ML17308A071

Auxiliary Feedwater Sys Automatic Initiation & Flow Indication, (F-16,F-17),technical Evaluation Rept

ML17308A071
Person / Time
Site:	Ginna
Issue date:	07/23/1982
From:	VOSBURY F W FRANKLIN INSTITUTE
To:	KENDALL R NRC
Shared Package
ML17256B208	List: ML17308A071
References
CON-NRC-03-79-118, CON-NRC-3-79-118 TER-C5257-287, NUDOCS 8207270149
Download: ML17308A071 (65)

Text

~~~a~/*4~TECHN)CAL EYALUATION REPORT AUXILIARY FEEDWATER SYSTEM AUTOMATIC INITIATIO.N AND FLOW INDICATION (F-j.6, F-l7)ROCHESTER GAS AIIID ELECTRIC CORPORATION ROBERT E.GINNA NUCLEAR POHER PLANT-NRC DOCKET NO.50-244 NRCTACNO.11706 NRC CONTRACT NO.NRC43-79-11S FRC PROJECT C5257 H FRC ASSIGNMENT 9 FRC TASK 287 Prepared by Franklin Research Center 20th and Race Street Philadelphia, PA 19103 Author: F.W.Vosbury FRCGroup Leader: K.S.Pertaer Prepared foi nuclear Regulatory Commission Washington, D.C.20555 I'ead NRC Engineer: R.Kendall M.Wigdor July 23, 1982 This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government no'r any agency thereof, or any of their i employees, makes any warranty, expressed or Implied, or assumes any legal llablllty or responslblllty for any third party's use, or the results of such use, of any Information, appa-ratus, product or process disclosed ln this report, or represents that Its use by such third'arty would not Infringe privately owned rights.Reviewed by: Approved by: Group Leader Pro'nager Depart ntDir ctor'(~(~(yafoPR J,'ranklin Research Center A Division of The Frankiin institUte The Benjamin Franklin Parkway, Phila., Pa.19103 (215)448.1000 l l TERM5257-287 Section Title P'acae INTRODUCTION

• ~~~'~~~~~~~~1 1.1 Purpose of Review 1.2 Generic Issue Background 1.3.Plant-Specific

Background

l.1~2 REVIEH CRITERIA~~'~~~'e~~~~3 TECHNICAL EVALUATION

~3.1 General Description of Auxiliary Feedwater System 3.2 Automatic Initiation.

3.2.1 Evaluation'.

,3.2.2

Conclusion:

5 5 6 6 8 , 3.3 Flow Indication

.9 3 3.1 3-3:2 Evaluation,'onclusion:.

3e4 Description of Steam Generator i e CON CLUS IONS~~~'~~~~~~~~Level Indication

.~~~9~10 10~'12 5 RFZEHNCES~~~~,~~~~~~~~~~13~IÃFran}din Research Center A~on Q The Fnvklin Intoaac TERM5257-287 This Technical Evaluation Report was prepared by Pranklin Research Center under a contract with the U.S.Nuclear Regulatory Commission (Office of Nuclear Reactor Regulation, Division of Operating Reactors)for technical.assistance in support of NRC operating reactor licensing actions.The technical evaluation was conducted in accordance with criteria establjshed by the NBC.'"'r.P.W.Vosbury contributed to the technical'preparation of this report.through a subcontract with HESTEC Services, Inc.b Jv Frankiin Research Center I(("I,

'1 TER~257-287 1 o INTRODUCTION 1 1 PURPOSE OP REVIEW:The purpose of this review is to provide a technical evaluation of the emergency feedwater system design to verify that safety~rade automatic initiation circuitry and flow indication are provided at the Robert E.Ginna Nuclear Power'Plant Although not in the scope of this review, the steam generator level indication available at the Ginna plant is described to assist subsequent NRC staff.review.1 2 GENERIC ISSUE BACKGROUND A post-accident design review by the Nuclear Regulatory Commission (NBC).after the March 28<1979 incident at Three Mile Island (TMI)Unit 2 estab-lished that the auxiliary feedwater (APH)system should be treated as a safety system in a pressurized water reactor (PWR)plant.The designs of safety systems in a nuclear power plant are required to meet general design.criteria (GDC)specified in Appendix A of 10CPR50[1].The relevant design criteria for the APW system design are GDC 13, GDC 20, and GDC 34.GDC 13 sets forth the requirement for instrumentation to monitor variables and systems (over their anticipated ranges of operation) that can affect reactor safety GDC 20 requires that a protection system be designed to initiate automatically in order to assure that acceptable fuel design limits are not exceeded as a result of anticipated operational 4 occurrences.

GDC 34 requires that the safety function of the designed system, that is, the residual heat removal by the APW,system, be accomplished even in the case of a single failure.On September 13, 1979, the NRC issued a letter[2]to each PWR licensee that defined a set of short-term control~rade requirements for the~system,.specified.

in NUREG-0578

[3].Zt required that the AM system have automatic initiation and single failure-proof design consistent with the , requirements of GDC 20 and GDC 34.In addition, it required~flow/indication in the control room in accordance.

with GDC 13.'I I!L!L~Frenkiin Research Center TER~257-287 During the week of September 24, 1979, seminars vere held in four regions of.the country to discuss the short-term requirements.

On October 30, 1979/,another letter vas issued-to each PWR licensee providing addit'ional clarifica-tion of the NRC staff short-term requirements vithout altering their intent[4].II Post-TMI analyses of primary system response to feedwater transients arid reliability of installed AFW systems also established that, in the long term, the AFW system should be upgraded in accordance vith safety-grade requirements.

These long-term requirements were clarified in the letter of September 5, 1980[5]and formalized in the letter of October 31, 1980[6].The October-31='etter.

incorporated in one document, NUREG-0737 f7]<all TMI-related items approved.by the commission for implementation Section II.E.1.2 of NUREG-0737 clarifies the requirements for the AFW system automatic initiation and flov indication.

l.3 PLANT-SPECIFIC BACKGROUND The Licensee of the Robert E Ginna Nuclear Power Plant<Rochester Gas and Electric Corporation (RG6E)<provided its response to Reference 3 on October 17, 1979 f8].In this response RG&E indicated that the Ginna plant was equipped with a safety~rade<

automatically initiated 2QW system, and that the existing flow indication for each generator complied with the requirements for a control-grade system.RG&E agreed to upgrade the AFW flow indication by January 1, 1981.Additional correspondence

[9-13]was exchanged between RGaE and the NRC regarding the AFW system, the implementation of NUREG-0578, and the subsequent clarification.

issued by the NRC On December 30, 1980[14]<RG&E provided its response to NUREG-0737 and included the design criteria to'upgrade the AFW flov indication to safety~rade.

On August 19, 1981[15]<the NRC sent a request for additional information to aid in the completion of this report.RGRE responded with the additional requested information on September 22, 1981[13]u~J Fr'anklin.Research Center iiIi i TER~257-.28 7~2~REVZEH CRITERIA To improve the reliability of the AHf system, the NRC required licensees to upgrade.the system, where necessary<

to ensure timely automatic initiation when required.The system upgrade was to proceed in two phases.In the short term, as a minimum, control-grade signals and circuits were to be used to auto-matically initiate the APW system.Control~rade systems were to meet the following requirements of NUBEG&578<

Section 2.1.7.a[3]: The design shall provide for the automatic initiation of" the auxiliary feedwater system.2~The automatic initiation signals and circuits shall be designed so that a single failure will not result in the loss of auxiliary feedwater system function.3~Testability of the initiating signals and circuits shall be a feature of the design..4.The initiating signals and circuits shall be powered from the emergency buses.5.Manual capability to initiate the auxiliary feedwater sys-tem from the control room shall be retained and shall be implemented so that a single failure in the manual circuits will not'esult in the loss of system function.6." The ac motor-driven pumps and valves in the auxiliary feed-vater system shall be included in the automatic actuation (simultaneous and/or sequential) of the loads to the emer-gency buses.7 0 The automatic initiating signals and circuits shall be designed so that their failure will not result in the loss of manual capability to initiate the APH system from the control room." In the long term, these signals and circuits were to be upgraded in accor>>dance with safety-grade requirements.

Specifically, in addition to the above 1 requirements, the automatic initiation signals and circuits were to have independent channels<use environmentally qualified components, have system bypassed/inoperable status features, and conform to control system interaction criteria, as stipulated in IEEE Std 279-1971[17].'I 4 llllll Franklin Research Center TER~257<<287 The capability to ascertain the APW system performance from the control room must also be provided.In the short term<steam generator level ,indication and flow measurement were to be used to assist the bperator in maintaining the required steam generator level during AB/system operation.

This system was to meet the following requirements from NUREG-0578, Section.2.1.7.b[3), as clarified by NUREG-0737,Section II.E.1.2[7]: "1.Safety~rade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room.2.The auxiliary feedwater flow instrument channels shall-be powered from.the emergency buses consistent with satisfying the emergency power diversity requirements of the auxiliary feedwater system set cnorth in Auxiliary Systems Branch Technical Position 10-1 of the Standard Review Plan, Section 10.4.9[18}.": The NRC staff has determined that<in the long term, the overall flowrate indication system for Combustion Engineering and Westinghouse, plants should include at least one AFH flowrate indicator and one vide-range steam generator'.level.indicator for each"steam generator or two flowrate indicators.

These flow indication systems should be environmentally qualified; powered from a highly reliable, battery backed<non~lass lE power source;periodically I testableg part of the plant's quality assurance program;and capable of display on demand.The operator relies on steam generator level instrumentation, in addition to.APH flow indicatiori<

to determine APH system performance.

The requirements for this steam generator level instrumentation are specified in Regulatory

~Guide 1.97, Revision 2,"Instrumentation for LightWater-Cooled Nuclear Power 1l Plants.to Assess Plant and Environs Conditions During and Following an Accident"[19].~JIIIIJ Franklin Research Center'is TER~257-28 7 3~TECHNICAL EVALUATION 3.1 GENERAL DESCRIPTION OF AUXILIARY PEEDWATER SYSTEM The Ginna plant is a Westinghouse&esigned, two-3.oop nuclear power plant.The APW system consists of a main APW system and a standby APW system.The main AFW system consists.of two motorMriven pumps (200 gpm each)and one turbineMziven pump (400 gpm).Normally<each motor-driven pump supplies one steam generator<

but the alignment can be altered to allow either motor-driven pump to supply both steam'generators.

The turbine&riven pump normally supplies feedwatez to both steam generators.

Each pump supplies'the steam generators through a normally closed, motor-operated, discharge valve.Only the flow from one motorMriven pump (200 gpm)is necessary to prevent the reactor coolant system from reaching the pressure required to actuate a relief bivalve.The three main APW pumps are located in the same room and could be rendered inoperable as a result of a high energy line break.The standby APW system was installed to provide independent APW system capability following such an event The standby APW system consists of two motor-driven pumps (200 gpm each)located in a plant area separate from'the main APW system.The standby APW system is manually actuated and aligned so that each puinp supplies one steam generator.

The water sources for the main APW system are two 30,000-gallon condensate storage tanks (non-seismic), a 100<000~allon condensate storage tank (non-seismic)

>and the service water system (seismic Category I)~The water..source for the standby ABC system is the service water system, which draws,its water from Lake Ontario.Steam generator level is controlled manually from the control room by adjusting the position of the main APW pump motormperated discharge valves.k (I!ld Franklin Research Center TERM5257-287 3 2 AUTOMATIC INITIATION

3.2.1 Evaluation

'The main APH system at the Ginna plant is designed as an engineered safe-guards system to seismic Category I (with the exception of the condensate storage tanks), Class 1E, and the automatic initiation signals and circuits are designed to comply with the requirements of ZEEE Std 279-1971[17].'he Ginna plant main APH automatic initiation system consists of two independent actuation trains.The actuation circuits are powered from emergency dc buses., The redundant channels are physically separated and'E electrically independent.

A review of the automatic initiation

'circuitry revealed no credible single failure that would inhibit the automatic.'nit'iation system from providing APW flow to at least one good steam generator.

The scope of the single-failure analysis in this report was limited to the redundancy of power supplies<diversity of actuating signals<'and'independence and redundancy of automatic initiation circuits.Both the main and standby APW motor-driven pumps are powered by independent ac emergency buses.The loading of the main APH motorMriven

'pumps onto their respective 480-Vac emergency buses is part of the post-accident, au'tomatic load sequencing.

The standby APW motorMriven pumps are interlocked with the main APH motor-driven pumps so that both are not simultaneously loaded'onto the emergency bus to prevent overloading during loss of.offsite power.The turbine-driven pump'receives its steam through a motor-operated steam admiss'ion valve in each of two lines that tap off upstream of the steam generator isolation valves.The following signals are used for automatic iriitiation of the main APW system: Motor-driven Pum s o low-low steam generator..level (2 out of 3 channels on either@team generator) o trip of both main feedwater pumps o safety injection.

~I~" Frankiin'Research Center T~5257-287 TurbineMriven o low-low steam generator'level (2 out of 3 channels on both steam generators) o loss of voltage on both 4>>kV buses The main APW system may be manually initiated from the control room by starting the motor-driven APW pumps individually; upon pump start, the associated discharge valve opens.The main APW motor~iven pumps discharge valves open fully on pump start.and then throttle down to limit flow to a maximum of 230 gpm to each steam generator The'automatic throttling conserves auxiliary feedwater and helps.Limit the cooldown rate%e turbine&riven pump discharge valve is normally open;in addition<when the turbinMriven pump is automatically initiated (steam admission valves open)<the discharge valve receives an automatic actuation signal to ensure that it is fully open.The main and standby APW system and components are tested in accordance wi.th technical specifications.

Operation of the APW pumps and motor-operated valves is checked monthly.Evexy 18 months each main APW pump and main APW motor-operated valve is verified to operate correctly on receipt of each of the automatic initiation signals.Me automatic initiati'on logic is tested monthly.The system design allows one channel to be bypassed for maintenancef

~testing, and calibration during power operation without initiating a protective action.Nhen a channel is bypassed for testing, the bypass is accompanied by'a single channel alert and channel status light actuation in the control room.The automatic start of the main APW motorMriven pumps resulting from the r tripping of both main feedwater pumps may be defeated during startup or shutdown when the turbine generator is off the line.The defeat switch is automatically bypassed when the turbine is latched.This bypass is alarmed in the control xoom.The only interaction between the main APH system automatic initiation circuits and normal system control functions occurs in the narrow-range steam generator level instrumentation.:

These level instruments are used for both-.I~, I$/s.~L~""Franklin Research Center TERM5257-287 protection (reactor trip and main AFH initiation) and normal control functions (narrow-range channel I only)in the main feedwater system.The control signals are separated from the protection signals by isolation'ransformers so that.a malfunction in the control circuits will have no effect on the.protection signals.The following individual alarms are provided on the main control board to alert the operator that the main AFW equipment may not operate properly: o low-low steam generator level (3 channels each)o 2 out of 3 low-low steam generator levels (1 channel each)I o 3 out of 3 low-low steam generator'evels (1 channel each)o emergency shutdown equipment local control o safeguards breaker trip o safeguards equipment lockmff o main APH bypass in defeat lockout.o single channel alert o standby APH pump C or D trip o standby APW pump transfer switch off normal (1 channel each)'o standby AFH pump high'discharge flow (1 channel each)o standby APH pump high discharge pressure (1 channel each)o standby AFH HVAC trouble.No alarms are provided to monitor the power available to the steam admission valves or APH discharge.

valves.A review of.the automatic and manual initiation circuitry and signals revealed that no single failure of either circuit train would inhibit the capability for manual initiation from the control room or the auxiliary shutdown panel.The environmental qualification of.safety-related electrical and mechanical components, including AFW system circuits and components,'s being reviewed separately by the HRC and is not within the scope of this.review.3.2.2 Conclusion The initiation signals, logic, and associated circuitry of the automatic initiation feature of the main AFH system of the Ginna plant comply with the IJ~JLL'renklin Research Center

TERW5257-287.long-term safety~rade requirements of NORE~578, Section 2.1.7.a, and the subseeluent clarification issued by the NR staff..Zn addition, the following point may effect the reliability of the APH system: o No alarms admission are provided to monitor the power available to the steam valves or APH discharge valves.3.3 PLOW ZNDZCATZON

.3.3.1 Evaluation The capability to evaluate the performance of the main and standby APH systems at the Ginna plant is provided by the following indications:

o, main APH motorMriven pump flow to each steam generator (2 channels each)o main APW turbineMriven pump discharge flow (2 channels)o main APH turbine-driven pump flow to each steam generator (2 channels each)o standby APW motor-driven pump flow (1 channel each)o main APW pump discharge pressure o standby APH pump discharge pressure t~t o, narrow-range steam generator level (3 channels each)o" wide-range steam generator level (1 channel each)o main and standby AZW'ump status indication o main and standby APH,valve position indication o condensate storage tank level (2 channels).

The Licensee has stated that the main APH flow indication for each steam generator is safety-grade.

The individual steam generator APH flow circuitry is powered from separate battery-backed instrument buses.Por each main APW pump, there is a primary and secondary flow instrumentation channel.The.primary channel indicates flow and,'for the motor-driven pumps, controls the individual discharge valves.The secondary flow instrumentation indicates flow only.The primary and secondary channels are powered from opposite instrument buses.The primary and secondary flow indication is provided on the main control board by a dual-movement vertical-scale indicator.)I)Franklin Res'earch Center TERM5257-287 Since the discharge header from the turbineMriven pump/ranches to supply both steam generatois, an additional channel'of safety~rade flow instrumenta-tion is provided in each line.Safety~rade wide-range steam generator level indication is provided as a backup.The standby APH system provides a single..channel of safety-guide flow instrumentation for each pump.The flow indication channels are tested in accordance with technical specificatiohs.

The environmental qualification of the APH flow indicators will M.'I reviewed separately by the NRC and is not within the scope of this review.3~3.2 Conclusion It is concluded that the APH flow instrumentation at the Ginna plant complies with the long-term safety~rade recyirements of.NUREG-0578<

Section 2.1.7.b, and the subsequent clarification issued by the NRC.3~4 DESCRIPTION OP~STEAM GENERATOR LEVEL INDICATION Steam generator level indication at the Ginna pl'ant consists of three safety-grade narrow-range level channels and one safety~rade wide-range level.~channel per steam generator.

The level transmitters and their power supplies*are as follows: P STEAM GENERATOR A Channel Transmitter Vital Bus Hide Range Narrow Range I Narrow Range II Narrow Range III=LT-460 LT-461 LT-462 LT-463 A A C D STEAM GENERATOR B Channel Transmitter Vital Bus Hide Range Narrow Range I Narrow Range II Narrow Range III LT-470 LT-471 LT-472 LT-473 B D A B k'".'Ll Franklin Research Center TERW5257-287 The steam generator level channels are checked each shift, tested monthly, and calibrated during refueling.

The wide-range channels for both steam generators are indicated individually on one stripchart recorder.Narrow-range channels for both'steam generators are indicated on vertical gages.b3'ranMin Research Center

~i/

~a~a w~~a~~~>v~.TERM5257-287 4~CONCLUSIONS The initiation signals, logic, and associated circuitry of the Robert E.Ginna Nuclear Power Plant auxiliary feedwater system comply with the long-term safety-grade requirements of NUREG-0578, Section 2.1.7.a[3], and the sub-sequent clarification issued by the NRC.In addition, the following points may affect the reliability of-the APW" system: o No alarms are provided to monitor the power avai3.able to=the=steam admission valves or APW discharge valves.The auxiliary feedwater flow instrumentation complies with the long-term safety-grade requirements of NUREG-0578'<

Section 2.1.7.b[3]<and the subsequent clarification issued by the NRC.r't~JP~~Franklin Research Center

~~~TER~257-287 2~5~REFERENCES 1 Code of Federal Regulations, Title 10, Office of the Federal Register, National Archives and Records Service, General Services Administration, Revised January 1<1980.NRC<Generic letter to all'PHR licensees regarding short-term requirements resulting from Three Mile Island Accident September 13, 1979.3 0 4~5 NUBEG-0578,"TMI-2 Lessons Learned Task Force Status Report and,.ShortMerm Recommendations NRC, July 1979.NRC<Generic letter to all'PWR licensees clarifying lessons learned'hort-term requirements, October 30;1979.NRC, Generic letter to all PWR licensees regarding short-term requirement resulting from Three Mile Island Accident, September 5<1980.6 7~NRC Generic letter to all PWR licensees regarding post-TMI requirements, October 31, 1980.I NUREG-0737<"Clarification:of TMI Action Plan Requirements;" NRC, November 1980.8 9.L.D.White (RG&E)Letter to D,.L.Ziemann (NRC)October 17<1979 L.D.White (RG&E)Letter to D.L.Ziemann (NHC)'November 19,.1979 10.L.D., White (RG&E)Letter to D.L.Ziemann (NRC)November 28<1979 11.L.D.White (RG&E)Letter to D.L.Ziemann (NRC)December 14, 1979 12.13~D.M.Crutchfield (NRC)Letter to L.D.White (RG&E)July 7, 1980 D;M.Crutchfield (NRC)Letter to J.E.Maier (RG&E)May ll,'1981.'I 4 L 3[)FranMin Research Center

~~~~~':~~I TER~257-287 14 J.E.Maier (RC'4E)Letter to D.M.Crutchfield (NBC)December 30, 1980 15.D.M.Crutchfield (NBC)'etter to J.E.Maier (RGS,E)August 19'981 16.J.E.Maier (RGRE)Letter to D.M Crutchfield (NBC)September 22, 1981 17~,18'EEE Std 279-1971, Criteria for Protection Systems for Nuclear-, power Generating Stations<" Institute of Electrical and Electronics Engineers, Inc., New York, NY.NUREG-75/087, Standard Review Plang Section 10..4.9t Rev.1g USNRC, no date 19 Regulatory Guide 1.97 (Task RS 917-4)<'Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Pollowing an Accident/Rev 2g NRCt December 1980 h C'I l~V P A'I TECHNICAL EVALUATION REPORT AUXILIARY FEEDWATER SYSTEM AUTOMATIC INITIATION AND FLOW INDICATION (F-16, F-17)ROCHESTER GAS AND ELECTRIC CORPORATION ROBERT E, GINNA NUCLEAR POWER PLANT.NRC DOCKET NO.50-244 NRCTACNO.11706 NRC CONTRACT NO.NRG43-79-118 FRC PROJECT CS257 FRC ASSIGNMENT 9 FRCTASK 287 Prepared by Franklin Research Center 20th and Race Street Philadelphia, PA 19103 Auth01': F.W.Vosbury FRCGroupLeader:

K.S.Fertner Prepared foi Nuclear Regulatory Commission Washington, D.C.20555 Lead NRC Engineer'.

Kendall M.Wigdor July 23,'1982 This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or Implied, or assumes any legal liability or responsibility for any third party's use, or the results of such use, of any Information, appa-ratus, product or process disclosed In this report, or represents that its use by such third'arty would not Infringe privately owned rights.Reviewed by: Approved by;Group Leader Pro'nager Depart nt Dlr ctor DESIGNATED ORIGINAL Certified.

By~~F Id'A Division of The Franklin Institute The Benjamin Frankiin Parkwoy, Phila., Pa.19103 (215)448 1000 TERM5257-287 Section Title Pacae 2 INTRODUCTION 1.1 Purpose of Review 1.2 Generic Issue Background 1.3 Plant-Specific

Background

REVIEW CRITERIA~~1 1 1 e 2~3 3.2 Automatic Initiation.

~~TECHNZCAL EVALUATION 3.1 General Description of Auxiliary Peedwater System 5 5 6 3.2.1 Evaluation 3.2.2

Conclusion:

~i~~6 8 3.3 Plow Indication

.9 3 3.1 3'-3.-2 Evaluation,'onclusion'.

CONCLUS IONS 3e4 Description of Steam Generator Level Indication

.9 10 10 12 REFERENCES 13)ll FranMin Research Center A Division d The Frsnrrtin Inserore TER~57-28.7 This Technical Evaluation Report was prepared by Franklin Research Center under a contract with the U.S.Nuclear Regulatory Commission (Office of Nuclear Reactor Regulation, Division of Operating Reactors)for technical assistance in support of NRC operating reactor licensing actions.The~technical evaluation was conducted in accordance with criteria established by~the NRC.Mr.F.W.Vosbury contributed to the technical'preparation of this report through a subcontract with WESTEC Services, Inc.Franklin Research Center A Division ot'sie Frenidin Insonrte v TER~257-287 1, INTRODUCTION 1.1 PURPOSE OF REVIEW The purpose of this review is to provide a technical evaluation of the emergency feedwater system design to verify that safety-grade automatic initiation circuitry and flow indication are provided at the Robert E.Ginna Nuclear Power Plant.Although not in the scope of this review, the steam generator level indication available at the Ginna plant is described to assist subsequent NRC staff review.lo 2 GENERIC ISSUE BACKGROUND A post-accident design review by the Nuclear Regulatory Commission (NRC).after the March 28, 1979 incident at Three Mile Island (TMI)Unit 2 estab-lished that the auxiliary feedwater (AW)system should be treated as a safety system in a pressurized water reactor (PWR)plant.The designs of safety systems in'a nuclear power plant are required to meet general design criteria (GDC)specified in Appendix A of 10CFR50[1).The relevant design criteria for the AFW system design are GDC 13<GDC 20'nd GDC 34'DC 13 sets forth the requirement for instrumentation to monitor variables and systems (over their anticipated ranges of operation) that can affect reactor safety.GDC 20 requires that a protection system be designed to initiate automatically in order to assure that acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences.

GDC 34 requires that the safety function of the designed system, that is, the residual heat removal by the AFW system, be accomplished even in the case of a single failure.On September 13, 1979, the NRC issued a letter[2]to each PWR licensee that defined a set of short-term control-grade requirements for the AFW system, specified in NUREG-0578

[33.It required that the AM system have automatic initiation and single failure-proof design consistent with the requirements of GDC 20 and GDC 34.In addition, it required A1W flow indication in the control room in accordance with GDC 13.Ijlj FranMin Research Center A Diviision ot The Ffsnklin Insutu<t TER~257 287 During the week of September 24>1979, seminars were held in four regions of the country to discuss the short-term requirements.

On October 30, 1979, another letter was issued-to each PWR licensee providing additional clarifica-tion of the NRC staff short-term requirements without altering their intent[4]~Post-TMI analyses of primary system response to feedwater transients and reliability of installed AFW systems also established that, in the long term, the AFW system should be upgraded in accordance with safety-grade requirements.

These long-term requirements were clarified in the letter of September 5>1980[5]and formalized in the letter of October 31<1980[6].The'ctober-.31r letter incorporated in one document, NUREG-0737

[7], all THI-related items approved by the commission for implementation.

Section II.E.1.2 of NUREG-0737 clarifies the requirements for the AFW system automatic initiation and flow indication.

lo 3 PLANT-SPECIFIC BACKGROUND The Licensee of the Robert E.Ginna Nuclear Power Plant, Rochester Gas and Electric Corporation (RGhE), provided its response to Reference 3 on October 17, 1979[8]~In this response RGSE indicated that the Ginna plant was equipped with a safety-grade<

automatically initiated AFW system, and that the existing flow indication for each generator complied with the requirements for a control~rade system.RGRE agreed to upgrade the AFW flow indication by January 1, 1981.Additional correspondence f9-13]was exchanged between BG&E and the NRC regarding the AFW system, the implementation of NUREG-0578, and the subsequent clarification, issued by the NRC.On December 30, 1980 f14], RGaE provided its response to NUREG-0737 and included the design criteria to upgrade the AFW flow indication to safety-grade.

On August 19, 1981[15], the NRC sent a request for additional information to aid in the completion of this report.RGSE responded with the additional requested information on September 22'981 f13][ill Franklin Research Center A Don@Ion ot The Frlnkh'n lnsotute TER~257-.28 7 2 REVIEW CRITERIA To improve the reliability of the ABC system, the HRC required licensees to.upgrade the system, where necessary, to ensure timely automatic initiation when required.The system upgrade was to proceed in two phases.In the short term, as a minimum, control-grade signals and circuits were to be used to auto-matically initiate the APH system.Control~rade systems were to meet the following requirements of NUREG-0578, Section 2.1.7.a f3]: "1.The design shall provide for the automatic initiation of the auxiliary feedwater system.2.The automatic initiation signals and circuits shall be designed so that a single failure will not result in the loss of auxiliary feedwater system function.3.Testability of the initiating signals and circuits shall be a feature of the design.4.The initiating signals and circuits shall be powered from the emergency buses.5.Manual capability to initiate the auxiliary feedwater sys<<tern from the control room shall be retained and shall be implemented so that a single failure in the manual circuits will not result in the loss'of system function.6.The ac motor-driven pumps and valves in the auxiliary feed-water system shall be included in the automatic actuation (simultaneous and/or sequential) of the loads to the emer-gency buses.7.The automatic initiating signals and circuits shall be designed so that their failure will not result in the loss of manual capability to initiate the APW system from the control room." In the long term, these signals and circuits were to be upgraded in accor-dance with safety~rade requirements.

Specifically, in addition to the above requirements, the automatic initiation signals and circuits were to have independent channels, use environmentally qualified components, have system bypassed/inoperable status features, and conform to control system interaction criteria, as stipulated in IEEE Std 279-1971 f17].ll!)ll FranMin Research Center A Division of The Fnuk5n Insane TER~257-,287 The capability to ascertain the APW system performance from the control room must also be provided.In the short tean, steam generator level 1 indication and flow measurement were to be used to assist the operator in" maintaining the required steam generator level during AFH system operation.'his system was to meet the following requirements from NUREG-0578, Section 2.1.7 b[3], as clarified by NUREG-0737>

Section II.E.1.2[7]: "3..Safety~rade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room.2.The auxiliary feedwater flow instrument channels shall.be=powered from the emergency buses consistent with satisfying the emergency power diversity requirements of the auxiliary feedwater system set forth in Auxiliary Systems Branch Technical Position 10-1 of the Standard Review Plan, Section 10.4.9[18]." The NRC staff has determined that, in the long term<the overall flowrate indication system f'r Combustion Engineering and Westinghouse plants should include at least one APW flowrate indicator and one vide-range steam generator level indicator for each steam generator or.two flowrate indicators.

These flow indication systems should be environmentally qualified~

powered from a highly reliable, battery backed, nonmlass 1E power source;periodically testable;part of the plant's quality assurance program;and capable of display on demand.The operator relies on steam generator level instrumentation, in addition to APW flow indication<

to determine APW system performance.

The requirements for this steam generator level instrumentation are specified in Regulatory'uide 1.97, Revision 2<"Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Pollowing an Accident"[19].Franklin Research Center A DMsion 4 The FnuA!in Insotutc TERM5257-287 3 TECHNICAL EVALUATION 3 1 GENERAL DESCRIPTION OP AVXILIARY PEEDWATER SYSTEM The Ginna plant is a Westinghouse-designed, two-loop nuclear power plant.The AFW system consists of a main AFW system and a standby AFW system.The main APW system consists of two motorMriven pumps (200 gpm each)and one turbine-driven pump (400 gpm).Normally<each motor-driven pump supplies one steam generator, but the alignment can be altered to allow either motor-driven pump to supply both steam generators.

The turbine-driven pump normally supplies feedwater to both steam generators.

Each pump supplies the steam generators through a normally closed, motor-operated, discharge valve.Only the flow from one motorMriven pump (200 gpm)is necessary to prevent the reactor coolant system from reaching the pres'sure required to actuate a relief valve.The three main APW pumps are located in the same room and could be rendered inoperable as a result of a high energy line break.The standby APW system was installed to provide independent AIW system capability following such an event..The standby APW system consists of two motor<<driven pumps (200 gpm each)located in a plant area separate from the main AFW system.The standby APW system is manually actuated and aligned so that each pump supplies one steam generator.

The water sources for the main APW system are two 30,000~allon condensate storage tanks (non-seismic), a 100,000~allon condensate storage tank (non-seismic), and the service water system (seismic Category I).The water.source for the standby APW system is the service water system, which draws its water from Lake Ontario.Steam generator level is controlled manually from the control room by adjusting the position of the main AFW pump motor-operated discharge valves.Ill FranMin Research Center A CiMsion ot The Ffsnkhn Instate TERM5257-287 3.2 AUTOMATIC INITIATION

3.2.1 Evaluation

-The main AFW system at the Ginna plant is designed as an enginee'red safe-guards system to seismic Category I (with the exception of the condensate storage tanks), Class 1E, and the automatic initiation signals and circuits are designed to comply with the requirements of IEEE Std 279-1971 f17].'he Ginna plant main AW automatic initiation system consists of two independent actuation trains.The actuation circuits are powered from emergency dc buses.The redundant channels are physically separated and electrically independent.

A review of the automatic initiation circuitry revealed no credible single failure that would inhibit the automatic initiation system from providing AFW flow to at least one good steam generator.

The scope of the single-failure analysis in this report was limited to the redundancy of power supplies, diversity of actuating signals,'nd independence and redundancy of automatic initiation circuits.Both the main and standby AFW motor-driven pumps are powered by independent ac emergency buses.The loading of the main AFW motorMriven pumps onto their respective 480-Vac emergency buses is part of the post-accident automatic load sequencing.

The standby AFW motorMriven pumps are interlocked with the main AFW motor-driven pumps so that both are not simultaneously loaded onto the emergency bus to prevent overloading during loss of offsite power.The turbineMriven pump receives its steam through a motor-operated steam admission valve in each of two lines that tap off upstream of the steam generator isolation valves.The following signals are used for automatic initiation of the main AFW system: Motor-driven Pum s I o low-low steam generator level (2 out of 3 channels on either steam generator) o trip of both main feedwater pumps o safety injection.)L'L<l.renklin Research Center T~5257-287 Turbine-driven o low-low steam generator,'level (2 out of 3 channels on both steam generators) o loss of voltage on both 4-kV buses The main AFW system may be manually initiated from the control, room by.starting the motor-driven APW pumps individually; upon pump start, the associated discharge valve opens.The main APW motor-driven pumps discharge valves open fully on pump start.and then throttle down to limit'flow to a maximum of 230 gpm to each steam generator.

The automatic throttling conserves auxiliary feedwater and helps limit the cooldown rate.The turbine&riven pump discharge valve is normally open;in addition, when the turbine-driven pump is automatically initiated (steam admission valves open), the discharge valve receives an automatic actuation signal to ensure that it is fully open.The main and standby APW system and components are tested in accordance with technical specifications.,Operation of the AB/pumps and motor-operated valves is checked monthly.Every 18 months each main AFW pump and main APW motor~perated valve is verified to operate correctly on'receipt of each of the automatic initiation signals.The automatic initiation logic is tested monthly.The system design allows one channel to be bypassed for maintenance,~testing, and calibration during power operation without initiating a protective action.When'a channel is bypassed for testing, the bypass is accompanied by a single channel alert and channel status light actuation in the control room.~The automatic start of the main APW motor&riven pumps resulting from the tripping of both main feedwater pumps may be defeated during startup or shutdown when the turbine generator is off the line.The defeat switch is automatically bypassed when the turbine is latched.This bypass is alarmed in the control room.The only interaction between the main AFW system automatic initiation circuits and normal system control functions occurs in the narrow-range steam generator level instrumentation.'hese level instruments are used for both j fffifl rjL'u J Franklin Research Center h Division of nre Fran@in Insrrnrre TERM5257-287 protection (reactor trip and main APH i.nitiation) and normal control functions.(narrow-range channel I only)in the main feedwater system.The control signaLs are separated from the protection signals by isolation transformers so that.a malfunction in the control circui.ts will have no effect on-the protection signals.The following individual alarms are provided on the main control board.to alert the operator that the main APW equipment may not operate properly: o low-low steam generator level (3 channels each)o 2 out of 3 low-low steam generator levels (1 channel each)o 3 out of 3 low-low steam generator levels (1 channel each)o emergency shutdown equipment local control o safeguards breaker trip o safeguards equipment lockmff o main APH bypass in defeat lockout~o single channel alert o standby AFW pump C or D trip o-standby APW pump transfer switch off normal (1 channel each)o standby AFH pump high discharge flow (1 channel each)o stanctby APW pump high discharge pressure (1 channel each)o standby AFN HVAC trouble..No alarms are provided to monitor the power available to the steam admission valves or APW discharge valves.A review of the automatic and manual initiation circuitry and signals revealed that no single failure of either circuit train would inhibit the capability for manual initiation from the control room or the auxiliary shutdown panel.The environmental qualification of safety-related electrical and mechanical components, including AFH system circuits and components, is being reviewed separately by the NRC and is not within the scope of this review.I 3.2.2 Conclusion The initiation signals, logic, and associated circuitry of the automatic initiation feature of the main AFH system of the Ginna plant comply with the IIl)Franklin Research Center A Division af The Fronkttn In t TERM5257-287 ,long-term safety-grade requirements of NURE&4578, Section 2;1.7.a, and the\subsequent clarification issued by the NRC staff.In addition, the following point may effect the reliability of the APH system: o No alarms are provided to monitor the power available to the steam admission valves or AFW discharge valves.3.3 FLOW INDICATION

3.3.1 Evaluation

C The capability to evaluate the performance of the main and standby AFH systems at the Ginna plant is provided by the following indications:

o main APW motor-driven pump flow to each steam generator (2 channels each)o main AFW turbineMriven pump discharge flow (2 channels).o main APH turbine-driven pump flow to each steam generator (2 channels each)o standby APH motor-driven pump flow (1 channel each)o main AFW pump discharge pressure o standby APW pump discharge pressure o narrow-range steam generator level (3 channels each)o wide-range steam generator level (1 channel each)o main and standby APW'pump status indication o main and standby APW valve position indication o condensate storage tank level (2 channels).

The Licensee has stated that the main APW flow indication for each steam generator is safety~rade.

The individual steam generator AFH flow circuitry is powered from separate battery-backed instrument buses.Por each main AFW pump, there is a primary and secondary flow instrumentation channel.The primary channel indicates flow and, for the motor-driven pumps, controls the individual discharge valves.The secondary flow instrumentation indicates flow only.The primary and secondary channels are powered from opposite instrument buses.The primary and secondary flow indication is provided on the main control board by a dual-movement vertical-scale indicator.)ll Franklin Research Center A Dnnsion of The Frsnkbn Insatiate TERM5257-287 Since the discharge header from the turbine-driven pump branches to supply both steam generators, an additional channel'of safety~rade flow instrumenta-tion is provided in each line.Safety~rade wide-range steam generator level indication is provided as a backup.The standby APH system provides a.single-channel of safety~uide flow instrumentation for each pump.The flow indication channels are tested in accordance with technical specifications.

The environmental qualification of the APW flow indicators will he-reviewed separately by the NRC and is not within the scope of this review.3.3.2 Conclusion It is concluded that the APW flow instrumentation at the Ginna plant complies with the long-term safety~rade requirements of NUREG-0578, Section 2.1.7.b, and the subsequent clarification issued by the NRC.3.4 DESCRIPTION OP STEAM GENERATOR LEVEL INDICATION Steam generator level indication at the Ginna plant consists'of three safety-grade narrow-range level channels and one safety~rade wide-range level ,channel per steam generator.

are as follows: The level transmitters and their power supplies STEAM GENERATOR A Channel Transmitter Vital Bus Wide Range Narrow Range I Narrow Range IZ Narrow Range III LT-460 LT-461 LT-462 LT-463 A A C D STEAM GENERATOR B Channel'ide Range Narrow Range I Narrow Range ZZ Narrow Range ZZZ Tr ansmit ter I LT-470 LT-471 LT-472 LT-473 Vital Bus B D A B Ijl)FranMln Research Center h~a e TERM5257-287 The steam generator level channels are checked each shift<tested.monthly, and calibrated during refueling.

The wide-range channels for both steam generators are indicated individually on one stripchart recorder.Narrow-,range channels for both steam generators are indicated on vertical gages.)ll FranMin Research Center A Dresisn ot The Franklin Institute TERM5257-287 4 CONCLUSIONS The initiation signals, logic, and associated circuitry of the Robert E.Ginna Nuclear Power Plant auxiliary feedwater system comply with the'long-term safety-grade requirements of NUREG-0578, Section 2.1.7.a[3], and the sub-sequent clarification issued by the NRC.I Zn addition, the following points may affect the reliability of.the APW system0 o" No alarms are provided to monitor the power available to=the steam admission valves or AFH discharge valves.The auxiliary feedwater flow instrumentation complies with the long-term~safety-grade requirements of NUREG-0578, Section 2.1.7.b[3], and the subsequent clarification issued by the NRC.l)ll FranMin Research Center A Division or The Fronton Insutute TERW5257-287 REFERENCES 2~3~4~Code of Federal Regulations, Title 10, Office of the Federal Register, National Archives and Records Service, General Services Administration, Revised January 1, 1980.NRC, Generic letter to all'WR licensees regarding short-term requirements resulting from Three Mile Island Accident September 13, 1979.I NUHEG-0578,"TMI-2 Lessons Learned Task Force Status Report and ShortMerm Recommendations'<" NRC, July 1979.NRC, Generic letter to all'WR licensees clarifying lessons learned short-term requirements, October 30, 1979.5~NRC, Generic letter to all'PWR licensees regarding short-term requirement resulting from Three Mile Island Accident, September 5, 1980'.7~8.9.NRC Generic letter to all PWR licensees regarding post-TMI requirements, October 31, 1980.I NUREG-0737,"Clarificationiof TMI Action Plan Requirements;" NRC, November 1980.L.D.White (RG&E)Letter to D.L.Ziemann (NRC)October 17, 1979 L.D.White (RG&E)Letter to D.L.Ziemann (NBC)November 19, 1979 10'1.L.D.White (RG&E)Letter to D.L.Ziemann (NRC)November 28<1979 L.D.White (RG&E)Letter to D.L.Ziemann (NRC)December 14, 1979 12.13.D.M.Crutchfield (NRC)Letter to L.D.White (RG&E)July 7 i 1980 I D.M.Crutchfield (NRC)Letter to J.E.Maier (RG&E)May ll, 1981!Franklin Research Center A Dnbion d The Franklin Insowte TER~257-287 14.J.E.Maier (RGSE)Letter to D.M.Crutchfield (NRC)December 30, 1980 15.D.M.Crutchfield (NRC)Letter to J.E.Maier (RGaE)August 19<1981 16.J.E.Maier (RG&E)Letter to D.M.Crutchfield (NRC)September 22, 1981 17.IEEE Std 279-1971,'Criteria for Protection Systems for Nuclear--Power Generating Stations," Institute of Electrical and Electronics Engineers, Inc., New York/NY.18.NUREG-75/087'Standard Review Plang'ection 10.4.9g Rev.lg USNRC, no date.19.Regulatory Guide 1.97 (Task RS 917-4)<"Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Pollowing an Accident,'ev.

2, NRC, December 1980.III)Franklin Research Center I TECHNICAL EVALUATION REPORT AUXILIARY FEEDWATER SYSTEM AUTOMATIC INITIATION AND FLOW INDICATION

<F-16.F-37)ROCHESTER GAS AND ELECTRIC CORPORATION ROBERT E, GINNA NUCLEAR PONER PLANT NRC DOCKET NO.50-244 NRC TAC NO.11706 NRC CONTRACT NO.NRC43-79-118 FRC PROJECT C5257 FRC ASSIGNMENT 9 FRC TASK 2S7 Prepared by Franklin Research Center 20th and Race Street Philadelphia, PA 19103 Author: F.W.Vosbury FRCGroup Leader: K.S.Fertner Prepared for Nuclear Regulatory Commission Washington, D.C.20555 Lead NFIC Engineer: R.Kendall M.Wigdor July 23, 19S2 This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government no'r any agency thereof, or any of their employees, makes any warranty, expressed or Implied, or assumes any legal liability or responsibility for any third party's use, or the results of such use, of any Information, appa-ratus, product or process disclosed In this report, or represents that its use by such third'arty would not Infringe privately owned rights.Reviewed by: Approved by: Group Leader Pro'nager Depart nt Dir ctor".8207270149.

820723.DOCK 05000244 CF 9Il Franklin Research Center A Division of The Franklin institute 7he Benjamin Franklin Parkway, Phila., Pa.19103 (215)448-1000 TERM5257-287 CONTENTS Section Title~Pa e INTRODUCTION

~1.1 Purpose of Review 1.2 Generic Issue Background 1.3 Plant-Specific

Background

1 1 1 2 REVIEW CRITERIA~3 TECHNICAL EVALUATION

~3.1 General Description of Auxiliary Feedwater System 3.2 Automatic Initiation.

3.2;1 Evaluation

3.2.2 Conclusion

5 5 6 6 8 3.3 Flow Indication

.9 3.3.1 Evaluation 3.3,.2 Conclusion 3a4 Description of Steam Generator Level Indication CONCLUSIONS REFERENCES 9 10 10 12 13~llll Franklin Research center rtk DMeiOn Ol Tbt: FranMtn InSutut t:

TERM5257-28 7 FOREWORD This Technical Evaluation Report was prepared by Franklin Research Center under a contract with the U.S.Nuclear Regulatory Commission (Office of Nuclear Reactor Regulation, Division of Operating Reactors)for technical assistance in support of NRC operating reactor licensing actions.The technical evaluation was conducted in accordance with criteria established by the NRC.Mr.F.W.Vosbury contributed to the technical preparation of this report through a subcontract with WESTEC Services, Inc.~llll Franklin Research Center A Divlslon of The FrenItln Institute J

a TER-C5257-287 l.INTRODUCTION 1.1 PURPOSE OF REVIEW The purpose of this review is to provide a technical evaluation of the emergency feedwater system design to verify that safety-grade automatic initiation circuitry and flow indication are provided at the Robert E.Ginna Nuclear Power Plant.Although not in the scope of this review, the steam generator level indication available at the Ginna plant is described to assist subsequent NRC staff review.1.2 GENERIC ISSUE BACKGROUND A post-accident design review by the Nuclear Regulatory Commission (NRC)after the March 28,, 1979 incident at Three Mile Island (TMI)Unit 2 estab-lished that the auxiliary feedwater (AFW)system should be treated as a safety system in a pressurized water reactor (PWR)plant.The designs of safety systems in a nuclear power plant are required to meet general design criteria (GDC)specified in Appendix A of 10CFR50[1].The relevant design criteria for the AFW system design are GDC 13, GDC 20, and GDC 34.GDC 13 sets forth the requirement for instrumentation to monitor variables and systems (over their anticipated ranges of operation) that can affect reactor safety.GDC 20 requires that a protection system be designed to initiate automatically in order to assure that acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences.

GDC 34 requires that the safety function of the designed system, that is, the residual heat removal by the AFW system, be accomplished even in the case of a single failure.On September 13, 1979, the NRC issued a letter[2]to each PWR licensee that defined a set of short-term control-grade requirements for the AFW system, specified in NUREG-0578

[3].It required that the AFW system have automatic initiation and single failure-proof design consistent with the requirements of GDC 20 and GDC 34.In addition, it required AFW flow indication in the control room in accordance with GDC 13.~llll Franklin Research center rst Dltrlslon of The Frankln Institttte TER-C5257-287 During the week of September 24, 1979, seminars were held in four regions of the country to discuss the short-term requirements.

On October 30, 1979, another letter was issued to each PWR licensee providing additional clarifica-II tion of the NRC staff short-term requirements without altering their intent[4].Post-TMI analyses of primary system response to feedwater transients and reliability of installed AFW systems also established that, in the long term, the AFW system should be upgraded in accordance with safety-grade requirements.

These long-term requirements wereclarified in the letter of September 5, 1980[5]and formalized in the letter of October 31, 1980[6].The October 31 letter incorporated in one document, NUREG-0737

[7], all TMI-related items approved by the commission for implementation.

Section II.E.1.2 of NUREG-0737 clarifies the requirements for the AFW system automatic initiation and flow indication.

1 3 PLANT-SPECIFIC BACKGROUND The Licensee of the Robert E.Ginna Nuclear Power Plant, Rochester Gas and Electric Corporation (RGGE)r provided its response to Reference 3 on October 17, 1979[8].In this response RGt'E indicated that the Ginna plant was equipped with a safety-grade, automatically initiated AFW system, and that the existing flow indication for each generator complied with the requirements for a control-grade system.RG6E agreed to upgrade the AFW flow indication by January 1, 1981.Additional correspondence

[9-13]was exchanged between RGGE and the NRC regarding the AFW system, the implementation of NUREG-0578, and the subsequent clarification issued by the NRC.On December 30, 1980[14], RGaE provided its response to NUREG-0737 and included the design criteria to upgrade the AFW flow indication to safety-grade.

On August 19, 1981[15]r the NRC sent a request for additional information to aid in the completion of this report.RG&E responded with the additional requested information on September 22, 1981[13].(Ill Franklin Research Center A (anion or The FranMln Inaarure TER-C5257-287 2~REVIEW CRITERIA To improve the reliability of the AM system, the NRC required licensees to upgrade the system, where necessary, to ensure timely automatic initiation when required.The system upgrade was to proceed in two phases.In the short term, as a minimum, control-grade signals and circuits were to be used to auto-matically initiate the AFW system.Control-grade systems were to meet the following requirements of NUREG-0578, Section 2.1.7.a[3]: "1.The design shall provide for the automatic initiation of the auxiliary feedwater system.2.The automatic initiation signals and circuits shall be designed so that a single failure will not result in the loss of auxiliary feedwater system function.3.Testability of the initiating signals and circuits shall be a feature of the design.4.The initiating signals and circuits shall be powered from the emergency buses.5.'Manual capability to initiate the auxiliary feedwater sys-tem from the control room shall be retained and shall be implemented so that a single failure in the manual circuits will not result in the loss'of system function.6.The ac motor-driven pumps and valves in the auxiliary feed-water system shall be included in the automatic actuation (simultaneous and/or'equential) of the loads to the emer-gency buses.7.The automatic initiating signals and circuits shall be designed so that their failure will not result in the loss of manual capability to initiate the AkW system from the control room." In the long term, these signals and circuits were to be upgraded in accor-dance with safety-grade requirements.

Specifically, in addition to the above Y requirements, the automatic initiation signals and circuits were to have independent channels, use environmentally qualified components, have system bypassed/inoperable status features, and conform to control system interaction criteria, as stipulated in IEEE Std 279-1971[17].()ll Franklin Research Center A Chilon of The Franklin Institute TER-C5257-287 The capability to ascertain the AFW system performance from the control room must also be provided.In the short term, steam generator level indication and flow measurement were to be used to assist the operator in maintaining the required steam generator level during AFW system operation.

This system was to meet the following requirements from NUREG-0578, Section 2.1.7.b[3], as clarified by NUREG-0737,Section II.E.1.2[7]: "l.Safety-grade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room.2.The auxiliary feedwater flow instrument channels shall be powered from the emergency buses consistent with satisfying the emergency power diversity requirements of the auxiliary feedwater system set forth in Auxiliary Systems Branch Technical Position 10-1 of the Standard Review Plan, Section 10.4.9[18]." The NRC staff has determined that, in the long term, the overall flowrate indication system for Combustion Engineering and Westinghouse plants should include at least one AFW flowrate indicator and one wide-range steam generator level indicator for each steam generator or two flowrate indicators.

These flow indication systems should be environmentally qualified; powered from a highly reliable, battery backed, non-class 1E power source;periodically testable;part of the plant's quality assurance program;and capable of display on demand.The operator relies on steam generator level instrumentation, in addition to AFW flow indication, to determine AFW system performance.

The requirements for this steam generator level instrumentation are specified in Regulatory Guide 1.97, Revision 2, Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident"[19].0P Franklin Research Center A DMslon oI The FtenMin Institute 4,

TERM5257-287 3~TECHNICAL EVALUATION 3.l GENERAL DESCRIPTION OF AUXILIARY FEEDWATER SYSTEM The Ginna plant is a Westinghouse-designed, two-loop nuclear power plant.The AFW system consists of a main AFW system and a standby AFW system.The main AFW system con'sists of two motor-driven pumps (200 gpm each)and one turbine-driven pump (400 gpm).Normally, each motor-driven pump supplies one steam generator, but the alignment can be altered to allow either motor-driven pump to supply both steam generators.

The turbine-driven pump normally supplies feedwater to both steam generators.

Each pump supplies the steam generators through a normally closed, motor-operated, discharge valve.Only the flow from one motor-driven pump (200 gpm)is necessary to prevent the reactor coolant system from reaching the pressure required to actuate a relief valve.The three main AFW pumps are located in the same room and could be-rendered inoperable as a result of a high energy line break.The standby AFW system was installed to provide independent AFW system capability following such an event.The standby AFW system consists of two motor-driven pumps (200 gpm each)located in a plant area separate from the main AFW system.The standby AFW system is manually actuated and aligned so that each pump supplies one steam generator.

The water sources for the main AFW system are two 30,000-gallon condensate storage tanks (non-seismic), a l00,000~allon condensate storage tank (non-seismic), and the service water system (seismic Category I).The water source for the standby AFW system is the service water system, which draws its water from Lake Ontario.Steam generator level is controlled manually from the control room by adjusting the position of the main AFW pump motor-operated discharge valves.~llll Franklin Research Center A DMslon oi The Franklin Inariture 0

0 TER-C5257-287 3.2 AUTOMATIC INITIATION

3.2.1 Evaluation

The main AFW system at the Ginna plant is designed as an engineered safe-guards system to seismic Category I (with the exception of the condensate storage tanks), Class lE, and the automatic initiation signals and circuits are designed to comply with the requirements of IEEE Std 279-1971[17].The'Ginna plant main AFW automatic initiation system consists of two independent actuation trains.The actuation circuits are powered from emergency dc buses.The redundant channels are physically separated and electrically independent.

A review of the automatic initiation circuitry revealed no credible single failure that would inhibit the automatic initiation system from providing AFW flow to at least one good steam generator.

The scope of the single-failure analysis in this report was limited to the redundancy of power supplies, diversity of actuating signals, and independence and redundancy of automatic initiation circuits.Both the main and standby AFW motor-driven pumps are powered by independent ac emergency buses.The loading of the main AFW motor-driven pumps onto their respective 480-Vac emergency buses is part of the post-accident automatic load sequencing.

The standby APW motor-driven pumps are interlocked with the main AFW motor-driven pumps so that both are not simultaneously loaded onto the emergency bus to prevent overloading during loss of offsite power.The turbine-driven pump receives its steam through a motor-operated steam admission valve in each of two lines that tap off upstream of the steam generator isolation valves.The following signals are used for automatic initiation of the main APW system: Motor-driven Pum s o low-low steam generator level (2 out of 3 channels on either steam generator) o trip of both main feedwater pumps o safety injection.

till Franklin Research Center A Dlvhton oI'nte Franklin Institute TERM525 7-28 7 Turbine-driven Pum o low-low steam generator level (2 out of 3 channels on both steam generators) o loss of voltage on both 4-kV buses The main AFH system may be manually initiated from the control room by starting the motor-driven AFH pumps individually; upon pump start, the associated discharge valve opens.The main AFW motor-driven pumps discharge valves open fully on pump start and then throttle down to limit flow to a maximum of 230 gpm to each steam generator.

The automatic throttling conserves auxiliary feedwater and helps limit the cooldown rate.The turbine-driven pump discharge valve is normally open;in addition, when the turbine-driven pump is automatically initiated (steam admission valves open), the discharge valve receives an automatic actuation signal to ensure that it is fully open.The main and standby AFW system and components are tested in accordance with technical specifi.cations.

Operation of the AFH pumps and motor-operated

/valves is checked monthly.Every 18 months each main AFW pump and main AFW motor-operat:ed valve is verified to operate correctly on receipt of each of the automatic initiation signals.The automatic initiation logic is tested monthly.The system design allows one channel to be bypassed for maintenance, testing, and calibration during power operation without initiating a protective action.When a channel is bypassed for testing, the bypass is accompanied by a single channel alert and channel status light actuation in the control room.The automatic start of the main AFH motor-driven pumps resulting from the tripping of both main feedwater pumps may be defeated during startup or shutdown when the turbine generator is off the line.The defeat switch is automatically bypassed when the turbine is latched.the control room.This bypass is alarmed in The only interaction between the main AFH system automatic initiation circuits and normal system control functions occurs in the narrow-range steam generator level instrumentation.

These level instruments are used for both I Franklin Research Center A Division of'nte Frenitfin Institute

0 o TER-C5257-287 protection (reactor trip and main AFW initiation) and normal control functions (narrow-range channel I only)in the main feedwater system.The control signals are separated from the protection signals by isolation transformers so that a malfunction in the control circuits will have no effect on the protection signals.The following individual alarms are provided on, the main control board to alert the operator that the main AFW equipment may not operate properly: I'low-low steam generator level (3 channels each)o 2 out of 3 low-low steam generator levels (1 channel each)o 3 out of 3 low-low steam generator levels (l channel each)o emergency shutdown equipment local control o safeguards breaker trip o safeguards equipment lock-off o main AFW bypass in defeat lockout o single channel alert o standby AFH pump C or D trip o standby JQW pump transfer switch off normal (l channel each)o standby AFW pump high discharge flow (l channel each)o standby AFH pump high discharge pressure (l channel'each) o standby AFH HVAC trouble.No alarms are provided to monitor the power available to the steam admission valves or AFW discharge valves.A review of the automatic and manual initiation circuitry and signals revealed that no single failure of either circuit train would inhibit the capability for manual initiation from the control room or the auxiliary shutdown panel.The environmental qualification of safety-related electrical and mechanical components, including AFH system circuits and components, is being reviewed separately by the NRC and is not within the scope of this review.3.2.2 Conclusion The initiation signals, logic, and associated circuitry of the automatic initiation feature of the main AFW system of the Ginna plant comply with the!)ll Franklin Research Center A Divfshn of The FcanMln Institute Q TERW5257-287 long-term safety-grade requirements of NUREG-0578, Section 2.1.7.a, and the subsequent clarification issued by the NRC staff.Zn addition, the following point may effect the reliability of the AFW system: o No alarms are provided to monitor the power available to the steam admission valves or AFW discharge valves.3~3 FLOW ZNDZCATZON

3.3.1 Evaluation

The capability to evaluate the performance of the main and standby AFW systems at the Ginna plant is provided by the following indications:

o main AFW motor-driven pump flow to each steam generator (2 channels each)o main AFH turbine-driven pump discharge flow (2 channels)o main AFW turbine-driven pump flow to each steam generator (2 channels each)o standby APW motor-driven pump flow (1 channel each)o main AFH pump discharge pressure o standby AFW pump discharge pressure o narrow-range steam generator level (3 channels each)o wide-range steam generator level (1 channel each)o main and standby APW'ump status indication o main and standby AFH valve position indication o condensate storage tank level (2 channels).

The Licensee has stated that the main AFW flow indication for each steam generator is safety-grade.

The individual steam generator APW flow circuitry is powered from separate battery-backed instrument buses.Por each main AFH pump, there is a primary and secondary flow instrumentation channel.The primary channel indicates flow and, for the motor-driven pumps, controls the individual discharge valves.The secondary flow instrumentation indicates flow only.The primary and secondary channels are powered from opposite instrument buses.The primary and secondary flow indication is provided on the main control board by a dual-movement vertical-scale indicator.

l)ll Franldin Research Center A Divlslon ot The Frsnk5n Insdtute

~~TERM525 7-28 7 Since the discharge header from the turbine-driven pump branches to supply both steam generators, an additional channel of safetygrade flow instrumenta-tion is provided in each line.Safety-grade wide-range steam generator level indication is provided as a backup.The standby AFW system provides a single channel of safety-guide flow instrumentation for each pump.The flow indication channels are tested in accordance with technical specifications.

The environmental qualificati'on of the AFW flow indicators will be reviewed separately by the NRC and is not within the scope of this review.3.3.2 Conclusion It is concluded that the AFW flow instrumentation at the Ginna plant complies with the long-term safety-grade requirements of NUREG-0578, Section 2.1.7.b, and the subsequent clarification issued by the NRC.3.4 DESCRIPTION.

OF STEAM GENERATOR LEVEL INDICATION Steam generator level indication at the Ginna plant consists of three safety-grade narrow-range level channels and one safety-grade wide-range level channel per steam generator.

The level transmitters and their power supplies are as follows: STEAM GENEBATOR A Channel Transmitter Vital Bus Wide Range Narrow Range I Narrow Range II Narrow Range III LT-460 LT-461 LT-462 LT-463 A A C D STEAM GENERATOR B Channel Transmitter Vital Bus Wide Range Narrow Range I Narrow Range II Narrow Range III LT-470'T-471 LT-472 LT-473 B D A B~llll Franklin Research Center A DMsion cI The FtentrIin Institute e TERM5257-287 The steam generator level channels are checked each shift, tested monthly, and calibrated during refueling.

The wide-range channels for both steam generators are indicated individually on one stripchart recorder.Narrow-range channels for both steam generators are indicated on vertical gages.I'I~llll Franklin Research Center A DMsion of The Frenklin Insliltste Qr~TER-C5257-287 4.CONCLUSIONS The initiation signals, logic, and associated circuitry of the Robert E.Ginna Nuclear Power Plant auxiliary feedwater system comply with the long-term safetygrade requirements of NUREG-0578, Section 2.1.7.a[3], and the sub-sequent clarification issued by the NRC..~I In addition, the following points may affect the reliability of the AFW system: I o No alarms are provided to monitor the power available to the steam admission valves or AFW discharge valves.E The auxiliary feedwater flow instrumentation complies with the long-term safety-grade requirements of NUREG-0578, Section 2.1.7.b[3], and the subsequent clarification issued by the NRC.~llll Franklin Research Center A Division ol The Fsenkln Inrritttte

TER-C5257-2&7 5.REFERENCES Code of Federal Regulations, Title 10, Office of the Federal Register, National Archives and Records Service, General Services Administration, Revised January 1, 1980.2~NRC, Generic letter to all PWR licensees regarding short-term requirements resulting from Three Mile Island Accident September 13, 1979.3~4~NUREG-0578,"TMI-2 Lessons Learned Task Force, Status Report and Short-Term Recommendations," NRC, July 1979.NRC, Generic letter to all PWR licensees clarifying lessons learned short-term requirements, October 30, 1979.5.NRC, Generic letter to all PWR licensees regarding short-term requirement resulting from Three Mile Island Accident, September 5, 1980.NRC Generic letter to all PWR licensees regarding post-TMI requirements, October 31, 1980.7~NUREG-0737,"Clarification of TMI Action Plan Requirements;" NRC, November 1980.8~r 9~L.D.White (RG&E)Letter to D.L.Ziemann (NRC)October 17, 1979 e L.D.White (RG&E)Letter to D.L.Ziemann (NRC)November 19, 1979 10'.D.White (RGaE)Letter to D.L.Ziemann (NRC)November 28, 1979 L.D.White (RGaE)Letter to D.L.Ziemann (NRC)December 14, 1979 12.D.M.Crutchfield (NRC)Letter to L.D.White (RGaE)July 7, 1980 13.D.M.Crutchfield (NRC)Letter to J.E.Maier (RGaE)May ll, 1981~IIII Frantttin Research Center A Dlvblon ol 7he Fsankmn Insulute I~, Q 4 TER-C5257-287 14.J.E.Maier (RGaE)Letter to D.M.Crutchfield (NRC)December 30, 1980 15.D.M.Crutchfield (NBC)Letter to J.E.Maier (RG&E)August 19, 1981 16.J.E.Maier (RG&E)I Letter to D.M.Crutchf'ield (NBC)September 22, 1981 k 17.IEEE Std 279-1971,"Criteria for Protection Systems for Nuclear Power Generating Stations," Institpte of Electrical and Electronics Engineers, Inc., New York, NY.18.NUREG-75/087,"Standard Review Plan," Section 10.4.9, Rev.1, USNRC, no date.19.Regulatory Guide 1.97 (Task RS 917-4),"Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," Rev.2, NRC, December 1980.00 FranMin Research Center A Dlvfshn ef The FtenkSn Institute 0~, Q~