Text

Revision 32 to Updated Final Safety Analysis Report, Section 9, Auxiliary Systems
	ML19106A419
Person / Time
Site:	Davis Besse
Issue date:	09/24/2018
From:	; FirstEnergy Nuclear Operating Co
To:	; Office of Nuclear Reactor Regulation
	Purnell B
References
	L-18-206
	Download: ML19106A419 (237)
	v • d • e

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.0-1 UFSAR Rev 30 10/2014 SECTION 9 9.0 AUXILIARY SYSTEMS

The auxiliary systems required to support the reactor coolant system during normal operation of the Davis-Besse Nuclear Power Station are described in the following sections. Some of these systems are described in detail in Chapter 6 since they serve as engineered safety features. The information in this chapter deals primarily with the functions served during normal operation.

Most of the components within these systems are located within the auxiliary building. Those systems with connecting piping between the containment and the auxiliary building are equipped with containment isolation valves as described in Subsection 6.2.4.

The codes and standards used, as appropriate, in the design, fabrication; and testing of components, valves, and piping are as follows:

a. ASME Boiler and Pressure Vessel Code,Section II, Material Specifications.

b. ASME Boiler and Pressure Vessel Code,Section III, Nuclear Components (1971.)

1. Nuclear Components Class 1.

2. Nuclear Components Class 2.

3. Nuclear Components Class 3.

c. ASME Boiler and Pressure Vessel Code,Section VIII, Pressure Vessels, and ASME Nuclear Code-Case Interpretations.

d. ASME Boiler and Pressure Vessel Code,Section IX, Welding Qualifications.

e. Standards of the American Society for Testing and Materials (ASTM.)

f. ANSI, B31.1.0 - 1967, Power Piping.

g. ANSI, B31.7 - 1969, Nuclear Power Piping.

h. Standards of the American Institute of Electrical and Electronics Engineers (IEEE).

i. Standards of the National Electrical Manufacturers Association (NEMA).

j. Hydraulic Institute Standards.

k. Standards of Tubular Exchanger Manufacturers Association.

l. Air Moving and Conditioning Association Codes (AMCA).

m. ANSI, B96.1, Aluminum Tanks.

n. American Gear Manufacturers Association Standards (AGMA).

o. American Water Works Association Standards (AWWA).

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.0-2 UFSAR Rev 30 10/2014

p. Draft ASME Code for Pumps and Valves for Nuclear Power, November 1968.

q. National Fire Protection Association (NFPA) Standards.

r. ANSI Standard C 50.20 - Test Code for Polyphase Induction Motors and Generators.

s. ANSI Standard C 50.2 for Alternating Current Motors, Induction Machines in General and Universal Motors.

t. Heating, Ventilating, and Air Conditioning Guide; American Society of Heating, Refrigerating and Air Conditioning Engineers (ASHRAE).

u. The pressure-containing parts of all engineered safety features systems pumps of stainless steel material were liquid penetrant-examined in accordance with Appendix VIII of Section VIII of the ASME Code. The pressure-containing welds of all engineered safety feature systems pum ps were radiographically examined in accordance with Paragraph UW-51 of Section VIII of the ASME Code.

v. Valves and piping were designed and fabricated per requirements of ANSI B16.5 or MSSS SP-66, and ANSI B31.1.0.

w. American Welding Society (AWS).

x. ASME Power Test Codes, PTC 8.2-1965.

y. Pipe Fabrication Institute Standards (PFI).

z. Recommended Standards for Water Works.

aa. State of Ohio Building Code, Chapter BB-51, Plumbing.

bb. The National Plumbing Code.

cc. Sheet Metal and Air Conditioning Contractors National Association (SMACNA).

dd. ASME Boiler and Pressure Vessel Code,Section III, Nuclear Vessels (1968).

ee. Service Water System valves SW-1424, SW-1429, and SW-1434 Component Cooling Water valves CC1407C, CC1411C , CC1568, Core Flooding valve CF2C, and Pressurizer Quench Tank valve RC229C were purchased utilizing the provisions of NRC Generic Letter 89-09, ASME Section III Component Replacements. Additionally, a spare valve which can be used as either SW3962 or SW3963 has been purchased and upgraded utilizing the provisions of Generic Letter 89-09.

ff. ANSI/FCI 70-2-1976, American National Standard for Control Valve Seat Leakage.

gg. ANSI B16.34-1981, Valves - Flanged, Threaded, and Welded End.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.0-3 UFSAR Rev 30 10/2014 hh. ASME Boiler and Pressure Vessel Code,Section II, Materials Specifications, 1971 through 1989 Editions.

ii. ASME Boiler and Pressure Vessel Code,Section III, Rules for Construction of Nuclear Power Plant Components, 1971 through 1986 Editions.

jj. ASME Boiler and Pressure Vessel Code,Section V, Nondestructive Examination, 1986 Edition.

kk. ASME Boiler and Pressure Vessel Code,Section IX, Qualification Standard for Welding and Brazing Procedures, Welders, Brazers, and Welding and Brazing Operators, latest Edition and Addenda.

ll. ASME Boiler and Pressure Vessel Code,Section III, Rules for Construction of Nuclear Power Plant Components, 1989 Edition, No Addenda.

To aid in utilizing the system drawings, a standard set of symbols and abbreviations has been used.

A cross reference identifying the system components to which the above codes and standards apply is given below in Table 9.0-1.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.0-4 UFSAR Rev 31 10/2016 TABLE 9.0-1 Cross Reference of Components and Design Codes Component Code (Class**)

SERVICE WATER SYSTEM Pumps a, b(3), e, j Piping b(2), b(3), e, f Valves a, b(2), b(3), e, ee, ff, gg, hh, jj, kk Motors h, i, r, s COMPONENT COOLING WATER Pumps a, e, j, p Heat Exchangers a, c, d, e, k Tanks a, c, d, e Piping a, b(2), b(3), d, e, ll***

Valves a, b(2), b(3), d, e, ee Motors h, i, r, s SPENT FUEL POOL COOLING SYSTEM Pumps a, b(3), e, j Heat Exchangers a, c, d, e, k, dd Filters a, b(3), d, e, g Demineralizer Tanks a, b(3), d, e, g Piping a, b(3), d, e Valves a, b(3), d, e Motors h, i, r, s SAMPLING SYSTEM Piping b(1), b(2), b(3), e, f Heat Exchangers e Valves b(1), b(2), b(3), e, f HEATING, VENTILATION AND AIR CONDITIONING Fans l, t, q, cc Filters l, t, q Ductwork l, t, q, cc Heating and Cooling Coils l, t Piping b(2), e, f Valves b(2), e, f Motors h, i, r, s STATION AND INSTRUMENT AIR SYSTEM Receivers a, c, d, e Piping b(2), e, f Valves a, b(2), e, v Motors h, i, r, s

__________________

- Where applicable to ASME Code Section III

- - A portion of the CCW lines (3"-HCB-41 and 3"-HBB-13) in containment that interfaces with the CRDM Stator Cooling Water System was replaced by ECP 10-0470. The construction code for the replacement CCW piping is ASME III 1989 Edition with No Addenda. ASME Code required reconciliation has been performed and is documented in ECP 10-0470.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.0-5 UFSAR Rev 31 10/2016 TABLE 9.0-1 (Continued)

Cross Reference of Components and Design Codes Component Code (Class**)

AUXILIARY FEEDWATER SYSTEM

Pumps a, b(3), e, j, x Tanks e, o Piping b(2), e, f Valves a, b(2), e Turbines e, i FIRE PROTECTION SYSTEM Pumps e, j, q Piping e, q Valves e, q Motors h, i, r, s, q Diesel q DECAY HEAT REMOVAL SYSTEM

Pumps a, e, j, p, u Heat Exchangers a, c, d, e, k, dd Piping a, b(1), b(2), d, e, *Valves b(2), e, g, p, v Valves a, b(1), b(2), d, e

Motors h, i, r, s DIESEL GENERATOR FUEL OIL SYSTEM Pumps a, b(3), e, j Tanks a, b(3), e, q Piping a, b(3), v Valves a, b(3), v Motors h, i, r, s CHEMICAL ADDITION SYSTEM

Pumps a, e, j, p, u

Tanks None Tanks a, d, e, dd Piping a, b(3), d, e, f, v

Valves e, f, v Valves a, b(3), d, e, f, v Motors h, i, r, s

__________________

Equipment by NSS Supplier ** Where applicable to ASME Code Section III

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.0-6 UFSAR Rev 31 10/2016 TABLE 9.0-1 (Continued)

Cross Reference of Components and Design Codes Component Code (Class**)

MAKEUP AND PURIFICATION SYSTEM

Pumps a, e, j, p, u

Heat Exchangers a, c, d, e, k, dd

Filters a, d, e, dd

Demineralizer Tank a, d, e, dd Demineralizer Tank a, b(3), d, e

Tanks a, d, e, dd Piping a, b(1), b(2), b(3), d, e

Valves b(1), e, g, p, v Valves a, b(2), b(3), d, e

Motors h, i, r, s DEMINERALIZED WATER MAKEUP SYSTEM Pumps e, i, j ***Clarifiers e, i, z ***Filters e, z ***Demineralizer c, e Piping e, v Valves e, v Motors h, i, r, s POTABLE AND SANITARY WATER SYSTEMS Pumps e, i, j Tanks c, e Piping e, aa, bb, o Motors h, i, r, s EQUIPMENT AND FLOOR DRAINAGE SYSTEM Pumps e, j Piping e, d, v Valves e, d, v Motors h, i, r, s

CONDENSATE STORAGE FACILITIES Tanks o, w Piping v Valves v EMERGENCY FEEDWATER SYSTEM Pump e, I, j Tank e Piping e, b(2)(3), gg, kk, ii Valves e, b(2)(3), ii Note: The EFWS does not support the RCS during normal plant operation but is added here as a new major plant system. __________________

Equipment by NSS Supplier ** Where applicable to ASME Code Section III ***Equipment is no longer used

£

°

³

°

°°°

°°

°°°°°°°

°

£D

°

°°

°

°°

°

°°°

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-1 UFSAR Rev 31 10/2016 9.2 WATER SYSTEMS 9.2.1 Service Water System

9.2.1.1 Design Bases

The service water system is designed to serve two functions during station operation. The first function is to supply cooling water to the component cooling heat exchangers, the containment air coolers, and the cooling water heat exchangers in the turbine building during normal operation. The second function is to provide, through automatic valve sequencing, a redundant supply path to the engineered safety features components during an emergency. Only one path, with one service water pump, is necessary to provide adequate cooling during this mode of operation.

The Seismic Class I service water pumps are sized to provide cooling water to the component cooling heat exchangers, containment air coolers, and the emergency core cooling system room cooling coils. Two redundant pumps, of 100 percent capacity each, are provided to back up the operating pump.

The service water system also provides a backup source of water to the auxiliary feedwater system and the Motor Driven Feedwater pump (MDFP). During normal operation service water discharge provides makeup for the circulating water system.

The portion of the system required for emergency operation, including the intake structure, is designed to the ASME Code,Section III, Nuclear Class and Seismic Class I, as applicable.

This includes protection from a tornado and tornado missiles. The associated containment penetrations are Nuclear Class 2.

Applicable design codes and standards are listed in Table 9.0-1. Design parameters for the system are listed in Table 9.2-1. The degree of compliance with the single-failure criterion is discussed in Subsection 9.2.1.3. The arrangement of the service water pumps, important dimensions of the pump room, and the minimum and extreme high water levels, including the maximum flood, are provided in Figure 2.4-21.

9.2.1.2 System Description

The service water system provides water for the following (Figure 9.2-1):

Normal Operation:

a. Component cooling heat exchanger cooling

b. Cooling water heat exchanger cooling

c. Turbine condensate polishing demineralizer system (as necessary)

d. Containment air cooler cooling

e. Emergency core cooling system room cooling coils (as necessary)

f. Cooling tower makeup

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-2 UFSAR Rev 31 10/2016 g. Water jet exhausters

h. Blowdown condenser

i. Motor Driven Feedwater Pump lube oil & seal water coolers

Emergency Operation:

a. Component cooling heat exchangers

b. Containment air coolers

c. Emergency core cooling system room cooling coils

d. Auxiliary feedwater system

e. Control room emergency condenser cooling

f. Component cooling water system makeup

g. Hydrogen dilution blowers

h. Motor Driven Feed water Pump

Three service water pumps are part of the system. They are installed in the intake structure and use Lake Erie as a source of water. The intake structure is chlorinated to prevent slime and algae growth in the system. Two pumps are used in normal operation. Motor-operated strainers at the pump outlets filter any material that may plug heat exchanger tubes and the orifices of the Auxiliary Feedwater pump bearing oil cooler, turbine bearing cooler, and governor oil cooler.

The combined flow leaving the system is normally returned to the circulating water system as makeup. This flow may also be diverted to the intake structure to prevent icing in winter. All Class I piping which passes through the turbine building is enclosed in a Class I tunnel.

The three service water pumps are piped to two separate interconnected but isolated supply paths. Interconnecting switching paths are provided on each of the system heat exchangers.

Connections are also provided on the system so that a source of water is available to (1) the component cooling water system, (2) condensate polishing demineralizer system, (3) the suction of the auxiliary feed pumps, (4) the water jet exhausters, (5) Motor Driven Feedwater pump, (6) Motor Driven Feedwater Pump lube oil & seal water coolers and (7) the blowdown

condenser.

The service water discharge can be redirected from the cooling tower to the forebay when required to maintain water level in the forebay above elevation 564 feet International Great Lakes Datum (IGLD).

If the supply pipe from Lake Erie to the intake structure is lost during an earthquake, the system will use the intake forebay as a reservoir and cooling pond. This is accomplished by motor-operated valves which block the system return flow to the cooling tower and open another return path to the intake forebay. Operation of the system under this condition is as follows:

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-3 UFSAR Rev 31 10/2016 Although not part of the Licensing Basis for a combination of events, if a LOCA and seismic event are considered to occur together when the forebay level is above elevation 564 feet IGLD, the actions of the operator to ensure the return of service water to the forebay are dependent on the consequences of the seismic event.

a. If the seismic event causes the blockage of service water as a result of the failure of the nonseismic line to the cooling tower, a pressure switch will cause the intake forebay return line valve to open. Should this valve fail to open, another switch will cause the intake structure de-icing line valve to open after a time delay. With the discharge through the de-icing line, the water temperature will reach the maximum 113F in approximately 2 days. This time is based on an analysis assuming El. 562 feet IGLD. The data used in the analysis are as follows:

Water temperature (initial), F 90 Service water flow rate, gpm 10,000 Forebay water level, ft IGLD 562 Heat load, Btu/hr.

Variable (LOCA load)

Surface area, ft 2 225,031 Dry bulb temperature (max.), F 81.6 Dew point temperature (max.), F 73.7 Wind speed, mph 7.4 Mean solar radiation, Btu/ft 2 2,362 Time for water temperature to reach 113F, days 2 The calculated temperature would be lower if the water elevation is higher than 562 feet IGLD in the forebay.

If there is a failure of the intake forebay return valve to open, the operator must leave the control room to open it manually.

b. If the seismic event causes a break in the nonseismic line to the cooling tower without a blockage of the line, the operator must open the intake forebay return line

valve and close the cooling tower return line valve from the control room to stop flow out of the break. If the cooling tower return line valve fails to close, the water level in the forebay will drop from elevation 564 to 562 feet IGLD in 2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . This time is based on the postulation that all service water flow from two-pump operation flows out the break in the cooling tower line. The operator must then leave the control room in this three-hour period to close the cooling tower return line valve manually. This time period is sufficient to close the valve manually under any conditions. Failure of the intake forebay return line valve to open would require action outlined in Paragraph (a).

c. The water entrapped in the Seismic Class I area plus 1/3 of the non-Seismic Class I area of the forebay is sufficient to provide plant cooldown without using the Condensate Storage Tanks. The results of the analysis to substantiate this fact are outlined in Subsection 9.2.5. It is noted that although the use of minimum usable volume of the Condensate Storage Tanks is considered in Subsection 9.2.5.1, it is not necessary for the tanks to be available in order to provide the necessary cooling required. The minimum usable volume of the Condensate Storage Tanks of 270,300 gallons is small compared with the approximately 6,700,000 gallons of water contained in the Seismic Class I area plus 1/3 of the non-Seismic Class I area of the forebay. There is sufficient margin Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-4 UFSAR Rev 31 10/2016 available in the intake forebay volume to provide the extra 270,300 gallons for use by the Auxiliary Feedwater system.

d. Operation of the steam generators for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months while injecting raw water would evaporate about 230,000 gallons of water. Based on raw water chemistry data from October 1995 through October 1997, this would result in a maximum of 1462 pounds of solids accumulating in each steam generator. This has been documented in B&W Canada calculation 205S-A161. This quantity of solids would not adversely affect the heat transfer capability of the steam generators. This capability has been documented in the following reports:

1. "Secondary Side Chemistry Investigation in the 37 Tube Nuclear OTSG", Research Center Report 1459-2/6/70.

2. "19 Tube OTSG Fouling Test", E.W. Dotson, ARC Letter Report 69-2218-45-2, 12/31/69.

3. Babcock & Wilcox Canada Engineering Calculation 205S-A161, "Davis-Besse Unit 1 ROTSG Heat Transfer Evaluation Using Lake Erie Water" The flow area of the intake forebay is many orders of magnitude larger than that of the service water return header. In turn, the velocity at the intake forebay is much less than the return header. Therefore, any particulate matter that could cause pipe plugging will settle out before reaching the service water pumps. Should an occasional large particle (over 1/16 inch) enter the service water pumps, the service water pump strainers will prevent it from entering the system.

Chlorination of the intake structure serves to prevent slime and algae growth in the system. A Sodium Bromide solution is mixed with the Sodium Hypochlorite solution to enhance the biocidal effectiveness of the intake structure water treatment without increasing the level of chlorine. Should the Sodium Bromide portion of the system not be available, Sodium Hypochlorite solution may be used alone.

The low water velocities at the intake structure, which result in settling of discrete matter upstream of the screens, the service water pump strainers, and chlorination with Sodium Bromide prevent any plugging of the system, including the 30-inch service water return header. Furthermore, as illustrated in Table 9.2-2 the intake water contains only a small amount of suspended solids, which also reduces the possibility of plugging in the service water lines.

The piping takeoff to the auxiliary feed pumps is from two independent Class I lines.

The piping takeoff to the Motor Driven Feedwater Pump is from the Service Water Loop 1 Class I line prior to Component Cooling Water Heat Exchanger 1-1.

The service water system is designed to prevent any component failure from curtailing emergency operation. It is possible to isolate all heat exchangers and pumps on an individual basis. Additionally, the dilution pump, P-180, can supply water to the Service Water System from the intake structure in the event of a fire disabling the Service Water Pumps.

The cooling water supply and return lines to and from the containment air coolers are provided with remotely operated isolation valves. The cooling water supply and return lines are also Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-5 UFSAR Rev 31 10/2016 provided with components to eliminate or minimize the effects of a postulated waterhammer or transient hydraulic event in the event of loss of internal service water pressure.

A check valve is provided in the containment air cooler (CAC) 1-1 service water supply line to prevent water from draining and voiding the CAC 1-1 service water piping. Vacuum breakers are provided in the CAC 1-1 service water return piping to admit air and prevent voiding of the service water piping.

A check valve is provided in the containment air cooler (CAC) 1-2 service water supply line to prevent water from draining and voiding the CAC 1-2 service water piping. Vacuum breakers are provided in the CAC 1-2 service water return piping to admit air and prevent voiding of the service water piping.

Vacuum breakers are provided in the common service water return header to admit air and prevent voiding of the service water piping.

The Service Water System return piping in the service water tunnel has been designed as Seismic Class I.

9.2.1.3 Safety Evaluation

The service water pumps have been designed to operate with Lake Erie low water level. In the

event of extremely high water levels, pump operation is ensured since the pump room is sealed to prevent flooding.

Pump head requirements are based on clean-tube friction factors. The containment air coolers have been designed with a cleanliness factor of 75 percent.

The Service Water piping and components in containment are seismic category 1 and therefore eliminates the possibility of radioactivity leaking out of containment through this source in the event of a LOCA. The possibility of radioactive leakage to the service water side of the component cooling heat exchangers is not considered because this would mean a concurrent primary system leak and tube leakage from the component cooling heat exchanger.

No corrosion inhibitors are used in the system. To prevent failure of the piping system due to corrosion, the piping wall thickness used is greater than the minimum required for the design pressures and temperatures.

During emergency operation each normally operating containment air cooler fan receives a Safety Features Actuation Signal (SFAS) to start in slow speed. The slow speed operation of the fans is interlocked with the service water valves of the associated containment air coolers, resulting in the normally open motor operated inlet valves being commanded to open, and the pneumatic operated outlet valves being fully opened. With a safety actuation signal also blocking flow to the cooling water heat exchangers, the system is ensured of having redundant paths available for safe operation.

However, in the event of a loss of offsite power (LOOP), a possibility exists for a water hammer in the Containment Air Coolers Service Water piping due to the stopping and subsequent restarting of the Service Water Pumps. To mitigate the pressure transient experienced due to the water hammer event and prevent damage to the Service Water piping and Containment Air Cooler coils, this piping and the Containment Air Cooler coils are isolated following a LOOP. To accomplish this, the Containment Air Cooler Service Water inlet valves (SW1366, SW1367 and Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-6 UFSAR Rev 31 10/2016 SW1368) are signaled to close upon restoration of electrical power following the LOOP event.

Service Water flow to the Containment Air Coolers is then manually restored if the CAC fans were operating in fast speed prior to the LOOP. If the CAC fans were operating in slow speed prior to the LOOP, Service Water flow will be automatically restored (in the same sequence that occurs when a LOCA signal is present, as described in the following discussion). If a LOCA signal is present in conjunction with the LOOP, the inlet valves automatically open, following a time delay, to a preset throttled position, if the associated CAC fan is running, to refill the Service Water piping. Once the piping is refilled, the Containment Air Cooler Service Water inlet valves fully open to establish design flow rates through the coils.

Although LOCA and a seismic event are not assumed to occur together, non-seismic equipment can not be credited to mitigate consequences of a LOCA. Since the instrument air system is not seismically qualified it can not be credited following a LOCA. Post-LOCA dose rates in the mechanical penetration rooms are high and will prevent entry to manually close the pneumatic operated outlet valves. Therefore, to cope with the postulated loss of instrument air, the pneumatic operated outlet valves are provided with backup nitrogen tanks to support the containment cooling and containment isolation functions. The air tanks are sized to support three valve strokes and maintain the valves closed for thirty days.

The forebay supply line from Lake Erie and the Service Water Discharge lines to the cooling Tower are not seismically qualified. Therefore, although LOCAs and seismic events are not postulated to occur concurrently, these pipes may not be credited for accident mitigation.

Analyses have been performed to demonstrate that all post-LOCA safety functions will be performed despite the adverse function of these parts of the system. In the event that one of the non-seismic Service Water discharge lines is in use when a LOCA occurs, the line may be partially or completely blocked. If the pressure in the safety-related common discharge header rises above the setpoint of PSH2930 and PSH2929, one of the seismic flowpaths will be automatically established. Should the common discharge header pressure remain below the pressure switch setpoint, administrative controls have been established for the operators to manually establish a safety-related Service Water discharge flowpath. The automatic transfer and manual actions assure that a safety-related Service Water discharge flow path is always established. To prevent Forebay level from falling below 562 feet IGLD, the administrative controls also require that flow through the non-seismic path must then be terminated within 2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months of the accident.

Service Water Pump 1 is supplied from Essential Bus Cl, Pump 2 from Essential Bus D1, and Pump 3 from either Bus C1 or D1 by means of manual transfer switches CD. The Service Water pumps will restart after a Loss of Offsite Power. A time delay is included in the circuit.

See Section 9.2.7.3 for additional discussion of the time delay design basis.

The valves and strainers in the independent paths are energized from two independent electrical channels. Valves for Service Water Pump 1 are supplied by Channel 1 via Motor Control Center E12. Valves and strainers for Service Water Pump 2 are supplied by Channel 2 via Motor Control Centers F12. Valves and strainers for Service Water Pump 3 are supplied

from either Channel 1 or 2 by means of manual transfer switches.

A single-failure analysis has been made on components of the system to show that a single failure of any component as shown in Table 9.2-3 will not prevent fulfilling the design functions.

When Service Water inlet temperature is less than the maximum design value, it is possible to provide the required heat removal duty of safety and non-safety related heat exchangers with Service Water flow rates below the design value. At sufficiently low temperatures, Service Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-7 UFSAR Rev 31 10/2016 Water may be manually bypassed through the spare CCW heat exchanger to maintain more desirable Service Water pump flow and discharge pressure. When operating in this manner, operating limits ensure that all safety related heat exchangers are capable of immediately providing adequate cooling capacity following a safety actuation signal. Following accidents where it is required, the Service Water system will be manually realigned to terminate bypass flow operation. This will be accomplished before design heat removal capability can be adversely impacted by any subsequent increase in forebay temperature.

9.2.1.4 Tests and Inspection

Except for the underground piping, the equipment, piping, valves, and instrumentation are arranged so that all items can be visually inspected. The containment air cooling units and associated piping are located outside the secondary concrete shield around the reactor coolant system loops. Personnel could enter this area of the containment vessel during station operation for emergency inspection and maintenance of this equipment. Operational tests and inspection were performed prior to initial startup to demonstrate the capability of the Service Water System to respond to an SFAS signal. The method used was to insert an SFAS signal with the system in normal operation to initiate SFAS operation.

9.2.1.5 Instrumentation

The operation of the service water system is monitored by the following instrumentation:

a. Pressure indicators and low-pressure alarms on pump discharge lines

b. High differential pressure alarms on strainers in pump discharge lines

c. Temperature indicators in supply headers to the service water system

d. Pressure indicators for the supply to each emergency core cooling system room cooling coil units

e. Deleted

f. Temperature indicators on the return lines from the containment air coolers, component cooling, and cooling water heat exchangers

g. Remote indication of service water pump motor bearing and stator temperature

h. A test point in the service water tunnel to determine system flow

i. Pressure indicators on the return side of the component cooling water heat exchangers

j. Flow elements and pressure differential indicators in piping to determine flow to individual and combined flow to the ECCS Room Cooler coils

k. Flow elements and pressure differential indicators in piping to determine individual flows to containment air coolers

l. Computer alarms to ensure proper operation of the service water return header valves Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-8 UFSAR Rev 31 10/2016

m. Redundant alarm channels warn of abnormal forebay level. Each channel has a high-level, low-level, and low-low-level alarm. Each channel is powered and routed separately.

n. Flow elements and associated pressure differential indicators to determine flow through individual CREVS water cooled condensers during tests.

Pressure differential switches on service water pump strainers reset to 1.9 psid (strainer motor starts and blowdown valve opens) and 2.5 psid (high D/P alarm). Previous settings were too low for the actual pressure differential experienced in the system at normal flows and with a clean strainer.

Setpoints were changed on PSH 2917A, 2918A, and 2919A to 116 psig, 105 psig, and 114 psig respectively; and on PSH 2917, 2918, and 2919 to 98 psig, 93 psig and 98 psig respectively.

This change allows the strainer blowdown valves to open properly before the relief valves

SW 3963 are activated.

9.2.2 Component Cooling Water System

9.2.2.1 Design Bases

The Component Cooling Water (CCW) System is designed to provide cooling water to reactor auxiliaries and ECCS systems during normal station operation and Design Basis Accident (DBA) conditions. The components of the system are sized on the basis of removing the maximum heat load during normal station operation with 90F service water temperature, and removing maximum heat loads from ECCS components during DBA conditions with service water at the ultimate heat sink conditions.

The system is designed to provide maximum reliability during normal operation and to meet single failure criteria during DBA conditions.

In addition, the CCW System provides cooling water to support makeup pump operation as described in Section 9.3.4.2 during feed-and-bleed operations.

Design parameters for the major components of the system are listed in Table 9.2-5.

9.2.2.2 System Description and Evaluation 9.2.2.2.1 System Description

The functional drawing for the Component Cooling Water System is shown in Figure 9.2-2.

The part of the system required during DBA conditions is separated into two redundant loops, with each loop capable of supplying 100 percent of the cooling water required under those conditions.

During normal operation, one of the loops will supply cooling water to reactor auxiliaries with the other loop in a standby capacity. During DBA conditions the nonessential portion of the system is automatically isolated from both loops.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-9 UFSAR Rev 31 10/2016 The CCW system provides cooling water to the reactor auxiliaries and ECCS systems listed in Table 9.2-4.

Three CCW pumps and heat exchangers are provided so that any one of the pump heat exchanger units can be removed from service for maintenance or repair without reducing the capability or redundancy of the system. Thus, the third pump can take the place of either No. 1 or No. 2 pump in all respect. The electrical scheme for the third pump is described in Subsection 8.3.1.1.3.

During normal station operation one pump is operating and one pump is in standby (in the redundant loop). The third pump is electrically disconnected from the system. Failure of the operating pump initiates an automatic transfer to the standby pump in the redundant loop. Manual valve and electrical alignment is initiated to place the third pump in a standby status in place of the affected pump.

Under DBA conditions, one CCW pump runs in each loop and nonessential components are isolated from the system. No single failure in a loop affects the other loop.

To support makeup pump operation during feed-and-bleed (non-DBA condition) as described in Section 9.3.4.2, a cross tie to the essential CCW header is provided. During normal operation, cooling to the makeup pumps is supplied via the nonessential header which may be isolated during conditions requiring feed-and-bleed operations.

Both CCW loops may be in operation while cooling the primary system below 280 F and maintaining primary temperature below 140F for refueling operations. The length of time two pumps are required is dependent on decay heat load, the auxiliary load, and service water temperature. Refer to Section 9.3.5.2.2 for additional information.

The makeup water for the system is supplied from the demineralized water storage tank.

Seismic Category I makeup is provi ded from the service water system.

9.2.2.2.2 Codes and Standards

The equipment in this system is designed to the applicable codes and standards tabulated in Table 9.0-1.

9.2.2.2.3 System Isolation The component cooling water lines which penetrate the containment have remotely operated isolation valves inside and outside the containment. Note that check valves on each of the three component cooling water lines penetrating containment were installed for the purpose of preventing a post LOCA overpressure condition of the containment penetration piping segments in response to NRC Generic Letter 96-06.

Connections with other systems are provided for makeup, N 2 blanketing, venting, and draining.

All equipment vent and drain lines are equipped with normally closed, manually operated valves.

In the event that a loss of coolant accident results in DBA, the lines supplying the non-engineered safety feature systems will be isolated automatically at SFAS Levels 3 and 4.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-10 UFSAR Rev 31 10/2016 The decay heat cooler, the letdown cooler, and the RC pump bearing internal heat exchanger are the only components having a single barrier between the component cooling water system and the reactor coolant system.

The design pressure and temperature of the barriers confining the reactor coolant exceed operating ranges of the reactor coolant in these components and are as follows:

Decay heat cooler Pressure, psig 450 Temperature, F 350 Letdown cooler Pressure, psig 2500 Temperature, F 600 Reactor coolant pump bearing internal heat exchanger Pressure, psig 2500 Temperature, F 650 The letdown coolers have higher design pressure and temperature than the operating pressure and temperature of the reactor coolant system. Further protection has been afforded the letdown coolers by the installation of a redundant valve on the common inlet to the coolers.

This valve, in addition to the valve on the line to each cooler, provides the necessary redundancy for isolation of the letdown coolers in the event of a tube rupture. Redundant high pressure switches on the CCW side of the coolers actuates the closing of the inlet valves to the

coolers.

The decay heat system is isolated during normal station operation. The decay heat system design pressure and temperature is based on the operating condition in the decay heat removal mode and, therefore, is considerably lower t han the normal reactor coolant system operating condition. The operation of the decay heat system and relationship to the reactor coolant are described in USAR Section 9.3.5.

Depending on the extent of reactor coolant system cooldown, a rupture (failure) of the reactor coolant barrier decay heat cooler tube will have the following consequences:

a. Component cooling water system pipe rupture due to overpressurization:

Component cooling surge tank low level Component cooling water high radiation Component cooling pump discharge line low flow

b. Component cooling water system pipe does not rupture:

Component cooling surge tank high level Component cooling water high radiation Component cooling water system high temperature The above conditions will actuate an alarm in the control room.

The redundant component cooling water and decay heat removal loops would then be utilized for decay heat removal. The CCW system piping has the primary rating of 150 psig at 500F. Therefore, the possibility of pipe rupture is extremely remote.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-11 UFSAR Rev 31 10/2016 The reactor coolant pump internal heat exchanger has higher design pressure and temperature than the operating pressure and temperature of the reactor coolant system. However, if the heat exchanger tube ruptured, the RC pump seal water will leak into the lower pressure component cooling water on the shell side of the heat exchanger. Upon high pressure, a pressure switch in the outlet line will close the motor operated valve on the outlet line of the heat exchanger. The check valve on the inlet line, at the same time, will prevent the RC pump seal water from leaking into the component cooling water system, making it impossible for the pump seal water pressure to extend beyond these two isolation valves.

9.2.2.2.4 Leakage Consideration

A small amount of normal leakage is expect ed from the CCW system. The operator will be alerted to a small increase in leakage rate by an increased frequency of makeup to the surge tank. Leakage detection and isolation for leakage rates in excess of makeup capacity is provided by a series of alarms and automatic valv e closures initiated by level switches on the CCW surge tank.

These are, in order of descending level: high level alarm, low level alarm, automatic isolation of nonessential components not required for reactor operation, and automatic isolation of all nonessential components. The automatic isolation circuitry meets seismic and single failure criteria. In addition, no single failure in the isolation circuitry will curtail cooling water to those components required for reactor operation.

The high level alarm would alert the operator to leakage into the CCW system from another system. If the leakage came from a radioactive component, the radiation monitors (refer to Subsection 11.4.2.2.3), located on the suction header of each loop, will alert the operator to this condition. Those components exposed to normal primary system pressure on one side (the reactor coolant pump seal coolers and the letdown coolers) will be automatically isolated from the CCW system in the event of a tube rupture.

Seismic Category I makeup is available from the service water system in the event that the non-Seismic I makeup supplies are not available after a Design Basis Accident.

9.2.2.2.5 Failure Analysis The single failure analysis presented in Table 9.2-6 was based on the assumption that a loss of coolant accident had occurred. It was then assumed that an additional malfunction or failure occurred either in the process of actuating the emergency system or as a secondary accident.

All credible failures were analyzed. In general, the types of failures analyzed should be unlikely because vital components of the component cooling water system are serving normal functions, and a program of periodic testing is incorporated into the station operating procedures to ensure the operational consistency of each vital component.

9.2.2.2.6 Environmental Consideration

All components serving the emergency function operation in this system are missile protected and are designed for Seismic Class I requirements.

9.2.2.2.7 Prevention of Long-Term Corrosion

The component cooling water is a demineralized water containing corrosion inhibitor. A chemical pot feeder provides chemicals to the system to maintain the concentration of corrosion Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-12 UFSAR Rev 31 10/2016 inhibitor and to control the pH value. Corrosion is kept to a minimum on all components in this system.

9.2.2.3 Tests and Inspection

Preoperational tests and inspection were performed on all components prior to station initial

startup. All components in this system are hydrostatically tested in accordance with the applicable code.

The operated components are all accessible for visual inspection for leaks from pump seals, valve packing, and flange joints.

The leakage tests were conducted on all containment penetration isolation valves prior to station initial startup.

Electrical components, such as switchgear and starting controls, are tested periodically.

9.2.2.4 Instrumentation

The operation of the component cooling water system is monitored by the following

instrumentation:

a. Temperature indicators on the inlet and outlet lines of the component cooling heat exchanger and high temperature alarms on the outlet lines.

b. Pressure indicators on the inlet and outlet line of the component cooling pumps and heat exchangers.

c. Level indicators on each compartment of the component cooling surge tank and high/low level alarm.

d. Flow indicator and low flow alarm on the outlet line of the component cooling pumps.

e. Radiation monitor and alarm on the suction header of each loop.

f. Temperature and pressure indicators on the inlet line of cooling water loops, and temperature indicator on return line.

g. Temperature and flow indicators on the outlet lines of selected components being cooled. 9.2.3 Makeup Water Treatment System 9.2.3.1 Design Bases

The makeup water treatment system is designed to supply high-quality water in sufficient quantity for primary and secondary plant makeup.

Applicable design codes and standards are listed in Table 9.0-1.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-13 UFSAR Rev 31 10/2016 9.2.3.2 System Description The functional drawing for the Demineralized Water System is shown in Figure 9.2-4A.

Under normal operation, Lake Erie water which may be chlorinated at the Intake Structure is

delivered to one of two Chlorine Detention Tanks. Sodium Hypochlorite may also be injected into the tanks. From the Chlorine Detention Tank the water is sent to a vendor supplied processing system. The vendor's system provides all necessary equipment and components to produce demineralized water for makeup to the demineralized water storage tank.

The Clearwell and Clearwell Transfer pumps, originally part of the Makeup Water System, are no longer used to produce primary and secondary plant makeup water. The Clearwell is fed from the Carroll Township Water System. The Clearwell is used as a source of makeup water for the Fire Water Storage Tank.

One of three pumps is then used, as required, to transfer the demineralized water in the storage tank to various points throughout the station, such as the condenser hotwell, condensate storage tanks, and for miscellaneous flushing operations.

Regeneration of the demineralizers is accomplished through the use of sulfuric acid and sodium hydroxide. Regenerant wastes from the demineralizers are transferred to the backwash sump where they are diluted before being discharged to the collection box via the settling basin.

Demineralizer system effluent does not exceed the following limits:

Conductivity 0.3 mho/cm max.

Soluble silica 20 ppb as SiO 2 Note: other system effluent limits are controlled by procedure.

9.2.3.3 Safety Evaluation

The makeup water treatment system is not interconnected with any safety features system and is not essential for safe shutdown of the station.

9.2.3.4 Tests and Inspection

All pressure vessels and piping were hydrostatically tested in accordance with the ASME Code,Section VIII and ANSl B31.1.0, respectively. After the equipment was put into service, a performance test was run to ascertain that the system and equipment were performing

satisfactorily.

9.2.3.5 Instrumentation Operating instrumentation provided to monitor performance of this system includes the

following:

a. Level indication and alarms on all tanks

b. Conductivity indication on the effluent lines of all demineralizers

c. pH indication on the effluent of the neutralizing tank Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-14 UFSAR Rev 31 10/2016

d. Flow indication for proportionate feed of chemicals

e. Discharge pressure indication of all pumps

9.2.4 Potable and Sanitary Water Systems 9.2.4.1 Design Bases

The domestic water system is designed to furn ish potable, sanitary, and area wash water throughout the station.

Applicable design codes and standards are listed in Table 9.0-1.

9.2.4.2 System Description

The functional drawing for the Domestic Water System is shown in Figure 9.2-5.

The source of water for the Domestic Water System is the off-site Carroll Township Water System. This water is taken from Lake Erie west of the Davis-Besse site, filtered and treated to meet the requirements of the Ohio EPA. The Carroll Township system pressure is maintained by the use of an elevated 500,000 gallon storage tank with a maximum water level of 742.5 feet ILG which provides sufficient pressure to supply all station needs.

Radioactive contamination or chemical/biological contamination of Domestic Water is prevented by the actions listed below.

1. There are no direct connections to any contaminated systems.

2. Backflow prevention devices are used when connecting to industrial uses of the system.

3. Use of hose connections to potentially radioactive contaminated sources is controlled by station procedures.

9.2.4.3 Safety Evaluation

The domestic water system is not interconnected wi th any safety features system and is not essential for safe shutdown of the station.

9.2.4.4 Tests and Inspection

Inspection and testing conformed to the requirements of the prevailing revision of the Ohio Building Code to ensure compliance with Chapter BB-51, plumbing. All pressure vessels were hydrostatically tested in accordance with the ASME Code,Section VIII.

9.2.4.5 Instrumentation

Operating instrumentation provided to monitor performance of this system includes the

following:

a. Domestic Water Header Pressure Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-15 UFSAR Rev 31 10/2016

b. Temperature indication of hot water system 9.2.5 Ultimate Heat Sink

The ultimate heat sink for this station is Lake Erie, which is the source of cooling water for the service water system. This single water source is utilized for both normal and emergency shutdown conditions. Lake water is conducted through the intake water system to the intake structure, where the service water pumps are located.

An open forebay area ahead of the intake structure serves as a reservoir for an ensured source of water in case of an extreme lowering of the lake due to meteorological conditions or collapse of the intake canal or submerged pipes. The effects of high and low lake levels and maximum probable wave action are discussed in Subsection 2.4.5 and Section 3.4.

The system described herein complies with Safety Guide 27. A further discussion of compliance is given in Section 2.27 of Appendix 3D.

9.2.5.1 Loss of Intake Canal

The most severe natural phenomenon, which will cause partial loss of the ultimate heat sink, is a loss of the intake canal due to an earthquake. Since the intake canal is categorized as Seismic Class II beyond approximately 700 feet from the intake structure, it has been postulated that the intake from the lake collapses as well as an incredible collapse of the sides of the Seismic Class II portion of the intake canal. All water flow from the lake to the intake canal was assumed stopped. The seismic class II intake canal collapse was assumed to leave one-third of the water surface area and one-third of the water volume from the seismic class II portion of the intake canal.

In the unlikely event of loss of the intake canal, the reactor will be tripped, and station will be maintained at hot standby with the auxiliary feedwater pumps for as long as condensate storage and other demineralized water storage is available. Assuming the minimum condensate storage tank volume allowed by Technical Specifications being available for the auxiliary feedwater pumps, the station can be kept at hot standby for 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months (additional condensate storage tank water would be available, but the transfer to the ultimate heat sink after 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months is conservative for this analysis). In this situation. Auxiliary Feedwater pump suction will be transferred to the Service Water system a minimum of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months after loss of the intake canal.

The water stored in the intake canal forebay below elevation 562 feet will provide sufficient cooling surface to continue cooling the station by evaporation for at least 30 days. However, it is estimated that 14 days should provide sufficient time to reestablish direct water flow communication between the lake and the station intake structure via the intake water system.

The design incorporates a Seismic Class I return line from the service water system to the intake canal Seismic Class I area forebay.

In order to support License Amendment 242 to in crease the service water temperature from 85 F to 90F, additional evaluations of the ultimate heat sink have been performed (Reference 6), which considered a LOCA with an intake water system loss of connection of Lake Erie. These analyses form the design basis for the ultimate heat sink temperature of 90 F at the time of accident initiation. The transient ultimate heat sink temperature following the accident, Figure 9.2-6, is used to determine the containment pressure, temperature response Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-16 UFSAR Rev 31 10/2016 and equipment qualifications in containment. Consequently, old analyses have been removed from the USAR.

The ultimate heat sink transient temperature analysis has been performed using the VPLUG computer program, which is a Bechtel Corporation standard computer program. VPLUG program is a one dimensional multilayer computer program that simulates the transient temperature response of the cooling ponds based on plant operating conditions and assumed meteorological conditions. The major assumptions used in the computer program are:

1. All mixing in the pond, including interfacial mixing between layers, can be simulated by a single constant entrainment ratio.

2. All heat exchange with the environment is through the free water surface of the pond. 3. Longitudinal mixing is negligible.

The ultimate heat sink computer model was developed and calibrated using onsite meteorological data and observed ultimate heat sink temperature data from the summer of 1995. Then the model was tested using the onsite meteorological data from 1988. These two years were selected because the ultimate heat sink temperature approached 85 F during these years. The results of the analysis showed a good correlation between the predicted and observed ultimate heat sink temperatures. The same ultimate heat sink model is used to calculate the post-LOCA transient temperature of the pond using the same conservative meteorological data that was used at the time of original plant licensing.

The time dependent heat input to the ultimate heat sink is conservatively estimated using the energy removal rate from a design basis hot leg break, assuming a constant service water temperature of 85F. The use a constant 85F service water temperature maximizes the heat removal from the containment and thus the heat input to the ultimate heat sink. A service water

temperature of 85F is only used to determine the maximum heat load to the UHS. The heat removal rate and the integrated heat removed are given in Tables 9.2-7 and 9.2-8 respectively. The other assumptions used in the analysis are as follows.

Maximum Temperature:

a. Meteorological Data

Maximum Clear Sky Radiation Hclear 750 LA/day Percentage of possible sunshine, S 0.6 Maximum Net Sky Radiation H net = H clear * (1-65 (1.S)

^2 672 LA/day 2478 Btu/Ft 2/Day Ambient air temperature 81.6 F Dew point 73.7 F Wet bulb temperature 75.7 F Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-17 UFSAR Rev 31 10/2016 Wind speed 7.4 mph

b. Plant Design Data

Elevation 562 ft. IGLD

Surface area 5.166 acres

Water volume, gallons 12,358,686 gallons

Total decay heat (for 30-day period), Btu 31 x 10 9 BTU Minimum time after reactor shutdown the service water pumps are required (hr) 0 Hours

Service water temperature at the start of transient 90 F Maximum UHS temperature 107.6 F Time of maximum temperature 2.3 days Final Intake canal elevation 559.7 ft Additional analyses have been performed to determine the maximum evaporation rate from the ultimate heat sink assuming a dewpoint temperature of 64F and a wind speed of 8.8 mph (Reference 15). These evaluations show that the ultimate heat sink will contain an adequate amount of water to cool the plant for more than 30 days.

The determination of the minimum forebay water elevation required by the Service Water pumps is documented in Reference 10. The analysis was performed with a bounding pump flowrate and fluid temperature. Also, the minimum forebay elevation at the end of the 30-day post-accident analysis period (i.e., maximum evaporation case) was determined by Reference

15. The results show that the forebay elevation at the end of the 30-day post-accident analysis period is greater than the minimum water elevation required by the Service Water pumps.

Therefore, pump NPSH and submergence are acceptable at the end of the 30-day post-accident analysis period.

Basis for Meteorological Conditions:

No weather record was examined; the design criteria were obtained from References 1, 3, and 5. Temperature data in Reference 1 was based on a 30-year period of record from 1931 to 1960. Seventeen stations around Lake Erie were used. Humidity and wind data were as listed in Reference 3 and were based on a 15-year period of record.

The design ambient air, dew point, and wet bulb temperatures and wind speed were determined as follows:

a. Ambient Air Temperature

The mean dry bulb temperature (Td) at Davis-Besse in July (the hottest month) is about 75F (Ref. 1). The standard deviation(s) of Td is about 2.2 F (Ref. 1). Since Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-18 UFSAR Rev 31 10/2016 temperature is a normally distributed parameter, 99.73 percent of the cases are included between

Td - 3s and Td + 3s (Ref. 2)

so a very conservative estimate for the highest daily average

Td is Td + 3s or 75 + 6.6 = 81.6 F This is the extreme mean July temperature. It is exceeded only 0.27 percent of the time, or about once in 370 years.

b. Dew Point

1. Maximum Evaporation When the highest possible evaporation rate for determining water loss, is of interest, the relative humidity (R.H.) for calculating evaporative losses should be a very conservative estimate for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months average R.H. The average relative humidity at Toledo in July is 71 percent. At 1300 local standard time (LST), it is 55 percent R.H. (Reference 3). To maximize evaporation, 55 percent R. H. was assumed to persist for the full 30 days without diurnal variation.

At 81.6F, Td, and 55 percent R.H. the corresponding TW and TDP at 30" atmospheric pressure are (Reference 4):

Wet bulb temp (TW) = 69.7 F Dew point temp (TDP) = 64.0 F 2. Maximum Temperature

When the highest forebay temperature is of interest, the relative humidity (R.H.) for calculating evaporative losses should be a very conservative estimate for the 24-hour average. The average relative humidity at Toledo in July is 71 percent. The extreme condition of R.H. is 76 percent, in August rather than July (Reference 5). At 0700 LST in August, it is 89 percent. To minimize heat transfer, 89 percent was assumed to persist for the full 30 days without diurnal variation. The following temperatures were determined at 89 percent humidity and a dry bulb temperature equal to the July mean plus one standard deviation, i.e., 75 F + 2.2 F = 77.2 F Wet bulb temp (TW) = 75.7 F Dew point temp (TDP) = 73.7 F Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-19 UFSAR Rev 31 10/2016 c. Wind Speed

1. Maximum Evaporation

For the highest evaporation rate, the use of the average wind speed in July is conservative. Near the Great Lakes, extreme high temperatures are rarely coincident with high winds. With the hot period hypothesized, it would not be possible to have winds as high as the average. They would have to be less than average. Use of the average wind speed is probably unrealistically conservative, however, the average was used. The average wind speed for July is 8.8 mph (Reference 5).

2. Maximum Temperature The wind speed used is that for the extreme conditions in August, 7.4 mph (Reference 5). August is used instead of July because it is more conservative. This is the lowest average wind speed for the year, although it would be reasonable to assume even a lower speed. However, there is sufficient conservatism already built into this analysis so that hypothesizing a lower speed is not necessary.

It is not possible to precisely determine the recurrence interval or percent of time the design criteria can be expected to be equaled or exceeded but the lower bound has to be less than 0.27 percent of the time with a recurrence interval of about once in 370 years. It is estimated to be less than 0.10 percent with a recurrence interval of less than once in 1000 years. This far exceeds the intended requirements in Regulatory Guide 1.27, Rev. 1 in which the requirements are normally based on worst conditions observed in only 40 to 100 years of data.

9.2.6 Condensate Storage Facilities

9.2.6.1 Design Bases

Condensate Storage Tanks provide the primary water source for the Auxiliary Feedwater System. The capacity is based on an assumed av ailable inventory sufficient to remove decay heat for thirteen hours plus a subsequent cooldown to less than 280F, under normal conditions. Condensate Storage also has the capability to provide makeup to the turbine cycle.

The storage facility is Seismic Class II. No radioactivity concentration is anticipated in this facility; therefore, only normal surveillance of the storage tank and valves for leakage is

required.

The storage system is subjected to ambient conditions of 50 to 120F and 100 percent humidity.

The storage tank design conforms to AWWA D100 and AWS D5-2.

9.2.6.2 Description The condensate storage system is shown in Figure 10.4-11. Two, 250,000-gallon tanks are provided. The tanks are located within a building adjacent to the turbine building. Normally, both tanks are in use, being interconnected by piping and normally locked opened isolation Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-20 UFSAR Rev 31 10/2016 valves. The tanks provide the suction of the auxiliary feed pumps, motor driven feed pump and startup feedwater pump. The condensate storage system also has the capability to provide

makeup to the turbine cycle.

Level is normally maintained by makeup directly from the 140,000 gallon demineralized water storage tank. The capability also exists to provide makeup through the condenser hotwell.

Three 200-gpm demineralized water transfer pumps are available for makeup supply to the tanks with interlocks permitting any two of the pumps to be operating. The pumps are available provided a sufficient level is maintained in the demineralized water storage tank.

The two 64,000 gallon (each) Deaerator Storage Tanks typically hold an additional 106,000 gallons of condensate.

9.2.6.3 Safety Evaluation

Failure of the condensate storage facilities will not preclude a safe shutdown of the reactor.

Backup water supplies are discussed in Section 9.2.7.3.

9.2.6.4 Inspection

The entire facility is readily available for in-service inspection.

9.2.6.5 Instrument Application The following instrumentation is provided to monitor this facility:

a. High/low tank level alarms

b. Remote and local tank level indication 9.2.7 Auxiliary Feedwater System

9.2.7.1 Design Bases

The auxiliary feedwater system is designed to provide feedwater to the steam generators when the turbine-driven main feedwater pumps are not available or following a loss of normal and reserve electric power. All components and pi ping in the system are designed to Class I requirements, except the condensate storage tank supply sources, and are tornado protected.

Applicable design codes and standards are shown in Table 9.0-1.

9.2.7.2 System Description

The functional drawing for the auxiliary feedwater system is shown in Figure 10.4-12A. On station shutdown, the auxiliary feedwater pumps can be used to remove decay heat until the decay heat removal system can be placed in serv ice. The auxiliary feedwater system consists of two steam turbine-driven feedwater pumps, condensate storage tanks, suction and discharge water piping, steam piping, valves, and associated instrumentation and controls. The pumps take suction from the condensate storage tanks, or from the Seismic Class I service water

system. A connection is provided to allow the fire protection system to supply water to the pump suctions. The turbine driver receives steam from the steam generators and exhausts to the atmosphere. The condensate storage capacity is sized so that a total condensate inventory Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-21 UFSAR Rev 31 10/2016 may be available to the pumps sufficient to remove decay heat for approximately thirteen hours plus a subsequent cooldown to less than 280F under normal conditions (i.e., no loss of offsite power). The steam supply for the turbine drivers is from the main steam headers as shown in Figure 10.3-1 and Figure 10.4-12A. Following a complete loss of normal and reserve power, the auxiliary feedwater system supplies water directly to the steam generators through the auxiliary feedwater nozzles to remove reactor decay heat. Reactor decay heat removal after coastdown of the reactor coolant pumps is provided by the natural circulation characteristics of the reactor coolant system. Use of the auxiliary feedwater system for cooldown is discontinued when the reactor coolant system temperature decreases to about 280 F; further cooldown is accomplished by the decay heat removal system. The Emergency Feedwater System (EFWS) ties into the AFWS to provide a water supply should the AFWS fail during a Beyond-Design-Basis External Event (BDBEE) (see Subsection 9.2.9).

The required pumping capacity to the steam generators is determined by the decay heat removal requirements for a total loss of main feedwater flow transient assuming infinite irradiation at 2,772 MWt which equates to 100.37% of 2817 MWt. Each pump is a horizontal, centrifugal pump with 1050-gpm capacity at 1050-psi head. One pump meets the capacity

requirement.

The maximum particulate size that will be present in the Auxiliary Feedwater Pump (AFP) cooling water lines is determined by the maximum size particulate present in the cooling water source upstream of valves AF13, AF14, SW9 and SW10. The water upstream of these valves is the cooling water source for the AFP cooling water lines. There are two sources of cooling water available for the AFP cooling water. The first water source is the common section of the AFP suction piping from the Fire Protection System (FPS) and the Condensate Storage Tanks (CSS). The second water source is the Service Water System connection isolated by normally closed valves SW9 and SW10 respectively. Therefore the particulate size present in the AFP cooling water lines is dependent upon the size of the particulate matter in the AFP suction line or the SW connection to the AFP cooling water lines.

Strainer S257 is located in the common section of the AFP suction piping from the CSS and the FPS. This strainer has a wire mesh size of 0.120 inches and has been installed to protect the AFP from the large entrained particulate matter from the CSS or FPS that could damage the pumps. This strainer limits the size of the particulate in the water source to 0.120 inches.

Filters F15-1, F15-2 and F15-3 located on the Service Water Pump (SWP) discharge lines limit the particulate size contained in the SW cooling water source to 0.0625 inches. However, during Chlorine System outages zebra mussel infestations can occur. Microbiologically induced corrosion and small infestations of zebra mussels have been discovered downstream of the filters during the Chlorine System outages. The zebra mussel shells range in size from very small up to 0.25 inches long.

The corrosion products that result from M1C are rust fragments. These rust fragments can be as large as 0.25 inches in width. Based on the M1C phenomena, it is possible for the SW source of cooling water to contain fragments as large as 0.25 inches.

To prevent plugging of the pressure reduction orifices RO4979 and RO4980 and plugging of a single stage strainer, two strainers of varying size screen mesh were installed in the AFP cooling water lines. Strainers S503 and S504 have been installed upstream of orifices RO4979 and RO4980 and limit the size of particulate in the cooling water to 0.125 inches. These strainers are the first stage of filtering and prevent the passage of particles large enough to plug the 0.131 inch orifice opening. Strainers S203 and S204 are installed downstream o0020f Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-22 UFSAR Rev 31 10/2016 orifices RO4979 and RO4980. These strainers contain baskets with a mesh size of 0.0625 inches. The purpose of these strainers is to limit the size of particulate matter entering the bearing oil coolers.

9.2.7.3 Safety Evaluation

The Auxiliary Feedwater (AFW) system at DB-1 consists of two safety-grade AFW pumps capable of being actuated and controlled by safety-grade signals that ensure the availability of feedwater to at least one steam generator, under the assumed conditions of a single failure.

System reliability is achieved by the following features:

a. Two turbine-driven pumps are provided.

b. Steam is supplied by separate steam lines from separate steam generators. The lines are physically separated to meet single-failure criterion.

c. In the event of loss of water supply from the condensate storage tanks, an automatic backup is provided from the service water system.

The service water system provides the Seismic Class I backup supply. In addition, a backup supply of water from the fire protection system is available to the auxiliary feedwater system via a manual valve.

d. Feedwater to the steam generators is supplied through lines separate from the main feedwater lines and through separate steam generator nozzles. These lines are also physically separated to meet single-failure criterion. Refer to Section 15.2.8 for the required system flowrate (600 gpm).

e. The suction and discharge feedwater lines and main steam lines are designed to Class I. The interface with non-Class I piping is shown on the flow diagram.

f. The turbines are designed to absorb water slugs carried over with wet steam without injurious effects.

g. The turbines are provided with mechanical hydraulic governors.

h. The turbine pump units are physically separated by a pressure-retaining wall and door (see Subsection 3.6.2.7).

i. DC power is supplied to the auxiliary feed pump steam inlet valve MS-106 and pump outlet valve AF 3870 to ensure divers electric power sources to the valves of the auxiliary feedwater system required to actuate for system functioning.

j. The Steam Generator Level Control Valves (AF 6452/6451) fail open on a loss of power to the valves.

k. Two auxiliary feedwater flow indication systems are provided for each steam generator. Both are Class 1E systems. The Class 1E systems consist of a common orifice plate and two flow transmitters in each AFW line to the steam generator. One flow indicator per AFW train is located on the PAMS panel. Another flow indicator for each AFW train is located on the Center Console in the Control Room.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-23 UFSAR Rev 31 10/2016

l. The Steam Admission Valves to the AFPTs fail safe by opening on loss of air or loss of DC power to the solenoid.

m. The Steam Admission Valves are located close to the turbine to minimize the amount of cold piping and the potential for water slugs entering the turbines.

n. Steam traps have been installed downstream of the Steam Admission Valves. This ensures that any leakage across the Steam Admission Valves does not accumulate in the turbine casing.

o. If the Auto Steam Generator Level Control System should fail, then the Level Control Valves (AF 6452/6451) can be de-energized (fail open) and Steam

Generator Level can be controlled manually from the Control Room (HIS 520A/521A) by varying AFPT speed.

p. The number of valves that require repositioning upon an SFRCS actuation is minimized by having MS 106A, and MS 107A, AF 3870 and AF 3872 in the open

position during modes 1-3.

q. The AFW Isolation Valves (AF 608 and AF 599) are no longer actuated by SFRCS. The valves are normally open motor operated valves with control power removed.

r. To increase the reliability of check valves MS-734 and MS-735 a continuous minimum steam flow may be diverted to feedwater heater E6-2. The continuous flow through the valves lifts the discs off the seats, reducing seat wear. The minimum flow line is shown in Figure 10.4-12A.

Steam Generator level is controlled by modulating solenoid control valves. These valves assume the automatic level control function and the AFPT controller maintains a constant speed at its high speed stop (HSS) setting. Automatic level control is accomplished by comparing a S/G level signal with a level setpoint providing an output signal to the valve controller to position the valve. The level control valves and the AFPT speed can be controlled manually from the

control room.

A cavitating venturi is also provided in each AFW line to the steam generator downstream of the motor driven feedwater pump (MDFP) discharge tie-in. The venturi is designed to limit the maximum flow rate to a depressurized steam generator to 800 gpm.

A main steam line break accident inside containment concurrent with a single active failure will prevent the isolation of AFW flow to the failed steam generator. Operator action would be required to isolate AFW flow to the affected steam generator. This event is analyzed in Section 6.2.1.3 based on assuming a flow rate of 800 gpm to the affected steam generator.

The AFW System is inter-related with several other plant systems due to its design requirements. It interfaces with the Service Water System for a seismic backup suction supply. This also causes indirect interaction with the Essential Electrical Distribution System. AFW also interfaces with the Main Steam System which provides the motive force for the turbine. Due to these interfaces, several sequencing details are included in the design basis of the AFW system to ensure that the systems are properly coordinated. The sequencing is discussed in detail in the following paragraphs.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-24 UFSAR Rev 31 10/2016 In the event of a loss of communication with CST, the volume of protected water within nuclear safety related portion of condensate supply to the AFW Pumps will sustain pump operation until the transfer to an alternate source of water, the Service Water System, is complete. Failures in the pump suction normal supply can occur either due to fouling of the common AFW Suction Strainer, S257, or because the non-nuclear safety related CSTs and the non-nuclear safety related piping from the CSTs to the AFWS are damaged by postulated events prior to or during AFP operation.

Failures in the pump suction supply are initially mitigated by transfer to an alternate source of water, the Service Water System. Low-pressure switches provided on the auxiliary feedwater pump suction line, upon sensing low pressure (5.3 psig for 10 seconds), will automatically open the service water inlet valve. If suction pressure remains low (3.8 psig for 60 seconds) the steam supply valves will close to protect the AFP from significant damage. The low-low suction pressure switches that close the steam supply valves also open contacts in the steam valves'

auto-open circuit to prevent an SFRCS "open" signal from causing the valves to cycle, which could cause valve motor operator damage.

The 60 second delay allows for the return of a Service Water pump following a Loss of Offsite Power. The time delay in closing the steam isolation valves is to be longer than the time required to start and load the Emergency Diesel Generator and to restart the Service Water pump. The low-low pump suction pressure trip time delay therefore has to be coordinated with

the time delay in the restart of the Service Water pump. The Service Water pump restart time delay is required to control the sequencing of loads being placed on the Emergency Diesel Generator. The steam supply valves to AFPT 1-2 will automatically re-open if the low-low suction pressure condition clears and if an SFRCS "open" signal is present. This automatic reopening is not a design function. This feature is not incorporated in the steam valve control circuits for AFPT 1-1, and manual action will be needed to re-open its steam supply valves if they are closed by a low-low suction pressure switch actuation.

A time delay is provided in the Main Steam to AFW Pump Turbine Line low steam pressure trip for Train 2. This time delay provides protection for the specific scenario of a Steam Line Break on Steam Generator 1 with a single failure of Auxiliary Feedwater Pump 1 and a loss of offsite power (see Section 3.6.2.7.1.5 for additional details regarding the mitigation of Steam Line Breaks). If MS-5889B, No. 2 Turbine Steam Admission valve, opens prior to power being available to open MS-107, Main Steam to AFWP Turbine 2 steam isolation valve, the steam line will begin to depressurize and the low steam pressure switches' setpoint may be reached. However, when off-site power is lost, the time delay relay loses power and drops out. This prevents the low steam pressure switches, PSL107A-D, from generating steam valve close/open-inhibit signals even if steam pressure fails below their setpoint. When power is restored, MS-107 receives power and begins opening if either an SFRCS or a manual open signal is present, and the steam line will begin to repressurize. Power will also be restored to the time delay relay. If pressure fell below the steam pressure switches' setpoint, the steam line will repressurize adequately before the time delay expires, resulting in MS107 remaining open.

The Train 1 side of AFW does not have a similar time delay because valve MS-106 is DC powered and can respond immediately to an open signal. This prevents the steam line depressurization scenario described above from occurring on Train 1.

9.2.7.4 Tests and Inspections

All active components of the system are accessible for inspection during normal station operation. The auxiliary feedwater pumps will be tested periodically during station operation in accordance with Davis-Besse Technical Specifications.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-25 UFSAR Rev 31 10/2016 9.2.7.5 Instrumentation

Operating instrumentation provided to monitor performance of this system includes the

following:

a. Turbine speed

b. Pump suction and discharge pressure

c. Pump and turbine high-vibration computer point

d. Pump bearing oil and turbine bearing metal temperatures.

e. Turbine control valve steam pressure

f. Low condensate storage tank level alarm

g. SG startup LVL

h. SG press outlet

i. SG AFW inlet flow

j. Minimum recirculation and test line flow indication

k. Condensate level in AFPT casing

The auxiliary feedwater system instrumentation is discussed in Subsections 7.3 and 7.4.1.3.

9.2.8 Motor Driven Feedwater Pump

9.2.8.1 Design Basis

The Motor Driven Feedwater Pump (MDFP) provides feedwater to the steam generators during normal plant startup and shutdown (see Section 10.4.7.2). The MDFP is also designed to provide a backup supply of feedwater to the steam generator in the event of a total loss of both auxiliary and main feedwater. The MDFP is non-safety related. However, the pump provides a diverse means of supplying auxiliary feedwater to the steam generators and thus functions as a backup to the nuclear safety re lated auxiliary feedwater system.

9.2.8.2 System Description

The functional drawing for the MDFP is shown in Figure 10.4-12. The pump can be aligned to take suction from the condensate storage tanks, deaerator storage tanks, or the service water system. The pump discharge can be aligned to either the auxiliary feedwater system or the main feedwater system. During plant operation when reactor power is greater than 40%, the MDFP is aligned as a backup auxiliary feedwater pump capable of delivering water to both steam generators.

The MDFP is a horizontal, eight stage centrifugal pump with approximately an 800 gpm capacity at 1050-psi head.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-26 UFSAR Rev 31 10/2016 9.2.8.3 Safety Evaluation

The Motor Driven Feedwater Pump is non-safety related. It provides a diverse means of supplying auxiliary feedwater to the steam generators thus improving the reliability and availability of the auxiliary feedwater system.

Increased auxiliary feedwater system reliability and availability is achieved by the addition of the MDFP through the following features:

a. The pump is motor driven to provide a power source diverse from the steam turbine driven main and auxiliary feedwater pumps.

b. The pump can take suction from the condensate storage tanks and discharge water to either steam generator.

c. The pump is sized to provide approximately the same capacity as one auxiliary feedwater pump.

d. The pump and auxiliary components are capable of being supplied by either emergency diesel generator in the event of a loss of offsite power.

e. The capability exists to start the pump and control auxiliary feedwater flow to the steam generators from the Control Room.

In the event of a line break in the steam supply piping of one auxiliary feedwater pump turbine and a single failure in the redundant auxiliary feedw ater train, the motor driven feedwater pump is capable of providing auxiliary feedwater to the steam generators.

9.2.8.4 Tests and Inspections

All active components of the system are accessible for inspection during normal station operation. The MDFP will be tested periodically during station operation in accordance with Davis-Besse Technical Specifications.

9.2.8.5 Instrumentation

Operating instrumentation provided to monitor performance of the MDFP includes the following:

a. Pump suction and discharge pressure

b. Pump flow

c. Pump motor current draw 9.2.9 Emergency Feedwater System 9.2.9.1 Design Basis

The Emergency Feedwater (EFW) system is designed to support the site's Diverse and Flexible Coping Strategies (FLEX) for a Beyond Design Basis External Event (BDBEE). The EFW System does not perform any design basis functions. The EFW System provides feedwater to Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-27 UFSAR Rev 31 10/2016 the steam generators should the Auxiliary Feedwater (AFW) system become unavailable. All components and piping in the system are designed to Seismic Class I requirements and are tornado protected. Applicable design codes and standards are shown in Table 9.0-1.

The Nuclear Energy Institute (NEI) established the requirements to maintain the capability for core cooling for beyond design basis events in the NRC-endorsed NEI 12-06, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide (Ref. 16). FENOC evaluated, per the guidance of INPO Event Report (IER) 11-4, the ability to cope with a beyond design basis event consistent with the NEI 12-06 requirements. The assessment considered the consequences of seismic, wind, or flooding events that result in the loss of non-safety related equipment concurrent with a total site loss of all AC power. Utilizing only installed and portable equipment protected from seismic, wind, and flooding events consistent with the guidance of NEI 12-06, FENOC concluded a robustly protected auxiliary feedwater source is required for DBNPS. The EFW Facility (EFWF) and EFW System provides the auxiliary feedwater source and the motive force to provide water to the steam generators and to support the FLEX strategies.

9.2.9.2 System Description The functional drawing for the emergency feedwater system is shown in Figure 9.2-7. The primary function of the emergency feedwater system is to serve as a backup source of

feedwater to the steam generators following a BDBEE. In addition, the system is designed to supply non-borated makeup water to the spent fuel pool or to the reactor coolant system. The emergency feedwater system consists of one diesel engine-driven pump, emergency water storage tank, suction and discharge water piping, fuel oil piping, valves, and associated instrumentation and controls. The pump takes suction from the emergency water storage tank.

A connection is provided to the storage tank to allow refill from the demineralized water system, the fire protection system, or other available water supply. The diesel engine receives fuel oil from the 6,000-gallon storage tank located on 603'-0" elevation of the Emergency Feedwater Facility.

The 290,000-gallon emergency water storage tank is sized so that a sufficient inventory of water is available to remove decay heat, cooldown the primary system to 280°F, and makeup any spent fuel pool boiloff for more than twenty-three hours (Ref. 17 - C-ME-050.05-001).

The system is equipped to operate with or without plant supplied power. Following manual initiation, the emergency feedwater system supplies water directly to steam generator 1-1 through the auxiliary feedwater nozzles to remove reactor decay heat. Feedwater supply is available to steam generator 1-2 following Operator action to reposition manual isolation valves. As with the auxiliary feedwater system, it is anticipated that the use of the emergency feedwater system for cooldown will be discontinued when the reactor coolant system temperature decreases to about 280°F; further cooldown is accomplished by the decay heat removal system.

The flow to the steam generators is manually controlled to maintain the desired steam generator level and cooldown rate. The emergency feedwater pump is a horizontal, eleven (11) stage centrifugal pump with a minimum of 600-gpm capacity to the system with the steam generator(s) at 1050-psi head.

Demineralized water is the preferred source, while the system is designed to be refilled from other sources as they are available (e.g., Fire Protection System (FPS), Service Water System (SWS), etc.).

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-28 UFSAR Rev 31 10/2016 9.2.9.3 Safety Evaluation

The Emergency Feedwater (EFW) system consists of one non-safety, seismically qualified pump capable of being actuated and controlled either locally or from the Control Room. System reliability is achieved by the following features:

a. One diesel engine-driven pump, seismically qualified, with its own dedicated battery start system.

b. Fuel oil to the diesel is from a 6,000-gallon storage tank located inside of the robustly designed EFWF.

c. The source of feedwater is from a seismically qualified, missile-protected, 290,000 gallon tank which is integral to the EFWF.

d. Feedwater to the steam generators is supplied through the existing AFW lines. The minimum required flow rate of 600 gpm is the same as for the AFWS as noted in Section 15.2.8.

e. The suction and discharge feedwater lines are designed to seismic Class I, and contained in either the protected EFWF, Auxiliary Building, or routed underground between the two buildings.

f. DC power is supplied to a solenoid operated flow control valve from the normal EFWF power source, backup emergency generator, or batteries. The valve is normally open, fails open, with the throttle position manually controlled.

g. The emergency feedwater flow indication to each steam generator is available locally. Indication of total flow to both steam generators is available locally and in the Control Room.

h. There are no valves that require repositioning upon manual initiation for automatic delivery of feedwater to steam generator 1-1.

i. A cavitating venturi is not required for the EFW system since it is manually initiated and controlled.

Refill of the emergency water storage tank is a manual operation, making use of any available source.

9.2.9.4 Tests and Inspections

All active components of the system are accessible for inspection during normal station operation. The emergency feedwater pumps will be tested periodically during station operation.

9.2.9.5 Instrumentation

Operating instrumentation provided to monitor per formance of this system in the EFWF includes the following:

a. Local and remote diesel engine operating indication Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-29 UFSAR Rev 31 10/2016

b. Local pump suction and discharge pressure

c. Local emergency feedwater storage tank level

d. Local emergency feedwater storage tank temperature

e. Local and remote system flow indication

f. Local flow indication to steam generators 1-1 and 1-2

g. Local fuel oil storage tank level

h. Local flow indicator for EFW minimum flow line

i. High emergency feedwater facility sump level

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-30 UFSAR Rev 31 10/2016 TABLE 9.2-1 Service Water System Design Parameters for Major Equipment Inlet water temperature, F 90 (4) Service Water Pumps

Number 3 (100% capacity)

Number normally operating 2 Type Vertical turbine Rated capacity, gpm 10,250 Rated head, ft 160 Motor horsepower 600 Number of stages 2

Emergency Core Cooling System Room Cooling Coils Number of units 4 Number normally operating as required Number for emergency operation 2 in the same room Flow per unit, gpm (emergency) 140 Max. head loss, ft 11 Containment Air Coolers

Number 3 Number normally operating 2 Head loss/gpm each normal operation 2.0 ft/540 (total 1080 gpm) Number required for emergency operation 1 Head loss/gpm for emergency operation 11.6 ft/1600 (total 1600 gpm)

(2) Max Service Water outlet temperature, clean unit 221.3 F (5) emergency operation

Component Cooling Heat Exchangers

Number 3 Number normally operating 1 Head loss 10.4 ft @ 8000 gpm Number required for emergency operation 1 Flow per unit, gpm 7500 (1) Deleted (2) Refer to Subsection 6.2.1.3.2 for analysis using reduced service water flow for emergency operation.

(3) Deleted (4) In support of License Amendment 242 a variable inlet water temperature up to 90 F was evaluated and determined to be acceptable.

(5) The maximum outlet temperature was determined assuming a CAC fan flowrate of 58,000 cfm. This is conservative. The design basis slow speed CAC fan flowrate has been revised to 45,000 cfm.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-31 UFSAR Rev 31 10/2016 TABLE 9.2-2 Average Composition of Existing Lake Erie Water at the Davis-Besse Station*

Calcium (Ca) 45 ppm

Magnesium (Mg) 11 ppm Sodium (Na) 12 ppm Chloride (Cl) 22 ppm Nitrate (NO

3) 12 ppm Sulfate (SO

4) 37 ppm Phosphate (PO

4) 1.5 ppm Silica (SiO

2) 2 ppm P Alkalinity as CaCO 3 6 ppm M.O. Alkalinity as CaCO 3 101 ppm Total Hardness as CaCO 3 154 ppm Free Mineral Acidity as CaCO 3 76 ppm pH 8.1

Suspended Solids 131 ppm Dissolved Solids 225 ppm Dissolved Oxygen 10 ppm

Based on samples from November, 1968 to October, 1970 and analyzed by the Toledo Edison Company.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-32 UFSAR Rev 31 10/2016 TABLE 9.2-3 Single Failure Analysis - Service Water System Component Failure Results 1 Offsite Power Not available Emergency diesels start and supply electrical load to system.

2 Emergency diesels One not available The operative diesel supplies necessary power to one of the redundant system flow paths. 3 Service water pumps One not available The redundant Service Water train supplies adequate cooling to its components.

4 Service water piping Rupture Passive failures of Service Water System piping are not postulated during or following design basis accidents. The following discussion pertains to the postulation of line break events during normal operation.

As discussed in Table 3.6-1, pipe breaks are not postulated in seismic category I systems with fluid pressures less than 275 psig and fluid temperatures less than 200 F. Since the essential portions of the Service Water system are seismic category I, and the system pressure and temperature are less than 275 psig and 200F, rupture of the essential Service Water piping is not postulated.

Rupture of the non-essential, seismic class II SW piping is postulated. The analysis is presented in USAR Section 3.6.2.7.2.16.

5 Essential component Fails to open or The redundant component supplied by the other Service Water train provides the SW isolation valve spuriously closes required function. (e.g., CAC, CCW, or Aux Feedwater Pump suction)

6 Turbine Plant Cooling Valve SW1395 or Service Water flow to components in the affected loop would be reduced. The Water Heat Exchanger SW1399 fails to redundant Service Water train provides adequate cooling to its components. isolation valve close

.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-33 UFSAR Rev 31 10/2016 TABLE 9.2-3 (Continued)

Single Failure Analysis - Service Water System

Component Failure Results

7 CREVS cooler outlet Fails to open or The redundant CREVS cooler will provide adequate cooling to the control room. In Valve spuriously closes addition, a safety-related, air-cooled system is available as a backup to the service water system. 8 SW Strainer Backwash Fails to open This failure could result in the loss of one service water pump. The redundant Service valve Water train supplies adequate flow to its components.

9 Valve SW2945, Service Fails closed or fails This failure is not credible since the air supply to the valve operator has been isolated Water strainer blow to remain open and the valve is permanently in its failed open position. Failure of this valve to remain down valve to intake open is not postulated. (See Note 1) structure 10 Service water return Fails to close via Operator repositions the valve manually. Postulated failure of a valve to change path isolation valves MOV (due to position when manually operated was not required as part of the original licensing (i.e., SW 2929, either automatic basis. (See Note 1)

SW 2931, and or manual SW 2932) actuation of MOV)

11 SW Discharge to Fails to open SW 2929, SW Discharge to Intake Structure (de-icing line) isolation valve opens Intake Forebay automatically due to high pressure in the return header. Operator subsequently isolation valve, manually opens valve SW2930 and closes SW2929. Postulated failure of a valve SW 2930 to change position when manually operated was not required as part of the original licensing basis. (See Note 1)

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-34 UFSAR Rev 31 10/2016 TABLE 9.2-3 (Continued)

Single Failure Analysis - Service Water System

Component Failure Results

12 Manual valve with Fails closed Passive Failure of manual valves (i.e., failure to remain open) is not postulated under function common to Davis-Besse's licensing basis. (See Note 1) multiple components (e.g., SW82, ECCS room cooler common header outlet valve, or SW2930A, Instrumentation root isolation valve.)

13 Non-Seismic Partially or SW2930 or SW2929 (winter only) opened by manual action or automatic action. Discharge Pipe Completely blocked Operator subsequently closes SW2931 or SW2932.

Downstream or SW2931 and SW2932

Note 1: Davis-Besse's licensing basis does not include passive valve failures that postulate the disc separating from the stem and dropping into the valve seat, blocking flow (i.e., stem-to-disc separation) or failures that postulate a valve failing to change position when locally, manually operated. This licensing basis is consistent with the guidance provided in regulatory documents that were used during the time of Davis-Besse's license application processing (References 9.6.11 and 9.6.12). These documents conclude that passive valve failures need not be postulated as part of post-accident response.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-35 UFSAR Rev 31 10/2016 TABLE 9.2-4 Reactor Auxiliaries and ECCS Systems Supplied by Component Cooling Water

DBA Conditions Normal Operation

Decay heat removal coolers Yes Yes (1)

Emergency diesel generator Yes Yes jacket heat exchangers

Decay heat removal pump Yes Yes bearing housing cooling

High pressure injection pump Yes Yes bearing oil cooling

Containment gas analyzer Yes Yes system heat exchangers

Letdown coolers No Yes Seal return coolers No Yes Radwaste and reactor sample No Yes coolers

Spent fuel pool heat exchangers No Yes Control rod drive coolers No Yes Pressurizer quench tank cooler No Yes Boric acid evaporator packages No Yes Degasifier package No Yes Waste evaporator package (4) No Yes Waste gas compressors No Yes Reactor coolant pumps (motor No Yes air, upper bearing, lower bearing, and pump seal)

Makeup pump lube and gear No (3) Yes oil coolers

__________________

Notes: (1) During cool-down only.

(2) Deleted (3) Required during feed-and-bleed. (Non-DBA condition)

(4) Waste evaporator has been abandoned in place.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-36 UFSAR Rev 31 10/2016 TABLE 9.2-5 Component Cooling Water System Design Parameters and Major Equipment Data (Equipment capacities are for single components)

Component Cooling Pumps Number 3 Number normally operating 1

Type Horizontal, Centrifugal

Rated capacity gpm 7,860 Rated head, ft H2O 150 Motor horsepower 400 Material CS

Component Cooling Heat Exchangers (2) Number 3 Number normally operating 1 (1)

Type Shell and Tube

Heat transferred, Btu/hr 27.4 x 10 6 Shell side (component cooling water)

Normal inlet/outlet temperature, F 102/95 Flow rate, gpm 7,860 Tube side (service water) Normal inlet/outlet temperature, F 90/97.3 Flow rate, gpm 7500 Material, tube/shell SS/CS (1) During winter months, SW may be manually bypassed through the spare CCW heat exchangers as described in Section 9.2.1.3.

(2) Values indicated area performance values determined by approved calculations. Original equipment data may be obtained from specification data sheets.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-37 UFSAR Rev 31 10/2016 TABLE 9.2-6 Single Failure Analysis - Component Cooling Water System

Components Malfunction Comments and Consequences

1. Component Cooling Pump Fails (Stops) This type of failure is considered unlikely, since the same pump performs normal function. Standby pump will serve same function.

2. Component Cooling Heat Fails to perform, tube Standby unit will perform the same function.

Exchanger rupture 3. Surge Tank Leaks The Surge Tank has adequate volume to accommodate minor, operational leakage from the system during normal operation and post-LOCA.

The surge tank is divided by a partition plate into two equal compartments. Each compartment serves a separate loop. This design assures that leaks on one loop do not affect the other loop. Level switches are provided to isolate the non-essential portion of the system upon detecting low levels in the surge tank.

Additionally, system make-up capability exists to compensate for leakage and to reduce the dependence on the redundant loop. Additional details on system leakage considerations are discussed in Section 9.2.2.2.4.

Passive failure of the Surge Tank is not postulated.

4. Decay Heat Removal Cooler Fails to perform Standby unit will perform the same function.

5. Emergency Diesel Generator Fails to perform The second emergency diesel generator is available, the component cooling Heat Exchanger water system will be switched to the standby loop.

6. Component Cooling Pump Sticks closed This type of failure is considered unlikely, since the same pump performs Suction or Discharge Valve normal function. Standby pump will serve same function.

7. Remotely-operated Isolation Fails to open Alternate line (loop) will serve the same function. Valve on Decay Heat Removal Cooler Outlet Line

8. Deleted Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-38 UFSAR Rev 31 10/2016 TABLE 9.2-6 (Continued)

Single Failure Analysis - Component Cooling Water System

Components Malfunction Comments and Consequences

9. Pipe Line Rupture Passive failures of CCW System piping are not postulated during or following design basis accidents.

Note: Section 9.2.2.2.5 specifies that this table is based on the assumption that a LOCA has occurred. The following discussion presents information pertaining to the postulation of line break events during normal operation. This information is not related to post-LOCA single failures, but is included for completeness and clarity relative to passive failures that are postulated in the CCW system.

As discussed in Table 3.6-1, pipe breaks are not postulated in seismic category I systems with fluid pressures less than 275 psig and fluid temperatures less than 200F. Since the CCW piping is seismic category l (except in Containment) as stated in Section 3.6.2.7.2.8, and the system pressure and temperature are less than 275 psig and 200 F, respectively, pipe breaks outside Containment are not postulated.

Ruptures (i.e., critical cracks) are postulated in non-seismic category I portions of the system. Should a critical crack in the non-seismic category I portion of the system inside Containment, a level alarm on the surge tank and flow indicators on the line will both indicate the abnormal condition. Level switches on the CCW surge tank will isolate the leak by closing isolation valves between the non-seismic and the seismic category I portions of the system. This isolation protection meets single failure criteria.

10. Remotely-Operated or Fails to close There are nine isolation valves on component cooling water lines penetrating Self-Actuated Containment containment - three on each of the two supply lines to containment and three Isolation Valve on the combined return from containment. One valve failing to close does not affect the proper function of the system.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-39 UFSAR Rev 31 10/2016 TABLE 9.2-6 (Continued)

Single Failure Analysis - Component Cooling Water System

Components Malfunction Comments and Consequences

11. Remotely-Operated or Fails to close Procedural actions in response to SFAS level 3 or low surge tank level alarms (HV-1495) on Auxiliary require HV-1495 to be verified closed. Operator closes the manual gate valve Equipment Cooling Header upstream of this control valve. Alternate line (loop) will serve the same function.

12. Other essential components CCW fails to provide Redundant component will perform the required function. served by CCW (such as adequate cooling Hydrogen Analyzers, Decay Heat Pump lube oil coolers, High Pressure Injection Pump lube oil coolers)

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-40 UFSAR Rev 31 10/2016 TABLE 9.2-7 Energy Removal Rate for 14.14 Ft 2 Hot-Leg Break (without ECCS Quenching)

Containment Air Decay Heat Cooler Energy Cooler Energy Total Energy*

Removal Rate Removal Rate Rejected Rate Time (sec) (Btu/hr) (Btu/hr) Btu/hr) 100 0.64 x 10 8 - 0.933 x 10 7

500 0.64 x 10 8 - 0.731 x 10 8

1,000 0.64 x 10 8 - 0.731 x 10 8

2,000 0.64 x 10 8 - 0.731 x 10 8 3,000 0.64 x 10 8 - 0.731 x 10 8 4,500 0.50 x 10 8 1.01 x 10 8 1.604 x 10 8

6,000 0.57 x 10 8 1.03 x 10 8 1.692 x 10 8 8,000 0.61 x 10 8 1.07 x 10 8 1.773 x 10 8 10,000 0.63 x 10 8 1.10 x 10 8 1.821 x 10 8

20,000 0.43 x 10 8 1.04 x 10 8 1.57 x 10 8

50,000 0.22 x 10 8 0.72 x 10 8 1.037 x 10 8

100,000 0.15 x 10 8 0.54 x 10 8 0.781 x 10 8

200,000 0.11 x 10 8 0.43 x 10 8 0.631 x 10 8

400,000 0.79 x 10 7 0.33 x 10 8 0.503 x 10 8

800,000 0.57 x 10 7 0.25 x 10 8 0.401 x 10 8 1,000,000 0.54 x 10 7 0.24 x 10 8 0.384 x 10 8

__________________

Includes containment air coolers, decay heat coolers, and auxiliary loads

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.2-41 UFSAR Rev 31 10/2016 TABLE 9.2-8 Energy Removed After a 14.14 Ft 2 Hot-Leg Break (without ECCS Quenching)

Energy Removed Energy Removed by the by the Containment Air Decay Heat Total Energy*

Time (sec)

Coolers (Btu) Coolers (Btu) Removed (Btu) 1,000 0.16 x 10 8 - 0.19 x 10 8 2,000 0.34 x 10 8 - 0.39 x 10 8 3,000 0.51 x 10 8 - 0.59 x 10 8 4,000 0.69 x 10 8 - 0.79 x 10 8 4,500 0.78 x 10 8 - 0.90 x 10 8 6,000 0.10 x 10 9 0.43 x 10 8 1.59 x 10 8 10,000 0.17 x 10 9 0.16 x 10 9 3.55 x 10 8 20,000 0.31 x 10 9 0.46 x 10 9 8.26 x 10 8 50,000 0.56 x 10 9 0.12 x 10 10 18.70 x 10 8

100,000 0.81 x 10 9 0.20 x 10 10 30.49 x 10 8

200,000 0.12 x 10 10 0.34 x 10 10 50.61 x 10 8

500,000 0.19 x 10 10 0.12 x 10 10 95.20 x 10 8

1,000,000 0.27 x 10 10 0.10 x 10 11 153.34 x 10 8

__________________

Includes containment air coolers, decay heat coolers, and auxiliary loads

°°

°

D°

°

°°

°

°°

°

°°°°

°°

°

°°

°

£°

°°°°

°°°°°°

D

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-36 UFSAR Rev 30 10/2014 TABLE 9.3-1 Safety Related Air-Operated Valves Required for Safe Shutdown Valve Safe System Number Position Function Steam generator HV-607 Closed Containment isolation secondary water sample line Containment air cooler TV-1356 Open Maintains service service water outlet** TV-1357 Open water through the TV-1358 Open coolers.

Letdown line to HV-MU3 Closed Containment isolation purification demineralizer

Containment vessel HV-1719A Closed Containment isolation equipment vent header HV-1719B Closed Containment isolation

Steam generator HV-598 Closed Containment isolation secondary water line

Demineralizer water HV-6831A Closed Containment isolation supply line HV-6831B Reactor coolant system HV-1773A Closed Containment isolation drain line to RC drain tank HV-1773B

Containment vessel HV-5005 Closed Containment isolation purge inlet line HV-5006 Closed Containment isolation

Containment vessel HV-5007 Closed Containment isolation purge outlet line HV-5008 Closed Containment isolation

Main steam line* FV-100 Closed Containment isolation FV-101 Closed Containment isolation

Main Steam to Condenser HV-375 Fail Closed Containment isolation Warmup Valves HV-394 Fail Closed Containment isolation

MSIV Bypass Line HV-100-1 Fail Closed Containment isolation HV-101-1 Fail Closed Containment isolation

Main Steam to Auxiliary HV-5889A Fail Open Ensures Main Steam to Feed Pumps HV-5889B Fail Open Auxiliary Feed Pumps Atmospheric Vent Valves PVICS-11A Fail Closed Containment isolation PVICS-11B Fail Closed Containment isolation Pressurizer quench tank HV-232 Closed Containment isolation circulation inlet line Service air supply line HV-2010 Closed Containment isolation

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-37 UFSAR Rev 30 10/2014 TABLE 9.3-1 (Continued)

Safety Related Air-Operated Valves Required for Safe Shutdown Valve Safe System Number Position Function Instrument air supply line HV-2011 Closed Containment isolation

Core flooding tank fill HV-1541 Closed Containment isolation and nitrogen supply lines HV-1544 Closed Containment isolation

Core flooding tank HV-1545 Closed Containment isolation sample lines

Core flooding tank vent HV-1542 Closed Containment isolation line

Pressurizer quench tank HV-229A Closed Containment isolation circulating outlet line HV-229B Reactor coolant pump HV-MU66A Closed Containment isolation seal water supply HV-MU66B Closed Containment isolation HV-MU66C Closed Containment isolation HV-MU66D Closed Containment isolation

Reactor coolant pump HV-MU38 Closed Containment isolation seal water return Pressurizer quench tank HV-235A Closed Containment isolation sample line HV-235B Nitrogen supply to HV-236 Closed Containment isolation pressurizer quench tank

Ventilation of the HV-5301E Closed Isolates the control control room HV-5311E Closed room from outside HV-5361B HV-5362B HV-5301A HV-5311A HV-5301B HV-5311B HV-5301C HV-5311C HV-5361A

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-38 UFSAR Rev 30 10/2014 TABLE 9.3-1 (Continued)

Safety Related Air-Operated Valves Required for Safe Shutdown Valve Safe System Number Position Function Ventilation of the HV-5362A Closed Isolates the control Control room HV-5301D room from outside. HV-5311D HV-5301F HV-5311F HV-5301G HV-5311G HV-5301H HV-5311H Decay heat removal HV-DH14A Fail Open Maintains the operation system HV-DH14B Fail Open of decay heat removal HV-DH13A Fail Closed system. Closes the HV-DH13B Fail Closed bypass on decay heat exchanger.

Component cooling HV-1469 Fail Open Maintains flow through system HV-1471 Fail Open the decay heat removal HV-1467 Fail Open and diesel generator HV-1474 Fail Open coolers. HV-1495 Fail Closed Isolates non-essential HV-1460 Fail Closed load on the system.

Service water system TV-1424 Fail Open Maintains service water TV-1429 Fail Open through the component TV-1434 Fail Open cooling heat exchanger.

__________________

On loss of air, the open position of these valves can be maintained by using nitrogen from the individual nitrogen bottles. Each bottle holds enough gas to maintain the open position, if required, for five days. ** Each of these valves is provided with a backup safety related nitrogen tank, sized to support three valve strokes and to maintain the valve closed for 30 days.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-39 UFSAR Rev 30 10/2014 TABLE 9.3-3 Failure Analysis - Process Sampling System

Component Failure Comments and Consequences

Pressurizer Samples Electrically operated isolation The isolation valves operated by the Safety Liquid or Vapor Space valve inside reactor containment Actuation System satisfy the Single Failure vessel fails to close. criteria, the electrically operated isolation valve external to the containment vessel will close.

Steam Generator, Isolation valve external to the Sample line is not connected directly to the Secondary Side, containment vessel fails to close.

reactor coolant system. The steam generator water and steam provides the first barrier.

Core Flooding Tank Electrically operated isolation Sample line is not connected directly to the valve inside the containment reactor coolant system; core flooding line vessel fails to close check valves provide first boundary. Pneumatically operated isolation valve external to the containment vessel will close.

Pressurizer Quench Electrically operated isolation The electrically operated isolation valve Tank Vapor Space valve inside the containment external to the containment will close.

fails to close.

Sample line from any Line breakage, inside reactor During a loss-of-coolant accident all external of the above components containment vessel, downstr eam isolation valves included in the Safety of any electrically operated Actuation System will be closed.

isolation valve.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-40 UFSAR Rev 30 10/2014 TABLE 9.3-4 Reactor Coolant Quality*

Parameter Value

Boron, ppm Appendix 4B Lithium as 7 Li, ppm 5.0 ppm (Note 1) pH at 582 F 6.9 - 7.4

Dissolved 02 (max.), ppm 0.10 (Limit not applicable with Tave 250 F) C1 (max.), ppm 0.05 H 2, std cc/kg water 25 - 50 F (max.), ppm 0.050 Hydrazine as N 2 H 4 , ppm Critical - not applicable; Subcritical (less than 200F) - as required to control O 2

SO 4 (max.), ppm 0.050 Fe (membrane) (used to monitor crud in RCS, diagnostic only)

Conductivity (diagnostic only)

Total Dissolved Gas, 100 STD cc/Kg water Zinc (max), ppb**

10

__________________

Values were derived following EPRI PWR Primary Water Chemistry Guidelines and provide an environment that is compatible with reactor coolant materials. Chemistry limiting conditions for operation are contained in the Technical Requirements Manual.

- Zinc limit is a steady state limit. The EPRI PWR Primary Water Chemistry Guideline does not address the zinc limit.

Note 1: The operating cycle is initiated with a maximum lithium concentration of 6.4 ppm at zero (0) Effective Full Power Days (EFPD) and 5.0 ppm at 4 EFPD. After 4 EFPD 300 C "at temperature" pH transitions to 7.2 without exceeding 5.0 ppm lithium. When 300 C "at temperature" pH of 7.2 is achieved, the Li/B ratio is controlled to maintain pH at 7.2. The minimum 300C "at temperature" shall be greater than 7.0 whenever nuclear heat is produced and the reactor is critical.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-41 UFSAR Rev 30 10/2014 TABLE 9.3-5 Steam Generator Feedwater Quality*

pH at 25 C 9.3 (1) Dissolved O 2 (max.), ppm 0.003 SiO 2 (max.), ppm 0.01 Fe (membrane) (max.), ppm 0.01 Cu (max.), ppm 0.001 Sodium (max.), ppm 0.003 Chloride (max.), ppm 0.005 Fluoride (max.), ppm 0.005 Lead, ppm

<0.001 Sulfate, (max.), ppm 0.003 Iron, (total) (max.), ppm 0.005 Corrected Cation conductivity (max.), 0.2 mho/cm (due to inorganic anions)

Hydrazine (N 2 H 4), ppb, and/or an amine 20 (2) to ensure a reasonable residual in the event of an oxygen in leakage transient

Values were derived for Steady State operation following EPRI PWR Secondary Water Chemistry Guidelines.

(1) No upper limit is given because pH is regulated to maintain an optimum balance between corrosion control and containment minimization.

(2) Applicable when N 2 H 4 is used for the oxygen scavenger. No upper limit is given as elevated concentrations may be used if additional corrosion protection is required.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-42 UFSAR Rev 30 10/2014 TABLE 9.3-6 (Note 1)

Floor Drain System Piping or Equipment Floor Arrangement Drainage Source of Flooding, Effect, Room Nos. Fig. No. Fig. No. Precautions, and Detection 601, 602 (Note 2) 3.6-2 9.3-8 See Subsection 3.6.2 603 3.6-2 9.3-8 See Subsection 3.6.2 500, 501, 515 3.6-6 9.3-8 See Subsection 3.6.2

427 3.6-7 9.3-9 See Subsection 3.6.2 404 3.6-7 9.3-9 See Subsection 3.6.2

314 3.6-3 9.3-10 See Subsection 3.6.2 304 3.6-3 9.3-10 See Subsection 3.6.2

303 3.6-3 9.3-10 See Subsection 3.6.2 318, 319 3.6-3 9.3-10 See Subsection 3.6.2 320A, 321A 313 3.6-3 9.3-10 See Subsection 3.6.2 236 3.6-4 9.3-11 See Subsection 3.6.2 237, 238 3.6-4 9.3-11 See Subsection 3.6.2

208 3.6-4 9.3-11 See Subsection 3.6.2 209 3.6-4 9.3-11 See Subsection 3.6.2 225 3.6-4 9.3-11 See Subsection 3.6.2

105, 113, 115 3.6-5 9.3-12 See Subsection 3.6.2

112, 116, 117 3.6-5 9.3-12 See Subsection 3.6.2 119, 122, 123 9.3-13 Service Pump Room 3.6-18 9.3-14 See Subsection 3.6.2 and Tunnel Tunnel -- 9.3-15 See Subsection 9.2.1.2 Note 1: This table was generated in response to FSAR question 9.3.4 to identify rooms outside of containment that contained essential equipment and were considered susceptible to flooding.

Note 2: Rooms 705 and 706 are located above, and separated by a metal grating from, Rooms 602 and 601, respectively; thus, for this analysis, Rooms 705 and 706 are considered to be part of Rooms 602 and 601, respectively. Likewise, Room 600 is not separated from Room 601, so Room 600 is considered to be part of Room 601.

°°

°

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-47 UFSAR Rev 30 10/2014 TABLE 9.3-9 Malfunction Analysis of Makeup and Purification System

Component Malfunction Comment

1. Letdown Cooler Tube rupture in one Pressure switches are installed on the cooler shell side of the letdown coolers. A pressure switch is installed on each letdown cooler shell (CCW) side and initiates closure of the associated cooler's tube side (letdown) inlet isolation valve (MU1A/MU1B). A diverse pressure switch is installed on each letdown cooler shell side outlet piping (CCW) which will initiate the closure of the letdown coolers

common inlet (letdown) isolation valve (MU2B). These switches will detect pressurization in the component cooling

water system due to a tube rupture. In the event that both coolers became isolated letdown is restored to the unaffected cooler. The unaffected letdown cooler is sufficient to meet normal makeup operations.

2. Letdown Coolers Loss of cooling water This malfunction results in loss of the flow due to failure of capability for feed and bleed. However, component cooling cold shutdown can still be achieved. water system Boric acid may be added in combination downstream of with the required demineralized water so containment vessel that the total added quantity injected will isolation valve. produce the required soluble poison concentration level as well as the required makeup for contraction (582 F to 140 F) and is approximately equal 3250 ft 3q.

Required volume of 7875 ppm boric acid solution (assuming the CRA of highest worth stuck out of the core) is approxi- mately 1711 ft 3 (12,800 gallons).

3. Block orifice Fails Either of the two full flow control valves in parallel with the block orifice have capability of maintaining normal letdown flow.

4. Makeup Pump Fails while operating Adequate makeup and seal injection flow is provided by the redundant pump.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-48 UFSAR Rev 30 10/2014 TABLE 9.3-9 (Continued)

Malfunction Analysis of Makeup and Purification System

Component Malfunction Comment

5. Makeup Pump Fails to start Adequate makeup and seal injection flow is provided by the redundant pump.

6. Seal Return Cooler Tube rupture in one The failed cooler can be manually Cooler isolated, and the spare cooler can be manually brought on line to provide sufficient seal return and makeup pump re-circulation cooling.

7. Solenoid actuated, Loss of air supply Air accumulators are provided on the air operated air inlet to the valves so that the valves isolation valves will remain in the same position as they outside Containment were prior to the loss of air. Enough air Vessel is available so that the valves will close upon receipt of SFAS signal. The isolation valves in the seal injection lines are equipped with air accumulators to ensure seal injection flow is maintained to the Reactor Coolant Pumps.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-49 UFSAR Rev 30 10/2014 TABLE 9.3-10 Decay Heat Removal System Performance Data

Reactor Coolant Temperature at

Startup of Decay Heat Removal, F 280 Time to Cool Reactor Coolant System

From 280F and a pressure below 260 psig to Refueling Temperature, hr 26* Maximum Refueling Temperature, F 140 Boron Concentration in the Borated

Water Storage Tank, minimum ppm boron 2600

This number was changed to 26 hours3.009259e-4 days 0.00722 hours 4.298942e-5 weeks 9.893e-6 months based on the DB MUR Summary Report. (References 13 & 14)

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-50 UFSAR Rev 30 10/2014 TABLE 9.3-11 Decay Heat Removal System Component Design Data

Decay Heat Pumps

Number 2 Type Single Stage, Centrifugal Capacity, gpm 3,000 Head at rated capacity, ft 350 Motor horsepower, hp 400 Material SS (Wetted parts) Design pressure, psig 450 Design temperature, F 350 Seismic Class I Code Draft ASME B&PV, III Class 2

Decay Heat Removal Coolers Number 2 Type Shell and Tube Heat transferred, Btu/hr 30 X 10 6 (26.9 X 10 6)* Reactor coolant flow (tube), gpm 3,000 Cooling water flow (shell), gpm 6,000 Temperature change, tube/shell, F 140-120/95-105 (140-122/95-104)* Material, shell/tube CS/SS Design pressure, shell/tube, psig 150/450 Design temperature, shell/tube, F 250/350 Seismic Class I Code ASME III-C & VIII

The values in parentheses are from B&W Document 51-1172856-00, dated August 3, 1988, based on input from Atlas Industrial Manufacturing Company for the design normal case heat load assuming degraded Decay Heat Removal Cooler performance as discussed in Section 6.3.1.2.

Borated Water Storage Tank Number 1 Capacity, gal. 550,000 Material SS Design pressure Atmospheric Design temperature, F 125 Seismic Class I Code AWWA D100 Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-51 UFSAR Rev 30 10/2014 TABLE 9.3-12 Chemical Addition System Performance Data

Boric Acid Storage Concentration, wt% 7

Required System Temperature to Prevent Boric Acid Crystallization, F 95 Volume of Concentrated Boric Acid for Cold Shutdown at Beginning of Life (Feed and bleed method), ft 3 813 Volume of Concentrated Boric Acid for Cold Shutdown Near End of Life (Feed and bleed method), ft 3 773 Volume of Concentrated Boric Acid for Hot Shutdown at Beginning of Life (Feed and bleed method), ft 3 574 Volume of Concentrated Boric Acid for Hot Shutdown Near End of Life (Feed and Bleed method), ft 3 524

This table lists historical system performance data. The Technical Requirements Manual shows the current cycle's system performance requirements with respect to minimum boron concentration and volume for Modes 1 through 4.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-52 UFSAR Rev 30 10/2014 TABLE 9.3-13 Chemical Addition System Equipment Data

Boric Acid Mix Tank

Quantity 1 Type Vertical Cylindrical Volume, gal 972 Design Pressure, psig Atmospheric Design Temperature, F 200 Material SS Seismic Class II Code N/A

Boric Acid Addition Tanks

Quantity 2 Type Horizontal Cylindrical Volume, gal 7600 Design Pressure, psig 15 Design Temperature, F 200 Material SS Seismic Class II Code ASME III-C Lithium Hydroxide Mix Tank

Quantity 1 Type Vertical Cylindrical Volume, gal.

50 Design Pressure, psig Atmospheric Design Temperature, F 150 Material SS

Seismic Class II Code NA

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-53 UFSAR Rev 30 10/2014 TABLE 9.3-13 (Continued)

Chemical Addition System Equipment Data

Boric Acid Pumps

Quantity 2 Type Centrifugal Capacity, gpm 25 Head, ft 180 Design Pressure, psig 100 Design Temperature, F 200 Material SS

Seismic Class II Code Draft ASME B&PV, III, Class 3 Lithium Hydroxide Pump Quantity 1 Type Diaphragm, Variable Stroke Capacity, gph 0-10 Head, ft 231 Design Pressure, psig 150 Design Temperature, F 200 Material SS Seismic Class II Code NA

Hydrazine Pump

Quantity 1 Type Diaphragm, Variable Stroke Capacity, gph 0-10 Head, ft 231 Design Pressure, psig 150 Design Temperature, F 200 Material SS Seismic Class II Code NA

Zinc Injection Skid

Zinc Injection Pump

Quantity 2 Type Positive displacement dual diaphragm Capacity, gph 0.01-0.10 Design Pressure, psig 150 Design Temperature, F 150 Material SS Seismic Class II Code N/A Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-54 UFSAR Rev 30 10/2014 TABLE 9.3-13 (Continued)

Chemical Addition System Equipment Data

Zinc Acetate Storage Tank

Quantity 1 Type Vertical Cylinder Volume, gal 60 Design Pressure, psig Atmospheric Design Temperature, F 150 Material SS Seismic Class II Code N/A

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.3-55 UFSAR Rev 30 10/2014 TABLE 9.3-14 Malfunction Analysis of the Chemical Addition System

Component Malfunction Comment

1. Hydrazine Pump Fails to start or The lithium hydroxide pump can be stops manually lined up to supply sufficient hydrazine to the reactor coolant.

2. Lithium Fails to start or The hydrazine pump can be manually Hydroxide Pump stops lined up to supply sufficient lithium hydroxide to the reactor coolant.

3. Boric Acid (BA) Fails to start or Adequate boric acid for feed and bleed Pump stops operation is provided by the redundant pump.

4. Boric Acid Fails to open The throttle valve in the bypass line can Injection Line be manually opened to permit flow. Flow Control

Valve 5. Boric Acid Mix Fails to operate Utilize concentrated boric acid from boric Tank Mixer acid addition tanks or boric acid concen- trate storage tank.

6. Piping from BA Break Same as above. Mix Tank to BA Addition Tank

7. Zinc Injection Fails to start or The zinc injection pumps can be Pump stops manually lined up to supply sufficient zinc acetate to the reactor coolant.

7. BA Addition Break The parallel tank and pump will supply Tank and Lines the required flow. to BA Pumps

8. 2" SS Line Break Same as 7. Connecting the Discharge of the Two Pumps

9. Tracing Failure to heat Same as 7. tanks or lines

°°

°

°°°

°

°°

°

°°°

°

°°°°

°°°

°°

°°°

°°

°°£°

°°°°°

°°

°°°°°°°

°°

°

°°°°

°

°°°

°°°°°°

°°°

°

°°

°

°°°

°°

°°°°°

°°°

°°°°°

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-24 UFSAR Rev 30 10/2014 TABLE 9.4-1 Single Failure Analysis - Control Room Emergency Ventilation System

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesels start and supply electrical load to systems.

2. Emergency One not available The operative diesel supplies necessary diesels power to one of the redundant system flow paths.

3. Control room One not available The standby, 100 percent capacity (for emergency emergency load), control room emergency ventilation ventilation system is available to provide systems suitable temperature conditions in the control room for operating personnel and safety-related control equipment.

4. Control room Rupture of Consideration has been given in the detailed emergency equipment casings design to withstand the design basis ventilation and/or ducts temperature, pressure, and seismic forces systems during a post-accident situation. The equipment and components are also inspectable and protected against credible missiles.

5. Control room Rupture of system Rupture is not considered credible since all emergency piping piping is designed to withstand the design ventilation basis temperature, pressure, and seismic systems forces during a post-accident situation and is inspectable and protected from missiles.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-25 UFSAR Rev 31 10/2016 TABLE 9.4-2 Control Room Emergency Ventilation System Heat Loads

Source Heat Load (Btu/hr)

1. Essential Cabinets

2. Essential Lighting (partial)

3. People (8)

4. Heat Transmission Load

5. Heat introduced into control room (at 95 F) by the intake of 300 cfm of outside air (at 95 F) (Latent Heat)

6. Fan load

Total 104,862 Total heat removal capability for one emergency unit (10 tons nominal) 120,000

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-26 UFSAR Rev 30 10/2014 TABLE 9.4-3 Single Failure Analysis - Low Voltage Switchgear Room Ventilation Systems

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesels start and supply electrical load to systems.

2. Emergency One not available The operative diesel supplies necessary diesels power to the redundant low voltage switchgear room ventilation system.

3. Low-voltage One not available The standby, full capacity, safety-related switchgear ventilation system is available to maintain an room average temperature between 60 F and ventilation 104F in the second low-voltage switchgear systems room.

4. Low-voltage Rupture of casing Consideration has been given in the detailed switchgear design to withstand the design basis tempera- room ture, pressure and seismic forces during a ventilation post-accident situation. The equipment and fans components are also inspectable and protected against credible missiles.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-27 UFSAR Rev 30 10/2014 TABLE 9.4-4 Single Failure Analysis - Emergency Diesel Generator Room Ventilation Systems

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesels start and supply electrical load to systems.

2. Emergency One not available The operative emergency diesel generator diesels supplies necessary power to its own ventilation system.

3. Emergency One not available The standby, full capacity safety-related diesel generator ventilation system is available to maintain room ventilation room temperature between 60 F and 125 F systems using outside air at 95F or less for essential equipment in the second emergency diesel generator room.

4. Emergency diesel One not available One fan in the diesel generator room will generator room maintain 131 F with 70F or less outside ventilation fans temperature, and no reverse flow through the inoperable fan.

5. Emergency diesel Rupture of Consideration has been given in the detailed generator room equipment casings design to withstand the design basis ventilation system and/or ducts temperature, pressure and seismic forces during a post-accident situation. The equipment and components are also inspectable and protected against credible missiles.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-28 UFSAR Rev 30 10/2014 TABLE 9.4-5 Failure Mode and Effect Analysis - Fuel Handling Area Ventilation System

Component Failure Mode Effect and Comments

1. Fuel Handling Area One not available The standby, full-capacity, fuel handling area exhaust fan is Exhaust Fans available to maintain a suitable environment in the fuel handling area.

2. Fuel Handling Area Not available The lack of normal makeup air results in a greater negative Supply Fan pressure being produced in the fuel handling area and infiltration of air from the adjoining radwaste areas.

3. Fuel Handling Area Not available The fuel handling area is connected to the emergency Exhaust Filter ventilation system filters by means of ductwork bypasses and dampers to exhaust the fuel handling area via that system.

4. Dampers in ductwork from One not available The second bypass ductwork damper establishes flow path the fuel handling area to to EVS. EVS (HV 5430A and HV 5430B)

5. Essential solenoid valves One not available Second solenoid valve (in series on a separate channel) is in main pneumatic air line capable of de-energizing on high radiation and bleeding air from respective valves.

6. Dampers on the upstream Power failure during The dampers are manually opened just prior to fuel handling side of EVS filters fuel handling operation. Since the dampers failed position is "as is", they (HV 5024 and HV 5025) will remain open when power failure occurs during fuel handling operation, thus assuring flow path to EVS.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-29 UFSAR Rev 30 10/2014 TABLE 9.4-6 Single Failure Analysis - ECCS Room Cooling Units

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesels start and supply electrical load to systems.

2. Emergency One not available The operative diesel supplies necessary diesels power to one of the redundant system flow path.

3. ECCS pump room One not available Cooling capacity in one room is reduced to cooling units 50 percent of design. The standby, full capacity, ECCS Room Cooling Units are available to maintain a suitable environment for essential equipment in the second ECCS pump room.

4. ECCS room Rupture of Consideration has been given in the detailed cooling units equipment casings design to withstand the design basis temperature, pressure and seismic forces during a post-accident situation. The equipment and components are also inspectable and protected against credible missiles.

5. ECCS room Fails closed This is considered incredible due to the fact cooler combined that the valve is a manual valve. service water outlet header

valve Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-30 UFSAR Rev 30 10/2014 TABLE 9.4-7 Single Failure Analysis - Battery Room Ventilation System

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesels start and supply electrical load to systems.

2. Emergency One not The operative diesel supplies necessary Diesel available power to the redundant battery room Generator ventilation. Affected battery discharges per design. Adequate ventilation is later made available to support recharging.

3. Battery Room One fails Long term redundancy is provided by the Ventilation alternate train batteries and associated System Train/Fan safety-related ventilation system. Annunciator should prompt compensatory action prior to loss of affected battery operability.

4. Battery Room Rupture of duct Consideration has been given in the detailed Ventilation design to withstand the design basis System Train temperature, pressure and seismic forces during a post-accident situation. The equipment and components are also inspectable and protected against missiles.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-31 UFSAR Rev 30 10/2014 TABLE 9.4-8 Single Failure Analysis - CCW Pump Room Ventilation System

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesels start and supply electrical load to systems.

2. Emergency One not available The operative diesel supplies necessary Diesels power to the redundant CCW room ventilation system.

3. CCW Pump Room One fails Redundancy is provided by the alternate Ventilation train 100% capacity safety-related Trains/Fan ventilation fan and outside air louvers, exhaust and recirculation air dampers and controls to maintain room temperature between 60 F and 104 F. Short term (less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , as often as once a year) temperature excursions to 120 F are acceptable.

4. CCW Pump Room Rupture of ducts Consideration has been given in the detailed ventilation system design to withstand the design basis temperature, pressure and seismic forces during a post-accident situation. The equipment and components are also inspectable and protected against credible missiles.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-32 UFSAR Rev 30 10/2014 TABLE 9.4-9 Single Failure Analysis -

Auxiliary Feedwater Pump Room Ventilation System

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesel start and supply electrical load to systems.

2. Emergency One fails The operative diesel supplies necessary Diesel power to the redundant auxiliary feedwater room ventilation system.

3. Aux. Feedwater One fails Redundancy is provided by the alternate Pump Room train 100% capacity safety-related Ventilation exhaust fan and its associated ventilation Exhaust Fan system to maintain between 60 F and 120 F or Train utilizing supply air from the turbine building 110F. 4. Aux. Feedwater Rupture of ducts Consideration has been given in the detailed Pump Room design to withstand the design basis Ventilation temperature, pressure and seismic forces System during a post-accident situation. The equipment and components are also inspectable and protected against credible missiles.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.4-33 UFSAR Rev 30 10/2014 TABLE 9.4-10 Single Failure Analysis - Service Water Pump Room Ventilation System

Component Failure Comments and Consequences

1. Offsite power Not available Emergency diesel start and supply electrical load to systems.

2. Emergency One not available The operative diesel supplies necessary Diesels power to the service water pump room ventilation system.

3. Service Water One fails Redundancy is provided by the alternate Pump Room or safety-related ventilation channel. Two Diesel-Driven 50% capacity fans per channel have Fire Pump adequate capacity to maintain the service Ventilation water pump room at or below 104 F and the Channel (2 fans) diesel driven fire pump room at or below 120 F based on a 95F outside air supply.

One fan per channel has adequate capacity to maintain the service water pump room at or below 104F and the diesel-driven fire pump room at or below 120 F provided the outside air temperature is 86F or less.

4. Service Water Rupture of duct Consideration has been given in the detailed Pump Room or design to withstand the design basis Diesel-Driven temperature, pressure, flow and seismic Fire Pump Room forces during a post-accident situation. The Ventilation equipment and components are also System inspectable and protected against credible missiles.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-1 UFSAR Rev 31 10/2016 9.5 OTHER AUXILIARY SYSTEMS 9.5.1 Fire Protection Program

The DBNPS fire protection program is described in NG-DB-00302, DBNPS Fire Protection Program. The program describes the overall fire protection effort and establishes the fire protection policy for the protection of Appendix R safe shutdown equipment required in the event of a fire and delineates the requirements for controlling changes to the program. The program identifies the various positions, responsibilities and authorities within the organization and addresses Fire Brigade training, controls over combustibles and ignition sources and includes procedures for fire fighting, equipment testing and quality assurance. The program also describes the specific implementation features and the means to limit fire damage to Appendix R safe shutdown equipment required in the event of a fire so that the capability to safely shut down is ensured.

The Fire Hazard Analysis Report (FHAR), which is part of the overall program, documents the analysis that ensures compliance with 10CFR50 Appendix R. Sections III.G, III.J, III.L, and III.O. It also documents the review of BTP APCSB 9.5-1, Appendix A requirements. Additionally, the FHAR contains the fire protection requirements for operability and surveillances and is incorporated by reference into the Davis-Besse Updated Safety Analysis Report (USAR).

The FHAR Section 9.0, Fire Protection Safety Analysis, contains the description of the fire protection systems previously found in this section.

9.5.2 Communications Systems

9.5.2.1 Offsite

Offsite communication are primarily accomplished by utilizing telephone systems and a private Asynchronous Transfer Mode (ATM) network system with built in redundancy.

A third type of off-site communication is provided by using the Toledo Edison mobile radio

frequency communication system. This UHF Radio System also provides onsite communications (see Subsection 9.5.2.2.5).

9.5.2.2 Onsite

9.5.2.2.1 Normal Station Communications System

Internally, the station utilizes a system primarily composed of individual, solid-state amplifier units. The system functions for paging, alarm signaling, and party-line-type voice communications. In plant areas, five channels are provided for regular communications, and an additional five channels are provided for establishing maintenance circuits. Office area amplifier units only have the regular plant area channels. Each station has individual amplifiers for the handset and local speaker(s), and the system has been designed such that failure of any one station will not affect the remainder. Should a station fail, its modular design allows for rapid replacement of components to return it to service.

The Normal Station Communications System includes a station in the Acid Injection Building, so that a person who contacted acid or discovered a leak could communicate the information quickly and conveniently.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-2 UFSAR Rev 31 10/2016 A Gai-Tronics handset unit is provided in the Emergency Lock (to containment) for the possibility of a person becoming trapped there.

9.5.2.2.2 Telephone System

Telephones have been provided for in the normally manned areas, including the Operational Support Center. These phones serve as a backup to the main internal station communications system and function as the primary offsite adm inistrative circuit. The system is powered separately from the main page system. 9.5.2.2.3 Fuel Handling Circuit An entirely separate loop circuit is provided by the Fuel Handling System for the exclusive use of personnel directly involved with fuel handling operations. A remote station is supplied in the control room for monitoring. The components used in this circuit are similar to those of the normal station system. The fuel handling circuit may be supplemented by radio communications.

9.5.2.2.4 DELETED

9.5.2.2.5 Portable Communications (UHF Radio) System

An additional communications system in the form of Ultra High Frequency (UHF) radio is provided.

Portable transceivers arc carried by personnel, and remote fixed transceivers are located at various key locations around the site.

Communications are possible in six different "modes" as follows:

Mode 1 Portable to Portable Mode 2 Portable to Repeater to Remote/Portable Mode 3 Remote to Lindsey Repeater Mode 4 Remote to Acme Repeater Mode 5 Remote to Ottawa County Sheriff Mode 6 Remote to Remote

Operating instructions for this system can be located in plant procedures.

9.5.2.2.6 Sound-Powered Phones

Sound-powered phones are installed to supplement the Normal Station Communications System (Gai-Tronics) which may be lost due to a fire in the Control Room. These phones are hard-wired independent of the Control Room and are provided with headsets that would be plugged in at key locations, including the Auxiliary Shutdown Panel. The headsets are maintained at the key locations. The phones utilize the human voice to generate electric current to ensure communication, and no external power source is required.

9.5.2.2.7 Alarms

Three different alarms, designated Fire, Access Control Area Evacuation, and Initiate Emergency Action Procedures, may be sounded throughout appropriate areas of the station Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-3 UFSAR Rev 31 10/2016 over the paging system. These signals will be initiated by the control room operator and have separate distinctive characteristics. All alarms will run for a preset period of time and may be overridden in case they fail to de-energize.

Visual signals have been installed to indicate alarm and page signals in the Diesel Generator Rooms, Diesel Generator Day Tank Rooms, and the Fire Pump Diesel Room.

9.5.2.2.8 Testing

Periodic maintenance and testing of the amplifier and loudspeakers of the public address system is performed to ensure that each unit is in working condition. The three alarm systems are tested weekly to confirm that each is operable. (See Chapter 14 for initial test procedure.)

The Off-site Communications are tested according to the requirements as stated in the

Davis-Besse Emergency Plan and Physical Security Plan.

9.5.2.2.9 Single Failure Criteria The communications system does not have a safety related function as defined by 10CFR50 General Design Criteria and, therefore, has not been designed to meet single failure criteria.

However, there is a sound-powered phone system located in designated areas of the plant that can be used for communications necessary to control shutdown. This system would remain operable in the event of a serious control room fire that disables the inplant communication system. In addition, the telephone system (Subsection 9.5.2.2.2) and the portable radio system (Subsection 9.5.2.2.5) are considered backups to the main internal system. Also, some sections of the main internal system are supplied by two redundant power feeders from the uninterruptible instrumentation distribution panel. As a minimum, these sections can be found in the Turbine Building, Auxiliary Building, and Containment.

9.5.3 Lighting Systems

The station lighting system utilizes five basic subsystems: 1) normal station and security lighting; 2) AC emergency lighting; 3) AC/DC emergency lighting; 4) Battery-powered lighting; and 5) hand-held lighting.

9.5.3.1 Normal Station and Security Lighting

Normal station lighting is provided by buses C2 and D2 through a double-end fed distribution substation (EF5) with a split-bus arrangement. The bus tie breaker connecting the two buses of this substation is normally open so that each bus is fed separately through a full capacity 4160-480/277 volt transformer. Upon failure of either source, the bus tie breaker will be manually closed and both buses will be fed from the remaining source.

Cooling Tower and switchyard lighting, which is actuated by photoelectric sensors, is provided by a yard distribution center and a switchyard distribution center.

Parking lot lighting is provided by a distribution center located in the Personnel Processing Facility.

Selection of lighting fixtures has been based on the particular area of application. Sodium or mercury vapor fixtures are used only for high bay lighting or out of doors. Fluorescent and mercury lighting is utilized only in areas where no possible contamination of the reactor coolant Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-4 UFSAR Rev 31 10/2016 system or its components could occur, such as the control room and office areas. In the containment and portions of the auxiliary building where such contamination could occur, only incandescent or LED fixtures are used.

The security lighting system has been brought into compliance with NRC requirements.

Some industrial type fluorescent lighting fixtures in the Auxiliary Building have exposed cord connecting the fixture to the lighting circuit outlet box or conduit. The separation distances between these exposed cords (cables in free air) and Class 1E raceway comply with the minimum separation distances given in IEEE Std 384-1992. Additionally, a review by fire protection has determined that the amount of combustible loading caused by these exposed cords does not pose an unanalyzed fire hazard.

While the normal and station lighting may be available, this lighting has not been evaluated for availability in the event of a fire.

9.5.3.2 AC Emergency Lighting AC Emergency Lighting consists of two divisions of lighting circuits fed from essential motor control centers E11C and F11A and serving the Containment, the Auxiliary Building and the Control Room. The lighting circuits for the Auxiliary Building and the Control Room are automatically fed from the Diesel Generators. Lighting for containment must be manually activated.

This lighting is in addition to that provided by the normal station lighting from substation EF5. Redundant feeders and penetrations into the containment are used to preclude the possibility of total loss of lighting.

During modes 5 or 6, the capability exists for powering Containment lighting from non-essential sources when the normal essential sources are deenergized for maintenance. Both non-essential sources will not be used simultaneously so as to preclude a total loss of Containment lighting.

9.5.3.3 AC/DC Emergency Lighting The AC/DC emergency lighting consists of two divisions of lighting circuits serving the Turbine and Auxiliary Buildings and the Control and Cable Spreading Rooms. Emergency lighting is used to provide sufficient illumination for safe evacuation during emergencies. The fixtures are 120V incandescent and will normally be supplied by substation EF5 through an automatic transfer switch. On failure of the EF5 source of power, the switch will cause automatic transfer of the emergency lighting to the 125V DC source for uninterrupted service. The essential DC sources are charged by the Diesel Generators and would be available in excess of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

9.5.3.4 Battery-Powered Lighting

The battery-powered lighting unit system consists of numerous self-contained sealed beam units located throughout the Auxiliary and Turbine Building. The units are subject to a periodic 8-hour discharge test and are maintained operable in accordance with plant procedures and manufacturer's recommendations.

The lighting units are rated at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for discharge to 87.5% of nominal system voltage (6 volts) or 5.25V. The battery charger is fully automatic and capable of restoring the battery to full Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-5 UFSAR Rev 31 10/2016 capacity from 87.5% of the nominal battery voltage. Pilot lights indicate the state of the charge of the battery.

9.5.3.5 Hand-Held Lights

A minimum of ten hand-held lighting units are available for distribution to operators during a fire emergency. The operability of these units is assured by plant procedures. Hand-held lights would be used by the operators for indoor plant areas and access and egress for outside plant areas. Hand-held lights are provided in accordance with current procedure practices to each operator implementing manual safe shutdown actions due to a fire. The use of the hand-held lights would include those areas exposed to a fire in indoor areas that would be entered to perform manual safe shutdown actions after the fire is extinguished. These hand-held lights are provided for manual operator actions in indoor areas as a precautionary/backup measure in case the permanent emergency lighting would not be available as anticipated. The portable lighting in outside areas can provide an equivalent level of Lighting as a permanent lighting system. In addition, in outdoor areas, portable Lighting provides greater flexibility than a permanent lighting system.

9.5.4 Diesel Generator Fuel Oil Storage and Transfer System

9.5.4.1 Design Bases

The fuel supply for the emergency diesel generators is designed to meet the requirements of IEEE-308. The system is designed to with stand damage or loss of function caused by earthquake or tornado. The system includes seven days' storage of fuel oil for each emergency diesel generator. Applicable design codes and standards are listed in Table 9.0-1 and additional detail is given in Subsection 8.3.1.1.4.

9.5.4.2 Description

The emergency diesel generator fuel oil storage and transfer system is shown in Figure 9.5-8. The physical arrangement of the emergency diesel generator day tanks is shown in Figure 9.5-10.

The diesel fuel oil storage and transfer system is comprised of two separate trains. Each train consists of one supply tank, one fuel oil transfer pump, one day tank, and piping between the supply tank and day tank.

Each supply tank has a gross capacity of approximately 40,000 gallons. The tanks are installed above grade elevation; with tornado missile protection provided by a truncated pyramid of structural backfill built around the tanks. Corrosion of the tanks will be prevented by protective coatings, and by cathodic protection if necessary.

The emergency diesel generator day tanks are filled automatically via separate transfer systems which receive fuel oil from the two Emergency Diesel Fuel Oil Storage Tanks.

Each transfer pump is a submersible cent rifugal pump suspended from the supply tank manhole. The pumps have a capacity which is greater than the fuel consumption of its associated emergency diesel generator at its maximum rated load. The fuel oil transfer pump discharge lines run directly to the associated diesel day tank. The underground portion of these lines will be protected from corrosion by protective coatings and cathodic protection. Each pump will be controlled automatically by level switches on the associated day tank. Manual Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-6 UFSAR Rev 31 10/2016 control for each pump is available at either the associated storage tank (below the outer manway) or the associated day tank room.

Each of the two diesel generator day tanks has a capacity of approximately 5,000 gallons, measured from the "start" level for the transfer pump.

Each day tank is located in a separate enclosure, with wet pipe, fusible head type automatic fire protection sprinklers. Flow indicating switches in each sprinkler system are provided for alarm. The day tanks are elevated to provide gravity flow to the suction of the fuel oil pumps for the engine.

The diesel oil system meets or exceeds all requirements of IEEE-308. The system meets ANSI proposed standard N195, "Fuel Oil Systems for Standby Diesel Generators," (1974 Draft) with the following exceptions:

a. No overflow line is provided from t he day tank back to the emergency diesel generator fuel oil storage tank.

b. The emergency diesel generator fuel oil storage tanks do not have high level alarms. Operator monitoring during filling of local level indication precludes

overfilling.

c. No pressure indicator is provided at the discharge of the transfer pumps. Proper operation of these pumps can be verified by observing the fill rate in the day tanks.

d. Fuel Samples are analyzed in accordance with diesel manufacturer recommendations. Out of specification conditions are corrected by filtration, water removal, or fuel replacement as appropriate.

e. Fuel Oil Storage Tanks are drained and cleaned at a maximum interval of ten years.

In addition, the emergency diesel generator fuel oil storage tanks do not have strainers installed on the fill lines.

9.5.4.3 Safety Evaluation

The fuel oil storage required to maintain one emergency diesel generator in operation at is continuous rated load for seven days is approximately 40,000 gallons. To conservatively establish the storage capacity, this volume is based on consumption 10 percent higher than the fuel consumption measured during testing at the supplier's factory; and a conservatively assumed specific gravity of the fuel oil. The required fuel oil capacity is based on both fully loaded emergency diesel generator consumption and fully loaded emergency diesel generator consumption plus 10 percent. A basis for the Emergency Diesel Generator Day Tank capacity, ANSI-N195, requires sufficient fuel oil capacity to sustain fully loaded emergency diesel generator operation for 60 minutes at 110 percent full load consumption. The basis for the combined capacity of the Emergency Diesel Generator Day Tank and the Fuel Oil Storage Tank, IEEE-308, requires sufficient fuel oil capacity to sustain continuous, full loaded emergency diesel generator operation for 7 days.

There is sufficient fuel oil in each day tank to operate its associated diesel generator for more then 19 hours2.199074e-4 days 0.00528 hours 3.141534e-5 weeks 7.2295e-6 months at the continuous rated load.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-7 UFSAR Rev 31 10/2016 The two Emergency Diesel Generator supply trains are completely independent except for a cross connect downstream of the day tanks which permits either diesel engine to be supplied with fuel oil from either tank in an emergency situation. In the event of an extreme emergency, the day tanks can be filled directly from a supply facility through the emergency fill connection.

There is no interconnection between the diesel generator engine fuel oil system and any nonsafety related system.

Each emergency diesel generator engine is operated monthly for test purposes, which keeps the internal surfaces of the system flooded or wetted with oil to reduce any potential corrosive condition. The tanks in the system are included in the station sampling program, and provisions are provided for the removal of any moisture in the system. A single failure of any component in the system will not result in damage to any safety-related systems. This analysis is shown in Table 9.5-3.

Level indication and low level alarms for the emergency diesel generator day tanks are provided in the main control room, as well as a low level alarm for the storage tanks. Level indication and high/low level indicating lights are provided locally at each storage tank.

Offsite diesel oil supply is available from several sources for onsite delivery within a safe margin of time to maintain the continuous operation of the emergency diesel generators.

With the exception of underground piping and tanks, all equipment and components are readily available for inspection.

9.5.4.4 Tests and Inspections

The storage tanks, transfer pumps, day tanks, and transfer piping receive tests and inspections in accordance with the applicable construction code.

Fuel quality and component operability will be verified at regular intervals in accordance with Technical Specifications.

9.5.5 Emergency Diesel Generator Cooling Water System Subsection 8.3.1.1.4.1 describes the operation of the diesel generator jacket water cooling system.

9.5.6 Emergency Diesel Generator Starting System Subsection 8.3.1.1.4.1 describes the diesel generator starting system.

9.5.7 Emergency Diesel Generator Lubrication System Subsection 8.3.1.1.4.1 describes the diesel generator lubrication system.

Davis-Besse Unit 1 Updated Final Safety Analysis Report 9.5-8 UFSAR Rev 30 10/2014 TABLE 9.5-3 Single Failure Analysis -

Diesel Generator Fuel Oil Storage and Transfer System

Component Failure Comments and Consequences

1. Fuel oil Fails (stops) Redundant subsystem is operable. transfer Emergency diesel generator operable by affected subsystem has sufficient fuel for more than 19 hours2.199074e-4 days 0.00528 hours 3.141534e-5 weeks 7.2295e-6 months of operation.

2. Pipe line Rupture Should pipe rupture occur, level alarm on the day tank will indicate the abnormal condition. Redundant sub-system is not affected.

3. Storage tank Leaks or rupture Should tank leaks or rupture occur, level alarm will indicate the abnormal condition. Alternate tank will serve the same function.

L-18-206, Revision 32 to Updated Final Safety Analysis Report, Section 9, Auxiliary Systems

Text

Navigation menu

L-18-206, Revision 32 to Updated Final Safety Analysis Report, Section 9, Auxiliary Systems

Text

Navigation menu

Search