ML21294A113
Text
SSES-FSAA QUESTION 032.1 Section 1.6 references GE topical report NEDO*l0466, "Power Generation Control Complex Design Criteria and Safety Evaluation." This topical report is presently undergoing review. Therefore we require that this topical report be included as a reference in the appropriate section of Chapter 7 and that you provide a commitment to adopt the resolution on this topical report achieved between GE and the staff. In addition, address in the FSAA all the interface requirements of the topical report.
RESPONSE
The topical report was approved by the NRC on July 13, 1978.
The reference in Section 1.6 has been changed to 3.12.3.4.2.1 (f) to which the following was added:
Power Generation Control Complex - (PGCC) Considerations Detailed design basis, description, and safety evaluation aspects for PGCC System are comprehensively documented and presented in GE-Topical Report: "Power Generation Control Complex; NEDO-10466 and its amendments,"
The FSAR does address the system interface requirements that are applicable to FSAR Chapter 7 systems. These system requirements are separation, color coding, and equipment qualification which are addressed in Subsection 3.12.1.
Rev. 46, 06/93 032.1-1
SSES-FSAR QUESTION 32.2 Section 1.7 states that:
"Table 1.7-1 contains a list of non-proprietary drawings electrical, instrumentation and control (EI&C) drawings.
This table lists those drawings which were considered to be necessary to evaluate the safety-related features in Chapters 7 and 8 of the Susquehanna Unit 1 and 2 FSAR .
This table will be updated in future amendments when necessary."
Verify if this list is intended to be a complete list of electrical, instrumentation and control drawings which contain safety-related equipment. In addition, provide all electrical instrumentation and control drawings pertaining to safety systems for staff's review.
RESPONSE
The list on Table 1. 7-1 is a complete list of electrical instrumentation and control drawings which contain safety-related equipment. Copies of these drawings have been provided to NRC under separate cover.
Rev. 46, 06/93 032.2-1
SSES-FSAR QUESTION 032.3 Section 3 . 11. 2 states, 11 Instrumentation components have not been qualified to the environmental qualification program delineated in IEEE 323. 11 Therefore, provide a comparison which delineates each deviation from IEEE Std 323-1974 and the justification for the deviation.
RESPONSE
Individual devices and assemblies have been seismically qualified.
Compliance with IEEE 323-1971 for Non-NSSS class lE electrical equipment is discussed in Subsection 3.11.2.1.
General Electric has complied with IEEE-323-1971 for the environmental qualification of Instrumentation Components for the NSSS systems.
Rev. 49, 04/96 032.3-1
SSES-FSAR QUESTION 032.4 Provide a summary of the temperature qualification of the safety related instrumentation and control equipment in all areas of the plant outside the containment.
This summary should include:
(1) The plant location under consideration (e.g. the room and building)
(2) The type of
- instrumentation and control equipment located in the area, (e.g. transmitter and controller)
(3) The ventilation provided for the area.
(4) The temperature extremes postulated for the area and equipment (including consideration of loss of forced ventilation, if applicable) and any temperature monitoring instrumentation in such areas.
(5) The equipment temperature qualification limits.
(6) The list of supporting qualification documentation for the equipment (e.g. test reports and industry standards).
RESPONSE
Parts (1) through (4) are responded to in new table 3.llA-1.
Parts (5) and (6) are responded to in new table 3.llA-2.
Rev. 46, 06/93 032.4-1
SSES-FSAR QUESTION 032.5 Section 3. lOa. 4 .1 and 3 .11. 3 .1 of the FSAR state that the seismic and environmental qualification tests results for GE safety related equipment are maintained in a permanent file by GE and can be readily audited. Provide a listing of the available subject reports for this equipment.
RESPONSE
Table 3.10a-1 contains sufficient information upon which to determine acceptable qualification levels. The qualification test results are traceable by equipment and device designation to the permanent files.
Rev. 46, 06/93 032.5-1
SSES-FSAR QUESTION J)3 2, 6 Provide a complete discussion of the instrumentation {pressure switches, manual control switches, and wiring) associated with the nuclear pressure relief system described in Section 5. 2. 2. 4 of the FSAR which actuate the safety/relief valves on an overpressure event or through operator action. Include elementary wiring diagrams as appropriate.
RESPONSE
The pressure relief instrumentation which controls the electrical operation of each valve is shown on Figure 032.6-1 (typical diagram). Each valve has its own pressure switch which acts to open the valve directly when it senses high vessel pressure unless the control switch {S8 in the diagram) is in the "OFF" position.
This control switch is a maintained contact switch which may be selected for one of three positions: OFF, AUTO or OPEN. With the switch in "AUTO", pressure at or above the setpoint closes the pressure switch which actuates a relay which opens its respective valve while simultaneously switching indicating lights. When pressure drops to an acceptable level, the pressure switch reopens causing the relay to deenergize and reclose the valve.
Manual control for opening the valve is initiated by simply placing the switch in "OPEN" thereby bypassing the pressure switch relay and opening the valve directly from the switch contact (5-6 in diagram).
The switch may be placed in the "OFF" position for maintenance or pressure switch calibration, etc. However, since this action renders the valve inoperative electrically, an annunciator window is provided to remind the operator of this condition which cannot be cleared until the switch is placed in either "Auto" or "Open". No electrical action will inhibit the valve from opening at its designated mechanical spring pressure relief setpoint. The safety relief valve control scheme is shown in the ADS elementary diagram for all valves, however, only a portion of a valve is wired for ADS action. For this reason, all valves are provided with 3 solenoids. Those designated for ADS utilize solenoids A and B (Div. l and 2 respectively). The safety relief logic is wired to solenoid "C" which is piped to separate air accumulators from those of ADS. Only one power division is required for the safety relief electrical control functions because each valve has a diverse back up mechanical spring setpoint capable of non-electrical safety relief action.
Rev. 46, 06/93 032.6-1
1-2 X SWITCHS8 OFF AUTO X
OPEN X
If=-- loPENt ICLOSE) rll-18 H12-P60M9C 5-6 1-8 9-10 11-12 X
X X
X X
X I
I
- ~- -,--
3 & S8 7....
B A
R B
A A
11 12 1~14 15-16 X X X
13......r 0
I 0 0 f
0 C 4 II I
0
--
- 4
-83
' 156 DOD 11 DOD 4> ODO C C ODO 1, u 00 II 4, DOD 6-1 6-2 6-3 DOD 8,8 ODD DOD DOD 6-7
&4 6-9 6-10 6-5 4 5, 3 I DOD
~ K22 i I'
- K23 i "K23=r 1-6 FS3 -----
HID -*- - ~
F~~ 1 AMP1 P*Fl I C+) 1 R13 I
- I----
I K22 b]:~p I 125VDC SH 1. FIG. 1 DRVWELL PENETRATION l L:
(-) (REF)
-- 0002-9 I 0002-10 I
' K22 0
DOD2*11 D002-121 H12~
1 I - --,
2 IP10-EI
-~- It ~14 C T-v1 valve) unless "C 11 also were to fail permissive {a double failure). This is likewise true with logic B and D in Division 2. This is accomplished simply by wiring the 11 A[B]" - final actuator relays within each valve control circuit as shown in the simplified sketch on Figure 032.11-1.
The ADS system, comprised of two independent sets of controls for the two pilot solenoids, meets the single failure criterion. This arrangement utilizes two out of two logic in each of the control channels which prevents the single failure from causing system initiation. Tolerance to the following single failures or events has been incorporated into the control system design and installation:
( 1) Single open circuit,
{ 2) Single short circuit,
( 3) Single relay failure to pickup,
( 4) Single relay failure to drop out, (5) Single module failure {including shorts, opens and grounds),
{6) Single control cabinet destruction (including multiple shorts, opens and grounds),
(7) Single instrument rack destruction (including multiple shorts, opens and grounds),
(8) Single raceway destruction (including multiple shorts, opens and grounds),
(9) Single control power supply failure (any mode),
(10) Single motive power supply failure (any mode),
(11) Single control circuit failure, (12) Single sensing line (pipe} failure, (13) Single electrical component failure.
Rev. 46, 06/93 032.11-1
A (B) C (D)
CLOSES ON HIGH PRESSURE CLOSES ON LOW LEVEL I-----I
- r:::
I - - - - -:::r:::
A (B)
I C (D)
~ A (B)
C ::ICAL VALVE SOLENOID FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT ADS VALVE CONTROL FIGURE 032.11-1, Rev 47 AutoCAD: Figure Fsar 032_11_1.dwg
SSES-FSAR QUESTION 032.12 Section 7.4.1.1.3.1 of the FSAR states that the RCIC system pumps water from either the condensate storage tank or the suppression pool to the reactor vessel. Explain how this selection is made.
RESPONSE
The suppression pool water is usually of a lower quality compared to that of the CST, therefore, the CST is the prime source of RCIC pump suction. In the standby condition the RCIC pump is lined up to take suction from the condensate storage tank (CST); hence, when the RCIC System is initiated, either due to low reactor water level or operator action, the pump will initially take suction from the CST.
If the CST inventory is satisfactory, no further operator action is required; however, if the water level is low, an alarm sounds in the control room indicating the pump suction must be shifted to the suppression pool for uninterrupted RCIC operation.
FSAR Subsection 7.4.1.1.3.6 discusses this arrangement. The selection is made by the operator.
Rev. 46, 06/93 032.12-1
SSES-FSAR QUESTION 032.13 Section 7.5.la.1 of the FSAR states that the elementary diagrams illustrate separation of redundant display
- instrumentation and electrical isolation of redundant sensors and channels. Provide specific reference drawing numbers containing the above information.
RESPONSE!
The elementary diagrams of the safety related systems are identified in tabular form in FSAR Section 1.7.
No specific reference drawing numbers can be provided since the requested information is not limited to a few drawings, but is contained on most of the elernentaries.
Rev. 46, 06/93 032.13-1
SSES-FSAR QUESTION 032.14 Completely describe the interrelation between the instrumentation and circuitry which provides information to the operator to enable him to perform required safety functions, and the other instrumentation and circuitry of the Advanced Control Room (ACR).
RESPONSE
The Advanced Control Room (ACR) design is no different than previous control rooms as far as safety functions are concerned. The only difference which exists is the method of presentation of certain non-safety plant data with a redundant video display system. In addition to the hard-wired panel indication, safety related information is also available to the operator via the video display system.
Rev. 46, 06/93 032.14-1
SSES-FSAR QUESTION 032.15 Provide the functional control diagram and associated elementary wiring diagram for the Recirculation Pump Trip (RPT)
System.
RESPONSE
The Recirculation Pump Trip (RPT) System information is contained on IED729E611AE (Reactor Protection System Figure 7.2-1} and elementary diagram 791E414AE which is listed in Section 1.7.
Rev. 46, 06/93 032.15-1
SSES-FSAR Question Rev. 48 QUESTION 032.16 The FSAR contains many conflicting or confusing statements which must be resolved in order for the review to proceed. For each of the questions below, provide a FSAR revision which is responsive to the staffs need for information satisfying the requirements of the "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants" Regulatory Guide 1.70.
(1) Clarify the discrepancy between the reference to "three trip logics" in FSAR Section 3.1.2.3 .2 and the description of the RPS in FSAR Section 7.2.1.1.4.3.
(2) Clarify the discrepancy between the definition of passive failures in electrical, instrumentation, and control systems in FSAR Sections 1.2.1 and 3.11.4 .
(3} Clarify the discrepancy between FSAR Sections 7.1.2a.1.3.5.1 and 7.3.1.1a.4.3 with regard to the parameters which initiate containment spray.
(4) FSAR Section 7.3.1 states that the RHR Suppression Pool Cooling System is an engineered safety feature system. Provide the necessary information in FSAR Section 7.3.1.1 a.5 which describes the system in accordance with the requirements of the "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants,"
Regulatory Guide 1. 70.
(5} Clarify FSAR Section 7.3.1.1a.2.3 to clearly state where the pressure, temperature, and water level sensors and racks are located.
(6) Provide layout sketches which show the location of all sensors which provide an input to the reactor protection system. The sketch shall have a sufficiently large scale and be of sufficient detail to verify that the separation criteria for RPS and ECCS are met.
(7) Clarify the status of the Main Steamline Isolation Valve design which is presented in Figure 7.3-4. (It is the staffs understanding that this in an outdated design which is no longer being provided by General Electric.)
(8) Resolve the contradiction between FSAR Sections 7.4.1.1.3.6 and 7.4.2.1.2.3.1.4 to provide a clear statement of the conditions under which the RCIC isolation valves will be required to operate and the seismic and environmental conditions for which these valves are qualified.
(9) Clarify the discrepancy between FSAR Section 7.6.1.1 .3.1, which states that the refueling interlock-system is single failure proof and the design of the reactor manual control system which has a single rod position input path and a single platform output path.
(10) Clarify the discrepancy between the AIWS trips shown in Figure 7.7-10 and the logic description given in FSAR Section 7 .6.1 a.8. 1.
FSAR Rev. 58 032.16-1
SSES-FSAR Question Rev. 48 RESPONSE :
(1) For response refer to revised Subsection 3.1.2.3.2.
(2) For this information see revised Subsection 3.11 .4.
(3) There is no discrepancy between the FSAR sections specified in Part 3 of Question 032.16. Containment spray is manually initiated only. However, manual initiation is contingent upon the presence of high drywell pressure.
(4) For response refer to Subsection 7.3.1.1a.5.
(5)(6) For response, see Dwgs:
J-2-4 Sh. 1 J-26-4 Sh. 1 J-28-2 Sh. 1 J-6-3 Sh. 1 J-26-6 Sh. 1 J-28-3 Sh . 1 J-6-4 Sh . 1 J-26-12Sh. 1 J-28-4 Sh. 1 J-10-3 Sh. 1 J-27-1 Sh. 1 J-28-5 Sh. 1 J-11-4 Sh. 1 J-27-2 Sh. 1 J-28-6 Sh. 1 J-25-1 Sh . 1 J-27-3 Sh. 1 J-29-1 Sh. 1 J-25-3 Sh. 1 J-27-4 Sh. 1 J-29-3 Sh. 1 J-25-4 Sh. 1 J-27-5 Sh. 1 J-29-4 Sh. 1 J-26-2 Sh. 1 J-27-6 Sh . 1 J-29-5 Sh. 1 J-26-3 Sh. 1 J-28-1 Sh. 1 (7) For response, see revised Figure 7.3-4.
(8) RCIC isolation valves receive various signals as shown on Figure 7.4-2. The qualification of these valves is discussed in Subsection 7.4.2.1.2. 3.1.4.
There is no contradiction. Both sections state the valves are normally open, and close on the pipe break (RCIC isolation) signal. Equipment qualification is discussed in Section 3. 11 .
(9) The referenced FSAR statement points out that some of the sensing circuits are provided with equipment that is single-failure proof. This was done to protect against single-failure in these circuits only, and should not be construed to mean that the complete Refueling Interlock System is single-failure proof.
The Refueling Interlocks are not required to meet single-failure criteria. Subsection 7.6.1 a.1.3.4 provides the discussion of single-failure criteria and the reason single-failure criteria is not met. The analysis in Subsection 7.6.2a.1 further explains why single-failure criteria need not be met by the Refueling Interlocks.
(10) FSAR Subsection 7.6.1a.8.1 discusses RPT, not AlWS. Figure 7.7-1 O is the detector drive system schematic. The logic described tor RPT is shown on Figure 7.2-1 .
FSAR Rev. 58 032.16-2
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 25 ELEV. 645'-0" FIGURE 032.16-1
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 27 ELEV. 645'-0" FIGURE 032.16-2
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 29 ELEV. 645'-0" FIGURE 032.16-3
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 28 ELEV. 645'-0" FIGURE 032.16-4
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 28 ELEV. 670'-0" FIGURE 032.16-5
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 27 ELEV. 670'-0" FIGURE 032.16-6
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 29 ELEV. 683'-0" FIGURE 032.16-7
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 27 ELEV. 683'-0" FIGURE 032.16-8
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 28 ELEV. 683'-0" FIGURE 032.16-9
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 25 ELEV. 683'-0" FIGURE 032.16-10
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 26 ELEV. 704'-0" FIGURE 032.16-11
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 28 ELEV. 719'-1" FIGURE 032.16-12
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 26 ELEV. 719'-1" FIGURE 032.16-13
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 27 ELEV. 719'-1" FIGURE 032.16-14
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 29 ELEV. 719'-1" FIGURE 032.16-15
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 25 ELEV. 719'-1" FIGURE 032.16-16
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 26 ELEV. 738'-11 1/2" FIGURE 032.16-17
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 28 ELEV. 749'-1" FIGURE 032.16-18
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 29 ELEV. 749'-1" FIGURE 032.16-19
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 27 ELEV. 749'-1" FIGURE 032.16-20
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 26 ELEV. 761'-1" FIGURE 032.16-21
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 28 ELEV. 779'-1" FIGURE 032.16-22
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 26 ELEV. 779'-1" FIGURE 032.16-23
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
REACTOR BLDG. UNIT ONE AREA 27 ELEV. 779'-1" FIGURE 032.16-24
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
TURBINE BLDG. UNIT ONE AREA 6 ELEV. 689'-0" FIGURE 032.16-25
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
TURBINE BLDG. UNIT ONE AREA 10 ELEV. 689'-0" FIGURE 032.16-26
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
TURBINE BLDG. UNIT ONE AREA 6 ELEV. 729'-0" FIGURE 032.16-27
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
TURBINE BLDG. UNIT ONE AREA 11 ELEV. 729'-0" FIGURE 032.16-28
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT INSTRUMENT LOCATION DWG.
TURBINE BLDG. UNIT ONE AREA 2 ELEV. 729'-0" FIGURE 032.16-29
SSES-FSAR QUESTION 032.17 Identify each type of relay in the SSES which must be energized or which must remain energized during a seismic event. For each of these relay types, provide the following information:
(1) The minimum voltage at which it must operate, (2) The voltage at which it was seismically qualified, (3) The normal operating voltage, and (4) The locations and functions of this type of relay.
Where a particular relay was not qualified by test or was not tested in both the energized and deenergized state, justify the seismic qualification of the relay.
RESPONSE
For the Non-NSSS relays see Subsection 3.lOc.2.3.4 and Table 3.lOc-17.
Listed below are (ECCS) relays which must be energized or remain energized during a seismic event. Each type may be supplied with AC or DC coils.
MANUFACTURE TYPE PRAWING NUMBER AGASTAT GP 145C3238 GP 164C5258 General Electric HMA 159C4251 HFA l-36B3137 CR2820 145C3035 (1) The m1n1mum operating voltage for the subject 125VDC relays is 120VDC and 92VAC for the 120VAC relays which is above their pickup and dropout voltages.
(2) These relays are seismically qualified for deenergized and energized modes of operation at nominal operating voltage.
(3) The normal operating voltages (nominal) are 125VDC and 120VAC, respectively, for the subject DC and AC relays (4) The subject relays are located in their respective ECCS Control Room panels. They energize or remain energized to complete their intended ECSS safety functions.
These relays and control room panels are shown on the ECCS related system elementary diagrams which are identified in Section 1.7.
Rev. 46, 06/93 03-2.17-1
1 SSES-FSAR QUESTION 032.18 With regard to FSAR Subsection 3.11.2a.3*, please provide the following additional information and clarifications:
(1) Describe the methods which are used to assure that equipment which is not qualified for all service conditions will not spuriously operate during exposure to service conditions (including excessive exposure times) for which the equipment is not required to function to mitigate the effects of accidents on other events.
(2) Provide a copy of the procedures for the following aging simulations:
(a) Thermal,.
{b) Radiation, (c) Operation, and (d) Seismic.
( 3) Justify the aging temperature which was used in terms of the maximum normal environmental conditions which are listed in FSAR Table 3.11-1.**
( 4} Quantify the thermal aging acceleration rate and provide the technical basis for this rate.
( 5) Quantify the aging time used for each plant location listed in FSAR Table 3 .11-1 ** which contains a valve which has been qualified in accordance with IEEE Std 382-1972. Identify the valves which are so qualified.
{6} Provide information similar to that requested in Parts 3 through 5 above for radiation aging and, in addition, describe how the neutron fluencies were accounted for.
(?) Provide the criteria for determining the "limits of an actuator family" including:
This subsection has been eliminated since the original response to this question. See S~ction 3 .11. 2
- Contents of this Table have been revised since the original response to this question.
Rev. 49, 04/96 032.18-1
SSES-FSAR (a) Definition of the limits of an actuator family, (bl The criteria which were used to assure that the sample valve operator is a valid representative of the family, and (c) A demonstration of how the criteria were applied.
(8) Provide a Table of the following information for all Class lE valve actuators in the Susquehanna SES design:
(a) The equipment specifications as per Section 3 of IEEE Std 382-1972, (bl Identification of the family membership, (c) Identification of the samples.
(9) Quantify the number of operating cycles each test specimen was subjected to.
(10) Specify the frequency range which was used in the seismic qualification and aging of the samples. (Note that the range which is permitted by IEEE Std 382-1972 does not agree with Branch Technical Position EICSB 10 which is presented in Appendix 7A to the Standard Review Plan.)
RESPONSE
The requested additional information pertaining to the Safety-related instrumentation and electrical equipment supplied with the recirculation system gate, main steam safety/relief and standby liquid control valve assemblies is detailed individually for each valve below.
A. Recirculation System Gate Valve
( 1) Equipment qualification is conducted on the safety-related recirculation system gate valve actuators to assure that the equipment will not operate spuriously.
Safety related NSSS recirculation system gate valve actuators are temperature qualified to IEEE 382-1972 by test for the equivalent active 40-year plant life plus LOCA condition.
The referenced conclusion on radiation qualification in the Subsection 3.11.5.3 is made on the basis of integrated radiation doses for LOCA plus 40 years life.
(2) Design control procedures for aging simulations are in accordance with IEEE 382-1972 as follows:
{a) Thermal: Refer to IEEE 382-1972, Part II, Section 2, page 10.
Rev. 49, 04/96 032.18-2
SSES-FSAR (b) Radiation: Refer to IEEE 382 - 1972, Part II, Section 1, page 10.
(c) Operation: Refer to IEEE 382-1972, Part II, Section 3, page 10.
(d) Seismic: Ref er to IEEE 382-1972, Part I, Section 4, Para. 4.3, Page 8.
These IEEE-382 procedures provided the outline for recirculation valve actuator qualifications.
Actual valve test parameters are discussed in the following sections.
(3) The actual thermal aging qualification test parameters which were imposed for the recirculation system gate valve actuator applications at Susquehanna SES were based on the most severe environmental conditions for equipment as described in Section 3.11.
(4) The recirculation system gate valve actuators are qualified for thermal aging in accordance with IEEE 382-1972, with the aging acceleration rate justified by application of the 10 C rule.
( 5) The motor stator of the recirculation system gate valve actuator is heat-aged for 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> at 1B0°C (356°F).
(6) L The actual radiation aging qualification test parameters which are imposed for the recirculation system gate valve actuator applications at Susquehanna SES are based on the most severe radiation environmental conditions for this equipment, as described in Section 3.11 .
ii. The radiation aging acceleration rate used for qualifying the recirculation system gate valve actuators is 1Xl0 6 RADS/HR. The justification for this rate is the need to complete the test in a reasonable period of time and subject the test actuator to a total radiation dose which envelopes the most severe radiation environmental conditions for the equipment, as described in Section 3 .11.
iii. The recirculation system gate valve actuator was qualified by radiation aging for 204 hours0.00236 days <br />0.0567 hours <br />3.373016e-4 weeks <br />7.7622e-5 months <br /> with the total radiation dose of 204 x 10 6 RADS.
iv. For radiation aging, an equivalence of neutron dose to gamma dose was determined so that the actual gamma dose used in aging is the summation of gamma dose and neutron-gamma dose equivalence.
Rev. 49, 04/96 032.18-3
SSES-FSAR (7) i. All recirculation system valve actuators of the Type SMB, Type SB, Type S8O, ANO and Type SMB/HBC are designed one "family" because all are designed and built with the same design features, standards, and tolerances, and all sizes are constructed of the same material.
ii. The qualification was performed on an SMB-0-25 actuator. Since it is part of the 11 family" mentioned in (i) above, it qualifies all sizes of Limitorque Actuators for the environmental test conditions in accordance with IEEE 382-1972.
iii. The criteria was applied by testing an SMB-0-25 which falls in the boundaries of the definition as given in (i) above. All recirculation system Limitorque Actuators in GE's scope of supply are within that "family" defined in (i) above.
(8) As required by IEEE 382-1972, a type test demonstrated that the performance characteristics of the actuator adhered to the equipment specifications and met all functional test requirements of IEEE 382-1972. The sample recirculation valve actuator was constructed using normal manufacturing processes and was then subjected to the test program. The test program for the sample valve actuator consisted of subjecting the actuator to the following sequence of conditions to simulate the design-basis service conditions of the actuator: . (a) aging (b) seismic, and (c) accident, These test conditions are detailed in subparagraph 2 below. No maintenance was performed during this type test.
All recirculation valve actuators used in the Susquehanna SES NSSS design are in one "family". The designation for this family has been established by the vendor as the "SMB" family. The sample valve actuator which was used to qualify this family was designated as follows:
Manufacturer Limitorgue Type SMB Size 0 Order# 360943A Serial# 144068 The recirculation system gate valve test specifications for the qualification sample are presented below and encompass the most severe conditions of equipment service.
Rev. 49, 04/96 032.18-4
SSES-FSAR
- a. The valve operator was required to operate and remain operable during plant normal, test, design-basis event, and post-design-basis event conditions.
- b. The valve operator was required to provide rated mechanical force for the following conditions:
- 1. Range of voltage - 230 to 460 volts;
- 2. Range of frequency 1 to 35 hertz @ 1. Og; (including seismic forces) 4 to 34 hertz@
3.0g; 35 hertz at 5.0g;
- 3. Thermal conditions - see Figure 0.32.18-1;
- 4. Mechanical aging - 500 cycles, open and close; and
- 5. Radiation exposure - see response to part 6.
- c. The mounting configuration for the valve and operator was specified as mounted in a nominally horizontal run of pipe with the valve stem nominally vertical.
- d. Lubricants, seals and other components have a minimum design life of 5 years.
- e. The design life of the valve operator is 4o years.
- f. Control and indicating devices contained on the valve operator include a torque switch and a limit switch.
( 9) The recirculation valve actuator specimen was subjected to 500 cycles as required by IEEE-382-1972.
(10) With regard to seismic qualification, the following is a description of the testing methods employed which are consistent with Branch Technical Position ElCSBl0 for plants with construction permits docketed before October 1972:
A search for resonance was performed by scanning the recirculation valve actuator test specimen in the three major axes. Scanning was done in the range from 1 to 35 hertz at a maximum acceleration of lg. This testing identified no resonance. Next, the test specimen was vibrated at even-integer frequencies from 4 to 34 hertz for a period of 10 seconds at an excitation of 3g in each of the three major axes. The test specimen was actuated at each dwell for one complete cycle (open and close). The test specimen was then vibrated at 35 hertz for 10 seconds in each of the three major axes at Rev. 49, 04/96 032.18-5
SSES-FSAR an excitation of Sg and was actuated for one complete cycle.
specific quantification of actuator qualification is embodied in the qualification test reports which are available for review at GE-NED (San Jose).
B. NSSS MAIN STEAM SAFETY/RELIEF VALVES (1) The electro-pneumatic actuator assembly for the S/RV has been qualified by tests in accordance with the guidelines specified in IEEE-323-1971. The environmental tests consisted of influences due to radiation, thermal and mechanical aging, seismic conditions, negative pressure and the postulated LOCA steam environment. Test results indicated that the equipment will not operate spuriously.
(2) Design control procedures for qualification of NSSS Safety/Relief valves are in accordance with the guidelines of IEEE-323-1971. Test specifications and/or test parameters are discussed in the following sections.
(3) The thermal aging temperatures used to allow acceleration of time/temperature aging effects artificially by increasing the maximum normal temperature followed the Arrhenius equation identified in Handbook of Engineering Fundamentals, John Wiley and Sons, 1975 and IEEE 101-1972 Guide for the statistical analysis of thermal life test data.
(4) The thermal aging acceleration rate is quantified in part (5) and the technical basis is explained in part (3) above.
(5) Thermal aging was performed at 343° + 9°/-0°F for 96 continuous hours in an air environment with uncontrolled humidity.
( 6) i. The actual radiation aging qualification test parameters which are imposed for the NSSS main steam safety/relief valve actuators used at Susquehanna SES are based on the most severe radiation environmental conditions for this equipment, as described in Table 3.11-4.
ii. The radiation aging acceleration rate used for qualifying NSSS main steam safety relief valve actuators is 2. 9 X 10 5 RADS/HR. The justification for this rate is the need to complete the test in a reasonable period of time and subject the test Rev. 49, 04/96 032.18-6
SSES-FSAR actuator to a total radiation dose which envelopes the most severe radiation environmental conditions for this equipment, as described in Table 3-11-4.
iii. The NSSS main steam safety relief valve actuators are radiation-aged for 103.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> with a total radiation dose of 30 X 10 6 RADS.
iv. For radiation aging, an equivalent of neutron dose to gamma dose was determined so that the actual gamma dose used in aging is the summation of gamma dose and neutron-gamma dose equivalence.
{ 7) i. All of the actuator assemblies are designed and built to the same design features, materials, standards and tolerances.
ii. All actuators are of the same 'family' by virtue of design controls imposed on details of the qualified design which is in accordance with IEEE-323-1971.
iii. The criteria is imposed via GE approval and vendor certification that the actuators were built to the controlled details in (ii).
{8) i. The test specifications for the qualification sample are summarized below and encompass the most severe conditions of equipment service.
- a. The valve actuator assembly was required to operate and remain operate and remain operable during plant normal, test, design-basis event, and post-design-basis event conditions.
- b. The valve actuator assembly was required to provide mechanical force under the following conditions:
(1) Voltage range - 104 to 138 VDC (2) Air pressure - 88 to 200 psig (3) Thermal aging - 343° + 9°/-0°F for 96 continuous hours (4) Mechanical aging - 500 cycles, open and close (5) Radiation aging - 30 x 10 6 RADS(Total)
(6) Negative pressure - Ambient pressure at 102°F to 0.7 psia within 5 minutes (7) LOCA environment - See Figure 032.18-2 Rev. 49, 04/96 032.18-7
SSES-FSAR
- c. The mounting orientation of the valve centerline is nominally in the vertical position with a +/-5° tolerance.
- d. Lubricants, seals and other components have a minimum design life of five years under normal operating conditions.
- e. Refurbishment or replacement period of the valve actuator is five years.
ii. Design controls assure that actual product ion units are comparable to the qualification samples.
(9) The actuator assembly was subjected to a minimum of 1000 operating cycles (See Figure 032 . 18-2).
(10) During seismic qualification testing the S / RV was subjected to a frequency range of 2 to 200 Hz.
C. NSSS STANDBY LIQUID CONTROL SYSTEM EXPLOSIVE VALVE (1) The qualification tests for the standby liquid control explosive (2) Valve were performed on a specimen that contained a primer assembly that had been in service for 5 years, the normal replacement interval. Advantage was taken of this opportunity to use the aged replaceable component which had demonstrated ability to survive normal operating conditions. This provided realistic thermal, vibration and radiation aging. Aging per cyclic duty is not applicable.
(3) Maximum normal environmental temperature specified for standby liquid control area in Table 3.11-1 of FSAR is 120°F . Actual aging temperature encountered in service is not available but is expected to have been between 70°F and 120°F. This variance is not considered significant because the maximum temperature specified does not produce rapid degradation of the replaceable components in the primer assembly.
(4) Thermal aging was not accelerated.
(5) A primer chamber that was installed for 5 years in an operating BWR was used for tests that qualified the Conax Corporation explosive valve.
Rev. 49, 04/96 032.18-8
SSES-FSAR (6) Radiation aging for normal service was not accelerated but obtained under a five year service condition exposure.
(7) i. All valves of similar size, design and materials of construction are judged to belong to the same
'family' for which qualification tests are applicable.
ii. A standard BWR 6 design unit was used for test.
The design used for Susquehanna belongs to the same 'family' .
iii. The criterion was applied by extending test results for the BWR 6 design to the design used for Susquehanna.
(8) Identity of the sample tested is Conax Valve P/N 1832-159-01. Design control documentation (equipment specifications per IEEE-382-1972 and drawings demonstrating 'family') are available for audit in San Jose.
(9) The SICS explosive valve was not subjected to any "operating cycles" as such, since it is not required to operate under normal conditions. The non-reuseable primer dial actuates on command at the end of the test sequence.
(10) Frequency scan showed no resonance below 35 Hz and the seismic test input vibration was therefore selected as sine beats at 33 Hz. The aging of the primer was under real life vibration as encountered in the installed position on an operating BWR.
Rev. 49, 04/96 032.18-9
VALVE OPERATORS CYCLED 0 INSULATION RESISTANCES 400 MEASURED 340"F/105 psig (+/-5°F/+/- 5 psig) 340"F/105 psig (+/- r F/+/- ?psig) 320"F/77 psig (+/- O" F/+/- O psig) 1 HOUR DROP TO 252" F/19 psig 300
,...... (+/- g* F/+/- 1 psig) DURING FIRST LL
.:...., HALF HOUR. THEN 251" F/15 psig
(+/-2"+/-1 psig) w a:: 3 HOUR DROP TO 162"F/Opsig 23 sec RISE TO 336"F/108psig
!ce a:: TEMPERATURE INCREASES TO 340"F w IN LESS THAN 4 MINUTES a.
- i:
w I- 200 19 sec RISE TO 334"F/11 Opsig TEMPERATURE INCREASES TO 341"F IN LESS THAN 3 MINUTES 100 START OF TEST 0 2 4 6 8 10 12 14 4 DAYS +6 hr TIME (hr)
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT ACTUAL STEAM EXPOSURE PROFILE FIGURE 032.18-1, Rev 47 AutoCAD: Figure Fsar 032_18_1.dwg
(1) ACTUATOR ASSEMBLY CYCLED ONCE EVERY 10 min FOR THE FIRST HOUR AFTER ACHIEVING A TEMPERATURE OF 340"F (TOTAL OF 51 (3) ACTUATOR ASSEMBLY CYCLED ONCE AT TEMPERATIJRE Of 340"F (4) ACTUATOR ASSEMBL V CYCLED ONCE AT TEMPERATURE OF 320"F (51 ACTUATOR ASSEMBLY CYCLED ONCE AT*
TEMPERATURE OF 308°F (61 ACTUATOR ASSEMBLY CYCLED AT TEMPERATURE OF 308°F ONCE EVERY SUCCEEDING 24 hr (7) ACTUATOR ASSEMBLY CYCLED AT TEMPERATIJRE
/
OF 308"F USING EACH SOLENOID VALVE ONCE I ---...- -....---,.--......
250°F I
I 18 hr I
I SATURATED I
TEMPERATURE' I STEAM SHALL RISE I I FROM AMBIENT I I I TEMPERATURE T03406 F IN I I Smin ENVIRONMENT AMBIENT 0 I 3 hr I hr 8 hr 1 day 2 days 3 days 4 day1 AMBIENT TEMPERATURE 1!hr l (21 ACTUATOR ASSEMBLY CYCLED ONCE AT END OF 3 hr WITH TEMPERATURE 181 ACTUATOR ASSEMBLY CYCLED AT AMBIENT TEMPERATURE ENVIRONMENTAL TEMPERATURE USING EACH SOLENOID VALVE AT AMBIENT SATURATED STEAM ENVIRONMENT PRESSURE (psigJ TEMPERATURE C°FI AIR SUPPL V-200 psig; MINIMUM VOL TAGE-106 OR 212 Vdc; AS APPLICABLE. EXCEPT AS 105 340 OTHERWISE INDICATED, ACTUATOR TESTS 15 320 SHALL BE CO~OUCTED USING NEAR 11 308 SOLENOID ONLY FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT ABNORMAL AMBIENT CONDITIONS FOR QUALIFICATION TEST OF SRV ACTUATOR ASSEMBLY FIGURE 032.18-2, Rev 47 AutoCAD: Figure Fsar 032_18_2.dwg
SSES-FSAR QUESTION 032.19 The requirements for documenting the seismic and environmental qualification of Class lE equipment are presented in Sections 3 .10 and 3 .11 of the 11 S tandard Format and Content of Safety Analysis Reports for Nuclear Power Plants, 11 Regulatory Guide
- 1. 70 and are applicable to all engineered safety features, reactor protection systems and all auxiliary supporting systems and are not limited to those systems which are supplied by General Electric.
It is the staff's position that such documentation, for all Class lE balance-of-plant supplied systems, required by IEEE Std 323-1971 must be retained by the applicant in an auditable manner. Describe the program which you will implement to satisfy the staff's position.
RESPONSE
Documentation for the environmental qualification of non-NSSS equipment is retained in an auditable manner as described in Subsection 3 .11. 3. See response to Question 032 . 20 for a discussion of compliance with IEEE 323-1971 for non-NSSS equipment.
Rev. 49, 04/96 032.19-1
SSES-FSAR QUESTION 032.20 The response to Acceptance Review Question 032.3 is incomplete.
You state that General Electric has complied with IEEE Std 323-1971 for the environmental qualification of instrumentation components. It is the staff's position that all safety-related equipment, both NSSS and non-NSSS, must be qualified in accordance with IEEE Std 323-1971. Provide a statement in the FSAR which certified compliance to IEEE Std 323-1971 for all safety-related equipment and identify and justify all exceptions.
RESPONSE
The degree of compliance with IEEE 323-1971 for non-NSSS Class lE equipment is discussed in Subsection 3.11.2.1.
Qualification data for typical equipment is given in response to Question 040.2. Also refer to the response to Question 032.28.
All Susquehanna SES NSSS safety-related equipment is environmentally qualified in accordance with the provision of IEEE 323-1971. See revised Subsection 3.11.1.
Rev. 49, 04/96 032.20-1
SSES-FSAR QUESTION 032.21 Your discussion of isolation devices, which is presented in FSAR Section 7.2.2.1.2.3.1.7 is incomplete. Provide the following information:
(1) List all parameters and systems that interface between the safety and non-safety systems.
(2) Identify the type of transmission (i.e., analog, digital, electrical, optic, etc.) which is involved with each interface that is identified in response to Item (1) above.
(3) Identify the type of isolation device which defines the Class lE boundary for each interface which was identified in response to Item (1) above.
(4) Provide the acceptance criteria for each isolation device which is identified in response to Item (3) above.
(5) Describe the type of testing which was conducted on the isolation devices to insure adequate protection against EMI.
(6} Describe the qualification test plans and provide the test results for each isolator which is identified in response to Item (3) above.
RESPONSE
The system and parameters that interface with the Reactor Protection System (RPS) (system described in Section 7.2) are described in part a to part j in Subsection 7. 2 .1.1. 4. 2, entitled Initiating Circuits. The interfaces with RPS are qualified as safety-related. Those instrument trips in non-seismic structures, namely, those associated with turbine stop valve and turbine control valve position sensing, have diversity in high reactor pressure trips to the RPS. Signals to the RPS are of digital type via relay contacts or instrument switch contacts . .Annunciators, process computer and Reactor Manual Control System inputs are non-safety related RPS interfaces. These are actuated via RPS relay contacts and isolation is provided through high coil to contact insulation impedance which has been accepted generically on this vintage plant. The testing type and relay qualification data is available for audit by the Commission at General Electric Company in San Jose.
Rev. 46, 06/93 032.21-1
SSES-FSAR Question Rev. 47 QUESTION 032.22 The standby liquid control system (SLCS) is designated as a special safety system in the SSES design. To assure that availability of the SLCS, you have provided two sets of the components required to actuate the system in parallel redundancy. However, our review indicates that you have not provided redundant heating systems and the heating equipment supplied is not powered from an emergency bus under normal conditions. The staff has concluded, therefore, that the statement in FSAR Section 9.3.5.3 that a "single failure will not prevent system operation" is not true. Provide a modified design of the SLCS which satisfies the single failure criterion or justify the present design.
RESPONSE
Regulatory Guide 1.70 identifies the SLCS as a safe shutdown system having a safety-related classification. Safety-related systems provide the actions necessary to assure safe shutdown of the reactor, to protect the integrity of radioactive material barriers, and/or to prevent the release of radioactive material in excess of allowable dose limits. However, the system fails to meet all the requirements of a safety-related system in that SLCS is not designed for the single active component failure criteria. A function of the system is to inject boron to the suppression pool via the SLC System to maintain basic pH in the suppression pool in order to minimize re-evolution of iodine from the suppression pool in the event of a Loss of Coolant Accident (LOCA). This function adds additional importance to the systems performance.
The NRC has provided review guidelines for the SLC system that do not meet single failure criteria or that are not of the expected quality (safety related). To demonstrate that the SLC System is able to perform its AST (10 CFR 50.67) function (injection of sodium pentaborate into the suppression pool), the System should satisfy, as a minimum, the recommended guidelines listed below (NRC review guidelines). Meeting these criteria, demonstrates reasonable assurance of the quality of the SBLC System. These guidelines are as follows:
a) The SLC System should be provided with standby AC power supplemented by the emergency diesel generators.
b) The SLC System should be seismically qualified in accordance with Regulatory Guide 1.29 and Appendix A to 10 CFR Part 100.
c) The SCL System should be incorporated into the plants ASME Code ISI and IST Programs based upon the plants code or record (10 CFR 50.55a).
d) The SCL System should be incorporated into the plants Maintenance Rule program consistent with 10 CFR 50.65 e) The SLC System should meet 10 CFR 50.49 and Appendix A (GDC 4) to 10 CFR 50.
An extensive validation of NRC guidelines for the SBLC system of components that do not meet single failure criteria or that are not of the expected quality (safety related) provides reasonable assurance of the Systems ability to support its original and the pH controlling functions.
FSAR Rev. 64 032.22-1
SSES-FSAR Question Rev. 47 Subsection 9.3.5.3 discusses the consequences of a loss of the tank heaters or suction piping heat tracing. Note that, as stated in Subsection 7.4.1.2.2, the tank heaters receive power from the standby a-c power supply bus C (Division I). The design has been changed to provide Division I standby a-c power to the heat tracing circuit as well.
FSAR Rev. 64 032.22-2
SSES-FSAR Question Rev. 47 QUESTION 032.23 The design of the recirculation system as described in FSAR Section 5.4.1.3 appears to be obsolete. It is the staffs understanding that the General Electric design does not include a bypass in the recirculation system piping. Therefore:
(1) Clarify the discrepancies between the cited Sections of the FSAR and FSAR Figure 5.4-2a (which doesn't show a bypass}.
(2) Revise the FSAR, as appropriate, to completely describe the actual design of the SSES recirculation system.
RESPONSE
Subsection 5.4.i .3 of the SSES FSAR describes the actual design of the Susquehanna SES recirculation system. Dwg . M-143, Sh. 1 shows the bypass in the recirculation system piping .
FSAR Rev. 58 032.23-1
SSES-FSAR QUESTION 032.24 The accident analysis presented in Chapter 15 is based, in part, on the assumption that the Rod Block Monitor (RBM) acts to mitigate the consequences of a continuous rod withdrawal.
The staff's position is that the RBM is a protection system and must be designed, fabricated, installed, tested, and subjected to all of the design criteria which are applicable to a reactor trip system. Revise the FSAR to reflect the importance of the RMB in accordance with the requirements of Section 7.2 of the "Standard Format," Regulatory Guide 1. 70. Identify and justify any exceptions.
RESPONSE
See the response to 32.7.
Rev. 46, 06/93 032.24-1
SSES-FSAR Question Rev. 47 QUESTION 032.25 Contrary to the statement in FSAR Section 7.2.1 .1.2, the staff has noted that the RPS motor generator sets are not Class 1E. Therefore, please :
(1) _ Clarify the discrepancy between FSAR Sections 7.2.1.1.1 and 7.2.1.1.2 with regard to the quatification of the motor generator sets.
(2) Identify the alternate power source in FSAR Figures 7.2*1, Sheet 1, and Figure 8.3-8.
(3) Describe how the design and implementation of the SSES PPS satisfies the requirements of IEEE Std 379-1972, Section 6.6 (with special emphasis on the last paragraph).
RESPONSE
11 (1) FSAR Subsection 7.2.1.1.2 has been revised to state * ** Safety Class 1E with the exception of the motor-generator power supplies which are non-Class 1E and the RPS circuits located ... "
(2) Figure 7.2-1 has been revised to show the alternate power source. The motor-generator sets shown in Figure 8.3-8 are part of the swing bus design and should not be confused with the RPS motor generator sets discussed in Subsection 7.2.1.1.2.
(3) The RPS Motor Generator sets supplied for Susquehanna are the same as those supplied for the Hatch 2 facility. These motor generators will be supplied with Class 1E qualified equipment to monitor and protect the connected loads from unacceptable values of voltage and frequency. The generic design and qualification plan supplied by G.E. has been approved by the NRC as satisfying the requirements of IEEE-379-1972 Section 6.6.
FSAR Rev. 58
SSES-FSAR QUESTION 032.26 Provide the design criteria and a description of the scram discharge volume switches and their qualification testing in accordance with the requirements of Section 7.2 of the "Standard Format," Regulatory Guide 1. 70. Include the following information:
(1} Manufacturer (2) Type of float (self-equalizing or sealed)
(3} Float material and magnet material (4) Qualification Test Conditions (a) Water Temperature (b) Pressure (c) Duration of test conditions (d) Number of test cycles (e} Period between test cycles (f) Extremes of external temperature, pressure, and humidity (g) Radiation source, strength, and dose.
RESPONSE
(1) Manufacturer: Magnetrol (2} Float Type: Sealed (3) Float Material: 374SS (4} Qualification Test Conditions:
Qualification information for the scram discharge volume switches is shown on 3.lOa-1 of Susquehanna's FSAR. The qualification data requested in 032.26 is available for audit at General Electric in San Jose, under file number 159C4361 (specified in Table 3.lOa-l under column labelled "Item No." and corresponding to item no.
Cl2-N013.
Rev. 46, 06/93 032.26-1
SSES-FSAR QUESTION 032.27 The staff's position with regards to post accident monitoring and safe shutdown display instrumentation is stated in Branch Technical Position ICSB 23 in Appendix ?A of the NR.C Standards Review Plan. *state your conformance or justify your alternatives.
The description contained in Section ?
- 5. la. 4. 2 of the FSAR refers to Post Accident Tracking in only general statements.
Discuss the extent to which the monitoring devices and safe shutdown equipment will conform to the position set forth above, and revise the FSAR accordingly. Your response should identify the channels that are recorded and their qualification.
RESPONSE
Post accident monitoring is discussed in PP&L's updated response to TMI related requirements (PLA-659, N.W. Curtis to B. J. Youngblood dated 3/16/81) . PP&L has provided its posit ion on Regulatory Guide 1.97, Revision 2 in PLA-965, Curtis to Schwencer, dated 11/13/81.
Rev. 46, 06/93 032.27-1
SSES-FSAR QUESTION 032.28 Identify the equipment which has been environmentally qualified by inference from tests done on similar equipment or previous operating experience and, for each item, provide the basis for the extrapolation in accordance with the requirements of IEEE Std 323-1971.
RESPONSE
For the environmental qualification of Class lE equipment, see the Susquehanna SES Environmental Qualification of Class lE Equipment Program.
Rev. 46, 06/93 032.28*1
SSES-FSAR TABLE 032 .28-1 NON*NSSS EQUIPMENT ENVIRONMENTALLY QUALIFIED TO IEEE 323-1971 BY INFERENCE FROM TESTS ON SIMILAR EOUIPMENT 111 M/R Description M 307AC Centrifugal Fans M 320 Flow Switches for HVAC Systems M 317 Drywall Unit Coolers M 327 Chilled Water and Cooling Water Pumps E 130A 600 V Power and Control Cable E 131A Instrument and Special Cable E 131 BC Instrument and Special Cable E 135-73 Cable Splices E 135 Electrical Penetrations E 109 5 kv Switchgear E 129 5 kv Single Conductor Cable E 112 ESW Pump Motor and RHR SW Pump Motor E 1198C 24 and 250 Vdc Battery and 125 Vdc Battery E 121 125 and 250 Vdc Load Centers E 151 M-G Sets E 152 Automatic Transfer Switches E 117 480 V Load Center and Load Center Transformer E 118 480V MCC E 136 120 VAC Instrument Transformer E 118 120 VAC Distribution Panels, AC and DC Motor Actuators for Nuclear Services Valves J 3A Electronic Field Mounted Instruments J 658 Control Valves J 70 Process Solenoid Valves 11)
Some of the equipment (but not necessarily all) in the listed purchase orders are qualified by inference from tests on similar equipment.
Rev. 46, 06/93
SSES-FSAR
- TABLE 032.28-2 NON-NSSS EQUIPMENT ENVIRONMENTALLY QUALIFIED TO IEEE 323-1971 BY PREVIOUS OPERATING EXPERIENCE M/R Description M 30 DG and Auxiliaries M 58 Diesel Fuel Oil Transfer Pump E 119A 24, 125 and 250 voe Battery Chargers Rev. 46, 06/93
SSES-FSAR QUESTION 032.29 The discussion in FSAR Section 7.2.2.1.2.3.1.20 of compliance with the requirements of IEEE Std 279-1971 Section 4.20 (Information Read-out) is not adequate. Revise the FSAR to describe the equipment and systems which provide nthe operator with accurate, complete, and timely information pertinent 11 to the status of the information channel "and to generating station safety."
RESPONSE
The requested information is contained in Section 7.5, Safety Related Display Instrumentation.
Rev. 46, 06/93 032.29-1
SSES-FSAR QUESTION 032.30 List all of the control circuits which receive inputs from the scram trip input circuits.
RESPONSE
There are no non-NSSS circuit interlocks from any of the RPS input circuits.
The Reactor Manual Control and Nuclear Steam Supply Shut-off Systems receive inputs from the scram trip input circuits.
Rev. 46, 06/93 032.30-1
SSES-FSAR QUESTION 032.31 Your discussion in FSAR Section 7.2.2.1.2.3.1.10 on the reactor low water level scram trip indicators is incomplete. Describe how the level switches and indicators are calibrated.
RESPONSE
For response see Subsection 7.2.2.1.2.3.1.10.
Rev. 46, 06/93 032.31-1
SSES-FSAR QUESTION 032.32 Describe the installation, operation, and removal of the "Startrek" computer system which is used for start-up testing of GE Boiling Water Reactors. Include the following topics:
(1) Specifications of and Qualification testing of electrical isolators.
(2) Separation criteria for permanent and temporary wiring.
RESPONSE
Subsections 7.7.1.9 and 7.7.2.9 have been included to supply this information.
Rev. 46, 06/93 032.32-1
Question Rev. 48 SSES-FSAR QUESTION 032.33 Identify and justify all containment isolation valves which are provided with manual override of the isolation logic. Also identify and justify all other aspects of the Susquehanna SES design which do not meet the requirements of IEEE Std 279-1971, Section 4.16. For each manual override which is provided in the Susquehanna SES design, demonstrate compliance with IEEE Std 279-1971, Sections 4.11 through 4.14.
RESPONSE
For this information, see revised Table 6.12-12 and revised Subsection 7.3.1.1b.1.3.
No non-NSSS circuits are provided with manual override or bypass isolation logic.
However, several non-NSSS isolation valves may be manually opened after a LOCA to permit containment atmosphere sampling and drywell purge to dilute hydrogen in the containment. Isolation logic for these valves is described in Subsection 7.3.1.1b.1.3.
All non-NSSS protection systems meet the requirements of IEEE 279-1971, Section 4.16.
The valves which are associated with the NSSS isolation logic and can be overridden are identified as part of the following IEEE compliance discussion. Also included are two parts, one is a design justification based on identifying those guidelines (namely IEEE Sections in question) which deem such a design as acceptable; and two is a compliance statement of related valves with IEEE 279-1971 Sections 4.11 through 4.14.
Compliance with IEEE 279, Section 4.16 The NSSS controlled isolation valves and logics are in compliance with IEEE 279-1971, Section 4.16 in that the isolation logics (including the isolation logic provided for AE use) are provided with seal-in circuits that will maintain the logic in a tripped (isolated) condition and cause valve closure even when the initiating signal clears. The operator must manually reset the logic (after the initiating condition clears) to remove the logic seal-in in order to move the valve to any position other than fully closed. The only exception to this logic seal-in is the reactor high pressure trip which is used to interlock the RHR shutdown cooling valves (E11-F008 and F009) and the RHR head spray valves (E11-F022 and F023). However, both shutdown cooling suction valves and the inboard head spray valves have motor control circuit seal-ins which will cause valve full closure even if the high pressure initiating signal clears. The outboard head spray valve (E11-F023) is a throttling valve and as such has no motor control center seal-in.
Therefore, it will stop "as is" should the initiating signal clear and would require manual operator action to cause full closure. It should be noted that the shutdown cooling suction valves and head spray valves are always interlocked closed when the reactor is FSAR Rev. 70 032.33-1
Question Rev. 48 SSES-FSAR at pressure and these valves are only opened during shutdown cooling. Additionally, should this unlikely event occur, the inboard head spray valve would perform the isolation function automatically on the spray line.
An assessment of compliance with IEEE 279-1971, Paragraph 4.16, of all systems within NSSS design scope for Susquehanna is provided in applicable analysis sections of Susquehanna's FSAR Chapter 7.
Compliance with IEEE 279-1971, Sections 4.11, 4.12, 4.13, and 4.14 Operational Bypasses The Main Steamline Isolation Valve Logic has two operational bypasses as follows:
- 1. Operational bypasses are provided for the main condenser low vacuum trips. The manual bypass switches are in the main control room under operator control and are keylocked. Alarms are provided to indicate when the bypass is in effect. The bypasses are cleared automatically whenever the turbine stop valves reach 90 percent full open or the reactor pressure is above a preset value or whenever the operator places the Reactor Mode Selector Switch in the "Run" position. Thus compliance with IEEE 279, Sections 4.12, 4.13, and 4.14 is achieved by providing automatic removal of the bypass, indication of bypass and keylocked bypass switches.
- 2. An Operational Bypass is provided for the main steamline low pressure trip whenever the reactor Mode Selector Switch is not in the "Run" with Neutron Flux measuring power above 10 percent of rated power without imposing a SCRAM. Therefore, the bypass is considered to be removed in accordance with the intent of IEEE 279, Section 4.12, although it is removed by manual action rather than automatic action. The bypass of the low pressure isolation signal is not indicated in the control directly except by the position of the switch handle and readout on the Display Control System. This mode switch is keylocked in each position and is centrally located on the operator's main control panel where it is under strict operator control. Its specific bypass functions are a matter of operator training and as such does not reasonably need to be brought to the operator's attention each time he places the switch in any mode other than "Run." Since the bypass is not removed by any automatic action, it is positively in effect any time the mode switch is not in "Run." Thus compliance with the intent of IEEE 279, Sections 4.13 and 4.14 is met.
These operational bypasses affect the Main Steamline Isolation Valves (B21-3002 A-D and F028 A-D) and the Main Steamline Drain Valves (B21-F016 and F019).
FSAR Rev. 70 032.33-2
Question Rev. 48 SSES-FSAR Manual Test Bypasses The steam leak detection system provides test bypass switches in the isolation logics for the following systems:
- 1. Residual Heat Removal System (RHR)
- 2. Reactor Water Cleanup System (RWCU)
- 3. Reactor Core Isolation Cooling System (RCIC)
- 4. High Pressure Core Injection System (HPCI)
These bypass switches only override the equipment area high temperature trip portions of the isolation logics and are provided for test purposes so that the temperature trip logics may be tested during plant operations. The Test/Bypass switches are located on panel H12-P614 in the control room where they are under operator control.
Additionally, they are keylocked switches which provide an alarm whenever they are removed from the normal position to the Test/Bypass position. Since these switches are provided for channel test, are alarmed when not in Normal, are keylocked and under operator control, compliance with IEEE 279, Section 4.11, 4.13, and 4.14 has been met.
The valves affected by the RHR leak detection bypass switches are the Shutdown Cooling Suction Valves (E11-F008 and F009) and the head spray valve (E11-F022 and F023).
The valves affected by the RWCU leak detection bypass switches are the system suction valves (G33-F001 and F004).
FSAR Rev. 70 032.33-3
SSES-FSAR QUESTION 032.34 Provide a discussion in FSAR Section 7.3.lb of testability and how the non-General Electric portions of all engineered safety features systems comply with the requirements of IEEE Std 279-1971, Sections 4.9 and 4.10, and IEEE Std 338-1971.
RESPONSE
Subsections 7.3,lb and 7.3.2b have been revised to include this information.
Rev. 46, 06/93 032.34-1
SSES-FSAR QUESTION 032.35 The description of how the ADS satisfies the requirements of IEEE Std 279-1971 Sections 4 .19 and 4. 20 are insufficient.
Provide the following information:
(1) Describe how the operator is made aware of Items a through d under the discussion of compliance with Section 4.19 of IEEE Std 279-1971.
(2) Justify the use of temperature monitors on relief valve discharge pipes and plant annunciators for providing information which forms the basis for operator action to protect public health and safety.
(3) Define "ADS level."
RESPONSE
(1) As stated in Subsection 7.3.2a.1.2.3.1.19, items a) through d) are indicated by annunciators or lamp indicators via relay contacts, which are operated integrally with its respective actuated device (relay) for a given parameter.
(2) Relief valve discharge temperature is annunciated to inform the operator that steam leakage has exceeded predetermined levels. Temperatures are further recorded and allow the operator to verify and identify the source of leakage. This on-line capability affords additional {beyond temperature annunciator trip point) means upon which to determine temperature/leakage status.
{3) Though the nomenclature "ADS level" could not be found in the sections specified in Question 032.35, it is the reactor water level at which associated ADS logic is initiated. This level is quantitatively defined in Chapter 16.
Rev. 46, 06/93 032.35-1
SSES-FSAR QUESTION 032.36 Justify your position, presented in FSAR Sections 7.3.2.l and 7.4.1.1, that only Sections 2.1 and 2.2 of IEEE Std 338 - 1971 are applicable to the design of the ECCS and RCIC. Identify and justify all exceptions to IEEE Std 338-1971 .
RESPONSE
The ECCS and RCIC systems conform to the scope of IEEE 338-1971 as defined therein by paragraphs 2.1 and 2.2 (see Subsections 7 . 3.2a.l.2.3.4 and 7.4.2.1 . 2.3.4).
Rev. 46, 06/93 032.36-1
SSES-FSAR QUESTION 03:2.37 The discussion of Environmental Conditions which is typified by material such as that in FSAR Sections 7.3.2.4 and 7.4.2.l is unacceptable. It is the staff's position that all equipment which is required to protect public health and safety (including cables) must be qualified for operation in the worst case environment. Inside the containment, this environment is typified by accident results. Equipment outside of containment must be qualified to the extremes of expected conditions which could result from the failure of other engineered safety features or equipment required to maintain a controlled environment such as plant heating systems. Revise the FSAA to demonstrate compliance with the staff position. Identify and justify all exceptions.
RESPONSE
Equipment qualification discussions in Subsections 7.3.2.4 and
- 7. 4. 2. l are appropriate for NSSS equipment supplied. As stated, the equipment is qualified for the normal and abnormal environs in which it is mounted. Sections 3 .10 and 3 .11 provide further discussions of equipment qualifications.
The qualification of all non-NSSS Class lE electrical equipment is discussed in Section 3.10 (Seismic) and 3.11 (Environmental) . The effects from a loss of HVAC on the qualification of non-NSSS equipment are discussed in Subsection 3.11.4.
Rev. 46, 06/93 032.37-1
SSES-FSAR QUESTION 032.38 The statement that "All components used in the containment spray system have demonstrated reliable operation in similar nuclear power plant protection system or industrial application," is unacceptable because:
(1) This statement does not satisfy the requirements of IEEE Std 323-1971.
(2) Considerable problems have been experienced with the drift of blind sensors.
Provide an amended discussion of compliance with IEEE Std 279-1971 Section 4.4 which satisfies the requirements of IEEE std 323-1971 and describes the methods which will be used to reduce sensor drift to acceptable levels.
RESPONSE
The compliance discussion for IEEE 279-1971 Section 4.4 states that the components are capable of accurate operation in both normal and abnormal environments expected. This appears in the discussion directly above the statement cited in this quest ion.
Further seismic and environmental qualification discussion to IEEE-323-1971 and IEEB-344-1971 is provided in Sections 3.10 and 3.11, and Subsections 7.3.2a.4.3.l.4 and 7.3.2a.4.3.1.5.
Having recognized the sensor drift problem, the following actions have been initiated:
a) The Technical Specifications Set Points Re-evaluation program has been undertaken to develop set points which take into account drift so that acceptable instrument performance does not cause false out-of-spec.
conditions.
b) The periodic testing cycle has been selected so as to detect the occurrence of drift and to keep the instrument within acceptable performance levels.
Rev. 46, 06/93 032.38-1
SSES-FS,AR QUESTION 032 1 39 Justify the use of a non-seismic Category I condensate storage tank for the RCIC. Include in this justification a discussion of how manual transfer satisfies the assumptions used in the operational analysis of the rod drop accident and how the RCIC satisfies the requirements of Regulatory Guide 1.29.
RESPONSE
Subsection 7.4.1.1 concerns the Instrumentation and Control systems for the RCIC. All instrumentation' and control systems for the RCIC, including the instrumentation and controls for the condensate storage tank (CST), are Class lE although the CST facility is non-Class lE. The RCIC is initially aligned to the CST for reactor vessel make-up water but can be manually transferred to the suppression pool at low CST water level. As the RCIC is automatically initiated by reactor vessel low water level and deactivated by reactor vessel high water level, and with the manual transfer of the water source from the CST to the suppression pool (Seismic Category I), the operational analysis is satisfied for the rod drop accident. During a safe shut-down earthquake (SSE), the condensate storage tank and associated non-safety related RCIC valves and circuitry are not required to be seismic Category I qualified to satisfy the requirements of Regulatory Guide 1.29 in the event of a rod drop accident. The accident analysis for rod drop does not rely on RCIC operation.
Rev. 46, 06/93 032.39-1
SSES-FSAR Question Rev. 47 QUESTfON 032.40 It is the staffs position that trip devices such as "86" devices which require manual reset must have the tripped condition indicated on the inoperable and bypassed status indicator.
Therefore, provide a revised design for the RCIC turbine over-speed trip, and any other lockout device which is a part of a safety-related system. Identify and justify each such system which does not have alt lock-outs indicated on the indicator required by Regulatory Guide 1.4 7.
RESPONSE :
All non-NSSS lock-out devices (86) in safety related systems are indicated/alarmed directly or indirectly in the control room except the following:
A. 4.16 kV busses and switchgear. The bus lock-out relay {86) in 4.16 kV switchgear is not individually indicated. It trips all closed feeder breakers and prevents closure of any open breakers when actuated on overcurrent of the bus incoming feeders or on a bus differential relay actuation. During the bus lockout, the undervoltage relay w\ll provide an alarm in the Control Room. The bus can not be re-energized and the above alarm can not be cleared without resetting the fockout relay.
- 8. Engineered Safeguard (ES) Transformer (non-Class 1E; see Dwg. E-1, Sh . 1 and E-1 Sh. 2). A fock-out relay (86), provided in the 13.8 kV SIU switchgear for the ES transformer is not indicated in the Control Room. It trips the ES transformer 13.8 kV feeder breaker and incoming feeder breakers for the ESF busses upon actuation of the ES Transformer differential relay. The trips of these ESF bus feeder breakers and the ES Transformer 13.8 kV feeder breaker are alarmed in the Control Room. These breakers cannot be closed until the ES Transformer lockout relay is reset.
The RCIC meets the requirements of Regulatory Guide 1.47. This is accomplished by providing an indicator light for turbine trip that is actuated by a limit switch when the turbine trip throttle valve is closed. This trip is also connected to annunciate RCIC system out of service.
Although it may be the staff's position that "86" devices which require manual reset must have the tripped condition indicated, Regulatory Guide 1.47 doesn't require this. The design used here, indicates the resultant turbine trip condition and annunciates system level out of service .
Component level indication is not required for any system .
FSAR Rev. 58 032.40-1
SSES-FSAR QUESTION 032,41 The discussion of compliance with the requirements of IEEE Std 279-1971 Section 4.17 is inadequate because it does not address manual initiation at the system level. Provide a description of manual initiation at the system level for all ECCS.
Identify and justify all exceptions.
RESPONSE
Manual initiation at a system level is addressed on a per system basis under Subsection 7.3.2a.1.2.3.1.17, entitled Manual Initiation (IEEE 279-1971, Paragraph 4.17).
Rev. 46, 06/93 032.41-1
SSES-FSAR QYESTION 032.42 Amend FSAR Section 7.5 to describe the Advanced Control Room Complex which includes NUCLENET and PGCC in accordance with the requirements of Sections 7.5 and 7.7 of the Standard Format, Regulatory Guide 1. 70. This description should include a discussion of the design and qualification testing of all devices which are used to isolate non-Class lE display systems from Class lE circuits and the physical separation between Class lE and non-Class lE wiring within the Nuclenet system.
(e.g. How are the Class lE circuits protected from the CRT high voltage circuits? How is this isolation system qualified to the requirements of IEEE Std 279-1971?)
RESPONSE
FSAR Section 7.5 has been revised to contain the information requested on the Advanced Control Room (ACR) implementation in the Susquehanna plant design. Because the Susquehanna SES design predates Regulatory Guide 1. 75 and IEEE 384, these requirements are not applicable to this plant (see Subsections
?.1.2.s.s and 7.1.2.6.16). The separation design used on Susquehanna SES has been found to be acceptable on the Hatch-2, Zimmer, and LaSalle dockets as satisfying the requirements of IEEE-279-1971.
The Susquehanna SES design includes a high degree of design protection between Class lE safety system signals and non-Class lE systems as follows: The safety system interfacing signals are either digital or analog. Digital signals are provided from Class lE qualified components such as relays and switches.
The Class lE qualification testing did not, however, include any requirement to demonstrate isolation capability, since this was a post-design requirement. For BWR IV and V vintage plants the NRC has approved, as acceptable, the inherent protection afforded by contact-to-contact and coil-to-contact isolation.
Analog safety signals are being provided from current and voltage limiting circuit designs which provide protection for the safety circuit. The circuit design incorporated good engineering design practices but qualification testing or demonstration of isolation capacity was not required. All of the non-safety signals that come from safety systems originate at the safety device or circuit which is within a safety system enclosure.
The Display Control System (DCS) in a non-safety system and its CRT high voltage circuits are separated from the safety system signals. The CRT high voltage occurs only within the HV section of the CRT chassis; it therefore does not appear in any panel or floor section signal cabling. Separation is provided by routing of safety system cables in floor section divisional ducts that are separated from the non-divisional duets.
Rev. 46, 06/93 032.42-1
SSES-FSAR Separation is also provided, as required, by conducting and canning the circuits in the common inner ring operator bench boards. For BWR IV and V vintage plants, the NRC has approved, as acceptable, these mechanical barriers between safety and non-safety circuits.
In summary, the separation design used on this plant has been previously approved by the NRC as satisfying the IEEE-279-1971 requirements and the level of isolation protection afforded by the design has also been approved.
Rev. 46, 06/93 032.42-2
SSES-FSAR QUESTION 032,43 The discussion of shutdown, isolation and core cooling indication is inadequate. Provide the following additional information:
(1) Identify which instrument bus supplies power to the control rod status lamps.
(2) Identify which instrument bus supplies power to the control rod scram pilot valve status lamps.
(3) Justify the use of the power range channels and recorders downscale indication as a valid indication of reactor eubcriticality following a loss of offsite power.
(4) ' Identify the annunciators which have a safety function.
(5) Describe the qualifications of the annunciators, and plant process computer and demonstrate that they satisfy the requirements of GDC 13, 20(2), 21, 22, 23, and 24 and IEEE Stds 279-1971, 323-1971, 338-1971, and 344-1971. If these criteria are not met, justify the use of this equipment for the protection of public health and safety.
RESPONSE
(l} Scram position of the control rods are indicated at both panels 1C652 (4 rod group status) and 1C651 (full core display). The rod positions are transmitted to these panels from a multiplexer located in panel 1C6l5. The power supplies for these panels are as follows (Unit 2 panels are fed from the corresponding Unit 2 power supplies}:
1C615, 1C651 120 V instrument a-c panel 1Y218 (non Class lE) lC652 - 120 V a-c uninterruptable power supply panel 1Y629 (non-Class lE)
Refer to Section 1.?, Dwg. E-25, Sheets 1, 2, & 3 for panel assignment.
{2) The Division I and Division II scram pilot valve status lamps are powered from the RPS 120 V a-c panels (non-Class lE) 1Y201A and 1Y201B, respectively. Unit 2 indications are fed from the corresponding Unit 2 RPS panels.
Refer to Section 1.7, Dwg. E-157, for panel assignment.
Rev. 46, 06/93 032.43 -1
SSES-FSAR (3) Al though the neutron monitoring power range channels are listed as indication that the reactor is shutdown, this is not to be construed as meaning they are required to verify shutdown. The neutron monitors provide information in addition to the verification that is given by the control rod status lamps and scram pilot status lamps. The neutron monitors would not provide verification following a loss of offsite power.
(4) The annunciators do not perform any safety function.
(5) The annunciator and the process computer are not safety equipment and do not perform any safety functions.
Rev. 46, 06/93 032.43 -2
SSES-FSAR QUESTION 032.44 The seismic qualification of indicators and recorders for post-accident monitoring which is described in FSAR Section 7.S.la.4.2.3.3 is unacceptable. It is the staff's position that post-accident indicators and recorders must satisfy their minimum performance requirements before and after a seismic event without adjustments or repair. (The staff acknowledges that these electro-mechanical devices may not accurately indicate during severe vibrational excitement.) Provide a modified design to conform to the above position or justify the exception taken.
RESPONSE
Post-accident monitoring is discussed in PP&L's updated response to TMI related requirements (PLA-659, N. W. Curtis to B. J. Youngblood dated 3/16/81). PP&L has provided its position on Regulatory Guide 1. 97, Revision 2 in PLA- 965, Curtis to Schwencer, dated 11/13/81.
Rev. 46, 06/93 032.44-1
SSES-FSAR QUESTION 032.45 It is the staff's position that the use of the Rod Worth Minimh:er in unacceptable for the protection of the public health and safety because it does not satisfy the requirements of IEEE Std 279-1971. Therefore, amend the FSAR by deleting this system from those sections specifically designated for systems that are required for safety.
RESPONSE
The FSAR will be amended, moving Rod Worth Minimizer from Section 7.6 to Section 7.7, under Control System Not Required for Safety.
Rev. 46, 06/93 032.45-1
SSES-FSAR QUESTION 032.46 The Rod Sequence Control System (RSCS) is assumed to function in FSAR Section 15.4.l.2 to mitigate or prevent several accidents. Therefore, it appears that the Reactor Manual Control System (RMCS), Rod Position Indicating System (RPIS),
and RSCS are parts of a reactor protection system. Therefore, provide the design bases and other information in accordance with bases and other information in accordance with the requirements of Section 7.2 of the Standard Format, Regulatory Guide 1.70 for these three subsystems.
RESPONSE
The Reactor Manual Control System (RMCS) with its Rod Sequence Control (RSCS) and Rod Position Indication (RPIS) portions and the Rod Worth Minimizer (RWM) are not safety systems; however, the safety action required for the continuous control rod withdrawal transient is performed by the qualified Neutron Monitoring System as detailed below.
Continuous control rod withdrawal errors during reactor startup are precluded by the rod sequence control system (RSCS) and the rod worth minimizer (RWM). The RWM prevents the selection and withdrawal of an out-of-sequence control rod. Failure of the RWM to block an out-of-sequence rod will result in a RSCS rod block. Thus, the RSCS and RWM provide redundant protection systems with diverse power supplies.
In the unlikely event that both the RWM and RSCS fail, the IRM system will block rod withdrawal and initiate a scram if the scram setpoint is reached. Furthermore, the ARPM will initiate a scram at 15% of rated power.
The consequences of a rod withdrawal error in the startup range were generically analyzed in NEDO-23842. The analysis shows that the licensing basis criterion for fuel failure is still satisfied even when the RWM and RSCS fail to block rod withdrawal. Thus, a modified design for the RSCS is not required.
Rev. 46, 06/93 032.46-1
SSES-FSAR QUESTION 032,4'7 Provide a list of NSSS Class lE instrumentation and control equipment utilized within the SSES design that have been previously used in BWR plants such as Zimmer, LaSalle, Hatch and Shoreham. Also identify those Class lE equipment in NSSS scope that are utilized for the first time in SSES design .
RESPONSE
The following NSSS Class-lE instrumentation and control equipment used on Susquehanna were not previously used on BWR plants such as Zimmer, LaSalle, Hatch, and Shoreham. The other equipment listed in FSAR Tables 3.10-1 and 3.10-2 have previously been used on BWR plants such as Zimmer, LaSalle, Hatch, and Shoreham .
Description Appficatlon Manufacturer Identification Operating Mode Switch H12P680 C72A-S1 Rundell 163C1487 Push Button Switch H12P601 Cutler Hammer 145C3230 e .g. E21A Sl6A &
E11A*S20A Push Button Switch H12P853 Cutler Hammer es,E392 R.G. 1.47 Bypass Ind. SW H12P601 J.L. Mark II 85iE603 Reactor Core Clinq. BB H12P601 General Electric 865E102A Standby Information Panel H12P678 General Electric 865E129 Unit Operating 88 H12P680 General Electric 865E141 Plant Operting BB H12P853 General Electric 865E130 AB Rev. 46, 06/93 032.47-1
SSES-FSAR QUESTION 032.48 With regard to the seismic and environmental qualification of the Class lE instrumentation and control equipment in the balance of plant scope, the staff requires the following qualification test program information along with the results of the tests:
(1) Equipment Design specifications (2) Test Plan (3) Test set up
( 4) Test procedures and (5) Acceptability goals and requirements.
Thie information shall be provided for at least one item in each of the following groups, including the type {functional designation), manufacturer, manufacturer's type number and model number, of Class lE instrumentation and control equipment.
(1) Transmitter (2) Logic equipment (3) Instrument Racks (4) Control Boards (NUCLENET)
RESPONSE
The four categories of equipment listed in this question are a subset of the 17 categories listed in NRC Question 042.2.
Therefore, for response, refer to question 040.2.
Rev. 46, 06/93 032.48-1
SSES-FSAR QUESTION 032.49 The SSES control room is different from GE's PGCC concept which we have reviewed. Therefore provide the following information:
(1) Provide the criteria with appropriate layout drawings and concepts for (a} physical separation and barriers between redundant circuits (b) physical separation and routing of non-safety circuits (c) safety channel identification and color coding (d} seismic qualification (e) fire detection and protection (2) Discuss your conformance to GDC-19 and Regulatory Guide l.78.
(3) Discuss the provisions for satisfying the recommendations of Regulatory Guide 1.75, and the acceptability of large quantities and large concentrations of cables in a small area immediately beneath the elevated control room floor.
{4} Discuss the degree of conformance to Regulatory Guide 1.75 in the vertical cable chase between the upper and lower relay rooms. Justify any exception {i.e.
associated circuits) and provide the criteria with appropriate* layout drawings depicting (a) physical separation and barriers between redundant circuits (b) physical separation and routing of non-safety circuits (c) safety channel identification and color coding (d) seismic qualification (e} fire detection and protection
RESPONSE
(1) The upper and lower level of the control complex is PGCC, while the center level control room is non-PGCC.
Those positions of the control room which are PGCC configured do meet the requirements and exceptions as defined in PGCC NEDO-10466A.
Rev . 4 6 , 0 6 / 9 3 032.49-1
SSES-FSAR Control Room related electrical layout drawings are identified on Table 1.7-1 and are submitted under separate cover.
(a) Physical separation and barrier's design criterion between redundant circuits in control room raceways is the same as stated in Subsections 3.12.3.4.2.1 and 8.3.1.11.4. See revised Subsection 3.12.3.4.2.6 for a discussion of separation in control room panels. See also Subsection 7.1.2.5.8.
(b) Routing of non-safety circuits is separated from safety related circuits. See Subsections 3.12.3.4.2.1 and 8.3.1.11.4.
( c) Safety channel identification and color coding are shown in Subsections 1. 8. 6. 2, l. 8. 6. 3, l. 8. 6. 4, and 8 . 3
- 1. 11. 3 .
(d) Refer to Section 3.10 for seismic qualifications.
(e) Fire detection and protection for Susquehanna SES is discussed in detail (including layout drawing) in the Susquehanna Fire Protection Review Report
- which was submitted on Jan. 18, 1978. For the control room, ionization detectors and manual CO are used under the removable floor. Portable CO extinguishers are deployed in the control room.
Hose stations are located outside the control room. All PGCC termination cabinets and floor channeling have smoke and thermal detection coupled with a Halon 1301 file suppressant system as approved by the NRC per Topical Report NED0-10466-A.
(2) As discussed in Sections 3.1 and 6.4.4.2, the Susquehanna SES control room complies with GDC-19 and Regulatory Guide 1.78. Prompt shutdown of the reactor from outside the control room is described in Subsection 7.4.1.4.
(3) The raceway design beneath the elevated control room floor is in compliance with Regulatory Guide 1.75-1975 as discussed in Subsections 3.12.3.4.2.l and 7.1.2.6.1.6. In some risers below the control panel where the minimum separation distance between two redundant channel/division or between Class lE and non-Class lE circuits cannot be met, cables of one of redundant channel/division or the Class lE circuits (to be separated from non-class lE circuits) are either installed in metallic flexible conduits or separated by steel barriers.
Rev. 46, 06/93 032.49-2
SSES-FSAR (4) Susquehanna SES has fully complied with Regulatory Guide 1.75-1975 in the vertical cable chase design between the upper and lower relay rooms. Layout drawings are listed in Table 1.7-1.
(a) Refer to Subsections 3.12.3.4.2.1, 8.3.1.11.4.
(b) Refer to Subsections 3.12.3.4.2.1 & 8.3.l.ll.4.
(c) Refer to Subsections 1.8.6.2, 1.8.6.3, 1.8.6.4, and 8. 3 .1.11. 3.
{d) Refer to Section 3.10.
(e) Fire detection and protection for vertical cable chases containing safety-related cables:
(i) Ionization detectors and manual total flooding CO2 are used for chases in the control room.
{ii) Heat detectors and automatic total flooding CO2 are used for chases above and below the control room into the cable spreading rooms.
Also refer to Susquehanna SES Fire Protection Review Report which was submitted on January 18, 1978.
Rev. 46, 06/93 032.49-3
SSES-FSAR QUESTION 032,50 Regulatory Guide 1.75 and IEEE Standard 384-1974 on Criteria for Separation of Class lE Equipment and Circuits do not apply to SSES because they were issued after the CP. Separations criteria for safety related mechanical and electrical equipment are described in 3 .12. Specific exceptions to RG 1. 75 are identified in 3.13 for non-NSSS equipment, but no similar list is supplied for NSSS equipment. A brief, general discussion is contained in 7.1.2.5.8.
Identify all specific exceptions to RG 1.75 and IEEE 384-1977 for NSSS equipment and justify each.
RESPONSE
The separation design of this plant has the same basis as that already approved by the NRC for Hatch 2.
See revised Sections 3.13 and 7.1.
Rev. 46, 06/93 032.50-1
SSES-FSAR QUESTION 032.51 Discussion of the APRM system on page 7 .2-5 indicates the maximum setpoint is 125% reactor power. Table 7.6-5 lists the nominal APRM setpoint as 120% and the range as 2% of ful 1 scale. This setpoint is significant for the accident analysis in 15.0.
Discussion of the APRM system on page 7. 2-5 indicates the maximum setpoint is 125% reactor power, but table 7.6-5 lists the nominal setpoint as 120% with a range of 2% of full scale.
Clarify this discrepancy and identify the maximum setpoint for accident analysis.
RESPONSE
The discussion of the APRM in Subsection 7.2.1.1.4.2 has been modified to indicate that the trip setpoint is provided in this plant Technical Specifications. For consistency Table 7.6-5 has also been revised by adding a footnote to the nominal setpoint column referencing the plant Technical Specifications for actual setpoints. These specifications define the analytic or design basis limit value, below that the allowable value, and below that the actual trip setpoint. Each value below the analytic limit (which the safety anaiysis uses) provides a measure of additional conservatism as well as taking into account instrument accuracy, calibration error and setpoint drift.
Rev. 46, 06/93 032.Sl-1
SSES-FSAR QUESTION 032.52 Table 7.2-4, Design Basis Setpoints, was deleted in Revision
- 11. Several sections still refer to data contained in that table.
Several references are made to design basis setpoints previously listed in Table 7.2-4. This table has been intentionally left blank. Please clarify this discrepancy.
RESPONSE
Table 7. 2-4 was deleted because the information thereon has been incorporated in the plant Technical Specifications. Some information from Table 7. 2-1 and all the information from Tables 7.2-5 and 7.2-6 has been deleted from Section 7.2 and is also contained in the Technical Specifications as the appropriate single point of reference for this data. Various discussions in Section 7.2 have been revised by appropriately referencing the Technical Specifications rather than the deleted tables.
Rev. 46, 06/93 032.52-1
SSES-FSAR QUESTION 032.53 Section 7.2.1.1.4.8 (Testability) states, "During preoperational testing the sensors are tested using an accepted industry method and actual response time data are compared to design requirements for acceptance." Section 7.2.2.1.4.4 (BTP
- 24) states in part that the sensor response time test method has not been resolved for neutron monitoring system (APRM and IRM) and main steamline radiation monitoring trip points.
Question 032.32 asks for a description of the Startrek computer system which is used for startup testing. The question also asks for separation criteria for permanent and temporary wire as well as specifications of qualification testing of electrical isolators. This question, directed at 7.3 only, has not been answered.
The discussion of compliance with BTP 24 is incomplete.
Describe methods to be used to perform periodic response time tests of RPS system to verify design specifications are met.
Identify all specific exceptions to RG 1.118 and IEEE 338-1977.
Describe separation criteria for permanent and temporary wiring and describe the qualification tests for electrical insulators.
RESPONSE
Subsection 7.2.2.1.2.4.4 has been revised to state that sensor response time testing for the reactor protection system is performed periodically as defined in Table 3. 3 .1-2 of the Technical Specifications.
Question 32.32 which asked for a description of the Star Trek computer system was submitted in Revision 14 dated February 1980.
With respect to the methods used to perform periodic response time tests of the RPS, the following criteria will be followed:
A precise hydraulic pressure signal will be generated as the input to the individual sensors. The sensor output and the final actuation device or initiation device to all connected loads will be recorded on a high speed recorder. The delay time will be determined ~long with other channel observations as required. This is consistent with both IEEE-338-1977 and Regulatory Guide 1.118 dated 1978, ev~n though IEEE-338-1977 and Regulatory Guide 1.118 are not design bases for this plant.
Rev. 46, 06/93 032.53-1
SSES-FSAR Question Rev. 48 QUESTION 032.54 Discussion of the Emergency Core Cooling Systems and the associated tables are incomplete and inconsistent. Correct and clarify the following:
- 1) The same instruments are used for Reactor Vessel low water level and Primary Containment high pressure for many ESF systems. The specification shown for these instruments in Tables 7.3-1 through 7.3-5 are not consistent. Correct trip settings, ranges, and accuracies shown for these instruments.
- 2) These tables have allotted columns for instrument resp:mse times and margins (of trip setting) to meet requirements of IEEE 279- 1971 Section 3, but most data has been omitted . Response times should indicate minimum and/or maximum where applicable.
- 3) Table 7.3-1 has omitted all specifications for the Turbine overspeed instrument.
- 4) Figure 7.3-5 has several errors:
- It does not show two ADS logics as indicated in 7 .3. 1.1 a.1.4.4.
- Referenced Figure 7.3-16 does not exist.
- It does not show low pressure interlocks to LPCI and CS required to initiate ADS as indicated in 7.3.1.1a.1 .4.4 .
- 5) Table 7.3-2 indicates only one reactor water level setpoint (-149 rnches) for the ADS. Section 7 .3.1.1 a.1.4.4 indicates two level setpoints, a low and a lower water level.
- 6) Use of level switches with a range of -150"/0/+60" to initiate ADS and CS action with trip settings at-149 does not seem like conservative design. Justify the use of this range for this application. Discuss accuracy of the trip setting and how it is affected by normal and accident environmental conditions and long term drift.
- 7) Why are two ranges shown for LPCI pump discharge pressure (10-240 psig and 10-260 psig). Range shown for this instrument ;n Table 7.3-4 is10-240 psig only.
Rev. 46, 06/93 032.54-1
SSES-FSAR Question Rev. 48
- 8) Section 7.3.1.1 a.1.4.5 on ADS Bypasses and Interlocks indicates that it is possible for the operator to manually delay the depressurizing action and states "This would reset the timers to zero seconds and prevent depressurization for 105 seconds." Table 7.3-2, Figure 7.3-8-3 and Table 6.3-2 all indicate a time delay of 120 seconds. How is a time delay of 105 seconds achieved?
- 9) Explain why two ranges (50-1000 psig and 50-1200 psig) are listed for the Reactor Vessel Low Pressure instrument in Table 7.3-3.
- 10) Instrument ranges for pump discharge flow, Tabte 7.3 .. 3, and pump minimum flow bypass, Table 7.3-4, are specified in inches of water but trip settings are in gpm.
Supply ranges for these flow instruments in gpm.
- 11) Table 7.3-9 HPCI System Minimum Numbers of Trip Channels Required for Functional Performance does not agree with Table 7.3-1 HPCI Instrument Specifications. Table 7.3-8 does not list HPCI pump high suction pressure or Turbine Overspeed as shown in Table 7.3-1. Table 7.3-8 lists two items, HPCI pump flow and HPCI pump discharge flow, not shown in Table 7.3-1.
- 12) Table 7.3-4 Low Pressure Coolant Injection - Instrument Spectfications does not agree with Table 7.3-10 Low Pressure Coolant Injection System Minimum Number of Trip Channels Required for Functional Performance. Table 7.3-1 0 does not list Reactor low pressure or Pump discharge pressure as shown in Tabte 7.3-4. Table 7.3-10 lists several trip channels which are not shown in Table 7.3-4. These indude Reactor vessel low water level inside shroud, Reactor vessel low flowl Primary containment high pressure, and Reactor vessel low water level (Recirculation Pumps).
- 13) Table 7,3-11 Core Spray System Minimum Numbers of Trip Channels Required for Functional Performance is incomplete. It does not list Pump Discharge Flow as shown in Table 7.3-1.
RESPONSE
- 1. Tables 7.3-1 through 7.3-4 have been revised to include all appropriate instrument functions and the number of channels provided. The trip settings and response time information has been deleted, and is provided in the Technical Specifications. Tables 7.3-8 thru 7.3-11 are deleted, with appropriate number of channel information incorporated into Tables 7.3-1 thru 7.3-4. Revisions to Table 7.3-5 have been submitted with the response to Question 032.55.
Rev. 46, 06/93 032,54-2
SSES-FSAR Question Rev. 48
- 2. The instrument response times and margins (of trip settings) are included in the Technical Specifications. The data in the Technical Specifications is intended to also satisfy the requirements of IEEE 279-1971, Section 3.
- 3. The HPCI turbine overspeed trip is a mechanical device, which is integral with the turbine. See Section 6.3, for discussion of the HPCI turbine. The overspeed trip setting and accuracy information is provided in the Technical Specifications.
- 4. Figure 7.3-5 is revised to show a simplified picture of the ADS and LPCI/CS initiation logic. The ADS division I and II Logics, discussed in revised Subsection 7.3.1.1a.1.4.4 and shown in detail by Figure 7.3-8 sheet 3, are identical and energizing either will initiate ADS. Therefore they are shown twice in Figure 7.3-5. Relating the simplified picture in Figure 7.3-5 to the detailed one in Figure 7.3-8, the left branch corresponds to logic A in Div. I (or Bin Div. II) and the right to logic C in Division I (or Din Div. II). A note has been added to Figure 7.3-5 to clarify the separate logics for Div. I and Div. II. The reference to Figure 7.3-16 contained on Figure 7.3-5 is erroneous. The correct reference Figure for LPCI logic is Figure 7.3-10, RHR FCD. The low pressure interlocks for pumps (CS and RHR) have been added to Figure 7. 3-5.
- 5. The revised Table 7.3-2 includes an appropriate entry for ADS initiation, with action caused by two signals, one each from the reactor water level L 1, and reactor water level L3. Both signals are required before ADS is automatically initiated. The set point for this action is provided in the Technical Specifications.
- 6. The instrument trip settings have been removed from the tables of Chapter 7 and included in the Technical Specifications. The level switch trip setting of -149 inches for ADS and CS will be changed and will be within the proper accuracy and range of the instrument. The trip setting accuracy related to abnormal operating temperature within the dryweH is discussed in the response to Question 032.59. Instrument drift is included in developing the instrument set points.
- 7. The LPCI pump discharge pressure permissive for the ADS has two redundant channels provided for each LPCI (RHR) pump. However the instruments have identical ranges, so Table 7.3-2 has been revised to agree with Table 7.3-4.
- 8. The ADS timer setpoint found in Table 6.3-2 is an upper limit. The correct setpornts (including margin) are provided in the Technical Specification. The proper time delay time is by mechanica~ adjustment of pneumatically operated time delay relay. The text of Subsection 7.3.1.1a.1.4.5 has been revised to delete the actual numerical value. The 105 second time value is nominal, and was used to allow for the margin and tolerance of the device. The proper value is provided in the Technical Specification.
Rev. 46, 06/93 032.54-3
SSES-FSAR Question Rev. 48
- 9. The two trip systems for CS have diverse instruments specified for reactor vessel and the same instruments are used in LPCI low pressure. Tables 7.3-3 and 7.3-4, as revised, give the instrument ranges for both trip systems. The trip setting values are provided in the Technical Specifications.
- 10. The* CS and LPCI (RHR) pump minimum flow bypass ranges are converted from differential pressure to flow on the revised Tables 7.3-3 and 7.3-4.
- 11. Table 7.3-1 has been revised to include HPCI pump minimum flow bypass and the HPCI pump flow controller signaling the HPCI turbine. The turbine overspeed trip is a mechanical device that is integral with the turbine, see Section 6.3. The turbine overspeed instrument range has been added to Table 7.3-1. The number of channels provided is added to Table 7:3-1, and Table 7.3-8 is deleted. The minimum number of trip channels required have been added to the Technical Specifications.
- 12. The LPCI Table 7.3-4 has been expanded to include the instruments of the actual design and the number of channels provided. The margin and trip setting of Tab!e 7.3-4 as well as Table 7.3-10 have been deleted.
- 13. The CS Table 7.3-3 has been revised to add the number of instrument channels provided, and margin, response time, and trip settings have been deleted. Table 7.3-11 has been deleted.
Rev. 46, 06/93 032.54-4
--- -- -*** *-* *- * - ~ -
SSES-FSAR QUESTION 032.55 Discussion of the Primary Containment and Reactor Vessel Isolation Control System in Section 7.3.1.la.2 and associated Tables 7.3-5, 7.3-7 and 7.3-12 are confused, incomplete and inconsistent. Correct or clarify the following:
- 1) Several instruments listed in 7. 3 .1. la. 2 .1 are not discussed in the text and/or do not appear in the tables. These include RWCS High Flow, RHRS High Flow, RICI High Flow, HPCI High Flow.
- 2) Several items only appear in Table 7. 3-5 with no discussion. These include RCIC Turbine Streamline High Temperature and Low Pressure, HPCI Turbine Steamline High Temperature and Low Pressure, Reactor Building and Drywell Ventilation Exhaust High Radiation.
- 3) In Table 7.3-5, in!3trument ranges, setpoints, accuracies, and time responses have been omitted for many sensors. Several sensors discussed in the text are not listed at all. These include Condenser Vacuum, RHR High Temperature and Differential Temperature, RWCS Differential Temperature, Main Steamline Differential Temperature. It is understood that some setpoints will be selected based on operating conditions, but these sensors must be identified.
4} Table 7.3-12 is redundant. It has only one entry, serves no purpose and could be eliminated.
- 5) Section 7.3.1.la.4.12, Main Steamline-Leak Detection, appears to serve no purpose since all items are discussed in other parts of this section on the PCRVICS.
- 6) Table 7.3-7, Trip Channel Required for PCRVICS, is incomplete. Many functions discussed in the text and/or listed in Table 7.3-5 are missing.
- 7) Section 7.3.1.la.2.4.2 references Table 7.3-7 for instrument characteristics. These are actually shown in Tables ?.3-5.
RESPONSE
- 1) The RWCS High Flow, RCIC High Flow, and HPCI High Flow have been deleted from Subsection 7. 3 .1. la. 2 .1. Please refer to new Subsection 7.3.l.la.2.4.1.14 for a discussion of the RHR high flow isolation signal on the shut down suction line.
Rev. 46, 06/93 032.55-1
SSES-FSAR
- 2) RCIC and HPCI systems are not part of the Primary Containment and Reactor Vessel Isolation Control System and have been deleted from Subsection 7.3.1.la.2 and I
- Table 7.3-5. Both RCIC and HPCI systems have system isolation valves that are initiated closed by HPCI and RCIC isolation signals, not PCRVICS. Refer to Subsections 7.3.l.la.l.3.7 for HPCI and 7.4.1.1.3.6 for RCIC. The discussion of Reactor Building Ventilation Exhaust High Radiation is found in Subsection 7.3.1.lb.4, 7.3.1.lb.5 and 9.4.2.1.
- 3) See Revised Table 7.3-5.
- 4) Table 7.3-12 has been deleted and the main steamline "Upscale Trips per Channel" information has been changed from 1 to 2 on Table 7.3-6. The following notes have been added to Table 7.3-6:
(a) The Main Steamline Radiation Monitoring System output is part of the Primary Containment and Reactor Vessel Isolation Control System (PCRVICS). See Subsection 7.3.1.la.2.4.l.2.
,. (b} The Reactor Building Ventilation Exhaust High Radiation Monitoring System output is part of the PCRVICS. See Subsections 7.3.1.lb.4, 7.3.1.lb.5, 9.4.2.1 and Table 7.3-5.
- 5) The purpose of Subsection 7.3.l.la.2.4.1.12 *Main Steamline Leak Detection" Sub-system Identification discussion is to give a concise interrelation of the three subsystems. Although the same conclusion can be reached by separately referring to Subsections
- 7. 3. 1. la. 2. 4 .1. 3 and 4 it would be cumbersome and possibly confusing, therefore this section will not be deleted.
- 6) Table 7.3-5 has been revised to include the number of trip channels provided information previously shown in Table 7.3-7 and the missing trip channel information.
Table 7.3-7 has been deleted. The minimum number of trip channels information of Table 7. 3-7 has been incorporated into the Technical Specifications. Table 7.3-5 has been corrected to delete the HPCI and RCIC
. system information because they are not part of the PCRVICS. See Table 7.3-5 for additional isolation functions and appropriate data.
- 7) The Subsection 7.3.1.la.2.4.2 reference to Table 7.3-7 has been changed to reference Table 7.3-5. Section 7.3 . 1.la.2.9 reference to Table 7.3-7 has been changed to Chapter 16, Technical Specifications.
Rev. 46, 06/93 032.55-2
SSES-FSAR QUESTION 032.56 It is the current staff position that Mark II suppression chamber sprays be actuated automatically instead of manually.
Similar plants such as Zimmer and Shoreham are making this change. Identify any significant differences between these plants and Susquehanna in this regard and justify the proposed manual system.
RESPONSE
We believe that manually actuated suppression chamber (wetwel 1) sprays are acceptable for Susquehanna. The basis for this decision is as follows.
- 1. Calculated Allowable Bypass Leakage Area (A/VK) is Acceptable.
The NRC has requested in Reference l that Mark II Containments be designed with a steam bypass capabi 1 i ty for small breaks on the order of 0.05 ft 2 (A.NK). A review of the FSAR's for Susquehanna, Shoreham, and Zimmer (References 2, 3 and 4) show the calculated allowable bypass leakage areas to be Susquehanna; . 0535 ft 2 Shoreham; .08 ft 2 -
Zimmer; . 0165 f t 2 Assumptions for operator action time for the Susquehanna analysis were conservatively chosen and are given in Reference 2.
Zimmer's area is less than as requested by the NRC and they chose to use automatic wetwell sprays to meet the intent of Reference 1. Shoreham's area is larger than that requested by the NRC and to our knowledge they have not yet made the decision to implement automatic wetwell sprays. Similarly, Susquehanna's area is larger than that requested by the NRC. It therefore meets the steam bypass capability requirement of Reference 1 with manually actuated wetwell sprays.
- 2. Automatic Spray Diverts Flow From The Vessel.
Core cooling is the first consideration in the response to a transient or accident. If the automatic wetwell spray is activated, it could potentially degrade required vessel cooling by diverting LPCI flow to the wetwell spray. This diversion would also reduce the operator's flexibility in responding to a transient or accident.
Rev. 46, 06/93 032.56-1
SSES-FSAR In conclusion, the current design of Susquehanna with the manually initiated wetwell sprays meets the NRC requirements and no automatic wetwell spray is required.
References
- 1. Appendix I to SRP 6.2.1.1.C, Containment System Branch Steam Bypass for Mark II Containments
- 2. Susquehanna Final Safety Analysis Report Chapter 6, Section 6.2.1.1.5 (updated per Question 21.51)
- 3. Shoreham Final Safety Analysis Report Chapter 6, Section 6.2.1.3.6
- 4. Zimmer Final Safety Analysis Report Chapter 6, Section 6.2.1.3.6
Draft Revision 6A, March 14, 1980.
Rev. 46, 06/93 032.56-2
SSES-FSAR QUESTION 032.57 Describe test method to be used to verify closing times for main steamline isolation valves are within limits of technical specifications. identify any special design features to facilitate this test. Table 6.2-12 is referenced for closure times of main steamline isolation valves, but time has been omitted from that table. What is the range of acceptable closure times?
RESPONSE
The determination of the MSIV closure was an extrapolation from the position lights as illustrated by Figure 032. 27. The closure time is the summation of the time between the initiation signal and the 90% closed light plus 1/9 times the time interval between the initiation and the 90% closed lights.
Prior to Startup Testing, data will be taken of actual MSIV stroke length and position limit switch actuation points by direct measurement at each MSIV. From this data, extrapolation factors for closure time have been calculated and included in the Startup Test Procedures. During the startup test these factors; based on actual rather than assumed valve positions, were applied to the closure times obtained by valve limit switch actuation signals to the control room.
The extrapolation factors used assume linear valve motion.
However, errors in valve closure time determination due to any non-linearity is small and over-shadowed by the ef feet of decreasing closure time due to steam line flow (by about one full second from no flow to full steam line flow), and is in the conservative direction . In addition, the extrapolation method is consistent with the method used to satisfy plant technical specification surveillance testing of MSIV closure times. The range of acceptable closure times for the main stearnline isolation valves is 3 to 5 seconds.
See revised Table 6.2-12.
Rev. 46, 06/93 032.57-1
0
~ - 100% MOTION TIME 10 0
w
(/)
0
_J u
I-z w
u I..
Cl'.'.'.
w 0... '-+---- RECORDED MOTION TIME 90 100 0 2 3 4 5 6 7 TIME FROM INITIATION (sec)
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT MSIV PERCENT CLOSURE VS.
TIME EXTRAPOLATION FIGURE 032.57-1, Rev 47 AutoCAD: Figure Fsar 032_57_1.dwg
SSES-FSAR QUESTION 032.58 Review of the Main Steamline Valve Isolation Control System logic at Hatch 2 and similar plants determined that failure of a single relay could cause two redundant isolation valves to open. Has this problem been corrected in the Susquehanna design?
RESPONSE
The problem of a single relay failure in the MSIV-LSC causing two redundant isolation valves to open has been corrected in the Susquehanna design. The changes to the design were to make to system initiation relays redundant and to separate the isolation valve circuits so that the final actuating relay coils for series valves are not connected directly to common devices. See FSAR Subsection 7. 3. 2a. 3 .1 which states that:
"The MSIV-LSC has redundant and separate instrumentation and controls to ensure that the system will be able to maintain its functional capability assuming a single failure ... "
Rev. 46, 06/93 032.58-1
SSES-FSAR QUESTION 032.59 General Electric and other NSSS suppliers have reported that post-accident temperature conditions can affect reactor vessel water level instrumentation.
- 1) Describe the liquid level measuring systems within containment that are used to initiate safety actions or are used to provide post-accident monitoring information. Provide a description of the type of reference leg used, i.e., open column or sealed reference leg.
- 2) Provide an evaluation of the effect of post-accident ambient temperatures on the indicated water level to determine the change in indicated level relative to actual water level. This evaluation must include other sources of error including the effects of varying fluid pressure and flashing of reference leg to steam on the water level measurements.
- 3) Provide an analysis of the impact that the level measurement errors in control and protection systems (2 above) have on the assumptions used in the plant transient and accident analysis. This should include a review of all safety and control setpointe derived from level signals to verify that the setpoints will initiate the action required by the plant safety analyses throughout the range of ambient temperatures encountered by the instrumentation, including accident temperatures. If this analysis demonstrates that level measurement errors are greater than assumed in the safety analysis, address the corrective action to be taken. The corrective actions considered should include design changes that could be made to ensure that containment temperature effects are automatically accounted for. These measures may include setpoint changes as an acceptable corrective action for the short term. However, some form of temperature compensation or modification to eliminate or reduce temperature errors should be investigated as a long term solution.
- 4) Review and indicate the required revisions, as necessary, of emergency procedures to include specific information obtained from the review and evaluation of Items l, 2 and 3 to ensure that the operators are instructed on the potential for and magnitude of erroneous level signals. Provide a copy of tables, curves, or correction factors that would be applied to post-accident monitoring systems that will be used by plant operators.
Rev. 46, 06/93 032.59-1
SSES-FSAR
RESPONSE
- 1) Reactor vessel water level is measured by means of a produced differential pressure between a reference leg and a variable leg. The reference leg is connected to the upper part of the vessel (steam zone) and provides the constant head using an overflow type condensing chamber. The variable leg is connected to the lower part of the vessel. The produced differential pressure is therefore a function of water level.
2),3),4) General Electric has conducted a review on the effects of high drywell temperature on reactor vessel water level instrumentation. Instrument accuracy is not markedly effected by varying drywell temperatures because the vertical drop of the sensing lines within the drywell are similar in length. This ensures equalization of temperature effects between lines, should elevated drywell temperature conditions (as in a LOCA) occur, and thereby ensures continued instrument set point accuracy under these conditions.
In summary, with the above instrument routing, there would be little or no impact on the scram or high level trip function, nor would post-accident monitoring be impaired.
Re V . 46, 06 / 93 032.59-2
SSES-F$AR QUESTION 032.60 Pressure switches 1N022 A through Sare used to actuate the 16 safety relief valves in the overpressure mode of operation as described in section 5.2.2.4.
- 1) Describe the logic associated with these instruments including those associated with ADS relief valves (Figure 7.3-8 Sht. 3) and non-ADS relief valves.
- 2) Identify design criteria and requirements met by this system.
- 3) Justify the use of a single instrument to operate each relief valve and analyze the effects of single failures.
RESPONSE
Section 7.3.1.la.1.4 presently includes an overview discussion of the pressure relief function of the safety relief valves.
The ADS is a function of the ECCS and the design criteria for the ADS is found in Section 7.l.2a.1.3 and the analysis and requirements are found in Section 7.3.2a.
The design criteria for the safety relief function of the SRV is discussed in Section 5.2.2. As stated in the FSAR Section
- 7. 3. l. la .1. 4 .1, the SRV' s are dual function valves, i.e. ,
safety and relief. The safety function includes protection against overpressure of the reactor primary system by mechanical spring actuation. The SRV' s open on spring setpoint pressure and close when inlet pressure falls below a predetermined spring setpoint pressure. The safety function is designed according to ASME Boiler and Pressure Vessel Code,Section III.
Each SRV including those designated for ADS are instrumented to open automatically when reactor pressure reaches a specified level. A pressure switch senses reactor pressure, if reactor pressure exceeds the trip setpoint the switch's contacts close and energize a solenoid operated air pilot valve. The pilot valve controls air supply to the SRV. When the pilot valve solenoid is energized, pneumatic energy is supplied to the SRV's
- air cylinder operator which opens the SRV. There is one pressure switch per SRV. The pressure switch setpoint is established from the overpressurization analysis of Section 5.2.2.
The pressure relief function .is not required for accident mitigation, therefore, no safety criteria (e.g., IEEE or regulatory requirements) are applicable. There is no Rev. 46, 06/93 032.60-1
SSES-FSAR requirement to assume simultaneous pressure switch failures during transient events.
The Pressure Relief System writeup is provided as Subsections 7.7.1.12 and 7.7.2.12.
Rev. 46, 06/93 032.60-2
SSES-FSAR QUESTION 032.61 The purpose of the Recirculation Pump Trip (RPT) is to aid the Reactor Protection System (RPS) in protecting the integrity of the fuel barrier.
- 1) Is the RPT designed in accordance with all requirements for the RPS? If not, identify and justify any exceptions.
- 2) Plants such as Hatch 2 and Zimmer have provided recirculation pump trips for reactor vessel low water level or high reactor pressure. Why have these not been provided for Susquehanna?
RESPONSE
- 1) The purpose of the Recirculation Pump (RPT) is to aid the Reactor Protection System (RPS) in protecting the integrity of the fuel barrier at the end of core life, and as such, it has been designed in accordance with all the requirements of the RPS.
The RPT is initiated on turbine stop valve and turbine control valve closure initiation signals.
- 2) Reactor vessel low level and high reactor pressure signals are part of the ATWS design change. These signals do exist as part of the Recirculation System and not RPS. They do initiate a separate recirculation pump trip designed to meet the existing ATWS requirements.
Rev. 46, 06/93 032.61-1
SSES-FSAR QUESTION 032.62 It is the staff's position that the Rod Block Monitor (RBM) is a system important to safety and should be designed, fabricated, installed, tested and subjected to all the design criteria applicable to safety-related systems. Design of the RBM is being reviewed on a generic basis on the Zimmer docket.
Identify any differences between the Susquehanna plant and the Zimmer plant in this regard.
RESPONSE
The Rod Block Monitor system for Susquehanna 1 and 2 identical to that in the Zimmer plant. As in all pre BWR-6 plants (plants where RBM was used), the Rod Block Monitor is designed to prohibit erroneous withdrawal of a control rod so that local fuel damage does not occur. Local fuel damage poses no significant threat relative to radioactive release. The RBM is a power generation system and not utilized for accident mitigation. The RBM's objective is to further fuel life by restricting rod movement to within defined limits, whereby local flux peaking is minimized. The FSAR has been amended to move the RBM from Section 7.6 to Section 7.7.
Rev. 46, 06/93 032.62-1
SSES-FSAR QUESTION 032.63 The response to Q032.39 states, "The RCIC is initially aligned to the CST for reactor vessel make-up water but automatically switches to the suppression pool at low CST level." This does not agree with the FSAR, Section ?.4.1.1.3.6, or the drawings (791E421AE) submitted for review. Correct this discrepancy.
RESPONSE
The following general information is provided to clarify assumptions and misunderstandings within questions 032. 39, 211.126 and 032.63 which are inter-related. At the Susquehanna SES, the HPCI is initially aligned to the condensate storage tank (CST) and automatically transferred to the suppression pool on low water level in the CST.
When the RCIC system is initiated, the turbine-drive pump supplies makeup water from the condensate storage tank (primary source) or the suppression pool {secondary source) into the reactor vessel. When CST water level is low, the suppression pool suction valve is manually opened, and the CST suet ion valve automatically closes thus allowing the suppression pool to provide the necessary makeup water.
The response to Q032.39 is partly incorrect in stating that RCIC automatically switches from CST to suppression pool at low CST level. The two pump suction valves provided in the RCIC are interlocked in such a manner that when the suppression pool suction valve is manually opened from the control room, the CST suction valve automatically closes. Subsection 7 . 4.1.1.3.6 has been amended for clarification. The correct drawing reference is 791E421AE.
See revised responses to Questions 032.39 and 211.126.
Rev. 46, 06/93 032.63-1
SSES-FSAR Question Rev. 47 QUESTION 032.64 Correct and clarify the following items associated with the Core Spray System: .
11
- 1) Figure 7.3-8 Sh. 3 indicates a permissive when core spray pump ;,B is running.
Pump B is not in Division 1. The pressure switch shown (E21-N008A) actually is monitors pump C which in Division 1.
- 2) Section 7.3.1.1a.1.4.4 states in part that one of the RHR pumps or any pair of the Core Spray pumps is sufficient to give the permissive signal. It appears from Figure 7.3-8 that only two specific pairs of Core Spray pumps can give the permissive. These are the pair in each RHR loop {A & C or B & D). No other pairs can give the permissive.
RESPONSE
- 1) Dwg. M1-B21-92, Sh. 3 has been corrected.
- 2) Section 7.3.1.1a.1.4.4 has been corrected.
FSAR Rev. 58 032.64-1
SSES-FSAR QUESTION 032. 65 __
Correct and clarify the following items associated with the Main Steamline Isolation Valve Leakage Control System (MSIV-LCS):
- 1) Provide instrument specifications and setpoint data.
Section 7. 3 .1. la. 3 .12. 3 indicates
- there are no setpoints, but several perrnissives setpoints on steamline pressure, reactor pressure and leakage flow are indicated in the Functional Control . Diagram, Figure 6.7-3.
- 2) Sections 7.3.2a.3.2.1.4 states in part that the MSIV-LCS does not comply with RG-1.96 with regard to reduction of s~em packing leakage or direct leakage to the steam tunnel from MSIV. Section 6.7.1.2 states the system does conform to RG-1. 96 and Section 6. 7. 3. 5 indicates the outboard MSIV leakage is piped to the radwaste system.
- 3) Section 7. 3. 2a. 3
- 2 . 1. 4 references Section 5. 5. 5. 4 which does not exist.
RESPONSE
- 1) Subsection 7.3.l.1a.3.12.3 has been modified and new Table 7.3-27 has been added.
The MSIV-LCS is a manually actuated system and does not have setpoints as such. There are permissives, however;- for reactor pressure, steamline pressure and the inboard MSIV's being fully closed. Thes e permissives are discussed in Subsection 7.3.1.la.3.4.
- 2) Subsection 6 . 7 . 1. 2 is incorrect. The va 1 ve stern packing leakoff and direct leakage is not provided by the MSIV-LCS. These leaks are carried off separately.
The FSAR has been . amended accordingly.
- 3) The reference in Subsection 7. 3 . 2a. 3. 2 .1. 4 to Subsection 5. 5. 5. 4 should instead be to Subsection 5.2.5.4. The FSAR has been amended accordingly.
NQIE:
MSIV-LCS information maintained here for historical purposes.
The MSIV-LCS has been deleted. The function is now performed by the I solated Condenser Treatment Method (Section 6.7).
Rev. 51, 02/97 032.65-1
SSES-FSAR QUESTION 032.66 The response to Q032. 25 is incomplete. Provide a complete description of the design of, and the qualification plan for, the RPS motor generator monitoring and protection equipment to protect the connected loads from unacceptable values of voltage and frequency. Include a functional control diagram and an elementary diagram. Also, revise elementary diagram 115D6002AE and Figure 7.2-1 to show how the protection equipment connects to the RPS and MG sets.
RESPONSE
There are two Class lE Electrical Protection Assemblies associated with each of the two RPS Motor Generator Sets. For redundancy, contactors of two EPA's are installed in series between the Motor Generator Set and the RPS power distribution panel. Each EPA provides undervoltage, overvoltage and underfrequency protection for connected loads. In addition, there are two Class lE EPA's associated with each of the two alternate feeds. The contactors of these EPA's are installed in series between the alternate feed and the RPS panel and provide the protection described above.
The generic design and qualification plan supplied by G.E. for this equipment has been approved by NRC as satisfying the requirements of IEEE-379-1972 Section 6. 6 on the Hatch 2, Zimmer and LaSalle plants. The same is planned for Susquehanna. The RPS MG Set Control Elementary Diagram 115D6002AE and the IED have been updated. FSAR changes to text have been completed.
Rev. 46, 06/93 032.66-1
SSES-FSAR QUESTION 032.67 The description of the backup scram DC power supplies in the FSAR and the elementary diagram (791E414AE) is inadequate.
Amend the FSAR to answer the following questions:
- 1) Does the DC power to the trip system A and B backup scram circuits come from Class lE sources and, if so, what are the power sources.
2} Assuming the DC power does come from separate Class lE sources, what methods are used to separate and isolate the two DC sources in the two trip system cabinets since DC sources pass through both the trip system A and trip system B cabinets? Also, what methods are used to separate and isolate the DC power from non-Class lE power circuits in the cabinets?
- 1) The DC power to the trip system A and B backup scram circuits come from Class lE sources. The power source for trip system A is control center 1D614, breaker 09.
The power source for trip system Bis control center 1D624, breaker 11.
- 2) Divisional separation of the two Class lE sources within the two RPS trip system cabinets is provided by separated terminal boards, each located in different cabinet bays, and by separated wire routing . Loads separation is further provided by the total enclosure of the source's respective equipment terminations, namely relay contacts in this case.
Class lE/Non-Class lE routing separation is provided by routing wiring in separate conduits or by maintaining a minimum of 6 inch separation between wiring. In addition, coil-to-contact and contact-to-contact isolation is used where both Class lE and non-Class lE wiring interfaces with common equipment.
The above methods of separation have been approved by the NRC for use in plants of the same vintage as Susquehanna, Hatch 2 being one example.
Rev. 46, 06/93 032.67-1
SSES-FSAR QUESTION 032.68 The various analyses for Regulatory Guide 1.47, Position C.4, are incomplete since they do not indicate that the individual system level indicators can be actuated manually from the control room by the operators. Describe the provisions incorporated into the Susquehanna design to satisfy Position C.4 of Regulatory Guide 1.47. (Note: This position is not intended to address the testing of annunciators, but is intended to provide manual initiation of system level indication of inoperable and bypassed status.)
R_ESPONSE:
See response to Question 32.71.
Rev. 46, 06/93 032.68-1
SSES-FSAR Queslion Rev. 47 QUESTION 032.69 The description, analyses, figures, and elementary diagram of the HPCI sensors and logic are inconsistent. The text (7. 3.1.1 a.1. 3) begins by describing a system with only two lever sensors and then continues describing a system with four fevel sensors and four pressure sensors. The IEEE 279 analyses appear to be for a system with four each level and pressure sensors arranged in two separate one-out-of-two-taken-twice logics. The information in Table 7.3-8 implies two separate logics. The figures (F5.1-3b, F7.3*6. and F7.3-7) and the elementary diagram (791 E420AE) show only two each level and pressure sensors and a single logic.
Amend the appropriate document(s) to describe the HPCI initiation and control system actually installed at Susquehanna. Also, review the RPS, ECCS, and other ESF system descriptions in the FSAR, the FSAR figures, and the elementary diagrams and verify that these documents describe the systems actually installed.
RESPONSE
The logic required to initiate HPCI consists of four vessel water level switches arranged in a one-out-of-two-twice logic (two level switches from division 11 and two from division 2). This logic is in parallel with four drywell pressure switches (two pressure switches from division 1 and two from division 2) that are also arranged in one-out-of-two-twice logic.
Consistent wfth the above discussion, Subsection 7.3.1.1a.1.3.3 has been amended.
Figure 7.3-6 has been changed to show 2 parallel sets of one-out-of-two-twice logic for vessel low water level and drywell high pressure.
Dwg. M1-E41-65Sh.1, M1-E41-65, Sh.2, M1-E41-65, Sh. 3, M1-E41-65, Sh. 4and M1-E41-65 Sh. 5 have been changed to show the above one-out-of-two-twice logic each for vessel low water level and high drywell pressure. The correct HPCI Elementary Diagram for Susquehanna SES review is 791 E420WJ, Rev. 1. This document has been changed to show one-out-of-two-twice logic each for vessel low water level and high drywell pressure.
Per the response to 0032.54, Table 7.3-8 has been deleted. The information pertaining to this discussion has been transferred to Table 7.3-1 .
See also revised Subsection 7.3.1.1a.1 .6.7, 7.3.1.1a.1.6.8, 7.3.1.1a.2.4.1.1, and 7 .3.1. 1a.2.4.1.6.
FSAR Rev. 58 032 .69-1
SSES-FSAR QUESTION 032.70 Describe the actions required to restart HPCI upon again reaching reactor low water level after HPCI has been tripped due to reactor high water level.
RESPONSE
See revised Subsection 7.3.1.la.l.3.3 for this information.
Rev. 46, 06/93 032.70-1
SSES-FSAR QUESTION 032.71 The analysis for compliance with Regulatory Guide 1.47, Positions C .1, C. 2, and C. 3 appears to address the RPS and PCRVICS and not the ECCS (HPCI, ADS, CS, and LPCI) which is the subject of this section. Provide an analysis showing how the BCCS meets Regulatory Guide 1.47, Positions C.1, C.2, and C.3.
RESPONSE
The reference to RPS and PCRVICS as examples in the conformance .
statements for ECCS, under positions C.1, C.2 and C.3 of Subsection 7.3.2a.l.2.l.7 is somewhat misleading and has been deleted from that subsection. Subsection 7.3 . 2a.2 . 2.1.5 has also been revised to correct the same problem. See revised Subsections 7.3.2a.l.2.l.7 and 7.3.2a.2.2.1.5.
Rev. 46, 06/93 032 . 71-l
SSES-FSAR Question Rev. 47 QUESTION 032.72 The description of LPCI manual initiation is incomplete and is inconsistent with Figure 7.3-1 O and elementary diagram 791E418AE. The description of LPCI manual initiation references the HPCI system description which mentions manual initiation but does not describe it. The Regulatory Guide 1.62 analysis (7.3.2a.1.2.1.9) indicates a single manual initiation switch for each of the RHR NRHR C and RHR B/RHR D LPCI systems. Figure 7.3-10 and elementary diagram 791 E418AE indicate the LPCI manual initiation switch does not start the RHR pumps.
Regulatory Guide 1.62, Position C.2, states that manual initiation of a protective action should perform all actions performed by automatic initiation. LPCI automatic initiation is as follows :
Low level or high drywell pressure coincident with low reactor pressure initiation logic includes coincident reactor pressure due to shared emergency diesel between Units 1&2 . Coincident
- signal used as LOCA confirmation.
Amend the FSAR and/or the figure and elementary diagram to fully describe the LPCI manual initiation system actually installed at Susquehanna. Amend the Regulatory Guide 1.62 analysis to justify having a manual initiation that does not perform all actions performed by automatic initiation, i.e., the manual initiation switch initiates the LPCI valve lineup but does not start the RHR pumps.
RESPONSE :
Per Regulatory Guide 1.62, an LPCI manual initiation performs all actions performed by an automatic initiation, including RHR pump initiation. The correct elementary diagram for Susquehanna SES is 791E418WJ, Revision 2 which shows the starting circuitry for RHR pumps with manual initiation. LPCI automatic initiation is as follows :
Low level or high drywell pressure coincident with low reactor pressure initiation logic inctudes coincident reactor pressure due to shared emergency diesel between Units 1 & 2. Coincident signal used as LOCA confirmation .
Dwg. M1-E11-51, Sh. 1, M1-E11-51, Sh. 2, M1-E11-51, Sh. 3, M1-E11-51, Sh. 4 and M1-E11-51, Sh. 5 show the proper automatic, as well as manual RHR pump initiation for the LPCI mode of RHR system operation.
See revised Subsections 7.3.1.1 a.1.6.3 and 7.3.1.1 a.4.4.
FSAR Rev. 58 032 .72-1
SSES-FSAR Question Rev. 53 QUESTION 032. 73 Figure 7.3-10 and elementary diagram 791E418AE show an interlock between the RHR systems in Units 1 and 2 such that when a LOCA signal (Low Reactor Water level or High Drywell Pressure in coincidence with Low Reactor Pressure) is present in one unit, the RHR pumps in the other unit are prevented from operating either automatically, manually, or remote~
manually from the individual pump start/stop switches. This interlock is not mentioned or described in the FSAR text and appears to be a violation of GDC 5.
Amend the FSAR and/or the figure and elementary diagram to fully describe the interlocks between the RHR systems in Unit 1 and Unit 2. Provide a detailed analysis to justify having such an interlock that will prevent the safe and orderly shutdown and cooldown of one unit (by preventing RHR operation) while a LOCA signal is present in the second unit. Include this interlock in your discussion and analysis of compliance with GDC 5 (3.1.2.1.5).
RESPONSE
The SSES Unit 1 and 2 LPCI interlock fix is described as follows:
Not "all" pumps in one unit are stopped, namely either pumps C and D in Unit 1 (with LOCA in Unit 2) or pumps A and Bin Unit 2 (with LOCA in Unit 1). Therefore, one pump in each RHR loop remains operable for use in normal shutdown in the Unit without the LOCA, thereby satisfying the requirement of General Design Criterion 5.
The acceptability of the above scheme is based on Appendix K analysis, using worst case single failure whereby one failure is the false initiation of the LOCA initiation logic in the Unit without the actual LOCA. This and all other credible failures were analyzed to assure that minimum pump capacity for core reflood is always available. The single failure analysis is specifically for Susquehanna Units 1 and 2 on the LPCI fix.
The correct RHR elementary diagram 791 E418WJ, Rev. 2, has been reviewed and it shows the LPClfixlogiccorrectly. Dwg. M1-E11-51, Sh.1, M1-E11-51, Sh. 2, M1-E11-51 Sh. 3, M1-E11-51, Sh. 4 and M1-E11 Sh. 5 show the appropriate interlock.
See revised Subsections 7.3.1.1a.1.6.3, 7.3.1.1a.1.6.5 and 7.3.2a.1.2.2.
FSAR Rev. 58 032. 73-1
SSES-FSAR Question Rev. 48 QUESTION 032.74 For the PCRVICS, a large number of inconsistencies, errors, omissions, and conflicts were noted between the descriptions (7.3.1.1a.2), the analyses (7.3.2a.2), the functional control diagram (Figure 7.3-8) and the elementary diagrams (791E401AE, 791E414AE, and 791E425AE). Some examples follow:
- 1) The FSAR (7.3.1.1a.2.4.1.1.1) indicates four level switches with two sets of contacts each - one set of contacts for low level and one set for low low (lower) level. Also, a single pair of reactor vessel pressure taps for each pair of switches was indicated. Figures 5.1-3b and Figure 7.3-8 and elementary diagrams 791E401AE and 791E414AE show two sets of four each level switches - one for low level and one for low low level. Figure 5.1-3b also shows the low level and low low level switches connected to difference pressure taps.
- 2) The FSAR (7.3.1.1a.2.4.1.1.1) indicates that the low low water level signal isolates the MSIVs, the steam line drain valves, the sample lines, and "all other NSSS isolation valves." Further review of the FSAR text, figures, and elementary diagrams shows low low water level only isolates the MSIVs, steam line drain valves, and the sample lines. No "other NSSS isolation valves" could be found that were actuated by the low low water level signal.
- 3) The FSAR indicates the PCRVICS instrumentation and control subsystems include: (10) main steamline - leak detection; (12) reactor water cleanup system - high flow, (14) reactor core isolation cooling system - high flow, and (15) high pressure coolant injection system - high flow. The remaining text does not discuss these items nor were they found in the elementary diagrams or figures.
- 4) The FSAR (7.3.1.1a.2.4.1.9) indicates that RWCU system high differential flow is sensed with "two differential flow sensing circuits" and the analyses section indicates the PCRVICS complies fully with the single failure criteria. The RWCU P&ID and the elementary diagrams show only one high differential flow instrument consisting of three flow transmitters driving a single summer which, in turn, drives two alarm units (one for each of the two trip channels). This arrangement does not meet the single failure criteria.
- 5) Elementary diagram 791E401AE shows a device (dPIS G33-NO44A) labeled "High Diff Flow" in addition to the device in 4) above. N044A appears as a differential pressure switch in the RWCU P&ID. No other reference to this device could be found in the text or elementary diagrams.
- 6) The text states "RWCU system high differential flow trip is bypassed automatically during RWCU system startup." No information on this bypass could be found in the text or elementary diagrams (791E401AE or 791E423AE) or in the various analyses in Section 7.3.2a.2.
FSAR Rev. 65 032.74-1
SSES-FSAR Question Rev. 48
- 7) The text indicates "main condenser low vacuum trip can be bypassed manually when the turbine stop valve is less than 90% open." Elementary diagram 791E401AE and the response to Q032.33 shows that "reactor low pressure" is also required to allow this bypass. No other information on this "reactor low pressure" permissive, including the setpoint, could be found in the FSAR.
- 8) The FSAR (7.3.1.1a.2.5 and 7.3.1.1a.2.11) mentions a "high differential pressure" signal used for RWCU isolation. No other information could be found on this signal either in the text or the elementary diagrams.
- 9) The FSAR (7.3.1.1a.2.11) mentions "high temperature downstream of the non-regenerative heat exchanger" as a RWCU isolation signal. Elementary diagram 791E401AE also shows this signal, but only shows a single instrument, which does not meet the single failure criteria. This isolation signal is not discussed, described, or justified in the text or the analyses.
- 10) Elementary diagram 791E401AE also shows a single SBLC system isolation signal that does not meet single failure criteria. This signal is also not discussed in the text or the analyses.
- 11) Elementary diagram 791E401AE shows an RHR isolation for "Excess Flow" and "High Reactor Pressure". No information could be found on these signals in the text or analyses.
- 12) The text indicates that RWCU and RHR systems high area and differential temperature subsystems have "no automatic bypasses." Elementary diagram 791E401AE shows a manual bypass switch for this sybsystem. The text also says that the main steamline low pressure and the condenser low vacuum bypasses are the only bypasses in the PCRVICS.
- 13) The text indicates that the main steamline high radiation system has bypasses on the individual instruments that are not described in the FSAR or included in the analyses (7.3.2a.2).
Amend the appropriate document(s) to fully and accurately describe the PCRVICS instrumentation and control systems actually installed at Susquehanna. Amend the PCRVICS analyses presented in Section 7.3.2a.2 to agree with the systems discussed in the text and shown in the figures and elementary diagrams.
For the bypasses, fully describe the justify all manual or automatic bypasses associated with any PCRVICS subsystem and include all bypasses in the various Section 7.3.2a.2 analyses. Include a description of how all bypasses are annunciated. Also, review the complete PCRVICS descriptions and analyses given in the FSAR and the figures and elementary diagrams. Verify that these documents accurately describe the systems actually installed at Susquehanna.
FSAR Rev. 65 032.74-2
SSES-FSAR Question Rev. 48
RESPONSE
- 1) Subsection 7.3.1.1a.2.4.1.1.1 has been amended to indicate one set of four level switches is for low level and a second set is for low low level. There is one common and two variable leg pressure taps for each pair of two water levels.
- 2) Subsection 7.3.1.1a.2.4.1.1.1 has been modified to read; "the second (and lower)......isolation valves and other selected isolation valves. Isolation valves and their initiating signals are shown in Table 6.2-12." The Nuclear Boiler FCD and NS4 elementary diagram will be modified to remove drywell pressure as an initiating signal from the RHR isolation valves, except the Radwaste discharge valves and the heat exchanger valves. Drywell pressure as an initiating signal will also be removed as an input to the RWCU valves. In addition, level 3 (low level) isolation will be changed to level 2 (low low level) for all valves except the RHR and TIP. These changes to the PCRVICS initiation signals and set points have no impact on safety. They have been implemented as a plant availability feature i.e. to reduce inadvertent containment isolation during plant transient events. The PCRVICS FCD and elementary diagram has been updated to reflect these changes.
- 3) Main steamline leak detection is discussed in Subsection 7.3.1.1a.2.4.1.12. RCIC high flow and HPCI high flow are discussed in the response to Question 032.55.
- 4) The single failure criterion applies at the system (RPS) or function (ECCS) level and not at the signal input or channel level. The RWCU isolation valves will receive a system isolation signal from the space temperature trip channels and high flow signal described in (5) below if a breach occurs in the RWCU system RCPB and the flow summer failed. Single failure of the summer will not preclude RWCU system isolation.
- 5) G33-NO44A and B provide an RWCU system isolation signal on high flow in the suction line. A revised discussion is contained in Subsection 7.3.1.1a.2.4.1.9.
- 6) Subsection 7.3.1.1a.2.4.1.9.6 has been modified to stated that the RWCU system high differential flow trip is bypassed during RWCU system startup by a time delay.
The time delay will not affect RWCU System RCPB isolation. When the RWCU system is initiated a high differential flow will exist between the inlet and outlet flows and initiate system isolation and prevent RWCU operations. The time delay bypasses the flow signal until the system loop flow is established.
- 7) See revised Subsection 7.3.1.1a.2.4.13.6 FSAR Rev. 65 032.74-3
SSES-FSAR Question Rev. 48
- 8) See revised Subsections 7.3.1.1a.2.5 and 7.3.1.1a.2.11 which use the term "high flow" which is now described per part (5) above.
- 9) The subject signal is a system trip signal, not a containment isolation signal.
See the response to part 4 and see Subsection 7.7.1.8.2.2(1) and 7.7.2.8.1 for coverage of this signal.
- 10) The signal is required for SLCS operation and is not a containment isolation signal. The RWCU System will be manually shutdown, if standby liquid injection is required, to prevent boron loss to the RWCU system. See response to part 4 and see revised Subsection 7.4.1.2.5.1 to cover the need for manual isolation of RWCU.
- 11) Excess flow is discussed under the Leak Detection System, in Subsection 7.6.1a.4.3.5.3. High reactor pressure is discussed under High Pressure/Low Pressure System Interlocks, in Subsection 7.6.1a.3.3.1.
- 12) The text in Subsections 7.3.1.1a.2.4.1.10.6 and 7.3.1.1a.2.4.1.11.6 is referring to operating bypasses, which are the subject of discussion in Subsection 7.3.2a.2.2.3.1.1.2.
The Manual Bypass Switches are shown on the Leak Detection Elementary Diagram for RWCU and RHR. These switches actuate the system in test annunciator. Test and maintenance bypasses are also discussed in Regulatory Guide 1.47 conformance (see Subsection 7.3.2a.2.2.1.5).
- 13) Subsection 7.3.1.1a.2.4.1.2.5 discusses bypasses and states that there are no operational bypasses provided with the Main Steamline High Radiation Monitoring Subsystem. The individual log radiation monitors may be bypassed for maintenance or calibration by the use of test switches on each monitor.
Bypassing one log radiation monitor will not cause an isolation but will cause a single trip system trip to occur.
FSAR Rev. 65 032.74-4
SSES-FSAR QUESTION 032.75 Justify your claim that high drywell pressure provides "diversity of trip initiation for pipe breaks inside primary containment" when high drywell pressure will not close MSIV's, isolate RWCU, or reactor water sample lines. Also, discuss diversity for breaks outside primary containment.
RESPONSE
See revised Subsection 7.3.1.la.2.4.l.l.5.
Rev. 46, 06/93 032.75-1
SSES-FSAR Question Rev. 47 QUESTION 032. 76 Justify locating the MSIV-LCS controfs. instrumentation, and indicators needed for effective operation on back row panels in the control room. Describe the panels and their location with respect to other safety-related instrumentation and controls required for accidents.
RESPONSE
.____ _-_*-*_ _ _ _ _ _ _ _ _ _S_t_a_rt_H_i_st_o_ric_a_J_S_e_c_tio_n______ *. _ --. _ _ _ _ _ ____,/1 The MSIV-LCS controls, instrumentation, and indicators, which are located on the MSIV-LCS panels in the control room do not normally require any operator attention either in the shutdown or the operation mode. When required, operator attention is called to the MSIV-LCS controls by an annunciated trip in the system. For example, an MSIV-LCS trip is annunciated in the control room when main steam line pressure drops to predetermined setpoint. The purpose of the annunciation is to signal the control room operator to start up the MSIV-LCS system. Other MSIV-LCS trips are annunciated to alert the operator to all significant operational 1 and trouble event which require operator action.
There are two MSIV*LCS panels, each located on opposite sides or the main control room floor elevation and situated on back row panels (C644, C645). Both panels are of the single door ,
totally enclosed, upright type. The panels are readily accessible from the console, although no direct lin~ of vision is available to the operator from the console.
FSAR Rev. 59 032.76-1
SSES-FSAR QUESTION 032.77 For the containment spray cooling system, the following inconsistencies and errors were noted between the FSAR description (7.3.1.la.4), the analyses (7.3,2a.4), the function control diagram (FCD) (Figure 7.3-10), and the elementary diagram (791E41BAE):
- 1) The description indicates high drywell pressure is the only permissive required for containment spray cooling manual initiation. The analyses, FCD, and elementary diagram show high drywell pressure QI: reactor low level as the permissive. The FCD and elementary diagram also show LPCI injection valve (F0lSA) closed as another permissive.
- 2) The description indicates "containment spray is interlocked with reactor water level." This interlock was not addressed in the analyses and could not be found in the FCD or elementary diagram.
- 3) The description indicates the "two drywell pressure switches are electrically connected so that no single sensor failure can prevent initiation of containment spray A." This could not be verified in the analyses, FCD, or elementary diagram.
Amend the appropriate document (s) to fully and accurately describe the containment spray cooling instrumentation and control system actually installed at Susquehanna. Amend the analyses presented in Section 7.3.2a.4 to agree with the description. Also review the complete containment spray descriptions, analyses, figures, and elementary diagrams and verify that these documents accurately describe the systems actually installed.
RESPONSE
- 1) See revised Subsection 7.3.l.la.4.4.
- 2) The FSAR text is incorrect and has been revised to delete the last sentence of FSAR Subsection 7.3.l.la.4.6.
- 3) Elementary Diagram 791E418WJ sheet 4 zone B-8, indicates two success paths in each division such that no single sensor failure can prevent initiation of containment spray A.
See also revised Subsections 7.3.2a.4.3.l.6, 7.3.2a.4.3.1.8 and 7.3.1.la.4.12.3.
Rev. 46, 06/93 032.77-1
SSES-FSAR QUESTION 032,78 Discussion of the SGTS, RBRC, HPCI, and RCIC pump rooms unit coolers, and SWGR cooling system indicates the two trains for each system are normally set up in a "lead-lag" fashion and that when the manual control switches for the fans are in the STOP position, this is annunciated on the BIS. What controls are used to ensure the switch for One train is in the LEAD position and the switch for the other train is in the STANDBY position? What are the consequences of having the switches for both trains in either the LEAD or the STANDBY positions when an emergency initiation signal is received and what effect on the safety of the public or the release of radioactivity to the environment would this have?
RESPONSE
The SWGR air handling units are run during both normal and emergency operations. Their handswitches are stop-auto-start and if the running unit were switched from start to auto it would continue to run. The standby unit being already on auto, would remain on standby. The HPCI and RCIC room unit coolers each have a "Stop-Auto-Start" handswitch and are normally on "auto". A separate two position switch in the main control room for each redundant pair assures that one unit (of each pair) is on LEAD at all times.
The redundant RHR pumps each have their own unit cooler which stops and starts with the pump. Each unit cooler is normally in the "Auto" position on its "stop-auto-start" hand switch.
The SGTS room cooling fan units and heating units are normally in the "auto" position on their individual *stop-auto-start" handswi tches. The cooling uni ts start on room temperature high signal and the heating units on a room temperature low signal.
The redundant units of each pair are made lead or lag by the settings of their individual thermostats. If temperature setting were arranged for simultaneous operation of a redundant pair this would have no detrimental effect on equipment in the room.
Hence, as all redundant lagging unite are independently actuated and are designed to replace the leading unit in case of failure, no effects to the safety of the public are expected.
The Reactor Building recirculation fans are normally set with the "A" fan in "auto lead" position and 11 B" fan on "standby".
If the "auto lead" fan fails it will alarm on the local control panel and in the control room and the "standby" fan will start automatically. If both switches are on "auto lead" or if both are on "standby" then both fans will run.
Rev. 46, 06/93 032.78-1
SSES-FSAR QUESTION 032.79 The FSAR section on safety related display instrumentation is incomplete and/or inconsistent as follows:
- 1. The SRDI as identified in 7.5.la.1 and Table ?.5-1 is incomplete in comparison to the instrumentation identified in 7. 5. la. 4. Specifically, two fuel zone water level channels, control rod information, neutron monitors, all pertinent annunciators and valve position indicators, and relief valve discharge pipe temperature monitors are identified as SRDI in 7.5.la.4, but are not included in Table 7.5-1. In addition, Table 7.5-1 does not indicate what SRDI is on the remote shutdown panel, what SRDI provides post-accident monitoring, and what SRDI is supplied Class lE power. In several cases, the discussion indicates that two to four channels of information are displayed on what is identified as a single channel indicator in Table 7.5-1. There is no information listed in Table 7.5-1 for the HPCI turbine steam pressure entry.
- 2. Sections 7.5.la.4 and 7.5.2a.S.1 state, or imply, that "indicators and records 11 will not be qualified for post-seismic performance while ?
- 5. 2a. 5. 5 states that records and indicators are seismically qualified.
- 3. The statements on Regulatory Guide 1. 97 in Sect ions 3. 13 and 7. S. 2a are contradictory or misleading. Section 3.13 states that SRDI was not evaluated against RG 1.97, Rev. i while 7~5.2a states that the SRDI complies with paragraphs C. 2 through C .16 of RG 1. 97 (no revision number is stated and the SRDI does not comply with C.3 of RG 1.97, Rev. 1).
- 4. Table 7.5-3 indicates that records that provide post-accident monitoring history are not provided with Class lE power and Section 7.6.lb states that the records are not safety related. It is the staff's position that records providing PAM history are safety related and must be seismically qualified to be operable following an accident.
S. Table ?.5-3 indicates that only the wide range containment and suppression pool pressures are recorded while Section 7.6.lb states that both the narrow range and wide range pressures are recorded.
- 6. Section 7.5.2b states that cross checking between di visions is the means for checking operability on instrumentation, but does not address how the operable system is determined if the instruments do not compare.
Rev. 46, 06/93 032.79-1
SSES-FSAR This determination could be crucial if a discrepancy occurs during an accident with only two channels of information displayed.
Amend your FSAR to provide a complete and consistent analysis of the safety-related display instrumentation.
Provide a discussion of how the operator will be instructed to resolve discrepancies occurring between two instrument channels during an accident. Revise your design as necessary to assure that all records and indicators used for post-accident monitoring (or history} are qualified to be operable following a seismic event and are powered from Class lE power.
lWSPONSE:
The following modifications to the 7.5 text to correct inaccuracies and deficiencies, and to delete inappropriate discussions are provided:
- 1. The power source for the main steam line flow indicators described in Subsection 7.5.la.4.2.3.1 (2}b. is from an instrument AC source only, not from one of the standby AC buses. The FSAR has been amended accordingly.
The relief valve discharge pipe temperature monitors are powered from an instrument AC source, not from the standby AC buses as described in Item (3)g. The FSAR has been amended accordingly.
Subsection 7.5.la.4.2.3.3 has been revised.
Subsections 7. 5. 2a. 5. 1. 5, 7. 5. 2a. 5. S, and 7. 5. 2a. 5. 6 have been revised. Table 7.5-1 has been modified.
- 2. Answered in 1. above.
- 3. Answered in 1. above.
- 4. Answered in 1. above.
- s. Subsection 7. 6. lb has been revised to provide this information.
- 6. Subsection 7.5.2b.4 has been revised to provide this information.
Rev. 46, 06/93 032.79-2
SSES-FSAR QUESTION 032.80 The description of the refueling interlocks is unacceptable as follows:
- 1. The statements in 7.6.la.l.3.4 and 7.6.la.l.3.6 do not indicate compliance with single failure criteria.
(Single failure criteria require that protection from an accident is still provided with any single failure present, not that a single failure will not cause an accident.)
- 2. Even though refueling operations are the means by which the core reactivity is restored, no mention is made of any interlocks that ensure that the core reactivity is adequately monitored during refueling (nor is there reference to the mechanisms used to ensure refueling with identical or suitable fuel).
Revise your design and/or your analysis to provide compliance with single failure criteria. Justify the exclusion of flux monitoring instruments from the interlocks on the refueling platform and indicate how compliance with GDCs 10, 26, and 27 are maintained and/or re-established following refueling.
RESPONSE
The refueling interlocks are provided as a backup to administrative procedures which by themselves prevent criticality during refueling operations. For this reason, the refueling interlocks are not safety-related and not required to meet single failure criteria. Therefore, to comply with the requirements of Reg. Guide 1.70 Rev. 2 the refueling interlocks discussion has been moved from FSAR Section 7.6 to Section ?.7 (Table 7.6-1 has been moved to Table 7.7-2). Section 7.7 discusses major plant control systems and (as required by the Standard Review Plan} how their failure affects the plants.
- 1. Subsection 7.6.la.l.3.4 has been amended.
- 2. Multiple failures (in extremely reliable equipment) and operator errors are required in order to cause criticality during refueling. The probabilities of this are remote. Core flux activity monitoring is provided during refueling by the SRM's and/or dunking chambers which are specified and controlled by the technical specifications. The mechanism used to ensure refueling with identical and suitable fuel is procedural and administrative. These mechanisms are sufficient in scope and reliability to ensure compliance with GDC 10, 26, and 27.
Rev. 46, 06/93 032.80-1
SSES-FSAR Question Rev. 48 QUESTION 032.81 The description of the high pressure/low pressure interlocks is incomplete and/or inconsistent as follows :
- 1. It is not clear whether the last two sentences of the first paragraph of 7 .6.1 a.3. 3.1 apply to all valves or just to recirculation suction valves.
- 2. The logic shown on Figure 7.3-10 for RHRS does not show close signals originating from reactor pressure intertocks for any RHRS valves (isolation logic is shown. but is not connected to close circuit).
- 3. The discussion indicates two motor-operated injection valves for RHR, but only one is listed in the table.
- 4. The steam ccndensing mode of RHR is included in the tabl&, but is not discussed.
Figure 7.3-10 does not show one of the valves and indicates that the other valve is a pressure regulating valve.
11
- 5. It is stated that the core spray valve must start opening above system design pressure to fulfill the flooding function." The permissive pressure for this valve is the same as for the RHR system.
- 6. It is stated that the recirculation suction valves have independent and diverse interlocks to prevent valve opening with high primary system pressure, but no diversity is identified.
Revise your FSAR as necessary to correctly describe the high pressure/low pressure interlocks.
Include the design basis that justifies a valve permissive pressure that exceeds the "system design pressure," and identify all systems in this category. Identify the "diverse interlocks" claimed for the recirculation valves. {If diversity is provided by utilizing pressure switches from two different manufacturers, identify the diverse principles by which the pressure switches function.}
RESPONSE
- 1. Subsection 7.6.1a.3.3 has been revised.
- 2. Subsections 7.6.1 a.3.3 and 7.6.1 a.3.3.4 have been revised .
Dwg. M1-E11-51, Sh. 1, M1-E11, Sh. 2, M1-E11-51, Sh. 3, M1-E11-51 . Sh . 4 and
- M1 -E11-51, Sh. 5 were modified .
- 3. Subsection 7.6.1a .3.3 has been revised .
4&5. Subsection 7.6.1a.3.3 has been revised.
(Note: The steam condensing mode of RHR has been eliminated since the original response to this question.)
- 6. Diversity is provided by supplying the pressure switches from two different manufacturers as described in Section 7.6.1a.3.3.4. Principles of operation are similar for the diverse pressure switches. Diversity comes from manufacturing techniques, etc.
FSAR Rev. 59 032.81-1
SSES-FSAR QUESTION 032.82 The RCIC flow rate monitoring switches are identified as differential switches (measuring pressure drop across an elbow) in the circuit description and as pressure switches (sensing high flow by low pressure) in the logic description. Section 7.6.la.4 states that there are two channels of (differential) pressure monitoring in each logic, but Figure 7.4-2 only shows one switch in each logic. Revise the appropriate section to provide a correct and consistent description of the RCIC flow rate monitoring circuits. Provide instrument specifications and setpoints.
RESPONSE
Subsections 7.6.la.4.3.3.1, 7.6.la.4.3.3.4.1 and 7.6.la.4.3.3.4.2 have been revised to correct and clarify the discussion.
Rev. 46, 06/93 032.82-1
SSES-FSAR QUESTION 032.83 Where is the instrumentation for the warea drain monitoring system" and "area temperature monitoring system" (mentioned in
- 7. 6. la. 4. 3. 6} for the RWCU discussed? Also, revise 7.6.la.4.3.6.2.2 to properly describe the RWCU flow comparison logic; the use of two trip units connected to the same flow comparator does not constitute one-out-of-two logic.
RESPONSE
The two -methods of RWCU leak detection which provide containment isolation signals are RWCU high differential flow and RWCU area high temperature. Please refer to revised Subsection 7.6.la.4.3.6.1.
Also see revised Subsection 7.6.la.4.3.6.2 and new Subsection 7.6.la.4.3.6.3.
Rev. 46, 06/93 032.83-1
SSES-FSAR QUESTION 032.84 Revise your discussion of safety/relief valve discharge line temperature monitoring to correctly identify the monitoring scheme. If the thermocouples are actually al 1 connected in parallel, provide a discussion of how the open relief valve is identified.
RESPONSE
Subsection 7. 6. la. 4. 3. 7. 2. l has been amended to show the monitoring scheme for the safety/relief valve discharge line temperature.
Positive value position indication monitors are addressed in Subsection 18.1.24.
Rev. 46, 06/93 032.84-1
SSES-FSAR QUESTION 032.85 Clarify your discussion of HPCI system leakage detection as follows:
- 1. The circuit description states that some temperature isolation signals are immediate and some must persist continuously for a fixed time before isolation is initiated. The logic description states that all signals are delayed.
- 2. The logic is said to be one-out-of-two, but it is not clear whether this applies to the ambient and differential temperatures individually or collectively.
- 3. The three identical statements on bypasses and interlocks and the circuit description imply that HPCI isolation cannot be initiated manually, nor initiated from the high flow/low pressure logic, if a nlogic test" is in progress.
- 4. Instrument specifications are not given, nor referenced, for either the flow or temperature channels.
RESPONSE
- 1. The Circuit Description of Subsection 7.6.la.4.3.9.2.1 is correct. See the amendment to Subsection 7.6.la.4.3.9.2.2 (Logic and Sequencing) per the response to part two of this question.
- 2. See revised Subsection 7.6.la.4.3.9.2.2.
- 3. The three FSAR statements are correct. When the bypass/test switch is in the test position for one particular division of logic, that division will not allow initiation of HPCI system isolation either manually or automatically. However, the alternate redundant and independent division of HPCI isolation logic will still function in its normal mode.
- 4. Trip settings will be shown in the Technical Specifications.
Rev. 46, 06/93 032.85-1
SSES-FSAR QUESTION 032,86 The presentations in Sections 7.6.la.5 and 7.6.2a.5 provide a questionable explanation of how the SRMs respond to reactivity changes. This in turn makes the analysis for compliance to design requirements questionable. Revise the FSAR to address the following specific points.
- 1. Justify the claim that the SRMs are designed to meet the single failure criterion in light of your statement that the SRM channels are not redundant.
- 2. Provide documentation to support the contention that one "section" of the core can independently be on a 20-second period (Section 7.6.2.5.1).
- 3. Indicate whether the redundancy/single failure relationship of the SRMs is applicable to the IRMs.
- 4. The APRM response to a full control rod withdrawal is not shown on Figure 7. 6-17 in contradiction of the statement in 7.6.2a.s.
- 5. The parenthetical description contradicts the remainder of the statement in the first paragraph of 7.6.la.6.3.
- 6. The LPRM positions are misidentified in Figure ?.6-15.
Neither Figure 7.6-15 nor 7.6-16 is clear on whether one or both detectors are failed. Also, verify that a factor of two difference in response (as shown on Figures 7.6-15 and 7.6-16) exists between RBM-A and RBM-B. If this difference is real, identify the cause and address the effect it has on the APRM trips.
{Would doing away with the Band/or D inputs improve the APRM response, i.e., cause the APRM signal to increase significantly faster than the average power?)
RESPONSE
- 1. The SRM is not a safety-related subsystem of NMS.
Therefore, it is not required to meet the single failure criterion of IEEE 279~1971, Paragraph 4.2 (See FSAR Subsections 7.6.la.S.1 and 7.6.2a.S.l.2).
Subsection 7.6.la.S.3.l.2 has been revised.
- 2. Chapter 7 is not the proper chapter for a discussion of core performance per core sections or neutron production period of any part of the core. Core performance and neutron production periods are described in Chapter 4. The sensitivity and placement of the SRMS, has been considered in developing the core Rev. 46, 06/93 032.86-1
SSES-FSAR performance and detector placement for the SRMS to monitor that performance. Subsection 7.6.2a.5.1.1 has been revised.
- 3. The IRM is a safety-related subsystem of NMS and has been designed to meet the single failure criterion of IEEE 279-1971, Paragraph 4.2. There is no correlation between SRM and IRM concerning redundancy and applicability of IEEE 279-1971, Paragraph 4.2.
- 4. The second paragraph of Subsection 7. 6. 2a. 5. 4 .1 has been revised. FSAR Table 1.6-1, Referenced Reports, under APED 5706, has been amended, adding Subsection 7.6 . 2a.5 as reference. In addition, Figure 7.6-17 has been deleted.
- 5. See revised Subsection 7.6.la.6.3.
- 6. FSAR Figure 7.6-15 has been amended, changing position 22.23 to 28.29. FSAR Figure 7.6-15 has been changed to Figure 7.7-17.
As stated in the response to Question 032.62, the RBM is a power generation system and not utilized for accident mitigation. The RBM should not be confused with the Rod Block Trip System, including the APRM rod block trip function. RBM has been appropriately moved from Section 7.6 to 7.7. (See response to Question 032.62). .
The end points will vary according to the following parameters:
- 1. Total Rod worth
- 2. Rod worth at a specific elevation along the rod.
- 3. Detector elevation relative to rod position, and
- 4. Since RBM A and RBM B average detectors at different axial heights, the response from RBM B (which averages detectors at B & D locations) is affected slightly more by void formation at top of bundles than RBM A (which averages detectors at A & C locations).
Rev. 46, 06/93 032,86-2
SSES-FSAR QUESTION 032.Q?
Revise your description of the recirculation pump trip or the appropriate sections of the FSAR to resolve the following inconsistencies:
Verify that the sensors and logic are seismically qualified since your analysis merely states that it meets the requirements of a non-existent subsection of IEEE 344 -1971.
- 2. The logic is described as two-out-of-two under "Initiating Circuits,R but is correctly identified, in the "Logic" descriptions, as two-out-of-two for the control valves and one-out-of-two-twice for the stop valves.
- 3. It is stated in the logic paragraph that failure to initiate requires failures in more than two RPS divisions, when obviously failures in A plus C, A plus D, B plus C, or B plus D could prevent initiation for the control valves. (The logic is not sufficiently definitive for the stop valve to determine whether more than two failures would be required.) Similarly, initiation would require two or more channels.
- 4. The logic shown in Figure 7 .2-11 identifies breakers by the numbering scheme used with the two-speed recirculation pumps used in newer (than SSES) BWRs.
What breakers are actually tripped?
- 5. The logic shown in Figure 7.2-1 includes a trip bypass and power level enable {with the enable given in the wrong direction) that are not included in the description or the analysis.
- 6. The recirculation pump FCDs provided in Section 7.7 do not indicate that the RPT is implemented, even though the ATWS trips are shown.
- 7. It is stated that paragraphs 4.11, 4.12, and 4.15 of the IEEE 279-1971 are not applicable to the RPT. It is the staff' e position that all requirements of the standard are applicable and justification must be provided for deviating from any requirement. Each of these positions is addressed in Section 7.2 when the same circuit is analyzed for the RPS.
Rev. 46, 06/93 032.87-1
SSES-FSAR RESPONSE;
- 1. All RPT sensor and logic elements are seismically and environmentally qualified. Subsection 7.6.2a.8.2 has been revised.
2 & 3. A change to the system has been made. The logic for each, Turbine Control Valves and Turbine Stop Valves, is now a two-out-of-two configuration. Subsections 7.6.la.8.3.l, 7.6.la.B.3.2 and all applicable documents will reflect this change by the fourth quarter of 1980.
- 4. The breakers identified (3A, 4A & 3B, 4B} are added specifically for the RPT function and are numbered the 0
same for all plants.
- 5. The RPT logic shown in Figure 7.2-1 will be revised to be consistent with the permissive for reactor power greater than -30% rated. Discussion has been added in Subsections 7.6.la.8.3.2 and 7.6.2a.8.1. The RPS IED will be revised by the end of the fourth quarter of 1980.
- 6. FSAR Section 7.7 text will be amended to reflect the (ATWS} RPT function. This will be accomplished in the fourth quarter of 1980.
- 7. The requirements for conformance to Paragraph 4.11 of IEEE 279-1971 are contained in the first two paragraphs of Subsection 7. 2. 2 .1. 2. 3 .1.11. It should be noted that these limit switches cannot be maintained or calibrated during plant operation because they are mounted directly on the stop valve which is located in a high radiation area. Subsection 7.6.2a.8.2 (IEEE 279 Paragraph 4 .11) has been amended to refer to Subsection 7.2.2.1.2.3.1.11.
The requirements for conformance to Paragraph 4.12 of IEEE 279-1971 are contained in Subsection
- 7. 2. 2 .1. 2 .1. 2. 3 .1.12. FSAR Subsection 7. 6. 2a. 8. 2 ( IEEE 279 Paragraph 4 .12) has been amended to ref er to Subsection 7.2.2.1.2.1.2.3.
Rev. 46, 06/93 032.87-2
SSES-FSAR QUESTION 032.88 No discussions, descriptions, or analyses of HPCI or RCIC manual isolation systems could be found in Sections 7.3, 7.4, or 7.6. A review of Figures 7.3-7 and 7.4-2 and elementary diagrams 791E420AE and 791E421AE revealed several concerns about the HPCI and RCIC manual isolation systems. Justify having a manual initiation that:
- 1) Operates only one of the two isolation valves and, therefore, does not meet the requirement of the single failure criteria or Regulatory Guide 1.62.
- 2) Is interlocked with the system initiation signals such that the manual isolation switch is ineffective unless a system initiation signal is present.
RESPONSE
The correct elementary diagrams for Susquehanna SES-1 are 791E420WJ, Rev. *1 and 791E421AE, Rev. 7.
- 1) The HPCI and RCIC systems do comply with the single failure criteria and Regulatory Guide 1.62. Each is a system which operates within one single mechanical/electrical division. HPCI is a Division 2 system while RCIC is a Division 1 system. Each of these systems meets the single failure criteria on a network basis with ADS and LPCI acting as the independent backup for the HPCI system and HPCI acting as the independent backup of the RCIC system. Alone each of these systems is not required to be single failure proof. The manual initiation and isolation capability of each system does satisfy the requirements of Regulatory Guide 1. 62 by providing the required system level manual initiation function which is identical to the automatic function. In order to provide some increased availability within each system independent division of automatic initiation logic has been provided. Because these systems are single division systems manual initiation capability was not necessary nor provided in the availability logic division for each system. Isolation capability of each system can be provided by the control switch for each isolation valve. This same isolation valve control capability would exist for each system regardless of the presence or absence of availability logic.
Consequently, the operator has at his disposal one system level isolation control switch and one isolation valve control switch for one valve and one isolation valve control switch for the other valve.
Rev. 46, 06/93 032.88-1
SSES-FSAR
- 2) The interlocking of manual isolation with system initiation was provided to obviate the loss of system availability before the system is even required to function. This objective of maintaining the availability of the system against inadvertent isolations is enhanced with the present logic configuration. This configuration is considered to be consistent with the requirements of Regulatory Guide
- 1. 62.
Rev. 46, 06/93 032.88-2
SSES-FSAR QUESTION 032.89 The text indicates that RCIC system will not automatically return from the test to the operating mode on system initiation if the flow controller is in the manual mode. Is this annunciated in the control room as a system inoperable/bypassed indication as recommended by Regulatory Guide 1.47?
RESPONSE
Placing of the flow controller in manual mode occurs at a test frequency of less than once per year. The RCIC inoperable/bypass.e d system level control room annunciator is administratively actuated by the plant operator when such testing occurs, per the provisions of positions C.3 and C.4 of Regulatory Guide 1.47.
Rev. 46, 06/93 032.89-1
SSES-FSAR QUESTION 032.90 Describe the actions required to restart RCIC upon again reaching reactor low water level after RCIC has been tripped due to reactor high water level.
RESPONSE
The RCIC system, once tripped by a reactor vessel high water level, will not automatically restart upon again reaching reactor vessel low water level. The plant operator manually resets the trip and throttle valve. The trip reset is accomplished from the main control room by first closing the turbine trip and throttle valve and then opening it. The system will then restart if vessel water level is below the high level trip point.
An alternate RCIC restart sequence requires the operator to reset the entire RCIC system to the standby condition once the water level is below the high water level trip point. This requires resetting the system valves and logic.
Rev. 46, 06/93 032.90-1
SSES-FSAR QUESTION 032.91 The analysis for Regulatory Guide 1.47, Position C.4, is incomplete since it does not indicate that the individual system level indicators can be actuated manually from the control room by the operators. Describe the provisions incorporated into the Susquehanna design to satisfy Position C.4 of the Regulatory Guide 1.47. (Note: This position is not intended to address the testing of annunciators, but is intended to provide manual initiation of the system level indication of inoperable and bypassed status.}
RESPONSE
FSAR Subsection 7.4.2.1.2 . 7, Position C.4 has been amended.
Rev. 46, 06/93 032.91-1
SSES-FSAR QUESTION 032.92 Section 7.4.1.3.3.1 states that during the initial phase of cooling the reactor, only a portion of the RHR heat exchanger capacity is required. What is the basis for this statement and is it related to the normal operation of the RHR? Also, the second sentence in Section 7.4.1.3.3.2 does not clarify the first sentence of the section. Two redundant shutdown cooling modes are identified earlier, but what are the "two diverse shutdown cooling means" referred to in Section 7.4.1.3.3.5.
RESPONSE
Heat exchanger capacity is conservative for all RHR operating modes. The statement -in Subsection 7.4.1.3.3.1 is based on the fact that for any single shutdown mode of RHR, the respective heat exchanger capacity utilized is far less than the available system-wide heat exchanger capacity of RHR. This statement is related to normal RHR operation insofar as the RHR System affords alternate loops to one or more heat exchangers plus alternate heat exchanger loops to insure accornpl ishing *its functional objectives. It should be noted that though additional heat exchanger capacity is available for another mode of operation, simultaneous operation of modes is possible only if appropriate interlocks are satisfied.
FSAR Subsection 7.4.1.3.3.l has been revised.
There is no explicit justification for the statements contained in Subsection 7.4.1.3.3.2, Initiating Circuits, because the reactor shutdown cooling mode is design-based about a controlled shutdown mode, whereby manual operation is acceptable. Furthermore, because of the reactor conditions that are prerequisite to initiating the shutdown cooling mode, as stated in Subsection 7.4.1.3.1.1, Section a, the use of auto-initiation to precisely time such action is neither critical nor necessary.
FSAR Subsection 7.4.1.3.3.2 has been revised.
The two diverse means of shutdown cooling referred to in Subsection 7.4.1.3.3.5 are: {l) the loop consisting of pumping vessel water to the heat exchanger and back to the vessel with relief valves open to the pool; (2) the loop consisting of pumping suppression pool water to the heat exchanger and back to the vessel with relief valves open to the pool.
FSAR Subsection 7.4.1.3.3.5 has been revised.
Rev. 46, 06/93 032.92-1
SSES-FSAR QUESTION 032.93 A review of the remote shutdown panel description, Drawing E149, and various system drawings indicates several possible concerns.
(1) The remote shutdown panel is a single panel with only the minimum controls and instrumentation required to bring the reactor to cold shutdown status. Other BWR plants (Zimmer and Grand Gulf) have provided separate and independent remote shutdown panels. Justify having a remote shutdown panel that does not meet the single-failure criteria and describe the means used to meet the separations criteria inside the remote shutdown panel.
(2) Transferring control to the remote shutdown panel disables automatic ECCS actuation of both RHR loops.
During this condition, the ECCS is no longer capable of providing cooling for all DBAs. Justify.
{3) When transferring control to the remote shutdown panel, controls for some functions are transferred to maintained contact switches. Describe how the operator determines the proper position of the control switches on the remote shutdown panel before making the transfer. Analyze the effects on plant safety of operating any of the transfer switches with its associated control switches in the incorrect position.
RESPONSE
(1) The remote shutdown panel (RSP) is designed to meet 10CFRS0, Appendix A, Criterion 19.
The design assumes that the Evacuation Occurrence does not occur simultaneously or coincident with recovery from another abnormal condition or with any other abnormal operating condition except loss of offsite power. The plant is assumed to remain in an orderly status during the Evacuation Occurrence. The Susquehanna SES remote shutdown system design philosophy is the same as presented in GESSAR-251 and accepted by NUREG 0151, Docket No. 50* 531, and the same as presented in Hatch 2, FSAR.
The panel is subdivided with a continuous barrier, top to bottom, back to front, to physically separate Division I power from Division I I power.
Rev. 46, 06/93 032.93-1
SSES-FSAR (2) A OBA is not part of the design criteria for the remote shutdown panel (RSP). The RSP is designed to prevent failure of equipment (controls) in the Control Room or the cable spreading rooms from causing failure of equipment on the Remote Shutdown Panel. Since several RHR Loop A valves are closed to prevent unwanted flow paths and RHR Loop B valves are used for shutdown from the RSP, then the controls for these valves are isolated from the control room to preclude spurious actuations. This includes the automatic ECCS actuation for these valves, which is in the control room panels.
Please also refer to the assumed prevailing condition stated in part (1) above.
(3) The operator follows the Susquehanna SES Remote Shutdown Panel C201 normal status procedure, OP-00-001, to transfer control to the RSP or return the RSP switches to-standby status.
Rev. 46, 06/93 032.93-2
SSES-FSAR QUESTION 032.94 A review of the RHR Drawing El53 indicates an interlock between Unit 1 and 2 such that when an RHR pump is operating in one unit, the corresponding RHR pump in the other unit cannot be started. This interlock is in addition to the one questioned in Question SSES 24. This interlock is not mentioned or described in the FSAR text and also appears to be a violation of GDC-5.
Amend the FSAR and/or drawing to fully describe the interlocks between the RHR systems in Units 1 and 2. Provide a detailed analysis to justify having such an interlock that will prevent the safe and orderly shutdown and cooldown of one unit (by preventing RHR operation) while the RHR system in the other unit is operating. Include this interlock in your discussion and analysis of compliance with GDC-5.
RESPONSE
The interlocks described in Question 032. 73 and 032. 94 are intended to be the eame. The fol lowing drawings wi 11 be revised in the first quarter of 1981 to show AE's implementation of the GE interlock discussed in 32.73:
E-153-2 E-153-4 E-153-6 E-153-8 E-153-47 E-153-49 E-153-51 E-153-53 Rev. 46, 06/93 032.94-1
SSES-FSAR QUESTION 032.95 The FSAR text states in Section 7.4.1.2.3.3 that when the SLCS is initiated, !2Q.t.h explosive valves fire and also states in Section 7.4.1.2.3.6 that when the SLCS is initiated, one of the two explosive valves is fired. Amend the FSAR to resolve this discrepancy.
RESPONSE
FSAR Subsection 7.4.1.2.3.6 has been revised to correctly state that both valves are fired when SLCS is initiated.
Rev. 46, 06/93 032.95-1
SSES-FSAR Q_UESTION 032, 96 The FSAR states the remote shutdown panel transfer switches will generate a signal to actuate valves in a direction that will isolate piping that could bypass significant volumes of water away from systems required for remote shutdown. The valves that are actuated to the "safe-condition" are listed in Table 7.4-3, but Table 7.4-3 does not indicate which condition
{either open or closed) is the "safe-condition" for all such valves. Amend Table 7.4-3 to include which condition is the "safe-condition" for all valves so actuated when the transfer switches are operated.
RESPONSE
Table 7.4-3 has been revised to include this information.
Rev. 46, 06/93 032.96-l
SSES-FSAR QUESTION 032,97 Apparent inconsistencies and omissions were noted in the analysis for compliance with the following criteria. Amend the FSAR as required.
A. RCIC
- 1) Regulatory Guide 1. 6. Justify your statement that because the single failure criteria are not applicable, RG-1.6 is not applicable to RCIC.
- 2) General Design Criteria 21. The analysis addresses testability but does not address reliability.
- 3) General Design Criteria 29. The analysis merely states the function of RCIC; it does not address the probability of the system functioning when needed.
- 4) General Design Criteria 34. The analysis consists of a reference to a non-existent subsection.
- 5) IEEE 279. The discussion presented under paragraph 4.12 is pertinent to paragraph 4.13 and is unrelated to paragraph 4.12. The discussion should be modified as needed and relocated to paragraph 4 .13. It appears that there are no operating bypasses as defined in IEEE 279 associated with RCIC.
B. SLCS
- 1) General Design Criteria 20 and IEEE 279, paragraph 4 .1.
The analysis describes instrumentation that is not a part of the SLCS. Justify the non-compliance of the SLCS with the automatic actuation requirement.
- 2) General Design Criteria 28. No analysis for GDC-28 is given. Does the SLCS meet GDC-28, assuming that the maximum amount of the SLCS piping that could contain cold water does so at the time the system is activated with the reactor at full power?
- 3) IEEE 279, paragraphs 4.8 and 4.9. the analysis presented described instruments that are neither system inputs nor system input sensors.
RESPQNSE:
A. RCIC
- 1)
- Regulatory Guide 1. 6 is concerned with independence between redundant standby power sources. RCIC does not have redundant power sources. It should be noted that two divisions of 125VDC power are used to power inboard and outboard isolation valves that are defined as RCIC system valves. These power supplies meet Regulatory Position 3 of Regulatory Guide 1.6. FSAR Subsection 7.4.2.1.2.1.l has been revised.
Rev. 46, 06/93 032.97-1
SSES-FSAR 2&3) RCIC is periodically tested to ensure operational readiness as part of the reliability and probability of proper functioning. Additional reliability and probability of operation are provided through the use of high functional reliability components and intersystem redundancy. FSAR Subsections 7. 4. 2 .1. 2 . 2. 3 and 7.4.2.1.2.2.5 have been revised.
- 4) Section 7.4.2.1.2.2.6 refers to Section 7.4.1.1.1.1. (3) which does exist in the present text. No change is required.
- 5) FSAR Subsections 7.4.2.1.2.3.1.12 and 7.4.2.1.2.3.1.13 have been revised.
B. SLCS
- 1) Subsections 7. 4. 2. 2. 2. 2. 2 and 7. 4. 2. 2. 2. 3. l.1 have been revised.
The SLCS is not required to comply with the automatic initiation requirements of GDC 20 and IEEE 279, paragraph 4. 1. The SLCS is a backup method of manually shutting down the reactor to cold subcritical conditions by independent means other than by the normal method through the control rod drive system.
Refer to Subsections 7.4.1.2.1.1, 7.4.1.2.1.2 and 7.4.1.2.3.5 for further clarification.
- 2) Subsection 7,4.2.2.2.2.6 has been revised. The text material formerly found in Subsection 7. 4. 2. 2. 2. 2. 6 has been renumbered 7. 4. 2. 2. 2. 7. The maximum amount of cold water that can be contained in the piping between the SLCS sodium pentaborate tank and the reactor vessel is less than 20 gallons. The SLCS piping enters through the bottom of the vessel; therefore, the initial injection of cold water contained in the SLCS piping is insignificant when mixed with the existing reactor coolant. The negative reactivity added to the reactor system by the sodium pentaborate solution counteracts by a very large margin the effect of the initial cold water injection.
- 3) It is correct that the display instruments described in 7.4.2.2.3.l.8 do not directly provide system-inputs or .
system sensors to the SLCS. However, these instruments display to the operator the status of functions of other systems upon which the operator decides whether or not to manually initiate the SLCS. Therefore, to the extent feasible and practical, system inputs to the SLCS are derived from the operator, based on his judgment from observing displays which are direct measures of desired variables. The SLCS, as an independent system governed by intent and design definition described elsewhere, of necessity requires a man/machine interface as described above. It is in Rev. 46, 06/93 032.97-2
SSES-FSAR this sense also, that the annunciated status of sodium pentaborate tank temperature, level, discharge pressure, and explosive valves control circuit continuity, does in fact provide a means for checking, with a high degree of confidence, the operational status of the SLCS system.
Subsections ?.4.2.2.2.3.1.8 and 7.4.2.2.2.3.1.9 have been revised.
Rev. 46, 06/93 032.97-3
SSES-FSAR QUESTION 032.98 The notes to Table 7 .1-2 indicate in several places that Susquehanna has four sets of axial taps on the reactor pressure vessel for water level and vessel pressure sensors and, also indicate that the instrument racks have been located in four distinct quadrants of the plant with the RPS equipment separated from the ECCS and isolation equipment. Figure S.l-3b, "P&ID Nuclear Boiler Vessel Instrumentation," shows only two sets of axial taps and also shows the RPS and ECCS sharing various sensors. Various other material in Section 7.0 gives conflicting information as to the number of sets of axial taps on the Susquehanna pressure vessel and to the number and arrangement of RPS and ESF sensors. (See also Q032 .44, 0032.45, Q032.69, and 0032.74.) These inconsistencies make it difficult to complete the review. Review Sections 5.0, 6.0, and 7.0 and amend the FSAR as necessary to give a clear and consistent description of the pressure vessel axial taps and the number and arrangement of RPS and ESF sensors.
RESPONSE
Susquehanna 1 and 2 do not have four sets of axial RPV taps, only two. Instrument racks are not located in four distinct quadrants and RPS, NS 4 , and ECCS sensors are not separated.
Table 7.1-2 has been revised.
Rev . 4 6 , o6 / 9 3 032.98-1
SSES-FSAR QUESTION 032.99 Several inconsistencies and anomalies were noted in the review of the various RHRS drawings:
- 1) Figure 5 .4-2a shows four differential pressure switches measuring the difference in pressure between the risers for System A and System B. These switches are not shown P&ID (Ml43) , are not included in Table ? . 3-3, and are not discussed in Section 7; however, F7.3-l0 and drawing Ell-1040 indicate they are used in the control logic of valves Ell-F015 and Ell-F017.
- 2) Figure 7.3-10 appears to indicate that if the recirculating pumps are not operating at the time of LPCI initiation, they will be given a superfluous trip and an additional reactor pressure permissive interlock will have to be satisfied. If the recirculation pumps are running,* the trip circuit and the interlock are both bypassed.
- 3) Figure 7. 3-10 shows a number of signal seal-ins with no indication that there is any method for resetting them. In addition, redundant seal-ins are shown following the recirculation pump running/not running logic.
Revise the FSAR as necessary to correctly describe the RHRS and its interlocks and logic, and verify that the FSAR and the drawings describe the instrumentation and controls that are actually being installed at your facility. All FCDs should be reviewed to ensure that all seal-ins are shown correctly.
RESPONSE
- 1) The recirculation system riser differential pressure switches no longer provide input to Ell-F0lS and Ell-F017 valve control logics. The RHR System FCD has been corrected.
- 2) Figure 7.3-10 has been corrected.
- 3) Figure 7.3-10 has been corrected.
Rev. 46, 06/93 032.99-1
SSES-FSAR QUESTION 032.100 Section 7. 7 ~ 1.1 states that the upset water level and the narrow water level range are indicated by recorders in the control room (the wide water level range is described, but the type and location of readout is not stated), and that reactor pressure is indicated on gauges in the containment. Section 7.7.1.4 states that the narrow water level range and the wide water level range are continually recorded in the main control room, and the reactor pressure and upset water level range are nindicated in the main control room." Revise the FSAR to clarify the number of channels and the type of indication provided in the control room for monitoring reactor pressure and water level. Also, identify whether these indications are from the same transmitters that provide safety-related displays in Section 7.5.
RESPONSE
Subsection 7.7.1.1.3.1.2 and 7.7.1.1.5.2 (Item 4) have been revised. The recorders discussed in Subsection 7. 7 .1. 1 and 7.7.1.4 are the same recorders described in Section 7.5.
Rev. 46, 06/93 032.100-1
SSES-FSAR QUESTION 032,101 Revise the FSAR to resolve the following discrepancies:
l) Section 7.7.l.2 states that the withdraw and settle commands are applied simultaneously to withdraw a rod and the withdraw command is dropped to enter the settle cycle.
Figure 7.7-2 indicates that only the withdraw command is active during withdrawal.
- 2) Section 7.7.l.2 states in one paragraph that drive commands are transmitted to the selected rod every milli-second and in the next paragraph (and in Figure 7.7-5) states commands are transmitted every 0.2 milliseconds. Figure 7.7-2 indicates that commands are alternated with status monitoring of non-selected rods and that after monitoring the status of all rods, approximately 45 milliseconds, the RMC goes into the self-test loop long enough to test one rod (approximately 60-500 msec based on self-test loop duration). For 185 rods, the 45 millisecond for the monitor loop is a little long for a 0.2 millisecond action loop (37 msec corresponds to the 0.2 msec action loop) and too short for the l millisecond action loop. Correct the logic shown in Figure 7.7-5 if it is incorrect; otherwise, explain what happens within the HCU during the 60-500 millisecond the RMC is in the self-test loop.
RESPONSE
- 1) The statement in Subsection 7.7.1.2 is correct. During the withdrawal cycle, the settle command and the withdrawal command are applied simultaneously at the end of the withdrawal period {approximately O.1 sec) . This is shown on sheet l of Figure 7. 7-2, Table I. The references in Subsection 7.7.1.2.3.2.l.3 *withdraw Cycle" to a *settle Valve" are correct. The settle valve is so-called because it is held open after all other rod drive directional control valves have been shut, allowing water in the volume under the CRD drive piston to be vented into the exhaust header, thereby allowing the control rod to settle until the collet fingers latch into the next notch on the index tube.
The rod drive directional control valves are traditionally named as follows:
Rev. 46, 06/93 032.101-l
SSES-FSAR FUNCTION Valve No.
Insert Withdrew Settle 120 X X 121 X 122 X 123 X Name Insert Valves Withdrew Valves Settle Valves Note that the 120 "settle" valve also plays a role in withdrawing a rod~ so that replacing "settle valve" with "settle function" may .not always be accurate. The words "settle function" do not indicate as clearly as the words "settle valve" whether or not the 120 valve is the ~
valve in action.
- 2) The *each millisecond" described in paragraph 2 of FSAR Subsection 7.7.1.2,3.2.1.l defines the periodicity of the generated signal, whereas ".0002 seconds" in the next paragraph defines the duration of the signal. See Subsection 7. 7 .1. 2. 3. 2 .'1 .1 for a clarification change.
Rev. 46, 06/93 032.101-2
SSES-FSAR QUESTION 032.102 In Section 7.?.1.4, it is stated that "In event of loss of feedwater, the reactor protection system will cause plant shutdown, thus preventing any further lowering of vessel water level." Identify the interlock in the feedwater system that causes "plant shutdown" instantaneously following the loss of feedwater and discuss the mechanism that prevents a continuing decrease in vessel water purely as a result of the plant being shut down.
RESPONSE
FSAR Subsection ?.7.1.4 was stated incorrectly and has been revised.
Rev. 46, 06/93 032.102-1
SSES-FSAR QUESTION 032,103 The response to 0032.16(4} is not acceptable. Specifically, Section 7.3.1.la.S.6 states that the suppression pool cooling mode is interlocked with reactor water level and drywell pressure functions. No further description, information, or analysis of this interlock is provided. Also, no analyses for conformance to the regulatory criteria are given in Section '7.3.2.
Amend the FSAR to provide a complete description of the suppression pool cooling mode interlocks and to provide analyses for conformance to the regulatory criteria in Section 7.3.2. Also, the inconsistencies and errors raised in Q032.?7 for the containment spray cooling system appear to be applicable to the suppression pool cooling system.
RESPONSE
A. FSAR Subsection 7.3.1.la.5.6 has been modified to identify the interlock which deals with LPCI mode selection. If additional description of the LPCI interlock is desired see Subsection 7.3.1.la.l.6.5. Subsection 7.3.1.la.l.6.7 has been modified showing the ten-minute period after initiation of LPCI during which an open signal is present on the heat exchanger bypass valves.
B. FSAR Section 7.3.2a.5 has been added to provide the required analysis section for suppression pool cooling mode.
No addition text changes in the discussion or analysis are required due to the concerns identified in Question 32.77.
Rev. 46, 06/93 032.103-1