circuit test is supplemented by a manual one-at-a-time valve test using its associated actuation circuitry from the transmitter trip units with the reactor shut down but with its steam dome pressure equal to or greater than 100 psig. This test interval is approximately 18 months, depending on fuel cycle and length of outage. Other safety systems, such as RPS, portions of PCRVICS, MSIV-LCS, HPCI, CS, RHR/LPCI, RHR/CS mode, RHR/ suppression pool cooling mode, and safety relief valves, have components that are not activated or tested with a complete integrated testing procedure. Each of these systems has a modified test procedure that uses a manual test which allows for independently checking of individual components. This includes verification of flow tests by using the installed return piping such that the motors, pumps and valves are operated, with the associated installed sensors and circuits monitored to verify proper operation. The injection valves are checked independently and separately by manual initiation. The frequency of these tests, parameters verified, and procedures will be included as part of the proposed Technical Specifications. Sections 7.2.1.1.4.8 (RPS), 7.2, and 7.3 provide additional details on testing. 421.43-1
g. h l. ni LGS FSAR \\- 'I OUESTION 421.45 Section 7.3.2.11 of the FSAR indicates'that no active failure can impair the capability of the' Emergency Service Water (ESW) system. to perform its safety-related function. -10CFR-Part 50, Appendix A, indicates in (footnote 2) the definition of single failure 'that "s' ingle failures of passive components in. electrical systems should be assumed in designing against single failures." Discuss the considerations given to passive failures in all safety-related instrumentation and control systems in your facility. Provide assurance that passive failures were included in the FMEA performed in response to the concerns identified in' item 421.44. EESPONSE 4 Section 7.3.2.11 has been changed to show conformance to the single failure requirements. \\./ 421.45-1
e -- DR/%r l. ge ape LGS FSAR- ,s () OUESTTON 421.45 Section 7.3.2.11 of the FSAR indicates that no active failure can . impair-the capability of the Emergency Service Water (ESW) system to perform its safety-related function. 10CFR-Part 50, Appendix A, i'ndicates in (footnote 2) the definition of single failure that " single failures of passive components in electrical systems should be assumed in designing against single failures." Discuss the considerations given to passive failures.in all safety-related instrumentation and control systems in your facility. Provide assurance that passive failures were included in the FMEA performed in response to the concerns identified in item 421.44.
RESPONSE
l Section 7.3.2.11 has been changed to show conformance to the single failure requirements. L 'hi s/ t s l i O 421.45-1 I t
@ /. M DRAFT LGS FSAR 7 b. Residual heat removal service water (RHRSW) 9.2.3 system and support subsystems c. Ultimate heat sink (spray pond) 9.2.6 l d. Standby gas treatment system (SGTS) and support subsystems Emeraency Service Water System The ESW system is designed to supply cooling water to safety-related components, including the diesel-generators, room coolers and chillers, and the RHR pumps during loss of offsite power and accident conditions. Certain nonessential components can be cooled by the ESW system also, at the operator's option. The ESW pumps are located in the spray pond pumphouse with the RHRSW pumps. The spray pond pumphouse is designed as seismic Category I. The ESW system. consists of two redundant loops, each capable of simultaneously providing 100% of the cooling water required by both Units 1 and 2. The system is designed so that no single active or passive electrical or control component failure or active mechanical component failure can prevent it from achieving its safety-related objective. /~T \\# For additional discussion, see Section 9.2.2. RHR Service Water System The RHRSW system is designed to supply cooling water to the RHR heat exchangers during normal shutdown cooling operations as well as during loss of offsite power and accident conditions. The RHRSW pumps are located in the spray pond pumphouse with the ESW pumps. The spray pond pumphouse is designed as seismic Category I. The RHRSWS consists of two redundant loops, each supplying one RHR heat exchanger in each unit and capable of simultaneously providing 100% of the cooling water required by both Units 1 and 2. The system is designed so that no single active or passive component failure can prevent it from achieving its safety-related objective. For additional discussion, see Section 9.2.3. Ultimate Heat Sink (Spray Pond) The spray pond provides the water for both the ESW and the RHRSW r systems. It is the ultimate heat sink for both Units 1 and 2. The return lines from the ESW and the RHRSW system are combined, and the total quantity of water from both these systems is (]) discharged through spray networks, which dissipate the heat. There are two redundant return loops; either one is capable of 3.1-6
9' /. 4 5' 1 A (I AR LGS FSAR actuation circuits to the various loop valving. Bypass indication of the ESW control circuitry is provided in,the main control room. 7.3.2.11.2.1.3 ESW - Regulatory Guide 1.29-1978 - Seismic Design Classification The ESW system complies with this regulatory guide as discussed in Section 3.2. 7.3.2.11.2.1.4 ESW - Regulatory Guide 1.32-1972 - Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants Refer to Section 8.1.6.1. 7.3.2.11.2.1.5 ESW - Regulatory Guide 1.53-1973 - Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems Compliance with NRC Regulatory Guide 1.53-1973 is achieved by specifying, designing, and constructing the ESW system so that it meets the single failure criterion described in Paragraph 4.2 of ,N IEEE 279-1971. The ESW system consists of two loops which have \\_J separate and independent sets of controls and power. Each loop consists of two pumps; all four pumps and controls are assigned to separate divisions. The controls for the ESW valves are assigned to various divisions such that a single active or passive electrical or control failure cannot disable a complete ESW loop. In cases where two valves are in series to shutoff a flowpath, the valves are assigned to two different divisions. Likewise, in cases where two valves are used to provide redundant flow paths in a single loop, the valves are assigned to two different divisions. 7.3.2.11.2.1.6 ESW - Regulatory Guide 1.62-1973 - Manual Initiation of Protection Actions Controls are provided in the main control room to manually initiate the ESW system. 7.3.2.11.2.1.7 ESW - Regulatory Guide 1.97-1977 - Instrumenta-tion to Assess Plant Conditions During and Following an Accident See Section 7.1.2.5.23 for a discussion of the degree of conformance. 7.3.2.11.2.1.8 ESW - Regulatory Guide 1.105-1976 - Instrument (~3 Setpoints. U i 7.3-247 l }
i DRAFT LGS FSAR O OUESTION 421.46 Section 7.6.2.7.2.2.10 of the FSAR indicates that the Safeguard Piping Fill System (SPFS). instrumentation and controls are designed to tolerate a single failure. Address the concerns identified in 421.45.
RESPONSE
Section 7.6.2.7.2.2.10 has been changed to address the concerns of Question 421.45. O I i l k i iO l i 421.46-1 -..-.....-...-.._..-...-..-..,._,..,..-,-..-,.,,,,..--__._,....._-,.-.-...,,n._,
Yle Yb LGS FSAR I( () annunciate an alarm in the control room, and the operator can start the SPFS pumps. The SPFS also provides water to the feedwater lines to maintain a water seal against discharge of containment atmosphere into the reactor enclosure in the event of any line break other than a feedwater line break inside containment. The SPFS is a supporting system to the ECCS. Once the fill system pumps are started, they operate continuously until they are turned off by the operator. The SPFS is designed with redundancy as described in Section 7.6.1.7.5 so that no single active or passive electrical or control failure will prevent the SPFS from meeting its safety-related objective. 7.6.2.7.2 SPFS Specific Regulatory Requirements Conformance 7.6.2.7.2.1 SPFS Conformance to Specific Regulatory Guides 7.6.2.7.2.1.1 SPFS Regulatory Guide 1.22 (1972) Periodic Testing The SPFS pumps can be functionally tested during normal plant operation. The fill-water supply to feedwater line shutoff valves can be opened from the control room to verify operability. (]) 7.6.2.7.2.1.2 SPFS Regulatory Guide 1.29 (1978) - Seismic Classification The SPFS is qualified to seismic Category I criteria, in accordance with IEEE 344. 7.6.2.7.2.1.3 SPFS Regulatory Guide 1.30 (1972) Quality Assurance Requirements for the Installation, Inspection, and Testing of Instrumentation and Electrical Equipment See Section 8.1.6.1. 7.6.2.7.2.1.4 SPFS Regulatory Guide 1.53 (1973) Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems A single failure within the SPFS will not prevent the SPFS from performing its safety function. 7.6.2.7.2.1.5 SPFS Regulatory Guide 1.89 (1974) - Qualification of Class IE Equipment The SPFS is qualified to meet Class IE requirements. O 7.6-116 l ,.---y-,-,___~,.--.._y-, _y--,_ -,__-,,-.-w
qA/. 9't> LGS FSAR () 7.6.2.7.2.2.7 SPFS GDC 20 - Protection System Function The SPFS is manually initiated. 7.6.2.7.2.2.8 SPFS GDC 21 - Protection System Reliability and Testability The components used in the SPFS are selected to ensure high functional reliability. The system can be tested and failures determined during normal plant operation. 7.6.2.7.2.2.9 SPFS GDC 22 - Protection System Independence The two SPFS trains are independent and physically separated with separate instruments to provide assurance that the protective function is not lost. j 7.6.2.7.2.2.10 SPFS GDC 23 - Protection System Failure Modes The system is designed to tolerate a single active or passive electrical or control failure. 7.6.2.7.2.2.11 (SPFS) GDC 29 - Protection Against Anticipated j Operational Occurrences . () The SPFS is designed to remain functional during anticipated 2 operating occurrences. 7.6.2.7.2.3 SPFS Conformance to Industry Codes and Standards 7.6.2.7.2.3.1 SPFS IEEE 279-1971 - Criteria for Protection j Systems for Nuclear Power Generating Stations 1 7.6.2.7.2.3.1.1 SPFS General Functional Requirement 1 IEEE 279-1971 (Paragraph 4.1) The SPFS is manually initiated. It is effective over the full ' range of environmental conditions cited below: a. Power supply voltages. Equipment is designed to operate within the range of voltages specified in Section 8.3.1. b. Power supply frequency. Equipment is designed to operate within the range of power supply frequency specified in Section 8.3.1. c. Temperature. The system is operable at all temperatures that can result from a design basis LOCA. d. Humidity. The system is operable at all humidities, ) including steam, that can result from a LOCA. 7.6-118 l 1 _=
- W, &
LGS FSAR e. Pressure. The system is operable at all pressures resulting from a LOCA. f. Radiation. The system is operable at all radiation levels expected for any design basis LOCA. O. Vibration. The system will tolerate the conditions stated in Section 3.10. h. Malfunction. The system will tolerate any single component failure. l 1. Accidents. The system will operate during and following l any design basis accident. l j. Fire. The system will tolerate raceway fires in a single divisien, k. Explosion. Explosions are not defined in design bases. 1. Missiles. The system will tolerate any single missile i destroying raceway, cabinet, or equipment in one 4 division. l m. Lightning. The system will tolerate lightning damage to
- O one electricai division.
n. Flood. The plant is not subject to flooding as discussed in Section 3.4. o. Earthquake. The system will tolerate conditions stated in Section 3.10. p. Wind and Tornado: All control equipment is located in a seismic Class I structure. See Section 3.3 for wind loadings. I j q. System response times: The system is manually initiated. l r. System accuracies: Accuracies are within those needed j for correct action. i j s. Abnorraal range of sensed variables: No variables are sensed. 7.6.2.7.2.3.1.2.SPFS Single-Failure Criterion IEEE 279-1971 (Paragraph 4.2) A single active or passive electrical or control failure will not i prevent the SPFS from meeting its safety-related objective. O. 7.6-119 l l
'/2/.9'b hf jh(l f LGS FSAR
- ()
i In single failure analysis of electrical systems, no distinction is made between mechanically active or passive components; all j fluid system components, such as valves, are considered electrically active whether or not mechanical action is required. i 6.2.4.4 Tests and Inspections The containment isolation system undergoes periodic testing during reactor operation. The functional capabilities of power operated isolation valves are remotely tested manually from the main control room. By observing position indicators and changes in the affected system operation, the closing ability of a particular isolation valve is demonstrated. A discussion of testing and inspection pertaining to isolation valves is provided in Section 6.2.1.6 and in Chapter 16. Table 6.2-17 lists all isolation valves. (]) Instruments are be periodically tested and inspected. Test j and/or' calibration points are supplied with each instrument. Excess flow check valves (EFCVs) are periodically tested by j opening a test drain valve downstream of the EFCV and verifying proper operation. As these valves are outside the containment and accessible, periodic visual inspection is performed in addition to the operational check. Leak-rate testing for the containment isolation system is discussed in Section 6.2.6. 6.2.5 COMBUSTIBLE GAS CONTROL IN CONTAINMENT Following a postulated LOCA, hydrogen gas may be generated within the primary containment as a result of the following processes: a. Metal-water reaction involving the Zircaloy fuel cladding and the reactor coolant b. Radiolytic decomposition of water in the reactor vessel and the suppression pool (oxygen also evolves in this process) '(:) 6.2-64 ~.- -.
1 LGS FSAR O \\/ OUESTION 421.48- (Section 7.3) From a review of the FSAR it appears that the logic for manual initiation for several engineered safety feature systems is interlocked with permissive logic from various sensors. In some cases it appears that the permissive logic is dependent upon the same sensors as those used for automatic initiation of the system. The satff's position is that the capability to manually initiate each safety system should be independent of permissive logic, sensors, and circuitry used for automatic initiation of that system. (See Section 4.17 of IEEE-279). Identify each Safety System which is interlocked as described above and provide proposed modifications or justification for the existing design.
RESPONSE
a. ECCS The emergency core cooling system (HPCI, ADS, CS and LPCI) as a whole meets IEEE 279 Paragraph 4.17 because each individual subsystem has a provision for its own manual initiation. In addition, no single failure in the manual initiation portion (s-)S of the network of systems will prevent manual or automatic initiation of redundant portions of the network. 1. HPCI The HPCI system is initiated automatically by a LOCA signal (low reactor water level and/or high drywell pressure) or by a system-level remote manual switch. The subsystem can also be initiated by use of an individual remote manual switch for each valve including the turbine driven pump. In all initiation modes, the system is prevented from operating by high water level (Level 8) using one-out-of-two-twice logic. 2. ADS The ADS function is initiated automatically by a LOCA signal (Iow reactor water level and high drywell pressure) or by system-level remote manual switenes. In either mode, the ADS valves are prevented from opening unless either the CS pump, or one of two RHR pumps, is running. In addition, each inidividual ADS valve can be opened manually without restriction from permissive sensors. O 421.48-1
DRAFT LGS FSAR (x 's_) 3. CS (Loop A and Loop B) ~~ The CS (Loop A) system is initiated automatically by a LOCA signal (Iow reactor water level and/or high drywell pressure with low reactor pressure) or by a single system-level remote manual switch. In either mode, normal or standby power must be available on the pump bus. The CS (Loop A) system can be initiated individually by use of individual remote manual switches for each valve and pump. In this mode, the injection valve cannot be opened unless the LOCA signal and reactor low pressure permissives are present. CS Loop B is identical to Loop A. No sensors are shared between the loops. 4. LPCI (Loop A, Looo B, Loop C, Loop D) The LPCI (Loop A) system is initiated automatically by a LOCA signal (low reactor water level and/or high drywell pressure with low reactor pressure) or by a single system-level remote manual switch. In either mode, normal or standby power must be available on the pump motor bus. The LPCI (Loop A) system can also be initiated by use of individual remote manual switches for each valve and pump. The injection valve cannot be (~') opened unless the low differential pressure (across \\~' valve) permissive is present. The LPCI Loop B, C and D are identical to Loop A. No sensors are shared between the loops. b. PCRVICS There are no interlocks involved in manual operation of the PCRVICS. c. MSIV-LCS, Containment Spray Mode (RHR) and Suppression Pool Coolina Mode (RHR) These three systems are manually initiated (no automatic initiation) only. l d. CONCLUSION Of the ESF systems, only the HPCI, ADS, CS, AND LPCI systems of ECCS share permissive logic between automatic and system-level manual initiation logic. The design is acceptable because the individual subsystems of ECCS are not required to meet the single failure criterion. The ECCS function will be l l met with one of its subsystems inoperative. 421.48-2 -y --w
DRAFT LGS FSAR ('") OUESTION 421.49 Section 7.6.1.1.2.4 of the FSAR indicates that if one channel in both A and B trip logic is downscale in the Reactor Enclosure Ventilation Exhaust Radiation Monitoring System (REVE-RMS), system isolation is not possible. It is further indicated that a downscale trip is present during calibration and whenever instrument trouble occurs. Any one downscale trip sounds an alarm in the control room. Discuss the design details implemented to preclude downscale trips in one channel in each logic from occurring simultaneously and required actions and procedures taken if a channel in one or both logics is downscale. ~ Indicate if the details provided in this discussion are applicable to other RMS identified in Section 7.6 of the FSAR. Identify the location of the detectors which provide the inputs for the RMS included in Section 7.6 of the FSAR.
RESPONSE
Design details implemented to preclude downscale trips are: If one channel of the REVE-RMS in both A and B isolation logics is downscale, system isolation is disabled only in the event of s high radiation in the reactor enclosure exhaust. System isolation is still possible in the event of a LOCA, loss of building negative pressure, or manual actuation. Administrative procedures are followed to prevent removal from service of more than one channel at a time. There are no interlocks between the channels. If a channel in each logic is inoperative, the operator will monitor the north stack effluent radiation monitor and manually initiate isolation if a relesse is detected. The trip system of the REVE-RMS is configured identical to the reactor enclosure exhaust monitors; therefore, similar administrative procedures are followed. As described in Section 7.6.1.1.7, the RHRSW monitors are arranged in a one-out-of-one logic configuration, with spray pond i return radiation monitors acting as redundant to the RHR heat j exchanger discharge radiation monitors. Downscale trips from i these monitors do not initiate any safety actions; they are alarmed in the control room. If a monitor trips downscale due to failure or being rendered inoperable, administrative procedures are followed to prevent the other redundant monitor from being removed from service. {} 421.49-1 i
DRAFT LGS FSAR () The MSL-RMS isolation logic is configured such that either an upscale or downscale trip will cause a channel trip. This is also true of the CRV-RMS. The remaining systems described in Section 7.6 are for alarming or monitoring only; none initiate safety actions. The locations of radiation monitoring sensors identified in Section 7.6 are: Monitor Location Main steam line Main steam tunnel Reactor enclosure ventilation exhaust Reactor enc 1soure Refueling floor ventilation l exhaust Reactor enclosure l Control room ventilation Control enclosure Control room emergency fresh air supply Control enclosure Post-LOCA containment Reactor enclosure RHRSW Diesel generator enclosure Standby gas treatment Control enclosure North stack effluent Reactor enclosure roof. All of the above locations are safety-related structures. 421.49-2 l I
DRAFT LGS FSAR O ousSr10N 42i.52 j Section 7.6.1.2.5.3 of the FSAR indicates the HPLPSI setpoints for the RHR and CS systems are included in Tables 7.3-4 and 7.3.3 -respectively. These tables do not include the setpoint requirements for the RHR and CS system HPLPSI. Revise the FSAR 4 tables accordingly.
RESPONSE
Section 7.6.1.2.5.3 has been changed to reference Chapter 16 for setpoint information. 2 i J O 421.52-1 - ~..
%?/.5A DRAFT LoS rS= o'- 7.6.1.2.5.2 HPLPSI Reactor Operator Information The status of each valve providing the high-pressure / low-pressure boundary is indicated in the control room. The state of the reactor pressure and RHR injection valve differential pressure sensors is indicated in the control room. 7.6.1.2.5.3 HPLPSI Setpoints The setpoints for HPLPSI are contained in Chapter 16, Technical l Specifications. 7.6.1.3 Leak Detection System (LDS) - Instrumentation and Controls The LDS consists of the following safety-related subsystems: a. Main steam line leak detection subsystem b. RCIC system leak detection subsystem c. RWCU system leak detection subsystem d. HPCI system leak detection subsystem /^ 7.6.1.3.1 LDS Identification U} This section discusses the instrumentation and controls associated with the safety-related portion of the leak detection system. The non-safety-related portion is described in Section 7.7.1.16. The LDS itself is discussed in Section 5.2.5. The purpose of the leak detection system instrumentation and controls is to detect and provide the signals necessary to isolate leakage from the RCPB before predetermined limits are exceeded. Environmental conditions and qualification for the leak detection system are discussed in Sections 3.10 and 3.11. 7.6.1.3.2 LDS Power Sources Separation requirements are applicable to leak detection signals that are associated with the PCRVICS. Six power sources are used to comply with separation criteria. Equipment associated with Division 1 is powered by 120 V ac instrument bus A and RPS bus A. Division 2 equipment is powered by 120 V ac instrument bus B and RPS bus B. Division 3 equipment is powered by 120 V ac instrument bus C. Division 4 equipment is powered by 120 V ac instrument bus D. () 7.6-21 l
_ - - - - ~. - - %? /. SA. k f- ' _)3 ( TABLE 7.3-4 LOW PRESSURE COOLANT INJECTION - INSTRUMENT SPECIFI, CATIONS LPCI FUNCTION INSTRUMENT RANGE ACCURACY Reactor vessel Level sensor -150/0/+60 e 6 inches low water level inches (2) (LPCI initiation) Drywell high Pressure sensor 0-10 psig 0.05 psi pressure (LPCI initiation) LPCI pump delay Timer 1.5 - 15 sec 1.5 sec (on loss of normal aux power) Injection valve Differential 0-800 psid differential pressure switch pressure Pump minimum Flow sensor 0-2500 gpm 12.5 gpm flow bypass Pump discharge Pressure sensor 0-500 psig t2.5 psi pressure (signal to auto depressurization system) RHR injection line Differential 0-100 psid 0.5 psi l high differential pressure sensor prescure (2) Instrument zero equal to 527.5 inches above vessel zero. O
DRAFT LGS FSAR OUESTION 421.54 (Section 7.7) Figure 7.7-14 of the FSAR which provides details of the RBM circuit is not included. It is indicated the information will be provided later. Discuss the status of your design of the RBM and projected availability of Figure 7.7-14.
RESPONSE
The RBM design is complete; however, the RBM is considered a subsystem of the NMS system and as such has no RBM unique FCD. The RBM is included in the NMS FCD and is shown in Figure 7.6-4. Figure 7.7-14 showing the RBM rod selection combinations has been added. Section 7.7.1.6.2.1 has been changed to reference the appropriate figure. i I = ) O 421.54-1
C/S4 tcS-^" DPsAFT [} 7.7.1.6.1.1.1.1 SRM Bypasses and Interlocks One of the four SRM channels can be bypassed at any one time by a i switch on the operator's control panel. 7.7.1.6.1.1.2 SRM Redundancy and Diversity 1 i SRM channels are not redundant because SRM detectors are } spatially dependent and do not serve as a backup to other i detectors. 7.7.1.6.1.1.3 SRM Testability l Each SRM channel can be fully tested and calibrated using written i procedures. Inspection and testing are performed as required on the SRM detector drive mechanism; the mechanism can be checked I for full insertion and retraction capability.- The various combinations of SRM trips can be introduced to ensure the { operability of the rod blocking functions. I f 7.7.1.6.1.2 SRM Environmental Considerations { The wiring, cables, and connectors located within the drywell are i designed for continuous duty in the conditions described in i Section 3.11. The above SRM system components are designed to i n operate during and after certain design basis events such as jU earthquakes and anticipated operational occurrences. 7.7.1.6.1.3 SRM Operational Considerations The SRM system provides information to the operator. It is j operated by inserting the SRM detectors into the core whenever these channels are needed,.and withdrawing then, when permitted, } to prevent their burnup. 7.7.1.6.2 Rod Block Monitor (RBM) Subsystem l 7.7.1.6.2.1 Equipment Design l 7.7.1.6.2.1.1 RBM Circuit Description I The RBM has two channels (Figure 7.6-4). Each channel uses input l signals from a number of LPRM channels. A trip signal from either RBM channel initiates a rod block. One RBM channel can be l bypassed without loss of subsystem function. The minimum number j of LPRM inputs required for each RBM channel to prevent an i instrument inoperative alarm is four when using four LPRM assemblies, three when using three LPRM assemblies, and two when i using two LPRM assemblies. l } 4 l 7.7-47 l
_. ~..... - _ - - -.. - 9'A/. 59 LGS-FSAR DRAFT zO a. Power Supply r The RBM power is received from the 120 Vac supplies used i for the RPS. RBM channel A receives power from the ac i bus used for RPS trip system A; RBM channel B receives j power from the ac bus used for RPS trip system B. b. Signal Conditioning The RBM signal is generated by averaging a set of LPRM l signals. One RBM channel averages the signals from LPRM detectors at the A and C positions in the assigned LPRM assemblies. The second RBM channel averages the signals from the LPRM detectors at.the B and D positions. Assignment of LPRM assemblies to be used in RBM averaging is controlled by the selection of control rods. Figure 7.7-14 illustrates the four possible assignment combinations. Note that the RBM is ^ automatically bypassed and the output set to zero if a j peripheral rod is selected. If any LPRM detector assigned to an RBM is bypassed, the computed average signal is adjusted automatically to compensate for the number of LPRM input signals. ({} When a control rod is selected, the gain of each RBM channel output is normalized to an assigned APRM channel. This gain setting is held constant during the i movement of that particular control rod to provide an i indication of the change in the relative local power level. If the APRM used to normalize the RBM reading is indicating less than 30% power, the RBM is zeroed and j the RBM outputs are bypassed. If the normalizing APRM is bypassed, the normalizing signal is automatically provided by a second APRM. In the operating range, the RBM signal is accurate to approximately 1% of full scale. 7.7.1.6.2.1.2 RBM Trip Function The RBM supplies a trip signal to the RMCS to inhibit control rod withdrawal. The trip is initiated when RBM output exceeds the rod block setpoint. There are three parallel rod block setpoint lines that have an adjustable slope. These lines provide a setpoint that is a function of the recirculation driving loop i flow. The intercepts of these setpoint lines with the rated flow I are adjustable. The normal settings are approximately 107% for the upper line, 99% for the intermediate line, and 91% for the lower line. Lights indicate which rod block setpoint lines are active. Two percent below'the intermediate and lower rod block ([) setpoint lines are the setup-permissive (and setdown) lines. When the power reaches these lines on increasing power, an 7.7-48 l 1 ..~~_.__,_.-_......m,_
DRMT LGS-FSAR indicator lights up so that the operator can evaluate the () conditions and manually change to the next higher rod block setpoint line; on decreasing power, these lines provide automatic setdown. Either RBM can inhibit control rod withdrawal (Figure 7.6-4). Table 7.7-5 describes the RBM trip functions. 7.7.1.6.2.1.3 RBM Bypasses The operator can bypass one of the two RBMs at any time. 7.7.1.6.2.1.4 RBM Redundancy i The following features are included in RBM design: a. Redundant RBM channels i b. Redundant, separate selection information (including redundant contacts for each rod selection pushbutton) provided directly to each RBM channel c. Separate LPRM amplifier signal information provided to each RBM channel d. Separate recirculation flow inputs provided to each RBM for trip level determination ] (]) e. Redundant APRM reference signals to each RBM channel q f. Redundant RBM level readouts and status displays from i the RBM channels g. Mechanical barrier between Channels A and B of the manual bypass switch i h. Redundant rod block signals from the RBM channels to the RMCS circuitry } 7.7.1.6.2.1.5 RBM Testability The RBM channels are tested and calibrated with written procedures. The RBMs are functionally tested by introducing test signals into the RBM channels. 7.7.1.6.2.2 RBM Operational Considerations When increasing power, the setup permissive lamp lights up, at which time the operator must evaluate conditions before manually changing to the next higher rod block setpoint line. O 7.7-49 l .__m
- __m,
,,,y 7 .--.--.y-. _ _. -.-,-_w-7y.. y-_.- 9-.- ,-__y
4 21.r+ i o DRAFT LPRM METER DISPLAY INPUT GROUPS METER i 0* STACKS 61 I I I I_ _I I I 3g i 2 7 HH HH 1 57 HH 3 4 i 55 s' 1 a 1 51 d> &W 49 M& H& H & 47 ~ 4 I 45, 1 43 HW MW H W k 41 HW ~ ~ l ) ( j 39 l 37 35 _ _k_ 33 HW dW HW d & ~ ~~ ~ ) 29 -- - - 27 25 ~~ d& HW HW RW HW 4 W A W - 23 21' I 19 17 HW HW 4 W MW 2 r, 1 / s [ 35 ' d 4 I l ' 13, t- ' 11 09 HH H& I l \\ J l l 05 r 7 03, [ l 01 I ' 00 02 04 06 08 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 TYPICAL ROD YlELDING FOUR STRING INPUT RG MERME MMM $ TYPICAL ROD YlELDING THREE STRING INPUT UNITS 1 AND 2 FINAL SAFETY ANALYSIS REPORT h TYPldAL ROD YlELDING TWO STRING INPUT $ TYPICAL ROD YlELDING ONE STRING INPUT RBM ROD h LPRM INPUT UPON ROD SELECTION SELECTION COMBINATIONS FIGURE 2.1.2.8 FIGURE 7.714 4 4 t -e-e wr- .y--, ,-,-.wy--me.---,,..,- ,--,---+-,-,---r-,r------.--..ww--,-,--,-------s.--r,--www--.-r,.w-
4'a /.5V LGS FSAR I= () CHAPTER 7 FIGURES (Cont'd) Fioure No. Title 7.7-4 Reactor Manual Control Self-Test Provisions 7.7-5 Eleven-Wire Position Probe 7.7-6 Reactor Recirculation System Functional. Control Diagram 7.7-7 Recirculation Flow Control 7.7-8 Feedwater Control System IED t 7.7-9 Simplified Diagram Turbine Pressure and Speed Load Control Requirements 7.7-10 Traversing Incore Probe Assembly 1 7.7-11 Reactvr Water Cleanup FCD 7.7-12 Area Radiation Monitoring System IED 7.7-13 Functional Block Diagram of SRM Channel 7.7-14 RBM Rod Selection Combinations l l 7.7-15 RBM Response to Control Rod Motion (Chan els A & C) } 7.7-16 RBM Response to Control Rod Motion (Channels j B & D) 1 5 2 ) O 1 7-xxi l t
DRAFT LGS FSAR () OUESTION 421.55 Section 1.12 of the FSAR indicates that the concern of Anticipated Transients without Scram (ATWS) has been resolved by issuance of NUREG-0460, Volume 4. However, no description of the instrumentation or controls are addressed in Chapter 7 of the FSAR relating to the requirements for recirculation pump trip (RPT) for BWRs. Discuss your design andits conformance to NUREG-0460 for the ATWSRPT. Identify all non-safety related. equipment utilized in the design.
RESPONSE
The ATWSRPT design will be provided in May 1983. The conformance will be provided after the ruling is made on NUREG-0460. O l C) 421.55-1 1 1
DRAFT LGS'FSAR ) OUESTION 421.56 ~" Identify any safety systems that are shared by both units. Discuss design criteria for instrumentation.
RESPONSE
The below-listed safety systems and subsystems are shared by both units. Refer to the section listed by each system or subsystem for discussion of design criteria for instrumentation. The instrumentation for these systems is available on common panels ) in the control room and therefore is available to the operator of both units. SHARED SAFETY SYSTEMS SECTION Emergency service water system 7.3.2.11 RHR service water system 7.3.2.12 ,/ RHRSW radiation monitoring subsystem 7.6.1.1 Control structure support systems Habitability, control room isolation subsystem 7.3.2.10 I Emergency switchgear and battery room cooling 7.3.2.15 subsystem I Control enclosure chilled water subsystem 7.3.2.13 Auxiliary equipment room ventilation subsystem 7.3.2.15 Control room vent radiation monitoring subsystem 7.6.1.1 Control room emergency vent radiation monitoring 7.6.1.1 l subsystem Standby gas treatment system 7.3.2.7 SGTS-RMS area coolers subsystem 7.3.2.15 SGTS radiation monitoring subsystem 7.6.1.1 North stack radiation monitoring system 7.6.1.1 (~3 Spray pond pumphouse support system 7.3.2.15 %J 421.56-1
%R/.5~b 5 "S rsa DRAFT ? -() 7.6.2.1.8.2.2 SGTS-RMS Conformance to 10 CFR Part 50, Appendix A, General Design Criteria (GDC) This system is designed to conform to the following criteria of 10 CFR Part 50, Appendix A. 1 7.6.2.1.8.2.2.1 (SGTS-RMS) GDC 1 - Quality Standards and Records A quality assurance program is established for the production of this system. i 7.6.2.1.8.2.2.2 (SGTS-RMS) GDC 2 - Design Basis for Protection Against Natural Phenomena The system is designed and tested to meet seismic Category I l requirements. 7.6.2.1.8.2.2.3 (SGTS-RMS) GDC 3 - Fire Protection Fire resistant components are used throughout the system. 7.6.2.1.8.2.2.4 (SGTS-RMS) GDC 4 - Environmental and Missile Design Basis (]) Redundancy of this system and separation of the two channels provide protection against missiles. i 7.6.2.1.8.2.2.5 (SGTS-RMS) GDC 5 - Sharing of Structures, Systems, and Components l The standby gas treatment radiation monitoring system is shared by both units of the plant. The system is designed to perform its safety function in the event of an accident in one unit and during the orderly shutdown and cooldown of the other unit. 7.6.2.1.8.2.2.6 (SGTS-RMS) GDC 13 - Instrumentation and l Controls i Operating ranges of the instrumentation are compatible with anticipated accident conditions. 7.6.2.1.8.2.2.7 (SGTS-RMS) GDC 21 - Protection System l Reliability and Testability The system is designed for high functional reliability and inservice testability,. 7.6.2.1.8.2.2.8 (SGTS-RMS) GDC 22 - Protection System l Independence O 7.6-76 l
4-4 yRI. 66 DRAFT wS FSan
- O System redundancy and separation of channels provides for protection system independence.
j 7.6.2.1.8.2.2.9 (SGTS-RMS) GDk' 23 - Protection System Failure l j Modes Loss of either channel of this system does not impair its j function. i 7.6.2.1.8.2.2.10 (SGTS-RMS) GDC 24 - Separation of Protection j and Control Systems The two channels are separated in accordance with IEEE 279-1971. 7.6.2.1.8.2.2.11 (SGTS-RMS) GDC 29 - Protection Against l Anticipated Operational Occurrences ] The system is designed to ensure functional reliability in the event of anticipated operational occurrences. 7.6.2.1.8.2.2.12 (SGTS-RMS) GDC 60 - Control of Releases of l Radioactive Materials to the Environment 2 Surveillance of the release of radioactive materials to the i C environment is maintained, but remedial action is initiated by j control room personnel. 7.6.2.1.8.2.2.13 (SGTS-RMS) GDC 64 - Monitoring Radioactive l r Releases j i The requirement for the monitoring of radioactive releases, during and following postulated accidents, is fulfilled. 7.6.2.1.8.2.3 SGTS-RMS Conformance to 10 CFR Part 50, Appendix I i This system provides information needed for restricting the i release of radioactive materials to the environment to limits as low as practicable. ~ 7.6.2.1.8.2.4 SGTS-RMS Conformance to Industry Codes and ] Standards 7.6.2.1.8.2.4.1 IEEE 279-1971 - Criteria for Protection Systems 7.6.2.1.8.2.4.1.1 SGTS-RMS Sinole Failure Criterion (IEEE 279, l Paragraph 4.2) Channel redundancy and independence ensures that a single failure does not result in the loss of this system's output. 2 7.6-77 l 1 . ~.
N /. Ib LGS FSAR [ O 7.s.2.i.e.2.4.i.2 SGTS-RMS ouelity of components ana xoauies (IEEE 279, Paragraph 4.3) A quality assurance program is adhered to in the production of this system. 7.6.2.1.8.2.4.1.3 SGTS-RMS Equipment Qualification (IEEE 279' Paragraph 4.4) The system is qua11fied in accordance with IEEE 323-1974. .1 O O } O 7.6-77a g
l, </a /,5% h* 4 [)f;0Flr LGS FSAR 1 L '.(]) 7.6.2.1.9.2.1.6 NSE-RMS Regulatory Guide 1.100 (1977) - Seismic Oualification of Electrical Equipment 'ee Section 3.10 for a discussion of the degree of conformance. S 7.6.2.1.9.2.1.7 NSE-RMS Regulatory Guide 1.105 (1976) - Instrument Spans and Setpoints See Section 7.1.2.5.25 for a discussion of the degree of conformance. 7.6.2.1.9.2.1.8 NSE-RMS Regulatory Guide 1.118 (1977) - Periodic Testing See Section 7.1.2.5.26 for a discussion of the degree of conformance. 7.6.2.1.9.2.2 NSE-RMS Conformance to 10 CFR Part 50, Appendix A, General Design Criteria (GDC) 7.6.2.1.9.2.2.1 (NSE-RMS) GDC 1 - Quality Standards and Records Although this system is not required to meet IEEE Class IE requirements, a quality assurance program has been established for the production of the wide-range accident monitor. 7.6.2.1.9.2.2.2 (NSE-RMS) GDC 2 - Design Basis for Protection Against Natural Phenomena The wide-range accident monitor is tested to meet seismic Category I requirements. 7.6.2.1.9.2.2.3 (NSE-RMS) GDC 3 - Fire Protection Fire resistant components are used throughout. 7.6.2.1.9.2.2.4 (NSE-RMS) GDC 4 - Environmental and Missile Design Basis No provision is made for protection against missiles. 7.6.2.1.9.2.2.5 (NSE-RMS) GDC 5 - Sharing of Structures, Systems, and Components The wide-range accident radiation monitoring subsystem is shared by both units of the plant. The system is designed to perform its safety function in the event of an accident in one unit and during the orderly shutdown and cocidown of the other unit. O 7.6-82 l
</R/, % DRAFT tGS rS R () 7.6.2.1.9.2.2.6 (NSE-RMS) GDC 13 - Instrumentation and Controls l Operating ranges of the instrumentation cover normal plant operations, accident conditions, and post-accident conditions. 7.6.2.1.9.2.2.7 (NSE-RMS) GDC 21 - Protection System l j Reliability and Testability This system is designed for high functional reliability and in-l service testability. 7.6.2.1.9.2.2.8 (NSE-RMS) GDC 22 - Protection System Failure l Modes Two independent systems are provided. Within their operatitig ranges, redundancy and channel separation are provided, however only one system is provided for high range accident and { post-accident conditions. 7.6.2.1.9.2.2.9 (NSE-RMS) GDC 60 - Control of Release of l ,l Radioactive Materials to the Environment Surveillance is maintained of release of radioactive materials to i the environment; however, remedial action is initiated by control room personnel. O 7.6.2.1.9.2.2.10" (NSE-RMS) GDC 64 - Monitoring Radioactive Releases 4' i The requirement for monitoring radioactive releases from normal j operations, anticipated operational occurrences, and from i postulated accident is fulfilled. 1 7.6.2.1.9.2.3 (NSE-RMS) Conformance to 10 CFR Part 50, Appendix I 4 This system is equipped with instruments capable of state-of-the-4 i art sensitivity to provide control room personnel with real-time 1 information needed for restricting release of radioactive t materials to limits as low as practicable. 7.6.2.1.9.3 Conformance to Industry Codes and Standards { 7.6.2.1.9.3.1 (NSE-RMS) Compliance with IEEE 323-1974 i The wide-range accident monitor is qualified to IEEE 323-1974, including aging test requirements. 7.6.2.1.9.3.2 NSE-RMS Compliance of IEEE 344-1971 i j 'js The wide-range accident monitor is qualified for seismic j Category I. 7.6-83 l 4 ___..._.-.,..,-_,_,.__...,,_.,__..,_,_m,.,.- ...-m.,_._.__
92/.56 DRAFT "S rs^" 7.6.2.1.9.3.3 NSE-RMS Compliance with IEEE 384-1974 Redundancy is provided within the operating range of subsystem a by keeping the two subsystems separated and independent. 7.6.2.1.9.4 NSE-RMS Preoperational Checkout Preoperational tests are conducted prior to initial startup. The tests ensure functioning of all components and controls. System reference characteristics such as setpoints are documented during i a i
- O j
j i I I 4 O 7.6-83a l l ,._,.,,,m
4'A /. 56 LGS FSAR 4 avoid potentially hazardous areas. The means used to preserve the independence of redundant counterparts of safety-related systems are discussed in Chapter 6. ~ Dynamic effects external to the plant, induced by natural phenomena (e.g., tornado-produced missiles), are discussed in Section 3.5. Section 3.11 contains a discussion of design environmental conditions. Environmental and missile design bases are in accordance with General Design Criterion 4. Criterion 5 - Sharino of Structures, Systems, and Components Structures, systems, and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and cooldown of the remaining units. Desian Evaluation ( ) Although LGS Units 1 and 2 share certain structures, systems, and x-components, sharing them does not significantly impair the performance of their safety functions. The following safety-related structures are shared between both units: a. Control enclosure and support subsystems l b. Spray pond pumphouse and support subsystems l c. Spray pond The safety-related structures are designed to remain functional during and following the most severe natural phenomena. Therefore sharing these structures does not impair their ability to perform their safety functions. Seismic Category I structures that house safety-related systems and equipment are discussed in Section 3.8. The shared systems that are important to rafety are discussed below; a more detailed discussion may be found in these referenced sections: /N (,) a. Emergency service water (ESW) system 9.2.2 3.1-5 l 1
~ @l.sh LGS FSAR b. Residual heat removal service water (RHRSW) 9.2.3 system and support subsystems l c. Ultimate heat sink (spray pond) 9.2.6 l d. Standby gas treatment system (SGTS) and support subsystems Emercencv Service Water System The ESW system is designed to supply cooling water to safety-related components, including the diesel-generators, roor coolers and chillers, and the RHR pumps during loss of offsite power and accident conditions. Certain nonessential components can be cooled by the ESW system also, at the operator's option. The ESW pumps are located in the spray pond pumphouse with the RHRSW pumps. The spray pond pumphouse is designed as seismic Category I. The ESW system consists of two redunc ant loops, each capable of simultaneously providing 100% of the cooling water required by both Units 1 and 2. The system is designed so that no single active or passive electrical or control component failure or active mechanical component failure can prevent it from achieving its safety-related objective. g() For additional discussion, see Section 9.2.2. l RHR Service Water System The RHRSW system is designed to supply cooling water to the RHR heat exchangers during normal shutdown cooling operations as well as during loss of offsite power and accident conditions. The RHRSW pumps are located in the spray pond pumphouse with the ESW pumps. The spray pond pumphouse is designed as seismic Category I. The RHRSWS consists of two redundant loops, each supplying one RHR heat exchanger in each unit and capable of simultaneously providing 100% of the cooling water required by both Units 1 and 2. The system is designed so that no single active or passive component failure can prevent it from achieving its safety-related objective. For additional discussion, see Section 9.2.3. Ultimate Heat Sink (Sorav Pond) The spray pond provides the water for both the ESW and the RHRSW systems. It is the ultimate heat' sink for both Units 1 and 2. The return lines from the ESW and the RHRSW system are combined, and the total quantity of water from both these systems is (~J discharged through spray networks, which dissipate the heat. T There are two redundant return loops; either one is capable of 3.1-6 l J
%u.56 DRAFT LGS FSAR 4 handling the full flow from the ESW and RHRSW systems when shutting down two units simultaneously. Each return loop supplies two spray networks. Two of the four networks provide sufficient cooling for the design basis conditions. The spray pond contains sufficient water to meet the requirements for shutting down one unit if there is an accident and to permit the safe shutdown of the second unit for a period of 30 days without makeup. For additional discussion, see Section 9.2.6. l Standby Gas Treatment System l The SGTS system is designed to maintain the reactor enclosure or refueling area at the required negative pressure corresponding to isolation of either the reactor enclosure or refueling area. The SGTS filter train and fans are located in the control enclosure. The control enclosure is a seismic Category I structure. The SGTS system consists of two 100 percent-capacity redundant filter trains and two 100 percent-capacity fans. The (~3 system is designed so that no single failure can prevent it from \\_) achieving its safety-related objective. Additional discussion is given in Section 6.5.1.1. l Criterion 10 - Reactor Desian The reactor core and associated coolant, control, and protection systems shall be designed with appropriate margin to assure that specified acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences. Desian Evaluation The reactor core components consist of fuel assemblies, control rods, incore ion chambers, neutron sources, and related items. The mechanical design is based on a conservative application of stress limits, operating experience, and_ experimental test results. The core has sufficient heat transfer area and coolant flow to ensure that there is no fuel damage under normal conditions or anticipated operational occurrences. AV i 3.1-7 l l
%5ti. % LGS FSAR d)- The reactor protection system (RPS) is designed to monitor certain reactor parameters, sense abnormalities, and shut down the reactor, thereby preventing fuel damage when trip setpoints are exceeded. Trip setpoints are selected according to operating experience and the design bases. There is no case in which the scram-trip setpoints allow the core to exceed the thermal-hydraulic safety limits. Power for the RPS is provided by de-ac static inverters. Alternate electrical power is available to the RPS buses. The RPS is failsafe, i.e., scram is initiated on loss of power. An analysis and evaluation have been made of the effects on core fuel following adverse plant operating conditions. The results of abnormal operational transients are presented in Chapter 15 and show that the minimum critical power ratio (MCPR) does not fall below the specified limit, thereby satisfying the transient design basis. The conditions assumed in the analysis and the control systems used to accommodate these transients are identified in Chapter 15. O 3.1-7a l
DRAFT LGS FSAR (~ \\- ~ OUESTION 421.57 (Section 7.1) Demonstrate that the Safety / Relief Valve (SRV) low-low set point function is adequate given a single failure which could cause an additional SRV to open during the time for which only one valve is permitted to be open (i.e., on second and subsequent valve pops).
RESPONSE
The safety / relief valve (SRV) low-low setpoint logic circuit is not part of the design for Limerick 1 and 2. O 4 () l 421.57-1 l
DPsAFT LGS FSAR [m y) OUESTION 421.59 The staff has recently issued Revision 2 to Regulatory Guide 1.97, Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and e Following an Accident." This revision reflects a number of major changes in post-accident instrumentaticn. Discussion compliance i with this Regulatory Guide. RESPONCE i l The compliance to Regulatory Guide 1.97 Rev. 2 has been discussed in the revised Section 7.5 supplied in Rev. 16 of the FSAR. t l I i i () 421.59-1 6s se - v -L-g-- ---g-nwy mg~ e m _m 9 w4 - ew4 w w qwwwe .--y y-wgm-smvwr 3 -=
~ DRAFT LGS FSAR O OUESTION 421.61 As stated in Section 7.2.1.1.4.2 the APRM upscale trip setpoint is lowered in the start-up mode. Discuss whether this is accomplished automatically or manually. If automatically, describe the circuitry used. If manually, describe administrative procedures applicable, if any.
RESPONSE
Manually moving the reactor mode switch out of the run position to any other position causes the power to flow trip points to be lowered. This setpoint change is accomplished by removing the flow input to the power to flow circuits. The manual positioning of the reactor mode switch is governed by the standard reactor startup (shutdown) procedure. O O 421.61-1
DRAFT LGS FSAR I) OUESTION 421.62 The description of the APRM trips in Section 7.2.1.1.4.2 includes a thermal power trip. This trip, however, is not called for in Table 7.6-4 or shown in Figures 7.6-1 and 7.6-4. Clarify the status of the thermal power trip and correct the apparent discrepancy. )
RESPONSE
Limerick does not have a thermal power trip. Section 7.2.1.1.4.2 has been revised to show this. 4 I I () i 1 i j .I 1 ) 421.62-1
- /dk/.bSk LGS FSAR i
criteria. Even with the permitted APRM bypasses, the subsystem is capable of generating a trip scram signal before the average neutron flux increases to the point that fuel damage is probable. The trip units for the APRMs supply trip signals to the RPS and the reactor manual control system. Table 7.6-4 itemizes the APRM system trip functions. Any one APRM can initiate a rod block, depending on the position of the reactor mode switch. Section 7.7.1.2.3.2.3.3 describes in detail the APRM rod block interlock functions. The APRM upscale rod block and the APRM upscale scram trip setpoints vary as a function of reactor recirculation driving loop flow. The APRM upscale trip set point varies with recirculation flow. When the reactor mode switch is out of the run position, this setpoint is reduced to obtain a fast response to high neutron flux. Any APRM upscale trip or inoperative trip initiates an NMS trip in the RPS. Only the trip system associated with the APRM is affected. At least one APRM channel in each trip system of the RPS must trip to cause a scram. The operator can ( ) bypass the trips from one APRM in each trip system 7x of the RPS. A simplified circuit arrangement is shown in Figure 7.6-7. NMS scram operating bypasses are described in Section 7.2.1.1.4.4. Diversity of trip initiation for unusual excursions in reactor power is provided by the NHS trip signals and reactor vessel high-pressure trip signals. An increase in reactor power initiates protective action from the NMS discussed in the above paragraphs. The increase in power causes reactor pressure to increase because of a higher rate of steam generation with no change in turbine control valve position resulting in a trip from reactor vessel high pressure. These variables are independent of one another and provide diverse initiation of protective action for this condition. b. Reactor Pressure (RPS Initiating Circuits) Reactor pressure is measured at four physically separated locations. A pipe from each location is routed through the drywell and terminates in the reactor enclosure. One locally mounted pressure sensor monitors s() the pressure in each pipe. Cables from these sensors 7.2-5
DRAFT LGS TSAR OUESTION 421.63 As shown in Table 7.6-4, the APRM downscale trip scrams the reactor. However, the discussion of the APRM trips in Section 7.2.1.1.4.2 does not include this trip as a scram parameter. Review all relevant information and correct this apparent discrepancy.
RESPONSE
The APRM downscale trip is a parameter used in the NHS input to the RPS scram circuitry. Section 7.2.1.1.4.2 has been changed to include this trip function. f~\\ o (> %-) 421.63-1
O O quss O LGS FSAR TABLE 7. 6-4 n ] APRM SYSTEM TRIPS j ,i i 5 TRIP FUNCTIQH_ TRIP POINT RAHij NOMINAL SEIPOINT ACTION j s APRM downscale 25 to full scale 35 Scram, rod block, annunciator, 4 white light display APRM upscale Setpoint varied with flow, R(0.66 Flow + 4211 in Scram, annunciator, red 8 slope adjustable, inter-run mode; fixed 125 in light display l cepts separately adjust-startup mode ,t able R = Dggjgn PeAAiD9. leg 19r___ Operating Peaking Factor APRM Calibrate switch or too Not in operate mode or Scram, rod block, f inoperative few inputs module interlock chain annunciator, red light broken or less than - display 7 of 21 inputs or 8 of 22 inputs White light 5 APRM Bypass Manual switch i f I f i i f l 5 l i t k l l' I i
DRAFT LGS FSAR AlJ OUESTION 421.64 There appears to be a discrepancy between the number of instrumentation channels as described in Section 7.3.1.1.1.1.3 and the logic shown in Figure 7.3-7. Also the logic shown in Figure 7.3-5 does not agree with the logic in Figure 7.3-7 or the logic described in Section 7.3.1.1.1.1.4. Describe the as-built system and correct apparent discrepancies.
RESPONSE
Figure 7.3-5 and Section 7.3.1.1.1.1.3 have been changed to i correct the discrepancies. A revised Figure 7.3-7 will be l provided by June 1983. There are four level transmitters and four drywell pressure transmitters incorporated in the HPCI l initation circuitry. The four trip units that operate off the level transmitters are combined in a one-out-of-two-twice logic l for automatic system initiation. The same is true for the drywell pressure transmitter / trip units. Either of the two logic i l trains will initiate the system. The turbine trip logic for high i water level is also one-out-of-two-twice and not two-out-of-two as stated in the text. Section 7.3.1.1.1.4 is correct in its () description of the initiation logics. i j 421.64-1 l
'lRI. b el DRAFT o V L L P P HPCI L L P P O START HPCI L -RE ACTOR VEMEL WATER LEVEL l l P -HIGH DRYWELL PRESSURE 4 LIMERICK GENERATING STATION l UNITS 1 AND 2 FINAL SAFETY ANALYSIS REPORT I l AUTOMATIC lNITIATION LOGIC-HPCI FIGURE 7.3 5
Sa/. W LGS FSAR f CHAPTER 7 \\ (,) FIGURES (Cont'd) t Fioure No. Title 7.2-15 Raceway Layout Reactor Enclosure Unit 1, Area 16, Elevation 253'-0" + 1 7.2-16 Single Line Meter and Relay Diagram 7.3-1 Isolation Control System For Main Steam Line Isolation Valves 7.3-2 Isolation Control System Using Motor-Operated Valves 7.3-3 Main Steam Line Isolation Valve Control Diagram 7.3-4 System Level Automatic Initiation Logic-ADS, CS, RHR 7.3-5 Initiation Logic-HPCI l 7.3-6 Emergency Core Cooling System (ECCS) ({} Separation Scheme 7.3-7 High Pressure Coolant Injection System 7.3-8 Nuclear Boiler System 7.3-9 Core Spray System FCD 7.3-10 Residual Heat Removal System 7.3-11 Procesa Radiation Monitoring IED 7.3-12 Miscellaneous Structures HVAC Logic Diagram 7.3-13 Drywell HVAC Logic Diagram 7.3-14 HPCI Logic Diagram 7.3,15 Core Spray Logic Diagram 7.3-16 RHR Logic Diagram 7.3-17 Reactor Encl'osure Cooling Water Logic Diagram ~ 7.3-18 Containment Atmosphere Control Logic Diagram () 7.3-19 Primary Containment Instrument Gas Logic Diagram 7-xix l l
vai/.4,4r DRAFT LGS FSAR (3 m) Reactor vessel low water level is monitored by four level sensors l that sense the difference between the pressure due to a constant reference leg of water and the pressure due to the actual height of water in the vessel as shown in Figure 5.1-4. Each level sensor provides an input to a trip unit. The four trip units are connected in a one-out-of-two-twice logic to provide an automatic HPCI initiation signal. Two lines, attached to taps above and below the water level on the reactor vessel, are required for the differential pressure measurement for each pair of level sensors. l The lines terminate outside the primary containment and inside the reactor enclosure. The sensors are physically separated frem the ADS sensors and tap off the reactor vessel at points widely separated from the ADS sensors. These same lines are also used for pressure and water level instruments for other systems. A similar arrangement of the ADS instrumentation initiates the ADS system. The arrangement ensures that no single event can prevent reactor vessel low water level from initiating both the HPCI system and the ADS. Primary containment pressure is monitored by four pressure sensors that are mounted on an instrument rack outside the drywell, but inside the reactor enclosure. Pipes from the drywell interior to the sensors provide the sensing lines. Each drywell high-pressure sensor provides an input into a trip unit. (]') The four trip units are connected in a one-out-of-two-twice logic to provide an automatic HPCI initiation signal. The relay contacts from the trip units are arranged so that both of the sensors sensing high drywell pressure initiate the HPCI system. The sensors are physically separated from the ADS pressure sensors and tap off the containment at points widely separated from the ADS pressure sensors. The arrangement ensures that no single event due to containment high pressure can prevent the initiation of both the HPCI and ADS. The HPCI system controls automatically start the HPCI system from the receipt of a reactor vessel low water level signal or primarp containment high-pressure signal and bring the system to its design flow rate in approximately 30 seconds. The controls then function to provide design makeup water flow to the reactor vessel until the amount of water delivered to the reactor vessel is adequate, at which time the HPCI system automatically shuts down. The controls are arranged to allow remote-manual startup, operation, and shutdown. The HPCI turbine is functionally controlled as shown in Figure 7.3-7. A speed governor limits the turbine speed to its maximum operating level. A centrol governor receives an HPCI system flow signal and adjusts the turbine steam control valve so that the design HPCI system pump discharge flow rate is obtained. (~J Figure 7.3-7 shows the various modes of turbine control. The T flow signal used for automatic control of the turbine is derived s 7.3-4 l l
= =.m _ = i e/JR I. 69/ LGS FSAR High water'1evel in the reactor vessel indicates that the HPCI system has performed satisfactorily in providing makeup water to the reactor vessel. Further increase in level could result in i HPCI system turbine damage caused by gross carryover of moisture. The reactor vessel high water level setting that trips the turbine is near the top of the steam separators and is sufficient to prevent gross moisture carryover to the turbine. The level sensors that sense differential pressure are arranged in a one-out-of-two-twice trip logic to initiate a turbine shutdown. Low steam supply pressure is detected by two pressure sensors, both of which must trip to initiate a turbine shutdown. This low pressure indicates that there is insufficient energy in the steam for the turbine to function. The control scheme for the turbine auxiliary oil pump is shown in vigure 7.3-7. The controls are arranged for automatic or manual c?ntrol. Upon receipt of an HPCI system intiation signal, the auxiliary oil pump starts and provides hydraulic pressure to open the turbine stop valve and the turbine control valve. As the turbine gains speed, the shaft-driven oil pump begins to supply hydraulic pressure. After about 1/2 minute during an automatic turbine startup, the pressure supplied by the shaft-driven oil O pump is sufficient, and the auxiliary oil pump automatically stops upon receipt of a high oil pressure signal. Should the shaft-driven oil pump malfunction, causing oil pressure to drop, the auxiliary oil pump restarts automatically. The operation of the gland seal condenser components - gland seal condenser condensate pump (de), gland seal condenser blower (de), and gland seal condenser water level instrumentation - prevents outleakage from the turbine shaft seals. Startup of this equipment is automatic, as shown in Figure 7.3-7. Failure of this equipment does not prevent the HPCI system from providing water to the reactor vessel. 7.3.1.1.1.1.4 HPCI Logic and Sequencing Either reactor vessel low water level or primary containment t (drywell) high pressure can automatically start the HPCI system as indicated in Figure 7.3-7. Reactor vessel low water level is an indication that reactor coolant is being lost and that the fuel is in danger of being overheated. Primary containment high pressure is an indication that a breach of the nuclear system process barrier has occurred inside the drywell. The scheme used for initiating the HPCI system is shown in Figure 7.3-7. One logic actuates the trip upon receipt of a low water level signal. The other actuates upon receipt of a high i (]) drywell pressure signal. Either logic can start the HPCI system. The HPCI system is powered by de buses. t 7.3-6 l
O O w.w O DRAFT
= rs^
i TABLE 7.3-8 I HIGH PRESSURE COOLANT INJECTION SYSTEM t [ } MINIMUM NUMBERS OF TRIP CHANNELS FOR FUNCTIONAL PERFORMANCE k MINIMUM NUMBER OF TRIP CHANNELS { REQUIRED TO j COMPONENT TRIP CHANNELS MAINTAIN FUNCTIONAL AF EQIED
- CIIANNEL, INSTRUMENT EE9YIDED
_ EEEf9EL4 HSE i l HPCI initiation Beactor vessel Level sensor 4 2 l low water level (level 2) HPCI initiation Primary containment Pressure sensor 2 2 high pressure 2 l HPCI turbine HPCI pump discharge Flow indicator 1 1 i flow controller HPCI turbine Reactor vessel bigh Imvel sensor 4 2 1 water level (level 8) HPCI turbine Turbine exhaust Pressure sensor 2 1(*3 high pressure HPCI turbine HPCI pump low Pressure sensor 2 1883 faction pressure I HPCI pump ' Minimum flow Flow sensor 1 1 HPCI steam supply HPCI steam supply Pressure sensor 2 2 valve and sup-low pressure pression pool suction valve Suppression pool Condensate storage Level sensor 2 1 suction valve tank low level and 1 suporession pool high level (83 An inoperable sensor should be placed in the untripped state. i l 4 4
DPsAFT LGS FSAR O QUESTION 421.65 The CS initiation logic.as described in Section 7.3.1.1.1.3.3 appears not to be complete and is also in disagreement with the logic shown in Figure 7.3-9. Review all relevant information and bring these items into agreement.
RESPONSE
Figure 7.3-4 has been corrected. A revised Figure 7.3-9 will be provided by June 1983. The initiation logic presently in Section 7.3.1.1.1.3.3, in conjunction with the revised figures, adequately describes the design. O l l () 421.65-1 1
DRAFT LGS FSAR O outsrion 42i 66 The description of the initiation logic for the ADS includes a permissive interlock from the LPCI or the CS pumps running signal. This permissive, however, is not shown on Figure 7.3-4. Correct the apparent discrepancy.
RESPONSE
Figure 7.3-4 has been revised to agree with the description of the initiation logic for the ADS. O O 421.66-1 __..,.,___,___..__,..__.,__,_.i
9'R /. 6 6 DRAFT ADS P, R) L 3 O 1 P START ADS -LOW RE ACTOR WATER LEVEL (LEVEL 1) -LOW RE ACTOR WATER LEVEL (LEVEL 3) { -HIGH DRYWELL PRESSURE i CS, R H R -REACTOR LOW PRESSURE PERMISSIVE -TIME DELAY UNNING P R SSIVE G l' l' ^" cS RHR A LIMERICK GENER ATING STATION UNITS 1 AND 2 FINAL SAFETY ANALYSIS REPORT SYSTEM LEVEL AUTOMATIC INITIATION LOGIC-ADS,CS, RHR FIGURE 7.34
9'A /. 6 6 / LGS FSAR (^' CHAPTER 7 FIGURES (Cont'd) Ficure No. Title 7.2-15 Raceway Layout Reactor Enclosure Unit 1, Area 16, Elevation 253'-0" 7.2-16 Single Line Meter and Relay Diagram i 7.3-1 Isolation Control System For Main Steam Line Isolation Valves 7.3-2 Isolation Control System Using Motor-Operated Valves 7.3-3 Main Steam Line Isolation Valve Control Diagram 7.3-4 System Level Automatic Initiation Logic-ADS, CS, RHR 7.3-5 Initiation Logic-HPCI l cx 7.3-6 Emergency Core Cooling System (ECCS) V Separation Scheme 7.3-7 High Pressure Coolant Injection System 4 7.3-8 Nuclear Boiler System 7.3-9 Core Spray System FCD 7.3-10 Residual Heat Removal System 7.3-11 Process Radiation Monitoring IED 7.3-12 Miscellaneous Structures HVAC Logic Diagram 7.3-13 Drywell HVAC Logic Diagram 7.3-14 HPCI Logic Diagram 7.3,15 Core Spray Logic Diagram 7.3-16 RHR Logic Diagram 7.3-17 Reactor Enclosure Cooling Water Logic Diagram 7.3-18 Containment Atmosphere Control Logic Diagram () 7.3-19 Primary Containment Instrument Gas Logic Diagram 7-xix l
DRAFT LGS FSAR { QUESTION 421.67 The discussion of the SGTS in Section 7.3.1.1.7 states that the fans for the two redundant systems are arranged in a lead-lag mode with operation of the lead fan started automatically by a secondary containment isolation signal, and the other fan (lag) remaining on standby. Section 6.5.1.1.2, however, states that the isolation signal starts both fans. Correct this apparent discrepancy.
RESPONSE
Section 7.3.1.1.7 was changed in Revision 15 to the FSAR to correct the discrepancy. () (_) l I (\\ U/ l 421.67-1 l l --}}