ML20151M135

Rev 0 to Technical Evaluation 172-97, Cable Separation Safety Assessment Rept

ML20151M135
Person / Time
Site:	Maine Yankee
Issue date:	07/21/1997
From:	Maine Yankee
To:
Shared Package
ML20151L714	List: ML20151L709 ML20151M135
References
TE-172-97, NUDOCS 9708110001
Download: ML20151M135 (106)

Text

. - . . -. - - - . . .-

TECHNICAL EVALUATION TE No. 172-97 Rev. No. O Tech. File No.17.7 4 Page 1 of 42 SECTION 1. BACKGROUNQJNEQBMAI1ON: (Proc. step 3.2.1)

TITLE: CAB 1 E SEPARATION SAFETY ASSESSMENT REPORT l

l SOURCE DOCUMENT: I anrning Bank Inspectinn Reoort ID NO.97-248 (i.e., WO, REQ.. Po, Proc. MYTTS, ..)

PLANT SYSTEM: All Electrical Cable and Circuits PLANT COMPONENT:_ A!! cables and Circuits ID NO. Various TE TYPE: c Modification o Altemate Replacement c Material substitution a Setpoint Change s Assessment c Proc Change / Review c Repair a other SECTION 11. EVALUATION: (Proc. step 3.2.2)

Document and attach responses for the following items:

a. Issue

Description:

(Describe in sufficient detait to explair' the need for the evaluation)

b. Anplir nble Designers /S: (Inputs, assumptions, industrias design function, nuc!sar safety function, key features)

C. ObjectiV0:(Concise statement vthich defines the purpose and scope)

d. Design Evaluation: (Impact on the plant design basis and assurance that the basis has not been adversely abcted)

6. C.Qnt'luMtons: (Technically supported and meets the stated objective)

f.

References:

(Those required to support the evaluation) i

g. BecommendatiODS: (Adsttbnal or planned recommended actions and a responsible department) l l o Are changes identified which effect con #guration documents? e Yes a No 1

l o Does this issue represent a design change? e Yes a No l - .=. .

.: :. . =-- _ .

SECTION 111, PREPARITIONfAPPROVAL SIGNATURES: (Proc, step 3.3)

Prepared by: c,

_D Date: 7!I3,97 Reviewed by: oo A - Date: 2/ 7 Approved By: b n Date:

4 PORC Review required?

O e Yes a No 97-CW

• Approved Date: MA/f'7 P+ ORC Mtg. #1Herl. an, s 3:n Dma: >/Yes a No ' i y/

V' (Proc. No.17-226, Rev.11, Page 15 of 19)(Attachment A) 9708110001 970731 PDR ADOCK 05000309 P PM j

l 10CFR50.59 SCREENING TE No. 172-97

Rev.No. O Page 2 of 42 NOTE Minor editorial changes to design basis information do not require a 10CFR50.59 Determination.

a. Would the issue being evaluated:

1. Require a change to tfm Technical Specifications? YES a NO a ;

2. Change the facility as described in the FSAR7 YES a NO o

3. Change the intent of a procedure as described in the FSAR? YES a NO a ]

4. Change items that affect nuclear safety in a way not previously evaluated in the FSAR? YES a NO a j

5. Involve test or experiments not described in the FSAR? YES a NO a

6. Require a technical change to a design basis document? YES a NO a l

7. Be classified as a design change? YES a NO a

8. Be classified as an in-service repair of a safety class component? YES a NO a  !

9. Require a change to the EQ Master List? YES a NO a

b. Is a 10CFR50.59 Determination required? YES a NO a (s 10CFR50.59 Determination is required if any of the screening questions were answered YEs.)

4 (Proc. No.17-226, Rev.11, Page 16 of 19)(Attachment A)

I TE 172-97 i Revision 0  !

Page 3 of 42 l 1.0 Executive Summary l This technical evaluation provides the analysis necessary to support a revision to the Maine l Yankee FSAR to clarify acceptable methods to ensure that the independence of redundant safety related electrical systems meets or exceeds the level of independence provided by -

the on,ginal licensing basis, i

Plant inspection,s performed to resolve a wiring discrepancy discovered during an engineenng review in December,1996 identified that certain circuits did not meet either -

FSAR design requirements or underlying construction standards, specifically cable and l cin:uit separation guidelines. Subsecuent inspections identified additional non-conforming t conditions related to separation in fie d cable raceways and control panel wiring.

Separation requirements for Maine Yankee are, in general terms, contained in the FSAR.  !

Acceptable methods of meeting the FSAR separation requirements are contained in plant construction documents. Although deviations from plant construction documents would not, <

in some cases, be discrepant conditions with respect to the FSAR (and may not, therefore,  !

construction document discrepanc)ies when performing inspections. representj Cable separation criteria specified during construction includes the use of sheetmetal 1 j

barriers, flexible conduit or air separation for field cables. Two inches of air separation is ,

specified for wiring within control panels. However, cable separation is only one of several I means to preserve the independence of redundant systems and decouple the effects of  !

physical and electrical hazards. The current license basis achieves independence not only  !

through separation, but employs electrical protection, and physical location as well. Any j one, or a combination of these methods can afford adequate independence. It is the thoughtful application of these various methods which forms the basis for resolving the identified cable separation discrepancies such that adequate independence is preserved.

The objective of this assessment is to provide an acceptable method to maintain the independence of redundant circuits not separated in accordance with the current license basis. The separatiori discrepancies identified by plant walkdowns were classified and analyzed to determine if the discrepant conditions could be acceptable without resulting in any loss of independence of the safety related channels. The hazards to the cables were identified and the effects of removing the metal barrier system was analyzed. This assessment proceeded in a logical sequence to: !dentify potential cable hazards i throughout the alant, evaluate the potential damage to any safety related circuit inflicted by  ;

the hazard, anc identify all of the design features in place to prevent the hazard from preventing safety system functions. ,

Where the physical protection provided by the metal barriers or distance was found to be j degraded, more reliance must be placed on elimination of potential hazard and use of i electrical overcurrent protection to achieve an equivalent level of electrical independence, i The indirect effects of postulated hazards, such as fault inducted cable damage or ignition, must be eliminated. Double overcurrent protection compensates for missing or degraded  ;

barriers by eliminating the cable damage hazard. To implement the required protection, the i existing single overcurrent device, most of which are presently not qualified, is replaced by i two qualified overcurrent devices providing the same function. The double protection maintains the required independence when considering any single failure.

l AATRANSFER\TE172 97.RVO i

a

TE 172-97 Revision 0 Page 4 of 42 Where necessary, plant modifications will be made to ensure that the cable installation fulfills all attributes for achieving independence. Modifications will include relocating cables  ;

and equipment and installin,g or repainng metal barriers. in other cases, cable separation  !

will not form a basis for achieving independence. Rather, the concepts of electrical i protection or physical location will be applied to achieve that goal such as installing double overcurrent cable protection, automatic isolation of certain loads during design basis events, and enhancing overcurrent protection device maintenance and testing programs.

Maine Yankee has elected to enhance the license basis of the plant as described in the FSAR in accordance with 10CFR50.59 to clarify acceptable methods to achieve electrical independence. Specifically, this assessment provides an attemative to the barriers and spacing originally specified as part of the method cmphyed to mitigate circuit induced i effects, maintenance operations, and channel malfunctions, i I

t The extensive plant and document reviews performed in support of this evaluation provide a l better understanding of the cable separation elements important to safety at Maine Yankee.  !

Based on that understanding, it is clear that restoring physical separation in all cases would provide little safety improvement. Altematively, utilizing other methods of maintaining ]-

electrical independence (e.g., electrical protection, physical location) provide a net safety improvement. Thus, in moving forward, this assessment presents a technically sound ap 3 roach to improving safety through achievement of a higher level of electrical i incependence.

i i

i l

AATRANSFER\TE172-97.RVO

TE 172-97 Revision 0 Page 5 of 42 IABLE OF CONTENTS 1.0 Executive S u mma ry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.0 O bjective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 l 3.0 I ntrod u ctio n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.1 License and Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.2 The Role of Industry Standards on Cable Separation . . . . . . . . . . . . . . . . . . 10 3.3 Identification of Discrepancies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.4 Approach to the Evaluation of Discrepancies . . . . . . . . . . . . . . . . . . . . . . . . 10 3.5 Classification of Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 4.0 Method of Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4.1 Identification of Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4.2 Plant Design Features Which Address Hazards . . . . . . . . . . . . . . . . . . . . . . 12 4.3 Selection of Critical Plant Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4.4 Assessment of Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4.5 Elimination of Circuit Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 4.6 Changes Required to the Plant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 5.0 Existing Hazards Considered for Assessment . . . . . . . . . . . . . . . . . . . . . . . 14 5.1 Identification of Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 l 5.2 Plant Design Features Which Address Hazards . . . . . . . . . . . . . . . . . . . . . . 15 5.2.1 Electromagnetic interference (EMI) . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 5.2.2 Circuit Fault Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 5.2.3 DBE Hazards Other Than Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 5.2.4 Fire -Hazard s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 f

j 5.2.5 Non-DBE Miscellaneous Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

[ .

5.2.6 Maintenance and Installation Hazards . . . . . . . . . . . . . . . . . . . . . . . . . 23 i

AATRANsFER\TE172-97.RVO s

i l

l TE 172-97 J Revisi:n 0 Page 6 of 42 IABLE OF CONTENIS 5.3 Summary of Protection Provided by the Metal Barrier System . . . . . . . . . . . 25 5.3.1 Electromagnetic Interference (EMI) . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 5.3.2 Circuit Fault Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 5.3.3 DBE Hazards Other Than Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 5.3.4 Fire H aza rd s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 6 5.3.5 Non-DBE Miscellaneous Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1 l

5.3.6 Maintenance and installation Hazards . . . . . . . . . . . . . . . . . . . . . . . . . 26 5.4 Selection of Critical Plant Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

- l 6.0 Assessment of Hazards and Separation Discrepancies . . . . . . . . . . . . . . . . 28 l.

l 7.0 Demonstrate Elimination of Circuit Hazards . . . . . . . . . . . . . . . . . . . . . . . . . 29 7.1 Electromagnetic Interference (EMI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 7.2 DB E/H ELB Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 7.3 Analysis of Fire Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 7.4 Analysis of Other Miscellaneous Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . 30 l 7.5 Circuit Fault Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 I i

7.5.1 Application of Circuit Protection . . . . . . . . . . . . . . . . . . . . . . . . . 30 7.5.2 Double Circuit Protection Design Evaluation . . . . . . . . . . . . . . . 31 j 7.5.3 Summaty of Circu!! Protection . . . . . . . . . . . . . . . . . . . . . . . . . . 34 l 7.6 Analysis of Maintenance Hazards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 l 7.6.1 Main Control Board and Control Panele . . . . . . . . . . . . . . . . . . . 35 l

7.G.2 Field Ca bles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 8.0 Actions Required to Support Safety Assessment . . . . . . . . . . . . . . . . . . . . . 37 9.0 Summary and Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

10. 0 Refe re n ce s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 l

A$ TRANSFER \TE172-97.RVO

TE 172-97 Revision 0 Page 7 of 42 TABLES

1. Cable Separation Discrepancy Types identified By Field Inspections

2. Table of hazards and mitigating actions FIGURES

1. Cable Separation Safety Assessment Overall Program Flow Chart

2. Fault Potential Identification Graph For All Plant Cables ,

3. Class 1E Cable Evaluation Flow Chart

4. NNS Cable Evaluation Flow Chart

5. Case Study for Cable Independence  !

ATTACHMENTS

1. 10CFR50.59 Safety Evaluation Summary and FSAR Changes l

2. Summary of TE 226-96 Changes By the Safety Assessment l

l 3. Representative Photographs and Descriptions l l l l l

l 1

i I

\

A:\ TRANSFER \TE172-97.RVO

TE 172-97 Revision 0 Page 8 of 42 2.0 OBJECTIVE l The objective of this assessment is to provide an acceptable method to maintain the independence of redundant circuits not separated in accordance with the current license basis. Specifically, this assessment will:

2.1 Evaluate the different types of separation discrepancies identified by the field walkdown to identify the safety significance.

2.2 Identify the types of hazards that cables may be subjected to in areas where separation discrepancies were identified in the field.

2.3 Identify those measures which should be taken to eliminate the physical and electrical l hazards posed to the cables because of the identified cable separation discrepancies.

l 2.4 Describe attemative methods to achieve independence and provide the technical i justification necessary to support the required FSAR changes and evaluation of the l l changes per the requirements of 10CFR50.59. +

l l

l l

\

\

A:\ TRANSFER \TE172-97.RVO l .

TE 172-97

! Revirion 0 Page 9 of 42

3.0 INTRODUCTION

4 The original design for Maine Yankee makes use of a combination of methods to achieve 4

independent safety related systems. Circuit independence is achieved by applying,

individually or in combination, the concepts of cable separation, electrical protection, and physical location (protection from or elimination of hazards), each described in the FSAR.

This technical assessment provides the analysis necessary to support a revision to the Maine Yankee FSAR to clarify acceptable methods to ensure that the independence of

redundant safety related s the current license basis. ystems meets or exceeds the level of independence provided by This assessment does not eliminate the separation criteria described in the current license basis in FSAR Section 7 and 8 (Reference 1). This assessment clarifies other acceptable methods of assuring the independence of redundant safety related circuits which may be discrepant with the separation requirements of the current license basis. The assessment focuses on eliminating the hazards which may be present in plant areas containing redundant safety related circuits and applying new insights on electrical independence to not only discrepant conditions but all cable in the plant, resulting in an overall improvement in the independence of redundant safety systems.

1 3.1 License and Design Basis  !

The current license and design basis for cable separation was recovered from vanous documents and docketed correspondence and presented by Technical Evaluation (TE) J i

226-96 (Reference 2). TE 226-96 also captured various construction documents and '

standards which constituted acceptable means of meeting the license and design bases.

TE 226-96 then served as the benchmark for identifying cable and circuit separation discrepancies from the field inspection data. It should be noted that TE 226-96 made no attempt to distinguish between conditions discrepant with respect to the license / des,ign i basis (which would represent Appendix B deficiencies) and conditions discrepant with l respect to construction documents (which may not be Appendix B deficiencies).

The Maine Yankee license / design basis focuses on ensuring the required independence between redundant safety related channels, and between safety and non-safety systems.

These independence requirements are specified by the FSAR Section 7 (Reference 1),

which specifies the performance and reliability requirements of the redundant channels to {

be in accordance with IEEE 279-1968 (Reference 3). Independence is defined in IEEE '

279-1968, as follows:

"ChannelIndependence: Channels that provide signals for the same protective l function shall be independent and physically separated to accomplish decoupling of the effects of unsafe environmental factors, electnc transients, and physical accident consequences documented in the design basis, and to reduce the likelihood of interactions between channels during maintenance operations orin the event of channel malfunction" A:\ TRANSFER \TE172-97.RVO

TE 172-97 i

Revision 0 Page 10 of 42

] 3.2 The Role of Industry Standards on Cable Separation

! 3.2.1 Staff Anproved Industrv Standards i

! Draft IEEE Standard, " Criteria for Separation of Class 1E Equipment and Circuits," dated i July 20,1973 (Reference 4), was prepared by the Institute of Electrical and Electronics Engineers. The draft was subsequently modified in August 1973 incident to the normal j process of developing its technical content. The modified draft standard provided criteria for the separation of redundant Class 1E equipment and circuits installed at nuclear power

slants. Inasmuch as there was an urgent need for explicit guidance in the area of physical ndependence of electric systems and in view of the considerable guidance already

{ available from the modified IEEE draft standard, the AEC staff issued Regulatory Guide

1.75 " Physical Independence of Electric Systems,"in February,1974 (Reference 5). RG l 1.75 endorses the IEEE draft standard, as a general implementation document for cable i separation. This IEEE draft standard was subsequently issued as IEEE-384-1974.

1 i This staff ap aroved standard is not part of the license or design basis for Maine Yankee l and is provic ed for reference purposes only.

3 3.2.2 Apolication to Maine Yankee License Bania Industry and regulatory standards for cable separation had not yet been established during

! the licensing and construction phase of Maine Yankee. The specific separation requirements for Maine Yankee evolved during the construction period, with input and i acceptance from the AEC. The separation criteria for Maine Yankee are contained in

FSAR Sections 7 and 8.

l.

3.3 Identification of Discrepancies A systematic and methodical approach was implemented, to identify the scope of cable separation discrepancies. This approach b an with an inspection of the plant to identify cable separation discrepancies (Reference . The inspection plan (Reference 6) identifiec the typec of discrepancies listed in able 1, based on the separation guidelines described by TE 226-96 (Reference 2).

As a result of this inspection, Maine Yankee has developed a high level of confidence that all types of discresancies have been found and have been 3roperig identified and classified. Specif c discrepancies on a circuit-by-circuit bas s need'not be known to support this safety assessment. This ar,sessment addresses the worst-case separation discrepancy. The worst-case discrepancy is defined as circuits for redundant safety related functions not provided with the circuit separation required by the current license basis (e.g. Train A and Trein B circuits routed through the same raceway).

3.4 Approach to the Evaluation of Discrepancies Having identified the full range of potential cable separation discrepancies, the approach to the resolution phase shifted focus in three significant ways.

First, it was apparent that the original license / design basis, or the underlying construction standards, were weak in the area of cable separation. For instance, the construction specification for two inches of air separation within control panels may be reduced when a lesser distance is dictated by contact or device configuratione. Also, the original AATRANsFER\TE172 97.RVO

TE 172-97 Revision 0 l Page 11 of 42 l

license / design basis allowed NNS cables to be routed with safety-related cables, such that ,

faults in NN6 cable could adversely affect safety-related cables if additional protection is not provided. l Second, it became clear that the original construction features which preserve independence include elements other than cable separation. Consequently, it was necessary to take a new look at the separation criteria in order to focus on safety improvement. As discussed in more detail below, this approach evolved into an emphasis on ) reserving electrical independence (vice electrical separation) through a critical review of t1e hazards that could adversely affect electrical independence.  !

Third, the inspection activities focused primadly on identifying discrepancies in the cables installed since Maine Yankee was licensed. Because, as noted above, the license basis was relatively weak in the area of cable separation, it was appropriate to apply the hazards review to not only the new construction cable, but all safety-related cable in the plant.

As a result, each type of cable separation discrepancy identified during the inspection phase has baen casigned a category which may exist in the plant. The ardhaz(or multiple categories categories) are identified based by IEEE on the 279-1968 as: type of hazards a Unsafe environmental factors b Electric transients (EMI and circuit damage) c Physical accident consequences documented in the design basis d Interaction between channels during maintenance activities e interaction between channels in the event of a channel faihre.

A methodical evaluation of each type of hazard identified is performed oy ns assessment.

This evaluation looks beyond the concept of cable separation by incorporating the use of electrical protection and physical location to achieve electrical independence.

3.5 Classification of Components This assessment discusses the following three categories of electrical components:

Safety Related: Components which must function to achieve safe shutdown, mitigate .

the design basis events (DBE) documented in the FSAR, or prevent the release of radioactive materials to the environment. Contemporary standards identify these components as " Class 1E," a term which is used interchangeably with " safety related" throughout this document. Redundant safety related circuits are generally referred to as Train A and Train B.

Non-Safety Related: Non-safety related NNS) components provide functions for balcnce-of-plant systems and are not relie(d on to mitgate the DBEs discussed in the FSAR.

Quality Assurance Related: Quality assurance related (QAR) components are a subset of NNS components which are assigned certain quality attributes to assure that the required level of functionality is maintained. QAR overcurrent protection devices described in this assessment meet the necessary qualifications to ensure that overcurrent conditions are interrupted but are not qualified to maintain circuit operability under all design basis conditions.

I A:\ TRANSFER \TE172-97.RVO

TE 172-97 Revision 0 Page 12 of42 4.0 METHOD OF ASSESSMENT This section is a summary of the method used in the following sections to identify the potential hazards and evaluate the impact of the hazards on safety related circuits.

4 4.1 Identification of Hazards To facilitate this assessment, the general hazard categories identified by lEEE 279-1968 are expanded in Section 5.1 to list the specific hazards which are postulated in the Maine Yankee plant. Unsafe environmental factors and physical hazards are identified or the assessment documents that such hazards do not exist.

4.2 Plant Design Features Which Address Hazards The plant design features which protect circuits from the postulated hazards are identified in Section 5.2. This section also discusses the level of protection provided by the original license / design separation requirernents s acified in FSAR Sections 7 and 8 for each hazard. The level of protection provided oy the original license / design separation requirements for each hazard is summarized in Section 5.3. All hazards and design features are addressed such that altemative methods which are established may a applied independent of the original separation criteria.

4.3 Selection of Critical Plant Areas Critical plant areas are defined as those areas which contain safety related circuits or components. The critical plant areas are listed in Section 5.4. Where it is clear that no safety related circuits are present, the direct effects of circuit failure or hazards to circuits in the area need not be evaluated. Faults which may propagate from a non-critical area to a critical area are postulated to occur unless steps are taken to eliminate such hazards.

In certain very large areas, such as the Turbine Building, the critical areas identified for review are limited to those areas which contain redundant safety related circuits. Where inspections demonstrate that no cable separation discrepancies exist, further evaluetion is not required.

4.4 Assessment of Hazards Each of the hazards are evaluated as described in Section 6.0 to define an acceptable i altemative method, which will provide independence equal to or better than the original design. Where attemative methods are required, hazards to circuits are assessed to assure that postulated hazards which may damage adjacent circuits are prevented by suitable protection, such that the independence of redundant safety related circuits is not degraded.

A:\ TRANSFER \TE172-97.RVO

i

! TE 172-97

, Revision 0 Page 13 of 42 4.5 Elimination of Circuit Hazards  !

i To address each potential circuit hazard, Section 7.0 of the assessment identifies

,' acceptable methods to address each of the hazards. The assessment is carried out in  !

i' three main parts designed to complement each other (See Figures 2 and 3). These three

, parts are: '

a) Identify Class 1E and NNS circuits connected to power sources capable of delivering -

sufficient energy to damage or Ignite cables.

b) ' discrepancies between redundant circuits may exist. Identify areas of the pj c) Identify any physical hazards which may exist for the circuits identified in a) and b) l above.

4.6 Changes Required to the Plant '

The preferred method of assuring circuit independence for redundant safety related circuits is the current license basis presented in the FSAR. For cases where the required separation has not been maintained, specific actions and engineering evaluations are 4 required. To further improve the plant safety margin, future NNS cables installed in raceways with Class 1E circuits will be protected to lower the common failure probability due to the NNS cables. The required actions are specified in Section 8.0. ,

i l

A\ TRANSFER \TE172-97.RVO

TE 172-97 I Revision 0 Page 14 of 42 5.0 HAZARDS CONSIDERED FOR ASSESSMENT 5.1 Identification of Hazards To facilitate this assessment, the general hazard categories identified by IEEE 279-1968 are expanded to list the specific hazards present in the Maine Yankee plant. Unsafe environmental factors and physical consequences will be identified or demonstrated to be non-existent by this assessment. Faults or failures of circuits in any area will be assessed l

to assure that potential faults of sufficient magnitude to damage adjacent circuits are provided with double overcurrent protection sized to protect the cable.

A) Decouple the effects of unsafe environmental factors

1. Fires l 2. Floods l

I

3. Missiles

4. Carts, Forklifts, Man lifts, Trucks, and similar traffic

5. Heavy Loads l

6. Electromagnetic Interference (EMI)

7. Seismic Events  !

l 8. Lightning  !

9. Strong Winds and Tomados l

B) Decouple the effects of electric transients

1. Excessive heating

2. Metal Splatter

3. Electromagnetic Interference (EMI)

4. Missiles

5. Cable or wire induced fires C) Decouple the effects of physical accident consequences documented in the design basis

1. Fires

2. Harsh (accident) Environment

3. Pipe Whip

4. Jet Impingement 1

5. Missiles D) Reduce the likelihood of interactions between channels during maintenance operations

1. Insulation Damage

2. Short Circuit

3. Accidental Removal from Service E) Reduce the likelihood of interactions between channels in the event of a channel malfunction.

1. Excessive heating

2. Metal Splatter

3. Electromagnetic Interference (EMI)

4. Fires A:\ TRANSFER \TE172-97.RVD 1

, . _ . --- _ . = .

l TE 172-97 Revisien 0 l Page 15 of 42 l This extensive list can be reduced to the following six hazard categories for detailed l analysis:

1) Circuit fault or operation causes electromagnetic interference to adjacent Class i 1E circuits

2) Circuit fault causes damage to adjacent Class 1E circuits

3) DBE (other than fire) and any resultant harsh environment damages circuit or utilization device.

l 4) Fire DBE damages circuit i

5) Miscellaneous hazard initiated by something other than a DBE damages circuit or utilization device.

6) Maintenance or installation activities damage circuit or utilization device.

5.2 Existing Plant Design Features Which Address Hazards The existing plant design features which protect circuits from the postulated hazards are identified in this section . This section also discusses the level of protection provided by the originallicense/ design separation requirements specified in FSAR Sections 7 and 8 for each hazard.

5.2.1 Electromagnetic Interferencn (FMI) l Instrument circuit cables are designed to 3rovide sufficient protection against EMI such that safety functions are not degraded be ow an acceptable level. The original instrumentation cable specification MYS-3268 (Reference 8) specifies that the cable be constructed with twisted pairs or triads. After twisting, extemal noise is reduced further by a total coverage shield consisting of aluminum backed Mylar tape with a bare solid copper drain wire. Specification MYPS-14 (Reference 9), which was written to supersede MYS-3268 and include more rigorous environmental performance requirements, includes the same specification for twisting and shielding. MYPS-14 is the current instrument cable purchase specification.

Control logic circuits at Maine Yankee make use of conventional relays which are not susceptible to the EMI levels found in a power plant environment. Many relay circuits contain noise suppression diodes or networks. The control rod drive power circuits have been modified to included noise suppression networks to reduce overall EMI levels that the safety related channels are exposed to.

Standard industry technologies with low noise sensitivity are used. Digital control systems are not used for safety related systems. Sensitive circuits, such es radiation monitors use coaxial or triaxial cables. Excore NI cables are protected by steel conduit or equivalent EMI protection for their entire route (FSAR Section 8.3.7.5).

The metal barrier between redundant instrument circuits was not installed to provide EMI protection because the adjacent instrument circuits are not potential noise sources.

I Service separation requirements state that instrument circuits are installed in raceways I

separate from control and power circuits. Design specifications, not included in the FSAR, A:\ TRANSFER \TE172-97.RVD

i- ,

TE 172-97 l Revisi::n 0 i Page 16 of42 state that instrument circuit cables are twisted and shielded to attenuate EMI. The service l sepa, ration and cable specifications provide the required EMI protection for instrument l circuits i

5.2.2 Circuit Fanit Damage i t

A) Excessive heating l Cables subjected to fault conditions could generate excessive heat if the fault current is  ;

of sufficient magnitude and duration. If the fault is not cleared, cable damage or cable  ;

{ ignition can occur. In this case, adjacent cables may be damaged and their associated safety systems rendered inoperable if a means of preventing the cable damage is not provided. As stated in FSAR Section 8.3.7.8, the use of correctly sized overcurrent ,

- protection devices provides an acce ) table method to ensure that circuits faults will not  !

result in cable damage. The origina Maine Yankee design utilizes overcurrent devices i as one method to ensure the electrical independence of safety systems.  !

Protection from normal circuit heating is provided by the cable and wire specified for i circuits throughout the plant. The des,ign specifications require that the cables and wires are selected and installed to function within the normal operating conditions. Instrument and control circuits operate at levels which are well below the cable design limits, 3roviding additional margin to ensure circuit integrity. Some power cables have very ittle margin and occasionally operate at their design limits. Circuits located near Class 1E circuits in the plant must be protected to ensure that cable damage does not occur.

Instrument Cables Instrument cables have the following specifications:

MYPS 14 Voltage rating of 300 volts.

90 degrees C (194 F) conductor temperature MYS 3268 Voltage rating of 600 volts.

75 degrees C (167 F) conductor temperature MYS 3683 Voltage rating up to 2300 volts. (Coax Cable) 50 degrees C (122 F) ambient temperature ,

Instrument cables operate at very low energy levels with low fault potential, and, as such, are not hazards to other cables. This conclusion regarding the heating potential presented by instrument circuits will be documented by Reference 11.

1 Control Cables Control cables have the following specifications:

MYPS 12 Voltage rating of 600 volts.

90 degrees C (194 F) conductor temperature  !

MYS 3712 Voltage rating of 600 volts (Silicone Insulation) i 125 degrees C (257 F) conductor temperature MYS 3893 Voltage rating of 600 volts (CEDM Position Indication) ,

76 degrees C (167 F) conductor temperature

! MYS 1796A Voltage rating of 1000 volts

- 75 degrees C (167 F) conductor temperature A:\ TRANSFER \TE172-97.RVO 1

4-

l. TE 172-97  !

i Revision 0 -l l Page 17 of 42 ' l 1 1 i

Control cables operate at low current levels and are typically provided with circuit l prot x: tion rated between 1 and 35 Amps. The circuit fault potential of control circuits

! which may be routed near Class 1E circuits must be evaluated to determine if fault  !

conditions may result in circuit damage. Circuits classified as control circuits which ,!

are postulated to have sufficient fault potential to damage the cables must be treated  ;

in the same manner as the power cables discussed below. The fault potential presented by each type of control circuit will be documented by Reference 11.

j i.

Power Cables 3 Power cables have the following specifications:  !

MYPS 12 Voltage rating of 600 volts.

90 degrees C (194 F) conductor temperature ,

MYS-3859 Voltage rating of 600 volts.

90 degrees C (194 F) conductor temperature MYS-3860 Voltage rating of 600 volts. J 90 degrees C (194 F) conductor temperature j MYS-3912 Voltage rating of 600 volts.  :

125 degrees C (257 F) conductor temperature MYS-1110 Voltage rating of 5000 and 8000 volts 90 degrees C (194 F) conductor temperature Power cables are selected and installed to ensure that they operate within their specified design parameters during normal operation. The sizing criteria considers equipment load requirements, ambient conditions, and the installation configuration.

The specified cable conductor temperature, cable configuration, and the conductor matenal and size provide the starting point capacity for the cable.

Cables required to olarate at elevated temperature (harsh environment conditions) have been evaluatecl to ensure that they have adequate design life to perform the safety function in the harsh environment (Reference 13).

Power cables must be provided with aaec uate overcurrent protection that will prevent cable damage in the event of a circuit fau t.

Switchboard Wire (SIS)

MYS-1546 14AWG (minimum) with 31 mils XLPE insulation, gray General Electric Vulkene, SI-57275 (From original control panel specification)

Field checks indicate that the switchboard wire has a voltage rating of 600 volts, and a maximum 90 degrees C (194 F) conductor temperature. This wire is used for control and instrument circuits. The fault potential of control and instrument circuits is discussed above.

The metal barrier separation design provides limited protection from circuit over-heating by acting as a heat-sink and delaying heat transfer. Correct sizing and installation of cabies and overcurrent devices provides assurance that excessive heating will not occur.

AATRANsFER\TE172-97.RVO

r _ ._ _ _ . _ .._. _ . _ _ _ _ _ _ . - _ . .

I TE 172-97 l Revision 0 i Page 18 of 42 s

l B) Fires Caused byLircuit Faults A cable fault which is not caused by a design basis event, but results in a fire, is treated in the same manner as the fire DBE. Faults caused by a DBE are identified by the

, evaluation discussed in Section 5.2.3. A simultaneous DBE and multiple Class 1E i

circuit faults not caused by the DBE is not considered to be a credible event for this analysis. For a Class 1E circuit to become a hazard, a random fault must be postulated at the utilization device and, therefore, the Class 1E breaker would function to clear the '

fault. For conservatism in this assessment, all NNS circuits are assumed to fail, le of their exposure to the DBE. This consideratien is revisited in more detailin Cable (or wire) damage potential is established by considering the following factors: .

1) The current producing capability of the power source to which a cable is  ;

connected, such as transformer size, battery size, inverter rating, etc. (Definition l of Fault Potential)  ;

2) The type, size, and length of cable l

, ,, 3) Overcurrent protection provided for the cable To determine the potential for circuit fault induced fires, a circuit fault analysis must be 3erformed for circuits routed with Class 1E circuits which do not meet the current license 3 asis separation requirements.  ;

FSAR Section 8 defines three general types of cables; instrument, control, and power. l The FSAR also states that only power cables have sufficient fault potential to cause  !

fires. No reference is provided for the technical basis of this FSAR statement. Because this information is not available, a discussion of control and instrument circuits has been included in this assessment.

The sequence of the analysis is described by the attached figures. Figure 2 represents the entire population of cables in the plant. Cable fault potential for each of the cables must be determined as follows: ,

Instrument cables:

Instrument circuits transmit a varying voltage or current signal which is re 3resentative of a process or function. Instrument cables operate at very low energy leve s with low fault sotential. Typical instrument loops are protected by a 1/32 amp fuse and operate at ess than 50 volts. Radiation monitor circuits may operate at voltages as high as 2000 volts but current is restricted by the power supply to less than 10 milliamps. The energy required to damage adjacent circurts is not present in an instrument circuit. An evaluation of the fire hazard potential of instrument circuits will be documented by Reference 11.

ControLCables:

Control circuits provide on/off state control for utilization devices. Control circuits also include 120/125/240 volt power supply cables to panels, small motors, and similar devices, following the current FSAR definitions (Reference 2). Control circuits in critical plant areas must be evaluated to identify the control circuits with cable damage potential. The criteria for control circuit review is provided in Section 7. An evaluation of AATRANsFER\TE172-97.RVO

TE 172-97 i Revision 0 I i Page 19 of 42

] the fire hazard potential of control circuits will be documented by Reference 11.

Power Cables-2

Power circuits have the greatest potential to damage redundant Class 1E circuits. '

Power circuits include 480,4160, and 6900 volt circuits, as well as some 125 volt battery '

i circuits. For this review, power circuits in critical plant areas must be evaluated to identify the power circuits with cable damage potential. The criteria for power circuit

, review is provided in Section 7. ,

The original separation design provides protection from fires caused by circuit faults by

the defense-in-depth provided by the barriers in concert with circuit protection (FSAR i Section 8.3.7.6) and the fire protection systems. The metal barriers delay fire l

propagation from one safety channel to the next long enou l

systems to extinguish the fire (Reference 7). Additional sa1;;h ety margin for thebysuppression is provided the t altemate safe shutdown system, which makes use of independent systems separated

] from the normal safe shutdown systems by three hour rated fire bamers. '

l C) Metal Splatter I

Metal splatter may occur due to the melting and rapid expansion of cable or wire materials during a fault. Where cables are found to have a fault capability sufficient to .

fail catastrophically, and the original separation criteria is not met, the failure must be '

j piecluded by double overcurrent protection. i I

The original separation design provides protection from metal splatter with metal barriers and circuit protection. l D). Missiles E!cctric transients in circuits or utilization devices will not generate missile hazards of sufficient energy to damage adjacent circuits. Large electrical devices are contained by metal cabinets. Over-speed conditions resulting in the failure of rotating equipment caused by a circuit fault are bounded by the discussion of miscellaneous mechanical failure hazards evaluation discussed in Section 5.2.3.B below.

5.2.3 DBEHn7mrds Other Than Fire A) Harsh (accident) Environment

' Maine Yankee has an Equipment Qualification (EQ) program to maintain compliance with 10CFR50.49. Equipment (and cables) required to mitigate an event are qualified for the most severe conditions in which the equipment must operate (Reference 13).

Each of these components have been demonstrated by testing or analysis to function in the postulated environment. Class 1E equipment not requirec to mitigate the event (and, therefore, not included in the EQ program) subjected to the harsh environment is assumed to fail as a direct result of the event. This DBE related failure is assumed to result in circuit faults. All NNS circuits are assumed to fail coincident with a DBE for this assessment.

Class 1E circuits identified to have cable damage potential as described in Section 5.2.2  !

are assessed to determine DBE damage based on their location in the plant. Circuits i located entirely outside of the harsh environment areas described by the EQ Program AaTRANsFER\TE172-97.RVO l

TE 172-97 Revision 0 Page 20 of 42 Manual (Reference 13

. from further analysis.1are i he post-DBE not harsh subjected environment to thisareas hazard are: and, therefore, may be excluded

. Reactor Containment

. Primary Auxiliary Building

. Containment Spray Pump Area

. Steam and Feedwater Valve House

. Turbine Building Area in cases where equipment may be subjected to the harsh environment, a fault is assumed to occur as a direct result of the DBE.

The on'ginal separation design provides protection from the harsh environments created by a DBE with a combination of design features. Where such hazards may impact circuits and result in circuit faults, overcurrent protection is provided. The metal barrier prevents the failure of a single circuit protection device from damaging more than one

, safety channel.

B) ' Pine Whip; Jet Impingement, Missiles The general plant design locates cable raceways away from potential pipe whips (and similar hazards). A significant percentage of safety related cables are routed in protected areas such as encased duct banks, the protected cable tray room, cable vault, and penetration rooms, which do not contain pipe whip hazards. Field walkdown and evaluation of areas containing potential pipe whip hazards has been completed in accordance with Procedure MYPTP-21 (Reference 14). Class 1E equipment which is postulated to be damaged by pipe whip must be evaluated to ensure that required mitigation functions are not lost (see Section 7.0).

NNS circuits are not specifically evaluated for pipe whip hazards. NNS equipment located in areas containing high energy piping are assumed to fail because of direct impact or the resultant environmental conditions. Therefore, specific types of damage need not be evaluated individually. Class 1E components not in the EQ program but subjected to the DBE environment are assumed to fail due to the harsh environment.

The original metal barrier separation design provides no direct circuit protection from pipe whip or missile damage. Circuit faults which may result from this type of hazard represent secondary hazards are prevented from disabling the redundant safety systems as described in Section 5.2.2 above.

5.2.4 Fire Hn7ards A comprehensive fire protection system is provided and maintained throughout Maine Yankee. Fire protection is provided for exterior areas by hose stations. The Fire which have been implemented )at Maine Yankee. One of the pnnciple fire prot objectives is to maintain the capability to safely shut down the plant if fires occur. The fire protection systems ensure that safe shutdown capability is maintained, and has been reviewed and approved by NRC (Reference 7).

, Transient fire sources are controlled by procedure. In-situ combustible loading is described for each fire area in the Fire Hazards Survey. Altemate shutdown capability is A$ TRANSFER \TE172 97.RVO

- - - . . - - - . . . -.- . - - - - . _ . ~ . -

TE 172-97 i Revisisn 0 l . Page 21 of 42 j;

provided as described in the Appendix R Program Manual (Reference 20) for large area p fires. '

A detailed evaluation of each fire area at Maine Yankee was performed in the early *

, 1980's to determine the extent of conformance to Appendix R safe shutdown critena.

! This evaluation revealed several areas ofinadequate cable separation. As a result, an  :

l altemate safe shutdown system, including a dedicated power supply, was added to 1 enhance the plant's safe shutdown capability. At the same time, installation of the

! altemate safe shutdown system closed open items from the 1977 fire protection inspection report (Reference 7) regarding safe shutdown capability.

The original separation design provides protection from fires as described in Section 5.2.2.B, which discusses fire hazards which may result from circuit faults.

5.2.5 blon-DBElliscellaneom Hmrds

[ i

! Non-DBE failures affecting redundant trains of safety related equipment are not assumed

[ to occur simultaneously with a DBE. In this case, safe shutdown can be achieved using j j undamaged shutdown equipment or the altemate safe shutdown system.  ;

i l ~ A) Floods

Floods resulting from a DBE are considered in the EQ analysis resulting from automatic fire suppression system actuation have(Reference been evaluated within 13). F

the fire protection program. Cable tray systems in general are elevated and not j susceptible to flooding. Exceptions to the general rule are the trays in the tunnel under the turbine building floor for cables to the diesel generators, and the trcys in the cable

vault, in these areas, seals and curbs have been provided to keep any flood water out.

! Underground duct banks are sloped to prevent the accumulation of groundwater. Cable j insulation and Jacket materials are specified to perform in both wet and dry (non-4 accident) environments. (Reference the cable specifications previously listed) t Flooding is mitigated to prevent damage to Class 1E equipment by the following

!j methods:

1

.

• Protected areas for Class 1E equipment p = Sump Pumps and Alarms  ;

. . Automatic Pump Trips when Flooding is Detected 1

. . Operator Rounds and Inspections for early detection of leaks L

The original separation design provides protection from the possible effects of flooding

by locating raceways above the postulated flood hazards.

i

) B) Missiles F ,

A significant percentage of cable raceways are located away from missile hazards.

Safety related cables are primarily routed in missile protected areas such as encased duct banks, protected cable tray room, cable vault, and penetration rooms. Field  !

i walkdown and evaluation of potential missile hazards has been completed in

accordance with Procedure MYPTP-21 (Reference 14). This walkdown evaluated l l

l missile sources such as valve stem ejections and catastrophic failure of rotating 1

A:\ TRANSFER \TE172-97.RVO

i TE 172-97 Revision 0  :

Page 22 of 42  ;

equipment such as pumps and fans. A failure modes and effects analysis (FMEA) must  !

be preformed for each of the identified Class 1E targets. Recommended actions, as required will be specified by the FMEA (Reference 23).

l The original metal barrier separation design provides protection from the circuit faults

which may be caused by missiles as described in Section 5.2.3.B.

I f

C) Carts. Forklifts Man lifts. Trucks. and similar traffic C able raceways are located away from traffic hazards. This is primarily accomplished by elevating trays, using underground duct banks, protected cable areas, and rigid metal conduits. Field walkdown and evaluation of potential traffic hazards has been completed in accordance with Procedure MYPTP-21 (Reference 14). A failure modes 1 and effects analysis (FMEA) must be preformed for each of the identified Class 1E I targets. Recommended actions, as required will be specified by the FMEA (Reference 23).

l The original separation design provides protection from the possible effects of vehicles or traffic by locating raceways away from such hazards. The metal barrier provides no l.

additional protection.

4 D) Heavv Lands a

Heavy loads in plant areas containing equipment required for reactor shutdown, core i

decay heat removal, or spent fuel pool coo;ing have been reviewed to determine their mtential to impact plant safety. The results of this review are contained in the Heavy

_oads Source Document Reference 16). A field walkdown has been completed to identify any changes to th(e heavy load hazards in accordance with Procedure 21 (Reference 14).

The original separation design provides protection from the possible effects of heavy loads by locating raceways away from such hazards. The metal barrier provides no additional protection.

E) Seismic Events Safety related cables are routed through Class 1 structures or Class 2 structures which been evaluated to eliminate seismic 2-over-1 concems, which are designed to maintain their integn'ty during the hypothetical earthc uake. Supports for Class 1E installations, including cables are not considered Class ' E because they do not perform an electrical safety function. Suppo ts are specified to accommodate the design loads and are procured as Level 1 or Level 2 (QAR) to ensure material acceptability. The use of NNS material is acceptable when a : companied by engineering specified testing (Reference 12). j l

As part of a NRC seismic margins research effort, Maine Yankee agreed to be evaluated for a greater-than-design earthquake as described in Re"erence 12. This report identifies cable and wire as "not seismically sensitive parts." Cable trays, conduits, control panels, instrument racks, electrical distribution systems were accepted by the walkdown reviews performed to support the seismic margin review.

l l

A:\ TRANSFER \TE172-97.RVO

TE 172-97 i Revision 0  :

Page 23 of 42 ,

c The original separation design provides protoction from the possible effects of t

earthquakes by locating Class 1E cables in Class 1 structures or evaluated Class 2  ;

f- structures and by adequately supporting cable raceways. The metal barrier provides no f j additional protection or seismic support. '

l F) I lahtnino l i .

! Circuit damage which may be postulated to be caused by lightning is bounded by the f discussion of circuit faults in Section 5.2.2.B. Further assessment is not required.

I 1

G) Strong Winds and Tornados 1 .

l Circuit damage which may be postulated to be caused by strong winds and tomados is i

4 bounded by the discussion of missiles and traffic damage discussed for missiles and vehicle traffic in Sections 5.2.5.B and C above. Further assessment is not required.

j; 5.2.6 Maintenance and installation Havards A) Inanistion Damage e Cable and wire installation standard MYSTD-ELEC-1 (Reference 17) requires that cables are routed only in raceways which are inspected to assure that they are free of burrs and sharp edges or any other damage prior to pulling cables. New cables are

' installed following pull tension limits and are tested for conti and insulation integrity before they are placed in service. When cables are removed m raceways containing other cables (pull-by), MYSTD-ELEC-1 requires that adjacent safety related cables are identified and evaluated. These controls ensure that adjacent cables are not damaged and that the safety functions of all affected cables are not degraded.

Cable tags uniquely identify safety related circuits so that they may be distinguished from NNS circud. 02ie numbers further identify the channel or train assignment of the i safety related cables. Reference drawings or knowledge of the cable code system is  !

required. Labels are provided to identify cable trays and scheduled conduits which contain Class 1E circuits. Maintenance workers are trained to take extra care when a working on or adjacent to safety related cables and components (Reference 24).  ;

The controls discussed above, combined with post-maintenance functional testing requirements specified by the work order procedure (Reference 18), reduce the i likelihood that redundant safety systems will be damaged.

The original metal barrier separation design provides a conductive barrier between redundant safety related circuits. In most configurations, the metal barriers are i grounded by incidental contact with cable trays, conduits or support structures. i Grounding of the separation barriers was not required because the barriers are installed for separation, not electrical protection, as stated in original construction documents (Reference 2). Furthermore, the metal barriers in transition areas were installed after the cables were installed during plant construction, and, as such, are not intended to prevent insulation damage dunng installation.

In the unlikely situation of insulation damage to adjacent redundant safety related circuits, the following may be postulated.

A$ TRANSFER \TE172-97.RVO

4 TE 172-97 i Revision 0 i Page 24 of42 i

1) - Both circuits short to ground. This is the most likely situation with or without the i

metal barriers. For grounded power and control circuits, a single short to ground .

can disable the effected circuit. For ungrounded circuits, multiple shorts to ground are required to disable the effected circuit. The protective channel and i safeguards logic circuits are ungrounded and are provided with ground detection i alarms.

j 2) Circuits short to each other. This can happen with or without the" metal bamers '

j present because the barriers are installed for physical separation need not be

prounded. Specific circuit shorts (smart shorts) may cause unwanted ,

j interactions between safety channels in both grounded and ungrounded circuits.

i j The original metal barrier separation design reduces the likelihood of damaging adjacent l safety related circuits at the same location during maintenance activities. Where the

original separation requirements are not met, compensating measures are in place to 4

maintain the independence of the safety systems, as desenbed in Section 7.

} B) Short Circuits J Short circuits due to maintenance activities may occur anywhere in the circuit between i the utilizing device and the power source. Short circuits due to maintenance activities

are most likely to occur at the exposed terminals of the circuit components, rather than i in the cables and wires routed between devices. The resultant hazards are discussed

[ as Circuit Fault Damage in Section 5.2.2.

i The metal barrier design does not provide protection from maintenance induced short circuits in control panels. Control devices are arranged in the control panels to suit i operational needs, not to provide separation. The likelihood of short circuits due to

} maintenance is reduced by control of maintenance activities and the training of maintenance personnel. The attemate shutdown system provides increased safety

margin by providing a third train of safe shutdown systems when postulating short circuits due to maintenance activities.

C) Accidental Removal from Service Field cables may be removed from service only at the load center, control panel,  ;

junction box, or containment penetration. Removal from service is controlled by the I equipment tacmut procedure (Reference 19) or ap 3 roved operation or surveillance procedures. Yhe controls provided by plant procec ures help to preclude accidental  ;

removal from service. Safety systems are design to facilitate maintenance on one '

- channel without affecting operation of the opposite channel. Circuits are identified to assure that the correct circuit is removed from service.

The original separation design provides no protection against accidental removal from service. Protection is provided by circuit identification, training of the craft performing the maintenance, and administrative controls.

D) SpeciaLconsiderations for the Main ControlBoard The Main Control Board (MCB) and other control room panels contain a dense population of redundant Class 1E circuits. As a result of the quantity of equipment in AATRANSFER\TE172-97.RVO

- . . . - . . ~ . . . -- -. - - - . _ .- - - . - . - - . . - . - _ - - . ~ . - . - .. . .-

TE 172-97 Revision 0  !

Page 25 of 42 ,

this area, the MCB is the site of many maintenance and surveillance activities. The potential for maintenance hazards in this area is greater than any other plant area.

, i The original separation criteria provides for physical separation between redundant i safety channels to maintain the independence of safety functions. The two inch criteda j applied to Maine Yankee reduces the possibility of damage to redundant safety related '

circuits. The separation criteria reduces the likelihood that redundant channels will be damaged to the point of not being able to perform the safety function during ,

maintenance activities. )

Maintenance activities performed in areas where redundant channels are in close proximity present a potential for damage to redundant channels of adjacent safety  ;

related circuits. This could occur in any mode of plant operation. Section 7.6.1 1 assesses these activities with regard to current work practices and identifies the

! compensating measures in place to maintain the independence of redundant safety 3 l

systems.  !

l  !

5.3 Summary of Protection Provided by the Metal Barrier System in the context of this assessment, the metal barrier system refers to the se ration design

! requirements of the current license basis other than circuit protection and physical plant i i location design features provided by the original plant design. The protection provided by j the meta l bamers is summarized below as a point of reference for the new separation requirements specified by this assessment. It is important to note that discrepancies identified following the msthods set forth by,this assessment (such as HELB damage) not l related to the metal barrier separation critena must be resolved to conform with the current l license basis. This summary of protection is the bench-mark for the 10CFR50.59 determination to change the FSAR to include the additional separation requirements.

5.3.1 Electromagnetic Interference (EMI)

The metal barrier between redundant instrument circuits was not installed to provide EMI protection because the adjacent instrument circuits are not potential noise sources.

5.3.2 Circuit Fault Damage 3

. A)- Overheating: The metal barrier separation design provides limited protection

! from circuit over-heating by acting as a heat-sink and delaying heat transfer from one side of the tray to the other.

B) Fire caused by circuit faults: The original metal barrier separation design provides only hmited protection from fires caused by circuit faults.  !

C) Metal Splatter: The original metal barrier separation design provides limited protection from metal splatter caused by circuit faults.

D). Missiles: Over-speed conditions resulting in the failure of rotating equipment

!- caused by a circuit fault are bounded by the miscellaneous failure hazard

! evaluation discussed below.

1 A$ TRANSFER \TE172-97.RVO

TE 172-97 Revision 0

- Page 26 of 42 5.3.3 DBE Hm7mrds Other Than Fire A) Harsh (accident) Environment: The original separation design provides protection from the barsh environments created by a DBE with a combination of design requiremants. Where such hazards may impact circuits and result in circuit faults, fault protection is provided for each circuit by a circuit breaker or fuse. The metal barrier prevents the failure of one circuit protection device from damaging more than one safety channel.

B) Pipe Whip, Jet impingement, Missiles: The original metal barrier separation design provides protection from pipe whip or missile damage as described in Section 5.3.3.A.

5.3.4 Fire Hm7mrds The original metal barrier separation design,provides protection from fires when I combined with defense-in-depth fire protection measures.

5.3.5 Non-DBE Mismilaneous Havards A) Floods: The original metal barrier separation design provides no protection from the possible effects of flooding.

B) Missiles: The original metal barrier separation design provides protection from the possible effects of missiles as described in Section 5.3.3.A.

C) Carts, Forklifts, Man lifts, Trucks, and Similar Traffic: The original metal barrier separation design provides no protection from the possible effects of vehicles or traffic.

D) Heavy Loads: The original metal barrier separation design provides no protection from the possible effects of heavy loads.

E) Seismic Events: The original metal barrier separation design provides no protection from damage from seismic event.

F) Lightning: The original metal barrier separation design provides only limited protection from damage caused by lightning.

G) Strong Winds and Tornado: The original metal barrier separation design provides no protection frorn the possible effects of strong winde and tomados.

5.3.6 Maintenance and Installation Hm7mrds A) Insulation Damage: The original metal barrier separation design reduces the likelihood of damaging adjacent safety related circuits at the same location.

B) Short Circuits: The metal barrier design does not provide protection from maintenance induced short circuits in control panels. Control devices are arranged in the control panels to suit operational needs.

A:\ TRANSFER \TE172-97.RVO

i TE 172-97 t Revision 0 Page 27 of 42 C) Accidental Removal from Service: The original metal barrier separation design provides no protection against accidental removal from service.

5.4 Selection of Critical Plant Areas Cntical plant areas are defined as those areas which contain safety related circuits or compor.ents. Where it is c!aar that no safety related circuits are present, the effect of circuit failure or hazards to circuits in the area do not require further evaluation. Faults I which may propagate from a non-critical area to a critical area are considered to occur unless they are )revented by approved double overcurrent circuit protection. In certain areas, such as t1e Turbine and Service Building, the critical areas identified are not -

bounded by walls or structures, but are defined by the distance between the postulated hazard and the nearest safety related circuit. 'Nhen it is not obvious that the safety related circuits are separated from a hazard, or protection from the hazard has not been installed, the hazard is assumed to negatively impact the circuit.

Areas defined as Critical Areas:

. Cable Vault

. Protected and Unprotected Cable Tray Rooms

. . Protected Switchgear Room

. Main Control Room

. Protected and Unprotected Cable Chase

. Reactor Containment Building

. Spray Pump Building

. Reactor MCC Building

• Primary Auxiliary Building

. Circulating Water Pump House (Note 1)

Turbine Buildin (Note 2)

. Service Buildin Note 2)

. Emergency Fe water Pump Room (Altemate Shut Down Panel)

. Main Steam and Feedwater Valve House

. Containment HVAC Area

. Fuel Storage Building

. Diesel Generator Rooms Note 1: All safety related circuits in this area are enclosed in conduit or duct bank.

Note 2: Certain areas in these structures do not contain safety related circuits.

A:\ TRANSFER \TE172-97.RVO

TE 172-97 Revision 0 Page 28 of 42 6.0 ASSESSMENT OF HAZARDS AND SEPARATION DISCREPANCIES Table 2 presents a summary of how each of the six types of cable hazards identified may 1 impact Class 1E cables at Maine Yankee. The analysis crodits the physical location of cables and components for protection from specific hazards. No credit is taken in this  ;

assessment for the metal barrier separation system employed during plant construction. It I is important to note that although numerous separation discrepancies were identified, the '

i barriers do exist and most cables are physically separated in accordance with the original

design requirements. l 6.1 Circuit Routing l Class 1E circuits must be protected from all hazards to ensuie that redundant systems are L not disabled by a single event. The hazard to a Class 1E circuit may be a physical hazard or an electrical hazard from adjacent Class 1E circuits from the opposite safety train. As the original design for Maine Yankee places NNS circuits in the same raceways as Class 1E circuits, all NNS circuits are potential hazards to Class 1E circuits if the metal barriers l are providing the only method to achieve independence.

6.2 Circuit Fault Potential Circuit fault potential must be evaluated for circuits near Class 1E cimuits to eliminate the potential for cable damage. Any circuit with cable damage potential is assumed to be a potential hazard to adjacent Class 1E circuits.

6.3 Circuit Location This assessment makes use of several general plant design features to facilitate the analysis. MCC load centers are distributed throughout the plant as a matter of economy and convenience. An additional benefit from this design is that entire NNS power distribution centers and hundreds of circuits are located solely in areas which do not contain any safety related components. A detailed analysis of these circuits is not required because their failure will have no impact on safety related systems. ,

The physical separation between cables and DBE hazards reduces the number and .!

location of potential interactions to limited plant areas. The Appendix R altemate safe shutdown system circuits are separated from normal shutdown circuits by three hour rated fire baniers and do not credit the metal barrier separation system.

i l

l AATRANSFER\TE172-97.RVO

_ _ _ _ _ _ _ . _ _ _ _ . _ . _ _ _ _ . _ . . _ ~ _ _ _ _ . . _ . _ _ _ _ _ _ . _ _

TE 172-97  :

Revision 0 Page 29 of 42 7.0 DEMONSTRATE ELIMINATION OF CIRCUlT HAZARDS t 7.1 Electromagnetic Interference (EMI) l l

l In a power plant environment, EMI from various sources can not be eliminated. Class 1E i circuits must be protected from the EMI hazard. T he Maine Yankee plant design for  !

instrument circuits provides the necessary protection. )

The original design required instrument field circuits to be routed separate from control and

)ower circuits. In control panels, control and instrument cables are not separated. This is n accordance with the control panel design requirements. Operating experience has proven this to be a sound design practice. The length of circuit runs within control panels typically will not exceed 30 feet based on component layout, thereby reducing the coupling j

! of noise from control circuits to adjacent instrument circuits. Twisting and shielding is not >

maintained within control panels to the board instruments.

l During the cable separation walkdowns, control cables were found to be routed in '

instrument raceways, in a few instances. In addition, numerous cases where instrument circuit would touch or come close to control circuits in cable transition areas were identified. For the latter, the total cable length which could be affected is very small, and is bounded by the estimated 30 foot runs of instrument and control circuits within control panels. As such, the noise which may be coupled to an instrument circuit in a transition will be less than that which would occur in control panels. This type of interaction will not degrade safety system function below an acceptable level. For those cases where control

cables were found to be routed with instrument circuits for long distances (some exceeding i

200 feet), an evaluation cf the safety significance was documented in TE 18-97 L (Reference 25). Such cases were found to be acce stable, provided the affected instrument circuits are propedy shielded and grounced. The grounds of the affected circuits must be verified to be intact, or be repaired, as part of the walkdown discrepancy resolution process.

7.2 DBE/HELB Analysis j A walkdown of plant areas containing high energy piping and other potential hazards  !

(defined in Section 5.2.3) was completed following procedure MYPTP-21. Potential targets, including electrical cables, were identified. For each target, the affected component tag number and safety classification was stated. With this information, a failure modes and of ects analysis (FMEA) will be performed to determine if the postulated accident can be mitigated and the reactor safely shut down with the loss of equipment dynamically effected by the HELB or other potential hazards identified during the walkdown. Resultant environmental effects have been analyzed by the Maine Yankee -

environment qualification (EQ) program. Required plant modifications are specified by the FMEA (Reference 23).

l i

For NNS equipment and cables located in the plant areas included in the HELB walkdown, failure was assumed to occur due to the environment created, regardless of dynamic HELB effects.

7.3 Analysis of Fire Hazards

. The Fire Hazards Survey (Reference 15) provides a summary of the fire protection

objectives which have been implemented at Maine Yankee. One of the principle fire

! protection objectives is to maintain the capability to safely shut down the plant if fires occur. Fire protection and safe shutdown capability for NIaine Yankee is described in the Appendix R Program Manual (Reference 20) for large area fires. Transient fire sources l

l

TE 172-97 Revision 0 Page 30 of42 l are controlled by procedure. in-situ combustible loading is described for each fire area in l

the Fire Hazards Survey. .

s .

/

} 7.4 Analyels of Other Miscellaneous Hazards

The review and analysis discussed in Section 7.5 includes the overcurrent conditions j which are postulated to be caused by these types of hazards.

i l 7.5 Circuit Fault Analysis <

7.5.1 Apnlicatinn of Circuit Protectinn I

A circuit fault analysis must be performed for circuits in areas where discrepancies may .

! exist between the field conditions and the FSAR metal barrier separation requirements.

l The circuit fault analysis must evaluate the possibility of cable insulation damage or ignition due to fault currents or overloads, and shall include the following: .

a) When cable damage occurs in a Class 1E or NNS cables such that normal safe  :

shutdown systems are effected in the absence of an accident event, safe shutdown will be achieved using features provided by the altemate shut down system (Appendix R or other normal safe shutdown equipment. The Appendix R analysis demonstrates th)e capability to achieve and maintain safe shutdown following the resultant fir b) When a cable fault occurs in a NNS cable, simultaneous with an accident event, the following cases are investigated:

i) If the fault could be caused by an accident, Class 1E and QAR overcurrent devices in series are credited with interrupting the fault prior to cable damage.

The basis for acceptance of this approach is that the overcurrent protection isolates the fault (FSAR Section 8.3.7.6). Additional safety margin also exists because of the remote joint probability of: 1) having an accident, and 2) having a simultaneous failure of both the Class 1E and QAR interrupting devices.

ii) If the fault is not a direct result of the accident, a random fault of the NNS device  !

shall be assumed to occur coincident with the event. The analysis and l protection required for this case are the same as for I) above. This approach adds conservatism to the assessment given the remote joint probability of: 1) having an accident,2) having a simultaneous fault not caused by the accident, i and 3) having a simultaneous failure of both the Class 1E and QAR interrupting  ;

devices. 1 Both overcurrent devices relied upon to provide the double protection shall be orocured as Class 1E components. One device shall meet all Class 1E requirements dor the circuit protection function. Existing circuit breakers, relays, and switchgear credited in the double protection schemes must be tested and placed into a breaker maintenance or testing program, c) When the cable fault occurs on a Class 1E cable, simultaneous with an accident event, the following cases must be investigated:

i) If the fault is not a direct result of the accident because of physical location or environmental qualification, then credit will be taken for the existing protective device to clear the fault. The basis for acceptance of this approach is the

I'  !

) - TE 172-97

Revision 0 .

] Page 31 of42 l j ap plication of the single failure criteria and the overcurrent protection discussed

[ in i:SAR Section 8.3.7.6. The Class 1E device failure is the single failure for the

event, and the single Class 1E overcurrent device performs its design function i and cieans the fault before the cable is damaged. ,

[

ll) If the fault is caused by an accident or the resulting environment, two Class 1E overcurrent devices in series shall be provided to interrupt the fault prior to i

insulation damage. The basis for acceptance of this is that at least one of the ,

j FSAR Section 8.3.7.6 and single

two failureovercurrent devices criteria). Additional safety isolates margin c the fault (lso exists because of the i probability of

1) having an accident, and 2) having a simultaneous failure of two Class 1E interrupting devices. As described below, a number of circuits will be i

modified to meet the new requirement to have a second overcurrent device. in i this case, both protection devices must be Class 1E to maintain the integrity of

the Class 1E circuit function.

L i d) From b) and c) above, Class 1E circuits which are not protected from the DBE direct .

[

effects or resultant harsh environment and all NNS circuit known to have cable

• damage potential must have double overcurrent protection to isolate the cable fault

[ prior to cable damage.

!~ .e) Cables which run completely in a conduit, meet the current separation criteria and are j accepted as is because any fault would effect only the single Class 1E circuit or channel.

f) Power cables from switchgear have protective relaying which will respond to fault cunents and trip the circuit breaker before enough heating has occurred to damage the cable, as described in FSAR Section 8.3.7.6. No additional protection is required.

{ g) MCCs exposed directly to a hazard or to a harsh environment can not be relied upon i

to isolate a fault. An attemative means to eliminate a postulated fault must be i provided outside of the affected area, as described n Section 8.6.

i' 7.5.2 Double Circuit Protection Design Evninntion I Separation requirements for Maine Yankee are, in general terms, contained in the "

f FSAR. The onginal method of providing electrical independence between redundant systems includes a combination of three design features; plant location, physical separation or barriers, and electrical overcurrent protection. Any one, or a combination

! of these methods can afford adequate independence.

l During plant construction, the combined protection approach was used throughout the j plant to ensure the independence of the safety systems. Providing separation assures i

electrical system independence without the need to perform a detailed analysis of the

! aotential hazards. This method also provided an additional benefit during construction

n that the cost associated with purchasing, installing and maintaining active d-components such as circuit breakers to achieve independence in place of passive

- barriers was avoided.

i 4

Where the physical protection provided by the metal barriers or distance was found to j be degraded, more reliance must be placed on elimination of the potential hazards and

} use or electrical isolation to achieve an equivalent level of electrical independence. The indirect effects of postulated hazards, such as fault induced cable damage or ignition,

. must be eliminated. Cable ignition is a more serious subset of cable damage. For i conservatism, cable damage will be used to determine the required protection. Double overcurrent protection compensates for missing or degraded barriers by eliminating the i

TE 172-97 l Revisi::n 0

Page 32 of 42 -

L cable damage hazard which may effect power, control, or instrument cables. To implement the required protection, the existing single overcurrent device, which typically is not qualified for NNS circuits, is replaced by two qualified overcurrent devices

)roviding the same function. The double arotection must maintain the required ndependence when considering any sing e failure. ,

Two methods may be utilized to prevent cable damage:  ;

1) Increase the size of the cable so that it can withstand the fault current continuously such that cable damage will not occur. In most cases, replacing the cable is not practical and can result in other electrical system operationa problems. '

2) The practical solution to this problem is the use of overcurrent protection devices 1 which will isolate any fault pnor to the cable being heated to a )oint where  :

damage occurs. This approach is discussed in the Maine Yan <ee FSAR l Section 8.3.7.6.

The use of overcurrent protection devices will be the primary method employed to reestablish the electrical independence in lieu of physical separation. The design requirements which must be addressed to allow the use of overcurrent protec'Jon are the following:

a) The number and configuration of devices required to eliminate the cable  !

damage hazard, considering all potential single failures. ,

b) The required type of overcurrent device and the trip settings required to provide cable protection and still ensure system operability.

c) The safety classification o'ithe devices.

d) Procurement, installation, testing, and maintenance requirements.

Figure 5 shows a typical circuit installation where NNS cables are routed with Class 1E cables in each side of a barriered cable tray. This case is chosen for discussion in detail because it poses the most safety significant hazard if the physical separation is not -

• maintained. For this discussion the following is assumed:

1) The faulted circuits are not required to function to mitigate the postulated accident. ,

I All power sources are large enough to cause cable damage if the faults are not 2) cleared by an overcurrent device.

3) The overcurrent protection devices are adequately sized to prevent cable damage.

4) A physical hazard is postulated to cause a fault of the cables or the utilization devices.

1

5) The overcurrent devices are not directly subjected to the affects of the postulated physical hazard or any resulting harsh environment.

._____._____.______.y 4

1 TE 172-97 l

Revision 0 Page 33 of 42

! 7.5.2.1 Safety cin== circuit failure review

]

a) Original Design Train A and Train B circuits not required to mitigate the event are damaged, resulting in cable faults. (note that cables required to mitigate the event are not directly damaged by the event) One circuit s Class 1E overcurrent protection device is the assumed single failure. The failure of the ovsrcurrent device clear the fault) results in cable damage. The cable damage is(the device conservatively does n assumed to affect the cables sharing the one side of the tray with the faulted cable.

The barrier protects the cables on the other side from the effects of the damaged cable. The other train overcurrent protection device clears the fault prior to cable damage and that train remains operable, b)- Alternative Method The situtuation is the same as described above, except that the separation provided

. by the tray baniers is assumed to be degraded. The equivalent level of electrical independence will be achieved as follows:

Train A and Train B circuits are damaged resulting in cable faults. The physical separation provided by the tray barriers can not longer be relied on to prevent damage to the other train cables in the event of a failure of one of the Class 1E overcurrent device. To compensate for the missing barrier, a second level of protection is required. This second level of protection must also be a Class 1E device. Because the postulated single failure for the event is the first overcurrent device, the second device will clear the fault prior to the cable being damaged.

7.5.2.2 NNS claaa circuit failure review a) Original Design NNS circuits on both sides of the barrier are subjected to fault conditions. The '

overcurrent protection devices for the circuits are NNS. A failure is assumed to occur  !

at only one overcurrent device. The failure of the overcurrent device (the device does l not clear the fault) results in cable damage. The cable damage is conservatively assumed to affect the cables sharing the one side of the tray with the faulted cable.

The barrier protects the cables on the other side from the effects of the damaged ,

cable. The other NNS circuit overcurrent protection device clears the other fault prior l to cable damage and safety circuits in that tray side remain operable.  !

b) Altemative Method The situtuation is the same as described above, except that the separation provided by the tray barriers is assumed to be degraded. The equivalent level of electrical independence will be achieved as follows:

NNS circuits on both sides of the banier are subjected to fault conditions. The physical separation provided by the tray barriers can not longer be relied on to prevent damage to cables on the opposite side of the tray in the event of a failure of one of the NNS overcurrent devices. To compensate for the missing barrier, a second level of 3rotection is required. This second level of protection must be a Class 1E device 3ecause it functions to protect Class 1E circuits. The existing overcurrent protection will be upgrade to QAR. The postulated single failure for the event is the first

I TE 172-97 i Revisi:n 0 j Page 34 of 42

! overcurrent device. Therefore, the second device will clear the fault prior to the cable i being damaged.

4

7.5.2.3 Harsh environment inruatinns i in locations where circuit overcurrent protection has the potential of being subjected to i the accident harsh environment, automatic distribution bus isolation will be provided.

! Only NNS circuits are exposed to this type of hazard. When considering the postulated cable faults, circuit independence is achieved as follows:

a) Original design with barrier separation:

i NNS circuits on both sides of the barrier are subjected to fault conditions. The

! overcurrent protection devices for the circuits are NNS. A failure is assumed to occur i at only one overcurrent device. No additional considerations are made regarding the postulated environment. The failure of the overcurrent device (the device does not i clear the fault) results in cable damage. The cable damage is conservatively assumed to affect the cables sharing the one side of the tray with the faulted cable.

The other NNS circuit overcurrent protection device clears the other fault prior to cable

damage and safety circuits in that tray side remain operable, b) Barrier separation design not met and double protection required

The QAR double protection device discussed abcve is exposed the the postulated i harsh environment. Because operability in such an environment has not been

demonstrated by testing, the bus is automatically deenergized at a remote location by

{ a Class 1E actuated trip circuit. The fault is cleared on any affected cable when the i bus is deenergized. Damage to safety related cables will not occur because no cable j damage will occurin the raceways.

l 7.5.3 Summarv of Circuit Protection

!l The original cable separation design relied on physical separation and overcurrent

protection to ensure that a potential hazard would not degrade redundant safety l systems. Since NNS cables are routed with Class 1E cables, the potential exists that a

physical hazard induced electrical fault could result in a cable failure remote from the i fault location. The design relies on the two elements provided protection for safety i related cables. The primary protection is provided by the NNS overcurrent device, l which is assumed to clear the fault prior to the cable being damaged and @tential affecting safety related cables. Second,if the overcurrent device fails anc the cable is damaged, the damage is limited to as single redundant system because of the raceway bamers.

Where the physical protection provided by the metal barriers or distance was found to be degraded, the potential hazard is eliminated by double overcurrent protection.

Assuming the failure of the first overcurrent device, the second, redundant, overcurrent protection device will clear the postulated fault before cable damage occurs. By clearing the fault, the cable hazard does not exist, and, therefore, the barrier (or lack of barrier) is not challenged. In all cases, safety system independence is maintained.

TE 172-97 Revision 0 ,

. Page 35 of 42 7.6 Analysis of Maintenance Hazards 7.6.1 Main control Bnard and control Panels l

l Inspections were completed and documented following work order instructions (Reference 10). Controlled wiring drawings were used to identify safety related circuits.

Instances where opposite channel safety related circuits do not meet the specified 2 inch separation critena were discovered. In addition, in many areas the separation can not be determined because of the use of gray SIS wire without any distinguishing marks.

Each of the safety related circuits identified on the controlled wiring drawings have been l

color-coded inside the control panels. This effort identified the safety related circuits at 3 the panel component termination and at control panel field cable terminal blocks. In other words, the safety channel identity is clearly evident at the mest maintenance intensive areas, which are the panel mounted components and the terminal blocks.

As noted above, a number of circuits have been identified in the MCB which do not l conform to the original separation requiremerits. Though the required separation was l- found in some instances to be degraded, a number of compensating measures have l been implemented since plant construction and not reflected in the current license basis i separation requirements:

. The installation or removal of wire and cable will be prohibited in control panels which contain redundant channels of safety related circuits which may not be physically separated while the functions served by the un-separated circuits are required to be operable. Installation activities in control panels which contain redundant safety related circuits which are required to function during shutdown conditions will be controlled by the Outage Risk Management Program.

. The electrical be used Safety in energized panels. Procedure Th (is reduces the exposed conductive length o greatly reducing the likelihood of an inadvertent short circuits between redundant trains.

. Smoking is no longer allowed in the plant, reducing the overall fire hazard.

. Smoke detectors were added to the control panels in the late 1970's to enhance early detection capabilities and reduce the likelihood that redundant trains would be affected by a single fire.

. Workers performing electrical maintenance tasks are provided safety trainin before l they are allowed to enter the MCB for any activity. The training includes bot

( personnel and equipment protection requirements (Reference 24).

. Control panel wire color-coding at devices and terminal blocks has been restored

! (Reference 10).

1 i . Precautions will be added to surveillance procedures which require test equipment

connections in control panels. A two person " challenge and reply" will be used when

! making the test connections.

i . A Foreign Material Exclusion (FME) process will be established for the Main Control Board to prohibit the use of tools or objects which have the potential to damage i adjacent circuits. Insulated tools are required to reduce the likelihood of short circuits j Reference 21.

. - , . , .. ~,,.7 - .

~- '

TE 172-97 Revision 0 Page 36 of 42

. Workers assigned to perform tasks in control panels shall have documented training and experience. This specialty training is in addition to the general electrical safety training discussed above.

7.6.2 Field Cables i

Maintenance hazards to field cables include cable pulling activities as well as any other work in close proximity to or above cable raceways. The following controls have been added since the plant was designed and constructed. Each of these features reflects a defense-in depth approach to eliminating potential hazards to cables. .

. The installation or removal of cables will be prohibited through sleeves and raceways which contain redundant channels of safety related circuits which may not be physically separated while the functions served by the un-separated circuits are .

required to be operable. Installation activities in raceways which contain redundant l safety related circuits which are recluired to function during shutdown conditions will  !

be controlled by the Outage Risk N anagement Program.

. The pulling of cabling will be prohibited through sleeves and raceways which contain redundant channels of safety related cabling which is not physically separated while the safety functions served by the un-separated cables are required to be operable.

ensures that hazards are not

. Scaffolding created by erecting and Aerial Work Procedures or removing scaffolding.(Reference This proce 22) dure also ensures that scaffolding is seismically rugged to protect adjacent safety related equipment.

. Fall protection devices may not be tied off to conduits or cable trays (Reference 22).

. The Outage Risk Management Program and cutage , system work windows provide additional arotection during reduced inventory conditions and when one safety is not available c ue to maintenance activities. Detailed contingency plans must be performed to perform work in the exclusion areas prescnbed by the risk management program.

• The Work Order Procedure (Reference 18) requires a pre-job brief to discuss the possible impacts on plant safety of any task immediately before it is performed.

Seismic concems are also reviewed to protect adjacent safety related equipment when tasks are being performed, i

. A Foreign Material Exclusion (FME) process will be established in any area when cable tray covers must be removed to perform maintenance activities, and when accessing the Cable Chases or the Cable Vault for cable )ulling or any other task. ,

Personnel not directly involved with the task will be excluc ed from the area. A i cleanliness inspection will be performed prior to re-installing the cable tray cover.

. Cable trays and other raceways will be included in a periodic maintenance and inspection program to ensure that the level of protection provided by the raceways is  ;

not degraded.

TE 172-97

Revision 0 l Page 37 of 42 8.0 ACTION REQUIRED TO SUPPORT ASSESSMENT  !

The initial results of the circuit damage review have identified a number of circuits which rec uire some action be taken to eliminate the hazard that is posed to Class 1E circuits.

Tables 1 and 2 summarize the types of separation discrepancies identified in the field. The changes and analyses required to bring the discrepant circuits in compliance with the  ;

revised separation design basis are summarized here. The safety impact of the required j l modifications shall be reviewed with regard to all operability requirements of the effected ,

system by the required detailed design (EDCR) package.  ;

1 8.1 Class 1E circuits and equipment which are required to mitigate a DBE but are l not protected from the physical damage caused by the DBE will be relocated to an area not affected. This level of protection exceeds the current FSAR requirements regarding DBE damage to redundant Class 1E circuits. Circuits requiring protection will be identified by the FMEA study (Reference 23), which 1 will be tracked to closure as Leaming Bank issue Number 97-03017. l j  !

8.2 Class 1E circuits not required for mitigation and exposed to a DBE environment for which they ars not qualified must 3e provided with Class 1E double i overcurrent protection of sufficient rating in series with the existing Class 1E breaker to protect the cable. This requirement applies only to circuits in areas where the requirements of the barrier separation system can not be met. The evaluation and required changes vill be contained in EDCR 97-56.

4

8.3 If it is determined that adequate cable damage protection can not be provided and still meet the o )erational requirements of the system, the subject cable will be replaced with a arger cable installed in accordance with the onginal separation criteria. The evaluation and required changes will be contained in EDCR 97-56.

8.4 NNS aower circuits originating from Class 1E powar sources must be provided

with c ouble overcurrent protection of sufficient rating to protect the cable. The l Class 1E to NNS isolation boundary is not affected by this change, and remains at the distribution bus. The second protection device shall be procured as Class

1E, but will be installed on the NNS side of the isolation device. The evaluation and required changes will be contained in EDCR 97-56.

t 8.5 NNS power circuits originating from NNS sources must be provided with double 1

overcurrent protection of sufficient rating to protect the cab!e. The existing NNS overcurrent device shall be replaced with a device with known characteristics, or tested in accordance with an approved testing program. The second overcurrent device shall be classified as Class 1E and seismically mounted.

The evaluation and required changes will be contained in EDCR 97-56.

8.6 NNS motor control centers which are exposed to DBE hazards require additional protective measures. In addition the double protection requirement stated above, exposed MCCs may be automatically deenergized when a harsh l environment is detected. This trip signal shall be generated by a redundant

, Class 1E monitoring system. The trip circuit shall open a circuit breaker outside of the area affected by the postulated harsh environment to deenergize the affected MCC. The evaluation and required changes will be contained in EDCR 97-56.

4

TE 172-97 Revision 0  ;

Page 38 of 42

~

8.7 For cases where circuits are powered from ungrounded DC systems fitted with a continuous ground detection and alarm circuit, fuses on the positive and negative leads are redundant to each other and can provide the necessary double overcurrent protection. The ex! sting fuse size will be evaluated or replaced if necessary to provide cable protection. In these cases, the existing breakers will not be replaced. The evaluation and required changes will be contained in EDCR 97-56.

t 8.8 Control and instrument circuits shall be evaluated in a manner similar to power circuits. Control and instrument circuits found to have fault current potential capable of causing cable damage shall be evaluated and modified in the same manner as the power circuits discussed above. Control and instrument circuit fault potential will be characterized by Reference 11 and tracked to closure by Leaming Bank issue # 97-03018.

8.9 The following controls and controls listed in Section 7.6.2 for work in cable raceways containing safety related circuits will be established and controlled by procedure. The required procedure changes will be tracked to closure by Leaming Bank issue # 97-03019.  ;

. A Foreign Material Exclusion (FME) process will be established in any area when cable tray covers must be removed for maintenance activities, and when accessing the Cable Chases or the Cable Vault for cable pulling or any other l task. Personnel not directly involved with the task will be excluded from the area. A cleanliness inspection will be performed prior to re-installing the cable .

tray cover. Leaming Bank issue # 97-03020 l

. Cable trays and other raceways will be included in a periodic maintenance and inspection ?rogram to ensure that the level of protection provided by the raceways c oes is not degraded. Leaming Bank issue # 97-03021 8.10 The following controls and controls listed in Section 7.6.1 for work in control aanels containing safety related circuits will be established and controlled by procec ure. The required procedure changes will be tracked to closure by Leaming Bank issue # 97-03022.

. Precautions will be added to surveillance procedures which require test equipment connections in control panels. A two person " challenge and reply" will be used when making the test connections. Leaming Bank issue # 97-03023

. A Foreign Material Exclusion (FME) process will be established for the Main

- Control Board to prohibit the use of tools or objects which have the potential to damage adjacent circuits. Insu!ated tools are required to reduce the likelihuxi of short circuits per Reference 21. Leaming Bank issue # 97-03024

. Workers assigned to perform tasks in control panels shall have documented training and experience. This specialty training is in addition to the general electrical safety training discussed above. Leaming Bank lasue # 97-03025 8.11 Field cable raceways for safety related cables will be clearly identified in the field as required by Procedure 17-52 (Reference 6).

i

TE 172-97 Revision 0 Page 39 ef42 8.12 Devices in Clars 1E control panels and wires at terminal points will be color coded to identify the train or channel association of each Class 1E component. This woric will be completed per the Work Orders identified in Reference 10, 8.13 Existing NNS protective devices relied on for double protection will be tested prior to re-start, and a periodic testing program for these devices will be instituted. The evaluation and required proceclura changes will be contained in EDCR 97-56.

8.14 When physical constraints prevent the installation of double overcur ent protection where is required, the cable will be rerouted in accordance with the original cable separation criteria. The evaluation and required changes will be contained in EDCR 97-56.

8.15 Where control cables were found to be routed with instrument circuits, the instrument circuit shielding must be verified as required by TE 18-97. The required inspections will be tracked to closure by Leaming Bank issue # 97-03026.

8.16 Revise the FSAR to include the changes specified by this safety assessment. (See attached 10CFR50.59 evaluation for details.) These changes will identify the bounds of this assessment to assure that future modifications will comply with the new requirements.

8.17 Revise the appropriate design specifications to require cable damage protection for any NNS cables installed with safety related cables in the future. Leaming Bank issue

1. 97-03019

TE 172-97 Revision 0 Page 40 of 42 9.0

SUMMARY

AND CONCLUSIONS In areas where separation between redundant safety related circuits has not been maintained in accordance with the current license basis for separation, altemative methods are available to insure the independence of the affected circuits. When all physical and electrical hazards have been removed from the specific areas where the current license basis for separation is not met, and appropriate controls over maintenance activities have been established, further separation is not required. The requirements specified by this assessment provide attemate methods to meet Maine Yankee license requirements for safety system independence.

This Safety Assessment has addressed all elements involved in the cable separation issues identified by inspections and evaluations. Each of the different discrepancies identified by the field walkdown effort has been evaluated. The types of hazards to circuits in the field have been identified. The measures which should be taken to eliminate the hazards have been presented.

Maine Yankee has elected to supplement the design of the plant as described in the FSAR in accordance with 10CFR50.59 to specify the altemate methods for providing circuit independence. Specific requirements to eliminate the effects of the postulated hazards, as summarized in Section 8, will be added to the FSAR. This change satisfies the corrective action requirements of 10CFR50 Appendix B, in lieu of restoring the affected equipment to its ori;pinal design. The 10CFR50.59 determination supported by this safety assessment is incluced as Attachment 1. The 10CFR50.59 addresses all aspects of the assessment, including the required changes to the FSAR.

The extensive plant and document reviews performed provide a better understanding of the cable separation elements important to safety at Maine Yankee. Maine Yankee has determined that restoring the original physical separation would provide little safety improvement. In moving forward, this assessment presents a technically sound approach to achieve a higher level of electrical independence and improve the safety margin at Maine Yankee.

I AiTRAWSFElmTE172-07.RVO

TE 172-97 i Revisisu 0 l Page 41 of 42 - 1 1

10.0 REFERENCES

l 1 Maine Yankee FSAR )

2 TE 226-96, Cable and Wire Separation Criteria, Revision 2 j 3 IEEE Standard. 279-1968, Proposed IEEE Criteria for Nuclear Power Plant Protective I Systems, August 30,1968 4 IEEE Standard 384, IEEE Trial Use Standard Criteria for Separation of Class 1E Equipment and Circuits, February 28,1974 and 1973 draft. 1 5 Regulatory Guide 1.75, Physical Independence of Electrical Systems, February,1974 6 Procedure 17-52, Cable and Raceway inspection Criteria, Revision 3 i 7 Letter NM-77-67, NRC to Maine Yankee, inspection Report 77-14 l 8 Original Maine Yankee Cable Specifications l a) MYS 1796A Voltage rating of 1000 volts  !

75 degrees C (167 F) conductor temperature b) MYS 3268 Voltage rating of 600 volts.

75 degrees C (167 F) conductor temperature c) MYS 3683 Voltage rating up to 2300 volts. (Coax Cable) 50 degrees C (122 F) ambient temperature d) MYS 3712 Voltage rating of 600 volts (Silicone Insulation) 125 degrees C (257 F) conductor temperature e) MYS-3859 Voltage rating of 600 volts.

90 degrees C (194 F) conductor temperature f) MYS-3860 Voltage rating of 600 volts.

90 degrees C (194 F) conductor temperature g) MYS 3893 Voltage rating of 600 volts (CEDM Position Indication) 75 degrees C (167 F) conductor temperature h) MYS-3912 Voltage rating of 600 volts.

125 degrees C (257 F) conductor temperature

1) MYS-1110 Voltage rating of 5000 and 8000 volts 90 degrees C (194 F) conductor temperature j) MYS-1546 SIS Switchboard Wire 9 Revised Cable Specifications a) MYPS 14 Voltage rating of 300 volts.

90 degrees C (194 F) conductor temperature b) MYPS 12 Voltage rating of 600 volts.  ;

90 degrees C (194 F) conductor temperature l umnemnm m l

l

TE 172-97 Revision 0 ,

Page 42 of 42 l 10 Control Panel Walkdown and labeling Work Orders 97-1584,1592,1595, and 1596 l 11 Instrument and control circuit fault potential and cable damage assessment

! 12 Guideline for Seismic Systems, Structures, and Components, Revision 2 13 Environmental Qualification Program Manual 14 Procedure MYPTP-21, Procedure to Perform HELB Walkdowns to Assess impact on l Safety Related Cables, Revision 1.

15 Fire Hazards Survey l 16 Heavy Loads Source Document 17 Standard MYSTD-ELEC-1, Maine Yankee Cable and Raceway Installation / Removal Standard, Revision 7 l 18 Procedure 0-16-3, Work Order Process 19 Procedure 0-14-1, White Tagging Procedure l 20 Appendix R Reference Document 21 Procedure 24-103-3, Electrical Safety 22 Procedure 24-103-1, Walking and Working Surfaces, including Scaffolding, Ladders, l

Cranes, and Aerial Work 23 Mechanical Hazards Failure Modes and Effects Study 24 Lesson Plans IC-STD-01 MY and EM-SAF-02 for Electrical Maintenance and Instrument and Controls Worker Training.

l 25 TE 18-97, Control Cables and Instrument Cables Routed Together, Revision 0 l

l AATRANSFER\TE172-97.RVO

- t

, l i

i 1

l

.i i

s +

4  !

l t

9 TE 172-97 TABLES i

4 l

TABLE 1 Oable Separation Discrepancy Types identified By Field Inspections TABLE 2 Table of hazards and mitigating actions I

i i

f t

i

?

l 6

l i

I I

I A:\ TRANSFER \TE172 % COV J

i TE 172-97 TABLE 1 Walkdown Discrepancy Summary l Type of Cable Separation Discrepancy from Applicable Affected Cable l Walkdown Hazards Types Cable in the Wrong Raceway 1, 2, 4, 5 A,C,E  !

Cables Cross at Cable Tray Tee 2,4,5 A,C,E No Barrier or Degraded Barrier in Tray 2,4,5 A,C,E Cable Tray Overfilled 2, 4 A,C,E l i

No Barrier or Proper Air Space at Transition, 1, 2, 4 A,C,E  !

Control Cable Run With Inerument Cable 1 E-Power Cable Run With Contro! Cable 1 C. j Power Cable Near Instrument Cable 1, 2, 4 E ,

Eastulated_ Circuit Howard Codes

1) Non-mechanistic cable damage causes electromagnetic interference or damage to adjacent Class IE circuits

2) DBE (other than fire) and any accompanying harsh environment damages circuit or '

utilization device.

3) Fire DBE damages circuit

4) Mechanical hazard initiated by something other than a DBE damages circuit or utilization device.

5) Maintenance or installation activities damage circuit of utilization device.

I 1

Cable.Iype_ Codes A) Class IE Power Circuits B) NNS Power Circuits C) Class 1E Control Circuits D) NNS Control Circuits E) Class IE Instrument Circuits F) NNS Instrumeni Circuits G) Alternate Shutdown (Appendix R) Circuits

\

l l 4 MTRANSFEmTE172-95 781 l

TE 172-97 TABLE 2 Circuit Protection Matrix Damage to Circuit or Damage to Circuit or Damage to Circuit or Maintenance Electromagnetic Circuit Damage Utilization Device by Utilization Device by Utilization Device by and installation Interference from Circuit Fault DBE including liarsh Fire Miscellaneous hazards Environment llazards Safe Shutdown Verify safe shutdown Identification, 1E POWER Not Affected Verify adequate Verify no damage to IE components achieved using capability training, and CIRCUITS fault protection.

required to mitigate the alternate shutdown compensatory Protect non-EQ DBE system measures circuits.

Protect cables with Verify alternate safe Protect cables with Same NNS POWER Not affected Protect cables with damage potential and shutdown circuits not damage potential and CIRCUITS damage potential and routed with IE routed with IE circuits damaged by fire routed with IE circuits circuits Verify no damage to Safe Shutdown Verify safe shutdown Same IE CONTROL. Not affected Verify adequate fault protection or IE components achieved using capability CIRCUITS protect non-EQ required to mitigate the alternate shutdown circuits. DBE system Protect cables with Verify alternate safe Protect cables with Same NNS Not Affected Protect cables with damage potential damage potential and shutdown circuits not damage potential and CONTROL.

and routed with iE routed with 1E circuits damaged by fire routed with IE CIRCUITS circuits circuits Verify no damage to Safe Shutdown Verify safe shutdown Same IE Verify adequate Verify no fault potential IE components achieved using capability INSTRUMENT cable shielding configuration required to mitigate the alternate shutdown CIRCUITS DBE system Evaluation not required Verify alternate safe Not affected Same NNS No Safety No damage Significance potential shutdown circuits not INSTRUMENT damaged by fire CIRCUITS Verify that all IE and Verify safe shutdown Same ALTERNATE No Safety Evaluated Above See next column for fire DBE NNS circuits for capability SilUTDOWN Significance alternate shutdown are CIRCUlTS protected from fire A \TRANSFERtTE172 96 TB2

1 i

l TE 172-97 FIGURES

1. Cable Separation Safety Assessment Overall Program Flow Chart

2. Fault Potential Identification Graph For All Plant Cables

3. Class 1E Cable Evaluation Flow Chart

4. NNS Cable Evaluation Flow Chart L l l 5. Case Study for Cable Independence '

}

1 l

l

{

i j

b l A:\ TRANSFER \TE172 % COV l

1 l

l )

. . -. . - _ . - . . . . - - - - - _ _ _ ~ . . . _ . _ . ~ . . - _ ~ . . - - . . - . . _ _ _ . . . . . _ . . . _ - _ _ . . . . . . .

TE 172-97 [

CABLE SEPARATION FIGURE 1 l SAFETY ASSESSMENT ,

i I

FSAR CABLE HAZARD FIELD INSPECTION

. LICENSE / DESIGN BASIS IDENTIFICATION l r

I f

ORIGINAL CONSTRUCTION SUPPORTING HAZARD  :

DOCUMENTATION REVIEW ANALYSES  !

1r ir SUPPORTING PROGRAM INSPECTION CRITERIA

SUMMARY

OF CONDITION O EVALUATIONS g ) l HELB/ FLOOD / FIRE /ETC.

l l

I I l l I I 1

1r ml 4L

\f SAFETY ASSESSMENT ROOT CAUSE (TE 172-97) PRCE-214 ir

PROPOSED

! MODIFICATIONS i

l i

l

. . RESTART READINESS ,

J REPORT i

l i

4 i

1 i

TE 172-97 FIGURE 2 INSTRUMENT CABLE FAULT POTENTIAL r IDENTIFICATION CONTROL i

POWER DAMAGE NO DAMAGE NO DAMAGE PROTECTED NOT WITH

. 1E CABLES DAMAGE ONH PROTECT .-.

1E CABLES l

PROTECT

\

\

w.

L E o -

a

\

u j

= CIRCUITS WHICH REQUIRE ACTION

TE 172-97 FIGURE 2 CABLE FAULT POTENTIAL ,

IDENTIFICATION CONTROL POWER INSTRUMENT DAMAGE PROTECTED NO DAMAGE NO DAMAGE  :

f L

NOT WITH 1E CABLES DAMAGE [

t PROTECT NOT WITH 1E CABLES PROTECT i I

L

[

= CIRCUlTS WHICH REQUIRE ACTION t t

i

s i

TE 172-97

' FIGURE 3 i

IE CABLE i All Class 1E ,

Cables i

l ir l

]

paration Discrepan Pessible 1

i Y <

1r j l

Y noio,,,,, ,,,noy, n ,,,, ,,

> %uW to mR$a e Hazard to cable event? shield cable i

N , ,N 4

1r t

Cable Damage Potential

, ,Y N Provide Doubie overcurrent l Cable Double '

Protection ercurrent Protected? )

l I

Y

'(O)K' j

I i

3 l

i i

l

. ~ ~ . - . . . . . - . .~. - . - . . - - -.- ~-.~ .._~ .-. .- . ,

s 2

TE 172-97 FIGURE 4 NNS CABLE

=

All NNS Cables 9

4 i

i N

i Cable Damage

! Potential?

i i

i 5 i f.

i 1r 4 N Cable routed with 1E cables

[ <

Y 1r t N , , , . Y to Hazard?

t ir

/

ouDle Overcurrent Y ,r Brtaker

• Prowde Protes. tion? Altemate Test Breakers and initiate PM Sotution

/ Program or appy fuse PM i

V 1r Provee 1E/QAR 1r i OK Proteacn

= - _ _ _ _ _ _ . _ _ _ . _ _ _ _ _ , _ , _

TE 172-97 FIGURE 5 CASE STUDY FOR INDEPENDENCE TRAIN A A ucc TRAIN A I

NNS1 NNS Mcc

= ""=""""""" "

NNS2 q

p -

I '

I l  ;

TRAIN B l I

TRAIN B B ucc -

(

KEY TRAIN A:

TRAIN B. '

t NNS MCC:

BARRIER:- - - - -

TE 172-97 ATTACHMENL1 10CER50.59_ Safety _EvaluationEummaryand FSAR Changes i

I l

l I

A:\ TRANSFER \TEl72-% COV

ATTACHMENT A (Pags 1 of 2) Proc. No. 0-06-4 R5v. No. 8 10CFR50.59 DETERMINATION Pags 1 of 38 Document

Title:

Cable Seoaration Safety Assessment Date July 21/1997 Procedure O EDCRQ Yellow Tag O Other X TE Bri:,f Description (Step 5.4.1)

Rnfety Acencempnt in tunnnrt FRAR Ebar npc nor peenrv tn rpenIvo Onkle Ronnrntinn feciime SCREENING (Step 5.4.2 and 5.4.3)

(1) Does this action violate or negate any Technical Specification?

O Yes; This action must be revised to comply with Tech. Specs. or approved by the NRC in order to be implemented. Attach NRC approvalif appropriate.

X No; List associated Tech Specs reviewed. Continue.

Explain: See attached (2) Does this action require an USQ evaluation? lE any of the following questions are answered yes, THEN perform an USQ evaluation. j Yes X No O Does the action involve a change to a SSC described in the FSAR and affect nuclear I safety?

)

Yes C No X Does the action involve a test or experiment not described in the FSAR and affect nuclear safety?

Yes C No X Does the action involve a procedure described in the FSAR, or listed in Tech. Specs. ,

Section 5.8.2?  !

Yes C No X Does the action involve a change affecting FSAR Chapter 14 accident analysis assumptions or conclusions?

Explain: This chance soecifies new cable indeoendence criteria. See attached IE all of the questions are answered no, THEN the action may be approved. Provide an explanation and GO TO Step 6.

UNREVIEWED SAFETY QUESTION EVALUATION (Step 5.4.4)

NDIE lE any of the questions in the USQ Evaluation are answered y_qa, THEN the proposed action constitutes an unreviewed safety question requiring NRC approval prior to its implementation. LE all of the questions in the USQ Evaluation are answered an, the proposed action is NOT an unreviewed safety auestion A_MQ may be aooroved.

(3) List any accidents specified in Chapter 14 of the FSAR and the Safety Analysis Review Section of the current Core Performance Analysis which could be affected by this action. (Step 5.4.4.a.1)

All Chaoter 14 accidents

a. Could this action increase the probability that any of these accidents may occur?

Yes O No X Explain: See attached

b. Could this action increase the consequences of any of these accidents?

Yes Q No X Explann: SEc s rue m

6T. TACHMQLT A (Pag 2 2 of 2) Proc. No. 0-06-4 Rsv. No. 8 -

10CFR00.59 DETERMINATION Paga 17 of 38 'l Dccument

Title:

M f**>-~ Se rr ~ M rerr - - " Date 7b'/97 '

Document No. h2 -93 Rev.No. e ocedure O EDCRO Yellow Tag Q Others. rE

c. Could this action increase the probability that a piece of equipment important to safety previously .

evaluated in the FSAR will malfunction?  :

Yes O No R.

l Explain: 4 - ro ~c o l ' d. Could this action increase the consequences of any malfunction of equipment important to safety previously evaluated in the FSAR7 Yes O No S <

Explain: 4- re ~o -

l (4) a. Does this actien create the possibility of an accident not bounded by these specified in the FSAR l and the Core Performance Analysis? (Step 5.4.4.b)  !

Yes O Ncr;ic l Explain: A nac arn

b. Does this action create the possibirity of an equipment malfunction not anticipated in the accidents specified in the FSAR and the Core Performance Analysis?

Yes O N d l l Explain: A > + c ar e

)

(5) Could this action reduce the margin of safety defined in the batig of any Technical Specification ~~

(Sections 1-4)7 (Step 5.4.4.c) ' )

Yes O Nofc., -

Explain: e a u er a l

(6) Does this action render any FSAR or IASD wording permanently incorrect or obsolete?

(Step 5.7)

Ye % NoO If yes, identify the changes with the wording changes, tables, figures, etc. After the action has been implemented nottfy the Licensing and Engineering Support Department.

Snefly explain the wording discrepancy: mr %we e s +% u en (7) Determination: T?e proposed actio dees n does involve a Te ical Specification violation or wording ge,does no:/dces involve an un "ed safety question a d ma av not be implemented without prior NRC approval 1 A C Rff hlC 10 CFR 50.59.

• r'=aoa= - .[' wa/,/4 '

On orilQtpartment/Date' i (8) Forward this Determination attached to the applicable document package to the NSEG Superviser or the i Assistant Manager of Operations Support.

Review - Satisfactory / '

m

/

7 /!97 NSE/STA/Date ' /

(9) Send a signed copy of this form to the NSEG Superviser.

l List Attachrnents:

I 6

TE 172-97, Attachmant 1 10CFR50.59 Page 3 of 19 10CFR50.59 EVALUATION i

CLARIFICATION OF ELECTRICAL INDEPENDENCE AND CABLE SEPARATION REQUIREMENTS BACKGROUND Electrical circuit independence ensures that the potential for common mode failure due to cable interaction or environmental hazards is minimized. Cable separation is one means of achieving electricalindependence. Other acceptable means of effecting electrical independence include application of the concepts of electrical protection and physical location.

Electrical independence is discussed in various ways throughout the FSAR. The intent <

of the independence requirements is described in Appendix A to the FSAR in design criterion 23," Protection Against Disability for Protection Systems". This criterion states:

"The effect of adverse conditions to which redundant channel or protection i systems might be exposed in common, either under normal conditions or those l

of an accident, shall not result in loss of the protection function." '

A general discussion of tha methods for meeting the intent of the design criterion 23 for j more than the reactor protection system is in FSAR section 7.3.5 l

"The engineered safeguards initiation, control and power supply systems are i designed in accordance with IEEE Criteria No. 279, dated August,1968, so that no single fault in components, units, channels or sensors will prevent engineered safeguards operation. The wiring is installed so that no single fault or failure, l including either an open or short circuit, will negate minimum engineered '

safeguards operation. Wiring for redundant circuits is protected and routed so that damage to any one path will not prevent minimum engineered safeguards a ction...."

IEEE Criteria No. 279," Proposed IEEE Criteria for Nuclear Power Plant Protection Systems," dated August 1968, (IEEE Std 279-1968) is the standard that provides the

! basis for the design of reactor protective and safeguards circuits at Maine Yankee.

Section 4.6 of this standard states:

" Channels that provide signals for the same protective functions shall be l independent and physically separated to accomplish decoupling of the effects of l unsafe environmental factors, electric transients, and physical accident consequences documented in the design basis, and to reduce the likelihood of interactions between channels during maintenance operations or in the event of a channel malfunction."

6

TE 172-97, Attachmsnt 1 l

10CFR50.59 Page 4 of 19 Additionally, FSAR Section 8 states that the Maine Yankee bus system is equalin independence and reliability to the bus arrangement shown in the " Proposed lEEE l

Criteria for Class 1E Electrical Systems for Nuclear Power Generating Stations," dated June,1969,later issued as IEEE Std 308. This proposed criteria states:

" Class 1E electrical equipment shall be physically separated from its redundant counterpart or mechanically protected as required to prevent the occurrence of common failure mode."

Similar independence is intended for safety related indication channels not providing protective functions, but required by subsequent license commitments, such as post-accident sampling and indication circuits.

As identified in these documents the intent of electrical independence is to preclude 1

common mode failures by decoupling the effects of the following hazards:

a. Unsafe environmental factors

b. Electric transients

c. Physical accident consequences documented in the design basis l Also, the intent of electrical independence is to reduce the likelihood of common mode failures during maintenance operations or in the event of a channel malfunction The way that the individual hazards are mitigated or eliminated is specific to the hazard involved and the individual cable function and type (i.e., the pipe whip associated with a high energy line break can be eliminated by circuit location while accident i

environmental effects can be mitigated by the circuit design / qualification). Specific methods for mitigating individual classes of potential hazards (e.g., high energy line breaks and fire) can be found in the FSAR.

Also, identified in the FSAR are the design guidelines for providing cable separation used for the construction of the plant outside of the control room. These guidelines are summarized in FSAR Section 8.3.7.7 which states:

" Cable separation, when required, is achieved by use of the following methods:

1. In separate exposed rigid metal conduit following separate routes where practical.

2. In separate concrete encased plastic or metal ducts in the same duct

bank.

l

! 3. In separate cable trays with horizontal separation. (The tray sides are considered adequate barriers.)

l i

. l l

l l TE 172-97, Attachm:nt 1 10CFR50.59 Page 5 of 19 l

l

! 4. In separate cable trays separated vertically by solid tray covers.

i

5. In separate barrier sections of the same tray.

6. By means of interlocked armor / flexible metal conduit.

7. During cable transitions, cable separation will be continuous by one or more of the following methods:

7a. At crossover / cross under points, the method established for one raceway or the other will be maintained (e.g. if the separation method is a metal barrier in a cable tray, then separation at a i crossover, such as at a cross or tee, will be maintained by a

{

metal barrier) l 7b. At transitions from one raceway type to another raceway type, I the separation method for one raceway or the other will be maintained (e.g. if the separation method is a metal barrier in a cable tray and the transition is to a wall sleeve, then the metal barrier will be extended from the cable tray to the wall sleeve).

7c. By maintained open air spacing as supported by industry i standard (s) or as established by analysis or testing."

The specific method of separation used for an individual circuit depends on the individual circuit type and the specific hazard being mitigated. And, the use of cable separation may not be necessary if other means of electrical independence (e.g., circuit design or physical location) are employed to eliminate or mitigate the hazard, in many cases the FSAR goes on to identify the specific type of separation used for  !

particular systems. For example, inside the control room the potential for many hazards is precluded and as a result cable separation requirements to maintain independence are different from those in other plant areas. FSAR section 8.3.7.5 identifies the separation in the control room with the following:

" Components within control boards, panels and relay racks are arranged to suit operational flexibility, and the wiring to any redundant component is physically separated."

It should be noted that the FSAR itself does not contain prescriptive requirements

! conceming the degree of cable separation required in the control room panels.

Construction documents arbitrarily specified a two inch separation in control room l panels but no specific separation distance criterion is contained in the licensing basis.

Consistent with the FSAR notion of " operational flexibility' cited above, the construction l

TE 172-97, Attachmsnt 1 10CFR50.59 Page 6 of 19 documents also explicitly allowed separation distances less than two inches where physical equipment restraints were involved.

Following establishment of the design and licensing basis of the plant, additional separation guidance was developed by the industry. These industry standards were developed and are continuing to be developed to aid in the achievement of independence and contain suggested separation distances as one desirable element of the independence process. The separation distances are generally based on conservative judgments and are intended to envelope the entire spectrum of potential designs across the industry. These standards contained very restrictive criteria for several years but recently, as more data has become available, the recommended separation distances have been reduced. For exarnple IEEE Standard 384-1981, "lEEE Standard Criteria for Independence of Class 1E Equipment and Circuits,"

recommend an air separation distance of 6 inches for internal panel wiring while the recommended distance is reduced to 1 inch by the Working Group on Independence Criteria, SC-6.5 of the Nuclear Power Engineering Committee as published in the IEEE Transactions on Energy Conversion, Vol. 5, No. 3, September 1990. It is clear that as l standards evolved, separation distances were reduced to well below that employed by '

Maine Yankee's construction documents, implying little if any safety benefit will be achieved through restoration of discrepant control room panel conditions to a two inch criterion. In any case, the licensing basis of the plant is silent on control room panel separation distances, j 1

Additionally, while conformance with the industry suggested separation distances should generally be considered as desirable good practice, as reflected in the FSAR, separation distances constitute only one means of achieving independence. Other ,

means are available which provide the needed independence and these other means can provide adequate channel independence, particularly when combined with existing l separation distances.

CHANGE This evaluation reviews proposed FSAR changes to clarify attemative acceptable methods to provide electricalindependence that assures the adverse effects of cabling induced effects, maintenance operations, and channel malfunctions are minimized with respect to common mode failures. The proposed changes modify the current separation and design control FSAR requirements with respect to the mitigation of any hazard which may result in circuit faults, and provides additional controls for maintenance activities.

Specifically, this evaluation will provide acceptable methods for providing electrical independence where existing cable separation is discrepant with respect to either the FSAR or construction documents in the areas of mitigating cabling induced effects, maintenance operations and channel malfunctions. These methods work in concert with the original license basis (which is met by the large majority of safety-related circuits) to increase the overall level of safety system independence. Circuit

1 TE 172-97, Attachm:mt 1 I 10CFR50.59 Page 7 of 19 overcurrent protection, circuit and raceway identification, and strict control of maintenance activities are applied to the safety systems to provide a level of circuit independence equivalent to or better than that provided by the original license basis.

EVALUATION Physical separation is provided between redundant circuits as one method to presente their independence by decoupling the effects of environmental hazards and reducing the likelihood of common mode maintenance damage to redundant circuits. Physical separation is currently provided by sheet metal barriers, rigid or flexible conduit, or air separation. Plant inspections have identified that certain circuits did not meet FSAR requirements or construction documents in this regard.

Where necessary, two different types of plant modifications may be made to ensure that the cable installation fulfills all attributes for achieving independence.

1. Some modifications will restore the original license basis for cable separation, including relocating cables and equipment and installing or repairing metal barriers. These types of modifications,which are Appendix B corrective actions, are not the subject of this 50.59 evaluation and are mentioned only for completeness. I i

2. In other cases, cable separation will not form a basis for achieving independence.

Rather, the concepts of electrical protection or physical location will be applied to achieve that goal, such as installing double overcurrent cable protection, automatic isolation of certain loads during design basis events, and enhancing overcurrent protection device maintenance and testing programs. This 50.59 evaluation amends the license basis with respect to these types of plant changes.

This evaluation provides acceptable alternative methods of achieving electrical independence to assure that cabling induced effects, maintenance operations, and channel malfunctions are minimized to reduce the likelihood of common mode failures for situations similar to the second case, above. The methods consist of design and administrative controls on cabling, specifically:

1. Faults which are postulated to occur on safety related and non-safety related circuits are prevented from damaging adjacent cabling by ensuring that overcurrent protection is provided to prevent cable damage. Double overcurrent protection is provided to ensure the operability of the circuit protection when considering a single failure and faults initiated by non-qualified devices. With this enhanced protection, a cable / circuit fault in a safety related raceway cannot produce sufficiently high temperatures to damage adjacent cables.

2. N m overcurrent protection devices (i.e., breakers and fuses) are procured to the requirements of safety-related devices and at least one of the overcurrent protection devices meets all requirements for Class 1E devices.

- . - - - . - ~ . . - - - - - - - . . _ - , - - . - - . . - - . . .

TE 172-97, Attachment 1 10CFR50.59 Page 8 of 19

3. The required overcurrent protection devices are placed into a safety related maintenance and testing program. i

4. The effects of the electromagnetic interference produced by control cables not separated from instrument cables at cable transitions are evaluated to ensure that '

adverse instrument channel effects are not credible. l 5

5. . Administrative controls are implemented to reduce the potential for maintenance operations to directly af'ect redundant components by the following':  !

l

a. Prohibiting the pulling of cabling through sleeves and raceways which contain redundant channels of safety related cabling which is not physically separated while the safety functions served by the un-separated cables are required to be operable,

b. Prohibiting the installation or removal of wire and cable in control panels which contain redundant channels of safety related circuits which may not be physically separated while the functions served by the un-separated circuits are required to be operable. Installation activities in control panels which contain redundant safety related circuits which are required to ,

function during shutdown conditions will be controlled by the Outage Risk Management Program.

c. Implementing strict access controls for the cable vault, cable chase, and the interior of the safety related control panels while the safety functions served by the areas or panels are required to be operable.

d. Requiring the use of insulated tools to reduce the amount of exposed conductive material inside the safety related control panels while the safety functions served by the panels are required to be operable.

e. Including safety related cable raceways in a periodic maintenance program so that the proper management attention is applied to ensure a high reliability of the raceways and the associated cabling.

Implementing the controls described above assures that cabling induced effects are  !

minimized to reduce the likelihood of common mode failures in redundant safety-related channels, and that maintenance operations and the potential for channel malfunctions are controlled to reduce the likelihood of interactions between channels. In addition to the above controls, the potential for the overall maintenance program to indirectly affect redundant components will be further i reduced by the following:

1. Worker training identifying special precautions for safety related cables and components.  !

I

1 l TE 172-97, Attachm:nt 1 10CFR50.59 Page 9 of 19

2. Procedure control on work activities and pre-job briefing will be strengthened.

3. Design process and configuration management controls will bo strengthened.

4. The identification and labeling of safety related equipment in the plant and on drawings will be improved.

The FSAR states that nonsafety-related circuits are not separated from safety-related circuits. Interactions with these nonsafety-related circuits are part of the total failure probability of the safety-related circuits, including the potential for common modo failures. To reduce the risk ofinteractions between the safety-related and non-safety-related circuits, the additional requirements discussed above are placed i on the non-safety-related circuits which could adversely affect redundant safety-related circuits. These requirements will ensure that the total failure probability of )

the safety-related circuits is not increased as a result of the evaluated changes by reducing the potential for failures in safety-related circuits due to faulted nonsafety-related circuits.

Two areas of practical application of the proposed changes deserve further discussion - addition of electrical protection devices (e.g., fuses, breakers) and enhanced maintenance controls. j AdditiottotelecidcaLprotection_ devices Providing double overcurrent protection devices will be necessary to either correct discrepant conditions under 10CFR50 Appendix B or to enhance the reliability of safaty-related circuits in accordance with the proposed changes.

Procurement of additional protection devices, as previously noted, will be to appropriate Appendix B criteria, including at least one Class 1E device in each double overcurrent design. Design of the double protection will be in accordance with applicable codes and standards. As a result component and system reliabilities will be maintained at an acceptable level, and as a general principle, the accident and equipment malfunction probabilities associated with 10CFR50.59 are not increased.

Recognizing the scrutiny which this evaluation will receive, as well as the unsettled regulatory environment associated with 10CFR50.59, the following supplemental discussions regarding the acceptability of installing additional overcurrent protection devices are provided. It should be noted, however, that consistent with the industry and Maine Yankee positions on 10CFR50.59, the following information goes beyond that necessary to support the proposed changes, and addresses inappropriate interpretations of the requirements of 10CFR50.59.

! Near term installation of additional overcurrent protection involves three different

. types of circuitry, each of which is discussed below. These discussions address the

TE 172-97, Attachm nt 1 10CFR50.59 Page 10 of 19 increases the failure probability of the function associated with the protection device's cable. (It should be noted that, taken to its logical conclusion, such hypotheses would prohibit adding equipment to a nuclear facility under 10CFR50.59.)

A. Non-Safety-Related (NSR) Circuits Since the Maine Yankee design basis allows running NSR and SR circuits together, i faults in NSR circuits could adversely affect SR circuits. Where an NSR circuit could I adversely affect both trains of an SR function, dual protection devices will be l provided for the NSR circuit in accordance with the proposed changes.

J i

While it can be hypothesized that the failure probability of the associated NSR function is nominally increased, that function is not important to safety. The safety effect of the additional device is to increase the reliability of the SR function I contacted by the NSR cable. Therefore, no unreviewed safety question exists.

B. Control Circuits I Most SR control circuits at Maine Yankee were designed and constructed with either single or double overcurrent protection devices.' SR control circuits with single overcurrent protection for which cable separation has not been maintained could, in the presence of a single failure of the protection device, propagate a fault to opposite train SR cable. A small fraction of SR control circuits (those associated with four control panels - approximately 18 circuits) fit into this category - i.e., cable damage or ignition may occur in the presence of a single failure.

For these circuits (similar to the power cables discussed below), adequate electrical independence can be provided in one of two ways - either restore the metal barriers or install double overcurrent protection on the control cable. Sheet metal separation barriers, while an acceptable license basis method of providing cable separation, provide relatively little protection against a self-ignited control cable. Clearly, the method which contributes most to safety is to provide additional overcurrent protection (a highly reliable device) to prevent fault propagation. In other words, the overcurrent device will be more reliable at preventing self-ignition than the sheet metal barrier will be in preventing the ignition propagation to another cable.

Nonetheless, adding an additional protection device to the control cable would,

' In discussing fire susceptibility of cables. section 8.3.7.6 of the FSAR states:-Control cables will not ignite from ovedoading or grounds since the maximum fault is insufficient to heat the insulation to the flash point.

Fire in control cables can, therefore. only occur as the result of another fire."

This statement is misleading and is being revised through the proposed changes. Overcurrent protection for control cables is a necessary design element to eliminate cable self-ignition when the maximum fault exceeds the cable's fault capability.

TE 172-97, Attachm::nt 1 10CFR50.59 Page 11 of 19 under the hypothesis presented above, result in a nominal increase in the probability of malfunction of the SR equipment suociated with the control cable.

C. Power Cables SR power cables are designed and qualified to survive those design basis accident (DBA) conditions under which their associated safety functions must be performed to mitigate the event. If a power cable and associated function is not necessary to mitigate a particular DBA, it need not be qualified for that DBA and is assumed to  ;

fail if it is not qualified. All Maine Yankee power cables meet this license basis.  !

l A fault on an SR power cable due to a DBA for which it is not required to be  !

qualified could propagate to opposite train SR cable if cable separation has not .

been maintained. There is a small number of SR power cables where this condition i exists -i.e., metal barriers intended to separate redundant trains are either missing l or degraded. i For this condition, adequate electrical independence can be provided in one of two ways - either restore the metal barriers or install double overcurrent protection on the power cable. Sheet metal separation barriers, while an acceptable license basis -

method of providing cable separation, provide relatively little protection against a self-ignited power cable. Clearly, the method which contributes most to safety is to provide additional overcurrent protection (a highly reliable device) to prevent fault propagation. in other words, the overcurrent device will be more reliable at preventing self-ignition than the sheet metal barrier will be in preventing ignition propagation to another cable.

Nonetheless, adding an additional protection device to the power cable would, under the hypothesis presented above, result in a nominal increase in the probability of malfunction of the SR equipment associated with the power cable.

D. Conclusion Double overcurrent protection is an accepted industry standard (e.g., see RG 1.63 and IEEE Std 741 with respect to containment electrical penetration protection).

Providing double overcurrent protection for the NSR, Control and Power circuits discussed above places the plant in the safer condition compared to restoring the original metal barriers associated with cable separation.

In each case, any slight potential increase in failure probability attributed to adding a second overcurrent protection device is more than offset by the protection afforded to an adjacent cable. Since the ignition propagation protection supplied by a sheet metal barrier is small, the second protection device results in a large increase in electrical independence compared to restoring the metal barrier and, therefore, constitutes a net increase in safety.

TE 172-97, Attachm:nt 1 10CFR50.59 Page 12 of 19 Appropriate quality controls, codes and standards will be applied to the new overcurrent protection device and its installation. As a result, the traditional interpretation of 10CFR50.59 holds that the failure probabilities considered under 10CFR50.59 are not increased. To conclude otherwise is equivalent to virtually prohibiting the installation of any new safety-related equipment - clearly not the intent of 10CFR50.59.

To summarize, installation of a second overcurrent protection device for selected NSR circuits and limited SR control and power circuits provides a net safety benefit compared to restoration of metal barrier separators, and does not constitute an unreviewed safety question.

ControlRoomfanels _EnhancedAlaintenance_ Controls As previously noted, the FSAR does not contain prescriptive criteria for separation of control room wiring (" components within control boards, panels and relay racks are arranged to suit operational flexibility, and the wiring to any redundant

( component is physically separated"). Construction documents established a two inch separation criterion but also note that less separation was acceptable for operational flexibility. Also as previously noted, the amount of separation (i.e., one inch vs. two inches) adds little if anything to component reliability.

The Maine Yankee control room contains a small number of safety-related circuits (estimated to be less than 10% of the total number of control room safety-related circuits) whose separation from redundant components is less than recommended by the original construction documents. The precise number is difficult to identify due to inaccessibility problems.

Control room circuits are not subject to the hazards encountered in the rest of the facility, in fact, the reason for electrical independence of control room circuits is to guard against inadvertent common mode failure due to maintenance. Sufficient controls on maintenance, therefore can provide equivalent or better protection against maintenance common mode failure for the few instances where wiring separation is not strictly compliant with the construction documents. it's worthwhile to explain this further.

There are two types of " maintenance" activities to examine. The first is traditional maintenance in the control room panels. The second is installation " maintenance" associated with plant modifications. In general, they present different risks and can effect different portions of a circuit.

Traditional maintenance is performed on the components associated with the control room wiring rather than the wiring itself. In this respect, the work is focused on the termination points of the wiring, all of which are compliant with the FSAR and construction standards with respect to separation criteria. Regardless, the proposed changes do place additional controls on traditional maintenance (e.g., access

TE 172-97, Attachm:mt 1 10CFR50.59 Page 13 of 19 controls, requiring the use of insulated tools, training, etc.) to further enhance the electricalindependence of the circuits.

installation " maintenance" often involves running / pulling cable and accessing portions of the circuitry distant from termination points. The discrepant conditions (e.g., redundant wiring less than two inches separated) occur at those locations remote from their termination. In this case, additional controls on maintenance (e.g.,

prohibiting the installation or removal of wire and cable in control panels which contain redundant channels of safety related circuits which may not be physically separated while the plant is operating, etc.) are an effective altemative for achieving electrical independence. In other words, regardless of separation distances, an inappropriate maintenance activity can lead to common mode failure. If, however, such maintenance activities are prohibited or strictly limited, the possibility of common mode failure is'either eliminated or greatly reduced. In this sense, stringent maintenance controls on those activities that could affect control t com wiring with less than optimal separation will lead to fewer opportunities for maintenance-induced common mode failure and increase circuit reliability over that due to wiring separation.

APPLICATION OF PROPOSED CHANGES This 50.59 assesses the acceptability of the additional methods specified to achieve the required level of safety system independence where the original methods have not been met. However, specific applications of the proposed changes to the FSAR will be implemented in accordance with the Maine Yankee engineering design change (EDCR) process. In each case where material changes are proposed for safety related circuits and systems, components and installation methods will be specified to match the existing quality level of the safety system.

And, each specific plant design change will be evaluated through the rigorous EDCR process to assess the overallimpact of the change on plant safety, including a separate 50.59 evaluation.

SUMMARY

With the implementation of the proposed changes discussed above, the reliabikty of the safety related circuits is equivalent to or better than that afforded by the current license basis.

l l

TE 172-97, Attachm:nt 1 10CFR50.59 Page 14 of 19 SAFETY EVALUATION A. TechnicaLSpecifications

1. Implementation or performance of the action described in the evaluated document will require a change to the Technical Specifications. No.

Basis: The proposed change does not modify the functional requirements for any equipment required to be OPERABLE by the Technical Specifications. This change only affects the method of design qualification to meet electrical independence requirements for the identified hazards. Those requirements are contained in the FSAR and are not addressed in the Technical Specifications. As a result, the evaluated change does not require a change to the Technical Specifications.

B. Unreviewedfafety_ Question Implementation or performance of the action described in the evaluated document:

1. May increase the probability of occurrence of an accident previously evaluated in the SAR. No.

Basis: The electrical independence methods evaluated are used to assure that environmental hazards due to cabling induced effects, maintenance operations, and channel malfunctions are minimized to reduce the likelihood of common mode failures. Without adequate electricalindependence these failures could result in spurious system actuations (e.g., reactor trip or ECCS injection), valve repositioning, systems failing, or other failures which could result in an accident.

The evaluated changes recognize that cable separation is only one of several means to preserve the independence of redundant systems and decouple the effects of environmental hazards. The current license basis achieves independence not only through separation, but employs electrical protection, and physical location as well. Any one, or a combination of these methods can afford adequate independer. e.

The proposed changes clarify electricalindependence methods of minimizing cabling induced effects, potential adverse effects of maintenance operations, and channel malfunctions from the physical division of cable trays and spacing to control

) of the design / qualification of the individual cables and precluding the occurrence of specific maintenance hazards.

Electricalindependence methods consist of design and administrative controls on individual circuits. The specific controls are the following:

i TE 172-97. Attachm:nt 1 10CFR50.59 Page 15 of 19

1. Faults which are postulated to occur on safety related and non-safety related circuits are prevented from damaging aojacent cabling by ensuring that overcurrent protection is provided to prevent cable damage. Double i' overcurrent protectio,1is provided to ensure the operability of the circuit protection when considering a single failure and faults initiated by non.-

qualified devices. With this enhanced protection, a cable / circuit fault in a safety related raceway cannot produce sufficiently high temperatures to damage adjacent cables.

2. New overcurrent protection devices (i.e., breakers and fuses) are procured to the requirements of safety-related devices and at least one of the overcurrent protection devices meets all requirements for Class 1E devices.

3. The required overcurrent protection devices are placed into a safety related maintenance and testing program.  ;

4. The effects of the electromagnetic interference produced by control cables not separated from instrument cables at cable transitions are evaluated to ensure that adverse instrument channel effects are not credible.

5. Administrative controls are implemented to reduce the potential for maintenance operations to directly affect redundant components by the following:

a. Prohibiting the pulling of cabling through sleeves and raceways which contain redundant channels of safety related cabling which is not physically separated while the safety functions served by the un-separated cables are required to be operable.

b. Prohibiting the installation or removal of wire and cable in control panels which contain redundant channels of safety related circuits which may not be physically separated while the plant is operating. Installation activities in control panels which contain un-separated redundant safety related circuits which are required to function during shutdown conditions will be controlled by the Outage Risk Management Program.

c. Implementing strict access controls for the cable vault, cable chase, and the interior of the safety related control panels while the safety functions served by the areas or panels are required to be operable.

d. Requiring the use of insulated tools to reduce the amount of exposed conductive material inside the safety related control panels while the safety I

functions served by the panels are required to be operable.

e. Including safety related cable raceways in a periodic maintenance I

TE 172-97, Attachm nt 1 j 10CFR50.59 Page 16 of 19 i

program so that the proper management attention is applied to ensure a high i reliability of the raceways and the associated cabling.  !

While difficult to quantify, the proposed design and administrative controls

associated with electrical independence provide an equivalent level of electrical independence to minimize potential common mode failures.2 To provide added confidence, additional controls beyond the current license basis are imposed on

) non-safety related circuits to further lower the likelihood of safety-related circuit .

failures. With the implementation of the requirements discussed above, the I reliability of the safety related circuits is equivalent to or better than that affordeo by the originallicense basis. Therefore, the proposed changes do not increase the probability of occurrence of an accident previously evaluated in the SAR.

i

2. May increase the consequences of an accident previously l evaluated in the SAR. No.

Basis: As noted in response to Question #1, above, the pre-accident reliability of safety-related cabling is preserved or enhanced through the proposed changes. A similar situation holds for the post-accident reliability of the same cabling.

By the nature of the proposed changes, accident consequences would only be adversely affected if the environment proouced by the accident were to increase the failure potential of cabling which would in tum lead to failure of equipment necessary to mitigate accident consequences. This is the subject of Question #3, below.

In summary, the engineering assessment which led to the proposed changes focused attention on minimizing the adverse effects of environmental hazards, including accident conditions, such that an equivalent or better level of electrical independence was maintained through the propoced change. This assessment included the harsh environment created by traditional DBAs as well as the effects of floods, missiles, heavy loads, etc. In each case, the prcposed changes afforded equivalent or better electrical independence in an accident environment. In addition to protecting against cross-channel common mode interactions, single failure criteria continue to be satisfied i;uch that equipment responds as described in the SAR, Therefore, the proposed changes do not increase the consequences of an accident previously evaluated in the SAR.

3. May increase the probability of occurrence of a malfunction of l equipment important to safety previously evaluated in the SAR. No.

Basis: Adequate electrical independence, which employs the concepts of cable separation, electrical protection and physical location, ensures that the common 2

See also the previous evaluation discussions under " Addition of electncal protection devices" and l

• Control Room Panels + Enhanced Maintenance Controls" l I

l l

l l TE 172-97, Attachm:nt 1 10CFR50.59 Page 17 of 19 mode failure of safety-related cabling is minimized, and, therefore, minimizes the common mode failure of equipment important to safety that may be associated with the cable.

l The proposed changes clarify the acceptability of various methods of achieving electricalindependence. These methods are derived by examining and addressing those plant hazards which, in the face of inadequate electrical independence, could lead to unacceptable levels of circuit common mode failure.

The engineering assessment supporting the proposed changes examined, in detail, j the types of hazards covered by the Maine Yankee license basis. Specifically, IEEE l 279-1968 discusses the following hazard categories:

a) Unsafe environmental factors l

b) Electric transients c) Physical accident consequences documented in the design basis d) Interaction between channels during maintenance activities j c) Interaction between channels in the event of a channel failure.

l A methodical evaluation of each type of hazard was performed looking beyond the concept of cable separation to incorporate the use of electrical protection and

! physical location to achieve electrical independence. For instance, evaluations

! considered electromagnetic interference, circuit fault damage, DBA hazards other l than fire, fire hazards, non-DBA mechanical hazards, and maintenance and installation hazards. The assessment datermined that in each case, the appropriate approach to electrical independence resulted in equivalent or better cable reliability and, therefore, equivalent or better reliability of equipment important to safety associated with the cable.3 Application of the electricalindependence criteria is on a case-by-case basis. In some cases, cable separation fulfills all attributes for achieving independence.

l Appropriate modifications include relocating cables and equipment. In other cases, cable separation will not form a basis for achieving independence. Rather, the concepts of electrical protection or physical location will be applied to achieve that goal such as installing double overcurrent cable protection, automatic isolation of certain loads during design basis events, and enhancing overcurrent protection maintenance and testing programs.

In addition to clarifying the electricalindependence criteria needed to preserve an equivalent level of protection from common mode failure, additional criteria were

! specified to lower the common mode failure probability associated with non-safety related cable that could adversely affect safety-related cable. Although such a l

3 see also the previous evaluation discussons under

• Addition of electncal protection devices

• and

• Control Room Panels - Enhanced Maintenance Controls

• i

TE 172-97, Attachm::nt 1 10CFR50.59 Page 18 of 19 design is allowed under the current license basis of Maine Yankee, the proposed change ensures that such design is not allowed in the future and serves to reduce the probability of malfunction of equipment important to safety that interfaces with the non-safety related cable.

Consequently, the reliability of equipment important to safety under the proposed changes is equivalent to or improved upon. And, therefere, the proposed changes do not increase the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the SAR.

4. May increase the consequences of a malfunction of equipment important to safety previously evaluated in the SAR. No.

Basis: As discussed above, circuit reliability, pre- and post-accident is preserved or enhanced through implementation of the proposed changes. The proposed changes are based upon the rational application of electrical independence in order to achieve that objective. The acceptability of an individual approach to electrical independence has been explicitly evaluated against the plant hazards defined in the Maine Yankee license basis to ensure that individual applications of the proposed changes will achieve equivalent or better electrical independence compared to the current license basis requirements. In addition, the proposed changes can only affect electrical circuits and cannot introduce new fai!ure modes of equipment important to safety that is associated with the cable. Therefore, the proposed changes cannot increase the consequences of a malfunction of equipment ,

important to safety previously evaluated in the SAR.

5. May create the possibility of an accident of a different type than any previously evaluated in the SAR. No.

Basis: The proposed changes are limited to clarifying acceptable methods of achieving electrical independence for safety-related circuits so as to minimize the potential for common mode cable failure. In this respect, the changes expand upon and clarify the use of cable separation, electrical protection and physical location

'already contained in the SAR, and address the same environmental and accident hazards already considered in the SAR. The changes themselves do not introduce new common failure modes of electrical circuits over those already considered in IEEE 279-1968, nor do they directly affect other equipment important to safety as discussed in the response to Questions 3 and 4, above. Therefore, the proposed change does not create the possibility of an accident of a different type than any previously evaluated in the SAR.

6. May create the possibility of a malfunction of equipment important i to safety of a different type than any previously evaluated in the SAR. No.

( Basis: The proposed changes are limited to clarifying acceptable methods of achieving electrical independence for safety-related circuits so as to minimize the

l l TE 172-97, Attachm:nt 1

, 10CFR50.59 Page 19 of 19 l potential for common mode cable failure. Other than electrical failures which are not l

new failure modes for associated equipment, the proposed changes cannot introduce other related equipment failure modes. Therefore, the proposed changes do not create the possibility for a malfunction of equipment important to safety of a different type than any previously evaluated in the SAR.

7. Will reduce the margin of safety as defined in the basis for any Technical Specification. No.

Basist The proposed changes do not modify the functional requirements for any equipment required to be OPERABLE by the Technical Specifications. Nor do the Technical Specifications and their Bases directly address the license / design basis requirements associated with electrical independence. Therefore, there is no defined Technical Specification margin of safety associated with the proposed changes.

Nonetheless, the Technical Specifications implicitly assume an acceptable level of electrical independence in order to preserve redundancy and/or single failure assumptions, oc, in other words, minimize the likelihood of common mode failure.

The proposed changes are focused upon the same thing - providing equivalent or better electrical independence to that provided under the current license basis. As discussed in more detail in response to Questions #1 and #3, above, the proposed changes preserve or enhance the reliabilny of, and preserve or decrease the potential for common mode failure in, electrical cable. Therefore, the proposed changes do not reduce the margin of safety as defined in the basis for any Technical Specification.

I 1

l l

l

TE 172-97 10CFR50.59 FSAR Chang s 7.2.2 Design Bases i

The reactor protective system is designed under the following bases to assure adequate protection for the reactor core:

1. Instrumentation conforms to the provisions of the proposed IEEE Criteria for Nuclear Power Plant Protective Systems (IEEE 279, August 1968), ar_a1 soecified below l

l 2. No single component failure can prevent safety action; l l

l 3. Four independent measurement channels are provided for each parameter; j 4. The channels monitoring each parameter are provided with a high degree of independence by separate connection of the sensors to the process systems and the channels to instrument power supply buses. Cable routing criteria are l provided in Section 8.3.7.5; i l \

15. Equipment associated with the reactor protective system is distinctly identified from other plant equipment on plant drawings. Refer to Section 8.3.7.7 for discussion of electrical separation criteria; 7.2.8 Physical Separation The locations of the sensors and the points at which the sensing lines are connected to the process loop have been selected to provide physical separation of the channels, thereby precluding a situation in which a single event could remove or incapacitate a protective function. Those process transmitters which are located inside the containment and which are required for short-term operation following a design basis accident (DBA) are designed and tested for the intended service in the DBA environment. Sensor lines to redundant sensors are run by separated routes whenever possible. Safety related redundant process sensors are mounted on separated racks or are physically separated by barriers when on one rack. Safety-related neutron sensors are located in separated thimbles. The routing of cables from these sensors is arranged or orotected so that the cables are separatedindependent from each other and from power cabling to minimize the likelihood of common event failures. This includes separation at the containment penetration areas. In the control room, the four nuclear instrumentation and protective system trip channels are located in the individual compartments. Mechanical and thermal barriers between these compartments minimize the possibility of common event failure. Outputs from the components in this I

l l TE 172-97 10CFR50.59 FSAR Chang s area to the control boards are either isolated or buffered so that shorting, grounding or i the application of the highest available local voltages do not cause channel malfunction. i l 7.3.1 Design Bases l

The type and quality of instrumentation used to initiate action of the engineered safeguards systems is the same as that used for the reactor protective system. Control l

equipment used to start the pumps and actuate the valves is backed up, rated and l protected to achieve redundancy and reliability consistent with that of the protective I system instrumentation as described in Section 7.2.

l The instrumentation and controls which actuate and control the engineered safeguards systems are designed on the following bases:

1. Redundant instruments are provided for initiating safeguards systems action;  :

2. Three or more sensors are used for each of the critical parameters;

3. A trip from any two of the sensors will initiate the appropriate engineered safeguards action (see Figure 7.3-1,7.3-2 and 7.3-3);

4. Circuits are run-irrseparatesecarated or barriered-wiring-racewaysprotected as specified in Section 8.3.7.7 and 8.3.7.8 and power supplies are taken from separate high quality instrument buses, consistent with the principle of maintaining independence of channels;

5. No singie component failure will prevent the engineered safeguards system from being actuated;

6. Equipment associated with the engineered safeguards system will be distinctly  !

identified in cases where they are not readily distinguishable from others;

7. Electrical circuit separation will be provided between engineered safeguards systems and annunciators and the plant computer, 7.3.5 System Evaluation The engineered safegaurds initiation, control, and power supply systems are designed in accordance with IEEE Criteria No. 279, dated August 1968, or as specified in Section 8.3.7, so that..

8.3.7.5 Cable Routing 1

l l

TE 172-97 10CFR50.59 FSAR Changes I The groups into which cables are separated when routed are large power cables, low-current power cables, instrumentation and control cables, and nuclear instrumentation cables. In addition, the indeoendence of cables for the same group but for redundant equipment or separate protective lnstrument channels are-also-separated from-eachtther;is orovided as described in Section 8.3.7.7 and 8.3.7.8 Large power cables are kept physically separate from each other and from other cables by barriers in the trays or armor on the cables. Power cables are placed in trays with only power cables whenever possible with due regard to cable heating.

Instrumentation and control cables are placed in trays separate from power cables.

When cables related to more than one protective channel or to redundant engineered safeguards equipment have to be routed via the same tray, vedical barriers are provided between cables of the different channels. Nuclearinstrumentation cables are 1

routed in steel conduit or provided with equivalent EMI protection for their entire  !

distance. l The basis for the routing of the cables of redundant systems through areas containing high pressure piping or where mechanical damage is possible and the cables may be directly impacted is as follows: When scheduling the routing of two redundant cablesrA andBronlytable-A required to function to mitiaate the postulated event. A and B.

neither cable A nor B will be routed through an area containing the hazards described

, above._When scheduling the routing of two redundant cables not required to function to mitigate the postulated event, A and B, cable A may be routed through an area

_containing the hazards described above. Cable B will be run via a different route.

Therefore, no additional methods of protection are necessary-because-in-any-such-area,-the-cables-of redundant-systems-are-never found together.

Components within control boards, panels and relay racks are arranged to suit operational flexibility, and the wiring to any-redundant componentcomponents is physically-separated installed and maintained in accordance with Section 8.3.7.7 8.3.7.6 Fire Susceptibility of Cables By routing cables in such a way as to avoid combustible materials, as well as carefully sizing and placing them in their trays, the chance of an electrical fire developing is minimized.

3

- .- - . - - . - - . . . _ . -. - - =..- - -

TE 172-97 10CFR50.59 FSAR Chang s Control cables will not ignite from overloading or grounds since the required circuit protection is provided or the maximum fault is insufficient to heat the insulation to the flash point. Fire in control cables can, therefore, only occur as the result of another fire.

Good housekeeping and sufficient care in cable routing reduces to a minimum the chances of extemal fires.

Power cables can carry sufficient fault current to reach the flash point of the cable insulation; however, protective relaying on the switchgear circuits will respond to fault currents and open the circuit before enough heating has occurred to damage the cable insulation and start a fire.  !

Carbon dioxide discharges into and totally floods the cable vault, the penetration rooms, and the protected and unprotected cable tray rooms in the event of a fire in those areas. Furthermore, a water spray system in the cable vault may be manually actuated as a backup system. Fire stops are provided around trays and in sleeves which penetrate areas where carbon dioxide protection is used.

8.3.7.7 Summary of Criteria i Identification Safety-related equipment is physically identified by its distinctive location or by distinctive marking in cases where there could be confusion between safety-related and non-safety-related equipment. Wiring to safety related equipment is physically identified by color-coding or by its distinctive location. As examples of distinct locations, l the reactor protection system cabinets are set apart from the main control board, and other cabinets. Engineered safeguards contro!s on the main control board are arranged in mimic arrangement unique to the system they are in, and the meters which

! monitor protective and safeguards analog signals are set apart from other meters on the main control board. As examples of distinct markings, safety-related cables are identified with yellow tags while other cables have white identifying tags, and the rear of each safety-related indicator on the main control board is distinctly marked.

The reactor protective system racks themselves each have a different colored decal on the front of each of the four cabinets. The cabling within these cabinets have the corresponding colors. Cables going from one cabinet through the barriers into another cabinet are identified with the color code of the cabinet they exit from and also with the color code of their destination.

Cable trays and scheduled cable raceways are identified with their designation at regular intervals along their route.

Cable Raceways 4 Safety related cable raceways are included in a periodic maintenance program to 4

4 4

i TE 172-97 10CFR50.59 FSAR Chang:s ensure a high reliability of the raceways and the associated cabling.

Cables are not oulled throuah raceways which contain redundant channels of safety related cabling which is not seoarated while the safety functions served bv the un-separated cables are required to be operable.

Access is restricted to the cable vault, cable chase, and the interior of the safety related c' ontrol panels while the safety functions served by the areas and panels are required to be operabie. 1 Insulated tools are reauired for work inside the safety related control canels while the safety functions ser/ed by the panels are reauired to be operable.

Cable _ Separation Cable separation, when required,is achieved by used of the following methods:

1. In separate exposed rigid metal conduit following separate routes where practical.

l

2. In separate concrete encased plastic or metal ducts in the same duct bank.

3. In separate cable trays with horizontal separation. (The tray sides are considered adequate barriers.)

4. In separate cable trays separated vertically by solid tray covers.

5. In separate barrier sections of the same tray.

6. By means of interlocked armor / flexible metal conduit.

l

7. During cable transitions, cable separation will be continuous by one or more of i the following methods:

a. At crossover / cross under points, the method established for one raceway or the other will be maintained (e.g. if the separation method is a metal barrier in a cable tray, then separation at a crossover, such as at a " cross" or " tee", will be maintained by a metal barrier)

b. At transitions from one raceway type to another raceway type, the separation method for one raceway or the other will be maintained (e.g. if the separation method is a metal barrier in a cable tray and the transition is to a wall sleeve, then the metal barrier will be extended from the cable tray to the wall sleeve).

5

TE 172-97 10CFR50.59 FSAR Changis i

c. By maintained open air spacing as supported by industry standard (s) or as established by analysis or testing.

L By two inches of air separation in control panels unless lesser distance is dictated by contact arrangement.

9. Where the reauirements of 1 throuah 8 above are not achievable, the-reauirements of Section 8.3.7.8 must be aoolied.

Cable _lostallation.and Intermixing Cables are installed according to the following criteria

All power cables (safety-related and non-safety-related) originating from one emergency bus are separated from all power cables originating from the corresponding l redundant emergency bus.

Redundant safety-related power cables are separated from each other. Where physical separation is not maintained, the requirements of Section 8.3.7.8 must be applied.

Non-safety-related power cables are not separated from each other or from safety-related power cables.

All dc power cables are separated according to the battery source, one (safety-related) battery system from the other. Where physical separation is not maintained, the requirements of Section 8.3.7.8 must be applied.

Control cables are run in trays separate from the trays used for power cables.

Redundant safety-related control cables are separated from each other. Where l physical separation is not maintained, the requirements of Section 8.3.7.8 must be applied.

Non-safety-related control cables tre not separated from each other or from safety-related control cables.

Instrument cables are run in trays separate from the trays used for power and control cables.

All cables associated with a vital bus are separated according to the vital bus source, each vital bus from the other.

Non-safety-related instrument cables are not separated from safety-related instrument

{ cables. 4 i

l 6 l i

i

m. . - - . . -- , - .,e- .,. ,e c-m---- , - , - - .

4 TE 172-97 l 10CFR50.59 FSAR Changes Cables are derated in accordance with IPCEA tables.

. Cable trays are loaded so as to permit only one layer of power cable in a tray, unless '

calculations justify additional layers. Control and instrumentation cables are loaded so the cables lie within the height of the tray. When cables exceed the height of the tray rails, the requirements of Section 8.3.7.8 must be applied.

J Cables installed in hostile environments are selected with due consideration to the radiation, temperature and humidity which may exist in that location.

Cables in the control circuits for the two diesel generators do not contact any other common cable. Mechanical separation or cable routing insures that no common cable lies against the Jacket of control cables for both diesel generators. Where physical' separation is not maintained, the requirements of Section 8.3.7.8 must be applied.

Separation of Penetration Areas 1 The containment penetrations are located in two rooms which are separated by a fire wall.

l Power and control cable separation is maintained by routing mutually redundant cables j through penetrations which are located in the separated rooms.

Instrumentation cable separation is maintained by routing cables related to vital Buses l 1 and 2 through penetrations in one room, and cables related to vital Buses 3 and 4 through penetrations in the other room. Within one room, separation is further l maintained by using separate penetrations or feed throughs within a single penetration

assembly with physical barriers for redundant vital bus cables.

,Where physical separation is not maintained, the requirements of Section 8.3.7.8 must l be applied.

l l

I p 8.3.7.8 Additional Cable Independence Methods Faults which are postulated to occur on safety related and non-safety related circuits  ;

are prevented from damaging adjacent cabling by ensuring that overcurrent protection  !

is provided to prevent cable damage.

l Double overcurrent protection is provided to ensure the operability of the circuit l protection when considering a single failure concurrent with a fault initiated non-qualified by a non-qualified device.

l l

l Overcurrent protection devices (e.g., breakers and fuses) which provide the required l

independence are procured to the requirements of safety-related devices. When L

l 7

I TE 172-97 ,

10CFR50.59 FSAR Changes ,

double protection is required, at least one overcurrent device is safety related.

Overcurrent protection devices specified to provide circuit independence are maintained '

as safety related devices.  ;

1 1

1 l

l i

i l

I i

l I

i

8 5

- - - - _ - . . = . . - . . - .. .- . . . - - - - - - . . . . _ _ - - . - . . - .. . - _ .

i l

l t

t l

l IL 'Z2.97 ATTACHMENT _2 Summary _of TE 226-96 ChangesEyJheSafetylasessment l

I i

l l

l I

A:\ TRANSFER \TEl72 96 COV

l 1 i

TE 172-97 Attachment 2 l Page 1of 8 CABI E SEPARATION SAFETY ASSESSMENT Safety Assessment Impact on the Separation Requirements Specified by TE 226-96 NOTE: TE 226-96 References are identified in parentheses (). Text in italics ,

provides commentary on the current license / design basis. l A. FIELD CABLE SEPARATION Al Separation by service requirements applies to all cables and circuits at Maine Yankee. Service separation for non-safety circuits is desirable but not required.

(1, 4, 7) Service separation provides boundariesfor EMI rejection designfactors.

Effectiveness ofdesign is demonstrated during normal operation. Not safety significant in that separation between redundant trains is not affected.  !

t l TE 172-97: FSAR revised to allow exceptions for some control and instrument circuits per TE 17-97.

i A2 Cables are routed away from fire sources to reduce the chance of cable fires. (1)

Reduces the chance ofdamage to cables. Fireprotection improvements since plant construction and installation ofthe Appendix R alternate shutdown system have significantly improved overallplant safety. l TE 172-97: No change. j l A3 Power cables are placed in trays only with other power cables whenever possible l with due regard to cable heating produced by nonnal loads (1). Sigmyicantfor i normalplant operation to maintain insulation integrity over time and reduce the

, potentialfor cable overheating andfires.

I TE 172-97: No Change.

A4 Non-safety related control cables are not separated frcm safety related control l cables. Non-safety related instrument cables are not separated from safety related

! instrument cables (1,4) The current license basis assumes that NNS control and l

instrument circuits can notfailin such a way to result in degradation ofadjacent circuits. By extension, the design implies that, similarly,1E control and instrument circuits can not damage each other.

TE 172-97: No change. The technical basis for disregarding the fault 1 l potential ofinstrument and control circuit provided by the safety assesment. 1 Where cable damage potential was identified for some control cables, the j cables were provided with double overcurrent protection, similar to the

, power cables.

i ASTRANSFER\TE172.es AT2

l TE 173-97 Attachment 2 Page 2of 8

! A5 Instrument cables are routed separate from large power, power, and control cables I l for safety related circuits. (1) Good design practice.

TE 172-97: See A1.

l A6 Cables routed through cable trays in multiple layers shall not exceed the height of l the tray rails, barriers, or extensions. (1,21,22) Duringplant construction, tray rails were extended in overloaded areas to ensure that the metal barrier created by the tray rail is efectively in place.

TE 172-97: Tray rails do not need to be extended to provide a metal barrier in those areas where all hazards to the cables have been removed.

Overloaded trays identified by field inspection will be evaluated to ensure that seismic load limits are not exceeded as required by Procedure 17-52.

Where load limits have been exceeded, supports will be replaced.

A7 Cables from the same service group but for redundant equipment or separate l protective or safeguards channels are also separated from each other. (1) General l statement ofthe separation design ofthe current license basis.

TE 172-97: Separation is not required between cables for redundant safety functions in those areas where all hazards to the cables have been removed.

l A8 In areas containing high pressure piping or where mechanical damage is possible, when routing two redundant cables, A and B, only cable A will be routed through an area containing the hazards described above. Cable B will be mn via a l different toute. (l,27B) Important safety consideration. Need to clanfy basisfor breaks and analysis in the FSAR.

l TE 172-97: Cable A or B may not be damaged by mechanical hazards if they must function to mitigate the DBE which has caused the hazard. This is more restrictive than the current license basis where one of the two required channels may be damaged by the event and represents a safety gain, i

A9 Safety related and non-safety related large power cables are separated from each i l other and from any other cable by barriers in the trays or armor on the cable. (1, i l 22) As stated in the FSAR, the design basis relies on theprotective relayingfor these circuits, rather than the armor or barriers.

TE 172-97: Separation is not required between cables for redundant safety functions in those areas where all hazards to the cables have been removed.

Double overcurrent protection shall be provided for all Class IE large power l cables and NNS large power cables routed with Class IE cables.

A10 Power cables (both safety related and non-safety related) from one emergency bus are sgarated from all power cables from the redundant emergency bus.

A tTRANSFERiTE172 96 AT2

. . - - .. ._ . . - - _ - _ . _ - - . . . . -. ..- ~ - . _ ~ - ..

TE 172-97 i Attachment 2 i Page3of8  ;

(Exception: Certain cables to original redundant NNS circuits (e.g. Containment foundation drain pumps) may run together (22,26). The exception allowed relies

, on a single 1E breaker at the safety bus to clear afault. Thepostulated single .

failure of the 1E breaker may result in the loss ofthe entire safety bus. The 7

opposite train safety bus would not be affected. j

\

TE 172-97: Separation is not required between cables for redundant safety )

functions in those areas where all hazards to the cables have been removed.  ;

l NNS circuits from safety busses shall de provided with double overcurrent protection to eliminate the potential cable damage hazard. The overall plant margin of safety is increased by significantly reducing the likelihood that a i safety bus would be lost as a result of NNS equipment failure and concurrent )

failure of the single Class 1E protective device. i l All Where power cables (both safety related and non-safety related) larger than 1/0 l_ AWG cross raceways containing redundant safety cables, flash protection, i l equivalent to a tray cover, will be provided for the safety cables (22). The barrier l provides limitedprotectionfrom afault ofa large cablepostulated to result in a fire.

TE 172-97: The hazard presented by power cables larger than 1/0 AWG is  ;

eliminated by double overcurrent protection. When the cable damage  !

hazard has been removed, flash protection equivalent to a tray cover is not t required.  !

t A12 NNS power cables will not pass from one train raceway to another containing . i redundant train cable (no tray-hopping). (22,24) This design requirement l addresses some oftheproblems created by installing Class 1E and NNS cables in i the same raceways. The requirement addresses those cases where one NNS ,

circuit is postulated tofail. The Appendix R Alternate Shutdown System greatly improvedplant safety with regard to NNS cablefailures and thefire damage which may be postulated to resultfrom suchfailures.

TE 172-97: The hazard presented by power cables is eliminated by double  !

overcurrent protection. When the cable damage hazard has been removed, i NNS cables may be routed with both safety trains without a mett.1 barrier between the NNS power cables and redundant safety related cables.

l

! A13 Power cables may be routed with control cables through floor sleeves beneath a

> MCC. This application is an exception, not a standard practice. Previously

established criteria to separate power and control cables shall govern when at all i possible. (21,23) Not significantfor MCC circuits because thepower and l control circuits run in the same wireways within the MCC. For switchgear i cables, control circuits required to clear afault postulated on the power cable j could be damaged by thefault. The safety sigmficance or routing the power and l control circuits through the same sleeve is minimal because only one train, which l

. ATf5tANSFEmTE172-es AT2 i

I i

l l TE 172-97 l Attachment 2

! Page 4of 8 l

would have to befaulted to create the ha:ard to the control circuit, would be affected.

j TE 172-97: No change.

A14 At tray ends and transitions, cable separation will be maintained by metal barriers >

or the required free air space. (1,7,9B) Application ofthe industry standardsfor I

requiredfree air space must, in each case, be accompanied by an engineering evaluation. The industry standard makes use ofcable insulation andjacket materials tested and quahfied in accordance with IEEE Standard 383. Cables ins talled during originalplant construction are constructedfrom different materials.

l TE 172-97: Air separation is not required between cables for redundant safety functions in those areas w here all hazards to the cables have been removed.

l L A15 Safety related 125 volt DC circuits from one battery shall not be run in the same i raceway with safety related circuits from any other safety related battery. It is j preferred that the same separation of non-safety related 125 VDC circuits be I maintained in the same manner, if possible. (4) The barrier system provides l limitedprotectionfor allfaults postulatedfor DC bus circuits. l

! TE 172-97: Separation is not required between redundant Class IE 125 VDC cables safety functions in those areas where all hazards to the cables have been removed. NNS circuits connected to the Class 1E battery busses will be provided with double overcurrent protection to eliminate the potential cable damage hazard. The overall plant margin of safety is increased by significantly reducing the likelihood that a safety bus would be lost as a result of NNS equipment failure and concurrent failure of the single Class IE protective device.

A16 120 volt AC circuits from one vital bus shall not be run in the same raceway with circuits from any other vital bus. (1,4) Effectiveprotectionfor all VB circuits.

l TE 172-97: Separation is not required between redundant Vital Bus cables >

l in those areas where all hazards to the cables have been removed. The overall plant margin of safety is increased by significantly reducing the likelihood I that a Vital Bus would be lost as a result of NNS equipment failure and concurrent failure of the single Class IE protective device.

A17 120 volt vital AC cables and 125 volt DC cables can be run in the same channel of a divided tray, as long as they are comparable channels (Battery I with Vital Bus

I, etc). (l3) Clarification ofwhich channels perform redundantJimctions.

TE 172-97: No change.

A \TRANSFEmTE172 9e AT2

l l

l TE 172-97 Attachment 2 Page Sof 8 A18 Safeguards actuation circuits are separated in the same manner as the protective I instrument channels. (15) Clarification only.

TE 172-97: No change.

A19 Safeguards actuation circuits for components which may be aligned as either ,

Train A or Train B shall be routed separate from other safety related Train A and  !

Train B circuits. (16,32) Because these circuits may aligned as either safety train, they may not run with Train A or Train B.

1 TE 172-97: No change.  !

A20 Protective channel cables are separated from cables of other protective channels when tenninated in the control panel. (3) Separation protectsfrom external physical ha:ards, other thanfire.

1 TE 172-97: Separation is not required between circuits for redundant safety functions in those areas where all hazards to the circuits have been i eliminated, and maintenance hazards reduced to an acceptable level. Cables will be identified with channel color code in the control panels. Strict controls of maintenance and installation activities is controlled by improved -

administrative procedures.

A21 NI cables are routed in steel conduit or provided with equivalent EMI protection for their entire distance. (1) Provides the required EMIprotectionfor these channels tofunction in a high noisepowerplant environment.

TE 172-97: No change. l A22 Cables in the control circuits for the two diesel generators do not contact any other common cable. Mechanical separation or cable routing ensures that no common cable lies against thejacket of control cables for both diesel generators. (1) This is a higher degree ofseparation than applied anywhere else in the plant and i follows the associated circuit separation criteria ofcurrent industry standards. l l

TE 172-97: Separation is not required between cables associated with 1 l diesel and cables for the redundant diesel where all hazards to the cables

have been removed. Potential common cables with cable damage potential l are provided with double overcurrent protection to eliminate the cable l damage hazard.

1 i

A23 Separation between nonnal and altemate shutdown capability cables shall be maintained in accordance with 10CFR50.48 Appendix R per the Maine Yankee Appendix R Reference Document. (1,33) Separation is provided by three hour rated barriers, not the metal barrier system.

TE 172-97: No change ermsmnroner2

I TE 172-97 Attachment 2 1 Page Sof 8  !

B. CONTROL BOARD AND CONTROL PANEL SEPARATION ,

B1 Components within control boards, panels, and relay racks are arranged to suit i operational flexibility, and the wiring to any set of redundant components is physically separated. (l,13) NNS circuits are not separatedfrom Class 1E I circuits. Tise 2 inch separation provides minimalprotectionfromfire. '

TE 172-97: Separation between redundant circuits is not required. Circuit damage potential will be eliminated in control panels. Internal equipment hazards do not exist. Damage to two redundant circuits by maintenance i hazards are reduced to an acceptable level by training, procedures, and  ;

access controls.  !

B2 Separation is not required for NNS circuits in control panels. (9A) Reflects  !

original design assumption that circuitfaults will not occur in panels and disturb -

adjacent circuits.

1 TE 172-97: No change. Cable damage potential will be eliminated as i described in the safety assessment.

B3 Control panels designated to serve a single safety-rela:*d channel, such as the ESF  ;

cabinets, Auxiliary Logic cabinets, and MCB rear cabinets, should not contain {

any circuits from a different channel. Where it is necessary for a redundant circuit  :

from a different channel to enter the cabinet, separation shall be provided by flexible conduit or a similar physical barrier. (5,13,14,15) Clarrfication only.  :

TE 172-97: Separation between redundant circuits is not required. Circuit damage potential will be eliminated in control panels. Internal equipment hazards do not exist. Damage to two redundant circuits by maintenance hazards are reduced to an acceptable level by training, procedures, and access controls.

B4 Cables entering control panels containing multiple channels shall enter the panel as close to the terminal point as possible. Where a cable may contact the l redundant component cable from the opposite channel, separation shall be l provided by flexible conduit or a similar physical barrier, or by maintaining the required air space separation. (6,11,15) Goodpractice and clarrfication.

TE 172-97: Separation between redundant circuits is not required. Circuit damage potential will be eliminated. Internal equipment hazards do not

, exist. Damage to two redundant circuits by maintenance hazards are reduced to an acceptable level by training, procedures, and access controls.

i B5 Redundant circuits terminate at separate terminal block risers. Where it is j l l l

ATTRANSFERtTE1T2.es AT2

. - l

1 TE 172-97  !

Attachment 2 l

! Page 7of 8 necessary to terminate redundant circuits at the same terminal block riser, separation shall provided by flexible conduit, air spacing, or other approved method from the opposite channel circuit. (3,12,15) The separation in the terminal block risers reduces the likelihood ofmechanical damage byprotecting

, one channel with armor.

l TE 172-97: Separation between redundant circuits is not required. Circuit damage potential will be eliminated. Internal equipment hazards do not

exist. Damage to two redundant circuits by maintenance hazards are l reduced to an acceptable level by training, procedures, and access controls.

I I B6 Circuits serving redundant components arranged in close proximity for operational flexibility shall come no closer to each other than required by the l component arrangement. Circuits shall then be routed in different directions to

maintain separation. (18,27A) Exclusion built into original designfor 1 practicality.

TE 172-97: Separation between redundant circuits is not required. Circuit damage potential will be eliminated. Internal equipment hazards do not exist. Damage to two redundant circuits by maintenance hazards are l reduced to an acceptable level by training, procedures, and access controls.

l \

l B7. Redundant circuits are separated from only circuits of the opposite channel i providing the redundant function for the same safety parameter. (1) A strict l interpretation ofthe FSAR statement which is less restrictive than other design l requirements. Focus is on the true safety issue ofindependence ofredundant l

safetyfunctions. l TE 172-97: Separation between redundant circuits is not required. Circuit damage potential will be eliminated. Internal equipment hazards do not exist. Damage to two redundant circuits by maintenance hazards are reduced to an acceptable level by training, procedures, and access controls.

B8 Vital bus, safety-related battery, and protective channel circuits mnning from one l section of the MCB to another are run through raceways on the top of the MCB i which are physically separated. (13) Implementation consideration.

TE 172-97: Separation is not required between redundant Vital Bus circuits in those areas where all hazards to the cables have been removed.

The overall plant margin of safety is increased by significantly reducing the likelihood that a Vital Bus would be lost as a result of NNS equipment failure

and concurrent failure of the single Class IE protective device.

4 A STRANSFER.TE1T2-98 AT2 e

. - - . - - - . . ~

l l

TE 172-97 l Attachment 2 l Page Bof 8 l

B9 Wires in the control circuits for the two diesel generators do not contact any other common cable. Mechanical separation or cable routing insures that no common cable lies against thejacket of control cables for both diesel generators. (1) l Higher degree ofseparation than applied anywhere else in theplant. Follows the associate! circuit separation requirement ofcurrent industry design standards.

l l TE 172-97: Separation between redundant circuits is not required. Circuit

! damage potential will be eliminated. Internal equipment hazards do not ,

f exist. Damage to two redundant circuits by maintenance hazards are l reduced to an acceptable level by training, procedures, and access controls.

l i B10 Safeguards actuation circuits for components which may be aligned as either Train A or Train B shall be routed separate from other safety related Train A and Train B circuits. (16,32) Because these circuits may be aligned as either train, ,

they may not be routed with Train A or Train B. i TE 172-97: Separation between redundant circuits is not required. Circuit damage potential will be eliminated. Internal equipment hazards do not l exist. Damage to two redundant circuits by maintenance hazards are

! reduced to an acceptable level by training, procedures, and access controls.

i l

I l

I i

A tTRANSFER\TE172W.AT7 l

-. . . = - _ - . __ - _ . . _ - . _ - .- .-.. - .-.._. -. -.--.-.- -.. -. . _._ - .-

l l l

1 i

1 1

\

TE 172-97 ATTACHMENL3 Representative Photographs 3ndDescdptions l

l i 1 l

l l

I 1

I l

r l

l l

l l

A ATRANSFER\TEl72 % COV

TE 172-97 i Attachment 3 Page 1 l REPRFRENTATWE PHOIOGRAPHS Picture 1 Typical metal barriers in cable trays conforming to the original construction i separation requirements. The metal strip in the tray running from left to right on l the page separates Train A circuits in the lower section of the picture from the Train B circuits in the center of the page. Train A circuit crossing under the Train B Section of the tray are separated by the horizontal plate. Train A and Train B circuits entering the conduits just left of center are separated by the small aluminum sheet. The cables are Class 1E, as indicated by the yellow cable tags.

Picture 2 Cables in transition from horizontal cable tray to wall sleeves. The barrier strip in the tray is visible in the upper left corner near the cable tag strings. The hanging streamer is a marker from the walkdown effort.

Picture 3 Cable tray tee repaired with sheetmetal and metal braid wrap to provide separation between cables on the A-side and B-side of the tray. No cable tags are hung in this area. This type of repair was discontinued . The metal barriers in the tray would represent a significant hazard to any cables pulled through the tray in the future.

Picture 4 Cable Vault overview, looking West. Room size is 10 feet by 40 feet. Each tray carrying safety related cables carries cables from both trains, separated by a metal i strip. All Emergency Diesel Generator, Safeguards, and Protective Channel  ;

circuits are routed through this room. The Cable Vault has limited access through l A normally locked floor hatch. Fire protection is provided by an automatic CO2 l system and a manual water spray system.

1 Picture 5 Transition area between the cable trays in the Cable Vault and wall sleeves. l Picture 6 Transition area between the cable trays in 'he Cable Vault and wall sleeves. There is one foot of space between the cable trays and the wall.

Picture 7 Flexible metal ducts providing separatio 1 between protective channel instrument circuits from original construction.

Picture 8 Maine Control Board Section C, view from under the bench board section.

Switches shown are Train A and B safeguards actuation circuits. Color-coded cable ties and switchboard wire are visible (Signature copy contains color photos).

The wiring at the bottom is the logic chassis for the ECCS valve position indication light on. Train B (left) and Train A are separated by the metal barrier I i in the center. l l

l TE 172-97 Attachment 3 Page 2

Picture 9 Typical terminal block riser in the Main Control Board. j Picture 10 Flexible conduit used for separation between the control circuit to the reactor trip push-buttons.

Picture 11 Color coded SIS wire to Class IE control switches in the Main Control Board (Signature copy contains color photos).

Picture 12 Metal flexible conduit used for separation in the Main Control Board.

I Picture 13 Main Control Room Air Conditioning Control Panel. Train A and Train B circuits rovted together during original plant constmction. No color coding was provided.

l Picture 14 Field cable terminations in the Air Conditioning Control Panel. Terminal block section TQ is Train A and Section TR is Train B.

l l

I I

i t

)

i i

---

,_mamm----_,m- ow- - ou o - --

m.a t-- l

~ .

f'

.} jD~

e r -

.' ~ ' .

l

}

Q 6 i

/

J Ut i

E  :

p w .

l i~ . i h-  !;

94 ,

.j,.g  ; . ..

f

. n a

~

1. $ C, 4_ <

.=  ; -

s .

m L p L.a _

, i "D' . < _;r_

, =

~

I

[ .

m- ,

c l i

., o

?

h~ .

E

~

I

_ - - - - - _ _ - _ _ - - - _ - - - _ _ - _ _ - _ _ _ - _ _ -_ _ ._ _- - - - - - - , , , - - , - , - - - , m---- , -- ,---m- --- -~

% ,j

~.myzgjkys7s o.

- E c _ _ __ _, . -w . -

.~1

• ' ? -

-- <- w' g

-M N- -

e

. . %,, . -- .- 1lp w e .,

_. y

~ ~u .

I

, . N.

~

j L:

f; -

\'.

.s ,

% ,' .. I g

~

'f l nj F .,

m '

r

• • :, )

~

.4 l  %)k.' , .

}& ,

1 l] [,f \- ,..If Photograph 2 of 14

--- w-~ .s,o,m.nw_-~~w._.a_-_mmm - - -

m .

D F

i

! 1 l

l

! t 1

A Afi($d IN

_N?k? .

l l

s l

l  : .

=

^

a

--I

(;

5

, I e

i

.. e a k \' - -

.1 h!

j gj EI l

"he_k.a A. Ja.4.em.ai.m an.de 4% Jhamaea d a.d.h & AM MM ad

m. 44m ma a - -

4 mene.sh h 4m.

p

.L j."y, ," f/ D "/ f

+

i a ,

.g J

, 4 /

[

~

I -

(

.yi

.( ,

I w

-s

\' . >*

J t ^ >;

/

/,j f e l .Qr ,.i

'pf 4 .

j ~ .. *

,'f-, \

, ~

.' ffIY '

, y. ! p

~

o.o y -~~-

-~ ; .ihhNh

• 3 . g.mp -

3 a'

"M,k3

,. 4

., ~7 g3 y

7.; C

'; .1%;y j . gdMj ' ,.

.M',

I #

,, *g g,

q 9

' x - _.

, v - ,- m q

• __!!3L rs g

, >,x, -

' * /l j $ ' , T .'s 6

~

'.,87 f I ;ltri . * \\s l

• 4 Il .,

i ., .

e

.et

, 8. .

< .P l 1

, s ,. -

8 e T g \\

g V f - -

i ,

8h 4

-\" .

\ 4 y 8 . .' W f

b _. _ 1 l \ <

E. I ea ' \ W g

t ,

l' .

p,

n. 1 l

s '

en G.klf

\

[ s

\ I' k

,\

j;-- p .y

. ' x1 t , ,

\ , ,

\ ' _

\

l

~

- +

.g

\

~

}ll' v

/ ,\

\

5

\

%*%, 3W-7 .l gs e

\

\ .

\

,f: #

,. z j Pho\09'3pd 5 of N j--'"

_g__- amm 4:gJh. OM.4m m ui.s"' ' ' '

1 J

B 4

8 9, W m = R. ._.; $

1 ,

l "\ ; - c '* '. 'f _ , h.  ;, >} _ . , .

l b f '(i ' g .

F

4

7 '

. ~ J, g., f^ r ( ,.<

et f,9l. -

w-gg , e , %g

..,m ie ,

g g, # $

4 Y*g2*Th4 :'71lOj/ h'h6h

}\

T4, (

o

}

Q $#;b) M t M W g r_,0: 4 '

im!v: p t ;rm::w.:

run., *44 - p nnq ~

1

% g',. ,,. - .

.7 rv~

w.A,7.s, e:yy ;; 4 w - "

• g \. j w <

p QOhiOS, aAZLAWa V . . DJ M ~S h' / .'

W P' wWp&:3:yy Qk2,"llYh(+ > %y.,p  !,,k'$

-v IDa. -

,/

p '.

g u. .ma ,geM':]'As,{ f gh %s., g $

MMf { tT7 9,f QQp' j

\

weh::4%-

i 4

,w pW-#,,'- s- , ,u . .

• ' / f , 4, , . ~&%

~

• l y

, ..

.- e ..[- l

.\

y hp m ,e ~

[~ .

j ~

? > p ~.;,- ~ ' v} ' s ./ 1r- [

ww agg shN

,f ,....a.-.

?

.a a E'.

y-

'N

. 3g,

,/ Y

. - _ .. - s

. s .

1. • 4 S

m _, l * '

l w.

3

./:. ;,4 #itt '

, ,tA$g*o

m v.' / [_

g

,( p dhai . 1 '

} ,

~ yp'. .

7.g '" '9 ikf .

w.-

0

'.h s .,

' # ar e ones*

l vu pS=- M l .

jyj ,

. - \ .

.* ( *>

"O

. L a n 99 j . .

.m .s e O

~

1. 1. r O

o f g

• r g Q g 4

a-_-- - - -

p1 .

y 1

1 .-

[ fY')p Q

w y_;

g.

[r. .

%yy ,

v. .

g' g,

p n

~

s).

w w a, y ew4

$d[il? .,

w>.a:n . '

..+.w.

' " ~

1 I* .

j ,

gg

. j.jg gr;. .

p q v4 4

. ~ ,

1 y . g

.k j .

I~$ '

3; R..

'y

. f

-: q't' . .

y}, w '

4

~ ' '

.  : . , , = - "

l

' 1 -

i/

%_]d

. . T." ' '

y-

) * '

p

_s .*

4 .

_ , ,f, .-

y t

a j -s .

" & }l *

.4 BL-p, 4 M. ,.

[.~_ ~$ .o i.,

. ---- m- . .

.r

, 5 0 g N g

f y cL, ge 5

W 3 7 . . .

j < 4,, . . . .. . . . . . . . . -r . g1

k..

e.

4 . . -) , ,_

t c

a. 3

}

lliM MF N .' . ,

I m

i

li '

u l

~

l y,-e - ,

i

' I i

'p,:

'45 s ~*'.: * '

• n

} T l

.5D.?:~1$$!d .'

l ml a 3l l .

~: _ - ' _' d Mn

'3 4

21

. > f v ,, 53 te

\ 71

\ '

s

\ y 4 \

i r.-

2 ..

e e

c' e"> 7, $

j s

kk ..

4 93 n

IT 15 L

\

\

\

\

geoy 9.!'2 "^

1_

f  ;- . . ., p45 + a' l '

[h " -

E * >ev e n. R .,

9

'l

,)

.s ,

t\U1 w _ -

- ' /' .,

ig f3P ,

pop

. . , . +

j<

+ ..

, y .,-Q.

. ._ u ,

, n ,

.}*

'b, ' .

\g,,s I, 4"-

, /,

/

, , x. .% h s

& _' r' "

- s n 3, gJy -

._ . w. n gg . -

. K {T}_ ..MT.:

1 g '. i.

j

= - ' ' '

d 4

\ g . ..

^

~

, ~

i -

f. i .

.- l

- ~

4 '

l g.  ! e 4 ' 'g I

=g lf. '.' 4 .. N.

\

l & -

t,'

~ ,

g. ,

~

l

? Jr , ,

l --- / } , . , ,

G , .

i ,- .

• &)y- $; . l_

~

_. ?i-1 M. g eg.

_. 4 F-

, u. g. .- g j. ,,-<

l ~1 - p .-

• *s.*

-w -. .-

~_

. . . P ~.

2 l

l h

i i

Sectiori'A, HR i 4 .'

i e '

i 4

f Photograph 10 of 14 l - - , .... .

a 4

i 1 _

u

) i

$j ..

\  ;

,l '-

-. AL f ' ,

^

d!

.p-

/ --

V' 2

.s

\

\ \

t

\  ; ,.

, . . ,, 1-

' u.

i

.. 'N, ,

$ 4 3;.

_ 6/~ _ .

• 7 i_ .,

s

, ' . . - ~

It

' ~

\

, ., ' t -w

\

\

Photograph U OI

, ,,,,o,a-

mam magiamm, sa , ape imemmam A g.w..mha._4.am_aha*m.m.m.m diL.Jrgum am e _m,a.am e u Ju e, e _ m a me w mama a sumumae.m.,s.m u e.a._um4mmeo -en am , e.nui.sem ma .

j __ _ -

3 w .e j .y 2

l g$4

['

-^

, '. l

.i 1

j  ; j Mj9 x -'

() ,

io

( . -

g M } .

i?L.$$$:,. ~ :,

y n ,

, I G  :

1 '

qv i

7

,d i .<

'lf y

f $y 5 i 'l '\ t ';:::..4 1

l lr k' a 4 . I

(,

7((

I ...,

e ej i hi, i

( < i; Fd

( ( <l

( r (

L' ' . g I

2 O

I I i i i 4 e t

}  ; .

Fl l H EI

k!??Sb5k5S?? ,~

~ . 444;em cysm~ e ,

Qt  :

ll~ ,@ 8 ?-

'

• 8 f. . ,,pg 9-

• 3

, , w ta in te e y

sty ~

ll^ . e e ,, Q, l

.x .

>- +

. , =

..~p f

' m- ars

' ora. ~.

e :n A $h

.? Y

- + ij;CY$ "

ff2. l[ Ag .n.2 M2%!A

. 1T ea.~

~,

5::d} 2

fik$

nn amn

$$t w 3 v_ ,

a_e -

is u

i i, I -

i r.-rz . -

4.- >

m ..

.h.

h ..:s f)f 2c.

i -

@lQ. i 2 e I

. . _ , .T' : *- ~" c-~ $.y0?

MC9_ !i s fll . . rM ACCP Front Panet & 1B Panel 2/26/97 Ref: Engineenng Drakncj' fe3elt.m(9799.ea,g)rac@ ting Photograph 13 of 14 c ,_,,.....,m.

i l ?R F, _A l ,[Q*% %  ;;Q[

n ,.

A l 1 i ~,' ?

, .{ .

.i j <;1 f! .

,s [ .'

h:. . _7,- g

• g

.t l t

?)$a ee I i

l iji s

cc;7roni

, Panel & 1B Panel

%l"?";;rO*;"6 -

thogag,}4 oN4 j ..

s

ENCLOSURE 3 List of Attendees i

I i

R. Cooper, Member of Public P. Gunter, NIRS R. Shadis, Friends of the Coast (FOTC) i J. Block, Attorney for FOTC i S. Gwale, Member of Public A. Kreider, Member of Public l

J. Gyrath, PECO Energy l G. Hunger, PECO Energy J. Valentino, International Access Corporation S. Urbanowski, Maine Yankee, Design Engineer, Electrical '

L. Lozano, Maine Yankee, Design Section Head i M. Meisner, Maine Yankee, VP, NS&RA B. Fraser, Maine Yankee, VP, Engineering P. Dostie, State of Maine Nuclear Safety Insp.

R. Summers, Project Engineer, USNRC, Region i D. Chawaga, State Liaison, USNRC, Region l N. Sheehan, Public Affairs, USNRC, Region l G. Guthrie, Reactor Engineer, Region i G. Morris, Reactor Engineer, Reg lon I W. Ruland, Chief, Electrical Engineering Branch, DRS, Regiore 1 C. Cowgill, Chief, Projects Branch 5, DRP, Region 1 J. Yerokun, Sr. Resident inspector, Maine Yankee, Region i D. Thatcher, NRR/EELB, USNRC N. Trehan, NRR/EELB, USNRC l C. Smith, NRR/DRPE, USNRC D. Dorman, NRR/DRPE, USNRC l

l i

i l

l  !

~

l l

l l

J l

I

,