ML17311A007

From kanterella
Revision as of 10:43, 29 June 2018 by StriderTol (talk | contribs) (Created page by program invented by StriderTol)
Jump to navigation Jump to search
SEP Review of SEP Safety Topic VII-03,Associated W/Electrical,Instrumentation & Control Portions of Sys Required for Safe Shutdown of Ginna Nuclear Power Plant.
ML17311A007
Person / Time
Site: Ginna Constellation icon.png
Issue date: 09/30/1980
From: BRODERICK N E, LAUDENBACH D H, RADOSEVIC J R
EG&G, INC.
To:
Shared Package
ML17258A699 List:
References
TASK-07-03, TASK-7-3, TASK-RR EGG-1183-4147, NUDOCS 8101120353
Download: ML17311A007 (72)
v • d • e


Text

yEGzGENERGYMEASUREMENTS GROUPEGG1183-4147 SEPTEMBER 1980SYSTEMATIC EVALUATION PROGRAMREVIEWOFHRCSAFETYTOPICVll-3ASSOCIATED 1NITHTHEELECTRICAL, IHSTRUMENTATIONI ANQCONTROLPORTIONSOFTHESYSTEMSREQUIREDFORSAFESHUTQOVfN FORTHEQIANANUCLEARPOWERPLANTLI,+I~fj'~~~~C.SANRAMONOPERATIONS 2001OLOCROWCANYONROAOSANRAMON.CALIFORNIA 94583 r

~EGcGnEnormityMeasurements Oroutr5anttamonOperations SYSTEMATIC EVALUATION PROGRAMREVIEWOFNRCSAFETYTOPICVII3ASSOCIATED WITHTHEELECTRICAL, INSTRUMENTATION, ANDCONTROLPORTIONSOFTHESYSTEMSREQUIREDFOR.SAFESHUTDOWNFORTHEGINNANUCLEARPOWERPI.ANT,byD.H.Laudenbach IApprovedforPublication

.RaosevscDepartment ManagerThisdocumentisUNCLASSIFIED Derivative Classifier:

Nicoas.derrickDepartment ManagerLL(LWorkPerformed forLawrenceLivermore NationalLaboratory underU.S,Department ofEnergyContractNo.DE-ACO8-76 NVO1183.

C ABSTRACTThisreportdocuments thetechnical evaluation andreviewofNRCSafetyTopicVII-3,associated withtheelectrical, instrumentation, andcontrolportionsofthesystemsrequiredforsafeshutdownoftheGinnaNuclearPowerPlant,usingcurrentlicensing criteria.

FOREWORDThisreportissuppliedaspartoftheSystematic Evaluation Programbeingconducted fortheU.S.NuclearRegulatory Commission byLawrenceLivermore NationalLaboratory.

Theworkwasperformed byEG5G,Inc.,EnergyMeasurements Group,SanRamonOperations forLawrenceLivermore NationalLaboratory underU.S.Department ofEnergycontractnumberDE-AC08-76NVO1183.

TABLEOFCONTENTSPage1.INTRODUCTION................'

1I2.CURRENTLICENSING CRITERIA.............

33.REVIEWGUIDELINES..

'.............

'54.SYSTEMDESCRIPTION...............

74.1General4.1.1ReactorProtection System4.1.2Auxiliary Feedwater System.4.1.3MainSteamSystem.4.1.4ServiceWaterSystem...4.1.5ChemicalandVolumeControlSystem4.1.6Component CoolingWaterSystem.4.1.7ResidualHeatRemovalSystem4.1.8Electrical Instrumentation andPowerSystems.79101011ll1213135.EVALUATION ANDCONCLUSIONS.

195.15.25.35.45.55.65.75.8ReactorProtection System.Auxiliary Feedwater System.MainSteamSystem.ServiceWaterSystem.ChemicalandVolumeControlSystem.Component CoolingWaterSystemResidualHeatRemovalSystem.Electrical Instrumentation andPower~~~Systems.19202122232425306~SUMMARYe~~~~~~~~~~~~~~~~~~33REFERENCES.

...................35APPENDIXANRCSAFETYTOPICSRELATEDTOTHISREPORT~~~~.A-1 LISTOFTABLESTable4.14.1~PaeFunctions forshutdownandcooldown.........

8Listofsafeshutdowninstruments

.~...~.~~144e3Safeshutdownsystemspowersourceandlocation.....

17

SYSTEMATIC EVALUATION PROGRAMREVIEWOFNRCSAFETYTOPICVII-3ASSOCIATED WITHTHEELECTRICAL, INSTRUMENTATION, ANDCONTROLPORTIONSOFTHESYSTEMSREQUIREDFORSAFESHUTDOWNFORTHEGINNANUCLEARPOWERPLANTDonaldH.Laudenbach EGSG,Inc.,EnergyMeasurements GroupSanRamonOperations 1.INTRODUCTION SomeSEPplantsmaynothavethecapability toachievehotshut-downandsubsequent coldshutdownofthereactorfromoutsideofthecon-trolroom.The"SafeShutdown" report[Ref.1]generated bytheNRC/SEPstaffidentifies thesystemsrequiredforsafeshutdown.

This,report,reviewstheelectrical, instrumentati'on, andcontrolaspectsoftheidentified CategoryIsystemsastheyareutilizedfrominsideandoutsideofthecontrolroom.

2.CURRENTLICENSING CRITERIAGDC17[Ref.2],entitled"Electric PowerSystems,"

statesinpartthat:/Anonsiteelectricpowersystemandanoffsiteelectricpowersystemshallbeprovidedtopermitfunctioning of.structures, sys'tems, andcomponents important tosafety.GDC19[Ref.2],entitled"ControlRoom,"statesinpartthat:Acontrolroomshallbeprovidedfromwhichactionscanbetakentooperatethenuclearpowerunitsafelyundernormalconditions andtomaintainitinasafecondi-tionunderaccidentconditions, including LOCAs.Equipment atappropriate locations outsidethecontrolroomshallbeprovidedwithadesigncapability forprompthotshutdownofthereactor,including necessary instrumentation andcontrolstomaintaintheunitinasafecondition duringhotshutdownandwithapotential capability forsubsequent coldshutdownofthereactorthroughtheuseofsuitableprocedures.

GDC21[Ref.2],entitled"Protection SystemReliability andTestability,"

statesinpartthat:Redundancy andindependence designedintotheprotec-tionsystemshallbesufficient toassurethat:b.Nosinglefailureresultslossofthe.protection function.

IRemovalfromserviceofanycomponent orchanneldoesnotresultinlossoftherequiredminimumredundancy unlesstheacceptable reliability ofoperation oftheprotection systemcanbeotherwise demonstrated.

StandardReviewPlan(NUREG-75/087)

[Ref.31;Section7.5,en-titled"Safety-Related DisplayInstrumentation,"

.statesinparagraph II.2and3that:a.Allmonitoring channelsshouldberedundant, toassurethatwrongindication duetodevicemal-functionwillnotcausefalseactionorinactiononthepartoftheoperator.

Identification malfunc-'ions canbeidentified bycrosscheckingbetweenredundant channels.

,b.Redundant channelsofsafety-related displayin-strumentation shouldbeisolatedphysically andelectrically "toassurethatasinglefailurewill.notresultincompletelossofinformation aboutamonitored variable.

3.REVIEWGUIDELINES Thefollowing NRCguidelines wereusedforthisreview:Identifythesystemsandequipment necessary toachievesafeshutdownoftheplant.Verifythatthe'nstrumentation andcontrolsystemsnecessary forsafeshutdownpossesssufficient redun-dancy(GDC21).Verifythatthesystemsandequipment identified abovearecapableofreceiving powerfrombothnormalandemergency sources(GDC17).Verifythattheinstrumentation andcontrolsnecessary forsafeshutdownareavailable inthecontrolroom(GDC19).Identifytheinstrumentation andcontrolequipment thatislocatedoutsidethecontrolroomthatisavailable toachieveandmaintainhotandcoldshutdown(GDC19).Verifythatthesafeshutdowndisplayinstrumentation inthecontrolroommeetsthesinglefailurecriterion (SRP7.5II.2and3).Compilealistofelectrical structures, systemsandcomponents thatarenecessary forsafeshutdownoftheplant.Submitthecompilation asasectionofthereportonNRCSafetyTopicIII-.l[Ref.43.Verifythatnosinglepowersupplyfailureinhibitsachieving safeshutdownoftheplantandthattheavailability ofpowerexistsfromboth'normalandemergency source.IdentifytherelatedNRCsafetytopicsasanappendixtothereport.

4.SYSTEMDESCRIPTION 4.1GENERALTheSEPReviewofSafeShutdownSystemsfortheR.E.GinnaNuclearPowerPlantl.Ref.13statesthat:TheNRCstaffandthelicensee, Rochester GasandElectricCorp.(RGSE)developed alistoftheminimumsystemsnecessary totakethereactorfromoperating conditions tocoldshutdown.

Althoughothersystemsmaybeusedtoperformshutdownandcooldownfunctions, thefollowing lististheminimumnumberofsystems.requiredtofulfilltherequirements ofBTPRSB5-1[Ref.5].(1)ReactorProtection System(2)Auxiliary Feedwater System(3)MainSteamSystem(4)ServiceWaterSystem(5)ChemicalandVolumeControlSystem(6)Component CoolingWaterSystem(7)ResidualHeatRemovalSystem(8)Electrical Instrumentation andPowerSystemsfortheabovesystems.Fivebasictasks,orfunctions, arerequiredtoproceedfromplantpoweroperation, tohot-shutdown, tocold-shutdown.

Thesefunctions andtheirassociated alternate methodsareidentified inTable4.1.

Table4.1.Functions forshutdownandcooldown.

FunctionMethod1.ControlofReactorPower2.CoreHeatRemoval3.SteamGenerator HeatRemoval4.Feedwater 5.PrimarySystemControla.Boration1.CVCS2.HighPressureSafetyInjection b.ControlRods1.Controlled RodInsertion 2.ReactorTripa.ForcedCirculation (reactorcoolantpumps)b.NaturalCirculation (usingsteamgenerators) c.ResidualHeatRemovald.CVCSLetdownHeatExchangers (CCW)e.PressurizerReliefsandSafetyInjection a.MainCondenser (circulating watersystem)b.Atmospheric Dumps(manualactuation) c.SafetyValvesd.Auxiliary FeedSystemTurbinee.SteamGenerator Blowdownf.Water-Solid SteamGenerator a.MainFeedwater Pumpsb.Steam-andMotor-Driven Auxiliary Feedwater Pumpsc.StandbyAuxiliary Feedwater Pumpsa.CVCSb.Pressurizer ReliefValves 4.1.1ReactorProtection'ystem Thereactorprotection system(RPS)isdesignedonachannelized basistoachieveisolation andindependence betweenredundant protection channels.

Channelindependence iscarriedthroughout thesystemextending fromthesensortotherelayproviding thelogic.Isolation ofredundant analogchannelsoriginates attheprocesssensorsandcontinues backthroughthefieldwiringandcontainment penetrations totheanalogpro-tectionracks.Whensafetyandcontrolfunctions arecombined, bothfunc-tionsarefullyisolatedintheremaining partofthechannel,controlbeingderivedfromtheprimarysafetysignalpaththroughanisolation amplifier.

Assuch,afailureinthecontrolcircuitry doesnotaffectthesafetychannel.RPSchannelsaresuppliedwithsufficient redundancy toprovidethecapability forchannelcalibration andtestingatpower.Bypassremovalofonetripcircuitisaccomplished byplacingthatcircuitinahalf-tripped mode,i.e.,atwo-out-of threecircuitbecomesaone-out-of-twocircuit.Testingdoesnottripthesystemunlessatripcondition concurrently existsinaredundant channel.Thepowersuppliestothechannelsarefedfromfourinstrument buses.Twoofthebusesaresuppliedbyconstantvoltagetransformers andtwoaresuppliedbyinverters.

Eachchannelisenergized fromaseparatea-cpowerfeed.Eachreactortripcircuitisdesignedsothatatripoccurswhenthecircuitisde-energized.

Anopencircuitorthelossofchannelpowercausesthesystemtogointoitstripmode.Reliability andindependence areobtainedbyredundancy withineachtrippingfunction.

Inatwo-out-of-three circuit,thethreechannelsareequippedwithseparateprimarysensorsandeachchannelisenergized fromanindependent elec-trical,bus.

Asinglefailuremay'beappliedinwhichachannelfailstode-energize whenrequired; however,suchamalfunction canaffectonlyonechannel.Thetripsignalfurnished bythetworemaining channelsisunim-pairedinthisevent.

4.1.2AuxiliaryFeedwater SystemTheauxiliary feedwater system(AFS)isdividedintotwoindepen-dentchannelsortrains.Onechannelissuppliedbyaturbine-driven pump;theotherchannelissuppliedbytwomotor-driven pumpspoweredfromsepa-rateredundant 480Vemergency buseswhichcanreceivepowerfromeitheronsiteoroffsitesources.Eachmotor-driven pumpcanprovide100percentoftheAFSflowrequiredfordecayheatremovalandcanbecross-connected toprovideflowtoeithersteamgenerator.

Astandbyauxiliary feedwater system(SAFS)providesflowincasesuctionlossfromthecondensate storagetanks(CST)totheAFSpumpscausesAFSpumpburnup.TheSAFSusestwomotor-driven pumpswhichcanbealignedtoseparateservicewatersystem(SWS)loops.TheSAFSprovidesthesamefeaturesastheAFSpumpswithregardtofunctional capability andpowersupplydiversity; itismanuallyactuatedfromthecontrolroom.4.1.3MainSteamSystemThesafety-grade shutdowncomponents associatedwiththemainsteamsystem(MSS)arethemainsteamisolation valves(MSIV),thesteamsafetyvalves,andthesteamatmospheric dumpvalves.Eachofthetwosteamgenerators isequippedwithanair-operated, solenoid-controlled MSIV,foursteamsafetyvalves,andoneair-operated atmospheric dumpvalve.TheMSIVsfailshutuponlossofcontrolair.Forcoredecayheatremovalwithnaturalcirculation ofthereactorcoolant,onlyonesteamgenerator andoneofitsfoursafetyvalvesarerequiredtoremovecoredecayheatafewsecondsafterreactortrip.Oneatmospheric steamdumpwhichcanbeoperatedfrom,thecontrolroomissufficient formaintaining hotshutdownorforcooldownoftheRCSbelowhotshutdownconditions.

Boilingoffeedwater inthesteamgenerator is'hedominantmodeofremovingprimarysystemheat.Normally, theenergyinthesteamisremovedintheturbineandthemaincondenser.

Aftertheturbineistrip-ped,theturbinebypasssystemprovidesacontrolled steamreleasedirectly

tothecondenser.

Theultimateheatsinkforthecondenser isth'.cirulat-ingwatersystem.Whenthecondenser isnotavailable, thesteamisre-leaseddirectlytotheatmosphere througheitherthesteamsafetyvalvesortheatmospheric dumpvalves.Asthesteamislost,acontinuing sourceoffeedwater isrequired.

4.1.4ServiceWaterSystemTheservicewatersystem(SWS)circulates waterfromthescreenhousetovariousheatexchangers andsystemsinthecontainment, auxiliary, andturbinebuildings.

Thesystemhasfourpumps,threeofwhichhavethecapacitytosupplynormalcoolingloads.Underaccidentconditions, onepumpissufficient tosupplyessential loads.TheSWSpipingisarrangedsothatthereareatleasttwoflowpathstoeachessential load;non-essential loadsareautomatically isolatedonasafeguards actuation signal.Valvingisprovidedtoisolateanysinglefailureandtopermitcontinued operation ofthesystem.TheSWSvalvelineupsplitsthesystemintotwoindependent trains.Safety-related equipment (dieselgenerators, AFSsupply,containment ventilation coolers,etc.)issplitbetweenthetrainssothatthelossofoneSWSloopwillaffectonlyhalfofthere-dundantsafety-related equipment capacity.

Motor-operated valveswhichisolatenon'-essential SWSloads,aswellasthesystempumps,areoperablefromthecontrolroom.PowerfortheSWSpumpsisprovidedbythe480Vemergency buseswhichcanbesuppliedbyonsite(emergency diesels)oroffsitepower.OneSWSpumpperemergency dieselisautomatically startedduringpost-accident dieselloadsequencing.

44.1.5ChemicalandVolumeControlSystemThechemicalandvolumecontrolsystem(CVCS)providesboratedwaterfromtheboricacidtanks(BAT)orfromtherefueling waterstoragetank(RWST)throughthreepositivedisplacement chargingpumpstotheRCS.Thecapacityofonepump(46gpm)issufficient tocompensate forcon-tractionoftheRCScoolantduringnormalcooldown.

Onechargingpumpalone,orwithoneboricacidtransferpump,canprovidecoldshutdown

borationrequirements iomediatelyfollowingreactorshutdown.

~Boratedwaterforthechargingpumpscanbecontrolled locallyorfromthecontrolroom.Powerforthechargingpumpsissuppliedviatheemergency busesfromeitheronsiteor-offsitepowersources.Thechargingpumpsdischarge intoacommonpulsedampening accumulator whichrendersthesystemsus-ceptibletoasinglefailurewhichcouldpreventchargingforborationandcoolantcontraction duringcooldown.

Shouldthisoccur,aredundant methodofchargingandborationexistsbymeansofthehighpressuresafetyinjec-tion(HPSI)system.AnyofthethreeHPSIpumpscanbelinedupfromthecontrolroomtotakeasuctionontheBATsortheRMSTandtoinjectborat-edwaterintotheRCSviatheHPSIlines.4.1.6ComonentCoolinMaterSystemThecomponent coolingwatersystem(CCM)systemconsistsoftwopumps,twoheatexchangers, asurgetankandconnecting valvesandpiping.Duringnormalfullpoweroperation, orforpost-accident operation, onecomponent coolingpumpandonecomponent coolingheatexchanger'ccommodate theheatremovalloads.Thestandbypumpandheatexchanger provide100percentbackup.Bothpumpsandbothheatexchangers areutilizedtoremovetheresidualandsensibleheatduringplantshutdown.

Ifoneofthepumpsoroneoftheheatexchangers isnotoperative, thetimeforcooldownisextended.

TheCCMpumpsreceivepowerfromtheredundant 480Vemergency buseswhichcanbesuppliedbyonsiteoroffsitepower.TheCCWsystemisnormallyoperatedfromthecontrolroom.Thesurgetankaccommodates expansion, contraction andinleakage ofwater,andensuresacontinuous component coolingwatersupplyuntilaleakingcoolinglinecanbeisolat-ed.Becausethesurgetankisnormallyventedtotheatmosphere',

aradia-tionmonitorinthecomponent coolingpumpinletheaderannunciates inthecontrolroomandclosesavalveintheventlineinthe'eventthattheradiation levelreachesapresetlevelabovethenormalbackground.

I 4.1.7ResidualHeatRemovalSystemTheresidualheatremovalsystem(RHR)systemconsistsofasingledroplinefromtheRCShotlegthroughtworedundant pumpsandtheirassociated heatexchangers andbacktotheRCSviaasingleheader.Eachpumpcanbemanuallycross-connected tothealternate heatexchanger forincreased reliability.

NormalcooldownoftheRCSisaccomplished byoperating bothpumpsandheatexchangers; however,alessercooldownratecanbeachievedwithonlyonepump.Oneheatexchanger caneffectcooldownapproximately 30hoursaftershutdown.

EachRHRpumpissuppliedpowerfromseparateredundant 480Vemergency buseswhichcanreceivepowerfromeitheronsiteoroffsitesources.Thesystemisnormallyoperatedfromthecontrolroom.4.1.8Electrical Instrumentation andPowerSystemsTable4.2providesalistoftheinstruments requiredtoconductasafeshutdown.

Thelistincludesthoseinstruments whichprovide.inform-ationtothecontrolroomoperatorfromwhichtheproperoperation ofallsafeshutdownsystemscanbeinferred.

Theseinstruments showRCSpres-sure,RCStemperature, pressurizer level,andsteamgenerator level.Impropertrendingoftheseparameters would,leadtheoperatortoinvesti-gatethepotential causes.Otherinstruments listedinthetableprovidetheoperatorwithadirectcheckonsafeshutdownsystemperformance andanindication ofactualorimpending degradation ofsystemperformance.

Theasteriskinthe"instrument, location" columnofthetableindicates whichindicators arelocatedoutsidethecontrolroomatlocalshutdownpanels.

t Table4.2Listofsafeshutdowninstruments.

Comonent/SystemInstrument Instrument LocationReference MainSteamReactorCoolantAuxiliary FeedServiceMaterChemicalandVolumeControlSteamgenerator levelLT8LI460,461and470,471Pressurizer levelLT&'LI,426,427,428,433Pressurizer pressurePT5PT449,429,430,431RCStemperature TE8TI409A5Band410A5BAFWSflowFT2021,2022,2023,2024FI2021,2022,2023,2024SAFSflowFT5FT4084,4085Pumpdischarge press.PT216052161PI216052161ChargingflowFIT128,FI128RWSTlevelLT920,LI920LTInsideContainment LIControlRoom~LTInsideContainment ControlRoom"PTInsideContainment PIControlRoom~TEInsideContainment TIControlRoomFTIntermed.

Build.FIControlRoom"FTAux.Build.AdditionFIControlRoom"PTScreenHousePIControlRoomFIT.Auxiliary Oui1d.FIControlRoomLTAuxiliary Build.LIControlRoomDwg.33013-519 Dwg.33013-424 Dwg.33013-424 Dwg.33013-424 Dwg.33013-519 Dwg.D-302-071-E Dwg.33013-529 Dwg.33013-433 Dwg.33013-425 t<<d

Table4.2Listofsafeshutdowninstruments.

(Continued)

Comonent/SystemInstrument Instrument LocationReference Component Cooling.MaterSystemflowFIT619SurgetanklevelLIT618FITAuxiliary Build.Dwg.33013-436 LowflowalarmincontrolroomLITAuxiliary Build.Dwg.33013-435 LIControlRoomResidualHeatRemovalDieselGenerator SystemflowFT626,FI626Generator outputvoltageandcurrentFTAuxiliary Build.FIControlRoomControlRoomDwg.33013-436 IEmergency ACPowerIEmergency DCPower480VBusses14,16,17,ControlRoom18,voltageindication 125VDCBusses1and2ControlRoomvoltageindication

Offsiteemergency

'owerisprovidedthroughasingle4.16kVstationauxiliary transformer.

Therefore theBTPRSB5-1[Ref.5]assump-tiononlossofonsiteemergency power,i.e.,lossofbothdieselgenera-torsrenderstheoffsiteemergency powersusceptible tosinglefailure.Theacceptability ofthisdesignwasreviewedduringtheProvisional Operating Licensereview,anditwasconcluded tnat,becauseofthedemon-stratedhighreliability ofthetypeoftransformers

involved, theabsenceofaredundant transformer doesnotsignificantly affectthereliability ofoffsitepower.Asecondary sourceofoffsitepowercanbemadeavailable viatheunitauxiliary transformer bymanuallydisconnecting flexibleconnections atthemaingenerator terminals.

ThisdesignmeetsthecurrentNRCrequirements foroffsitepowersupplies(GDC-17),

providing thatdisconnection oftheflexibleconnections atthemaingenerator terminals canbeaccomplished withinthetimeconstraints imposedbycoolantwaterinventory andbatterylife,eventhoughitdeviatesfromtheguidelines ofBTPRSB5-1I.Ref.5].Onsiteemergency powerisfurnished bytwodieselenginegenerat-ingsets.Eitherdieselgenerator iscapableofsupplying sufficient safetyloads.Thedieselgenerators andloadsaredividedonasplit-bus arrangement.

Thereisnoautomatic tiebetweenthetwobuses.Bothdieselsarestartedbya"safetyinjection" signal,andeachdieselisIIstartedbyanundervoltage condition ateitherofits480-voltbuses.-Eachdieselcanalsobestartedlocallyorfromthecontrolroom.location.

Table4.3detailsthesafeshutdownsystemspowersourceand Table4.3.Safeshutdownsystemspowersourceandlocation.

SystemPowerSourceLocationReactorProtection ReactorBreakersReactorBistables DCpower,Instrument busesControlRoom(289')MainSteamSafetyValvesIsolation ValvesAtmos.DumpValvesAuxiliary FeedMotorDrivenPumpsA,BTurbineDrivenPumpStandbyPumpsC,DIServiceWaterPumpsA,B,C,DChemicalandVolumeControlpumpsA,B,CRefueling WaterStorageTankComponent CoolingWaterpumpsA,BHeatExchangers ResidualHeatRemovalpumpsA,BHeatExchangers DieselGenerators 1A1BAir(failclosed)AirormanualA-bus14,B-bus16SteamdrivenC-bus14,D-bus16A,C-bus18B,D-bus17A-bus14B,C-bus16A-bus14,B-bus16A-bus14,B-bus16125YDCcontrolpower125VDCcontrolpowerIntermediate Build.(278')Intenoediate Build.(278')Intermediate Build.(278')Intermediate Build.(253')Intermediate Build.(253')Aux.Build.Addition(270')ScreenHouse(253')ScreenHouse(253')-Auxiliary Build.(235')eastAuxiliary Build.Auxiliary Build.(271')Auxiliary Build.(271')Auxiliary Build.(219')RHRpitAuxiliary Build.(219')DieselRoomNsideofTurbineBuild.(253')DieselRoomNsideofTurbineBuild.(253')

II Table4.3.Safeshutdownsystemspowersourceandlocation(continued).

System480V,bus14=480V,bus16480V,bus17480V,bus18Instrument buses1A,1B,1C,1DBatteryandInverterlABatteryandInverter1BPowerSourceDiesel1AorOffsitePowerDiesel1BorOffsitePowerDiesel1BorOffsitePowerDiesel1AorOffsitePower1A-Inverter 1,1B-480VNCC1C-Inverter 2,1D-480VMCCLocationAuxiliary Build.(271')Auxiliary Build.(263')ScreenHouse(253')ScreenHouse(253')ControlRoom(289)BatteryRoom(253')BatteryRoom(253')

NS 5.EVAlUATION ANDCONCLUSIONS 5.1REACTORPROTECTION SYSTEMThereactorprotection system(RPS)isdesignedonachannelized basistoachieveisolation andindependence betweenredundant protection channels.

Channelindependence iscarriedthroughout thesystemextending fromthesensortotherelayproviding thelogic.Isolation ofredundant analogchannelsoriginates attheprocesssensorsandcontinues backthroughthefieldwiringandcontainment penetrations totheanalogpro-tectionracks.Mhensafetyandcontrolfunctions arecombined, bothfunctions arefullyisolatedintheremaining partofthechannel,controlbeingderivedfromtheprimarysafetysignalpaththroughanisolation amplifier.

Assuch,afailureinthecontrolcircuitry doesnotaffectthesafetychannel.RPSchannelsaresuppliedwithsufficient redundancy toprovidethecapability forchannelcalibration andtestingatpower.Bypassremovalofonetripcircuitisaccomplished byplacingthatcircuitinahalf-tripped mode,i.e.,atwo-out-of threecircuitbecomesaone-out-of-twocircuit.Testingdoesnottripthesystemunlessatripcondition concurrently existsinaredundant channel.Thepowersuppliestothechannelsarefedfromfourinstrument buses.Twoofthebusesaresuppliedbyconstantvoltagetransformers andtwoaresuppliedbyinverters.

Eachchannelisenergized fromaseparatea-cpowerfeed.Eachreactortripcircuitisdesignedsothatatripoccurswhenthecircuitisde-energized.

Anopencircuit'or.thelossofchannelpowercausesthesystemtogointoitstripmode.Reliability andindependence areobtainedbyredundancy withineachtrippingfunction.

Inatwo-out-of-three circuit,thethreechannelsareequippedwithseparateprimarysensorsandeachchannelisenergized fromanindependent elec-tricalbus.Asinglefailuremaybeappliedinwhichachannelfailsto

de-energize whenrequired; however,suchamalfunction canaffectonlyonechannel.Thetripsignalfurnished bythetworemaining channelsisunim-pairedinthisevent.Basedonareviewofthedocumentation listedintheReference Sectionofthisreport,weconcludethattheRPScompliestothecurrentlicensing criterialistedinSection2ofthisreport.5.2AUXILIARY FEEDWATER SYSTEMTheprimarysourceofwatertotheauxiliary feedwater system(AFS)isfromthecondensate storagetanks(CST)vianonseismic GSTsupplylines.ThebackupsourceofwatertotheAFSisfromtheseismicGlass1servicewatersystem(SWS)viatwoseparatepaths;onepathprovidessuctiontotheturbine-driven pump,theotherpathprovidessuctiontotwomotor-driven pumps.ManualactionisrequiredtoisolatetheAFSpumpsuctionsfromtheCSTandtolineupthepumpstotheSWS.Allotherfunctions oftheAFScanbeinitiated, controlled, and.monitored fromthecontrolroom.Themanualvalvealignment oftheAFStotheSWScanbeperformed by'noperatordispatched fromthecontrolroom.TheNRCstaffhasdetermined thatthemanuallineupoftheAFSsuctiontotheSWSisjustified underthe"limitedoperatoractionoutsidethecontrolroom"provision ofBTPRSB5-1[Ref.5].Thetwomotor-driven pumpsarepoweredfromseparateredundant 480Vemergency buseswhichcanreceivepowerfromeitheronsiteoroffsitesources.Eachmotor-driven pumpcanprovide100percentoftheAFSflowrequiredfordecayheatremovalandcanbecross-connected toprovideflowtoeithersteamgenerator.

Astandbyauxiliary feedwater system(SAFS)providesflowincasesuctionlossfromthecondensate storagetanks(CST)'otheAFspumpscausesAFSpumpburnup.TheSAFSusestwomotor-driven pumpswhichcanbealignedtoseparateSWSloops.TheSAFSprovidesthesamefeaturesastheAFSpumpswithregardtofunctional capability andpowersupplydiversity;

itismanuallyactuatedfromthecontrolroom.TheNRCstaffevaluation oftheSAFSiscontained in.:reference 6.Basedonareviewofthedocumentation listedintheReference Sectionofthisreport,weconcludethatAFScompliestothecurrentlicensing criterialistedinSection2ofthisreport.5.3MAINSTEAMSYSTEMThesafety-grade shutdowncomponents associated withthemainsteamsystem(MSS)arethemainsteamisolation valves(MSIV),thesteamsafetyvalves,andthesteamatmospheric dumpvalves.Eachofthetwosteamgenerators isequippedwithanair-operated, solenoid-controlled MSIV,foursteamsafetyvalves,andoneair-operated atmospheric dumpvalve.TheMSIVsfailshutuponlossofcontrolair.Forcoredecayheatremovalwithnaturalcirculation ofthereactorcoolant,onlyonesteamgenerator andoneofitsfoursafetyvalvesarerequiredtoremovecoredecayheatafewsecondsafterreactortrip.Oneatmospheric steamdumpwhichcanbeoperatedfromthecontrolroomissufficient formaintaining hotshutdownorforcooldownoftheRCSbelowhotshutdownconditions.

Boilingofthefeedwater inthesteamgenerator isthedominantmodeofremovingprimarysystemheat.Normally, theenergyinthesteamisremovedintheturbineandthemaincondenser.

Aftertheturbineistrip-ped,theturbinebypasssystemprovidesacontrolled steamreleasedirectlytothecondenser.

Theultimateheatsinkforthecondenser isthecircu-latingwatersystem.Whenthecondenser isnotavailable, thesteamisreleaseddirectlytotheatmosphere througheitherthesteamsafetyvalvesortheatmospheric dumpvalves.Asthesteamislost,acontinuing sourceoffeedwater isrequired.

TheMSS-level instrumentation isdesignedonachannelized basistoachieveisolation andindependence betweenredundant protection chan-nels.Channelindependence iscarriedthroughout thesystem,extending

fromthesensortotherelayproviding thelogic.LoopAsteamgenerator levelismonitored byleveltransmitters LT-460,LT-461,LT-462and.LT-463.LoopAsteamgenerator level,isindicated inthecontrolroombylevelindicators LI-461,LI-462ANDLI-463.LI-460AprovidesloopAsteamgene-ratorlevelindication attheauxiliary feedwater pumppanel.LI-460BprovidesloopAsteamgenerator levelindication atthemainfeedwater controlvalves.LoopBsteamgenerator levelismonitored byleveltrans-mittersLT-470,LT-471,LT-472andLT-473.LoopBsteamgenerator levelisindicated inthecontrolroombylevelindicators LI-471,LI-472andLI-473A.LI-470AprovidesloopBsteamgenerator levelindicati,on attheauxiliary feedwater pumppanel.LI-470BprovidesloopBsteamgenerator levelindication atthemainfeedwater controlvalves.[Ref.7,drawingsBD-8,BD-9,BD-18andBD-19].Basedonareviewofthedocumentation listedintheReference Sectionofthisreport,weconcludethattheNSScompliestothecurrentlicensing criterialistedinSection2ofthisreport.5.4SERVICEWATERSYSTEMTheservicewatersystem(SWS)circulates waterfromthescreenhousetovariousheatexchangers andsystemsinthecontainment, auxiliary, andturbinebuildings.

Thesystemhasfourpumps,threeofwhichhavethecapacitytosupplynormalcoolingloads.Underaccidentconditions, onepumpissufficient tosupplyessential loads.TheSWSpipingisarrangedsothatthereareatleasttwoflowpathstoeachessential load;non-essential loadsareautomatically isolatedona..safeguards actuation signal."Valvingisprovidedtoisolateanysingle.failureandtopermitcoqtinued operation ofthesystem.TheSWSvalvelineupsplitsthesystemintotwoindependent trains.Safety-related equipment (dieselgenerators, AFSsupply,containment ventilation..coolers, etc.)issplitbetweenthetrainssothatthelossofoneSWSloopwillaffectonlyhalfofthere-dundantsafety-related equipment capacity.

Motor-operated valveswhichisolatenon-essential SWSloads,.aswellasthesystempumps,areoperable

fromthecontrolroom.PowerfortheSWSpumpsisprovidedbythe48OVemergency buseswhichcanbesuppliedbyonsite(emergency diesels)or'offsitepower.OneSWSpumpperemergency dieselisautomatically startedduringpost-accident dieselloadsequencing.

Basedonareviewofthedocumentation listedintheReference Sectionofthisreport,weconcludethattheSWScompliestothecurrentlicensing criterialistedinSection2ofthisreport.5.5CHEMICALANDVOLUMECONTROLSYSTEMThechemicalandvolumecontrolsystem(CVCS)providesboratedwaterfromtheboricacidtanks(BAT)ortherefueling waterstoragetank(RWST)throughthreepositivedisplacement chargingpumpstotheRCS.Thecapacityofonepump(46gpm)issufficient tocompensate forcontraction oftheRCScoolantduringnormalcooldown.

Onechargingpumpalone,orwiththeboricacidtransferpump,canprovidecoldshutdownborationrequirements imnediately following reactorshutdown.

BoratedwaterforthechargingpumpswouldbesuppliedfromtheRWSTbymanuallyopeningvalve358tobypassanair-operated valveinthechargingpumpsuctionlines.Thechargingpumpscanbecontrolled locallyorfromthecontrolroom.Powerforthechargingpumpsissuppliedviatheemergency busesfromeitheronsiteoroffsitepowersources.Thechargingpumpsdischarge intoacommonpulsedampening accumulator whichrendersthesystemsusceptible toasinglefailurewhichcouldpreventchargingforborationandcoolantcontraction duringcooldown.

Shouldthisoccur,aredundant methodofchargingandborationexistsbymeansofthehighpressuresafetyinjection (HPSI)system.AnyofthethreeHPSIpumpscanbelinedupfromthecon-trolroomtotakeasuctionontheBATsortheRWSTandtoinjectboratedwaterintotheRCSviatheHPSIlines.Basedonareviewofthedocumentation listedintheReference Sectionofthisreport,weconcludethattheCVCScompliestothecurrentlicensing criterialistedinSection2ofthisreport.

5.6COMPONENT COOLINGMATERSYSTEMThecomponent coolingwatersystem(CCW)systemconsistsoftwopumps,twoheatexchangers, asurgetankandconnecting valvesandpiping.Duringnormalfull-power operation orforpost-accident operation, onecomponent coolingpumpandonecomponent coolingheatexchanger accommodate theheatremovalloads.Thestandbypumpandheatexchanger provide100percentbackup.Bothpumpsandbothheatexchangers areutilizedtoremovetheresidualandsensibleheatduringplantshutdown.

Ifoneofthepumpsoroneoftheheatexchangers isnotoperative, thetimeforcooldownisextended.

TheCCMpumpsreceivepowerfromtheredundant 480Vemergency buseswhichcanbesuppliedbyonsiteoroffsitepower.TheCCWsystemisnormallyoperatedfromthecontrolroom.Thesurgetankaccommodates expansion, contraction andinleakage ofwater,andensuresacontinuous component coolingwatersupplyuntilaleakingcoolinglinecanbeisolat-ed.BecausethesurgetankisnormallyventedtotHeatmosphere, aradia-tionmonitorinthecomponent coolingpumpinletheaderannunciates inthecontrolroomandclosesavalveintheventlineintheeventthattheradiation levelreachesapresetlevelabovethenormalbackground.

Basedonareviewofthedocumentation listedintheReference Sectionofthisreport,weconcludethatthe'CCWsystemcompliestothecurrentlicensing criterialistedinSection2ofthisreportexceptforthefollowing:

(1)Thesinglefailurecriterion isNOTmetbecauseofthesingledischarge linefromthe..CCMpumpsthroughMOV-817tothefollowing fourcoolingloops:RCP1A,RCP1B,ReactorSupportCoolingandtheExcessLetdownHX.IfMOV-817weretofailintheclosedpositionCCMtotheabovefourloopswouldbelost[Ref.8,drawing33013-435-A].

(2)Thefailureofcheckvalve816toremainopenwouldcauseCCWflowtotheabovefourloopstobelostf.Ref.8,drawing33013-435-A].

5.7RESIDUALHEATREMOVALSYSTEMThesuctionlineoftheresidualheatremovalsystem(RHR)systemisisolatedfromtheloopAhotlegoftheRCSbyMOV-700andNOV-701inseries.MOV-700andMOV-701normallyoperateintheclosedpositionanddonotchangepositionuponlossofpower(failasis).MOV-700isoperablewitheitheronsiteoroffsitepowerfromessential bus14viaNCC1C.MOV-701isoperablewitheitheronsiteoroffsitepowerfromessential bus16viaMCC1D.Thedischarge lineoftheRHRsystemisisolatedfromtheloopBcoldlegoftheRCSbyMOV-720andNOV-721inseries.MOV-720andMOY-721normallyoperateintheclosedpositionanddonotchangepositionuponlossofpower(failasis).MOV-720isoperablewitheitheronsiteoroffsitepowerfromessential bus14viaNCC1C.NOV-721isoperablewitheitheronsiteoroffsitepowerfromessential bus16viaMCC1D.TheRHRsystemdischarge lineisnotusedforanECCSfunctionthatwouldrequireMOV-720orMOV-721toopen;however,abranchoftheRHRdischarge lineprovidesLPSItotherectorvesselviaparallellines.Isolation betweentheRHRsystemandLPSIinjection intothereactorvesselisprovidedbytwoseparatepathsfromtheRHRdischarge line,witheachpathcontaining anMOVandcheckvalve.MOV-852Aandcheckvalve853Aprovideisolation inonepath,whileNOV-852Bandcheckvalve8538provideisolation intheotherpath.MOY-852AandNOV-852Bnormallyoperateintheclosedpositionanddonotchangepositionuponlossofpower(failasis).MOV-852Aisoperablewitheitheronsiteoroffsite"power fromessential Sbus14viaNCC1C.MOV-852Bisoperablewitheitheronsiteoroffsite.powerfromessential bus16viaMCC1D.Thesuctionlineofthe'RHRsystem,whenfunctioning intheinjection phaseofLPSI,commences attheRMSTtoMOV-856andcheckvalve854inseries,thentoaparallelbranchwhereMOV-704Aprovidesapathto

RHRpump2.MOV-856normallyoperatesintheclosedpositionanddoesnotchangepositionuponlossofpower(failsasis).MOV-856isoperablewitheitheronsiteoroffsitepowerfromessential bus14viaNCC1C.MOV-704AandMOV-704Bnormallyoperateintheopenpositionanddonotchangeposi-tionuponlossofpower(failasis).MOV-704Aisoperablewitheitheronsiteoroffsitepowerfromessential bus14viaMCC1C.MOV-7048isoperablewitheitheronsiteoroffsitepowerfromessential bus16viaMCC1D.TwoseparatepathsprovidesuctiontotheRHRsystemwhenitisfunctioning intherecirculation phaseofLPSI.Bothpathscommenceatthecontainment sumpandterminate attheRHRpumps.MOV-850AandNOV-851AinseriesprovidethepathtoRHRpump1.MOV-850BandMOV-8518inseriesprovidethepathtoRHRpump2.MOV-850A, MOV-8508, NOV-851AandMOV-851Bnormallyoperateintheclosedpositionanddonotchangepositionuponlossofpower(failasis).MOV-850AandNOV-851Aareoperablewitheitheronsiteoroffsitepowerfromessential bus14viaMCC1C.MOV-8508andMOV-851Bareoperablewitheitheronsiteoroffsitepowerfromessential bus16viaMCC1D.BothRHRpumpsareoperablewitheitheronsiteoroffsitepower.RHRpump1ispoweredfromessential bus14,RHRpump2ispoweredfromessential bus16.Section6.1.1oftheFSAR[Ref.91statesinpartthat:Acomprehensive programofplanttestingisformulated forallequipment systemsandsystemscontrolvitaltothefunctioning ofESFs.Theprogramconsistsofper-formancetestsofindividual piecesofequipment, inte-'rated testsofthesystemasawhole,andperiodictestsoftheactuation circuitry andmechanical compon-entstoassurereliableperformance, upondemand,throughout theplantlifetime.

Section6.2.1oftheFSAR[Ref.9]statesinpartthat:Designprovisions aremadesothatactivecomponents oftheSIScanbetestedperiodically foroperability andfunctional performance.

Eachactivecomponent canbeindividually activated onthenormalpowersourceatanytimeduringplantoper-ation.Anintegrated systemtestcanbeperformed duringthelatestagesofplantcooldownwhentheRHRloopisinservice.Thistestwouldnotintroduce flowintotheRCSbutwoulddemonstrate theoperation ofthevalves,.pumpcircuitbreakers, andautomatic circuitry uponinitiation ofsafetyinjection.

Section6.2.5oftheFSAR[Ref.9]statesinpartthat:Testingisconducted duringplantshutdowntodemon-.strateproperautomatic operation oftheSIS.Atestsignalisappliedtoinitiateautomatic actionandverification madethattheSIpumpsattainrequireddischarge heads.Thetestdemonstrates theoperation ofthevalves,pumpcircuitbreakers, andautomatic circuitry.

Thetestisconsidered satisfactory ifcon-trolboardindication andvisualobservations indicateallcomponents haveoperatedandsequenced properly.

FlowineachofthehighheadSIheadersandinthemainflowlinefortheRHRpumpsismonitored byflowindicators.

Pressureinstrumentation isalsoprovidedforthemainflowpathsoftheSIandRHRpumps.Ac-cumulator isolation valvesareblockedclosedforthistest.Thesequenceforrecirculation operation maybetestedfollowing theaboveinjection phasetodemon-stratepropersequencing ofvalvesandpumps.Toinitiatethefulloperational sequencetest,theSIblockswitchismovedtotheunblockpositiontopro-videcontrolpowerallowingtheautomatic actuation ofthesafetyinjection signalrelaysfromthepressur-izer.Simultaneously, thebreakerssupplying normalpowerto480-voltbusesaretripped,operation ofthediesel-generator powersystemcommences automatically.

TheSIpumpsandtheRHRpumpsstartautomatically following theprescribed loadingsequence.

Thevalvesoperateautomatically toaligntheflowpathforinjection intotheRCS.Thefunctional testisrepeatedforthevariousmodesofoperation neededtodemonstrate performance atpar-tialeffectiveness, i.e.,todemonstrate theproperloadingsequence, withlossofoneofthedieselgener-atorpowersources,andtodemonstrate thecorrectautomatic startingofasecondpumpshouldthefirst e

pumpfailtorespond.Theselattercasesareperformed withoutdeliveryofwatertotheRCS,butincludestartingof.allpumpingequipment involvedineachtest.Section4.1.aoftheGinnaTechnical Specifications statesthat:Calibration, testing,andcheckingofanalogchannels'nd testingoflogicchannelsshallbeperformed asspecified inTable4.1-1.Table4.1-1entitled"MinimumFrequencies forChecks,Calibra-tions,andTestsofInstrument Channels" providesthefollowing information regarding RHR/LPSI-related instrument channels:

(1)RHRPumpFlowiscalibrated duringeachrefueling shutdown; channelcheckandchanneltestarenotapplicable.

(2)RWSTLeveliscalibrated duringeachrefueling shutdown; channelcheckandchanneltestarenotapplicable.

(3)Containment SumpLeveliscalibrated duringeachrefueling shutdown; channelcheckandchanneltestarenotapplicable.

Section4.5.1.1.a oftheGinnaTechnical Specification states'npartthat:TheSafetyInjection Systemtestsshallbeperformed ateachreactorrefueling interval.

Withthereactorcoolantsystempressurelessthanorequalto350psigandtemperature

.lessthanorequalto350'F,atestsafetyinjection signalwillbeappliedtoinitiateoperation ofthesystem.Thesafetyinjection and.residualheatremovalpumpmotorsareprevented fromstartingduringthetest.Section4.5.2.1.a oftheGinnaTechnical Specifications statesinpartthat:Exceptduringcoldorrefueling shutdowns thesafetyinjection pumps,residualheatremovalpumps,andcontainment spraypumpsshallbestartedatintervals nottoexceedonemonth.

Section4.5.2.2.a oftheGinnaTechnical Specifications statesthat:Therefueling waterstoragetankoutletvalvesshallbetestedatintervals nottoexceedonemonth.Section4.4oftheSEPReviewofSafeShutdownSystemsfortheR.E.GinnaNuclerPowerPlant[Ref.13statesinpartthat:TheRHRisolation valveoperability andinterlocks cannotbetestedduringthe=RHRcoolingmodeofoperation.

Thistestrequirement isnotapplicable totheGinnafacility, sincetheinterlocks functiononlywhentheRHRisolation valvesareshut.Basedonareviewofthedocumentation listedintheReference Sectionofthisreport,weconcludethattheRHRsystemcompliestothecurrentlicensing criterialistedinSection2ofthisreportexceptforthefollowing:

(1)Thesinglefailurecriterion isNOTmetbecausethereisasingleinletlinetotheRHRpumpsthroughMOV-700andMOV-701inseriesfromtheRCSLoopAhotleg[Ref.10,drawing33013-436-A].

IfeitherMOV-700orMOV-701weretofailintheclosedposition, thesuctionpathtotheRHRpumpswouldbelost.(2)Thesinglefailurecriterion isNOTmetbecausethereisasingledischarge linebetweentheRHRheatexchangers throughMOV-720andMOV-721inseriestotheRCSLoopBcoldleg[Ref.10,draw-ing33013-436-A1.

IfeitherMOV-720orMOV-721weretofailintheclosedposition,,the discharge pathoftheRHRpumpswouldbelost.(3)Thesinglefailurecriterion isNOTmetwhentheRHRsystemisfunctioning inthesnjection phaseofLPSIbecausethereisasingleinletlinetotheRHRpumpsthroughMOV-856andcheckvalve854inseriesfromtheRWST[Ref.11,drawing33013-425-Al.IfMOV-856weretofailintheclosed P

position, thesuctionpathtotheRHRpumpswouldbelost.(4)TheRHRsystemtestability failstosatisfyRG1.22becausetheRHRpumpsaredisabledduringtheECCSsystemtest.Section6.2.5oftheFSARstatesthattheSIandRHRpumpsaretestedasapartofsystemfunctional tests.Section4.5.1.1oftheGinnaTechnical Specifications statesthat'heSIandRHRpumpmotorsareprevented fromstartingduringthesystemtest.(5)TheRHRsystemfailstosatisfyBTPRSB5-1andRG1.22becausetheRHRisolation valvesandtheirassociated interlocks arenottested.5.8ELECTRICAL INSTRUMENTATION ANDPOWERSYSTEMSTable4.2(seeSection4)providesalistoftheinstruments re-quiredtoconductasafeshutdown.

Thelistincludesthoseinstruments whichprovideinformation tothecontrolroomoperatorfromwhichtheproperoperation ofallsafeshutdownsystemscanbeinferred.

Theseinstruments showRCCpressure, RCStemperature, pressurizer level,andsteamgenerator level.Impropertrendingoftheseparameters wouldleadtheoperatortoinvestigate thepotential causes.Otherinstruments listedinthetableprovidetheoperatorwithadirectcheckonsafeshutdownsystemperformance andindication ofactualorimpending degradation ofsystemperformance.

Theasteriskinthe"instrument location" columnofthetableindicates whichindicators arelocatedoutsidethecontrolroomatlocalshutdownpanels.Offsiteemergency powerisprovidedthroughasingle4.16kVstationauxiliary transformer.

Therefore

'heBTPRSB5-1[Ref.5]assumption onlossofonsiteemergency power,i.e.,lossofbothdieselgenerators renderstheoffsiteemergency powersusceptible tosinglefail-ure.Theacceptability ofthisdesignwasreviewedduringtheProvisional Operating Licensereview,anditwasconcluded that,becauseofthedemon-stratedhighreliability ofthetypeoftransformers

involved, theabsenceofaredundant transformer doesnotsignificantly affectthereliability of loffsitepower.Asecondary'source ofoffsitepowercanbemadeavailable via,theunitauxiliary transformerbymanuallydisconnecting flexibleconnections atthemaingenerator terminals.

ThisdesignmeetsthecurrentNRCrequirements foroffsitepowersupplied(GDC-17),

providing thatdis-connection oftheflexibleconnections atthemaingenerator terminals canbeaccomplished withinthetimeconstraints imposedbycoolantwaterin-ventoryandbatterylife,eventhoughthisdeviatesfromtheguidelines ofBTPRSB5-1[Ref.5].Onsiteemergency powerisfurnished bytwodieselenginegenerat-ingsets.Eitherdieselgenerator iscapableofsupplying sufficient safetyloads.Thedieselgenerators andloadsaredividedonasplit-bus arrangement.

Thereisnoautomatic tiebetweenthetwobuses.Bothdieselsarestartedbya"safetyinjection" signal,andeachdieselisstartedbyanundervoltage condition ateitherofits480-voltbuses.Eachdieselcanalsobestartedlocallyorfromthecontrolroom.Table4.3(seeSection4)detailsthesafeshutdownsystemspowersourceandlocation.

6.SUMMARYFourloopsoftheCCWsystemfailtomeetthesinglefailurecriterion.

Boththesuctionanddischarge pathsoftheRHRsystemfailtomeetthesinglefailurecriterion duringtheRHRcoolingmodeofoperation.

ThesuctionpathoftheRHRsystemfailstomeetthesinglefail-urecriterion duringtheinjection phaseoftheRHRLPSIfunction.

TheRHRsystemfailstosatisfycurrentlicensing criteriabe-causetheRHRpumpsaredisabledduringfunctional systemtests.TheRHRsystemfailstosatisfycurrentlicensing criteriabe-causetheRHRisolation valvesandtheirassociated interlocks arenottested.criterion.

Offsiteemergency powerfailstosatisfythesinglefailureEachoftheaboveitemsofnon-compliance tocurrentlicensing criteriashouldbeinvestigated andresolutions soughtduringtheinte-gratedDBEreviews.33

REFERENCES 1.SEPReviewofSafeShutdownSystemsfortheR.E.GinnaNuclearPowerPlant,Revision1,undated.2.U.S.NuclearRegulatory Commission, CodeofFederalRegulations, Title10,Part50,AppendixA(GeneralDesignriteria,3.U.S.NuclearRegulatory Commission, StandardReviewPlanNUREG-75/087, Revision1.4.U.S.NuclearRegulatory Commission, SafetyTopicIII-1,Classification ofStructures, SystemsandComonents.5.U.S.NuclearRegulatory Commission, BranchTechnical

Position, RSB5-1,DesinReuirements oftheResidualHeatRemovalSystem,Revision1.6.NRCletter,D.ZiemanntoL.White,datedAugust24,1979,forwarding Amendment 29totheGinnaOperating License.7.FoxborodrawingsBD-2throughBD-19fortheGinnaNuclearPowerStation.8.Rochester GasandElectricCorp.drawi'ng33013-435-A, Auxiliary CoolantSystem.9.Rochester GasandElectricCorp.GinnaFinalSafetyAnalysisReport(FSAR)datedApril23,1975.10.Rochester GasandElectricCorp.drawing33013-436-A, Auxiliary CoolantSystem.11.Rochester GasandElectricCorp.drawing33013-425-A, Safety.Injection System.

APPENDIXANRCSAFETYTOPICSRELATEDTOTHISREPORTIII-1IV-2V-3V-8Classification ofStructures, Systems,andComponents.

Reactivity ControlSystems,Including Functional DesignandPro-tectionAgainstSingleFailures.

Overpressurization Protection.

SteamGenerator (SG)Integrity.

V-10.ARHRHeatExchanger TubeFailures.

V-10.BRHRReliability.

V-11.AV-11.BRequirements forIsolation ofHighandLowPressureSystems.RHRInterlock Requirements.

VI-10.ATestingofRTSandESFIncluding ResponseTimeTesting.VI-10.BVII-l.ASharedEngineered SafetyFeatures, OnsiteEmergency Power,andServiceSystemsforMultipleUnitFacilities.

Isolation ofRPSfromNon-Safety Systems,Including Qualifica-tionsofIsolation Devices.VII-1.BVII-2VII-4IX-3IX-4XV-1XV-2TripUncertainty andSetpointAnalysisReviewofOperating DataBase.ESFSystemControlLogicandDesign.EffectsofFailureinNon-Safety RelatedSystemsonSelectedESFs.StationServiceandCoolingMaterSystems.BoronAdditionSystem.Auxiliary Feedwater System.DecreaseinFeedwater Temperature, Increasein'eedwater Flow,IncreaseinSteamFlow,andInadvertent OpeningofaSteamGenerator RelieforSafetyValve.SpectrumofSteamSystemPipingFailuresInsideandOutsideofContainment

{PMR).A-1 I

APPENDIXA(Continued)

NRCSAFETYTOPICSRELATEDTOTHISREPORTXV-4XV-5XV-6XV-7XV-10XV-14LossofNon-Emergency A-CPowertoStationAuxiliaries..

LossofNormalFeedwater Flow.Feedwater SystemPipeBreaksInsideandOutsideContainment.

ReactorCoolantPumpRotorSeitureandReactorCoolantPumpShaftBreak.CVCSMalfunction thatResultsinaDecreaseintheBoronConcen-trationintheReactorCoolant(PWR).Inadvertent Operation ofECCSandCVCSMalfunction thatIncreases ReactorCoolantInventory.

XV-15'nadvertent OpeningofPORV.XV-17XV-24XVIRa'diological Consequences ofSteamGenerator TubeFailure(PWR).LossofAllA-CPower.Technical Specifications.

CEB/amr/85/t5 A-2

Retrieved from "https://kanterella.com/w/index.php?title=ML17311A007&oldid=740389"