ML18186A129

R. E. Ginna, Unit 1 - Technical Supplement Accompanying Application for a Full-Term Operating License, August 1972

ML18186A129
Person / Time
Site:	Ginna
Issue date:	08/15/1972
From:	Rochester Gas & Electric Corp
To:	US Atomic Energy Commission (AEC)
References
Download: ML18186A129 (157)

Text

Iiggulatory, L- .ge,.

'ECfI'g 5 7gypg.

'UG1 V.S. ATOMlC Et,ERE'OMMIS@Olit

'egulator Mall "Qctlpg cn RSCRESTER 6AS AM6 ELECTRIC C6RP6RNIHN R.E. 6INMA NIICLEAR P6WER PLMT SNIT N6. ll AUGUSY 1972 USA'. i DOCKETE9; AU815 197R ~,:-

REGUlATORY Q~ vAtL s<<cn<<Ngi DOCKET CORK Submit UMIYKD STATES ATGMIC EMERGY COMMlSSION DGGKEY NO. 50-244 45OS S

TABLE OF CONTENTS Section

~Pa e INTRODUCTION CONFIRMATION OF DESIGN AND OPERATIONS A. DESIGN ADEQUACY

l. Discussion of Power Test Program Results (0-1300 MWt)

2. Discussion and Interpretation of Results of Initial Rating (1300 MWt)

3. Evaluation of Escalation Program (1300-1520 MWt)

B. OPERATIONS RESULTS II-4

1. Discussion of Facility and Procedural Changes Made C. ORGANIZATIONAL AND ADMINISTRATIVE ADEQUACY II-10

l. Operators ( Includes Changes, Promotions, etc.)

2. Plant Staff (Includes Changes, Promotions, etc.)

3. Engineering Support

4. Westinghouse Electric Corporation

5. Consultants

6. Advisory Committees ADEQUACY RELATIVE TO CURRENT STANDARDS III-1 A. 10CFR50 APPENDICES III-1

1. Appendix A - General Design Criteria for Nuclear Power Plants

a. Overall Requirements (1-5)

b. Protection by Multiple Fission Products Barriers (10-19)

TABLE OF CONTENTS Section

~Pa e

c. Protection and Reactivity Control Systems (20-29)

d. Fluid Systems (30-46)

e. Reactor Containment (50-57)

f. Fuel and Radioactivity Control (60-64)

2. Appendix B - guality Assurance Criteria for Nuclear Power Plants

3. Appendix C - A Guide for the Financial Data and Related Information Required to Establish Financial gualifica-tions for Facility Construction Permits and Operating Licenses

4. Appendix D - Interim Statement of General Policy and Procedure: Implementation of the National Environment Policy Act of 1969 (Public Law 91-190)

5. Appendix E - Emergency Plans for Production and Uti liza-tion Facilities

6. Appendix F - Policy Relating to the Siting of Fuel Re-processing Plant and Related Waste Management Facilities

7. Appendix G - Fracture Toughness Requirements

8. Appendix H - Reactor Vessel Material Surveillance Program Requirements

9. Appendix I - Numerical Guides for Design Objectives and Limiting Conditions for Operation to Meet the Criterion "As Low As Practicable" for Radioactive Material in 'Light-Mater-Cooled Nuclear Power Reactor Effluents

10. Appendix J - Reactor Containment Leakage Testing for Water-Cooled Power Reactors ll. Appendix L - Information Requested By the Attorney General for Anti -Trust Review of Facility License Applications

TABLE OF CONTENTS Section ~Pa e B. AEC SAFETY GUIDES III-51

1. Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal System Pumps

2. Thermal Shock to Reactor Pressure Vessels

3. Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss-of-Coolant Accident for Boiling Water Reactors

4. Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss-of-Coolant Accident for Pressurized Water Reactors

5. Assumptions Used for Evaluating the Potential Radiological Consequences of a Steam Line Break Accident for Boiling Water Reactors

6. Independence Between Redundant Standby (On-site)

Power Sources and Between Their Distribution Systems

7. Control of Combustible Gas Concentrations in Con-tainment Following a Loss-of-Coolant Accident

8. Personnel Selection and Training

9. Selection of Diesel Generator Set Capacity for Standby Power Supplies

10. Mechanical (Cadweld) Splices in Reinforcing Bars of Concrete Containments

11. Instrument Lines Penetrating Primary Reactor Contain-ment'2.

Instrumentation for"Earthquakes

13. Fuel Storage Facility Design Basis

14. Reactor Coolant Pump Flywheel Integrity

15. Testing of Reinforcing Bars for Concrete Structures

16. Reporting of Operating Information

yg TABLE OF CONTENTS Section ~Pa e

17. Protection Against Industrial Sabotage

18. Structural Acceptance Test for Concrete Primary Reactor Containments

19. Nondestructive Examination of Primary Contain-ment Liners

20. Vibration Measurements on Reactor Internals

21. Measuring and Reporting of Effluents from Nuclear Power Plants

22. Periodic Testing of Protection System Actuation Functions

23. On-Site Meteorological Programs

24. Assumptions Used for Evaluating the Potential Radiological Consequences of a Pressurized Water

~ L5 Reactor Radioactive Gas Storage Tank Failure

25. Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactor

26. guality Group Classifications and Standards

27. Ultimate Heat Sink

28. guality Assurance Program Requirements

29. Seismic Design Classifications C. IEEE CRITERIA

1. Criteria for Protection Systems for Nuclear Power Generating Stations (IEEE 279-1971)

2. Class IE Electrical Systems of Nuclear Power Generating Stations (IEEE 308-1971)

3. Electrical Penetration Assemblies in Contain-ment Structures for Nuclear-Fueled Power Gen-g erating Stations (IEEE 317-April, 1971)

TABLE OF CONTENTS Section ~Pa e

4. guality Class I Electri,c Equipment for Nuclear Power Generating Stations (IEEE 323-Apr i l, 1971)

5. Type Tests of Continuous-Duty Class I Motors Installed Inside the Containment of Nuclear Power Generating Stations (IEEE 334-1971)

6. Installation, Inspection and Testing Require-ments for Instrumentation and Electrical Equipment During the Construction of Nuclear Power Generating Stations (IEEE 336-1971)

7. Trial Use Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems (IEEE 338-1971)

8. Seismic gualification of Class I Electrical Equipment for Nuclear Power Generating Stations (IEEE 334-1971)

STATUS OF PREVIOUS COMMENTS REGARDING R.E. GINNA NUCLEAR P01<ER PLANT UNIT No.l IV-1 A. ACRS LETTER DATED MAY 15, 1969 IV-1

1. Examination of Appropriate Flood Level

2. Strong Motion Accelegraph

3. Examination of-,Potential for Axial Xenon Oscillations

4. Control Rod Malposition Annunciation

5. Accident Related to Dropping of Irradiated Fuel In Spent Fuel Pit

6. Effect of Fast Neutron Fluence On Nil Ductility Transition Temperature

7. Monitoring for Excessive Primary System Vibration

8. I'-Service Inspection O.

TABLE OF CONTENTS Section Paqe B. ACRS LETTER DATED DECEMBER 17, 1971 IV-9

1. Tolerence to Anticipated Transients With Failure To Scram

2. monitoring of Iodine Released With Gaseous Wastes

I. INTRODUCTION This report is submitted in support of the application (AEC Docket 50-244) of the Rochester Gas and Electric Corporation to operate the R.E. Ginna Nuclear Power Plant Unit No.l at a power level of 1520 megawatts thermal under a Class 103 full term license as set forth in Title 10, Part 50, of the Code of Federal Regulation. This unit is presently operating under a Provisional Operating License (DPR-18).

Section II of this report includes operating information which confirms the adequacy of design bases and objectives. It also supports the adequacy of the applicant's organization during the Provisional Operating License period. Siqnificant changes which have been made to the facility are also discussed.

An analysis of the R.E. Ginna Unit No.l'n relation to criteria now being used by the Commission in evaluating new plants is presented in Section III. These criteria include Appendices A through L of 10CFR50, the "Safety Guides for Mater Cooled Nuclear Power Plants"

'1 through 29), and current IEEE Standards.

Section IV presents discussions of all items which have been included in the two ACRS letters for operation of the R. E. Ginna Nuclear Power Plant Unit No. l.

II. CONFIRMATION OF DESIGN AND OPERATIONS A. DESIGN ADEQUACY The Start-Up Test Program at R.E. Ginna Nuclear Power Plant Unit No. 1 was performed in order to ensure the safe and efficient operation of the plant up to its initial rating of 1300 megawatts thermal. The results of the initial testing have been previously submitted.

The reactor was shown to be stable at all power levels up to 1300 megawatts thermal with induced disturbances to the reactor system.

Perturbations to the secondary system were 104 load swings, 50K load reductions, and 100K turbine trip. Control rods were used for a dynamic rod drop test, ejected and dropped rod worth measurements, and a xenon oscillation test. Maximum and/or minimum values of critical reactor system parameters during plant transient tests were within allowable limits. In addition, core thermal-hydraulic limits were not exceeded for steady-state or transient situations.

A revision to the operating license was issued on March 1, 1972 which authorized an increase in the plant output from 1300 to 1520 megawatts thermal. A diverse and thorough testing program was used in the power escalation performed from March 8 to March 14, 1972. For conservatism, the power escalation was performed in several steps with a number of tests being performed at each step. These tests included flux and delta-T maps, calorimetric checks, steam generator carryover measurements, containment radiation surveys, and primary coolant i

activity level measurements. In addition, the response of system components to increases in core power output was studied. The reactor'

was operated for a short period at 1520 MWt and performed satisfactorily.

Core physics parameters agreed well with design data and there was con-siderable margin to core safety limits. Core instrumentation continued to accurately reflect the behavior of the core. A detailed discussion of the uprating test program has been presented.

The Ginna Station has operated with leaking fuel assemblies since shortly after reaching full power. Although this condition is not de-sirable, it has demonstrated that the station was adequately designed to permit operation without excessive doses being received by the opera-ting personnel. This condition has also allowed a thorough evaluation of the radioactive waste systems. As indicated in the semi-annual reports, the waste systems, with minor modifications discussed later, have dem-onstrated their ability to maintain effluent releases to a small per-centage of the allowable release limits.

The in-service inspection program as described in the Technical Specifications exceeds, in many areas, the inspection requirements of Section XI of the ASME Boiler and Pressure Vessel Code. The inspections that have been conducted at the Ginna Station during the first two re-fueling outages have been in excess of those required. At present ap-proximately 75/ of the five year requirements have been completed.

Since the core was completely unloaded during the March 1971 re-fueling outage, the opportunity was taken to lift the lower internals structure and to include in the inspection all areas of the internals and reactor vessel. The results showed that the design is satisfactory, and no problem areas are evident.

During the Spring 1972 refueling outage, the steam geherator tube sheets were examined for cladding separation. No indications of cladding separation were observed.

B. OPERATIONS RESULTS Semi-annual Operating Reports have been submitted starting with the period ending April 25, 1970. These reports cover primarily the statistics of plant operation, maintenance, waste disposal, and environmental monitoring.

The following is a list of principal changes made as the result of initial operating experience:

1. Check valves were installed in the high head safety injection lines downstream of the motor operated loop isolation valves.

This was to allow the motor operated valves to remain open during normal plant operation, thus, decreasing delivery time of boric acid after a safety injection signal.4

2. The hot leg safety injection motor operated isolation valves were removed from the group of valves to be automatically opened by a safety injection signal. These valves will be maintained in a closed position during normal operation.5

3. The primary coolant resistance temperature detectors expe-rienced their first failures early in plant life. Before com-mercial operation all of the RDF detectors were replaced with Rosemont RTDs. There have been no failures experienced since October 1970.

4. Prior to commercial operation the boron lined source range detectors were replaced with BF3 detectors. The boron lined detectors had experienced failures due to difficulties with the quenching gas and failure of the boron plating to hold.

Continued detector failures have prompted the use of detectors with an integral cable. This precludes connector failure and reduces the electronic noise at the detector cable.

5. The pressurizer spray bypass valves were replaced with bellows seal valves to alleviate packing leakage.

6. Fifty-six anchor bolts for the steam generator and reactor coolant pump support legs'were replaced after four had failed.

7. Supports were added to the pressurizer safety valve lines to reduce the stress on the lines during valve operation."

8. Supports were added to the main steam line safety and relief valves to reduce the stress on the main steam line during the valves operation.

9. A relief line was added to the bonnets of the double disk gate valves 850A and 8508 on the RHR system to relieve any pressure buildup between the disks.g

10. Due to the vibration on the charging and seal injection lines, a pulsation filter was installed in the discharge line of the charging pumps. Testing of the accumulator demonstrated the unit performs as designed with line vibration greatly reduced.

ll. A closed system for reclaiming of charging pump packing leakoff was installed. This reduced the release of fission gases from the CVCS system and reduced the amount of high activity water going into the liquid waste system.

12. Unacceptable performance of the waste evaporator necessitated modifications to the unit.l A steam jet vacuum pump was in-

stalled to replace the mechanical vacuum pump, a hood and shroud assembly was installed around the heating bundle, and modifications were made to the mesh and perforated plate areas in the upper section of the concentrator. The unit performed at design capacity and near design D.F. after these modifications.

To further reduce liquid effluent activity, mixed bed demineralizers have been added to the waste condensate system after the evaporator.

13. Hodifications have been made to the auxiliary building venti la-tion system to reduce the amount of radioactive iodine that was being released through the plant vent system. A charcoal filter was added to the control access areas exhaust system after the HEPA filter. A HEPA and charcoal filter unit was installed in the auxiliary building exhaust system combining the 1D and 1E auxiliary building exhaust systems. The 1C auxiliary building exhaust system, which draws from the spent fuel pit area, has had charcoal filters installed in it to reduce the consequences of a spent fuel pit accident.

14. During initial operation of the plant, the suction impellers of all three condensate pumps indicated excessive wear. The suction impellers were replaced with stainless steel impellers.

Suction impeller wear has not been as serious as in the past.

The manufacturer contends that the wear has been due to insta-bility in the first stage impeller at lower loads and that the instability will not be present when the pumps are operated at their design capacity at the 1520 Nwt load.

15. Shortly after power operation began at the Ginna Station, dif-ficulties were experienced with the moisture separator-reheaters for the secondary system. Continual modifications have been made to the units. The moisture separators have been reinforced internally for better structural integrity. The reheaters were each given a separate level control tank with separate condensate lines for better control of level in the reheaters. An orifice plate was added to the inlets of the reheaters to give a more uniform flow distribution through the tubes. Finally the lA and 2B reheater tube bundles were replaced due to degradation caused by tube failures. During the removal and inspection of the old tube bundles it was discovered that the shell on the 1A reheater was not long enough to allow for thermal expansion of the tubes.

The shell on the lA reheater u(as extended during the installation of the tube bundle.

16. During the first refueling outage, the turbine condenser was in-spected for leaks. Several stainless steel tubes in the upper sections of the tube bundles were found to be fractured. Stain-less steel clips have been installed to restrict the movement of the tubes. It is felt that this will solve the problem.

17. During early operation of the station the main steam lines ex-hibited excessive vibration. A review of the steam piping system was conducted to improve the piping support system. Six new hydraulic supports have been added to the steam piping and several

adjustments were made in the existing supports. No significant vibration levels have been observed since resumption of operation this 3une. RGSE plans to continue to evaluate and monitor the amplitude and frequency of the main steam vibration on a periodic

'asis.

18. Although fuel leaks have occurred, the reactor coolant activity has reNained within allowable limits. Effluent releases have been maintained well within limits and adminstrative contols have been applied to reduce the probability of further fuel leaks occur-ring. In addition, Rochester Gas 8 Electric Corporation has accel-erated its nuclear fuel purchase for the purpose of removing the leaking fuel.

TABLE II 1

SUMMARY

OF STATION OPERATIONS START UP TO JUNE 25, 1972 GENERATION IN MW HOURS HOURS NUMBER NUMBER RATES PERIOD OF 'OF REACTOR CRITICAL TRIPS VAILABILITYCAPACITY GROSS GROSS NET ON EQUIVALENT THERMA LINE FACTOR FACTOR Nov. 1969-1, 632, 448 527, 436 483, 953 2099:07 1300. 97 97 16 47. 80 25. 93 April 1970 May-Dec. 5, 423, 280 1, 824, 799 1, 720, 927 4483:37 4171. 75 17 10 76. 59 69. 15 1970 Jan- June 2, 936, 232 '1, 004, 218 949, 674 2363:47 2258. 64 12 54. 12 51. 16 1971 July-Dec. 5, 505, 432 1, 867, 512 1, 768, 483 4285: 95 4188. 95 10 97. 58 94. 74 1971 Jan. - June 3, 326, 088 1, 106, 150 1,048, 585 2537:00 2402. 06 33 57. 76 56. 18 1972 TOTAL 18,823,480 6, 330, 115 5, 971, 622 1569:08 14, 322. 37 169 40 67. 46 60. 11

ORGANIZATIONAL AND ADMINISTRATIVE ADE(UACY

l. Operators Operator training and retraining programs have been conducted at the Ginna plant continuously.ll At present there are 21 licensed senior reactor operators and ll licensed reactor operators. Twenty-one of these licensed personnel are shift operators. At present there are five additional auxiliary operators who do not hold licenses.

2. Plant Staff The Ginna plant staff has remained essentially the same as described in Section 12 of the FSAR. Variations are the staff-ing of three radiation protection technicians and one chemistry lab technician rather than the two chemistry technicians and one radiation protection technician, and the addition of two assistants to the plant superintendent to supervise assigned pro-jects, prepare reports, and assist other members of the plant staff when necessary. Additional engineers are also assisting in the operations and maintenance departments. A training coordi-nator has also been added to the plant staff to administer the operator training and retraining programs.

3. En ineerin Su ort Rochester Gas and Electric Corporation maintains an Engineer-ing Department, whereby, plant design changes can be implemented.

This has been used in changes brought about by operational ex-perience in the plant. Long-range fuel planning is also per-formed on a regular basis by this department as well as providing

expert assistance in evaluating current fuel performance. In major facility changes the expertise of Gilbert Associates, Inc.

has also been utilized.

4. Westin house Electric Cor oration The plant prime contractor has been used on all problems asso-ciated with its supply systems such as safety injection system modification, pressurizer safety valve supports, main steam safety valve and relief valve supports, RTD and source range problems, condensate pump problems, and turbine-condenser problems. Westing-house has also been utilized for short range fuel management and fuel performance evaluation.

5. Consultants The Rochester Gas and Electric Corporation has engaged the firm of Pickard, Lowe and Associates as consultant on reactor and plant engineering and general plant studies. In addition, specialists in critical areas have also been engaged: Dr. G. Hoyt Whipple, Health Physicist; Radiation Management Corporation, health physics; Southwest Research, metallurgy and in-service inspection; and Gilbert Associates, Inc., plant engineering.

6. Advisor Committees The Plant Operations Review Committee and the Nuclear Safety Audit and Review Board, which are both on-site and off-site ad-visory committees, have met regularly as described in the Technical Specifications and performed the functions described therein.

REFERENCES TO SECTION II:

l. Attachment to Letter to Dr. Peter A. Morris,

Subject:

Technical Supplement Accompanying Application to Increase Power, Appendix A.

(February 19, 1971)

2. Attachment to Letter to Mr. E.J. Bloch,

Subject:

Power Escalation to 1520 MWt, March 1972. (August 14, 1972)

3. Attachment to Letter to Dr. Peter A. Morris,

Subject:

A Review of Fuel Rod Integrity At The Ginna Reactor, WCAP-7703-L.

(June 3, 1971)

4. Attachment to Letter to Dr . Peter A. Morris,

Subject:

Re-evaluation of Safety Injection System Capabilities, R.E. Ginna Nuclear Power Plant Unit No. l. (June 3, 1971)

5. Attachment to Letter to Dr. Peter A. Morris,

Subject:

Amendment No.4 to Technical Supplement Accompanying Application to Increase Power. (Nov. 29, 1971)

6. Letter to Dr. Peter A. Morris,

Subject:

Report of Stud Failure at Ginna Station. (Dec. 21, 1970)

7. Letter to Mr. E.J. Bloch,

Subject:

R.E.Ginna Nuclear Power Plant Unit No.l, Pressurizer Safety Valves. (June 19, 1972)

8. Attachment to Letter to Mr. E.J. Bloch,

Subject:

Main Steam Safety Valve Support Modification. (June 5, 1972)

9. Letter to Dr. Peter A. Morris,

Subject:

Malfunction of Safeguards Valve MOV-850B. (Dec. 23, 1969)

10. Attachment to Letter to Dr. Peter A. Morris,

Subject:

Waste Evaporator Operatings History, R.E. Ginna Nuclear Power Plant Unit No. l. (June 3, 1971)

ll. Attachment to Letter to Dr. Peter A. Morris,

Subject:

Amendment No.3 To Technical Supplement Accompanying Application To Increase Power. (Oct. 7, 1971).

III. ADEQUACY RELATIVE TO CURRENT STANDARDS A. 10CRF50 APPENDICES

1. Ap endix A - General Desi n Criteria for Nuclear Power Plants During the design and licensing of the R.E. Ginna Nuclear Power Plant Unit No.l, the proposed Atomic Industrial Forum version of the criteria issued for comment by the AEC on July 10, 1967, were the general design criteria used. Although those proposed criteria are not identical to the present criteria they are quite similar. The proposed criteria are listed in Section 1.3 of the FSAR. The current general design criteria are set forth in Appendix A of 10CFR50 and the station's design conformance to it is detailed below.

a. Overall Re uirements These criteria are intended to assure that the quality control and assur ance programs are identified, recorded, and justified in terms of their adequacy. The five criteriq of this group are intended to apply to the design, fabrication, erection, and performance requirements of the facility's essential components and systems to ensure that there is pro-tection against natural phenomena and environmental conditions.

In addition, these criteria are also intended to provide fire and explosion protection for all.equipment important to safety.

Criterion - ualit Standards and Records 1

All systems and components of the facility were classified according to their importance. Those'tems vital to safe shut-

down and isolation of the reactor or whose failure might cause or increase the severity of a loss-of-coolant accident or result in an uncontrolled release of excessive amounts of radioactivity were designated Class I. Those items important to reactor operation but not essential to safe shutdown and isolation of the reactor or.,control of the release of substantial amounts of radioactivity were designated Class II. Those items not related to reactor operation or safety were designated Class III.

Classification of structures and equipment is discussed in Section 1.2 of the FSAR.

Class I systems and components are essential to the protection of the health and safety of the public. Consequently, they were designed, fabricated, inspected and -erected, and the materials selected to the applicable provisions of the then recognized codes, good nuclear practice, and to quality standards that reflected their importance. Discussions of applicable codes and standards, quality assurance programs, test provisions, etc., that were used are given in the section describing each system in the FSAR.

A complete set of as-built facility plant and system dia-grams including arrangement plans and structural plans are maintained throughout the life of the reactor.

A set of completed test procedures for all plant testing are maintained as outlined in Chapter 13 of the FSAR.

A set of all the quality assurance data generated during

fabrication and erection of the essential components of the plant, as defined by the Ginna facility construction quality assurance program, is retained. The quality control and assur-ance program for the Ginna facility construction is described in Section 1.8 of the FSAR.

Criterion 2 - Desi n Bases for Protection A ainst Natural Phenomena All systems and components designated Class I were designed so that there is no loss of function in the event of the maximum potential ground acceleration acting in the horizontal and verti-cal directions simultaneously. The working stresses for both Class I and Class II items are kept within code allowable values for the design earthquake. Similarly, measures were taken in the plant design to protect against high winds, sudden barometric pressure changes, seiches, and other natural phenomena. Definite procedures have been written that will be followed in the event of such natural phenomena. The occurrence of such phenomena is discussed in Section 2 of the FSAR.

Criterion 3 - Fire Protection The present design fully meets this criterion. Fire detec-tion and fighting systems of appropriate capacity and capability were provided to minimize the adverse effects of fire on struc-tures, systems, and components important to safety. Sensing devices include both ionization chambers (smoke detectors) and

.temperature detectors. Fire fighting equipment includes automatic

water deluge in appropriate areas. A manually initiated halon 1301 total flooding system has been recently added to the relay room in compliance with the criterion. Appropriate hoses and portable fire fighting equipment are placed throughout the plant. The fire protection system is discussed in Section 9.6 of the FSAR.

Criterion 4 - Environmental and Missile Desi n Bases This criterion is met in that the integrity of the contain-ment was analyzed for missiles and discharging fluids. Layout and structural design specifically protect injection paths lead-ing to unbroken reactor coolant loops against damage as a result of the maximum reactor coolant pipe rupture. Injection lines penetrate the main missile barrier, and the injection headers are located in the missile-protected area between the missile barrier and the containment outside wall. Individual injection lines, connected to the injection header, pass through the barrier and then connect to the loops. Separation of the individual in-jection lines is provided to the maximum extent practicable.

Movement of the injection line, associated with rupture of a reactor coolant loop, is accommodated by line flexibility and by the design of the pipe supports such that no damage outside the missile barrier is possible.

All hangers, stops and anchors are designed in accordance with USAS 831.1 Code for Pressure Piping and ACI 318 Building Code Requirements for Reinforced Concrete which provide minimum

requirements on materi al, des i gn and fabri cati on wi th amp 1 e safety margins for both dead and dynamic loads over the life of the equipment.

Criterion 5 - Sharin of Structures S stems and Com onents R.E.Ginna Nuclear Power Plant Unit No. 1 is a s'ingle unit installation.

b. Protection b Multi le Fission Product Barriers These criteria are intended to ensure that designs provide the reactor unit with multiple barriers which remain intact during normal operations and all anticipated transients and that adequate barriers are available for design-basis accidents.

In addition, these criteria are intended to identify and de-fine the instrumentation and control systems, electrical power systems, and control room requirements required for normal operation, anticipated operational occurrences and for accident condition.

Criterion 10 - Reactor Desi n The reactor core design, in combination with coolant, control and nuclear safety systems, provides margins to ensure that fuel is not damaged during normal operation or as a result of anticipated operational transients.

The W-3 DNB correlation was used to predict the DNB flux and location of ONB for axially uniform and non-uniform heat flux distributions. Based upon hot channel factor of Fq

= 2.72 and F NH

= 1.66, operation at 1520 MWt produces a peak specific

power of 16 Kw/ft. For operation within these parameters, the DNBR during steady state operation and anticipated tran-sients is limited to 1.30. The reactor control and protective system also prevents the power level or system temperature or pressure from exceeding limits that would result in a DNBR of less than 1.30 for anticipated transients.

Criterion ll - Reactor Inherent Protection The reactor core and associated coolant systems have been, designed so that in the power operating range the net effect of the prompt nuclear feedback characteristics, tends to compensate for a rapid increase in reactivity.

Design calculations and physics testing indicate that. the moderator temperature coefficient and doppler coefficient have always been negative in the power operating range" of the installed cores. l<hile the moderator pressure and density coefficients are not necessarily negative, the overall power coefficient is negative and so provides a nuclear feedback characteristic to limit a rapid increase in reactivity.

Criterion 12 - Su ression of Reactor Power Oscillations The reactor core and the associated coolant, control and protection systems have been designed to prevent power oscilla-tions that could result in exceeding fuel design limits. Part-length control rods provide the capability of attenuating axial oscillations. Xenon oscillation tests have been conducted at the Ginna Station on three separate occasions. In all cases the

core was stable.

Criterion 13 - Instrumentation and Control II Instrumentation and controls essential to avoid undue risk to the health and safety of the public are provided to monitor, and maintain containment pressure, neutron flux, primary coolant

-pressure, flow rate, temperature, and control rod positions with-in prescribed operating ranges.

The fission process is monitored and controlled for all conditions from the source range through the power range. The neutron monitoring system detects core 'conditions that could potentially threaten the overall integrity of the fuel bar'rier due to excess power generation and provides a corresponding signal to the reactor protection system. In addition to the excore neutron monitoring system, movable in-core instrumenta-tion provides the capability of mapping the core.

The non-nuclear regulating, process and cohtainment instru-mentation measures temperatures, pressure, flow, and levels in the Reactor Coolant System,'team Systems, Containment and other Auxiliary Systems. Process variables required on a continuous basis for the startup, operation, and shutdown of the plant are indicated, recorded, and controlled from the control room.

The quantity and types of process instrumentation provided en-sures safe and orderly operation of all systems and processes over the full operating range of the plant.

The instrumentation and control systems are more completely discussed in Section 7 of the FSAR.

Criterion 14 - .Reactor Coolant Pressure Boundar All piping components and supporting structures of the reactor coolant system were designed as Class I equipment as defined in Section 1 of the FSAR. All pressure containing com-ponents of the reactor coolant system were designed, fabricated, inspected, and tested in conformance with the code requirements detailed in Table 4.1-9 of the FSAR. Therefore, the probability of abnormal leakage, of rapidly propagating failure and of, gross rupture is very low.

Criterion 15 - Reactor Coolant S stem Desi n The reactor coolant system and associated auxiliary, control, and protection systems were designed with sufficient margins so that design conditions are not exceeded during normal operation including anticipated operational occurrences. The normal operating pressure is 2235 psig with design pressure being 2485 psig. This provides a reasonable range for maneuvering during operation with'allowance for pressure transients without actuation of the safety valves. Analysis presented in Section 14 of the FSAR demonstrates the ability of the plant to safely undergo all anticipated transients with pressure peaks below 2485 psig.

Overpressurization is prevented by a combination of auto-matic controls and pressure-relief devices. In addition to the safety valves, poWer operated relief valves are set for 2335 psig.

Criterion 16 - Containment Desi n The building containing the reactor and primary system is a reinforced concrete structure prestressed in the vertical direction, with a welded steel liner on the inside. The structure contains a free volume of 997,000 cubic feet and is designed for an internal pressure of 60 psig. Prior to initial operation, the containment was strength tested at 69 psig and then was leak tested. The acceptance criterion for the pre-operational leakage test was established as O.là per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 60 psig. Safety analyses have been performed on the basis of a leakage rate of 0.20% per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 60 psig.

Reports on the "Structural Integrity Test of Reactor Con-tainment Structure" and "Pr'e-operational Integrated Leak Rate Test of the Reactor Containment Building" have been previously submitted to the AEC. The leakage rate at 60 psig was determined to be 0.0219 + .0168K per 24 hours.

Periodic leak rate, measurements as defined in Section 4.4 in the Technical Specifications ensure that the containment structure provides an essentially leak tight barrier against the uncontrolled release of radioactivity to the environment.

Periodic inspection of prestressed tendons as well as periodic integrated leak rate tests as defined in the same section of the Technical Specifications ensure the continued structural integrity of the containment structure.

A containment spray system and fan coolers are provided to

mitigate the consequences of a loss-of-coolant accident.

More detail on the containment system can be found in Sections 5 and 6 of the FSAR.

Criterion 17 - Electrical Power S stems An on-site electrical power system and an off-site electrical power system are provided to permit functioning of structures, systems, and components important to safety. Each system pro-vides sufficient capacity and capability to ensure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital- func-tions are maintained in the event of postulated accidents.

Two completely independent and redundant emergency diesel-generator systems are provided as well as two completely sepa-rate and independent station battery systems. The station systems have sufficient redundancy in that dual feeds,

'attery one from each battery system supply the control board. Two 34 Kv transmission lines from separate sources feed auxiliary power into the Ginna facility. The two lines are on separate right-of-ways.

In the event of a permanent fault on one line, the other line has the capacity to supply all the power required to ensure that acceptable fuel and reactor coolant pressure boundary design limits are not exceeded during anticipated operational

occurrences. This capacity is also available in the case of postulated accidents to ensure that the core is cooled and that other vital functions are available.

Four 115 Kv transmission lines leave the Ginna substation.

In addition to the indicated sources of pov(er, power can be fed back into the plant on the 115 Kv system after the isolated phase bus is disconnected from the generator.

Diesels and batteries are tested according to the re-quirements of the Technical Specifications. Both the on-site and off-site power systems would be available following a loss-of-coolant accident in time to ensure that core cooling, containment integrity, and 'other vital safety functions are maintained. Nore detailed information on the electrical systems can be found in Section 8 of the FSAR.

Criterion 18 - Ins ection and Testin of Electrical Power

~Sstems The electrical power systems are designed with the cap-ability of periodic testing for operability. Components of the systems, i.e., on-site power sources, relays and switches, are similarly capable of being periodically tested. Passive components such as wiring, connections, switchboards, and buses are capable of periodic inspection.

Verification of operability of the systems as a whole, including transfer of power is described in Section 8 of the FSAR. Operability of the systems in accordance with design

conditions was verified by pre-operational testing and periodic testing of the systems as required by Sections 4.5 and 4.6 of the Technical Specifications.

Criterion 19 - Control Room The station is'quipped with a control room which contains all controls and instrumentation necessary for operation of the reactor and turbine generator under normal and accident condi-tions.

The control room is capable of continuous occupancy by the operating personnel under all operating and accident conditions.

Sufficient shielding, distance, and containment integrity are provided to assure that control room personnel shall not be subject to doses under postulated accident conditions during occupancy of the control room which, in the aggregate would exceed ten percent of the suggested limits of 10CFR100. The control room ventilation consists .of a system having a large percentage of recirculated air. The fresh air intake can be closed to control the intake of airborne activity if monitors indicate that such action is appropriate. After the dampers are closed, the air inside the control room is recirculated through a system having charcoal filters which will remove the iodine activity.

Although the likelihood of conditions which could render the main control room inaccessible even for a short time is extremely small, provisions have been made so that plant operators

can shut dowh and maintain the plant in a safe condition by means of controls located outside the control room. Dur-ing such a period of control room inaccessibility, the reactor will be tripped and the plant maintained in the hot shutdown condition. This is described in Section 7 of the FSAR.

c. Protection and Reactivity Control S, stems These criteria are intended to identify and establish requirements for functional reliability, in-service testability, redundancy, physical and electrical independence and separation, and fail-safe design of the systems that are essential to the

'eactor protection functions. In addition, these criteria are intended to establish (1) the reactor core reactivity insertion rate limit and (2) the means of control of the reactor within these limits.

Criterion 20 - Protection S stems Functions A plant protection system, as described in Section 7.2 of the FSAR, is provided to automatically initiate appropriate action whenever specific plant conditions reach pre-established limits. These limits assure that specified fuel design limits are not exceeded when anticipated operational occurrences happen.

In addition, other protective instrumentation is provided to initiate actions which mitigate the consequences of an accident.

The Ginna Station installation meets the requirements of Criterion 20.

Criterion 21 - Protection S stem Reliabilit and Testabilit Sufficient redundancy and independence are designed into the reactor protection system to ensure that no single failure results in loss of protection function. The system is designed such that it will accommodate any single component failure and still perform its protective function.

• Reliability and independence is obtained by redundancy with-in each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate primary sensors. Each channel is continuously fed from its own indepen-dent electrical sources. Failure to de-energize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event.

All reactor protection channels are supplied with sufficient redundancy to provide the capability-for channel calibration and test at power. Bypass removal of one trip circuit is accomplish-ed by placing that circuit in a half-tripped mode; i.e., a two-out-of-three circui't becomes a one-out-of-two circuit. Testing does not trip the system unless a trip condition exists in a concurrent channel.

Detailed information verifying compliance with this criterion was published in the FSAR, Section 7.2 and Technical Specifica-tions, Sections 3.5 and 4.1.

Criterion 22 - Protection S stem Inde endence The Ginna Station protection system was designed so that the effects of natural phenomena and of normal operating, main-tenance, testing and postulated accident conditions do not result in the loss of the protective function. The design includes the techniques, of functional diversity or diversity in components design and principles of operation to the extent practical in preventing the loss of the protection functions.

Specific information about system independence is covered in Section 7.2 of the FSAR.

Criterion 23 - Protection S stem Failure Modes The reactor protection 'system is designed to fail-safe upon disconnection from the system, loss of energy or, if exposed, to adverse environmental conditions.

Each reactor trip circuit is designed so that trip occurs when the circuit is de-energized; an open circuit or loss of channel power, therefore, causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from independent electrical buses. Failure to de-energize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remain-ing channels is unimpaired in this event.

Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on each drive, allowing the rod clusters to insert by gravity. The protection system is thus

inherently safe in the event of a loss of power.

Automatic starting of either emergency diesel-generator is initiated by redundant undervoltage relays on the 480 volt bus with which the diesel-generator is associated, or by the safety injection signal. Engine cranking is accomplished by. a stored energy system supplied solely for the associated diesel-generator. The undervoltage relay scheme is designed so that loss of 480 volt power does not prevent the relay scheme from functioning properly.

Sections 7 and 8 of the FSAR details compliance to this criterion.

Criterion 24 - Se aration of Protection and Control S stems The reactor protection system is physically and electri-cally separate from the control systems such that failure of any single control component or channel, or removal from service, leaves the system satisfying the reliability, r edun-dancy, and independence requirements of the reactor protection system. Information verifying compliance with this criterion is available in the FSAR, Section 1.3, with supporting details in Sections 6 and 7.

Criterion 25 - Protection S stem Re uirements for Reactivit Control Malfunctions The reactor protection system is designed to ensure that the specified fuel design limits are not exceeded for any single malfunction of the reactivity control systems. Reactor shutdown with rods is completely independent of the normal

control functions. The trip breakers completely interrupt the power to the rod mechanisms to trip the reactor regardless of existing control signals. Details of the effects of continuous withdrawal of a rod cluster control assembly and of continuous deboration are described in the FSAR, Sections 14.1 and 9.2.

Criterion 26 - Reactivit Control S stem Redundanc and Ca abilit One of the two reactivity control systems employs rod cluster control assemblies to regulate the position of Ag-In-Cd neutron absorbers within the reactor core. The control rods are designed to shutdown the reactor with adequate margin for all anticipated occurrences so that fuel design limits are not exceeded. The other reactivity control system employs the Chemical and Volume Control System to regulate the concentra-tion of boric acid neutron absorber in the Reactor Coolant System. The CVCS is capable of controlling the reactivity change resulting from planned normal power changes. Reactivity control system redundancy and capability is discussed in detail in Sections 3.1 and 3.2 of the FSAR.

Criterion 27 - Combined Reactivit Control S stem Ca abilit The reactivity control systems in conjunction with boron addition through the emergency core cooling system has the capability of controlling reactivity changes under postulated accident conditions with appropriate margins for stuck rods.

The Ginna facility is provided with the means of making and holding the core subcritical under any anticipated condi-tions and with appropriate margin for contingencies. Combined

use of the rod cluster control system and the chemical shim control system permit the necessary shutdown margin to be maintained during long term xenon decay and plant cooldown.

The single highest worth control cluster is assumed to be stuck full out upon trip.

In a loss-of-coolant accident the Safety Injection System 4

is actuated and concentrated boric acid is injected into the cold legs of the reactor coolant system. This is in addition to the boric acid content of the accumulators which is passively injected on a decrease in system pressure. See Section 6 and 3.1 of the FSAR for further details.

Criterion 28 - Reactivit L'imits The maximum reactivity worth of control rods and the maxi-mum rates of reactivity insertion employing control rods are limited by the design of the facility to values which prevent rupture of the coolant pressure boundary or disruptions of the core or vessel internals to a degree which could impair the effectiveness of emergency core cooling. Section 3.1 of the FSAR discusses the design basis in meeting this criterion, and Section 14 discusses the accident analyses and the relationship of the reactivity insertion rates to plant safety. Technical Specifications include appropriate graphs showing the maximum permissible insertion limits and overlap of RCCA banks as a function of power.

Criterion 29 - Protection A ainst Antici ated 0 erational Occurrences The protection and reactivity control systems are designed to assure extremely high reliability in regard to their required safet'y functions in any anticipated operational occurrences.

Like'ly failure modes of system components are designed to be safe modes. Equipment used in these systems is designed, con-structed, operated and maintained with a high level of reliability.

Loss of power to the protection system wi.ll result in a reactor'rip.

Section 1.3.4 of the FSAR is addressed to this criterion.

d. ~F1 id S These criteria are intended to: (1) identify those nuclear safety systems within the general category of fluid systems; (2) examine each one for capability, redundancy, testability, and inspectability; and (3) ensure that each safety feature's capability encompasses all the anticipated and credible phenomena associated with the operational transients or design basis accidents. In addition, these criteria are intended to establish the design requirements for the reactor coolant pressure boundary and to identify the means for sat-isfying these design requirements.

Criterion 30 - ualit of Reactor Coolant Pressure Boundar guality standards of material selection, design, fabrication and inspection for the Ginna reactor coolant system conformed

to the applicable provisions of recognized codes and good nuclear practice of that period. Details of the quality assurance programs, test procedures and inspection acceptance levels were given in Section 1 of the FSAR. Particular emphasis was placed on the assurance of quality of the reactor vessel to obtain material whose properties are uniformly within tolerances appropriate to the application of the design methods of the code used. Table 4.1-9 of the FSAR gives the code re-quirements used for the reactor coolant system.

Leakage from the primary coolant boundary is detected by an increase in the amount of makeup water required to maintain a normal level in the volume control tanks. The reactor vessel closure joint is provided with a temperature monitored leak-off between the double gaskets and a recently installed acoustic leak detector.

Leakage inside the reactor containment is drained to the reactor building sump where the actuation of a pump is an-nunciated.

Leakage is also detected by measuring the airborne activity and the condensate drained from the reactor build-ing recirculation units.

Criterion 31 - Fracture Prevention of Reactor Coolant Pressure Boundar The reactor coolant pressure boundary was fabri-cated, inspected and tested in accordance with codes

(i.e., ASME Boiler and Pressure Vessel Code and the ASA Code l

for Pressure Piping) which were applicable at the time of fabrication and installation. Evaluation of the Ginna reactor vessel by Westinghouse has concluded the Ginna vessel meets the new ASME fracture toughness requirements (see response to Appendix G of 10CFR50).

A maximum initial nil-ductility transition temperature for the vessel shell material was established as 40'F. Curves

'or heatup and cooldown limitations are in the Technical Specifications and are based upon an initial NDTT of 40'F.

curves are periodically updated to ensure operation 'hese within the required stress limits. Specimens of the vessel, weld material, and heat affected zone are located within the core region to permit periodic monitoring of exposure and material properties relative to control samples, as defined in the Techncial Specifications.

Pre-service ultrasonic inspection of the reactor vessel and primary system piping welds were performed and an in-service inspection program, as defined in the Technical Specifications, is maintained.

The heatup and cooldown r ates during plant life are pre-dicted using conservative values for the change in NDT due to ir radiation. Operating limitations during startup and shutdown of the reactor coolant systems were evaluated using Appendix G, "Protection Against Non-Ductile Failure" of the recently

revised ASME Code Section III fracture toughness rules (Code Case 1514). Heatup and cooldown curves in accordance with the method of Appendix G of Section III ASME Code show the present Technical Specification limits to be very conservative.

Steady-state and transient analyses are also presented in Section 14 of the FSAR. These analyses demonstrate that the design of the vessel meets the necessary requirements.

Inspections ensure that the probability of undetected and rapidly propagating fracture of the reactor coolant system is minimized.

Criterion 32 - Ins ection of Reactor Coolant Pressure Boundar In-service inspections of the reactor coolant boundary and proposed methods and frequencies for performing these inspections have been developed. The inspection program developed includes interpretation and analysis of the results employing the latest techniques available at the time of inspection.

This program is detailed in the plant Technical Specifications and is described in Amendment No.2 to the Technical Supplement Accompanying Application to Increase Power.

The five-year program presently in effect exceeds, in many areas, inspection requirements of both N-45 and the more recent Section XI of the ASME Boiler and Pressure Vessel Code. The in-service inspections that have been performed have exceeded

. those required and have revealed no problem areas.

Criterion 33 - Reactor Coolant Makeu The Chemical and Volume Control System provides a means

of reactor coolant makeup and adjustment of the boric acid concentration. Normally, makeup is added automatically from the boric acid blend system to the suction of the high head positive displacement charging Dumps when the volume control tank falls below a preset level. The charging pumps, of which there are three, are capable of injecting coolant into the Reactor Coolant System at a rate of 60 gpm each when power is available from either on-site or off-site electric power systems. Further decrease in the level of the volume control tank initiates a valve alignment to the refueling water storage tank.

Further protection against small breaks in the Reactor Coolant System is afforded by low level in the pressurizer which initiates isolation of the normal letdown purification path of the= CVCS system.

Should a larger break occur, resultant loss of pressure and pressurizer liquid level will cause reactor trip and initia-tion of safety injection. These countermeasures will limit the consequences of the accident in two ways:

1. Reactor trip and borated water injection will supplement void formation in causing rapid reduction of the nuclear power to a residual level corresponding to delayed fissions and fission product decay.

2. Injection of borated water ensures sufficient flooding of the core to prevent excessive temperatures.

Criterion 34 - Residual Heat Removal The Residual Heat Removal System, in conjunction with the Steam Power Conversion System, is designed to transfer the fission product decay heat and other residual heat from the reactor core at a rate such that design limits of the fuel and the primary system coolant boundary are not exceeded.

Suitable redundancy is provided with two residual heat re-moval pumps and two heat exchangers. The residual heat re-moval system is able to operate on either on-site or off-site power systems. Details of the system design can be found in Section 9 of the FSAR.

Criterion 35 - Emer enc Core Coolin Emergency Core Cooling Systems are provided to cope with any loss of coolant accident due to a pipe rupture. Cooling water would be available in an emergency to transfer heat from the core at a rate sufficient to maintain the core in a eoolable geometry and to assure that the clad metal-water reaction is limited. The Emergency Core Cooling Systems are capable of meeting the Interim Acceptance Criteria for ECCS for Light-llater Power Reactors. This was discussed in a report in response to the interim criteria and later in Amend-ment No.4 to the Technical SUpplement Accompanying Application to Increase Power. Adequate design provisions are made to assure performance of the required safety functions even with a single failure, assuming that electrical power is available

from either the off-site or the on-site electrical I

power system.

Engineered safeguards are discussed in Section 6 of the FSAR.

Criterion 36 - Ins ection of Emer enc Core Coolin S stem Important components of Emergency Core Cooling Systems are examined on a periodic basis as defined in the Technical Specifications; Except for the low head safety injection nozzles on the reactor vessel, all other connections are either directly or indirectly to the primary system piping, thus being accessible for examination.

Until such time as ultrasonic equipment is available to inspect the low head nozzles from the inside, periodic visual inspection using remote equipment is being performed. Valves and piping can be periodically inspected visually with non-destructive inspections being performed where appropriate.

The components located outside containment are accessible for leak-tightness inspection during operation.

Criterion 37 - Testin of Emer enc Core Coolin S stems Components of Emergency Core Cooling Systems located outside the containment are accessible for leak-tightness

,inspection during periodic tests.

Each active component of the Emergency Core Cooling Systems is individually actuated on the normal power source periodi-cally during plant operation to demonstrate operability, and tests are performed during the refuel,ing shutdowns to demon-strate proper automatic operation of the Emergency Core Cool-ing Systems. The required surveillance tests are described

in the Technical Specifications.

Criterion 38 - Containment Heat Removal Two systems based on different principles are provided to remove heat from the containment following an accident in order to maintain the pressure below the containment design pressure. The containment spray and the containment fan cooling systems are each independently capable of removing sufficient energy to maintain the pressure below the contain-ment design pressure. Containment spray is supplied from-two pumps each being fed from a separate electrical bus. Two fan coolers are fed from one safeguards bus with the other two being fed from anothei safeguards bus. Power is supplied from either the normal supply or from the associated emergency diesel.

These systems are discussed in Section 6 of the FSAR.

Criterion 39 - Inspection of Containment Heat .Removal System The two containment heat removal systems can receive appropriate periodic inspection of important components. Con-tainment spray nozzles are tested by blowing air into the spray rings and checking each nozzle for flow. Periodic test-ing of the pump is also done. Besides their safeguard role, the containment fan coolers are routinely used during opera-tion to maintain ambient temperature inside the containment at acceptable levels. The periodic testing is described in the Technical Specifications.

Criterion 40 - Testin of Containment Heat Removal S stem The containment heat removal systems have the capability of being periodically tested as folloWs:

a. Containment Fan Cooler System

1. The Containment Fan Cooler Units are used during normal operation and by those means are continuously monitored.

2. The house service water pumps operate when the reactor is in operation and therefore are continuously monitored.

3. Annual systems tests demonstrate proper automatic operation of the safety injection system. A test signal is applied to initiate automatic action and verify that the components receive the safety injection signal in the proper sequence. The test demonstrates the oper-ability of the valves, circuit breakers, and automatic circuitry.

b. Containmeht Spray System

1. Oesign provisions are made to the extent practical to facilitate access for periodic visual inspection of all important components of the Containment Air Re-circulation and Filtration and Containment Spray Systems.

2. Permanent test-lines for the containment spray loops are located so that all components up to the isolation valves at the spray nozzles may be tested. These isola-tion valves are checked separately.

3. The air test lines for checking that spray nozzles are

not obstructed connects upstream of the isolation valve.

Air flow through the nozzles is monito'red by tell-tale devices attached to each nozzle or by use of a smoke generator.

The required periodic tests are described in the Technical Specifications.

Criterion 41 - Containment Atmos here Cleanu There are two systems which are designed to clean up the containment atmosphere after a postulated loss-of-coolant accident.,

a. The containment spray system includes the injection of sodium hydroxide solution into the spray into the containment to remove elemental iodine. The system con-sists of two independent subsystems each supplied from separate buses. No single active failure will cause both subsystems to fail to operate.

b. Charcoal filters are placed into the air stream flow of two of the four fan coolers to remove iodine. Each of'the fan coolers is provided with a HEPA filter bank.

These are described in Section 6 of the FSAR.

In addition, two recombiner units are installed in the containment. The purpose of these units is to prevent the uncontrolled post accident buildup of hydrogen concentra-tions in the containment. These are described in the same section of the FSAR as above.

Criterion 42 - Ins ection of Containment Atmos here Ct CC5 The containment atmosphere cleanup systems, with the exception of the spray headers and nozzles, are designed and located such that they can be inspected periodically as required.

4 The spray headers and nozzles can be air tested as described in the response of Criterion 39.

The systems are described in Section 6 of the FSAR and the surveillance requirements are given in the Technical Specifications.

Criterion 43 - Testinq of Containment Atmos here Cleanup

~Sstems The containment atmosphere cleanup systems are tested as described in Criterion 40. In addition, the efficiency of the HEPA and charcoal filters are checked periodically as required by the Technical Specifications.

Criterion 44 - Coolin Water The systems provided to transfer heat from items of safety related importance to the ultimate heat sink of Lake 1

Ontario consist of subsystems identified as: House Service Water and Component Cooling Water.

Component cooling water is supplied by two redundant pumps which are supplied with power from separate buses. The House Service Water is supplied by four pumps, two being fed power from one safeguards bus, the other two from another

safeguards bus. Only one pump is needed during the injection phase and two are required during the recirculation phase of a postulated loss-of-coolant accident.

The systems are operable either from off-site power or from on-site diesel generators.

No single failure results in system loss of function.

Criterion 45 - Ins ection of Coolin Water S stem Important components of the component cooling system are located in areas which are accessible for periodic in-spection.

Host of the house service water piping is buried rein-for'ced concrete pipe which 'is not readily inspectable.

Since there are two redundant service water supply headers however, failure of one would not affect the operability of the other.

The House Service Water System is described in Section 9.6 of the FSAR.

Criterion 46 - Testin of Coolin Water S stem Redundancy and isolation are provided to allow periodic pressure and functional testing of the system as a whole, including the functional sequence that initiates system operation, and also including transfer between the normal and diesel power sources. At least one of the redundant pumps in the component cooling system is in service during normal operation.

During routine plant operation three house service pumps are in operation.

e. Reactor Containment These criteria are intended to establish the design requirements for the primary containment and to identify the means for satisfying these requirements including frac-ture prevention leakage testing, containment testing, inspection, and isolation.

Criterion 50 - Containment Desi n Basis The reactor containment structure, penetrations, valves, access openings and the containment spray system are designed with margin to accommodate the temperatures and pressures associated with the loss-of-coolant accident.

The design of the containment building is based on the Containment Design Basis Accident which assumes the double-ended severence of a reactor coolant pipe in the reactor coolant system coupled with partial loss of the redundant engineered safety features systems (Minimum Engineered Safety Features).

As described in Section 14.3.4 of the FSAR the containment is designed to accommodate conservative amounts of metal-water reaction which result from degraded emergency core cooling.

Criterion 51 - Fracture Prevention of Containment Pressure

~Boundar The concrete containment is not susceptible to a low temperature brittle fracture.

The containment liner is enclosed within the containment and thus is not exposed to the temperature extremes of the environs. The containment ambient temperature during opera-tion is between 50 and 120'F. The minimum service metal temperature of the containment liner is well above the NDT temperature + 30'F for the liner material. Containment pene-trations which can be exposed to the environment are also de-signed to the NDT + 30'F Criterion.

Criterion 52 - Ca abilit for Containment Leaka e Rate Testin The containment system is designed and constructed and the necessary equipment is provided to permit periodic integrated leakage rate tests during plant lifetime. Most of these periodic integrated leakage rate tests of the containment system will be conducted at 585 of the reactor building design pressure (35 psig). However, if required, periodic integrated leakage rate tests can be conducted at design pressure at infrequent intervals. Details concerning the conduct of periodic inte-grated leak rate tests are described in the Technical Specifi-cations; Criterion 53 - Provisions for Containment Testin and Ins ection There are special provisions for conducting individual leakage rate tests on applicable penetrations. Penetrations will be visually inspected and pressure tested for leak tight-ness at periodic intervals. Provisions have been made for an inservice tendon surveillance program throughout the life of

the plant intended to provide sufficient inservice historic evidence to maintain confidence that the integrity of the reactor building is being preserved.

Criterion 54 - Pi in S stems Penetratin Containment Piping systems penetrating containment are designed to provide the required isolation and testing capabilities. These piping systems are provided with test connections to allow periodic leak detection to be performed. The engineered safety features actuation system test circuitry provides the means for testing isolation valve operability.

Exceptions to this are instrumentation lines: dead weight test lines for the pressurizer and containment pressure sensing lines.

Criterion 55 - Reactor Coolant Pressure Boundar Penetratin Containment During the design phase of Ginna, containment isolation valves were covered by the GDC 53 which existed at that time:

"Penetrations that require closure for the containment function shall be protected by redundant valving and associated appara-tus." The design response to this criteria is in the FSAR, Section 1.3 and was stated thus:

"Isolation valves for all fluid system lines penetrating the containment provide at least two barriers for redund-ance against leakage 'of radioactive fluids to the environ-ment in the event of a loss-of-coolant accident. These bar-riers, in the form of isolation valves or closed systems, are defined on an individual line basis. In addition to satisfy-

ing containment isolation criteria, the valving is designed to facilitate normal operation and maintenance of the systems and to ensure reliable operation of other engineered safety features."

While the criteria at that time was met, the new Criterion 55 is not.

Criterion 56 - Primar Containment Isolation All lines which connect directly to the containment atmosphere and penetrate the primary reactor containment are provided with redundant isolation valves. Two normally closed valves outside the containment are provided for systems which are not required to function under accident conditions.

Each containment spray line which is i equired to be open under accident conditions contains a check valve outside the containment.

All penetrations, isolation valves and containment spray system components are designed and fabricated as extensions of the primary containment. The systems are considered to be part of the containment. All valves are located as close to the containment as possible.

The isolation system for each line is designed to fail in a safe mode. Under accident conditions each line would be isolated even if motive power were lost to a valve. Air-operated valves are designed to fail closed. Motor operated valves fail in the mode in which they are when failure occurs.

However, different power sources for each valve in series ensure

that isolation is not defeated by a single failure.

Criterion 57 - Closed S stem Isolation Valves The same considerations described for Criterion 55 apply here. The installation of valves was done in accordance with criteria which were applicable at the time. New and more stringent requirements are required by present criteria.

f. Fuel and Radioactivit Control These criteria are intended (1) to establish station

. effluent release limits and to identify the means of control-ling releases within these limits; (2) to define the radiation shielding, monitoring, and fission process controls necessary to effectively sense abnormal conditions and initiate required safety systems; and (3) to establish requirements for safe fuel and waste storage systems and to identify the means to satisfy these requirements.

Criterion 60 - Control of Releases of Radioactive Materials To The Environment Waste handling systems that were incorporated in the design of the Ginna facility have been upgraded such that, by process-ing and retention of radioactive materials, releases from normal operation do not exceed a few percent of allowable as indicated by the Rochester Gas and Electric Corporation, Ginna Station, Semi-Annual Reports. In addition, the facility was designed and has been further improved so that a radioactive release resulting from an accident would not exceed applicable

limits. The accident analyses recently were examined by .the AEC during its review of the "Petition Requesting Amendment of Li'cense and Extension of Expiration Date of Provisional Operating License" dated February 2, 1971. Modifications and improvements are presently being I

installed to maintain releases as low as practicable. A gaseous waste holdup system is pro-vided by the installation of four gas decay tanks. After a decay tank is filled, gas is left to decay for approximately 45 days prior to release to the environment.

Some decay of liquid wastes occurs in the waste holdup tank. In this case, however, since this tank is more of a holding base, (that is, it is filled and drained continuously) it is not used primarily for decay. Reduction of the releases here is accomplished by distillation in a waste evaporator. While the distillate is discharged, the "bottoms" are fixed in a ver-miculite and concrete filled barrel for shipment and burial.

Criterion 61 - Fuel Stora e and Handlin and Radioactivit Control The spent fuel pool and cooling system, fuel handling system, radioactive waste processing systems, and other systems that contain radioactivity are designed to assure adequate safety under normal and postulated accident conditions, and are discussed in Sections 1.3, 11.2,.and 14.2 of the FSAR.

1. Components are designed and located such that appropriate periodic inspection and testing may be performed.

2. All areas of the plant are designed with suitable shield-ing for radiation protection based on anticipated radia-tion dose rates and occupancy as discussed in FSAR.

3. Individual components which contain significant radio-activity are located in confined areas which are adequately ventilated through appropriate filtering systems.

4. The spent fuel pit cooling system provides cooling to remove residual heat from the fuel stored in the spent fuel pool. The system is designed such that, in addition to permanently installed equipment, temporary connections and equipment can also be utilized.

5. The spent fuel pool is designed such that no postulated accident could cause excessive loss of coolant inventory.

Criterion 62 - Prevention of Criticalit in Fuel Stora e

~dH d1 i Criticality in new and spent fuel storage areas is pre-vented both by physical separation of fuel assemblies and by the presence of borated water in the spent fuel storage pool.

Criticality prevention is discussed in detail in the FSAR in Section 9.5.

Criterion 63 - Monitorin Fuel and Waste Stora e Monitoring systems are provided to alarm on excessive temperature., or low. water level in the spent fuel pool. Ap-propriate safety actions will be initiated by operator action.

Radiation monitors and alarms 'are provided as required

to warn personnel of impending excessive levels of radiation or airborne activity. The Radiation Monitoring System is described in the FSAR, Sections 1.3 and 11.2.

Criterion 64 - Monitorin Radioactivit Releases The containment atmosphere is continually monitored during normal and transient station operations using the containment particulate and gas monitors. In the event of accident conditions, samples of the containment atmosphere will provide data of exist-ing airborne radioactive concentrations within the containment.

Radioactivity levels contained in the facility effluent dis-charge paths and in the environs are continually monitored during normal and accident 'conditions by the station radiation monitoring system and by the Health Physics program for this facility as described in Sections 1.3 and 11.2 of the FSAR.

III - 38

2. A endix B - ualit Assurance Criteria for Nuclear Power Plants Since the introduction of Appendix B, a program establish-ing managerial and administrative control for the purpose of quality assurance has been adopted for the Ginna facility.

This program is designed to ensure that continuing activities are conducted in conformance with the applicable requirement of Appendix B, thus meeting the requirements of 50.34 (b) (6)

(ii). While not all formal procedures and instructions are yet completely defined, the quality assurance program is being implemented.

Details of the quality assurance program were submitted to the USAEC as a supplement to the FSAR.

3. A endix C - A Guide For the Financial Data and Related Information Re uired to Establish Financial ualifications for Facilit Construction Permits and 0 eratin Licenses The information required by this Appendix is supplied in the form of Rochester Gas and Electric's 1971 Annual Report accompanying this Technical Supplement.

4. A endix D - Interim Statement of General Polic and Proce-dure: Im lementation of the National Environmental Polic Act of 1969 The Applicant's Environmental Report accompanies this application.

5. A endix E - Emer enc Plans for Production and Utilization Facilities Emergency plans for adverse weather, high water or flood,

earthquake and high radiation are presented in the FSAR.

The Radiation Emergency Plan is identified as Appendix 12A.

Since the submittal of this information, however, plans have been further developed that will meet the requirements of the State of New York and Appendix E of 10CFR50. Radiation emer-gency plans are presently being reviewed by the State of New York's Department of Health, Bureau of Radiological Health and upon their concurrence, these plans will be submitted to the USAEC for inclusion in the FSAR. The plans include the follow-ing:

a. Plans are developed for coping with radiation emergencies that affect areas both inside and outside the restricted area of the station. The plans designate specific pro-cedures to be followed and persons responsible in the Rochester Gas and Electric organization for specific action to be taken in the event of a radiation emergency. In addition, notification and contacts with the appropriate local, state, and federal agencies are specified in the applicable procedures.

b. Specific persons, identified by position, are assigned certain responsibilities in emergency conditions. These include personnel on operations'taff and designated authorities belonging to local, state, and federal agencies.

Special qualifications of personnel are described.

c. Radiation monitors are provided throughout the station and

in the on-site and off-site environment for determining the magnitude of the release of radioactive materials.

The sensitivity of these monitors, the criteria for deter-mining when protective measures are necessary, and sample survey sheets are included on the plans.

d. The specific procedures, and persons and agencies re-sponsible for public warning and evacuation, are described in the plans.

e. Periodic retraining is specified in the plans.

f. Equipment and facilities are provided at the station for personnel monitoring and decontamination. Minor contamina-ted injuries can be treated at the station. However, if the injury is serious and hospitalization is required, the procedure described in the plans will be implemented.

Specific facilities and physicians are designated and trained to handle contaminated injuries.

g. Arrangements are made for the treatment of individuals at appropriate off-site first aid or hospital facilities as described in the plans.

h. All Ginna Station personnel have been trained in their duties for an evacuation. Station fire committees are composed of the shift foreman and the auxiliary operator on duty plus the health physicist and maintenance personnel when they are available. Procedures for techniques of first aid and transportation of personnel, should they receive

a contaminated injury, has been developed with the assist-ance of the Radiation Management Corporation. The emer-gency staff at the Rochester General Hospital has been trained in the handling of contaminated injuries. The emergency plan describes the training of plant personnel as well as other groups.

i. Unannounced simulated incidents are periodically being carried out to train personnel under realistic conditions and to help discover any potential problems in the proce-dure.

j. Personnel are designated to take corrective action at the station to eliminate or reduce the source of radio-activity. The person responsible for overall coordination of the emergency procedures will. direct re-entry to the station as conditions permit.

The radiation emergency plans now being reviewed by the New York State's Department of Health have also been reviewed by the Plant Operation Review Committee. Any changes result-ing from the State's review will also be reviewed by the PORC Committee. The final plan will be reviewed and approved by the Nuclear Safety Audit and Review Board.

6. A endix F - Polic Relatin to the Sitin of Fuel Re rocessinq Plants and Related Waste Mana ement Facilities Since the R.E. Ginna Unit No. 1 is a utilization and not a reprocessing plant, this Appendix is not applicable.

7. Pro osed A pendix G - Fracture Tou hness Re uirements The R.E. Ginna Unit No. 1 reactor vessel was designed and fabricated in accordance with the ASME Boiler and Pres-sure Vessel Code, Section III, "Rules for Construction of Nuclear Vessel", 1965, Section IX; "Welding gualifications",

1965, and ASA B31.1 "Code for Pressure Piping",Section VI, Chapter 3 - 1965. The reactor vessel material opposite the core (shell forgings) was purchased to a specified Charpy V-

, notch impact energy of 30 ft.-lbs. or greater at a nil ductility temperature (NDTT) of 40'F. The material was subsequently tested (drop weight) to determine the actual NDTT and verify that it was less than 40'F. However, in January 1972, the ASME Boiler and Pressure Vessel Code adopted new fracture toughness requirements for ferritic components of nuclear primary systems. These are to be incorporated into Section III of the Code in the Summer 1972 Addenda, and are currently implemented by Code Case 1514. The new fracture toughness requirements of the ASME Boiler and Pressure Vessel Code are in the spirit and intent of Appendix G of 10CFR50.

As with many of the plants already constructed or now being constructed, the required materials were not ordered to the new testing requirements. As was the case with R.E.Ginna Unit No.l reactor vessel material, Charpy V-notch impact tests were'nly run in the longitudinal direction, whereas the new criteria require testing normal to the maximum working direction.

However, methods have been formulated to conservatively estimate the LPT (lowest pressurization temperature) for the reactor vessel. For example, for plates and forgings, where Charpy tests were not run in the direction normal to the direction of maximum working, the values from tests in the longitudinal direction can be reduced 35K to provide a conservative estimation of the properties in the transverse direction. When evaluation in this manner, the toughness properties of the Ginna reactor vessel meet the ASME Section III new fracture toughness requirements.

Curves for heatup limitations and cooldown limitations in the Technical Specifications are based upon an initial NDTT of 40'F. However,'operating limitations during startup and shutdown of the reactor coolant systems were evaluated using Appendix G, "Protection Against Non-Ductile Failure" (Code Case 1514). In compliance with the ASME Code, the RTNDT (reference temperature for NDTT) was based on the weld metal (limiting material) and was O'. After significant results from the surveillance program are available, RTNDT can be determined directly. Provisions have been made for determining the effects of nuclear radiation upon the reactor vessel material by subjecting specimens of the vessel material to core radiation inside the vessel. The radiation surveill-ance program is in accordance with ASTM E-185. To compensate for any increase in the NDTT caused by irradiation, the RT NDT

is changed periodically. Thus, the limits on the pressure temperature relationship are periodically changed to stay within the stress limits as required by ASME Boiler and Pressure Vessel Code Section III.

8. Pro osed A endix H - Reactor Vessel Material Surveillance Pro ram Re uirements The in-service inspection for Ginna is described in the plant's Technical Specifications. Five radiation capsules are installed in the Ginna reactor. They are presently sched-uled for removal on the 1st region replacement, 2nd region replacement, 4th region replacement and after 10 and 30 years.

The first capsule has been removed and specimens are presently being tested in a hot-cell. The results will be reported to the USAEC in a technical report.

9. Pro osed A endix I - Numerical Guides For Desi n Ob'ectives and Limitin Conditions for 0 eration to Meet the Criteria "As Low As Practicable" for Radioactive Material In Li ht Water Cooled Nuclear Power Reactor Effluents.

a. Introduction Present effluent discharge limits for the Ginna Station are based on maintaining radioactive doses and concentra-tions within the limits of 10CFR20. In addition, limits for iodine in gaseous effl'uents are reduced by a factor of 700 to account for possible reconcentration in the grass-cow-milk chain. The effluent discharge limits are contained

in the Technical Specifications.

The proposed Appendix I presents guides for liquid and gaseous waste effluents which are small percentages of the limits.

Plant capabilities and modifications which may be required to permit compliance with the proposed limits are discussed below.

b. Li uid Effluents The new guides in Appendix I specify that the average yearly concentration should not exceed 2 x 10 ~ci/cc and the total quantity discharged must not exceed 5 curies annually (tritium excluded). The average annual concentra-tion for H should not exceed 5 x 10 ~ci/cc.

Two and one-half years of operating experience at Ginna demonstrates that radioactive concentrations in liquid effluents can and have been maintained at a small fraction of 10CFR20 limits at the release point and con-trolled area boundary. This has been accomplished with coolant activity levels corresponding to cladding defects in 0.2 to 0.5% of the fuel rods in the core. In fact, records indicate that limits have and can be maintained below the Appendix I limits. For example, about 1 Ci of fission products were released in 1971 and concentrations in the released effluent were maintained below 10-8~ ci/cc.

Tritium concentrations were on the order of 2 x 10 7 y ci/cc.

Nevertheless, investigations are in progress which may result in additional improvements in the liquid waste system and further reduce radioactivity in liquid effluents.

For example, the laundry water has been a major source of activity in the liquid effluent (especially during refueling). Reverse osmosis is being considered as a means of cleaning and decontaminating this waste. A pro-totype unit is presently being tested in the plant to determine its effectiveness. Installation of additional waste evaporator capacity is also being investigated.

This added capacity might be needed to treat the steam generator blowdown in the event of steam generator tube leakage and high primary coolant activity.

c. Noble Gas Effluents The new Appendix I guides state that noble gaseous effluents should not result in an annual exposure in excess of 10 mrem at any location on or beyond the site boundary.

Current Technical Specifications are based on compli-ance with 10CFR20 limits at the site boundary (unrestricted area HPC). These tlPC values were designed to limit ex-posure of individuals to less than 500 mrem/yr. (based on submersions in an infinite cloud). However, the station has been operating at a very small percentage of the Technical Specification limit (about 1Ã). Doses resulting from the gaseous activity release in 1970, 1971, and 1972

would result in annual doses below 10 mrem.

Gaseous wastes are produced as a result of (1) system off gases, (2) leakage from system components in the containment vessel and (3) leakage from components in the auxiliary building. System off-gases are collected in gas storage tanks to permit decay of short lived activity prior to release to the plant vent. This system has operated satisfactorily (design based on 45-day holdup and 1/ fuel defects). The amount of activity released from the decay tanks is a small fraction of the total effluent released from the plant.

Gases released in the containment building can be held and released under controlled conditions to minimize ef-fluent concentrations. The auxiliary building has been a major source of the noble gas activity release. A con-tinuing effort to repair, modify, or replace leaking com-ponents is expected to further reduce the release of noble gas activities to levels well below Appendix I guides.

d. Iodines and Particulates In Gaseous Effluents Appendix I guidds state that the iodine release to un-restricted areas should not result in average annual con-centrations in excess of 1/100,000 times the limits specified in 10CFR20. A similar requirement applies to particulate activity with half lives in excess of 8 days.

Current Technical Specification limits require that

iodines and particulates with half lives in excess of 8 days be limited to less than 1/700 times the 10CFR20 values.

The isotopes with the greatest potential radiological significance is I131. The site boundary concentration must N

be less than 1.4 x 10 ~ ci/cc to comply with the present Techncial Specification limit. To comply with the Appendix I guide, the gaseous iodine effluents should not result in an annual exposure in excessive of 5 mrem at any loca-tion beyond the site boundary.

Records of effluent releases over the past 2-1/2 years i.ndicate that the plant has operated at a small percentage of the Technical Specification limit. For example, average S

site boundary concentrations in 1971 were less than 20%

of the Technical Specification limit (value based on "

= 5 x 10 sec/m.) The activity released from the auxiliary building in the first part of the year was the primary source of this activity. However, repairs and installation of charcoal filter units to remove iodine from gases vented from tanks and components resulted in a significant re-duction in rate of release of iodine during the latter part of 1971.and early 1972. Subsequent installation of charcoal filtering systems in portions of the auxiliary building ventilation system has resulted in a further re-t duction in iodine release.

With these modifications and considering the site meteorology and the lack of dairy cattle near the site, it is expected that the iodine release from the plant will be maintained well below the Appendix I guides.

10. Pro osed A endix J - Reactor Containment Leaka e Testin For Water Cooled Reactors The Ginna plant Technical Specifications regarding the integrated leakage rate test acceptance criteria and frequency were recently reviewed with changes being made to make the Technical Specifications consistent with specifications approved for other facilities. These changes were approved by the USAEC in a letter from Dr. Peter A. Morris dated March 29, 1971.

The Ginna plant Technical Specifications meet the containment leakage testing requirements set forth in the Proposed Appendix J .

11. Pro osed A endix L - Information Re uested B the Attorne General For Anti-Trust Review of Facilit License A lications The proposed Aopendix L does not apply to the R.E. Ginna Nuclear Power Plant Unit No.l.

III - 50

B. AEC SAFETY GUIDES

1. Safet Guide No.l - Net Positive Suction Head For Emer enc Core Coolin and Containment Heat Removal S stem Pum s Residual Heat Removal Pumps The NPSH of the residual heat removal pumps is evaluated for normal plant shutdown operation and for both the injection and recirculation phase operations of the design basis accident.

Recirculation operation gives the limiting NPSH requirements and the NPSH available is determined from the containment water level, the temperature and pressure of the sump water and the pressure drop in the suction piping from the sump to the pumps.

During recirculation a 43Ã NPSH margin is available.

Safety Injection Pumps The NPSH for the safety injection pumps is evaluated for both the injection and recirculation phase operations of the design basis accident. The end of injection phase operation gives the limiting NPSH requirement and the NPSK available is determined from the elevation head and vapor pressure of the water in the refueling water storage tank and the pressure drop in the suction piping from the tank to the pumps. At the end of the injection phase, a 30Ã NPSH margin is available.

Containment Spray Pump The NPSH for the containment spray pump is evaluated for both the injection and recirculation phase operations of the design basis accident. The end of the injection phase operation

gives the limiting NPSH requirement and the NPSH available is determined from the elevation head and vapor pressure of the water in the refueling water storage tank and the pressure drop in the suction piping from the tank to the pumps. At the end of the injection phase, a 30% NPSH margin is available.

2. Safet Guide No. 2 - Thermal Shock to Peactor Pressure Vessels The effects of safety injection water on the integrity of the reactor vessel following a postulated loss-of-coolant accident, have been analyzed using data on fracture toughness of heavy section steel both at beginning of plant life and after irradiation cor-responding to approximately 40 years of equivalent plant life. The results show that under the postulated accident conditions, the integrity of the reactor vessel is maintained.

Fracture toughness data are obtained from a Westinghouse experi-mental program which is associated with the Heavy Section Steel Technology (HSST) Program at ORNL and Euratom programs. Since results of the analyses are dependent on the fracture toughness of irradiated steel, efforts are continuing to obtain additional confirmative data. Data on two-inch thick specimens became avail-able in 1970 from the HSST Program. This data indicated a strong temperature dependence with a rapid increase in toughness at approx-imately NDT. Presently four-inch thick specimens are being irradi-ated and these will be tested in the spring of 1974. The HSST Pro-gram is scheduled for completion by 1974, at which time the reactor vessel thermal shock program will have been completed.

III - 52

A detailed analysis considering the linear elastic fracture mechanism method, along with various sensitivity studies, was sub-mitted to the AEC Staff and members of the Advisory Committee on Reactor Safety.

Revised material for this report plus additional analysis and fracture toughness data were presented at a meeting with the Containment and Component Technology Branch on August 9, 1968, and forwarded by letter for AEC review and comment on October 29, 1968.

The analysis for the pressurized water reactor under the postulated conditions of Safety Guide No. 2 shows that no thermal shock problem exists. It is not anticipated that the continuing HSST Program will lead to any new conclusions about reactor vessel integrity under LOCA conditions. Several backup positions are available if the results of the HSST Program do not conclusively indicate that vessel integrity could be assured foi the full plant life with the operating modes presently planned. One solution would be to anneal the reactor vessel such that material properties approach the original value. This solution is already feasible, in principle, and could be performed with the vessel in place.

3. Safet Guide No.3 - Assum tions Used for Evaluatin the Potential Radiolo ical Conse uences of a Loss-of-Coolant Accident for Boilin Water Reactors This safety guide is not applicable to the R.E. Ginna Unit No. 1 which is a pressurized water reactor.

III - 53

4. Safet Guide No. 4 - Assum tions Used for Evaluatin the Potential Radiolo ical Conse uences of a Loss-of-Coolant Accident for Pressurized Water Reactors Safety Guide No. 4 gives the assumptions used by the Commission to evaluate the design basis loss-of-coolant'accident. Doses based on RGImE's interpretation of the guides are shown in Table III - 1. Parameters and assumptions used in the analysis are summarized in Table III - 2.

TABLE III - 1 DOSES FROM LOSS OF COOLANT ACCIDENT Exposure Thyroid Dose Whole Body Dose Conditions (Rem) (Rem)

Site Boundary 155. 6.

(2 hrs. at 450 m)

Low Population Zone 36. 1. 2 (30 days at 4800 m)

III - 54

TABLE III-2 LOSS OF COOLANT ACCIDENT ASSUMPTIONS Parameter As sumption Iodine Fraction Available for Release from C. V. 25.%%uoo f Tota 1.Inventory Percent in Elemental Form 85. /0 Percent in Particulate Form 5. /0 Percent in Organic Form 10. /0 Noble Gas Release Fraction 100% of Total Inventory Decay From Holdup in C. V. Yes Spray and Filters Effect 0-2 hr. Reduction Factor 5 (1 spray, 1 filter) 30 day Reduction Factor 10 (1 spray, 1 filter)

Peak Pressure 60 psig (actual = 52)

Leak Rate 0-24 hrs. 0. 2%/day Thereafter 0. 1%/day Release, Height Ground Level Building Wake Factor CA = 440 m2 Depletion by Deposition and Decay in Transit None Breathing Rate 0-8 hrs. 3.47 x 10 m /sec.

8-24 brs. l. 75 x 10 4 m3/sec.

1-30 days 2. 32 x 10-4 m3/sec.

Iodine Dose Conversion From ICRP 11-59 Whole Body Cloud Dose Beta Infinite Cloud x 0. 5 Gamma Semi-Infinite Cloud Dispersion X/Q+

Boundary (450 m) 5~ 3 x ] P-4 sec/m LPZ (4800 m) 9 x lp-5 sec/m3

"<Based on analysis of meteorological data correlated at Ginna Site for the years 1966 and 1967.

5. Safet Guide No.5 - Assum tions Used For Evaluatin the Potential Radiolo ical Conse uences of a Steam Line Break Accident for Boi lin Water Reactors This safety guide is not applicable to the R.E. Ginna Unit No. 1 which is a pressurized water reactor.

6. Safet Guide No. 6 -. Inde endence Between Redundant Standb Onsite Power Sources and Between Their Distribution S stems The electrically powered safety systems are divided into two groups so that loss of either one will not prevent safety functions from being performed.

Each A-C load group has a connection to the preferred (off-site) power source. In a .situation where off-site power is not available, two diesel generators supply standby power to separate redundant load groups. There is no automatic connection between either the diesel generators or the load groups.

The D-C system consists of two separate batteries, each connected to two battery chargers, which supply separate D-C load groups. The battery-charger combinations have no automatic inter connections.

When operating from standby power sources, redundant load groups and the redundant standby sources are independent of

.each other. The standby source of one load group is not automatically paralleled with the standby source of the other load group during accident conditions. In addition, no pro-III - 56

visions exist for automatically connecting one load group to the other or for transferring loads between the redundant diesels.

Interlocks do exist which prevent the cross-connection of the two load groups.

7. Safet Guide No. 7 - Control of Combustible Gas Concentrations In Containment Followin a Loss-of-Coolant Accident A conservative upper limit analysis of potential radiolytic and chemical sources of hydrogen formation under post accident conditions yielded the results shown in Figure 6B-1, Appendix 6B of the FSAR (Revised 1-69). The post accident hydrogen formation mechanisms and assumptions made for estimating the maximum yield of each are summarized in Appendix 6B. A more rigorous calculation of the yield from core gamma absorption has been made, permitting a reduction in that source. Curves A and E of Figure 6B-1 reflect this change. Specific radiolytic yield from core gammas remains at 0.44 molecules per 100 ev, however, the inventory of long-lived gamma emitters in the fuel has been adjusted to represent a true burnup cycle.

In addition, Figure 6B-1 includes the results of a compara-tive calculation in which gamma energy deposition in the fuel and water of the core region is based on a lumped model rather than a homogeneous model. These results are shown as curves A'nd E'. Since this model is more nearly representative of the physical system, the lower yield curve obtained in the lumped model is apt to be more realistic. By this method, the lower flammability limit would be reached in 31 days.

Two hydrogen recombiner units are installed in the Ginna Plant containment. The purpose of these units is to prevent the uncontrolled post accident buildup of hydrogen concentrations in the containment.

The recombiner system consists of two full-rated subsystems, each capable of maintaining the ambient H2 concentration at 2 v/o.

Each subsystem contains a.combustor, fired by an externally supplied fuel gas, employing containment air as the oxidant.

Hydrogen in the. containment air is oxidized in passing through the combustion chamber. Hydrogen gas is also used as the externally supplied fuel in order that non-condensible combustion products are avoided which would cause a progressive rise in containment pressure. Oxygen gas is made up through a separate containment feed to prevent depletion of 02 below the concentration required for stable operation of the combustor.

Each recombiner is equipped with an air supply blower to deliver primary combustion air and quench air which reduces the unit exhaust temperature, an ignition system, and associated monitoring and control instrumentation. The system is designed to operate -at ambient steam overpressures corresponding to 0-5 psig in the containment, and to withstand the design basis transient environment prior to operation. It can be periodically tested during plant operation.

Alternatives to Operation of the Recombiner Venting of the containment atmosphere prior to accumulation of an explosive mixture of hydrogen has been evaluated as an

alternative to use of the recombiners. If purging is necessary it will be done in a manner that will minimize off-site doses.

That is, all releases will be made from the plant vent through HEPA and charcoal filters, and the releases will be coordinated with observed meteorological conditions.

Dose rates resulting from purging have been computed on a probabilistic basis using measured weather data for one year for the Ginna site. The computational procedure is to vary the purge flow rate as a function of the containment radioactive material inventory, based on Safety Guide No. 4, and hourly values of X/g and wind direction, so as to control the off-site dose increment in any 22 1/2'ector in any one hour to a small amount. Purging is not performed if conditions call for a rate of less than 10 cfm and is limited to a maximum rate of 500 cfm. The rate of hydrogen buildup in containment used in the analysis was that given for the homogeneous model Figure 6B-1 of the FSAR.

The results of the computation show that at the 5X probability level the maximum hydrogen concentration can be limited to less than 4 v/o without subjecting any individual off-site to a dose in excess of 1.5 rem to the thyroid or 0.5 R whole body. During 95K of the potential purge periods the doses would be lower.

It is concluded that proper protection of the health and safety of the public is served by providing the recombiner system, thus avoiding the necessity of venting at any specific time.

III - 59

However, the study reported above indicates that an alternative means exists for avoiding a serious hazard by controlled venting

, if for any reason the recombiner were not operable.

8. Safet Guide No. 8 - Personnel Selection 8 Trainin Personnel selection and training for the Ginna Station was completed before ANSI-18,1, "Proposed Standards for Selection and Training of Personnel for Nuclear Power Plants" was published.

However, the existing personnel and positions conformed very closely with the requirements of ANSI-18.1. Since that time, selection of personnel, their qualifications, training, and retraining have been done to conform to ANSI-18.1 - 1971 as suggested by the safety guide.

9. Safet Guide No. 9 - Selection of Diesel-Generator Set Ca acit for Standb Power Su lies The diesel-generator capacities were based on a conservative evaluation of power requirements in the event of a loss-of-coolant accident simultaneous with a loss of station reserve power supply.

Each of the gener ators has a nameplate continuous rating of 1950 KW with a 0.8 power factor at 900 RPM with 3 phase, 60 cycle, 480 volt operation. The unit also has a short-term rating of 2300 KW for one-half hour and 2250 KW for two succeeding hours.

While paragraph 2 of the safety guide regulatory position does not specifically apply to the load ratings of the Ginna diesels, it III '- 60

does indi cate the desired conservati sm. During the ini ti al injection phase, which lasts less than 2-1/2 hours, the power requirement is less than 90K of the two hour limit of 2250 KW.

Once this initial phase is completed, the power requirements are less than 905 of the continuous duty rating of the diesel.

During preoperational testing, the diesel was operated at the power levels specified above. The power required to run the safeguards loads under preoperational testing was less than that estimated because of the difficulties in simulating accident loads.

The containment air, for instance, was less dense than that exoe-rienced in an accident and thus reduced the power loading. Be-cause of this the diesel was tested at rated rather than actual load.-

Both diesels are capable of starting, accelerating, and

/

attaining rated voltage within 10 seconds of a loss of voltage on .a safeguard bus. During testing, the loading sequence and timing has been checked and has performed satisfactorily. Dur-ing this loading sequence, the voltage has not dropped below 75K of rated output and-has returned to within 10Ã of rated voltage within 40K of the load sequence time interval. A load loss from 1005 to zero power will not cause an overspeed trip of either diesel. Frequency checks during tests have not been addressed specifically, however, no unusual variations have been noticed.

The suitability of both diesels was confirmed through preoperational

testing and in periodic testing done since that time.

10. Safet Guide No. 10 - Mechanical Cadweld S lices in Re-inforcin Bars Of Concrete Containments Tension splices for bar sizes larger than 811 were made with Cadweld splice. To ensure the integrity of the Cadweld splice the quality control provided for a random sampling of splices in the field. The selected splices were removed and tested to destruction. A sampling of splices was initially tested to destruction to develop an average (x) and deviation (~). Suf-ficient samples were tested to provide a 99 percent confidence level that 95 percent of the splices met the specification require-ments. The distribution established permitted the development of the lower limit below which no test data should fall. If the result of any test fell below this limit, the subsequent or pre-vious splice was sampled; If the result was above the lower limit, the process was considered to be in control. If this result was again below the lower limit, the process average was recalculated and an engineering investigation was'equired to determine the cause of the excess variation and control reestablished. The average of all tests was required to remain above the minimum tensile strength.

As additional data became available, the average and standard de-viation were updated. The actual frequency of testing carried out was one specimen for each 25 splices made for each crew for the first 250 splices made by that crew and one test for each 100 splices thereafter . In addition, where deformed bars were attached to structural steel members, specimens were made and e

tested to 'ensure that the weld of the splice to the member did not fail before the rebar or the splice. The frequency of testing these specimens was the same as that for the normal splice.

In sampling the Cadweld splices a test was concurrently performed on the rebar. Where the rebar failed prior to the splice, a check was provided on the ultimate strength of the rebar, thus providing a check on conformance with the manu-facturer's certifications and the ASTM standards. In addition, certified mill test reports were received from the rebar supplier and checked for conformance with specification requirements.

Where the special large size bars (i.e. 14S and 18S) were spliced, the Cadweld process was used so that the connection could develop the required minimum ultimate bar strength. Where Cadweld splice was used, including in the cylinder and dome, the splices were staggered a minimum of three feet. An exception to this practice is in the vicinity of the large openings. Where reinforcing bars are anchored to plates or shapes, such as is the case for the dome bars anchored into the cylinder and the interrupted hoop bars at penetrations, the Cadweld splices all occur in one plane. Lapped splices are detailed in accordance with ACI-63.

Where Cadweld splices were used to anchor reinforcing bars to a structural steel member, a procedure of testing coupons was used to demonstrate that the welding process was under control.

This procedure required each welder to initially make coupons as qualification procedure. The procedure was repeated at a frequency of one coupon for each one hundred production units.

Each coupon required testing of two Cadweld connections.

In addition, the welding procedure complied with the specifications of the American Welding Society and provided for 1005 visual inspection of welds.

ll. Safet Guide No.ll - Instrument Lines Penetratin Primar Reactor Containment The reactor protection system is designed on a channelized basis to achieve isolation between redundant protection channels.

The channelized design is applied to the analog as well as to the logic portions of the protection system. Although shown for four channel redundancy, the design is applicable to two and three channel redundancy.

Isolation of redundant analog channels originates at the process sensors and continues back through the field wiring and contain-ment penetrations to the analog protection racks. Physical separation is used to the maximum practical extent to achieve isolation of redundant transmitters. Isolation of field wiring is achieved using separate wireways, cable trays, conduit runs and containment penetrations for each redundant channel. Analog equipment is isolated by locating redundant components in dif-ferent protection racks. Each channel is energized from a separate A-C power feed.

The reactor trip bistables are mounted in the protection racks and are the final operational component in an analog protection channel. Each bistable drives two logic relays

("C" 8 "D"). The contacts from the "C" relays are interconnected to form the required actuation logic for Trip Breaker No. 1 through D-C power feed No. 1. The transition from channel identity to logic identity is made at the logic relay coil/

relay contact interface. As such, there is both electrical and physical separation between the analog and the logic portions of the protection system. The above logic network is duplicated for Trip Breaker No.2 using D-C power feed No.2 and the contacts from the "D" relays. Therefore, the two redundant reactor trip logic channels will be physically separated and electrically isolated from one another . Overall, the Protection System is comprised of identifiable channels which are physically, elec-trically and functionally separated and isolated from one another.

The bistable portions of the protective system (i.e., relays, bistables, etc.) provide trip signals only after signals from analog portions of the system reach preset values. Capability, is provided for calibrating and testing the performance of the bistable portion of protective channels and-various combinations of the logic networks during reactor operation.

The analog portion of a protective channel (i.e., sensors and amplifiers) provides analog signals of reactor or plant parameters. The following means are provided to permit checking

the analog portion of a protective channel during reactor operation:

a. Varying the monitored variable

b. Introducing and varying a substitute transmitter signal

c. Cross checking between identical channels or between channels which bear a known relationship to each other and which have readouts available The design permits the administrative control of the means for manually bypassing channels or protective functions.

The design permits the administrative control of access to all trip settings, module calibration adjustments, test points, and signal injection points.

All instrumentation signal lines penetrating the contain-ment vessel are electrical (with the exception of the six containment pressure signal lines') and pass through electrical penetrations. The containment pressure sensing lines have manual isolation valves outside the containment vessel.

12. Safet Guide No.12 - Instrumentation For Earth uakes Section 2.9 of the FSAR discusses the seismology of the Ginna plant site. An investigation of the earthquake history of the northeastern United States and eastern Canada was used to develop estimates of the maximum expected and maximum credible earthquake which could affect the site. There is no instrumental or verifiable record of extremely large magnitude shocks and no record of damaging earthquakes with epicenters within 50

miles of the site. Further, it appears unlikely that there are any active faults or zones of structural weakness in or near the site.

A strong motion accelerograph is installed at the Ginna plant and is located in the,.basement of'the Intermediate Bui ld-ing. The operability of the instrument can be better assured in this location where periodic surveillance can be performed.

This would be difficult should the instrument be located in,.the basement of the Containment. In addition, retrieval of the shock record can more readily be made with the instrument in the pre-sent location.

The response of the accelerograph located in the basement of the Intermediate Building will be virtually the same as one located in the basement of the Containment. This will assure that meaningful data will be obtained.

13. Safet Guide No.13 - Fuel Stora e Facilit Desi n Basis The spent fuel pit is a reinforced concrete structure with a seam-welded stainless steel plate liner. This structure is designed to withstand the anticipated earthquake loadings as a Class I structure so that the liner prevents leakage even in the event the reinforced concrete develops cracks.

All structures have been designed for wind loads in accord-ance with the requirements of the State of New York - State Building Construction code. The wind loads tabulated in this code are based on a design wind velocity of 75 miles per hour

at a height of 30 feet above grade level. The stresses result-ing from these loads were considered on the basis of a working strength design approach. In addition, the spent fuel pit has been evaluated with regards to cyclonic winds. While potential missiles may puncture the spent fuel pit liner, they will not penetrate through the concrete walls or base and cause gross leakage of water.

Interlocks have been provided on the auxiliary building crane to prevent the crane hook from passing over stored fuel.

The interlocks and the auxiliary building layout are such that it is not necessary to defeat a crane interlock during a normal refueling operation. Since the fuel pit is at =the end of the crane run, the interlocks are not defeated during normal opera-tion of the station.

The area around the spent fuel pit is enclosed by the auxiliary building. In addition to other ventilation systems in this build-ing a 20,000 cfm system is provided to provide a sweep of air specifically across the top of the spent fuel pit. Originally, air was only passed through a HEPA filter before being exhausted to the atmosphere. Early in 1971, however, a charcoal filter was added to this discharge system to filter out the iodine in the air and thus improve the design to account for the assumption that all fuel rods in one fuel bundle might be breached if a refuel-ing incident occurred.

The fuel pool has been evaluated on the basis of dropping a

fuel cask into the spent fuel pit. While some damage would probably occur to the liner, the cask will not break through the reinforced concrete to cause a major leak.

There are no spent fuel pit designs, permanently connected systems and/or other features that by maloperation or failure could cause loss of fuel storage coolant to the extent that fuel would be uncovered. A maloperation or failure in the filter-ing or cooling systems will not cause the fuel to be uncovered.

The spent fuel pit is provided with level monitoring equip-ment which gives an alarm in the control room if the level drops. The radiation level just above the spent fuel pit is also monitored. A reading of this level is indicated locally and at the control room. A radiation level above setpoint will cause an alarm on the control board. The filtering system associated with the air just above the spent fuel pit is always in operation.

Before being exhausted from the plant this air always passes I

through HEPA filters first. During refueling operations this air is also filtered with impregnated charcoal filters. The addition of the charcoal filters to the airstream is done manually.

A seismic Category II makeup system has been provided to add coolant to the pool. In addition, a redundant filling system is available in the form of the fire system. The makeup rate is greater than any calculated leak rate.

III - 69

14. Safet Guide No. 14 - Reactor Coolant Pum Fl. heel Inte rit Precautionary, measures, taken to preclude missile forma-tion from primary coolant pump components, assure that the pumps will not produce missiles under any anticipated accident condition.

The primary coolant pumps run at 1189 rpm, and may operate briefly at overspeeds up to 109K (1295 rpm) during loss of out-side load. For conservatism, however, 125Ã of operating speed was selected as the design speed for the primary coolant pumps.

For the overspeed condition, which would not persist for more than 30 seconds, pump operating temperatures would remain at about the design value.

Each component of the primary pumps has been analyzed for missile generation. Any fragments would be contained by the heavy stator. The same conclusion applies to the impeller because the small fragments that might be ejected would be contained by the heavy casing.

As for the pump motors, the most adverse operating condition of the flywheels is visualized to be the loss-of-load situation.

The following conservative design-operation conditions preclude missile production by the pump flywheels. The wheels are fabri-cated from rolled, vacuum-degassed, ASTM A-533 steel plates.

Flywheel blanks are flame-cut from the plate, with allowance for exclusion of flame-affected metal. A minimum of three charpy tests are made from each plate parallel and normal to the rolling

direction, to determine that each blank satisfies design requirements. An NDTT less than + 10'F is specified. The finished flywheels are subjected to 100/ volumetric ultrasonic inspection. The finished machined bores are also subjected to magnetic particle or liquid penetrant examination.

These design-fabrication techniques yield flywheels with primary stress at operating speed to less than 50% of'he mini-mum specified material yield strength at room temperature (100 to 150'F). Bursting speed of the flywheels has been calculated on the basis of Griffith-Irwin's results(1)to be 3900 rpm, more than three times the operating speed.

A fracture mechanics evaluation was made on the reactor coolant pump flywheel. This evaluation considered the following assumptions:

a. Maximum tangential stress at an assumed overspeed of 125Ã compared to a maximum expected overspeed of 109K

b. A through crack through the thickness of the flywheel at the bore

c. 400 cycles of start up operation in 40 years Using critical stress intensity factors and crack growth data attained on flywheel material, the critical crack size for failure was greater than 17 inches radially and the crack growth data was 0.030" to 0.60" per 1000 cycles.

(1)

Ernest L. Robinson, "Bursting Test of Steam-Turbine Oisk Wheels,"

Transactions of the A.S.M.E. , July 1944

An ultrasonic inspection capable of detecting at least 1/2" deep cracks from the ends of the flywheel and a dye pene-trant or magnetic particle test of the bore both at the end of 10 years will be more than adequate as part of a plant surveill-ance program.

The design specifications for the reactor coolant pumps include as a design condition the stresses generated by a maxi-mum hypothetical earthquake ground acceleration of 0.2 g. The pump would continue to run unaffected by such conditions. In no case does any bearing stress in the pump exceed or even ap-proach a value which the bearing could not carry.

In order to preclude undetected flywheel deterioration during plant life, even though such deterioration is not expected, the ultrasonic inspections are repeated at intervals during plant life.

Following a hypothetical bearing seizure the flywheel is not expected to twist off. Therefore, it has been concluded that the reactor coolant pumps are not sources of missiles and the engineered safeguards are not in jeopardy.

15. Safet Guide No. 15 - Testin of Reinforcin Bars for Concrete Structures The present day codes for testing of reinforcing bars for concrete structures were not available at the time that the Ginna plant was built. The codes and practices followed do generally conform to the present day standards, however.

The concrete reinforcement used in the containment building and other Class 1 structures is deformed bar intermediate grade billet-steel conforming to the requirements of "Specifications for Billet-Steel Bars for Concrete Reinforcement",ASTM A15-64, with deformations conforming to "Deformed Bars for Concrete Reinforcement", ASTM A305-56T. Special large size concrete reinforcing bars are deformed bars of intermediate grade billet-steel conforming to "Specifications for Large Size Deformed Billet-Steel Bars for Concrete Reinforcement," ASTM-A408-64.

Reinforcing steel conforming to these specifications has a tensile strength of 70,000 psi to 90,000 psi and a minimum yield point of 40,000 psi.

All splicing and anchoring of the concrete reinforcement is in accordance with ACI 318-63. There was no splicing of bars by arc welding. The special large size bars were spliced by the Cadweld process.

It is to be noted that intermediate grade reinforcing steel is the highest ductility steel commonly used for construction.

Certified mill reports of chemical and physical tests were sub-mitted to the Engineer, Gilbert Associates, Inc., for review and approval. Each bar was branded in the deforming process to carry identification as to the manufacturer, size, type, and yield strength, for example:

B - Bethlehem 18 - Size 18S

N - New billet steel Blank - A-15 and A-408 steel 6 - A-432 60,000 psi yield 7 - A-431 75,000 psi yield Because of the identification system and because of- the large quantity, the material was kept separated in the fabricator's yard. In addition, when loaded for m'ill shipment, all bars were properly separated and tagged with the manufacturer's identifica-tion number.

Visual inspection of the bars was made in the field for inclusions and representative randomly selected samples of reinforcing bar stocked on site were tested for user's tensile tests.

The specifications stipulate that "Arc welding concrete reinforcement for any purpose including the achievement of electrical continuity shall not be permitted unless noted other-wise on the- drawings."

Concrete cover of reinforcing bar was at least as much as Specification ACI-318.

16. Safet Guide No. 16 - Re ortin of 0 eratin Information During the operating period that Ginna station has been producing power, reporting has followed the intent of 10CFR20, 40, 50, 70, and 73. Therefore, Rochester Gas 5 Electric Corpora-tion is complying with Safety Guide No. 16 as well as all report-ing requirements set forth in the- Technical Specifications.

17. Safet Guide No. 17 - Protection A ainst Industrial Sabota e The Rochester Gas and Electric Corporation submitted a pro-prietary document titled "Security at the Ginna Facility" to the Atomic Energy Commission by cover letter dated October 8, 1971.

This document describes in detail the implementation by RGSE of those sections of the Safety Guide applying to control of access and selection of personnel.

That aspect of the program for protection against industrial sabotage which deals with the monitoring of critical equipment at the station is accomplished by locks, alarms and/or control room indicators. Abnormal performance or status of safety re-lated components and systems can quickly be detected by control room monitoring and the appropriate action taken by operations and security personnel in the event of attempted sabotage. Further precautions are taken by locking critical valves not monitored in the control room to the position essential to normal safe operations.

Further protection against industrial sabotage is afforded by the design and arrangement of equipment at the station. This aspect of the program includes the optimization of physical sepa-ration of major components and associated equipment to minimize the effects of industrial sabotage.

18. Safet Guide No. 18 - Structural Acce tance Test for Concrete Primar Reactor Containments After completion of the construction of the entire contain-ment vessel, a structural integrity test was performed, where a pneu-matic pressure at 69 psig (ll5 percent of the design pressure

of 60 psig) was maintained for approximately four hours. The pressurization of the vessel was done so as to permit readings and measurements more fully described hereafter. The readings and measurements were made during the initial pressurization (with pressure maintained a minimum of 3 hours) at 0 psig, 14 psig, 35 psig, 60 psig, and at maximum test pressure of 69 psig, and thereafter during depressurization at 60 psig, 35 psig and 0 psig. Except for the maximum pressure level (69 psig), the vessel pressure was slightly increased above the level at which the measurements were taken; and the pressure was then reduced to the specified value and observations made after at least ten minutes to permit an adjustment of strains within the structure.

Because the structure is so large, displacement measurements were made with sufficient precision to serve as confirmation of previously calculated response; The test program further in-cluded, in addition to displacement measurements, a continuous visual examination of the vessel to observe concrete cracking.

Observations of the entire vessel surface were made from exist-ing or temporary platforms with special attention given to perti-nent locations, including primarily major discontinuities. 'A complete description of the instrumentation used to,measure response is described below.

Predicted displacements developed for an internal pressure .

of 69 psig, which is the maximum pressure for the structural proof test, is included below. Although strain measurements were made, no predicted measurements are provided consistent with agree-

ments previously documented in Appendices A,B, and C of Gilbert Associates, Inc., Report GAI 1720 . Strain values obtained, however, are analyzed to determine magnitude and direction of principle strains.

Maximum predicted crack widths for specifications are described below.

The installation of all- targets, LVDTs, whitewash for crack observations, load cells, tapes, strain gages, photoelastic discs, cameras, junction boxes, wires, readout instruments, support structures, and platforms were completed prior to initiat-ing pressurization of the vessel. The location for all instru-mentation is shown in Table I of GAI 1720 . In addition, the covers on the enclosures over the tendon anchors and the wax sur-rounding the anchor head were removed to permit inspection of the anchorage, including button heads, during the test. Men were sta-tioned at the three locations for theodolite measurements, at the ledge for tendon anchorage inspection, and at each location where crack measurements were made. These men were equipped with com-munication means to maintain contact with a control located in the Intermediate Building at elevation 253 ft.-6 in. where read-out instruments were located. In addition, three men were available to travel over accessible walkways to inspect the outer vessel surface.

All acquired data plus the interpretations of the results were incorporated in GAI Report No. 1720. It was recognized during the test that should the data include any displacements 1

Structural Integrity Test of Reactor Containment Structure GAI Report No. 1720, Gilbert Associates, Inc., October 3, 1969

which were in excess of the predicted extremes, such discrep-ancies needed to be resolved by means of a review of the design, an evaluation of measurement errors and material variabi,.lity, and conceivably an exploration of the structure. However, the data revealed that acceptance limits for displacements were, in fact, not exceeded thereby precluding the need for such additional action.

The type of instruments used were as follows:

a. Jig transit with scales and targets

b. Invar tapes

c. LVDT (Differential Transformers)

d. Strain gages

e. Rosette strain gages

f. Photoelastic discs

g. Load cells Cylinder base rotation and displacement were measured utiliz-ing LVDTs (Differential Transformers) at three azimuths, one of which was directly below the equipment access opening. At each azimuth two LVDTs were located near. the base of the structure with six foot vertical separation. These radial displacements were used to determine the actual base rotation. Also, at each azimuth one LVDT was used to determine the vertical displacement of the elastomer pad.

h Radial displacement measurements were made at a total of fifteen locations using a jig transit, base targets, and mounted scales.

A base target was attached to the structure at each of three different azimuths around the base of the cylinder. Five scales were attached (at each azimuth) three along the height of the cylinder and one each just above and below the ledge (i.e.,

elevation 343 ft.- 2 in.). Relative radial displacements were determined at each scale location by aligning the transit with the base target and by plunging/ the'cope up from the base target to each scale. Variations in the scale readings from the original reading indicated the amount of displacement.

The vertical displacement of the cylinder at the top (rela-tive to the base ring at three azimuths for side wall elongation and average tendon strain) was 'determined using three invar tapes.

The tapes were mounted at the ledge and extended down to the base ring, where weights tensioned the tapes. A scale at the base was read using an engraved mark on 'the tape to indicate relative elongations.

LVDTs were utilized at twenty-eight locations on concrete around the equipment access opening to measure horizontal and vertical displacements. Along the horizontal axis, on one side only, six horizontal and six vertical displacements were obtained to a point twenty-one feet out from the edge of the hole. An identical set of displacements was obtained on the vertical axis above the hole. Additionally, on the horizontal and vertical axis,'f those displacements previously mentioned, another point on each axis was selected to measure vertical and horizontal

displacements at a point two feet from the opposite edge of the hole.

Displacement measurement accuracies are as follows: The jig transits, using an optical micrometer, had a resolution of 0.001 inch and an accuracy of 0.005 to 0.010 inch. The LVDTs and associated instrumentation had a resolution of better than 0.001 inch and an accuracy of 0.002 to 0.005 inch.

A total of forty-six reinforcing bars were instrumented for strain measurements, twenty-eight were at locations similar to LVDT displacement measurement locations around the equipment access opening, and eighteen were at locations above and below the ledge.

The liner was instrumented with rectangular rosettes at six locations, to indicate general strain in regions unaffected by geometric discontinuities, and at thirty-two locations around four typical penetrations. Eight rosettes were used at each penetration.

Strain gages were attached to the tendon-anchorage bearing plates at tendon 13, 53, 93, and 133.

Load cells were installed under the button head of tendons 13, 53, 93, and 133.

The strain gages on reinforcing bars and associated instru-mentation had a resolution of 0.4 microinch per inch strain and an accuracy of 2 to 3 microinches per inch. The strain gages on the steel liner had a resolution of 1 microinch per inch and

an accuracy of approximately 5 microinches.

The strain gages on the bearing plates and the associated instrumentation had a resolution of 1 microinch per inch and an accuracy of approximately 5 microinches per inch. The instru-mentation utilized for the tendon load cell had a measuring accuracy of 1/2 percent of full load capacity.

Photoelastic discs, 1-1/2 to 2 inches in diameter, were placed on the liner, around the same four penetrations where strain gages .were installed, to qualitatively augment the local values indicated by the strain gages. Approximately fifteen discs were located in one quadrant for each of four penetrations.

(This resulted in approximately 25 percent surface coverage up to one diameter away from the opening.)

Reading and recording of all measurements were made just prior to pressurizing, after depress'urizing, and at each pressure increment, except that only one quadrant of photoelastic discs at each penetration were photographed while the structure was pressurized.

The identification and location of the instruments are shown on Figures 2,3,4, and 5 of GAI Report No. 1720. These instruments were located in such a way that the actual response of the vessel during the test was determined and verified, with the criteria established prior to the performance of the test. The location of scales and gages are as described in Table I of GAI Report

Most of the Structural Integrity Test instrumentation performed well and their recorded data are regarded as being valid.

Some discrepancies in the data were noticed. The significant discrepancies were noted and discussed. The number of discrep-ancies was small compared with the amount of data recorded.

The results of the Structural Integrity Test showed the stresses, strains, and displacements were within the limits as defined in the Final Facility Description and Safety Analysis Report (FSAR) and the GAI predicted results. The whitewash areas revealed crack patterns and spacings in good agreement with GAI's prediction; there were no horizontal cracks in dome concrete except for construction joints. The base shear restraint was stiffer than anticipated. The strains and displacements of the cylinder wall, the discontinuity of dome and cylinder wall, and dome revealed the structural stiffness of the containment vessel is greater than anticipated.

The structural capacity of the Containment Vessel met and exceeded its imposed criteria.

A detailed analysis and description of the Ginna plant containment vessel structural integrity test is contained in GAI Report No. 1720.

19. Safet Guide No. 19 - Nondestructive Examination of Primar Containment Liners All weld seams in the lin'er plate are covered with a test channel to permit testing for leaks. Except for the equipment

access hatch all penetrations provide a double barrier against leakage and can be pressurized to permit testing of leak tightness.'ll penetrations through the containment reinforced concrete pressure barrier for pipe, electrical conductors, ducts, and access hatches are of the double barrier type.

In general, a penetration consists of a sleeve embedded in the reinforced concrete wall and welded to the containment liner.

The weld to the liner is shrouded by a test channel which is used to demonstrate the integrity of the joint. The pipe, duct or access hatch passes through the embedded sleeve and the ends of the resulting annulus are closed off,,generally by welded end plates. Piping penetrations have a bellows type expansion joint mounted on the exterior end of the embedded sleeve where required to compensate for differential motions. The only exceptions to providing an annulus about piping occurs for the three drain lines from Sump "B".

All welded joints for the penetrations including the reinforce-ment about the openings (i.e., sleeve to reinforcing plate seam) were fully radiographed in accordance with the requirements of the ASNE Nuclear Vessels Code for Class "B" Vessels except that non-radiographable joint details were examined by the liquid pene-trant method. For fully radiographed welds, acceptance standards for porosity are as shown in Appendix IV of the Nuclear Vessels Code. (The ASNE Unfired Pressure Vessels Code states that porosity is not a factor in the acceptability of welds not required to be fully radiographed.)

Penetrations are designed with double seals so as to permit individual testing at design, pressure. In this case an adulter-ant gas method is used. An air distribution system is provided .

for periodic testing.

All penetr ations are provided with test canopies over the liner to penetration sleeve welds. Each canopy, except those noted below, is connected to, and pressurized simultaneously with, the annulus between its penetration's pipe and sleeve when under test. The exceptions are the canopy for the fuel transfer penetration which must be pressurized independently of the. annulus because of the separation posed by the transfer canal liner and the three pipe penetrations in sump "8" in which only the canopies are pressurized as there are no annuli.

Longitudinal and circumferential welded joints of the liner within the main shell, the welded joint connecting the dome to the cylinder, and all joints within the dome were inspected by the liquid penetrant method and spot radiography. All penetrations including the equipment access door and the personnel locks were examined in accordance with the requirements of the ASME Nuclear Vessels Code for Class "8" Vessels. All other shop fabricated components including the reinforcement about openings were fully radiographed. All other joint details were examined by the liquid penetrant method. Full radiography is performed in accordance with the procedures and governed by the acceptability standards of Paragraph N-624 of the ASME Nuclear Vessels Code. Spot radio-

graphy is performed in accordance with the procedures and governed by the standards of Paragraph Ull-52 of the ASME Unfired Pressure Vessels Code. Methods for liquid penetrant examination were in accordance with Appendix VIII of the ASME Unfired Pres-sure Vessels Code. All piping penetrations and personnel locks were pressure tested in the fabricator's shop to demonstrate leak tightness and structural integrity.

In order to ensure that the joints in the liner plate and penetrations as well as all weld connections of test channels were leak-test, the Technical Specifications for the containment liner required that all welds "shall be examined by detecting leaks at 69 psig test pressure using a soap bubble test or a mixture of air and freon... and 100 percent of detectable leaks arrested". These tests were preliminary to the performance of the initial integrated leak rate test which ensured that the contain-ment leak rate was no greater than 0.1 percent of the contained volume in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 60 psig.

The liner weld seams were also examined by pressurizing the test channels to design pressure (60 psig) with a mixture of air and freon, and checking all seams with a halogen leak detector. All detectable leaks were corrected by repairing the weld and retesting.

The Technical Specifications for the containment liner require the following quality control measures for welding:

The qualification of welding procedures and welders was in

accordance with Section IX "Welding gualifications" of the ASME Boiler and Pressure Vessel Code...Contractor shall submit welding procedures to the Engineer for review...

The qualification tests described in Section IX,'art A, include guided bend tests to demonstrate weld ductility. All penetrations...shall be examined in accordance with the require-ments of the ASME Nuclear Vessels Code for Class "B" Vessels.

Other shop fabricated components including the reinforcement about openings shall be fully, radiographed. All non-radiograph-able joint details shall be examined by the liquid penetrant method.

Conformance to this code was adhered to in all applicable cases.

20. Safet Guide No. 20 - Vibration Measurements on Reactor Intervals A vibration analysis and test program was developed for the Ginna plant by Westinghouse Corporation. The preoperational d dc 11 Ch dc AA'i AA.

Summar of Startu Test Ex erience at Ginna Nuclear Power Plant Unit No.l of the Technical Su lement Accom an in A lication To Increase Power. The results show that the vibration of the reactor intervals for the Ginna plant are well within the'existing criteria.

A program was conducted during the fir'st refueling shutdown of the R.E. Ginna reactor (March, 1971) to inspect and evaluate the performance of the reactor internals and c'ore components.

This inspection program was based on an inspection of all compon-ents, with emphasis on the thermal shield area since the thermal

shield has previously been the most vulnerable problem area.

The structures inside and outside of the lower internals, the upper internals, three control rod drive shafts, and all RCC control rods were inspected using a closed-circuit underwater TV and/or boroscope. All of the inspections performed by television were recorded on video tape; photographs were taken through the borescope to record that portion of the inspection. This inspection revealed no problem areas in any of the items inspected.

The inspection program is described in Westinghouse report WCAP-7780, "Robert E. Ginna Nuclear Generating Station, March, 1971 Refueling Shutdown Reactor Intervals and Core Components Evaluation".

21. Safet Guide No. 21 - Measurin and Re ortin Effluents from Nuclear Power Plants Starting with January 1, 1972, Plant effluent monitoring and reporting has been prepared in the format given in Appendix A of Safety Guide 21 and submitted to the State of New York on a monthly basis. A report in the format of Appendix A has been provided to the Commission for the year 1971. The Technical Specifications as revised March 1, 1972 follow the intent of the Safety Guide 21 for measuring and recording the plant effluents and are being followed. Plant records will be maintained to demonstrate that the sensitivity of analysis is within the limits given in the safety guide.

An on-site meteorological tower was fully operational early

in 1965 and was used extensively in the collection of pre-operational meteorological data. During early 1972, the record-ing instrumentation was relocated inside the turbine building.

Data are currently being used in upgrading calculations of dilu-tion factors for radiological releases.

Preoperational on-site meteorological data were evaluated to provide a basis for controlled radiological gas release limits, accident analysis, and storm prediction criteria in the FSAR.

Basic and critical meteorological parameters are recorded at the Ginna site. This information provides Rochester Gas and Electric Corporation with the capability of assessing the potential dispersion characteristics of radioactive releases to the environment through the atmosphere. Such assessments provide Rochester Gas and Electric Corporation with the ability to demonstrate that operations are well within the limits of 10CFR20.

22. Safet Guide No. 22 - Periodic Testin of Protection S stem Actuation Functions The plant protection system has been designed to permit periodic testing to extend to and include actuation devices and actuated equipment whenever practicable. hhile it is not possible to operate all actuation devices (such as trip of control rods) or significantly vary most of the operating parameters (such as coolant pressure) during operation, it is possible to test most equipment when the plant is in full power operation.

The bistable portions of the protective system (i.e., relays,

bistables, etc.) provide trip signals only after signals from analog portions of the system reach preset values. Cap-ability is provided for calibrating and testing the performance of the bistable portion of protective channels and various com-binations of the logic networks during reactor operation.

The analog portion of a protective channel (i.e., sensors and amplifiers) provides analog signals of reactor or plant parameters. The following means are provided to permit checking the analog portion of a protective channel during reactor opera-tion:

a. Varying the monitored variable

b. Introducing and varying a substitute transmitter signal

c. Cross checking between identical channels or between channels which bear a known relationship to each other and which have readouts available.

During operation it is also possible to test the pumps used in a safety injection. For instance, each high head safety injection can be and is tested on a monthly basis to insure that the pump performs so as to equal or better the performance required by the design curve.

Testing that cannot be done during operation is completed during refueling shutdowns. The safety injection system is tested to see that as a system it can perform according to,design. When completed the test shows that separate and redundant actuation signals are operative and that the valves and pumps that are

required for safety injection are indeed operable.

l]here the ability of a system to respond to a bona fide accident signal is intentionally bypassed for the purpose of performing a test during reactor operation, the expansion of the bypass condition to redundant systems is prevented. In addition, the condition is automatically indicated to the reactor operator in the main control room.

23. Safet Guide No. 23 - On Site Meteorolo ical Pro rams e

The Ginna plant site meteorology is described in Section 2.7 of the FSAR. The two year pre-operational meteorological program data is summarized in that section of the FSAR.

These data have been utilized by the Commission and the Rochester Gas and Electric Corporation for accident analysis and gaseous release limit determination during the initial license application for a 1300 Hl<t rating and more recently during their review of the application by the Rochester Gas and Electric Corporation to increase its licensed power level from 1300 alt to 1520 NMt. tagore information on the meteorological tower is provided in the discussion of Safety Guide 21 and in the environ-mental report that is an attachment of this application.

24. Safet Guide No. 24 - Assum tions Used for Evaluatin the Potential Radiolo ical Conse uences Of a Pressurized llater Reactor Radioactive Gas Stora e Tank Failure The activity in a gas decay tank is taken to be the maximum amount that could accumulate from operation with cladding defects

in one percent of the fuel rods. The maximum activity is ob-tained by assuming the noble gases xenon and krypton are ac-cumulated with no release over a full core cycle. This postu-lated amount of activity, one Reactor Coolant System equilibrium cycle inventory, is 46,000 curies equivalent Xe-133. This value is particularly conservative because some of this activity would normally remain in the coolant, some would have been dispersed earlier through the stack, and the shorter lived isotopes would have decayed substantially.

Samples taken from gas storage tanks in pressurized water reactor plants in operation show no appreciable amount of iodine.

To define the maximum doses, the release is assumed to result from gross failure of a gas decay tank giving an instantaneous release of its volatile and gaseous contents to the atmosphere.

The maximum whole body P-f dose, based on meteorology previously described in Safety Guide No.4, is less than a few rem ( c 3). This is well below the 25 rem guideline value in 10CFR100.

25. Safet Guide No. 25 - Assum tions Used for Evaluatin the Potential Radiolo ical Conse uences of a Fuel Handlin Accident in the Fuel Handlin and Storage Fa'cilit for Boilin and Pressurized Water Reactors The Ginna plant spent fuel pit charcoal filter system was designed and constructed prior to the issuance of Safety Guide 25.

The following is the design basis for the spent fuel pit char-coal system at the Ginna Station.

Desi n Basis Full power operation for 810 days at 1024 rating, MMt 1550 Time of fuel handling accident after plant shutdown, hours 100 Total number of rods damaged 179 Assembly power/core average 1.80 Fuel rod gap inventory, percent of total I-131 10.0 Xe-133 2.58 Kr-85 29.3 Xe-135 0.697 Fuel Pit D.F.

Iodine 150 Noble gases Activity released from pool I-131, curies 270 Xe-133, curies 1.96 x 104 Activity released to site boundary I-131, curies 27.0 Xe-133, curies 1.96 x 104 Atmospheric'dispersion x/g, sec/m3, 0-2 hrs. 5.3 x 10 4 III - 92

Desi n Basis cont Conversion factors Breathing rate, m /sec 3.47 x 10 4 Dose conversion factors ) TID 14844 Decay constants ) MCAP-7518L Site Boundary Dose Thyroid, rem 6.0 Mhole body, rem 0.5 Filter Design Flow rate, cfm 20,000 Single pass efficiency, percent 90 Estimated doses using Safety Guide No. 25 assumptions would be about 5 times higher for the thyroid (30 r'ad) and about 10 times higher for the whole body (5 rad). These doses are still well below 10CFR100 guideline values.

26. Safet Guide No. 26 - ualit Grou Classification 8 Standards Although Safety Guide 26 was not in effect when the Ginna Station was constructed, the Rochester Gas and Electric Corporation will classify the systems in the Ginna Station in accordance with this guide.

27. Safet Guide No. 27 - Ultimate Heat Sink The circulating water intake system of the Ginna Station is designed to provide a reliable supply of Lake Ontario water, regardless of weather or lake conditions, to a suction of the condenser circulating pumps, house service water pumps and

the fire water pumps. The intake system is designed to withstand, without loss of function,'round accelerations of 0.2 g acting in the vertical and horizontal planes simultaneously. With two pumps operating, the rated capacity of the Circulating Mater System is 334,000 gpm. Operation of a single circulating water pump reduces the nominal f'iow rate by about 50Ã,

In meeting the high reliability requirements of this safety guide, the intake system is completely submerged below the sur-face of the lake. A ten foot diameter reinforced concrete lined tunnel, driven through bed rock, extends 3,100 feet northerly from the shore line. The tunnel rises vertically and connects to a reinforced concrete inlet section. An occurrence of historical low water level will result in a depth of water of 30 feet at the inlet with 15 feet of cover over the top of the inlet structure.

The probability of water stoppage due to plugging of the inlet has been reduced to an extremely low value by incorporating certain design features in the system. Heavy screen racks with bars spaced at 10 inch centers will prevent large objects from entering the system. Redundant traveling water screens, 1/2 inch mesh, located in the screen house will remove trash from the cool-ing water. At conditions of full flow (354,600 gpm) the velocity at the intake screen racks is .8 feet per second. The plant cooling water requirements during an accident would be approx-imately 10,000 gpm which would result in a velocity of .02 feet per second.

In addition, water enters on a full 360'ircle thereby

protecting against the possibility of stoppage by a single large piece of material. The low velocity plus the submergence provides assurance that floating ice will not plug the intake.

The only phenomenon that is credible to contribute to the plug-ging would be the accumulation of frazil ice on the screen racks.

To prevent such a formation, the bars. have been separated 10 inches on center making it very unlikely that frazil ice could support itself over a span of this distance. Secondly, the bars have electric heaters which will keep the metal surface above 32'F which eliminates the adhesive characteristics of frazil ice to metal objects. Warm water recirculation is provided for in the screen house to melt any ice that might reach this point.

Detailed analysis of high and low water effects of Lake Ontario on intake water along with the influence of the most severe natural phenomena on the high and low water levels is described in Appendix 2C of the FSAR.

28. Safet Guide No. 28 - ualit Assurance Pro ram Re uirements The standards, specifications, and guidelines existing at the time the Ginna Station was constructed, pertinent to "quality assurance",were at least met or exceeded. Details of the "quality assurance" program implemented are described in Section I of the Final Facility Description and Safety Analysis Report.

Currently a "quality assurance" program is being instituted for the operation, maintenance, and system redesign of the Ginna plant that conforms to the guidelines of N45.2-1971.

29. Safet Guide No. 29 - Seismic Desi n Classification The Ginna Station conforms completely to this safety guide with the exception of the spent fuel pit cooling loop which is a Class II system located in Class I structures.

III - 96

IEEE CRITERIA

1. Criteria for Protection S stems For Nuclear Power Generatina Stations ( IEEE 279-1971)

a. Design Basis The station, conditions which require protective system action are enumerated in Section 2.3 of the Technical Specifi-cations. The station variables that are required to be monitored and the levels that, when reached, will require protective action are also described in that section. The protection system is designed to perform automatically with precision and reliability to initiate appropriate protective action when required.

The minimum number and location of the sensors required to monitor adequately, for protection function purposes, those variables referenced in Section 2 of the Technical Specifications that have a spatial dependence are not explicitly described.

Rather, this minimum is described implicitly by detailing the number and locations of sensors whose function is not required for continued safe operation. The source, intermediate and power range sensors, their locations and their range of operation are described in Section 7.4 of the FSAR. The neutron sensors are the only station protective system components possessing a spatial dependence. The number of source, intermediate and power range neutron-flux-measuring sensors which can be inoperable without deleterious effect on the safety of continued station operation are described in Table 3.5-1 of the Technical Specifi-cations.

The instrumentation systems are designed to perform their functions while accommodating system response times and inaccuracies. The Technical Specifications detail the limiting safety system setting for protective instrumentation.

Instrument errors, setpoint errors, instrument delay times, and calorimetric errors are taken into account in transient analyses which are given in Section 14 of the FSAR.

Prudent operational limits for each variable referenced above are interpreted to be those levels which will produce alarms but will not necessarily produce a protective system action. Each process variable referenced above has, in addition to its alarm function, a level providing protection system action. These values are called out and verified in the pre-operational tests that were performed. The operation modes in which these are applicable are specified in Section 2.3 of

.the Technical Specifications. Margins, with appropriate interpretive information, between each operational limit and level marking the onset of unsafe conditions are specifically described.

The range of transient and steady-state conditions of both the energy supply and the environment during normal, abnormal, and accident circumstances throughout which the system must perform has been evaluated and appropriate features have been incorporated to accommodate them. The reactor protection system is designed to fail safe, i.e., to produce a protective action

in the event of loss of power to the protection system. All system components are designed to operate indefinitely under the environmental conditions to which they are exposed under both steady-state and transient, and normal and anticipated abnormal station operating conditions. Reactor protection system components which can be exposed to excessive heat, humidity, and pressure due to the accidents described in the FSAR are qualified to perform their required functions for the duration of time required f'r engineered safety features opera-tion and post accident monitoring. Many components would un-doubtedly requi.re extensive maintenance or replacement before they could again be relied upon to perform their design functions.

Exposure to accident conditions would, however, also require an exhaustive instrumentation checkout along with maintenance or replacement as indicated.

Because of the design and physical separation and electrical isolation, fire, explosion, missles, and natural phenomena are not likely to affect a sufficient number of channels so as to compromise the system functions . Compliance with the separa-tion and single failure criteria and "fail safe" 'design insure that the system will operate reliably on demand. All channels of the reactor protection system are subject to the same environ-mental conditions in the control room although channel separation and electrical isolation are maintained. Should fire or natural phenomena require evacuation of the control room, alternate means

of safely shutting down the station from outside the control room are provided. These are discussed in the FSAR in Section 7.7.3.

The protection system seismic design 'requirements are such that the design basis, earthquake will not result in loss of the system function.

b. Requirements The station protection systems, with precision and reli-bility, automatically initiate appropriate protective action whenever a condition monitored by the system reaches a preset level. The reactor protection system will automatically initiate load cutbacks, inhibit rod withdrawal, or trip the reactor de-pending on the severity of the condition. The instrumentation used to initiate action other than trip is generally similar to the reactor protection system. The protection systems are further described in the FSAR in Section 7.

As described in Section 7 of the FSAR, the protection systems not only accommodate any single failure without loss of function, but also provide protection against spurious actuation because of the coincident logic design.

The quality of 'instruments and components for use in the protective system was specifically examined during the design to ensure that they were consistent with the objectives of mini-mum maintenance and low failure rates.

When designing Ginna Station, consideration was given to the III - 100

channel integrity of all protection systems during the extremes of environment that were hypothesized. Although complete equip-ment qualification data was not available at that time, l<est-inghouse Electric Corporation has done type tests on the equip-ment similar to that installed in the protection system used at Ginna Station. These tests demonstrated that the protection system would function as necessary during the malfunctions, accidents, or other unusual events as indicated in this criteria.

Channel independence is carried through the system extend-ing from the sensor to the relay providing the logic. The A-C power supplies to the channels are excited by four separate instrument buses. Independence is maintained by use of separate channel penetrations, cable trays, and equipment compartments.

Control and protection systems employ the same measurement where applicable. The protection is separate and distinct from the control system. Control signals which are-derived from the protection system measurements are transferred through isolation amplifiers. This prevents a failure in the control circuitry from affecting the protection system. The isolation amplifiers are classified protection system components and have been qualified by testing under conditions of maximum postulated faults.

The design is such that a single random failure which could cause a control- system action resulting in a station 'condition requiring protection is seen as a trip demand in the channel

designed to protect against the condition. -The remaining re-dundant protection channels may be degraded by a second random failure or removed from service without loss of the protection.

function.

The design provides a protection system which monitors a wide spectrum of process variables by different means. Equip-ment, location, and measurement diversity protects against multiple failures from a credible single event.

The entire protection system has the capability of being tested and calibrated with the reactor at power. Testing is discussed in the FSAR in Section.7. All instrumentation has the capability for sensor checks. Sensor testing can be done by perturbing the system variable, introducing a substitute input or, by comparing sensors which measure a like variable.

The system is designed to permit any one channel to be maintained and when required, tested or calibrated during power operation without system trip. During such operation, the active parts of the system continue to meet the single failure criterion. Exception is made in the one-of-two systems that are permitted to violate the single failure criterion dur-ing channel bypass provided that acceptable reliability of opera-tion can be otherwise demonstrated.

Operating bypasses that are removed automatically are restored automatically when permissive conditions are not met.

Manual bypasses that are immediately available to the operator III - 102

(located on the control board) are automatically reset or may be manually re-established by the operator. Manual bypasses that are not automatically reset are designed to permit admin-istrative control over their use. In all cases, there is con-tinuous indication in the control room if the trip function of some part of the system has been bypassed or taken out of service.

The protection system is designed so that once initiated, a protective action will go to completion. The return of the plant to normal operation will require deliberate operator action.

Administrative control of the means of. manually bypassing a channel or protective function is provided by controlling access to the control room and areas where a bypass can be affected.

Where multiple setpoints have been designed into the Ginna Station protection system, the design is in accordance with the other criteria of this standard as described in this submittal.

t1eans are provided for manual initiation of the protective system action. Failures in the automatic system do not prevent the manual actuation. The manual actuation requires the opera-tion of a minimum of equipment.

Access to setpoint adjustment, calibration, and test points're designed to be under administrative control.

All protective actions are indicated and identified down to the channel level. Also, each is designed to provide the operator with accurate, complete, and timely information pertinent

to its own status and to generating station safety. The design

,has been engineered to minimize the development of conditions which would cause meters, annunciators, recorders, alarms, etc.

to give anomalous indications confusing to the operator.

The system is designed to facilitate recognition, location, repair or replacement, and the adjustment of malfunctioning compo-nents and modules.

Finally, all the protection system equipment required for station safety or continuity of operation is distinctly identified from redundant portions of the system.

2. Class lE Electric Systems for Nuclear Power Generatin Stations IEEE 308-1971)

a. Principal Design Criteria The criteria states. that Class IE electric systems shall be designed to ensure that any design basis event as listed in Table 1 of the standard will not cause a loss of electric power to a number of engineered safety features, surveillance devices or protection system devices sufficient to jeopardize the safety of the station. The design basis events include earthquakes, winds, tornadoes, other 'natural phenomena and various postulated accidents.

All electrical systems and components vital to plant safety, including the emergency diesel generators, are designed as Class I and are .designed so that their integrity is not impaired by the maximum potential earthquake, wind storms, floods, or disturbances on the external electrical system. Power, control III - 104

and instrument cabling, motors and other electrical equipment required for operation of the engineered'safety features are suitably protected against the effects of either a nuclear system accident or of severe external environmental phenom'ena in order to assure a high degree of confidence in the operability of such components in the event that their use is required.

There is no known-loss of electric power to equipment that could result in a reactor power transient capable of causing significant damage to the fuel or to the reactor coolant system as a result of a design basis event.

The preferred power supply (off-site power) has a voltage variation of not more than plus or minus 10 percent and a frequency variation of not more than plus or minus 0.5 per-cent. Variations of voltage and frequency of the standby power supply (diesel-generators) will not degrade the performance of any load to the extent of causing significant damage to the fuel or to the reactor coolant system.

Controls and indicators are provided in the control room and locally for the standby power supply and for the circuit breakers required to switch the Class IE buses between the preferred and standby power supply. Transfer is automatic on loss of the preferred supply.

All components of the Class IE electric systems are identified with permanently installed equipment piece-number tags. Design, operating and maintenance documents for each major component III - 105

were identified as they were received from the equipment suppliers, and the identification associates each component with its par-ticular system.

Class IE electrical equipment is physically separated from its redundant counterpart either by distance, barrier walls or by location on different floors.

Each type of Class IE elecric equipment was designed, manufactured and tested in. accordance with the latest standards in existence at the time of manufacture. This equipment was analyzed to ensure that it would successfully perform its func-tion under normal and design basis events. In addition to this, preoperational testing was -performed to verify equipment operation.

Failure mode analyses have been done for all Class IE electrical systems. These analyses show that a single component failure, does not prevent satisfactory performance of the Class IE systems required for safe shutdown and maintenance of post-shutdown or post-accident station security.

The Class IE electric systems are described in detail in Section 8 of the FSAR. The systems consist of an alternating current power system, a direct current power system, and an in-strumentation and a control system to supply acceptable power to the station for any design basis event.

b. Alternating Current Power Systems The alternating current power systems include power supplies, distribution systems and load groups arranged to provide alter-

nating current electric power to the Class IE loads. Sufficient physical separation, electrical isolation and redundancy is provided to prevent the occurrence of a common failure mode in the Class IE systems.

The Class IE electric system is-divided into two redundant load groups. Safety actions by each group of loads is redundant and independent of the'safety actions provided by its redundant counterpart. Each load group .has access to both the off-site and standby power supply. Two independent 34.5KV transmission lines make up the preferred off-site power supply and two independent diesel-generators make up the standby power supply.

The preferred off-site 'power supply is the 34.5-4.16KY station auxiliary transformer. This transformer has two sources of supply, one from 115-34.5KV transformer at the Ginna switch-ing station and one from a 34.5KV line, the routing of which is entirely independent of the main transmission right-of-way.

If the preferred source should fail, the final sources of emergency power are two emergency diesel-generators sets.

The emergency diesel-generators start automatically and come up to speed within ten seconds after initiation of the start signal.

(1) Distribution Systems By design, each distribution circuit is capable of trans-mitting sufficient energy to start and operate all required loads in that circuit. Distribution circuits to redundant equipment

are physically and electrically independent of each other. Sepa-rate power buses and separate cable runs are used.

Auxiliary devices required to operate dependent equipment are supplied from related bus sections such that loss of electric power in one load group does not cause the loss of function of equipment in another load group. By means of circuit breakers located in the auxiliary building and the screen house, (both Class I structures) it is possible to disconnect portions of the Class IE system that are located in other than seismic Class I structures.

The distribution system is monitored to the extent that it is shown to be ready to perform its intended function. The sur-veillance program is ihcluded in the Technical Specifications.

(2) Preferred Power Supply The preferred power supply consists of two 34.5 KV circuits that are independent. One circuit originates at substation 13A, the other from substation 204.

This system, is designed to furnish the starting and operating power requirements for the shutdown of the station and for the operation of emergency systems and engineered safety features.

It also functions as start-up power and reserve power for all unit auxiliaries.

A minimum of one circuit is available from the transmission network during normal operation.

(3) Standby Power Supply The standby power supply provides power for the operation of

emergency systems and engineered safety features during and follow-ing the shutdown of the reactor when the preferred power supply is not available.

The standby sources become available automatically following the loss of the preferred power supply within a time consistent with the requirements of the engineered safety features and A

the shutdown systems under normal and accident conditions.

A failure of any unit of standby power source does not jeop-ardize the capability of the remaining standby power sources to start and run the required shutdown systems, emergency systems and engineered safety feature loads.

1l Status indicators are provided to monito'r the standby power supply continuously. The indicators are located at the standy power supply and in the control room. Annunciators, located in the control room, alarm the status of the standby power supply. Local indicators are as follows:

(a) fuel oil level (b) starting air pressure (c) fuel oil pressure (d) lube oil pressure Automatic or manual controls are provided to:

(a) Select the most suitable power supply to the distribution system.

(b) Disconnect appropriate loads when the preferred power supply is not available.

(c) Start and load the standby power supply.

III - 109

Manual controls are provided to permit the operator to select the most suitable distribtuion path from the power supply to the load.

Protective devices are provided to isolate failed equipment automatically; Two 6,000 gallon underground storage tanks serve only the two emergency diesel-generators. These tanks have sufficient capacity for 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> operation of both diesel-generators at load, simulta-neously, or one diesel-generator at load for 80 hours. The actual load on a diesel-generator needed to place the station in a safe shutdown condition is significantly less than the full-load rating of the diesel-generator. This supply allows adequate time for makeup supplies of oil if required. This is discussed in the FSAR.

The standby power supplies are started and operated at rated load for 1/2 hour on a monthly basis. This program is included in the Technical Specifications.

c. Direct Current Power Systems The direct current power systems include power supplies, a distribution system and load groups arranged to provide direct current electric power to the Class IE direct current loads and for control and switching of the Class IE systems. Sufficient physical separation, electrical isolation and redundancy are provi'ded to prevent the occurrence of common failure modes in the station's Class IE systems.

(a) The electric loads are separated into two redundant load groups.

(b) Safety actions by each group of loads are redundant and independent to the safety actions provided by its redundant counterpart.

(c) Each redundant load group has access to a battery and one battery charger.

(d) The batteries do not have a common failure mode.

These items are discussed in Section 8 of the FSAR.

(1) Distribution System Each distribution circuit is capable of transmitting sufficient energy to start and operate all required loads connected to it.

Distribution circuits to redundant equipment are independent of each other.

Auxiliary devices required to operate dependent equipment are supplied from a related bus section to comply with this criterion. It is possible to disconnect portions of Class IE systems located in Class I structures from those portions located in other than Class I structures. The'disconnecting means are breakers on the battery,. boards which are located in Class I battery board rooms. The system is monitored with indicators and alarms in the control room to the extent that, it is. shown to be ready to perform its intended function.

(2) Battery Supply Each battery supply consists of storage cells,'onnectors

and connections to the D-C distribution system supply breaker.

Each battery supply is independent of the other supply, and is capable of starting .and carrying all required loads. Each battery supply is immediately available during normal opera-tions and following the loss of power from the alternating current system.

Each battery is kept fully charged and floating across its battery charger . Stored energy is sufficient to operate all necessary breakers to provide an adequate sour ce of power for all connected loads.

Battery voltmeters located in the control room indicate the status of the battery suppliers.

(3) Battery Charger Supply The battery chargers provide all the D-C power required for normal station operation as long as A-C power is available.

Each supply consists of a full capacity and a parallel half-capacity charger. The full capacity charger has sufficient capacity to restore the battery from the design minimum charge to its fully-charged state while supplying normal steady-state loads. The two supplies are indendent of each other.

The capability for isolating each charger is provided by means of circuit breakers in the alternating current feeder and the 0-C output circuit.

(4) Protective Devices Protective devices are provided to isolate failed equip-ment automatically. Indication is also provided to identify

e

the equipment that is made unavailable.

(5) Performance Discharge Test Provisions To be sure that all cells, connections, jumpers, etc.,

satisfactorily handle full-rated current if necessary, each battery has been tested under full load and each component individually examined.

d. Vital Instrumentation and Control Power Systems Dependable power supplies are provided for the vital instru-mentation and control systems of the unit including:

(1) The nuclear plant protection, instrumentation and control systems.

(2) The engineering safety features instrumentaion and control systems.

Power is supplied to these systems in such a manner as to preserve their reliability, independence and redundancy.

e. Surveillance Requirements (1) Preoper ational Equipment Tests and Inspection The initial equipment tests and inspections were per-formed with all components installed, They demonstrated the following:

(a) All components were correct and properly mounted.

(b) All connections were correct and circuits were continuous.

(c) All components were operational.

(d) All metering and protective devices were properly cali-brated and adjusted.,

(2) Initial System Test The initial system test was performed with all components installed. The test demonstrated the following:

(a) The Class lE loads can operate properly on the preferred power supply.

(b) The loss of the preferred power supply can be detected.

(c) The standby power supply can be started automatically and can accept design load within the design basis time.

(d) The standby power supply is independent of the preferred power supply.

(3) Periodic Tests The periodic test programs are included in the Technical Specifications. Tests are performed at scheduled intervals to:

(a) Detect possible deterioration of the system toward an unacceptable condition.

(b) Demonstrate that, standby power equipment and other.

components that are not exercised during normal operation of the station are operable. If surveillance tests indicate that any Class IE systems are degraded, the Technical Specifications impose operating limitations.

3. Electrical Penetration Assemblies in Containment Structures for Nuclear Fueled Power Generatinq Stations (IEEE 317 - A ril 1971)

Electrical penetrations are designed and demonstrated by test to withstand, without loss of leak tightness, the containment post-accident environment and meet the following guide that was III - 114

available during construction:

IEEE - Proposed Guide for Electrical Penetration Assemblies in Containment Structures for Stationary Nuclear Power Reactors (Eighth Revision)

The electrical penetration sleeves, being part of the contain-ment vessel, were designed in accordance with the ASME Boiler and Pressure Vessel Code,- Section III, Subsection B, for Class B vessels.

The penetration assemblies are capable of preventing leakage from the containment under the following environmental conditions:

Parameter Normal ~Emer enc Temperature ('F)

Containment 150 286 Auxiliary Building 50 to 100 50 to 150 Containment Pressure (psig) 60 Relative Humidity (percent)

Containment 100 100 Auxiliary Building 100 All welded joints for the penetrations including the rein-forcement about the openings are fully radiographed in accordance with the requirements of the ASME Nuclear Vessel Code for Class "B" Vessels except that non-radiographable joint details are examined by the liquid penetran't method. Verification of leaks tightness is by means of pressurizing test channels.

Penetrations are designed with double seals so as to permit individual testing at design pressure. In this case an adulterant III - 115

gas method is used. An air distribution system is provided for periodic testing. Test canopies over the liner are provided.

The canopy is connected to, and pressurized simultaneously with,

,the annulus between its penetration's pipe and sleeve when under test.

There are generally four types of electrical cable penetra-tions required depending on the type of cable involved:

Type 1 - High voltage power 4160 volts Type 2 - Power, control and instrumentation; 600 volts and lower Type 3 - Thermocouple leads Type 4 - Coaxial and triaxial circuits All four types of penetration designs are a cartridge type.

The cartridge length and the supporting of cables immediately out-side containment are designed to eliminate any cantilever stresses on the cartridge flange.

The specification for penetrations cover all aspects of equip-ment design, manufacture, inspection, and testing.

For inspection of components in the fabrication shop, Rochester Gas -and Electric Corporaton personnel both from the field organization and from the operations supervisory group have taken part.

The design engineer and quality control engineer developed specific quality control plans which detailed the inspections, surveillance, record verification, and surveillance which quality control personnel p'erformed in the supplier's plant. Westinghouse

or its subcontractors prepared specifications and procedures for on-site storage, erection, quality control and testing.

4. ualif in Class I Electric E ui ment for Nuclear Power Generatin Stations IEEE 323 A ril 1971 The components of the protection system are designed and laid out so that the mechanical and- thermal environment accompanying any emergency situation in which the components are required to function does not interfere with that function.

The equipment that must withstand the most severe environment I

is that which is in the containment. The instrumentation, motors, cables and penetr ations located inside containment are either protected-from containment accident conditions or are designed to withstand, without. failure; exposure to the worst combination of temperature, pressure; and humidity expected during the re-quired operational period.

guality standards of material selection, design, fabrication, and inspection governing the above features conformed to the ap-plicable provisions of recognized codes and good nuclear practice.

5. T e Tests of Continuous -, Dut Class I Motors Installed Inside the Containment of Nuclear Power Generatin Stations (IEEE 334-1971)

Of those motors installed within the containment of the Ginna Station only the motors on valve- operators and the fan motors of the containment air recirculation cooling and filtration system are required to be Class I. The valve motors, however, are not subjected to continuous duty. Therefore, IEEE 334-1971 does III - 117

not apply to them.

The containment air recirculation cooling and filtration system fan motors are continuous duty. The fans, motors, electrical connections and all other equipment in the containment necessary for operation of the system are capable of operating under the environmental conditions following a loss-of-coolant accident.

The system has sufficient margin. to withstand an overrated condition of 90 psig and 318'F for one hour without- loss of operability. The system is designed to operate at 60 psig and 286'F for th'ree hours followed by 21 additional hours at 20 psig and 219'F.

All components are capable of withstanding or are protected from differential pressure which may occur during the rapid pres-sure rise to 60 psig in ten (10) seconds.

Any single active component failure in the system will not de-grade the heat removal capability.

Overload protection for the fan motors is provided at the switchgear by overcurrent trip devices in the motor .feeder breakers.

The fan motor feeder breakers can be operated from the control room and can be reclosed from the control room following a motor overload trip.

Fan motor tests included the following:

(a) Extensive tests in a steam and chemical environment.

(b) Six motor coils irradiated to levels of 106, 107, and 2 x 10 rads . During the exposure the coils were operated at normal motor running temperature.

III - 118

(c) Selected bearing greases were irradiated to 2 x 10 rads and then used in bearings undergoing tests to deter-mine their ability to stand up under working conditions following exposure.

6. Installation, Ins ection anQ Testin Re uirements for Instru-mentation and Electric E ui ment Durin the Construction of Nuclear Power Generatin Stations (IEEE 336-1971 An evaluation of prospective suppliers was conducted prior to awarding of a contract for important components. This evalua-tion established that the supplier had acceptable design, manu-facturing and quality control capability. To accomplish his work he was supplied individual equipment specifications covering all aspects of equipment design, manufacture, inspection and testing.

For Class I components, such as those in the reactor coolant system, a specification which defined the quality control require-ments was made a oart of each purchase order.

The instrumentation and electrical equipment for engineered safeguards and reactor protection were subjected to receiving inspection, pre-installation operability and calibration checks, and pre-operational functional and calibaration tests.

Rochester Gas and Electric field inspectors examined equipment for cleanliness, workmanship, capability of being maintained and operability. The primary purpose, however, of the Rochester Gas and Electric inspection was to independently audit and monitor the quality control program established by the prime contractor. In addition, the project erigineer had the authority to stop work in III - 119

any area that he considered could affect the. adequacy or safety of the plant.

Care was exercised in cable 'operations, such as pulling, splicing, terminating, routing 'and tagging of cable, and in the installing of penetration assemblies. A11 these operations were verified to be in accordance with drawings and installation procedures.

Many of the activities which the standard recommends be done during construction were performed during the preoperational test phase. This may be substantiated by referring to the preoperational test procedures and data forms. Others, classified as construction tests, were performed immediately following installation. These tests included tests for proper phasing, voltage, rotation, ground-ing, polarity and the like.

Preoperational tests included most of the elements of the post-construction verification phase described in the standard, and some of the elements deferred from the installation phase. For example, while verifications of cable terminations are called for during installation, these were verified again during the preopera-I tional tests.

7. Trial Use Criteria for the Per iodic Testin of Nuclear Power Generatin Station Protection S stems IEEE 338-1971)

The station has the capability for sensor checks, channel tests and channel calibration., The testing program is based on the calculations that were presented in the basis of the Technical Specifications.

III - 120

All protective instrumentation has the capability of being tested and calibrated. Instrumentation -that requires testing between reactor shutdowns also has the capability for being tested during normal operation. The satisfactory operation of .each redundant channel may be verified 'and credible failures can be detected. A scheduled test program is presented in the Technical Specifications. The test intervals are based on a failure probability analysis.

All. sensor checks and tests are either done by perturbing the monitored variable, introducing a substitute input or compar-ing sensors which measure like variables. The test signal ampli-tude 'is varied to determine that the protective action will occur when the set point is reached. These set points include the effects of instrumentation errors.

Written procedures are maintained for all tests. The results are documented and records are kept.

8. Seismic uglification of Class I Electrical E ui ment for Nuclear Power Generatin Stations IEEE 334-1971)

All systems and components designated Class I are designed so that there is no loss of function in the event of the maximum potential ground acceleration acting in the horizontal and vertical directions simultaneously. The working stresses for both Class I and Class II items are kept within allowable values for the design earthquake.

All components, systems'nd structures classified as Class I

are designed in accordance with the following criteria:

1. Primary steady state stresses, when combined with the seismic stress resulting from the response to a 'ground acceleration of 0.08g acting in the vertical and horizontal planes simul-taneously, are maintained within the allowable working stress limits accepted as good practice and appropriate design

.standards.

2. Primary steady state stresses, when combined with the seismic stress resulting from the response to a ground acceleration of 0.20g acting in, the vertical and horizontal planes simul-taneously, are limited so that the function of the component, system or structure shall not be impaired so as to prevent a safe and orderly shutdown of the plant.

III - 122

IV STATUS OF PREVIOUS COMMENTS REGARDING R.E.GINNA NUCLEAR POWER PLANT UNIT NO. 1 A. ACRS LETTFR DATED MAY 15, 1969

l. Examination of A ro riate Flood Level The plant is protected from wind driven waves by a break-water with a top elevation of 257.0 feet and by the discharge canal which run's parallel to the lake shore between the break-water and the plant. It is unlikely that any wave tops would spill significant amounts of water over the breakwater because the regular and gradual slope of the lake bottom (about 1 ft.

.for 100 ft.) causes large waves to break offshore, because wave heights are fetch limited in the lake and because the direction-ally persistent high speed winds which could cause large waves do not usually occur during the months when lake water levels are high. But, should spillover occur, the canal is designed so that it will act as a gutter draining water back to the lake.

The general plant grade elevation, except in the areas nearest the lake front, is .270 ft. Class I equipment is flood protected to a minimum elevation of 253.5 ft., thus providing sufficient margin above the maximum expected flood level. Such equipment is located inside buildings which provide further protection from wave action and water damage.

2. Stron Motion Accelero ra h A stong motion accelerograph has been installed at the Ginna plant. It is located in the intermediate building base-

ment and has been mounted near the containment wall. A letter to Dr. Peter A. Norris dated September 16, 1970 described and presented the basis for the location selected for the instrument.

3. Examination of Potential for Axial Xenon Oscillations Xenon oscillation tests have been conducted at the Ginna plant on three separate occasions, May 1970, February 1971, and January 1972. During the January 1972 test the part-length rods were inserted and the boron concentration was 275 ppm with the reactor at 1300 NWt. The core was still stable at this low boron concentration'nd was actually more stable than during the previous test at a higher boron concentration.

The upper and lower chambers of the excore nuclear power range channels are used for detection of axial offset. After the excore system is calibrated initially by use of the movable in-core system, recalibration is needed only infrequently to compensate for changes in the core and for changes in the detectors. If the axial offset is not maintained within the specified limits an automatic cutback in the overpower and overtemperature aT set points will occur. This automatic action thus maintains the reactor within its safety limits.

4. Control Rod Mal osition Annunciation The Ginna plant has been equipped with a system, independ-ent of the on-line process computer, whose function is to moni-tor and alarm any condition of abnormal power distribution of

ment and has been mounted near the containment wall. A letter to Dr . Peter A. Morris dated September 16, 1970 described and presented the basis for the location 'selected for the instrument.

3. Examination of Potential for Axial Xenon Osci llations Xenon oscillation tests have been conducted at the Ginna plant on three separate occasions, May 1970, February 1971, and January 1972. During the January 1972 test the part-length rods were inserted and the boron concentration was 275 ppm with the reactor at 1300 MWt. The core was still stable at this low boron concentration and was actually more stable than during the previous tests at higher boron concentrations.'he upper and lower chambers of the excore nuclear power range channels are used for detection of axial offset. After the excore system is calibrated initially by use of the movable in-core system, recalibration is needed only infrequently to compensate for changes in the core and for changes in the detectors. If the axial offset is not maintained within the specified limits an automatic cutback in the overpower and overtemper ature wT set points will occur. This automatic action thus maintains the reactor within its safety limits.

4. Control Rod Mal osition Annunciation The G'irma plant has been equipped with a system, independ-ent of the on-line process computer, whose function is to moni-tor and alarm any condition of abnormal power distribution of

sufficient magnitude to lead to a possible violation of a safety limit.

The signal actuating this monitor and alarm is derived from a comparison of the output current of each external ion chamber in either the top or bottom array with the average of output currents obtained from its companion ion chambers in that array. A deviation of pre-determined magnitude will actuate the alarm.

This monitoring system will supplement the information available to the operator from the process computer. The system provides an alarm independently derived from rod devia-tion, which deviation might cause a power maldistribution.

When either alarm system is inoperative, the operator shall increase his administrative surveillance over the parameters of concern, i.e., when the nuclear flux alarm is inoperative, the operator shall observe and record ion chamber currents periodically, comparing individual with average readings.

Similarly, if the computer is inoperative, the operator shall observe and record individual rod positions, comparing them with its own control rod bank position. Operation of the facility under these conditions has been included in the Technical Specifications.

5. Accident Related To Dro in of Irradiated Fuel In The S ent Fuel Pit Charcoal filters were installed in the fuel storage area

of the Ginna plant prior to the Spring 1971 refueling shut-down. The design basis for the spent fuel pool charcoal system was given in a letter to Dr. Peter A. Norris dated February 3, 1971.

6. Effect Of Fast Neutron Fluence On Nil Ductilit Transition Tem erature All components in the Reactor Coolant System are designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes. These cyclic loads are intro-duced by normal unit load transients, reactor trips, and start-I up and shutdown operation. The numbers of thermal and loading cycles used for design purposes are shown in Table 4.1.8 of the FSAR. During unit startup and shutdown, the rates of tem-perature and pressure changes are limited. The maximum allow-able plant heatup and cooldown rate of 100'F per hour above 290'F is consistent with the design number of cycles and satisfies stress limits for cyclic operation.

As a result of fast neutron irradiation in the region of the core, there will be an increase in the RTNDT with nuclear operation. The techniques to measure and predict the integrated lt fast neutron (E > 1 Mev) fluxes at the sample locations are de-scribed in Appendix 4B of the FSAR. The calculation method used to obtain the maximum neutron (E>1 t1ev) exposure of the reactor vessel is identical to that described for the irradia-tion samples.

Since the neutron spectra at the samples and vessel inside e

radius should be*identical, the measured transition shift for a sample can be applied to the adjacent section of reactor vessel for some later stage in plant life equivalent to the difference in calculated flux'magnitude. The maximum exposure of the vessel will be obtained from the measured sample ex-posure by appropriate application of the calculated aximuthal neutron flux variation.

The maximum integrated fast neutron (E> 1 flev) exposure of the vessel is computed to be 3.8 x 10 n/cm for 40 years operation at 80 percent, load factor. The predicted RTNOT shift for an integrated fast neutron (E r 1 Nev) exposure of 3.8 x 10 n/cm2 is 313'F. However, at one-quarter through the vessel wall (1/4T), the maximum integrated fast neutron (E ) 1 Mev) exposure of the vessel is computed to be 2.3 x 10 n/cm for 40 years operation at 80 per cent load factor. The predicted RONOT shift for an integrated fast neutron (E >1 Hev) exposure of 2.3 x 101g n/cm2 is 262'F. The ASME Section III Code (Code Case 1514) designated the 1/4T location as the reference point for RTNOT evaluation. The actual shift in RTNOT is established periodically during plant operation from the R.E. Ginna Unit No. 1 Reactor Vessel Surveillance Program.

The removal frequency for the radiation specimens is specified in the Ginna plant Technical Specifications'able 4.2-1. Four capsules will be removed over the first 10 years of- plant life. The first capsule was removed during the Spring

1972 refueling and is presently undergoing test and evalua-tion. A completed report is expected to be submitted to the AEC by early Fall, 1972.

7. Monitorin For Excessive Primar S stem Vibration The results of the preoperational test program for system vibration and the findings of the 1971 refueling shutdown in-service inspection have been previously discussed in the N

response to Safety Guide No. 20 in Section III.B.

In addition to the in-service inspection program, metal impact detectors have recently been installed at the two steam generators. The impact detector has been developed by West-inghouse to enable early detection of any debris which collects in the steam generators. The installation of the detectors at the Ginna plant will allow evaluation of the long term perform-ance of the system in an operating plant.

8. In-Service Ins ection The in-service inspection program is, where practical, in compliance with the ASME Boiler and Pressure Vessel Code (Section XI) for In-service Inspection of Nuclear Reactor Coolant Systems dated July 1, 1971. It must be recognized, however, that equipment and techniques to perform the inspection are still in development. It is recognized that examinations in certain areas are necessary and, therefore, a schedule has been proposed that includes areas and frequencies that are believed practical at this time for the Ginna reactor.l Amendment No. 2 to Technical Supplement Accompanying Application to Increase Power - guestion 3.

In most areas scheduled for test, a detailed pre-service map-ping was conducted using techniques which we believed could be used for post-operation inspections. The areas included

, for inspection represent those of relatively high strain and therefore will serve to indicate potential problems before significant flaws develop there or at other areas. As more experience is gained in operation of pressurized-water reactors, the recommended time schedule and location of inspection might be altered or should new techniques be developed, consideration must be given to incorporate these new techniques into this inspection program.

The use of conventional non-destructive, direct visual and remote visual test techniques can be applied to the in-spection of all primary loop components except for the reactor vessel. The reactor vessel presents special problems because of the radiation levels and remote underwater accessibility to this component. Because of these limitations on access to the reactor vessel, several steps have been incorporated into the design and manufacturing procedures in preparation for non-destructive test techniques which may be available in the future.2 The techniques for in-service inspection include the use of visual inspections, ultrasonic, radiographic, magnetic particle and dye penetrant testing of selected parts during refueling periods.

2 FSAR - Section 4.5.1

The intent of the inspection is the detection of flaws large enough to initiate fast fracture and gross leakage prior to subsequent inspection. At this time, it is judged that such a flaw is substantially larger that 1/2 inch by 1 inch which is the degree of detectablility. The inspection method is designed to detect flaws of this magnitude.3 As more experience is gained in operation of this and other pressurized water reactors, the time schedule and location of inspection might be altered.

3 - Section 4.5.1 FSAR

B. ACRS LETTER DATED DECEMBER 17, 1971

1. Tolerance To Antici ated Transients With Failure To Scram Although transients without trip have not been analyzed for the Ginna plant in pabticular, Westinghouse has developed a series of generic reports evaluating the behavior of recent generation Westinghouse Pressurized Water Reactors under anti-cipated transient conditions together with the functional per-II formance and reliability of the reactor protection system. The first report, WCAP-70364, determined the degree of backup pro-tection afforded by multiple trip functions, i.e., functional 5

diversity, while the second report,WCAP-7468-L ,dealt with the reliability of the protection system with respect to random failures as well as systematic non-random failures, i.e.,

common mode failures indicating the likelihood of failure to trip is practically zero. The third report,WCAP-7655 ,

dealt with the consequences of anticipated transients in this unlikely event.

The functional performance and reliability of the reactor protection system are major considerations in the overall safety T.W. Burnett, "Reactor Protection System Diversity in Westinghouse Pressurized Water Reactors," WCAP-7306 (April, 1969)

W.C.Gangloff, M.A. Mangan, "An Evaluation of Anticipated Operational Transients, in Westinghouse Pressurized Water Reactors," WCAP-7486-L ,(December, 1970)

P.F. Riehm, D.C. Garner, M.A. Mangan, "Analysis of Anti-cipated Reactor Transients Without Trip," WCAP-7655 (February, 1971)

evaluation of a nuclear power plant. A measure of the func-tional performance is provided by identifying various postu-lated transients or abnormal occurrences and demonstrating that the protection system will shut down the reactor in suf-ficient time to meet design objectives for the fuel. These objectives vary depending on the likelihood of the postulated

'ransient. A classification of tr ansients and their corres-ponding design limits is presented in American National Standard N-18.2, "Nuclear Safety Criteria for the Design of Stationary Pressurized Hater Reactor Plants." The fuel design limits range from one of no consequential damage for the more frequent or anticipated transients to limited fuel cladding damage for the infrequent or unexpected transients.

Extensive review of the design and performance of the Westinghouse Reactor Protection System has been made with the AEC Staff and ACRS. These reviews have included a demonstra-tion of performance in the event of a random single failure.

Discussions of susceptibility to systematic non-random con-current failures (common mode failures) have also taken place.

A review of the functional diversity of the Westinghouse Reactor Protection System is given in WCAP-7306 issued in 1969. This report indicated the large degree of backup protection afforded by multiple trip functions assuming the primary trip function inoperative, thus demonstrating a. high level of protection against common mode failures which might disable a complete

trip function.

Detailed discussions of common mode failures, their possible source and preventive measures have also been held.

An evaluation of the reliability of the Reactor Protection System using standard reliability engineering techniques including consideration of common mode failures is presented in WCAP-7486-L, issued in February, 1971. The results of this study indicated the likelihood of failure to trip following anticipated transients is practically zero.

Additional transient studies have been performed to provide further perspective regarding the inherent safety of the plant and to establish the relative importance of the protection system for anticipated transients. These studies determined the consequences within the reactor coolant system of failure to trip for certain transients. These transients classified as anticipated transients are those which probably occur once in the life of several reactors, although the probability of having the pessimistic combination of events and initial condi-tions assumed for these cases is very low.

For those physical parameters that vary with fuel deple-tion (such as the delayed neutron fraction) or with concentra-tion (such as the moderator temperature coefficient of reactivity),

the conservative practical limiting value, or combination of values, has been used.

The results of this study indicate no cases in which there

is a gross disruption of core geometry and continued core heat removal is maintained. There are, however, certain cases in-volving loss of the secondary system heat sink where high re-actor coolant system pressures may exist briefly. It is felt that these pressures will not lead to a catastrophic, reactor coolant system failure.

Iri view of these results and particlarly in light of the quantitive conclusions in WCAP-7486-L regarding the very low probability of failure to trip, no special remedial design changes should be made to reactors of the Westinghouse design to cope with the consequences of anticipated transients without trip. 'he studies have been useful in determining the inherent margins in the Westinghouse design under such extreme conditions and together the related studies described in WCAP-7306 and WCAP-7486-L have demonstrated the importance of critically evaluating potential common mode failure mechanisms as well as random single failures and of taking appropriate preventa-tive measures.

2. Monitorin Of Iodine Released With Gaseous Wastes Sampling programs have been conducted by Rochester Gas and Electric Corporation and by Westinghouse Electric Corporation in order to better understand the modes of escape of radio-active iodine from the plant. The findings of the sample programs have led to 'several modifications to the plant ventila-tion system. The most significant modifications are the instal'la-tion of a charcoal filter in the control access areas exhaust

system which services the radiochemical lab and nuclear sample room and the installation of a charcoal filter in the 1D and lE auxiliary building exhaust systems which services the auxiliary building. With the previously installed charcoal filters on the 1C exhaust fan for the spent fuel pit, all of the auxiliary building exhaust is now passed through the char-coal filters.

An iodine monitor has been installed at the plant for monitoring the iodine being released from the plant vent or containment vent. The monitor has a digital read-out and recorder in the control room. The monitor has a radiation panel alarm and is also alarmed on the. computer.

Normally the monitor is aligned to draw a sample from the plant vent system, however, during containment purges, its.sample point is transferred to the containment vent.

To improve the surveillance of the plant vent during containment purges, a second monitor has been ordered so that both vents can be given close surveillance at the same time.

With the installation of the charcoal filters and iodine monitors, the total off-site doses should remain well within the appropriate limits.

IV -13