Upload
others
View
3
Download
0
Embed Size (px)
Citation preview
AC-
REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)
ACCESSION NBR g 8409140165 „DOC ~ DATE: 84/09/13 NOT'ARI'ZEDS YES, DOCKETFACIL:50 410 Nine= Mile Point Nuclear Station< Unit 2i Niagara Moha 05000410
AUTH,NAME AUTHOR AFFILIATIONMANGANiC,VN . Niagara Mohawk Power Corp,
RECIP ~ NAME~ RECIPIENT AFFILIATIONSCHNENCER i A, Licensing Branch 2
SUBJECT: Forwards responses to SER Open Items 421 3i4i lOF 13F15F18y20»23<25i27g28i34i36i37,42i43»44 L 47ito aid in NRC revi,ew ofapplication for license; Info will be included in next'SARamend ~
DISTRIBUTION CODEF B001D COPIES RECEIVED:LTR .ENCL SIZE':TITLE': Licensing Submittal: PSAR/FSAR Amdts 8 Related Correspondence
INOTES:FNL icy FSAR'S & AMDTS ONLY, LleasW@l Glk. 05000410
RECIPIENTID CODE/NAME
NRR/DL/ADLNRR LB2 LA
INTERNAL; ADM/LFMBIE FILE"IE'/DEPER/IRB 35NRR/DE/AEABNRR/DE/EHEBNRR/DE/GB 28NRR/DE/MTEB 17NRR/DE/SGEB 25NRR/DHFS/LQB
32'RR/DL/SSPB
NRR/DSI/ASBNRR/DSI/CSB 09NRR/DS I/METB 12"N .L/ B 22R F1 04
M I/MIB
EXTERNAL) ACRS 4$DMB/DSS (AMDTS)LPDR 03NSIC 05
NOTES'OPIES
LTTR ENCL'
1
1
1
1
1
21
1
1
1
1
1c
1
1
1
1
1'»
RECIPIENTID CODE/NAME
NRR LB2 BCHAUGHEYFM 01
ELD/HDS3IE/DEPER/EPB 36IE/DQASIP/9 AB21NRR/DE/CEO 11NRR/DE/EQB 13NRR/DE/MEB 18NRR/DE/SAB 24NRR/DHFS/HFEB40NRR/DHFS/PSRBNRR/DS I/AEB 26NRR/DSI/CPB 10NRR/DS I/ICSB 16NRR/DS I/PSB 19NRR/DS I/RSB '23RGN1
BNL(AMDTS ONLY)FERA REP DIV 39NRC PDR 02NTIS
COPIESLTTR ENCL
,1 01 1
1
31
1
21
1
1 1
1
1
1
1
3
1 1»
1 1.
"TOTAL NUMBER OF COPIES REQUIRED: LTTR 55 ENCL
I
~ 01 ~ rr
I'~Ii
~'ll j' " '9 rV -(fV
(f'I
I'e(fj« ',ll li I ll(
~rI,,r' r~
( 4" 4')<
,f
~ S (f
l)r,
f j'x 'v v
It
~ 4
~ I'( I
«j,jj l 1jg
I
'4 )jrf, 4 4
f fr(,
«4 t)I
r1
3r'«V
' "Ijf' fr
«'( '1
8 1
1 lj, Q ( r$
ji
f,'VrS4'f
1
$ jv
v)I''f, 1
~ (I
a(
ijj II
lire "'
f( " '» ") J ifjf
«Ijg«r«'I
Yi
II ~,'[ jl, ji
~ 1('l s
4
Ij
rvvif,i
«Iv lf Ij«g ) ',ij I
I'.(, '
f(1v
('f )X
l«" 'vv l(')v I''l wT
f' 'jv
] (i
] gl )1/i
(') g t,,i
I'
l ""
(«
(, li
v
(1-If( 'VV
,I«j y
4
I,'' '(v lj
il iv
tf ) '1
"(v 4 v„
',
I
(g
A) I
.Tf
«()'f
'v«i«)I«
«
4 ., «))X
t «
V MIIASAIRA9 PgQO@g~g
NIAGARAMOHAWKPOWER CORPORATION/300 ERIE BOULEVARDWEST, SYRACUSE, N.Y. 13202/TELEPHONE (315) 474-1511
September 13, 1984(NMP2L 0152)
Mr. A. Schwencer, ChiefLicensing Branch No. 2U.S. Nuclear RecpQatory ConmissionWashington, D.C. 20555
Re: Nine Mile Point Unit 2Docket No. 50-410
Dear Mr. Schwencer:4
Enclosed for your use and information are the Nine Mile Point Unit 2responses to the Nuclear RecpQatory CoIImission's Safety Evaluation Reportopen items. This information has been previously discussed with your staffand is submitted to aid your review of the Unit 2 licence application forthe resolution of these open items. This information includes SafetyEvaluation Report open items 421.3, 421.4 421.10, 421.13, 421.15, 421.18,421 20 I 421 23'21 25I 421 27 421 28 g 421 34 g 421 36 g 421 37 '21 42 g
421.43, 421.44, 421.47.
The enclosed will be included in the next Final Safety Analysis ReportAaendrrent.
Very truly yours,
C.V. ManganVice PresidentNuclear Engineering 6 Licensing
NRL-gaEnclosurexc: Project File (2)
8<09>aortas se09SSPDR ADOCK 05000410,E' 'DR,', I,I
r
r 1
l
1
UNITED STATES OF AMERICANUCLEAR REGULATORY COMMISSION
In the Matter of
Niagara Mohawk Power Corporation )
(Nine Mile Point Unit 2)
Docket No, 50-410
AFFIDAVIT
C.V. Mangan, being duly sworn, states that he is Vice Presidentof Niagara Mohawk Power Corporation; that he is authorized onthe part of said Corporation to sign and file with the NuclearRegulatory Commission the documents attached hereto; and thatall such documents are true and correct to the best of hisknowledge, information and belief.
Subscribed and sworn to before me, a Notary Public in and thethe State of Maryland and County of Montgomery, this 13 day ofSeptember 1984.
Notary Public in an forMontgomery County, Maryland
My Commission expires:
Nine Mile Point Unit 2 FSAR
QUESTION F421.3 (7.1, 7.2, 7.3, 7.4, 7.5, 7.6)
Identify any "first-of-a-kind" instruments used in orproviding inputs to safety-related systems. Identify eachapplication of a microprocessor, multiplexer or computersystem where they are in or interface with safety-relatedsystems.
RESPONSE
Per k>~.The Unit 2 transient analysis recording system utilizes thevalidyne remote signal multiplexer, MC3TOAD-Q2, to provide'solation of lE signals from non-1E equipment. Themultiplexer unit a d associated plug-in signal conditioningmodules provide he signal conditioning, multiplexing, andA/ conversion to rocess and transmit up to 32 channels ofnput data.
The following components describe the multiplexer and itsassociated components:
1. 10
1. 12, 1.14
1.15
1.16
1.18
1.201.211.22
1.23
1.25
.1.2.3.
5.6.7.8.9.
10.
MC370AD-Q2AB295,-Q2AD296-Q2PS294-Q2PS171-Q2PS324-Q2CD173-Q2BA332-Q2BA332-150-Q2DI338-24-Q2
Remote multiplexer/module caseAna1og multiplexer boardA/D converter hoardMultiplexer/AID power supply brandSignal/conditioning power, supplyRemote DC power supplyHigh gain carrier demodulatorBuffer amplifierBuffer amplifierDigital encoder plug-in module
1.281.291.301.311.321.331.341.351.361.37
KESIM Kaman safety radiation monitoring:system isolation module provideselectrical isolation between theserial data lines of the Class 1Edata acquisition units and thenon-lE redundant microcomputers.
For details of testing against EMI, short circuit failures,voltage faults and/or surges, and the summary of performancecharacte ristics, see the Environmental Qualificationdocument. p gs ~~„,.g ~g Pei F i~s ~~ cc ~I'~c I +i~~]~
Pace 6» g g< @~A fi] P(Lg P ~seg~4» ~ ay~The Unit. 2 digital radiation monitoring system (DRMS)supplied by Kaman Instrumentation provides isolation of lEdigital, analog, and communication signals from non-1Eequipment.
The following modules describe the DRMS isolators.
1.401.41
iS
l.43
1.45
1. 47
1.50
.1.51
Amendment 9 .QEcR F421 ~ 3-1 March 1984
ch1217718fqr9c 02/06/84 112
NOR 8u091u0165u10 Nine Vii 1 i
Nine Mile Point Unit 2 FSAR
2. KEI-D
3 . KEI "A
Kaman digital isolation moduleprovides isolation between theClass 1E and non-1E digital signals.
Kaman analog isolation moduleprovides isolation between theClass 1E and non-1E analog signals.
1.54
1.57
For details of testing against EMI, short circuit failures,voltage faults and/or surges, and the summary of performancecharacteristics, see the Environmental Qualificationdocument.
2.12.22.3
gPKPg .~va /3wa~ p~w~nJ ~ ~PS'6N~ ~Wg~ibD-y'~''os)-a+4E mR rh'a bawdy. 7M5'.,a</~~ ~~ .p~ g~s w4-s a~an W~mur~M~ ~+@& + 'u'~rwlc~zd~- ~h V~/bh9pros&+ - +eW Wb:5'ew
W4'~~~~~a+~ p ever w ww::i wazw r ~tw~~ /ur~su+w~P st~~~; Y-~srPvip.c Flo&s 5g~w/EP *~0~ /4'c'4 4'5'Iorv
pgppy y~~pe+Aa Luu.< /w WM7~ .gNv'r~Fr@, gy rgb c~~. 7+rs rarr uzi~8K Roe /u Tee k'&vb~w ~ ShSP w~W'~4<i=8.uidwaer 'c u~wacp-ap ~~8 oPaMrro~44.
Amendment 9 QEcR F421.3-2 March 1984
chl217718fqr9c 02/06/84 112
e
s'EST ~~DFSc 8LH75g
i 4E ~M~gv'Wt~p<,~>r~p gyes ~d~r ~iy~> Oa~ry ~cg~i~grSM?Z.W Comsm~~~F M<~~EEcW<V~om~~mcZED c,a~Ps:
P CPPZZZZP ZZLLLIZPPPLLP~ IL ~ I
A'tran>gg,
d~lkfPLIILLZP~ZPLLL2 Ef LP~oPPP~PZPddd
N Z'.Pdd E
~ACIIIZLLZ.:rbY 'S
M~l70+ .
PZZP—~LZKZZILZZZ~ZZ~D~PP fff~d
~CiPr8% Cdn/&DP2vs ~
LZ PPZLZoNPEL ZZLPZPZ~.PP
P LLZfdlLZZZZLI~ILP.ZLZ'LSZZ l~/ 222~~PZ CIPLMZ.~dl~W.~MLLLZiZZ~~~af-~P—ZPP~ P PPPNLZPILZ.. ~— uLPLZIWZPILZZLL IP~ECLZLP LE~..PLL~—'~~~~PLLJIPLZ PZ dd.,. d'-
Lo&TZD /> irh ~WAA'L.
A'7ZD~Q(LCI~M'~hf~~.~fg(/C'6Q AFiBDLWCrfVSMELsYSifiiA~7 PF< rVOIV-g<~S ~c C iCCC+WLZSPPOK'7OES ~i&VIZu-CWTiVZ Low/XRO< d S +VAc.~~/ F~~
~8lB~MCESBW&~lttDYS(w~ C.DPS)~ ~s ~mac ~s'OCAI'L g
~HEM/M<~~E'NMf@~<(8SY52EMD85)~.MJ C.a~WuNdc29Z
~lych' CCA.SS M~8 ua~WWWuW~ Cpu)<%7RL~VK~CC/./e'CCum&c~~ ~Zd~MuVÃY~<> ~H DR.eR
eee/cess///c ooe-o/sm/sCo&ss ~see/e/oe~csa~asze~~~~y~~ RCC/„ul~9 gv' Th& OETR
on/S
// e/ee/seoees~</~o/Bs/~ca~i TTae~u~~~ >~Ski'KMKwEMw~~md~~
'5'3~Ã~mVW~65SM~ Cu..osaM~
d- - ~&MBA
o~ z//~.esse/s os*. Mo.
CRCu)M~i~ LC~/~wSua C EORMS'~)
e'/e///sess ~ ssso~ Q.~P
/s/ m //o s C'sou>
C~~W M~~~T'gQZa~i~rL~~r~~~~25 y+K5 A ~~gf<MEED
~c=Z~*~ ~~~~d~~l~'~~~~'~~&~mmo. /e o/e if+WiY..AM+~o~
L2onlwoR>pc 6R&s3~00er.E's MKwo <Da'pE.~Oe='CcrySs W~SocMDoW~O ZFE ORTS. lA)Cc~/.n.l~ SDBSgq~~ra
ZOP&), /Phoo/ ~D..L?i c~ye. /~D/'ÃDAs . R~> FK> <lro&P '///.8'use.ReCanCmC .uN'rr CHC<) Ou lu...is wZo~
. ~//e /Jo / c/A es~/ess-ooes ~/M~L/o/osso/ooe/ee,'~V~S
'IS//& C.8'DDE J ~P'ZA'IA'LASS~~.. ~<MEZS'dltlCH mg///'/'TCl/'-
\
~ ~~ — rs cw. err v~avem.
HOTEG AUG 1-g ~ps< H.PNSM;a.
2A CI IA Al
dCFS'J~'a'>-Cdm
v P'f U 8
~~i'5 Aom
~CA
~ C~Ad g~~u'
.s
CZc/
i'~n ~ %
J W. rt'~
5' - w ~ e. /ock4fADAdes /~Aft'f&~APu4i CngjI~J k gE ~
P ~ ~ ~ ~ ~
jt-ssdci~cd ~'PJj dg ~~cJ'a
jg~<&uL/~.~ I
it. j$0jiffu/" W (d~wd~ico /id'~IJ ~
ch~~~ef fi4r~ j4 Etna ja Q 8jJ (g~~ ~
-g r<>~sc ~e ~~ ~~„gi ./'gg ~~8v~G
~, ~ A
~ y
M 0 IAAFOtrfIOrvrer
COVSOICS
~ATA FAoct5511145005151cJIcows>
VVI VIV
ocr511I
CAV
ltslc~ IOW~SOI I
air
5rvfrr scAVI
NSTIArslACT/OIAD
golCPV
IrsrcvIOrrIVI
VV1 1I
Of»offIwivrIAS
NTIfirVATou vu rvot1
AIANNIDATADITJIAT sotsrlrcvIADDSI~
CATCOOIITt DVITSIjI5
fr@PAL A VolcANvcrs wi10A»IIIIAATCO»IVVIVV115 IACVSS
5AVS
VITAACDVISIno»5045flft»IOASI
IrncALelf ctovf t
DA» VIV ILIVI VAV VIII VIV
I ~
~14
AACrAf1'cfccf104
SVO 5 f5 TEVIAOSI CA
rt AAu ITlt v0»trvAC
CALI
TTPf4l Hg CATVVP
frpICA CAftt0CALS CAr.l CA1, ALC
TTPICAL VON CAfttVNT2 40»IIVVS
RSVVC t 5
~ ~
sfsrtAI corfncvvArfcsvFov AIAIp
D noae I'ONE 2-I
'
Ge/9o
NINE MILE POINT 2 FSAR
OUESTION
421.3
7.3I
7.S)7.6)
Identify any "first-of-a-kind" instruments used in orproviding inputs to safety-related systems. Identify'eachapplication of a mircroprocessor,.multiplexer or..computersystem where they are in or interface with safety-relatedsystems.
P
RESONSE
hiss) There are no "first of-a -k<-nd" instruments ued $ n or provSdfng
'nputs to safety-related systems.
2) Microprocessors are used as an integral part of.the RedundantReactivity Control System (RRCS). Four microprocessors(2/division) receive input signals, (e.g. low water level, high
.dome pressure, APRM downscale), process them against a time base.formula, and generate output signals (e.g. ARI, recirc pump trip,feedwater runback) to other systems. Details of RRCS operation arediscussed in Section (7.6.1.X). In addition to these dataprocessing microprocessors, the RRCS has 4 microprocessors
~
~
~
~2/division) for monitoring power supply status, 2 microprocessors1/division) for assisting in the calibration of RRCS process
instrumentation, and 2 microprocessors (1/division) to performautomatic on-line testing. of the safety related RRCS system.Hardware failures are annunciated and faults localized via use of alocal keyboard/display.
The performance monitoring system (PMS), which interfaces withsafety-related systems, is a non-safety-related system. Isolationof safety-related inputs to the PMS is shown functionally in the
-- logic diagrams and elementary diagrams listed in Table 1.7-1 andprovided to the NRC.
KC:pes:pc/1188-3.24/26/84
Nine Mile Point Unit 2 FSAR(g cj
QUESTION F421.4 (7.1, 7.2, 7.3, 7.4, 7.5, 7.6) 1.10
Section 7.1.2.3 of the FSAR provides a brief discussion on 1.11- conformance to Reg. CQide 1.47. Discuss in detail the 1.13
design of the bypassed and inoperable statue indication 1.14using detailed achamacica. Include Cho following 1. 15information in the discussion:
1. Compliance vith the recommendations of Reg. Guide 1.47 1. 17and Reg. Guide 1.22 Position D.3a and 3b; 1. 18
2. The design philosophy used in the selection of 1.19equipment/systems to be monitored, incand support ayatama.
uding auxiliary 1. 201.21
g YPindication ayatama comply with Positions Bl through B6 1.23of ICSB Branch Technical Position 21. 1.24
3. How the desi n of the b ass and noperabla status 1.22
4. The list. of system automatic and manual bypasses aa it 1.25pertains to the recommendations of Reg. Guide 1.47. 1.26
5. Discuss .hardware features- employed Co provide a 1.27consolidated, human factored, display of the bypassed 1.28and inoperable status of ESF equipment. 1.29
RESPONSE o 1.31,p .
g f gaa~hK1. Refer to er for degrees of compliance<'+ ~S~ "f1.33
2. Automatic bypassed and inoperable status indication iaprovided for all systems that affect, plant safety. ,Thisindication system accompanies any operational procedurefor all safety-related systems.
1.341.36
Any deliberate action vhich makes a support systeminoperable and also inhibits the proper function of adependant safety system will a'iso be automaticallyindicated.
Q&R F421.4-1CIMl I~~
~r - -
~r tha
is .annunciated (component evel). In thisgroup, e equipment Chat when bypassed causes a systemto be defeated, will contribute to its respective systemlevel annunciator and indicate a bypassed systemcondition. If a system is declared inoperable, vhetherit be a redundant portion of a system or a total system,and also supports other systems, the bypassed andinoperable indication vill cascade into the dependent~p 4Jc~5
Amendment. 9 March 1984
1.381.39
1. 401. 41~1.42 ~1. 43
1. 441. 45
1. 46
chl21771 02/06/84 112
I i~~g+5 pic I~+ +4l dE/w gg/rC C
ac~> n <yiiWcu a~el ruoi'ckR ae ~rSm'5'vcX><~<lCyPf 8+pz ogg. ~rqzg v>/c vo W SVS >u(/CAcrPr.aJ 4 pr y~'/ nyi 8N //
qu/JIC I"rica rAJrr g 9c PKoeIOzg>AT
~ iI+
+MAvcJQ
c Iri4 OF yh'E' YyR C> 8~0 raori6&+g
~~ A~~1.I~QIC 4riNI C pe~ ~ ++~ ~Oi(yg/~
I>odirro& ~wag - g / AC
D'/ )4~S n . ~c ~gg+iirrggZcy~>r!ewe'4 r~ reve~ ass-.y'+r-.~~IC ~ ~CW~reer'a~.
~r~g
rcpt
Rag ivo~/)~ 7irrcIc IiJDi<irrioiJ 0 >< Y h~ggrg iI~gC'Wg ~ +PROC'AP Ah/~ C ill 7+ QAAJCAVC. 4 P
~pPg 844rg iir7'Od C C. IIWIiiAld'rji
~—,4S . CO~~ a r i~~ ZrPR<S r~Qr.seZC'we. /~~6c< ~
MrrHIAJ
S~8u~ ~~ gtr g~ <a W a<Olcru&WOr-.
COCA~ ~ I l&~rAFT~rri AJOVE w~~ ~~~At~/ JBIC8VM . War4r p ~)Th'i< ~h Z ~84'4)/RG +8+ 7 AVAJA/J$ 7CQ
y-EH g c g /~i g P~Zg4 sr~ jyu~~/gWi~4 ~S /vs>Zcrud.:
Sg TEE Qe&c,~ oI .%K P6 r'Ms'ud ieoPaQA'Ecw- ~vu <
w rrcvV ~ ~ ~r~ >wc.c. iMdrcA~ arA~ ~A&vr~iRg—vc~ A QraC < j g gar R<6 ~FF~~ uIr~cnd
&cern~~ r 5 ~GE~ /~~4gCCc~I,g~ ~y ~~ i~RW~A ZfX~gW4~D~
G. MMhTOM gT'Jo. rid E
p/qg ~~ irurJo~r) y&. cue+H84dAC In]OP~i/6r P'9 FWCri'W( la'8rrCH S Paar
Re g)r/o4 KUwvrnQp 72V+7 Zo <or P>+< +iJggg47H47VC (o g(CrP77OAJ wd97'QJ~Q gCRiIJ 'ZE'i'yiYR P rim / C7)
-~au&~ +i
rM7 o+ wa. N0p~g y~o i~mt~ meAcciu3(<8yro~ S 4 S~ y- ~ gic3 reed'p~ag iN 7' eever +i<~WE M&'8&ci~ oa 4 ~~iCuA ucA4 Xf.<ra+ w)/r~6v~rM ~c.„~ «s caeg gu y gawewLc. ~oiM=vruhls ~dr w8vI~~~~ A P~~Ct(VW ~Iig~r ~ i y~~F~irI/~~
1A'4' pcprpirc+ y + gQ i~'45 $ $JprYAhz) A~ri IM~H~gQ
Nine Mile Point Unit 2 FSAR
21'.. 22
23.24
die f Il~i 4f ofs s~g ~ p ~,~~g~Q I '+3$ <'n $4VoLlC
SystemMnemonic
ADS
BYS
Re uirements
Automatic De ressurizati
Battery System
4S stem VDC
2. 35K.2.36
-'ÃI~P.38+2.3~? 41
. CCP
CPS
CSH
CSK
DER
EGA
EGF
Reactor Building Closed l.oop Cooling Mater(Component Eevel'nly)Containment Atmosphere Monitoring
Primary Containment Purge (Component fevelOnly)
High Pressure. Core Spray - Power Supply
l,ow Pressure Core Spray
Reactor Building Equipment Drains (Componentf,evel Only)
Standby Diesel Generator Air Startup
Standby Diesel Generator Fuel
2.522.53
2.55
2.572.58
3.2
3.4
3.63.7
3.9
3.11
EGP Standby Diesel Generator Protection (Breaker) 3.13
EGS
EJS
ENS
Standby Diesel Generator Protection(Generator)
Standby Station Service Substation
Standby Station Service Supply Breakers
3.153.16
3.18
3.20
Amendment 9 QER F421. 4-3 March 1984
chl217718f qr9d 02/06/84 112
Nine Mile Point Unit 2 FSAR
SystemMnemonic
S stems Containin B assed Ino erableRe uirements
Fire Protection - Water (Component Level Only) 3.22
GTS
HCS
Feedwater System (Component Level Only)
Standby Gas Treatment
COL Hydrogen Recombiner
Control Building Air Conditioning
Control Building Chilled Water
3.26
3.28
3.30
3.32
IAS
MSS
Standby Diesel Generator Building Ventilation 3.34iReactor Building Uentilation (CO Qg+l 4h .36
Yard struoture ventilation (tdenen+ Qrt[ onl4$ 3.38
Instrument Air (Component Ievel Only) 3.40
Main Steam (Component Level Only) -.. .3.42
SFC
SWP
WCS
5.
Residual Heat Removaleisa~
Fuel Pool Cooling andn Service Water
Reactor Water Cleanup (Component Level Only)~l
It is not a requirement of Regulatory Guide 1.47 thatthe bypassed and inoperable status indication system beClass 1E. However, the control circuit wiring isassociated with the Class lE components and is designedin accordance vith Class 1E requirements. Opticalisolation vill be employed to separate the annunciator,which is a non-Class lE circuit, from the bypassed andinoperable logic circuits.The component level inoperability vill be displayedusing master specialty svitch-light units vithin theirrespective operating area on the control panel.
The system=level indicators used are the standard plantannunciator vindovs separated into divisions ifapplicable. At the systcru level, the indicators will beaccompanied by an audible alarm. All bypassed and
3.44
3.46
3.48
3.50
3.573.584.14.2
'.3
4.64.7
4.84.94.104.11
Amendment, 9 QEcR F421.4-4 March 1984
chl217718fqr9d 02/06/84 112
inoperable
Nine Mile Point Unit 2 FSAR
status indication has ga er illuminatio~
Amendment 9 @BR F421.4-5 March 1984
chl217718fqr9d 02/06/84 112
Nine Mile Point Unit 2 FSAR
QUESTION F421.10 (7.1)
Section 1.10 of the FSAR provides a response to NUREG-0737.The discussion on item II.D.3 does not mention alarmsassociated with the valve position indication. Confirm thatalarms are provided zn conjunction with the positionmonitoring system. The discussions on items II '.3.13,II.K.3.21 and II.K.3.22 briefly address modifications thatwill be made to the RCIC and HPCS systems. Provide adetailed discussion on the design modifications proposed forthese systems. Use one-line diagrams and other drawings asappropriate.
RESPONSE
See revised Section 1.10 for Item II.D.3.TMI Item II.K.3.13 resulted in the-modification of the RCICsystem to allow automatic restart after RCIC system shutdowndue to high water level (Level 8) signal. Instead oftripping the RCIC turbine which required operator action toallow restart of the system, RCIC steam supply valveE51-F045 is closed, shutting down RCIC turbine/pumpoperation. Four separate transmitter/trip units energizeindividual relays, arranged in a one-out-of-two-twice logicconfiguration, to provide the closure signal for the valveF045. If the water level falls to Level 2, the systeminitiation logic will reopen the steam supply valve,restarting RCIC operation.
See revised Section 1.10 for Item II.K.3.21.TMI Item II.K.3'2 resulted in the modification of the RCICsystem to allow automatic switchover of pump suction fromthe condensate storage tank to the suppression pool if thecondensate storage tank falls to a preset low level. Lowlevel in the tank is monitored by two redundant leveltransmitters. If either transmitter senses low level, pumpsuction is automatically transferred to the suppressionpool. These are different transmitters/trip units fromthose that activate switchover for the HPCS system. Thecondensate storage tank suction valve will be signaled toclose upon opening of the suppression pool suction valve.The RCIC elementary (Drawing No. 807E173TY, Rev. 14) showsthe circuitry details.The PSID and elementary diagram will be revised to reflect arelocation of the transmitter to the pump suction line.
Se ~<scil- Amendment 10
e.Mg+ J.QEcR F421. 10-1 April 1984
Wc Mgcthe length of time the
operator will be required ocr hold the RCIC initiation button in adepressed condition to assure injection into the reactor. The concernis that if the manual initiation button is depressed only momentarilythe opening of the RCIC injection valve will not be sealed in andreactor injection will not occur. The NRC has recently indicated thathey feel this design may not satisfy IEEE-279, Paragraph 4.16, whichrequires the s stem corn
The logic for the RCIC injection valve E51-F013 is shown in Attachment1. Contacts of relays K3, K20, and K40 must all be closed for F013 toopen in response to a manual initiation signal or a low reactor waterlevel 2 signal. Relay K3 is a momentary contact relay which isenergized when the manual initiation button is depressed or when reactorwater level is below Level 2. Relay K20 is energized when the turbinetrip and throttle valve is partially or fully open. Since the trip andthrottle valve is open during system standby the contacts of relay K20will already be closed when RCIC is started. Relay K40 is energizedwhen the steam admission valve E51-F045 is fully closed. Since F045 isclosed when the system is on standby the contacts of K40 are open atthat time.
Given this logic, to manually initiate RCIC and assure the injectionvalve opening is sealed in, the operator must maintain the initiationswitch in a depressed condition until valve F045 comes off its seatcausing closure of relay K40 contacts. A red-valve position indicatinglight ill inform the operator when F045 has started to open. At thist m he initiation switch can be released since the seal-in circuit inthe MCC for valve F013 will now drive it to the full open position.
gd gJ
e0. ~
Limit switch LS6 energizes relay K40 when valve F045 is fully closed.Depending on the adjustment of this limit switch, it is not expected totake more than 1-2 seconds for relay K40 to be deenergized and itscontacts closed when F045 starts to open. This is the time required forthe operator to hold the initiation button down to assure vesselinjection.
As explained in the above the contacts of relay K3 in the initiationlogic have to be closed only 1 to 2 seconds before the injection valveopening logic is sealed in for automatic initiation. For an actualtransient event requiring the RCIC system (i.e., loss of feedwaterevents) reactor ~ater level will be below the initiation level for wellover this time required to seal-in the injection valve logic, sincewater level will not begin to recover until the RCIC and/or HPCS isinitiated. It is GE's position that this meets the intent of IEEE-279in that the RCIC system initiation will go to completion when
required'orit to perform its safety function. A momentary Level 2 lasting lessthat 1 to 2 seconds is considered very unlikely and could only occur iffeedwater flow is reestablished in time to reverse the water Mvel drop.In this case it would be preferable not to initiate RCIC, therebyavoiding injection of cold water into the reactor.
0
0
In conclusion, GE considers the current RCIC design to be adequate andthat it satisfies IEEE-279, Paragraph 4.16. Requiring the operator tohold the button for 1 to 2 seconds for a manual start does not impose a
hardship on the operator. Normally, on a manual start the operator willstay with RCIC for at least 30 seconds or more to verify turbine speed,flow and valve positions. Operating procedures will include aprecaution statement for the operator to ensure that he holds the manualinitiation switch/button for RCIC until the valve position indicatorshows the valve is opening.
~ 1~ ~
Nine Mile Point Unit 2 FSAR
~ ~ ~ ~ ~ ~QUESTION F421.13 (7.1, 7.2, 7.3, 7.4, 7.5, 7-6)
Various instrumentation and control system circuits in thep?ant rely on certain devices to provide electricalisolation capability in order to maintain the independencebetween redundant safety-related circuits and betweensafety-related circuits and nonsafety-related circuits.Provide the following information:
1.10
l. 12l.131.141.151.161.17
(1) Identify the types of isolation devices which are usedas boundaries to isolate nonsafety-related circuits fromthe safety-related circuits or to iso)ate redundantsa foty-re 1atod ci rcui ts.
1.)91.201.211.22
(2) Provide a summary of the performance characteristics 1.24from the purchase specifications for each isolation 1.25dovico idantified in rosponao to part (1) above. 1.26
(3) Describe the, type of testing that was conducted on theisolation devices to ensure adequate protection againstthe effects of electromagnetic interference, short-circuit failures (line to lihe to ground), voltagefaults, and/or surges.
1.281.291.301.31
1.33RESPONSE
Fc r. SOP
) The following list identifies the types of isolation devicesthat are used to isolate nonsafety-related circuits from thesafety-related circuits or to isolate redundant safety-related circuits.
1. CE optical isolatorsr
2. Potter and Brumfield MDR relays3. Valedyne multiplexers (MC37OAD-QE)
4. Kaman Industries isolation devices
KESIMS (serial data line communicationisolator)~ b. KEI-D (digi ta 1 iso lati on module)
IC. KEI-A analog isolation module)9-&&7
a
421.13
Insert
Each type of device used to accomplish electrical isolation is tested
to demonstrate isolation capability under maximum credible fault conditions.
These tests verify that the maximum voltage/current to which the device
could be exposed within the panel/cabinet will not jeapordize the integ-
rity of the class lE circuits. In addition, it will be shown that any
destructive effects caused by application of the worst creditable fault
will not jeapordize the function of any redundent divisional circuits
or devices in physical proximity to the failed device. All isolation
devices comply with environmental qualifications (10CFR50.49) and seismic
qualifications requirements which are the bases for plant licensing.
0
~ NINE MILE POINT 2 FSAR
UESTION
421. 137.17.27.37.47.57.6
Various instrumentation and control system circuits in the plantrely on certain devices to provide electrical isolation capabilityin order to maintain the independence between redundant safety-related circuits and between safety-related circuits and nonsafety-related circuits. Provide the following information:
'1)
Identify the types of isolation devices which are used asboundaries to isolate nonsafety-related circuits from the-safety-related circuits or to isolate redundant safety-relatedcircuits.
4sss
(2) Provide a summary of the performance characteristics from thepurchase specifications for each isolation device identified inresponse to part (1) above.
(3) Oescribe the type of testing that was. conducted on the isolation.= "devices to ensure adequate protection against the effect of
.. electromagnetic interference, short-circuit failures (line to. I.ine to grouhd), voltage faults;. and/or surges.
< ~
RESPONSE
The isolation-'devices used to electrically separate nonessential and essentialcircuits are designed to the guidelines of IEEE 384. Both relay and opticalisolation devices are employed.
The optical isolators use a'fiber-optic light pipe'to electrically separate theinput from the output. For example, an essential logic signal activates a
light emitting diode; the light is transmitted through the light pipe to a
photo switch; and the switch changes state upon receipt of the light signal andeither blocks or transmits. These are the same types of optical >solators usedin other GE plants.
The relay isolation devices provide a functionally equivalent degree. of separa-tion and are used typically for control voltage separation applications, i.e.,120-Vac and 125-Vdc essential to nonessential and redundant essential circuits.The relays are designed and- mounted so that a metal barrier separates the coilfrom the contacts with a mihimum distance of one inch between the coil andbarrier and between the contact and barrier.
The designs of- isolation devices are responsive to the concerns regardingsusceptibility to noise, shorts, surges, and faults. Adverse conditions„affecting the coil or the semiconductor device cannot propagate through theisolation barrier (i.e., metal enclosure or fiber-optic light'ipe). Converse-
ly, adverse conditions affecting the contacts or receivinq semiconductor cannotpropagate through the isolating barrier and affect the coil or transmittingsemiconductor. Therefore, essential systems or circuits are electricallyisolated from nonessential and/or redundant systems or circuits.
BAN:rm/A08223"8/30/84
0
NINE NILE POINT 2 FSAR
Summary of Purchase Specification:
A. HDR RELAY
1. Design Specification
a. HIL-R-19523b. Contract Specificationc. Coil Specificationd. Insulation Specificatione., Design Lifef. Reliability
2. Class 1E Safety Function
a. Functional Specificationb. Reli abi 1 ity
h
gualification Testing
Ambient and Desi n Environments
3.
gb; Normal Hountfng
B. -'ISOLATOR'.
Application Data Specification2. Performance Specification3. gualification Testing
a. Tested as a part of panel subassembly
The documents listed above are available for review at the General Electricoffices in San Jose, CA.
The optical isolator comprises semiconductors, resistors, and capacitorsmounted on a printed circuit board. As designed, this device satisfies elec-trical isolation requirements.
The NHP-2 NSSS uses two qenerations of optical isolators to provide isolation/separation between two divisional or divisional and nondivisional circuits.The PGCC uses one generation of isolator cards, and the Redundant ReactivityControl System uses a later generation. The basic difference is that the latergeneration has current-limitsng resistors on its input circuits to more fullyprotect the card from damage due to excessive input signals. Installation inthe panels is the same for both generations. Each is mounted in panel racksdesigned to hold..the input and output cards separated by a 1" quartz rodthrough a ceramic barrier.
Specifications control the type of testing and qualification required on theisolators. The basic difference is that line to line voltage tests (140 VDC
for two minutes and 400 V pulse for one msec.) were performed on the new
generation isolators. Instead of this test, an input circuit 5KV line-to-ground
BAH:rm/A08223"8/30/84
NINE MILE POINT 2 FSAR
test was performed on the older generation isolators. In either case, subse-
quent .to the test, it was confirmed that there was no degradation of the cardon the other side of the barrier.
Additionally, the RRCS used isolated lamp drivers (card mounted relays) toisolate class lE signals from certain non-class 1E loads (p. g., indicators);As part of its qualification, a 200 VDC line-to-line test across output con-
tacts was performed to determine no degradation will be propagated back to theinput circuit on the card.
Since the same kind of panel enclosures is used for both generations of isola-tors, running the 5KV test on the old generation will be sufficient to confirmthe barrier (dielectric) capability for both generations of isolator cards and
their housing. In addition, since the 5KV test greatly exceeds the voltage tobe applied during the line-to-line test of the new generation cards, it can be
considered equivalent to the test on the new generation cards, with respect tocausing detriment to the cards on the other ssde of the barrier.
The isolator enclosures are designed to hold either four or eight isolatorcards; only cards representing csrcuits from the same division are contained inthe same enclosure.' worse case failure would only cause loss of function toone division; because of built-in redundancies in other divisions, safetyfunctions would not be lost.
Copies of test plans, procedures, and results are on file at GE.
A summary of the qualification test performed on the MDR relay and the opticalisolators are given in Attachments 1 and 2.
An additional test of the optical isolators to verify that they can withstandthe maximum credible voltage applied in the'ransverse mode is being scheduled.This test will verify that the maximum credible voltage applied to the opticalisolator s in the transverse mode will-not be propagated through the quartzbarrier to the other side of the device.
COMMENT TO SMEC/NMPC
SPEC should provide the portion of the response concerning BOP devices used inelectrical isolation. This response should be incorporated into SPEC/NMPC FSAR
revision.
BAM:rm/A08223"8/30/84
-3-
'
k
ATTACHMENT 1 TO QUESTION 421.13SUMMARY OF QUALIFICATION TEST
PERFORMED ON HDR AUXILIARYRELAY
1. GENERAL
Rel ay Manufacturer:Relay Model:GE Drawing:GE Design Record File:
II. FUNCTIONAL TEST
Potter and BrumfieldMDR-4130-1169C9481AOO"901-1
The following tests were performed in the sequence listed.
a. Normal Operation:~ ~
~
~
~
~
~plication of normal coil rating voltage to coil terminals and
o servance of relay contact status change. Repeat test withgradually removing applied voltage.
b. Contact *Current Rating Test:
Application of contact rated load and observance of contact statuschange while relay coil energfzation and deenergization.
c'. Dropout and Pickup Voltage Test:
Gradual decrease and increase of relay coil voltage application,observance of contact status change.
d. Response Time Test:
Energization and deenergization of relay coil and recording of cycletime.
e. Dielectric Strength Test:
Application of appropriate voltage based on Hil Spec R-19523A (1230Vfor 120 VAC nominal, 2375V for 125 VDC nominal, 1265V for 24 VDC
nominal) for one minute between relay coil circuit and relay mainframe.
Acceptance Criteria - Relay shall not short out between coil circuitand contacts or frame during one minute exposure to applied voltage.
f. Typical Test Set-Up (see Figure421.13-1)'II.
SEISMIC TEST
Clutter and contact bounce monitoring in the. energized and* deenergizedstate at different times during seismic excitation.
BAM:pc:rm/L08225*-18/22/84
Rela State NC Contact NO Contact
Oe-energized 9 6.7g
Energized 0 17g
5 msec. max. No transfer of contact
No transfer of contact 2 msec. max.
IV. ENVIRONMENTAL TEST
Exposure to temperature and humidity environment of each extreme andvarious conditions in between and demonstration of relay operation before,during, and after such exposure.
Environmental Exposure
a. 710F~ HC RH
b 55oF'(g RH4loF''Hd. 614F, 35K RH
e 81oF'ly RH
f. 101 P, 65X RH
g. 102 F, 80K RH
h. 119 F 90K'RH
V. CONCLUSION
Test samples successfully demonstrated thatbefore, during, and after the test exposureall functional requirements as specified.
the relay wi.ll functionenvironment. The relay met
BAH:pc:rm/L08225"-28/22/84
~ ~
NUCLKARKNfAQYUSINESS GROUP
SKI)KRAKO KI.KCTRIC 40-901-Ib s~ ~o. II)IK; Qh
TYPICAL RECORDER CO lsiCTIG'.iS
+- Vo1 tage + Voltage
Contact
I Y 6 0)i."Coil
1030 GHN Recorder Recorder
TYPICAL TEST SET-UP'
Voltage
?n$ tietfngDevice ~ ~ ~0
RECC)"DER
RECORDER
Lo ic Rela;
ATTACHMENT 2 TO QUESTION 421.13
SUMMARY OF QUALIFICATION TESTPERFORMED ON OPTICAL ISOLATORS
OEVICE
Field Contact5V Logic Input12V Logic Input5V Logic InputHigh Speed Input.Analog InputAnalog InputFloating Low Level OutputHigh Level Output5V Logic OutputHigh Speed OutputAnalog Output .
Isolator Power SupplyOptical Isolator,Optical Isolator
FUNCTIONAL
TEST'04B6186AAG
004204B6190AAG 003204B6190AAG004204B6190AAG005204B6198AAG002204B6208AAG002204B6208AAG003198B6241AAG003204B6188AAG002204B6194AAG002204B6196AAG002204B6220AAG002198B6203AAG004133D9947G003133D9947G004
The optical isolators were tested to verify that they met the requirementsas specified in 272A8638, Isolator Application Data Information Document.
III. SEISMIC TEST.
The optical isolators were tested using 22A4320 Seismic qualificationProcedure for Class 1E Electrical Equipment Test Specification.
IV. ENVIRONMENTAL EXPOSURE
TEMPERATURE F
137153
70&+ 5 (Ambient)40
RELATIVE HUMIDITY RH
80'0K
50+15% (Ambient)80K
DURATION
100 hrs8 hrs
12 hrs100 hrs
V. HIGH VOLTAGE TEST
A 5KV hi-pot test was; performed on the Isolators to assure that electricalisolation between the input or output will not impair the function ofdevices on the other side of the barrier.
BAM:rm/A08294"-18/29/84
~ ~
VI. DETERMINATION OF TEST VOLTAGE
A generic review of the voltage sources present within the plants utiliz-ing optical isolators indicated that 4160 volts is the maximum voltagethat could conceivably be present. Therefore, a test voltage source of5OOO volts was chosen.
The actual voltages that could be present in a panel are determined by aspecific plant analysis.
VII. CONCLUSION
Test samples successfully demonstrated that the optical isolators willfunction before, during and after the test exposure environment and meetthe qualification requirements of IEEE 323-1971 and IEEE 344-1975. It wasalso demonstrated that electrical isolation is maintained between inputand output.
BAM:rm/AO8294*-28/29/84
TYPICAL TEST CONFIGURATION FOR OPTICAL ISOLATORS
XSo<A,~oK HouS[mg
~~ops>oa Chub S
t" Bra.~i<. ~4r r>e.r
Figure 421.13-2
Figure 421.13-3
~ ~ ~
~ ~
88r28~ 88 14 S8kJ CH3C 2739 2R M3. 881 ( PNine Nile Point Unit 2 FSAR
QUESTSN F421.15 {7.1, 7 ~ 3, 7.7)Tabl» 7.1-2 of the FSAR provides a listing of th» safetyrelated systems simi 1 arity to licensed reactors. Eleven~yscemo are shown to have no similarity. i'or these systemssufficient design details have not been provided to enablethe NRC ataf f to v»rffy con fnnnance to the acceptancecriteria of the Standard R»view Plan (NURRG 0800). For eachof these oyst»ms provid» a detailed comparison of the d»signto the app)icable raquirem»nte and recommendationsdelineated fn Table 7-1 of NUREG-0800. 8pecifical lyidentify and )beatify deviations from thea» provisions.
I
RESPONSE
S» S»ction 7. l, Tabl» 7 ~ I-S for applicability of standards;S»ction 1. 8, 'able 1.6J for D»gree of Compliance toRecclscosy ccidssI sod ssctios 7.1.1.2 soy sppli'cable ~ssection JSs syscew dssccipciop
doe'Beep~~.$*l IS I m Is eT>'V4
>) st~i ~ eyyIy 1 oI
1.12"1.141 '51.161.17le 191.24
X.22
1.27
1.29
hmendment 9 QhR F421.15»1 March 1984
ch1217718fqr9aiII
II
I
02/06/84
E.
r=C. Cur OS DE5'CRtP77onf NWg S~ Wpg Sa- red. mrna rIarwW.
L/euro ROGrorKOVE 4%~~ LHl5~ 5HfP I/.N. 3Ctl58049 Alee/cllv8~ gttS ~OF6. l/.3. 3SOuO afnetCVlyE~~ WSS - I/, V. 4
VOc, IIVoc ~ IIvor-. II
oH sr'terEaeo~~c. tfPtSPWaeArt
Or 9r3 A5-1 -Sr5-<C
er.~Z ee~r PMssce 'co5, LptS8OtuV OILY (r E-lrpl)
8'rA"I —S.k-t
Oveae jm~aw.' sZC~/r 7 us7,f~S '79848"'Ti I"I
VH8LE 7./-gVtatt'. I-3
5INec.K I-/IlurRB CA'Irt'RIII SF'Crorr. ~'TE'c7 nip 5v57Kpf
7iCA.7.3
wkvctlIL xillITIIITloivowPRo&cTIvd 8c roNS
CHS 7. S'2- 7II8LR7~-I
I.73 PAVSICr9I 27VDEP~OEivCE ~ C.ol ~+C~c, SV5va~s
~lr/e/Ino< OF XE swat XE ~csSYSl ert5
7r/rg. SSrB
%RE Xl-5
N~ y. Io/f-ITpg. 3, /red I
M-Aceo6VTPARA<ZrEC gPI=SKT
lrS
IrIOS'l)gI,roc TIIEMWOr/MLOWO Z '.RII.SRe~no~ oF mOmes ~St;mS
tr3rl:7 CFr3 IrloS
wlA
. I.llo FIRE p8OTECTIohlCur OS(.rH~
O.sr!~hr,'Mf tBIvlh
a
REchuppah,
OEScRtp77oH
/rl93 cnesz peePs M~oNPrre&Mrf
)RATSOacuPhOcHht. eeeAl7dV ~u~
ACfP5 cease rts~strv48LV'zrCYg~
0
s I
a ~
s ~
421.1(7.2)(7. 3)
s the Reactor Protection System (including Reactor Trip and Engineered
,r
8+provide a detailed discussion on the methodology used to es ab'lish
the technical specification trip setpoints and allowable values for
/P(f
Safety Feature .channels) assumed to operate in the FSAR accident and
transient analyses. Include the following information:
(1)
(2)
The trip setpoint and allowable value for the technicalspeci.fications.
The safety limits necessary o protect the integrityof the physical barriers which guard aoainst uncontrolledrelease of radioactivity. The safety limits should bethe limits established for licensing purposes, for examplethe technical specification safety limi s on minimum criticalpower ratio (1.06), and reactor coolant system pressure(1325 psig).
(4)
The values assigned to each component, of the combinedchannel error allowance (e.g., modelino uncertainties,analytical uncertainties, transient overshoot, responsetime, trip unit setting accuracy, test equipment accuracy,primary element accuracy, sensor drift, nominal and harshenvironmental allowances, trip unit driat), the basis forthese values, and the me hod used to sum the individualerrors. Mhere zero is assumed for an error a justificationthat the error is negligible should be provide .
The margin (i.e, the difference be ween the s fety limii andthe setpoint less the combined channel error allowanc ).
Identify any trip for which the setpoint and allowable valuein the technical specifications will be assigned bes- estimatevalues and for which you do not have an analysis of errors and/or uncertainties to confim that the trip function will occurbefore the actual value of the measured parameter exc ds thatassumed in the plant safety analysis. Provide justificationfor this nonanalytical aporoach.
Res e~ st
t Q|'.6 S
J- cAy~ g~ Cs ~4.
'V/w4~~ g) 2 / C +re4 v++a ~ ~A
NINE IlILE POINT 2 FSAR
4FI4!
QUESTION
421. 20(7. 2)(7-3)(7.a)
Operating reactor experience indicates that a number offailures have occurred in BWR reactor vessel level sensinglines and that in most cases the failures have resulted inerroneously high reactor vessel level indication. For BWRs,cownon sensing lines are used for feedwater control and as thebasis for establishing vessel level channel trips for one ormore of the protective functions (reactor scram, HSIV closure,RCIC, LPCI, ADS or HPCS initiation). Failures in such sensinglines may cause a reduction in feedwater flow and consequentialdefect of a trip within the related protective channel.
If an additional failure, perhaps of electrical nature, isassumed in a protective channel not dependent on the failedsensing line, protective action may not occur or may be delayedlong enough to result in unacceptable consequences. Thisdepends on the logic for combining channel trips to achieveprotective actions.
Identify each case where a reactor vessel water level tap orsensing line failure concurrent with an additional randomsingle electrical failure induces a transient and precludes theautomatic operation of reactor scram and/or engineered safetyfeature system. For 'each case identified provide an. evaluationwhich demonstrates how the redundancy or diversity of the plantdesign provides for reactor scram or safety system operationwithin acceptable limits. Where manual action is required bythe operators discuss the instrumentation and time availablefor the operator to take such corrective action.
To reduce the consequences of sensing line failures in combinationwith a single failure in a protection channel not dependent onthe failed sensing line, a modification of the protectionsystem logic may be required. Logic configurations which maybe considered for NRC approal on this plant are described inthe BWR owners group study entitled "Review. of BWR ReactorVessel Mater Level Measurement Systems", SLI-8211, prepared by.S. Levy Inc.
RESPONSE
A postulated break in an instrument line plus an additional failure isbeyond the design basis for this plant; however, an assessment of plantresponse to this event has been performed on the basis of the followingmethodolo'gy and assumptions.
Nethodolo
Determine the logic for combining channel trips to achieveprotective actions.
KC: pc/L01262"-14/27/84
NINE MILE POINT 2 FSAR
4&Sf
2. Identify each case where a reactor vessel water level tap orsensing line failure concurrent with an additional randomsingle electrical failure induces a transient and precludes theautomatic operation of a reactor protection and/or an engineeredsafety feature (ESF) system.
3. For each case identified, demonstrate how the redundancy ordiversity of the plant design provides the reactor.protectionor ESF system operation within acceptable lfafts. For theworst failure combination scenarios, perform transient analysesto demonstrate that plant safety fs not compromised.
Assum tfons
Instrument reference line failure (break)Single electrical device failure (no power supply failure)ARI operableNo operator action.
A review of various failure combinations resulted fn the identificationof the worst postulated failure path as the failure of division 1 instrumentsreference leg line (f.e., connected to condensing chamber B21-D004A)combined with a failure 4high" of B21-NOBOC.
The manual selection switch for feedwater. controller is assumed to beonthe failed instrument line, and the operator fs assumed not to switchcontrol to the other instrument. line as would be expected. This causesthe feedwater controller to respond to the high water level error signalby reducing the feedwater flow. Following the loss of feedwater, waterlevel will decrease to level 4 initiating a low water level alarm. Waterlevel vill further decrease to level 3 initiating a second low waterlevel alarm, and reactor scram vill not occur due to the assumed failure.When water level decreases to lev'el 2, a third low water level alarm wfllbe initiated, reactor scram will occur due to Alternate Rod Insertion(ARI). RCIC system vill automatically start, and both recirculationpumps will trip.'PCS system fs unavailable (tripped) due to the assumedfaf lure.
The core thermal hydraulic analysis using the REDY transient code showsthat the water level inside the shroud drops to a minimum of 1.9 feetabove the top of the active fuel at 1436 seconds and slowly rises thereafter.Since the core remains covered throughout the transient, no core heatupfs expected.
Note: The justification of 'Assumption 2 fs as follows:
Section 4.4.3 of BWROG-8253, "BWR Owners Group Reactor Vessel Water LevelMeasurement System Report," from T. J. Dente (BWROG) to H. R. Denton(NRC), dated August 13, 1982, stated: "...the ATMS events...indicatethat mechanical failures, not instrument failures, fn the system...arethe largest contributor to core melt.. Events involving electricalfailure, which included instrument failures, are less than O.lX of thetotal core melt frequency."
KC: pc/L01262*-24/27/84
NINE MILE POINT 2 FSAR
UESTION 421. 23~ f ~ $ ~ j 705)
Provide an evaluation of the effects of high temperatures on reference legs ofwater level measurinq instruments subsequent to high energy line breaks,including the potent>al for reference leg flashing)boil-o f, the indication/annunciation available to alert the control room operator of erroneously highvessel level indications resulting from high temperatures, and the effects onsafety systems actuation (e.g., delays).
RESPONSE:
High drywell temperature does not significantly affect measured reactor waterlevel when reactor pressure is greater than the saturation pressure of water inthe water level sensing lines because the vertical drop of the wide range,narrow range and fuel zone range reference and variable leg sensing lines inthe drywell are approximately equal. The water level indication is not affect-ed because the comparable vertical drops of the reference and variable legsensing lines in the drywell result in nearly equal changes in hydrostaticpressure in these lines due to reduced water density at increased drywelltemperature.
If reactor pressure decreases to less than the saturation pressure of the waterin the water level sensing lines, the water in the lines will flash and boil.
,The flashing and boiling may result in loss of some of the water in the sensinglines. Loss of water from the sensing lines results in reactor water -levelmeasurement error until'perator action refills the sensing lines.
Analyses have demonstrated that water level activated safety trips will beinitiated for high energy line breaks before reactor pressure decreases to lessthan the saturation pressure of the water in the sensing lines. Therefore,these safety trips will be initiated before high drywel1 temperature signifi-cantly affects water level measurement.
The NMP2 containment monitoring design consists of eighteen redundant Class 1Etemperature elements distributed throughout the Primary Containment: The
'ontainment temperature monitoring system constantly scans and selects thehighest containment temperatures fol control room indication and annunciation.The control room indication of containment temperatures includes meteredindication as well as temperature recorders. The control room annunicationalerts the operator of high containment temperatures which could lead topossible erroneous level indication. r
Long term (i.e. following RPV blowdown and reflooding) water level measurementerrors due to flashing and 'boiling of water in the sensing lines are postulatedto occur as a result of multiple failures by the operator to follow established
8AM: csc: rm/I08271""18/29/84
emergency procedures. The BWR Owners Group (BWROG) has established the posi-tion with the NRC that potentially large water level measurement errorsresulting from high drywell temperature increase the probability of core meltand that these errors should be minimized and/or eliminated. This position wasestablished with the NRC via the BWROG reports ¹SLI-8211, titled "Review of BWR
Reactor Water Level Heasurement System" and ¹SLI-8218, titled "Inadequate CoreCooling Oetection in BWR's" prepared by S. Levy, Inc.
This response provides the results of aii evaluation of the NHP2 reactor waterlevel sensing line arrangement in the drywell based upon the criterion accepted
- on the Shore4am docket. Specifically, t™he acceptance criterion is that:
"Following initial reactor water level stabilization after reactor depres-surization and assuming the operator fails to properly monitor reactorwater level during long term (on the order of hours) post-LOCA conditions,the operator shall receive a low reactor water level alarm before thelower tap is uncovered."
It should be emphasized that the stated criteria is based on the assumption ofmultiple failures., Under the highly unlikely scenario postulated it is assumedthat the operator:
1) fails to properly monitor reactor. water level (i.e., the most impor-tant post-LOCA parameter),
2) stops all systems providing reactor core inventory,')
fails to properly monitor drywell temperature 'and vessel pressure andreflood t'e reactor in order to recover/restore water level indica-tion, as required by the emergency procedures, when drywell tempera-ture near the- instrument lines exceeds that saturation temperature ofthe reactor vessel, and
4) fails to initiate the drywell spray at the high drywell temperaturespecified in the emergency procedures.
The evaluation assumes loss of all water in the part of the reference. legsensing line located in the drywell as a result of failure of the operators tofollow established emergency procedures. The loss of water from the referenceleg is assumed to occur due to high drywell temperature conditions (i.e.,flash-off that occurs when the reactor is depressurized and long-term boil-offof water due to drywell temperatures higher than reactor temperatures). Theerror resulting from flash-off and boil-off is proportional to the vertical'l
evati on change of the re ference 1 eg in the drywel 1 . NMP2 has a maximum ofg —// ~~ee4. vertical elevation of reference legs in the drywell. This evaluation
is based on the nominal trip setpoint.
The results of this evaluation indicate that a low reactor- water level 2 alarmwill be received before the lower instrument tap connected to the alarm isuncovered.
BAH:csc: rm/I08271"-28/29/84
Nine Mile Point Unit 2 FSAR
QUESTION F421.25 (7.2, 7.3, 7.4, 7.5, 7.6, 7.7)
Reg. Guide 1.118, which provides guidance with respect toperiodic testing of the reactor protection system
(reactor'rip,
engineered safety features and supporting systems,RCIC) excludes lifting of leads to perform surveillancetests and accepts opening of a breaker to performsurveillance tests only if opening of the breaker causes thetrip of the associated channel. Confirm that the Nine Mile.Point Unit 2 surveillance tests will conform to the abovecited guidance.
RESPONSE
See Table 1.8-1, Regulatory Guide 1.118.said, Crf $hsn$ Mh
surveillance testing procedures i for the reactorsystem are currently under development. Lifting
is not normally utilized in procedure steps unless
Periodicprotectioof leadsthe procedure would require this action to 'ccomplish the =
purpose of she procedure and no other method, suoh asopening a breaker, is possible. Ahenever lifted leads areutilized, an analysis will be performed to Verify that thisis the only practical method available to accomplish thesurveillance. Within the body of a procedure speci ficinstructions are given to identify, lift, and replace theleads Such actions are performed under strictadmini trative control with independent verification forsafet related systems or components.
ov Sukftof
Qgl>Q~s
444'A'ovid'ilq ~~ < m~i4* L~fg~Aa. Pechs~fmQPn d$ . Z'EUO4~.Qg Pg gq
>s'zscosse'pP>442&% Q.PA+dW~Qg4)~
P&R,MRW ~7yp~g p-y )c. g~prp~g~W>~b ~urPw~7- ~r~~ ~ +
C ~ ~'cr ~~D+~s' pR V~(ddsc~ ~~H4WTEAj+nlc~)'~+~~@~ g~y p(cg~Ms~s IVY&W< )7- gy~~ ~>-P>4v~~ 7-usvrwe, uu.c ~~ ~~~<>~> ~ +&46W6'Vncrio~+c. gdder~
0. ~m~7f ~vl~eb @kSR& P-~w ~~
NINE NILE POINT-2 FSAR
CE/Q
QIIEom 421.27Mode switch contact and mode switch operating mechanism
.'alfunctionshave caused inadvertent protective actions .Similarmalfunctions could have rendered redundant channels of protectivefunctions inoperable. IE Information Notice 83-42 provided noti-fication of potentially significant events concerning mode switchmalfunctions. Section 7.2..1 of the FSAR indicates that the reactormode switch is used to bypass and enable protective functions, rodwithdrawal interlocks and refueling equipment interlocks. Provide adetailed discussion on how the mode switch is.incorporated into theoverall design, supplemented with detailed drawings and schematics.Please include the following:
.
(1) Identification of the reactor protection system, rod block,refueling interlock and other, functions important-to-safetythat are dependent on proper mode switch contact operation.
(2) Identification of the analyzed transients and accidents wherecredit is taken for the operation of any function identified in(1) above.
(3) The surveillance actions necessary to positively verify mode
switch contact positions, detect mode switch contact failuresand detect mode switch operating mechanism failures for eachfunction identified in (1) above.
RESPONSE dn assessment of the system impact of postulated misopeeatioesfor the presently installed mode switch is provided below. Theassessment includes an 'valuation of the impact of postulatedmisoperations on the analyies described in Chapter 15. It identi-fies normal switch contact positions for each mode of operation(RUN, SHUTDOWN, REBEL, and STARTUP), and summarizes the consequnceshould one or more pairs of contacts misoperate. '11 of thesemisoperations are detectable by annunciation, instrumentationa Schecks, ~urveillance testing.
~ m I
{ ~ s~ ~
1-02731
C
Assessment of Effects of Mode Switch Miso eration
NOTE: Each pair of svitch contacts is . identified by identicaldigits vith the letter C as a suffix on one digit <(e.g., 1-1C,2-2C, etc.). For brevity, only one digit vill be used, thus:contact 1, contact 3, etc.
I. Contacts Normall Closed in RUN Position
).1 IRM B ass Contacts-3 5 19 21 35 37 51 53
1.1.1 If any of the above contacts are open in the RUN positionthe IRM scram function would be enabled and half-scrams orscrams could result if IRM's vere upscale'or inoperative.
1.1.2. If any of the above contacts are closed in STARTUP,.
REFUEL, or SHUTDOWN svitch positiions, the IRM scram
function vould be bypassed. This would not be detectedimmediately. but vould be evident 'during weekly channelfunctional tests because half scrams due to the IRM
function could not be induced in the affected channel(s).
1.2 Shutdown Scram Interlock Contacts-9 25 41 57
(Note: These contacts are also normally closed in STARTUP and.
REFUEL.)
1.2.1 If any of the above contacts are open in the RUN
position a scram or half scram vill result.
1.2.2 If any of the above contacts are closed in SHUTDOWN,
the shutdown trip function of the affected logic circuitvould be disabled.
1-02732
1.3 APRM Interlock Contacts-ll 27 28 43 44 59
1.3.1 If any of the above contacts are open in the RUN
position, the APRM setdown scram trip function 'would bet
enabled and the APRM's would provide half acrams or fullscrams at reactor power levels of 15'r greater.
1.3.2 If any of the above contacts are closed in anyposition but RUN, the APRM setdown scram trip functionwould be disabled and the trips setpoints would be raisedto their high setpoint level of about 113'f reactorrated power.
1.4 Rod Block Interlock Contacts-30 62
1.4.1 If either of the above'contacts are open in the.RUN
position, an annunciated rod block signal would be sent tothe reactor manual control system to prevent removal ofmore than one control rod.
1.4.2 If either of the'bove contacts are closed in STARTUP,
REFUEL, or SHUTDOWN, there would be an unannunciatedpermissive for the reactor manual control system to move
more than one control rod. In the STARTUP or REFUEL
mode, the permissive would be redundant.
1.5 Conclusions
For multiple failures of mode switch contacts which are normallyclosed in the RUN mode, the principal concerns are:a. The unannunciated bypass of the IRM scram function in switch
positions other than RUN.
b. Failure to cause scram when moving the mode switch toSHUTDOWN-
1-02733
c. The unannunciated bypass of the APRN setdown scram functionin switch positions other than RUN.
d. The unannunciated permissive to move more than one control rodwhen in the SHUTDOWN mode.
II. Contacts Normall Closed in STARTUP Positions
Z.l KSIV Closure Scram B ass Contacts-7 23 39 55
(Note: These contacts are also normally closed in REFUEL andSHUTDOWN.)
2.1.1 If any of the above contacts are open in the STARTUP
position, the MSIV closure scram trip function would beenabled vithout immediate operator knovledge, unless one
of the tvo bypass'nnunciati'ons vere to cease. Thi:s vouldrequire at least tvo of the four sets of contacts to open.
2.1.2 If any of the above contacts are closed in RUN, an
annunciated bypass of the MSIV closure scram trip functionwould occur.
2.2 Shutdown Scram'Interlock Contacts-9 25 41 57
(Note: These'contacts are also normally closed in RUN and
REFUEL.)
2.2.1 If any of the above contacts are open in the STARTUP
position, a scram or half scram vill result.
2.2.2 If any of the above contacts are closed in the SHUTDOWN
position, the shutdown scram trip function of the affectedlogic circuit would be disabled.
2.3 Steamline Lov Pressure Isolation Tri B ass
Contacts-10 26 42 58
1-02734
(Note: These contacts are also normally closed in REFUEL and
SHUTDOWN. )
2.3.14
If any of the above contacts are open in the STARTUPS
position, the MSIV isolation-on-low-steamline-pressurefunction would be enabled; A MSIV isolation trip or halftrip would occur. The isolation trip could be followed bya scram or half scram on HSIV closure.
2.3.2 If any of the above contacts are closed in the RUN
position, HSIV isolation on low steamline pressure wouldbe bypassed.
2.4 Rod Block Interlock contacts-31 63
2.4.1 If ei;ther of the above contacts are open in the STARTUP
position, an annunciated rod block signal would be sent tothe 'eactor 'anual control system to prevent removal ofmore than one control rod.
2.4.2 If either of the above contacts are cloyed when not inSTARTUP, there would be an unannunciated permissive forthe reactor manual control system to move more than one
control rod. In the RUN and REFUEL modes the permissivewould be redundant.
2.5 Conclusions
For multiple failures of mode switch contacts which are normally closedin the STARTUP mode, the principal concerns are:
a. Qe annunciated bypass of the kSIV closure scram trip functionin the RUN mode.
b. The unannunciated bypass of the %IV-isolation-on-low-steam-line pressure function in the RUN mode.
1-02735'
c. The failure to initiate scram whea the mode switch is moved tothe SHUTDOWN position.
d. The uaannunciated permissive to move more thaa onc, coatrol rod
in the SHUTDOWN mode.
III Contacts Normall Closed ia REFUEL Position
3.1 HSIV Closure Scram B ass Contacts-7 23 39 55
(Note: Thyrse coatacts arc also normally closed in STARTUP and
mmOWN.)
3.1.1 If any of the above contacts are open in the REFUEL
position, the MSIV closure, scram trip functioa vould be
enabled vithout immediate operator knowledge, unless one
of the tvo bypass. annunciatioas vere to cease. This would
require at least tvo of the four sets of contacts to be
open.
3.1.2 If any of the above .contacts are closed in the RUN
position, aa annunciated bypass of the MSIV closure scram
trip 'function vould occur.3.2 SDV Hi h Vater Level Scram ass Contacts-8 24 40 56
(Note: These contacts are also normally closed in SHUTDOWN.)
3-2.1 If any of the above contacts are open in the REFUEL
position, the SDV high vatcr level scram trip functionvould be enabled for the affected logic channel.vithoutiamediate operator knowledge, ualess one of the tvo bypass
aanunciatioas vere to cease. This would require at leasttwo of the four sets of contacts to be open.
3.2.2 If any of the above contacts are closed in RUN or STARTUP,
1-02736
the SDV high-water-level scram trip bypass would be
enabled. (h separate bypass switch for each channel must
also be closed to effect the bypass.)
3.3 Shutdown Scram Interlock Contacts-9 25 41 57 0 ~
(Note: These contacts are also normally closed in RUN and STARTUP)
3 3.1 If any of the above contacts are open in the REFUEL
position, a scram or half scram will result.
332 If any of the above contacts are closed in the SHUTDOWN
position, the shutdown scram trip function of the~ ffected logic channel would be disabled.
t
3.4 Steailine Low Pressure Iso)ation Tri B ass Contacts-10 26 42 58
'(Note: These contacts are also normally closed in STARTUP and
Simoom.)
3.4.1
3.4.2
If any of the above contacts are open in the REFUEL
'position, the MSIV isolation-on-low-steamline-pressurefunction would be enabled. h ESIV isolation trip or halftrip would occur.If any of the above contacts are closed"in the RUN
position, MSIV isolation on low steamline pressure would
be bypassed.
3.5 Rod Block Interlock Contacts-29 61
3.5-1 If either of the above contacts are open in the REFUEL
position, an annunciated rod block signal would be sent tothe reactor manual control system to prevent removal ofmore than one control rod.
1-02737
3.5.2 If either of the above contacts are closed when not inthe REFUEL mode, there would be an unannunciatedpezmissive for the reactor manual control system to move
more than one control rod. In the RUN and SThRTUP modes,the permissive would be redundant.
3.6 Conclusions
For multiple failures of mode switch contacts which are normallyclosed in the REFUEL mode, the principal concerns are:
ao The annunciated bypass of the HSIV closure scram trip functionin the RUN mode.
b. The unannunciated bypass of the %IV-isolation-on-low-steamlinepressure function in the RUN
mode.'.
The failure to cause a scram when the mode switch is moved tothe SHUTDOWN position.
d. The unannunciated permissive to move more than one control rodin the SHUTDOWN mode.
e. The annunciated bypass of the SDV high-water-level scram in theRUN or STARTUP mode.
IV. Contacts Normall Closed in SHUTDOWN Position
4.1 Shutdown Scram Reset Controls-1 2 17 18 33 34 49 50
4.1. 1" If any of the above contacts are open in the SHUTDOWN
position, the shutdown scram/manual scram logic for theaffected logic channel will not be configured to pezmitthe logic channel to be reset after a scram trip.
4.1.2 If any of the above contacts are closed in any position
1-02738
45/Q
except SHUTDOWN, there vould be no immediate effect. Ifboth sets of contacts in any logic channel (1 and 2 forlogic hl, 17 and 18 for logic Bl, etc.) vere.. closed vhennot in SHUTDOWN, the shutdovn scram function vould be inthe "reset" configuration; and a scram trip vould notoccur for that logic channel vhen the mode svitch is moved
to the SAG'DOWN position.
4.2 NSIV Closure Scram ass Contacts-7 23 39 55
(Note: These contacts are also normally closed in STARTUP and
REFIT..)
4.2. 1'f any of the above contacts arc open in the SHUTDOWN
position, the NSIV closure scram trip function would be
enabled vithout immediate operator knovledge, unless one
of the tvo bypass annunciations vould cease. This vouldrequire at least two of the four sets of. contact to be
opene
4.2.2 If any of the above contacts are closed in the RUN
position, an annunciated bypass of the MSIV closure scram
trip'unction vould occur.4.3 SDV Hi h Water Level Scram B ass Contacts-8 24 40 56
(Note: These contacts are also normally closed in REFUEL.)
4.3.1 If any of the above contacts are open in the SHUTDOWN
position, the SDV high vater level scram trip functionvould bc enabled for the affected logic channel vithoutimmediate operator hnovledge, unlesi one of the tvo bypassannunciations vere to cease. This vould require at leasttvo of the four sets of contacts to be open.
4.3.2 If any of the above contacts arc closed in RUN or
I 02739
STARTUP, the SDV high vater level scram trip bypass vouldbe enabled. (Closure of a separate bypass svitch for each'channel vould be .required to complete the bypass.
4.4 Steamline Low Pressure Isolation Tri B ass Contacts-IO . 26 42 58
(Note: These contacts are also normally closed in STARTUP andREZOEL. )
4.4.1 If any of the above contacts are open in the K03TDOWN
position, the MSIV isolation-on-lov-steamline-pressurefunction vould be 'enabled. h MSIV isolation trip or halftrip vould occur.
4.4.2 If any of the above contacts are closed in RUN, MSIV
isolation on lov steamline pressure vould be bypassed.4.5 Conclusions
For multiple failures of mode switch contacts vhich are normallyclosed in the SHUTDOWN mode, the principal concerns are:
a. The annunciated bypass of the MSIV closure scram trip functionin the RUN mode.
b. The unannunciated bypass of the MSIV-isolation-on-low-steamlinepressure function in the RUN mode.
c. The annunciated bypass of the SDV high-water-level scram in theRUN or STARTUP mode.
V. Summa and Conclusions
,A. All failure modes for the mode switch contacts where contacts open
that should be closed vould result in scrams or half scrams
depending on the number of contacts that are open. At the same
1-027310
time, for conditions of operation vhere steamline pressure is low,isolation of the main steamlines vould occur.
P'.
In the "STARTUP", REFUEL", and "SHUTDOWN" positions of the mode
svitch, closures of contacts that should be open (3,5,19,21,wpv/d
35,37,51,53)>result in a bypass of the IRM scram function in one ormore of the RPS channels. Closure of contacts 11, 27, 28, 43, 44,59, would result in raising, the setpoint of the normally setdown
APRM high flux scram function from 15~ to 113$ in one or more of theRPS/NMS channels.
C. In. item B above, although the mode svitch failure,- (i.e., contactsclosing), would not be immediately apparent to the;.plant operator,the failure would be detected during the veekly IRM"and APRM channelfunctional tests. If these'ests veie performed prior to the powerincrease and after transferring the mode switch,.to the "STARTUP"'
position, then the IRM channel functional tests vould detect the IRM .
failures because no half scram vould result. The proposed technicalspecification requirement vill be that the IRM channel functionaltest and the APRM channel functional test be performed vithin 24
hours prior to startup, if it has not been perfozmed in the previousseven days. Meekly surveillance vould be required for the case
vhereby the "hot standby" (STARTUP position) condition is maintainedfor long periods of time.
D. In the 'RUN" position of the mode svitch, closures of contacts 7,23, 39, 55 vould result in the bypass of one or more RPS tripchannels related to the MSIV closure scram functions. Closure ofcontacts 10 '6, 42, 58 would result in the bypass of one or more
NSSSS trip channels related to the steamline low pressure isolationfunction. Concurrent vith the incorrect'ode switch contactclosures, there would be annunciations that one or more of the RPS
MSIV closure scram trip channels have been bypassed.
1-027311
ALSO'NCE A REFUELING CYCLE AFTER THE N3DE SWITCH IS PLACED IN THE STARTUP
POSITION A CHANNEL FUNCTION TEST OF THE IN S HIGH FLUX TRIP WILL BE PERFORNED
Closure of contacts 9, 25, 41, 57 can bypass the "SHUTDOWN¹'ode
scram function. If the contacts remain closed during and aftertransfer of the mode svitch to the "SHUTDON" position,'such closedcontacts would not allow a scram to occur from positioning'f thesvitch. That is, only a half scram or no scram vould re'suit. Thisfact would be immediately apparent to the operator. Mannual
scraming of the plant is accomplished by depressing the manuallyscram switch. The ability to scram the plant from the mode iwitchis only a secondary effect, and one of several backup alternates tothe scram pushbutton.In the "SHUTDOWN" mode, closure of mode svitch contacts 29, 30, 31,61, 62, 63 vould remove the normal rod vithdrawal block restrictionassociated vith this mode. This fact vould be apparent'o theoperator because the window for the normal rod vithdrawal blockannunciator vould be extinguished, and its change of state vouldalert the operator. The manual positioning of rods is under strictprocedural controls. The rod block positioning restrictions areonly backups to those controls. hdditionally, the operator vouldbecome avare of the situation via standard technical specificationdriection by verifying this rod block by attempting to vithdrav a
second rod after the first one is vithdravn.
1-027312
NINE MILE POINT 2 FSAR
VI. Evaluation of the Effects of Mode Switch Miso eration on Cha ter 15~na ses.
The potential impacts of the effects of mode switch misoperation onthe analyses of transients and accidents presented in .Chapter 15were evaluated. The focus was on certain specific events becauseof previously expressed NRC concerns with those events or becausethe events might impact the limiting transients. These specificevents were classified into two groups according to theconsequences of mode switch misoperation.
1. ~Grou 1
The events in Group I include:
.a.. The abnormal startup of an idle recirculation loop..
b. The failure of the recirculation flow controllerwith increasing flow.
c. A rod drop accident.~ \
These are events for which the con'cern is related to thebypass of the scram function of the intermediate range monitor(IRM) while the mode switch is in the "STARTUP," "REFUEL," or"SHUTDOWN" positions. This would also raise the scramsetpoint of the average power-range monitor (APRM). from the15K "startup" value to the 118K "run" value, which correspondsto the analytical limit of 121% used for the analyses ofChapter 15 transients and accidents.
None of the Chapter 15 analyses of the events in Group I takescredit. for either the IRM scram function or the APRM scramfunction with the setpoint setdown to the 15-to-25K level.Events a-and b of Group I were analyzed from a "RUN"-modepower condition since the Chapter 15 analyses are initiatedfrom about 56K power and 40K core flow. In the "RUN" mode,the IRM trips are bypassed and the APRM flux scram-setpoint isapproximately 118K (121% analytical limit). The rod dropaccident analysis was initiated from OX power, (50K roddensity); consequently, the mode switch would be in the"STARTUP" position.
- No impact would result from the misoperation of the modeswitch in the "REFUEL" or "SHUTDOWN" modes.
a. For the analysis of the abnormal recirculation-loopstartup transient, no credit was taken for the flowreference in the scram for high neutron flux.. The highneutron flux setpoint of 121% was used. The Analysis ofthis event was initiated from a power level significantlyin excess of where recirculation-loop startups would
PCY: pes/1 lOBB-I4/27/84
b.
ce
NINE MILE POINT 2 FSAR
normally originate and corresponding to the mode switchin the "RUN" mode. At lower power levels, tgeconsequences of the event would be less severe;consequently, the impact of the mode switch misoperationon the analysis of this event is of no significantconsequence.
The initiation of an abnormal recirculation-loop startuptransient when the mode switch is in the "STARTUP"position would also be of no consequence since operatingprocedures would require the initial power level to beless than IS%. The resulting power increase probablywould not cause a scram. If the resulting power levelwere in excess of technical specification requirementsrelated to power, pressure, and core flow, the operator .
would take corrective action in accordance with thoserequirements.
The Chapter 15 analyses of the recirculationflow-controller failure with increasing flow wereinitiated from a 55% power and 35.7X core flowconditions, with a 12ll flux:scram terminating the powerexcursion. Similar events originating from the startuppower range of O.to 15K power would be of lesserconsequence. Also, at this low power level, normaloperating procedures would infer minimum pump speed withindividual'oop operation. These operating conditionswould lessen the effect of a single-loop .flow increaseand would preclude the event of flow control failing withincreasing flow on both loops.
The analysis in Chapter 15 of the rod drop event onlytakes credit for the 121% APRM trip and takes no creditfor the IRM scram function. The event, as analyzed fromthe OX power level, is terminated by the Doppler effectarid is of significance only below about 2 to 3% power.At high power levels, the rod drop would be less of aproblem because of the influence of the resulting steamvoids in the core on the local high reactivity.
2. ~Grou 2
The events in Group 2 include:
a. The inadvertent closure of the main steam isolationvalve.
PCY: pes/IIOBB-24/27/84
b. The loss of an auxiliary power transformer.
c. The break of a main steam line outside thecontainment.
d. The failure in the open position of the steampressure controller.
NINE HILE POINT 2 FSAR
These are events for which the concern is either the bypass ofthe main steamline isolation function due to low steamlfnepressure by the nuclear steam supply shutoff system (NS ) inthe "RUN" mode or the loss of the position scram function ofthe HSIVs in the "RUN" mode. Only the isolation fbnction thatshould result whenever the turbine-inlet steamline Pressuredrops below the (analysis) setpoint level of approximately )20psig is of concern. Ko other isolation functions of the NSare impacted by the potential mode switch misoperations.
a.
b.
The analysis of the HSIV closure event in Chapter 15 doestake credit for the scram initiated from limit switchesof the HSIV while the mode switch is in the "RUN" mode.Potential mode switch misoperation could cause this scramfunction to be bypassed while the mode. switch is in the
'RUN"position. However, this bypass would beannunciated in the control room. The operatingprocedures would require corrective action since thetechnical specification requirement that all four-channels for the HSIV-closure trip function be operablein the "RUN: mode would be violated. Depending upon thenumber of inoperable channels, the affected channels andat least one trip system of'the reactor protection system(RPS) would have to be placed in the tripped conditionwithin one hour. If both RPS trip systems were affected,the plant would have to. be placed in the "STARTUP"condition'ithin 6 hours.
The consequences of the auxiliary power, as analyzed inChapter 15, are also not affected by any mode switchmisoperation. The scram and isolation that occur atabout 2 seconds (or later) are a direct result of the
'oss of power to the RPS motor-generator sets and thesubsequent disconnection of all power to the loads on theRPS bus.
Ce The analysis of the main steamline break outside of thecontainment does not take credit either for the lowsteamline isolation signal that would probably resultfrom low steamline pressure or for the scram from HSIVclosure. In this analysis, the event is initiated at theLevel 3 scram to start out with a minimum inventory. Atabout.0.5 seconds into the event the isolation is assumedto be initiated because of high steamline flow. Althoughthis is not addressed in the analysis, a level-8high-water turbine trip would be expected due to suddendepressurization.
PCY:pes/llOBB-34/27/84
NINE NILE POINT 2 FSAR
d. Failure of the steam pressure controller in the openposition would result in a level-8 high-water. levelturbine trip, which would initiate a scram and a.recirculation pump trip. Further depressurization wouldbe limited to the capacity of the turbine bypa'ss. Sincean annunciation in the control room would have alerted tothe bypass of the isolation function, the operator wouldbe prepared to actuate HSIV closure manually should thisevent occur.
Conclusions from these evaluations are that all misoperationsof the mode switch are detectable. by one or more of thefollowing means.
a. The operator would be imnediately aware of a problem'because of the annunciation of bypasses that should not
. exist for the given postion of the mode switch. All modeswitch misoperations that, might impact the severity ofconsequences of transients and accidents analyzed inChapter 15 are in this category; Hence, the probability.of,a transient occuring be'fore the operator 'takes .
corrective action would be extremely low.
b. The operator would be iranediately aware of a problem inthe RPS because of scrams or half scrams, which are alsoannunciated.
c. The remaining modes of mode switch misoperation would bedetected during the weekly channel functional tests ofthe NMS channel inputs to the RPS. If these tests wereperformed prior to the power increase and after thetransfer of the mode switch to the "STARTUP" position,the IRM channel functional tests would detect thefailures because no half scram would result.
PCY:pes/110BB-44/27/84
Nine Mile Point Unit 2 FSAR
QUESTION F421.28 (7.3)
onse to the concerns addressed by IEProvide a detailed response o
M h 13 1980 FoControls) issued to operating reactors Mare-e i ment, which does not remain nall safety-related-equ p t provide adequateemergency mode follow gowi n an ESF rese, pf h piece ofge chan e of state o eac
ro osed corrective ac monsequipment or p p in to its normal operationalchanges (e.g., equipment return ng ostatus).RESPONSE
See revised Section 7.3.2.1.2.2 1.
CCS RHR, NSSS) documents currentA review of ESF system (EM984 for Nine Mile Point - Unit
an ESF system reset control actionf IE B ll i 8o-06(
)'he
idance oNMP2'utomati'c depressurization systems
valve to .its close dtrois return eich ADS safety/relief,Th deliberate operator action clos'ing eposition. is e
N R, and U torelief''alves B22-F013 C, H, K, M,t. inadvertent reactor depressurization xs
e tion to IE 80-06 compliance.the idance in-Besides this exception, no deviation from e gu
dicated in IE Bulletin 80-06 was found.
RCIC (not considered an ESF) was revieweiewed andIn addition, noith the guidance of IEfound to be in conformance wi
Bulletin 80-06.
Amendment 10 QEcR F421.28-1 April 1984
Nine Mile Point Unit 2 FSAR
QUESTION F421.34 (7.4)
Section 7.4.1.4 of the FSAR provides information on theRemote Shutdown System (RSS). Attachment 1 provides theinstrumentation and Control Systems Branch (ICSB) guidancefor remote shutdown capability. The attachment providesguidance for meeting the requirements of GDC 19. Providesupplemental information to identify the extent that thedesign of the RSS at Nine Mile Point - Unit 2 conforms tothe guidance provided . in Attachment 1. Include thefollowing information in your discussion using drawings asappropriate:
a) Design criteria for the -remote control station equipmentincluding the 'transfer switches and separationrequirements for redundant functions.
b) Discuss the separation arrangement between safetyrelated and nonsafety-related instrumentation andcontrols on the auxiliary shutdown panel.
c) Location of transfer switches and the remote controlstations.
. d) Description of isolation, 'eparation andtransfer/override provisions. This should include thedesign basis for, preventing electrical interactionbetween the control room and remote shutdown equipment.
e) Description of the administrative and procedural controlfeatures to both restrict and to assure access, whennecessary, to the displa'ys and controls located outsidethe control room.
f) Description of any communication systems required tocoordinate operator actions, including redundancy andseparation.
g) Means for ensuring . that cold shutdown can beaccomplished.
h) Descriptioncontrol orcontrol.
of control room annunciation of remoteoverride status of devices under local
Discuss the proposed start-up test program todemonstrate remote shutdown capability in accordancewith the guidance provided in R.G. 1.68.2.
Amendment, 10 QER F421-34-1 April 1984
Nine Mile Point Unit 2 FSAR
j) Discuss the testing to be performed during plantoperation to verify the capability of maintaining theplant in a safe shutdown condition from outside thecontrol room.
k) Discus s the equipment c1 assi fication using theguidelines contained in FSAR Table 3.2-1.
RESPONSE
The response to Items a, b, c, and d is as follows:
Unit, 2 compliance with the guidance contained in Attach-ment 1 is escribed below:
1. The remote shutdown panel (RSP) is designed toachieve and maintain hot shutdown in the event thecontrol room is inaccessible. This is achieved bythe use of redundant, safety grade instrumentation~identical .(in. most all cases) to that used: in the ~~gj
A'ontrolroom. Additionally, some nonsafety-'relatedindicators and recorders are provided for operationuse.
2. See, Item 1.
3. No jumping, rewiring, circuit disconnection, ormanual action (in locations. other than the RSP) isused to achieve the desired shutdown condition.
4. The design of the RSP is such that cold shutdown isachieved using safety grade, redundantinstrumentation.
5. Loss of offsite power will not negate shutdowncapability since power is supplied by reliablesafety grade power sources.
6.
7.
Transfer of control to the RSP does not disable anyESF function gr change, the o crating status o anyequipment. 7 g PR R.s'wGU1C a r
The acces the rem e shutdown room iscontrolled at all times and the transfer switchesare the lockable type. See response to Item ebelow.
April 1984Q&R F421.34-2
8 ~ Design of the RSP is under evaluation forconformance to the requirements of Appendix R to10CFRSO.
'I
Amendment 10
~<SP~72 EEEAIMOP + M~PC ~<R~PCC OCC .
CC CCOR M+MCIOIOECMCCPE EEOC- —.CCE C E —EE--.E+e Can>OI/eel» rOi~~C ~~EEOPTPE RECCO
EO >T E CO CEO C C C O
COO�
5W)7C~
MO ICE ERE E EECCCEPPCC M WEMccastro l/g tlg (yew
EBS ~ R' 'ni ~<
~~i~d7
~ eo~tvoj/Yt 4, PyOVN
IZC'SFoEPlgO'. sacif
z2Z~FMM@s&8awd~ S
CECCCCE E EC~~2322L ~ECN~ EoC'CE
CO LZCo~—D~W OEICOCE .OE CEEI
y~r~&Zo FaZ .
PME ZS~ ~1M~Na eo~~~ Pl ceEs~
I aE-PEOCIOEOEIO 'CC OCCOCCOC PCCIE.
.au.C~C<CN7 ~R~~ C)PE~ieg~n~~gUK i~~A~nr W]n/
- ./4>2&hSg OOu)A'..
AJ.. 4~~&suing ~e, .~ PCW4k $ 4IA4 CLCA~All&lfJ
<paco'k06. ~
Nine Mile Point Unit 2 FSAR
e. Access to the remote shutdown system controls will becontrolled by the plant security system. Access will berestricted as with other vital areas. In the event ofthe failure of the card reader, access will be possibleby use of metal keys. Additionally, key lock switchesrequiring the use of metal keys are utilized for paneltransfer/override functions. These keys will beadministratively controlled according to key controlprocedures and readily available to both the ControlRoom Operator and the Shift Supervisor in the event of acontrol room evacuation.
Use of communications to coordinate operator actions isnot required as all functions to safely shut down theplant can be performed independently from either thecontrol room or the remote shutdown system controls.
g. A description of how cold shutdown is achieved utilizingthe -remote shutdown panel is contained in Section7.4.1.4.
h. A description of control room annunciation when transferswitches are changed 'o the emergency position iscontained in Section 7.4.1.4.
1
A separate startup test procedure, as dyscribed in testabstracts, Table 14.2, will be performed to demonstratethe capability of the remote shutdown system to safelyshut down the plant within guidelines provided by Reg.Guide 1.68.2.
Instrumentation and controls associated with the remoteshutdown system shall be calibrated and functionallyverified by surveillance testing as required intechnical specifications. Remote shutdown system designis such that functional. testing of systems verifies theoperational capability to provide remote shutdown.Additionally, periodic testing of the transfer switcheswill be performed to verify control functions.
k. See revised Table 3.2-1.
Amendment 10 Q&R F421.34-3 April 1984
Nine Mile Point Unit 2 FSAR
421.34 ATTACHMENT 1ICSB GUIDANCE FOR THE INTERPRETATION OF GENERAI DESIGN
CRITERIA 19 CONCERNING RE UIREMENTSFOR REMOTE SHUTDOWN STATIONS
A. BACKGROUND
GDC 19 requires that equipment at appropriate locationsoutside the control room be provided to achieve a safeshutdown of the reactor. Recent reviews of remoteshutdown station designs have demonstrated that, somedesigns cannot accommodate ~ a single failure inaccordance with the guidance of SRP Section 7.4{Interpregation of GDC-19). The following providessupplemental guidance for the implementation of therequirements of GDC-19 concerning remote . shutdownstations. Requirements for remote .shutdown capabilityfollowing a fire are detailed in Appendix R to 10CFRSO:It should be noted that although GDC 19 and Appendix Rrequirements are complementary, the potential'xiststhat modifications to bring a design into conformancewith GDC 19 will violate Appendix R criteria and viceversa. For example, remote manual devices for a seconddivision of instrumentation and controls added tosatisfy single failure requirements would not beacceptable if the added devices were located in the samefire area as existing transfer switches in the redundantdivision. In addition, transfer switches added toisolate the remote shutdown equipment from the controlroom fire area would not be acceptable if they disableESF actuation; unless this is done in accordance withItem B6 below. The acceptability of remote shutdownstation designs given a fire is determined by theAuxiliary Systems Branch (ASB) as outlined inSection 9.S.1 of the SRP.
B. ICSB GUIDANCE
To Meet GDC-19 As Inte reted In SRP Section 7.4
1) The design should provide redundant safety gradecapability to achieve and maintain hot shutdownfrom a location or locations remote from thecontrol room, assuming ,no ~ fire damage to anyrequired systems and equipment and assuming noaccident has occurred. The remote shutdown stationequipment should be . capable of maintainingfunctional operability under all service conditionspostulated to occur (including abnormalenvironments such as loss of ventilation), but need
Amendment 10 'GR F421.34-4 ~ April 1984
Nine Mile Point Unit 2 FSAR
not be environmentally qualified for accidentconditions unless envi ronmental qua lification isrequired for reasons other than remote shutdown.The remote shutdown station equipment, includingindicators, should be seismically qualified.
2) Redundant instrumentation (indicators) should beprovided to display to the operator(s) at theremote shutdown location(s) those parameters whichare relied upon to achieve and verify that a safeshutdown condition has been attained.
3) Credit may be taken for manual actions (exclusiveof continuous control) of systems from locationsthat are reasonably accessible from the RemoteShutdown Stations. Credit may not be taken formanual actions involving 5umpering, rewiring, ordisconnecting circuits.The design should provide redundant safety gradecapability for. attaining subsequent cold ,shutdownthrough the use of suitable procedures.
5) Loss of offsite power should not negate shutdowncapability from the remote shutdown stations. Thedesign and procedures should be such that
following'ctivationof control from the remote;shutdownlocation, a loss of offsite power will not resultin subsequent overloading of essential buses or thediesel generator.= Manual restoration of power toshutdown loads i~ acceptable provided thatsufficient information is available such that itcan be performed in a safe manner.
6) .. The . design should be such that if manual transferof control to the remote location(s) disables anyautomatic actuation of ESF equipment, thisequipment can be manually placed in service fromthe remote shutdown station(s). Transfer to theremote location(s) should not change the operatingstatus of equipment.
Where either access to the remote shutdownstation( s) or the operation of equipment at thestation(s) is dependen't upon the use of keys (e.g.,key lock switches) access to these keys shall beadministratively controlled and shall not beprecluded by the event necessitating evacuation ofthe contxol room.
Amendment 10 QEcR F421.34-5 April 1984
Nine Mile Point Unit 2 FSAR
8) The design should comply with the requirements ofAppendix R to 10 CFR 50.
Amendment 10 Q&R F421. 34-6 April 1984
Nine Mile Point Unit 2 FSAR
QUESTION F421.36 (7.5)The NRC staff has recently issued Revision 2 to RegulatoryGuide 1.97, "Instrumentation for Light-Mater-Cooled NuclearPower Plants to Assess Plant and Environs Conditions Duringand Following an Accident" via Supplement 1 to NUREG-0737.This Reg. Guide revi sion re flects a number of ma jor changesin post-accident instrumentation. Supplement 1 toNUREG-0737 includes specific Reg. Guide 1.97 implementationrequirements for plants in the operating license reviewstage.
Provide a description of how the Nine Mile Point Unit 2design conforms to the provisions of Reg. Guide 1.97,Revision 2. This description should be in the form of atable that includes the following information for each TypeA, B, C, D, E variable shown in Regulatory Guide 1.97:
(1) instrument range
(2) environmental qualification (as stipulated in guide orstate criteria)
(3) seismic qualification (as stipulated in guide or statecriteria)
(4) quality assurance (as stipulated in guide or statecriteria)
(5) redundancy and sensor(s) location(s)(6) power supply (e.g., Class 1E, non-Class lE, battery
backed)
(7) location of display (e.g., control room board, SPDS,chemical laboratory
Deviations from the guidance in Reg.'uide 1.97 should beexplicitly shown, and supporting justification oralternatives should be presented.
RESPON
J«Ar «~d r««, Ii LC f V ~ iJ« ~P ~ e Q i/r
> Ia'f
1.121.131.141.151.161.181.191.20
1.211. 221.241.251.26
1.28
1.291. 30
l. 311.32
1.33
1.34
1.35
1.361.37
1. 391. 401.41
1.42
Amendment 9 QEcR F421.36-1 March 1984
chl217718fqr9ae 02/01/84 112
rhscf A . CHEC qudsrtotc vol.367
glotC 2D ttttttddh
Gf ttco To Ht4thER
Ph phot frdR
ptschIPtfoH
R.G. I.CIT REV 3phhhotrrfR
SEIISOR yyhc IFIch7toN 9 uhclrv Potttf R Pt spell PhSSvhhttCE Supply
CCRSSIC Cttnttttt41E S
Big DIf3PotttgR IttIG
Fltt> lfrfl.stRhrfhh p
RH6 ffuk g,yg. 8 't It.
flhSSIPICht H lochrtoH t '24tsrR ~ RRHS SE54CIC'
CoRE;4 5 I25$ Pst'2 Pgg.
<I+ . I Ct- tissu> PtdR y6I,II
P608
g hto If
PS'dfts
24t1E tPRN0 Pcox EEVER. B g <
c5I Nnozh tcteN
Sdc RC6 tttG
C5I N00I4 tlta. II Fluk ECVEL
cp& oc. RodPostltotl 87
cohf +i ~ I ktd cPS ~ QE5 I gg
utt rtt Ohhttt Cl
MES,IfE5'CRHM'"
COO~ If
ooo If Poof
paos ~
2 Z Sc EC. r I3 Rg21» Holt v J9
RV cooChttrcottc ~ B3
RthcroR ICESSEL
atrfl -A BCI a.~ C
3-'ttlr
I
Rr dtpc ~ ~ ~' ~«««~04rI 2304$ - ttso Cr . y<5
ltott~lt ~ Cp
otv S
ZZSC tf l.TABun VVg
REhcroR rESSEC
Cfrtk -S0 tt
R2 ocod ~ ttclfc cottfM1) 534.60- v3<6< 'E5 Va 5
rplv a PCOI g
dtIA Coht
rib 'TftopfhhTVRE
zzsctI PT6 4
I322 ttocxh
REhcroR VET5EC
PEESSoef «RRk dcOG + ~ ~
esto ctttf<+)j 0 1500 I SI6', /c~ 0(v I P64 I
ZZSc V PT6Bpu- NO6ZB
RfhcfoR vEssctPOES 5 OE'f' s6L.
RS ha,ddcsfc cctttttrJ O-ISoo Pst6 V+~ /~5
IE= ' Wll'X-- P6trt—
'hcf5 oF ICI
$ (OLC t D uoettl
DE~to go HrwhtR
~ ~
Phthe Ert4
ptScg(4 rfOH
R.G ~ (i%5 RLV )phkhmrrcR
vhh>A((IE Cchss(ich(NH
phd(,E A . ( lC C(utsrNN r(44)L)
SEH5OR OVAL(F(chTI4s
LOCI(THN! 5uSVR, l'AHS StsWc tuwtoHtH(A
PuhurV PawER b!SPSAPASSOAAACE Soppc
3'chrsurchnwrLochvora)
SOfaS
zchsS4PT zFI plv OLpgtssuRE 8 7q,. Ry QLob I
<Stc Co~r r) D '< . ~'< I(E S b«< P 6DIt''cNs c Pf x8 D 4'Y(uELL
PRE)SORE 8 87 6Rx hto4jSEc coum D-(So: ps b
I ;..)ES: I .4 V~5 p(v z PS%8
Zc&$ 4 P f 7A . 5PPPRE5$ !ouCuhrcdtR PRISS'A 8 7 C,
Rr ALOG ~ y,'stc cou~>) d ISD,~I+ D(V E, Pao I
rr
P
'rr'
~'
~c
SEE Hor8 g DRVtoELL SvtcP
LEVEL 88
cou™rh(N rht Nrltssuhf ~h
p g 58'arpltsswucNANbtA PRtss b 87 gr
4) ga oG ' I
(Stc'oarct) o ISo.pslb
gt gtoo((CC cour~r) -5.rOOC PSIG
)f5 '-. f'ES
r
~ .q r
o(v z PUB.
b(VI Paol
aced) g prg8 plwlhaVcourh(u~tsr
4 5 E 8896..
Ro tLPG ~ - ~
„'crccourarj -5 (e <5 Pyo ~; fES' QE5Pho(g
b I!Iz g
ZA8$ V acV is@~ (3$ PRiWARYcourhtua4tu vtV 8 (DW 5
A ou Ay, H(A Yzs kg oiv) (48$ (
xghs 4 acV I3L (st Par+ha YcourhfvHruf %tv
A5$
cc 4 NO I I PR(NAg VCourhlmtur VLV
8/DQ(
g(h I H(A~ ~
I Pl
':.t'FS 'yES D!Vg
X o(biPV53
4NO I r TV r ~ PcsCourei~ucur VLV 8(D, ~
OZ egrrothrrou H(h ) s(AI
. t'ES pto+z
P S(13
PACEZ oF IQ
J ~
Thd<d /3 . CttlC I/Otdt»tl eS/.dc)
Su tC SD trttr dtR
Frf Nto To ttrtttttR
SC»$ /f SOV AT iC 1CRC
32IIJ 33hJ 3 IA F'35 A ~
toht B r~ d LFIg B
Ph thoI BTCR
OIScOIPrtOH
PgttJthcotJJTA ItttrttotfXSachflltl ~CNIS
R-G ii%7 Rt~ 3Pht hlJttft'R
Vhltttt3IE tlhSSIFChftOII
8/D C I.
StHSOR
It/h At/A
LocllftON I 2A STR ghdd SCSIJIIC rHJJtttONthfh
WALIFICATtoht
I/ES
potttER DISplh3'SStthhttdt
SOPPC Vc 4hf5 IFrcrt tttttdoft 3
DIV1 P&3
Hd fgSJ
Tcr«s soV Arrd tt tCdD /thttrthRY3gdr 33d; 3lt; Std- COAtfhtOrttrrfdl///8 C3hr8 z5oc,AS OH .CH5 B/tt cx..
Atlh
4
ydfDIVX f~5
O Irr4 SAV rk rto PRIOJh
C oef htitttrrBAJT
htroAI ~cPS BIDE I,J
+/O'T..;. ylv5 fdf/3
P/tttrthgf4 V lar Cott fhIAJBIfit+
-cpSH/A" DIVZ
c Pttwtlo V4 JJIOV Io IOT lll lt 8/0 ~ f4
JJJ 8/SOJX Fdd On FOIS 25CAIIftOH -CS//
. j'RES'::;. " 'AS'
xcfco 0 0o Hov tow I
tsr - O
+pops oo I
PAJJJI hh YCOA fhtAJrrt4t< 8/Dg,Sfot hrtotl ~ C5g,
ht/g J '. /I/A ~ „It'" .. ll'g5 . QES DIVf f501 n
,15tt + trOV ter l3I PI I"I+Cotvfgtt ot tlrf 8/l5 Jt IISO hftOH DER d I yy ...'tljy .."'':;... P'ZS:.;-"/rg5 g DIVi fBV3
adtR V t«rV Itrti l30 Ptttrthk'YtoAtfhNIJI&T 8/I5
P I ~ Jt „... At//lS DER
'..IfES ' QES DIVZ fe /3
2DFR tt ptov tool t34/ trtrt RvCO*fhttt4ttAt1
DFRBIO/I I r At/h
(At/A . "..'rES '. pc& ww+. f573 ~
phtd3 OF Ir/
~ ~
VBBCB R .. (HlC Il&ESP(dtl ttdlrdC)
SlufC SD N((r(dcR
BE~CO VO tttltddR
phdttrt EICR
dfSOFIPItrrl
R. 5 ~ I« 'I V Rfv 3phl hrtd VER
SEIISC(A I3vhc IFIC41(rH
vhdth(3IE cchsslFLht(rpt cochstddl j 5r(SVR ~ Fttttd 5ESI(ttc Fttv(vdrtd(vttt
g V4LIVV45 S((R 4((cf
C c 455 Idtot t(r(v
potdKRSo/PLV
ol5PIII V
Lech ortIFFIE 3
lvofCS
WOPR P r(OV tetr IVO PR(r(r(RVCd(uVh(II»FV< Slob >,
5 Lhr(au «OTIC
I ~
Pt/A -; VIA . yes otv + ff13
zdd pf(u(P(kCdushttlr(EPV BIOI. I/P Itl
PIIA 'I'I
PtlA''.. 5 ., y'Eg:.. JES
2PP(r V srv t(RI zeal PF(rtttdvcr&fh(err(Eu+ ~ 8( ~
Sdchodrt - PPI(dtvlR ( 'giA' ': ",'/Ef. -:: Z '
d(V R P8(I(f
zdr Sd PIOVRIB(8'SX-
Fd C5 AI8
V,Fr(S It lld(t 53II(9
Bdl Po 3XA,(tj
//tr(((RVCdr(lrlr(r(fII< Bld Rt,gsrLAOotd ltd(5
/R(uhRV
CruIAIPr(dent(V
alo rf,z sdcANrtt Pws
~ /I/4 VlR.( ~ rt
O(Vj Pboa
are ~ IE /Co%
rr 5 fItrlIAIIII~34,((4,54 I'n,eau»du Std l,5 sr Lhf(OIJ « Iles I ~
iHCS d rd ld(dd(3f,ttfSd CB P(t(MII YCeufhtrtrt EI(1 Std fR ~III(rII NC5 ldl/I
Ptc'S-:. III'
r .,Vlh '. ' I/gp'<5.
X DIVE
T btv Z Pays
i$AS~ SOV ICV,ICC,ICr ICjj /RtrthhvCruse((ur(ous
5SIOet I ~
I3$
xzpsrSdVIL5 Idd IBC IB5 PR(»r(Rcert/h&r(ENd
Slo(RS,R tr
IV/4 ..
Hs D' ~ SS/SSl
f<5 „T, DIV1 / yg
<~cs(tr( ta(((aa (lC I C
IVS, ICV5 IIOV I5 5, (51
ESI FOCVr POCB Pd(3Pe 3(I Fd rtr Fddo
dst PO C5
l(g(P(hRyCo@'Zhtt(rl ftt 1
55OLPS(otl « 'Ec$ Slog),'/c5' f pl(o]
~ „ Phcf I/ df IIV
~ ~
fhgly 1 . (Hle Optsrsdsl 4cl.lc)
5tsstC CD «ssaidtR
CC Isco To HssdhcR
plllds RfCA
pgSCdlpsS44I
R.C ~ Ir'I'I RCV 5phl hsssdftR
SEIISOR IOsshL Ipsch old0
55CS<HdISs28 AB sfo PA+hgyCddrfhS«AC441
~'""Fdec. ~7+ ~s~h~~ -SC58 lo IIc
Cut SSIF4:hfsdu lo Chf»H s 5C5«SC P«SSIROSSghfSS
IHIA~: 'f55; PES
2L«SS u5OV 45~ sS57 PRS«IaafCdc fhSISFI Clsf 8loC5 'Pl IVI/ I
I,Issld -;;' ~.YES '-" - y-5
zms VSov I52I s5C. PRIFIhsfv r ~
cpdrfAsdras CHTc.«s PZ
~ '
2WSS v IloVHxlxoS Phs«duLYC
deaf
hssrsss Cssf «ii '".":,".-;.ill. '"s.jEg822 POI't <Sda hfsou
ehcsfv posvgR45 S sshhstC K $0 PPL
Cdhf 5SFSdl ps«
OISPIh tLdchf»sIHefts 3
o«x . P6ol
DIV I ft53
Dlvt PC)5
OsvS
pCox
HofR5
RdsSS II Hsdvlsl
B22 ~ pol C
Rs+IIAVcdafh idsssS tuf<Sdchfsdel PISS
244$5d IIVVvps,g,c, p pRI«4Rr Idio:Wps"'""'-Cpstsfhsum gssf 8soa z
D iso sffsdu -HISS'jfs.'fEgr
RPSosvg
Dlvz PROX
IISS RNVV4h,g g,P RsddhAycosssf ksds«siss F Blogf
822- FOXZ AsII,C 0 CSdLhfldu SSI5$IVI' rvIisl ':; ';"JEST',IFE5 RPS
osvX
Ca fds« 4«+c5l- J'oo4h,h c D E ssdLhfsdu 8sop ulh I«IR ' 'AS: t6o~ lo
Cy %40 dfSI dl44 ~ r'Lsd RSSdISse4' 'dd,fh 4 dscuf Slo5 ISSS-Fd2o XSochfsdu -Rc5
Sd fdtS m~ r S PRIINhR YdtC 4 Ssrs Cd*fhsudsfh1 Blo
Fd gsdchfsdss Rc5 5zt
HII} I
Hy} . ~... I„QES '.:. "- QE5 '
IHIP''";,'fES;:..'FES ow z.PcoZ
~II Phcf 5 of lf
VIIRSR R, ( HIC .OIEIS<ION 4ZIVJC)
Sloe c 5 D ttvtEbbR
OR&Co zo ttttdhbR
sttH51 Ho lh ashhvht zshr zch, xth,30h 3thcd to4',tt3
'hbhot gtbR
OISCIIFrtoN
PRIPI hR E/
Cotvfrtlltthbot15SOCWTIOtf ~RIIS
R.G ~ lr%~ RCV 3phhhotrrbR SgttSOR
vhh«eE glh5stptchoott Coctt ttoN E ygpSTR ghgb
OVRC IFIChttoN
$ 8544IC brtlnkootbtftg
Q yhsttV potat RRhSSVRhttCR SVFFECV
C 4 855 Its to Oorr
OI5PSh V
Cocher/HPTR 3
HotES
btz-FOCWhr FOthh,FOV hFetlfh,rotrh tsorErg ForthFtdfo r Fos flitFo sdh FoslhFofth'rd ZI'
oob'LHS
OVSOV Ib tC»58E8ggsvhrb 558 g C 8To83 538; 3TI5 ~ +o8$Otbr ltz
Its Foott8 c Folsb toEErt,c
FO4Sbisr Fddb FOIEthrrdrfb'FIOS8; Afro/Foboblrottb'ootgshs tt Itcv I6otl6/
PRtorhRV,cotv vhtstol Rbrt
5Sochttoto -Rlls
PhtNH4 fcoil thEHFEfdf
ost ghS
B/OTTz ~
l3/ou, I,
Ir/h
N/A
H/h
/VIR
r IE
Ve'5 'rES
~ E
yES
. IIFS
e/,ot
'DIVg
'tvl
I6 3 Ftt trrl8goEVfhttVtobolf
SAS6tIOgz
~ lt//3 " DIVZ
zSCrd <osoV 5ACtf t Pdogh
iolhhcool fhttvolb+1 «OVzsochttott SI-5 V lt ~ . Pr/P3'"'. '„'.',(E.5'. ', 'ES Otv l P6ol
g5CSE 4/LOV 58 . PR™hRVCdtrthihotblrl alovzCIII -Foo68 zSog.olttoN SI5
- I/O .: ',"IVjA'4'c.',fES:. f6'$
Sg HoV ttz i~A pR'tuhRV ~ ~ ~ ~: ' "'.''"."aE
Cdarhttrot/EHT g/o g ', /v//3 . Rt/R "..-"'=.. ~-.„YE>;" ".'p'ES.'- . X D v Isv 33 Fo ottr Fo f0 zsozh frost 8tcS TV I ~
RsvcS sl trtovtox@33rFOO(
PRttEI hRVCoo Ihtu<bstf B/ov/g i... ? It/R j /v/R "':.'ll'lc'5, .'' QE5zsocpf lot/ wcS
OIV 1 f6og,
Oiohdrlv«vvcoEHIhvo»stFW~IILV CPO~T cJ
QIEII1
It.o. a48" /A/ ltotlHR
phbR6 op IsF
sndi'E A . C Hlc.(lufsrloH vfi.sc)
S(u(C SD Hurg(R
bf.p,(O xO Alrh(R
fhfhe EtcR
p(scAIPHSN
u L OfRwlhR 7 Co oihu +
bhRHh Spfcthulh
R.G ~ I,91 R(V 5Phkh&ESER
VhhlAE(E ECHSSIFIChtHH
SEHSOR
LOCIItHNlisa SVR, RAHC
H.O. i IS
Ouh L IF(CA ZloH
sfsMIC fHINtoRCHth
guhiityhssuhhHCE
cihssIROIIuH
POUER OIsf(h ySuffiy
«utf 3
per-IE
H47f5
HIA CORESEH PER A1l(RE
f SIOSE I I EEA~R f ~A tSVSZEw -PRESSORE L 0
$ EE HOTC I I
SEE «4 C f Iushhy
hREII RAOIhttutl C (s ~'. 35 ~ ~
l
GAIA
HIA
phyllLL Pht}ll/Qlrps LEVEL
ZC~SWL7 IIA SufPR 5p04L &htfL LEVEL g 7 ~ $ ( fc ~~o) I$7 2o2.F ...'l (+.4 fg 5
6pius fbo l lg
~C~5 g(.7 II8 suPPRfss lou kv gioC ~ .. *
pco(. (uhtEIt Lf EL 4 7~- .f ( fc „~j H7 . gotff'; ti'gf. yf.5hhh R 67
Dip X p~g
zcfhS 6Lf (lA . SufPRCSSioH Ra gLOC: . ~
C7C ~ " (Sfc cornet) 'Ilk >(7 F7 ' fESl'I'E'Nb)
oiv I Pcol lW
xcRSWLt 9B SufPRhsslo> mRLOC - .
Pdoc cuhtER Lcv c, 7$ '.. (sfc
curtest
IQg, 7(7, Fl, .-.(I gg., "E 6
Z Divs ~ lg
SEE NoTE IS OhytufL<PRfssuRE
' ~ lt
SCE eotf (LCf otf IL
Itfhctoh coochutSystcfh PRfssuRE CQ
~ I Phgf 7 oF ICI
Thdt'E 1 . CHRC IItrdsttttt 4hl 36)
Sotdc sD wrvetR
g.g -iipo fO HtrhTR
PRRAPt ErLR
pgscgtPffolt
R.G. I.tIT Rdv 3PAR hat ttR
vhhthdtE ELASSiFcnnoH
sEHSDR
LOChfttH! OusTR, RAHC
EPOAL Ifich TtoN
5R5ot tC gHVikOttSHTA
POtrf IL DISPth thssvhhttCfCaASStacenwt Loch
H@TE3
HpffS
5EF uofE t7 PRirtha Vcpufh tv+
Etiam
PRRSStrRE l7
coafhlurt a fzc"5 + ttzt CA HVDRooEH I'. II'. ~coaccvfhh ftoH~ A
gx iILDG .
yoattt hafelt O-3o.Vi'-: '.,'f65': .= 'ftS Did I Pcol
@Lots'zT Cd couthlurtcut*VDROC E'H ' llgt
'Rh 8
Rf hLO& ~ ', ~, ~ ~
Sortii tse O'O'. 0-.3'.,fj '! '::t(k~t - I 'ES X 'D«z Peea
~S g AZTRIA coufhtuhigHTOk YgEhl C IXa. ~
A f ~
.DtV I PCoi
zc~sERrr ~ISO )a t'tiLrhl
tltilttoH 8'0-id'" "- /f5 Dt~ <
Pea�'RHS-
chg ITo coufhtveovEPF L ttftt TRh piohcftvtff
>R>S-CAa I o EFFt.vfuIthotohCftVITY
zfcts-FT gAtg . Pihttt FEED ahfcFLoto tq 8HDOIA 8
01
pth+ Sfhctt .XSotoPlCT'EHCLOSOAE o-t .Ios" tjg ':c~J, 'Qp-. 'g5
- SSOTOP IC.;*2 ." mRd Dpfl' S:"7 'i q'.7VO"FLooR 'O ~ io 'ACI/gc r; ' ~
Ttthd SLOE:
Crhcii7 . ':: IVI7: oo
ttotritE p gq<tePS7
kov-tE P gsglrPS)
Ilotl~lf fgo
-~
sfohhCE ca c vt. l7 ~PI 8
XRttS OFT f4R SoPPRESStoCHhriaEPL SPPIA V
EIIDFII FLo
9 ~ .. g T„lot o -Woo lt4PI L "~.',
Rx dLDC.SFc coitfoLTQ O 050 CPM "-'IPtp'5
. 'C5 Dill I PCDI
i~ r
h ISE PRAY O3b.lSD R 8
2Ra ELOO.Itic ccrc TN T)I
I g Ditt R Pfol
phof g op lff
thdd A . (HRC OkfsrISH 4hladc)
gOIEC SD wtrhhfR
Of~CO 5O NrrahfR
Phfhsl ESCR
pfSC RltrrfrH
R-fa ~ log1 REV 3phf hntr icR
rlthrh@E fch5slptchtrrH
sEH5OR
COCHVIPH a ~HS1R, RRH6
OarrhC IPICh7IPH
SfSlrrttC EHtrrrOHCHIS
PuhllrVhSSarhhHCE
C llISS IPlahtraH
PotaaER PISPCh uSuPPCaf
Nrrt3
HofES
SEE HorE IB PRYurf aLPRESSPRE re
Sff Horf Ig StrPPRESSIPH pnoC.OhrER LEVEL pg
Rrq
Sf tt crh f+,fghrrrh SOPPRESSIOpl PRaoL
IOASER vEPhp» A D 6aL ~
5pPPCCSSlnu
Proc. ~~ 50 fISO f" ;/to'5: . Ijgg D V] P6o
Cnrrcurf 618pCHd fgd>top SPP R jsstdll POOLuahrf'R tEMP ~B D bb
SrephfssrsHPOOI. 5o- x5OotrI
Pfg IDlv 2 Pvgs co
xcptsfrf lot rrlrfrsra apg pRlaarELLtcpaP -A DSR.,
ORWELL o-Ooo'P' CES, QEs Z Ptv I Pe13 zp
CCSISE rfltf rrrra gratr lsu. PRV IOECL IIrnaOSD7b,
tEpaP -BORVtaIBCL ~
~'q+",l pgaa DIV Xf515'RHS
FFr 63IS PRVrrEC
HEPIPER Floao -A 08aa.
xRHS VF1'38 . ORvr ELL SPROV
HthofR paaaraa B DBb.
R» EeocIlfc co+Star) p %50 QpHI
Rs dao&CSEC Carrrrtat7J 0 355O 4 PM 'S
PIV I P6o l
OIVZ P6c I
5df HO1EIg'ff
Hrrf Ig
raahru s 1 kaNcSsns artraOu yharaE p gCfhltitot COurhol,
T
Sv V+ t 7 fso —sr 3 prr»Rr SlrprrlhCCrfp VhaVE
sDtoac.
hCOar Srl CSEHSor nrtrhra Pr PE
IsSW-
Plv I pha l4o
gsqS y P1 IBI Phr~lrrv slPslurp vkaarrh05 HfhoER
ADtob,
Rs Iaoo ~ i, ~ . ~~
(sfr caaar isa 1)(
0 x50 oSl~ "QES . AS OIP I P605
~I phut 9 of IV
thdd Fl t Hdc,((odpr~ Qclrdc)
5(otC 5D Nvnp(R
DE~CO tO NeH C(R
PhdhH EICR
p(Sc pIP ~pH
R.G. I.Q I Rav 3PhC herr rCR
SEHSOR ~ 'vhg.(FlchttpN Q.phurrhSSVRhnct
C in S5 IdolI+fr
PO~ER OlSP(h tSvffCY
op&3
l(dfR5vhh(hl3(E gshSSIFch&H Loc(ITAIHI 5u5tR ghgd
ps(I$ 4Prs3o all s3L lown v 5 fcplaice vnc.vo 0(0hoS rnrK Fi C ~
t» dsoc(SEC Cour' .-' > P5'+'
sshSE Prl((6 fh~n gpfg r R» dadahfuCF VasVE p(oi.' .- LSE, CN+Otr) 0 Z50f5(g"-Pop Hcnogk
SESNIC 'HVCogggol
X Dlv I P6o(
OIV C,
I
AS 5 Pla53 53O, 53$ +3< I~n f~ 'i!. (SEC Cpurxg O;.COO,Pfkl6r .gory..;,.-~~>80$ thuc FhggRc
I
r ~ ~ .
DIVA ]do(:. ~ ..'.CIr( etg
rh5(5
~rr~
tsC Horj IS
$('E ott IS
SEE uprE IS
5EE HorE gv
c CN5I I 5ÃtllSiOC onrph aCVgg.
5$ oc,ho+uC oupo'N gfII Vh(llPr Si rsvp n( V
(r ~
5 JC5 4 FT Iog.
ESI Ilo5 I
xcSII RFI to5
Exx-HO Sc
gC SC F Loop ' (Stc coHVHr) O" SOO(rP(r('''. -)gj~:
(IEC ennrHt) D AJD(Y'Pl.", +jy,.'"... 'gpss
X ~ olv I II(A
blV3 3(IA
XCSLS FTIOT
E'Elr H05(
zRIIS 4 FTIVA
Elx-Ho (5A
I.Pc 5 F(dos DI5.~ .''v d(oo ..~ . ~ r', "„;~,- .
SIK. cpN>r) or Iopo 6PM yf5i
(SEC coutntf O-g)DD O~
jgV] pll
"o vl
1RH5 5Ff l+di C
E(5 IIOI5Sic
ESL5 v F1'II3CWI -HOor
LPCZ
5C.C5 FLoe
P(6d,
P(7
g3 Cspo ' ~ ~
(sEc ) o- B.&+P< ..I(Z'g ~,: . )E'5
Rx dcod(sn i~~rfl o- S6 GPNI ~
y<>
oiv z P6ol
~X ~V I" P6OI
Phdt lOoF IV
Thtlt A (IttC flktSTIOII 4tlrlo)
5IIIEC tD wutttfR
ftt&to To NttthtR
FhthH EftR
ptsCAIPftrlf
R.G ~ I.QT Rtv 5Pht her rtR SENSOR OIIRLIFIchTIIH
LochftdH Ta 5TR ~ Chit« StSHIC tltvttttlfthrh
pohclfvhssohhIICE
C LhfS IRthottf
pottiERSuppcy
OISFLhI'ochftftl
NoftlHOft5
%«LSD Lf/O3C frI ~ hl OO I
SEE NofE ttSct
5LcS 5 TORR6E
<Alt LEVEL
RHR SVSTEPh
FLooI
tchs«IFichorl
pityI
Rft ELObL«tt Cotter) 0-IOOOO 6IIL X otv I f60I
gZ
ZRNS 0 TEI3A ~ ticehoccA oowtr p tOILE It HozTFI Tttop A
Rw SLO6cstc ccwfrtr) 0 -6OO F holt ~If Pool
RHR Itt r~cH httoth oofLET y 10l, Z
Eis hloXT8 TCptF 3Ra gLOb(Stc CANftttr) 0 600 F NrH IE lt60l
SSIOP g TE Sip ueLtrvo IIIAI rCNPTo ESF «f$fCH Dzl<
hrhftftf5 A
SctltN atLLBa 06 35m I30 F f'ES QES Dlv I p60l zo
ZSIIIP g TE lip ooL+'o tohft TtrtPTo ESF SrsrtH P2IIIcoAtp S 8
SctttN acaL8Lob 35 I30"F YES DID 0 P6O I
xsoIP 4 Pf I3A
Et1 Noo TFI
Cool IOS tttlfCR FIOtrTO Ese SV«rtlffcotrrootltf5 -A
Rs 8Lobistc cooo r) 0-lo,ooo bFFS yE5 pE'5 PIV I P i 23
ZSIuP < FT I3B
JVOO 78
COOL IPtb Oth fthm
To CS F S VSTEFh D225, 7.c HFOIEHrS -8
6R cooc,geo fohft R FaotoTo ESF SrsrCltf pzZC ~ 2.
5
Rx tcobIstc co tt r) o- lo,ooo &R" yES
~ ttSEL OEH.@Los O- l6O H'hI 'fES 9ES
Dill2 P4OI 13
DIV] PT5X ZII
68 cooc. e~sESP SVSTEIts P2ZQI Z
LOAIAd*cAITS owl fft
OI ftc btNtco6 0- 56o &Flh II ES OiVZ'lsZ
mstttp«I FT 535 ooTo ESF Srsrco« P2Z + t
P
ottftc tetrtao& o- 650 &PNI yES yES Dlv 3 ltl5z x'tl
Phot ]I oF IIF
jIIItc sp wuogtR
pt~tp 5 0 BIohtROtSCOIPII4II
R.Go lo91 Rtv 3phg hrtd
fthm
vhglhBIE tch55lpch&H
fngit Pl (Igc outsf»H vzl.56)
SEN50R Ovhg, Iflch7IPPI
LOCRTIIN 'INSTR ~ gh5I6 5t5PIIC dluutfOPIghlh
qvaclfv pooka a pl5pch tASSuRNCE Sul'pC
C 5 A55 IIIOIOoII CrchIIrftW
HofI5
IIISIIg S- gh,dc 5th,d dfl dtOI0 VhtulC LEVEL $ 13
Rhoah55EBL05. IOO 1o jap Lure+
2K +~ IE cootcrtROthouIC5
Rohoplb,6RJMJIoR fgor h IIDhHPth Pos eoH
Rr Bt06Cstc covlulr) sllh IIES QES T plv I PB70
ItutWRrp I8,6B BB oBCA ~ N
h P
D1 ter Ru ei00CStc coueaf) Prjh PES DIES PlvZ PB'si
5 fh 18$ o F'rod vSooted s
hV V 8E-I DZ5o., Zz g.vs< ~ oo I
o Isovoc ITS tuv l lot5 1,
zB~ SI Eyt lg sfhlus OF sr v P»Soutct 5 pt5b ~ I.Boffgtl cutttl f I
Zd VS t Suo OO
troa ro Oslo hoiS OIV ) Pt5L
5 TVS op Io5ouhcts p XSc,ISoffgtl'4rhdf Z
~ 7zdfsgsosooIB
0 lco voc pe AS Jlvz I PB5z
<Bf5 II E/g IB SoutcES ~ DZ5$ ,lsh ERl cuhtthf-s
agfsdsvsrosdtooo ru O tcoo hoPs blv z. PBSZ.
MS rF 5fodl'aSroRCCS- p>S.e.llh R CE
z BCS <Avcro?O.lco voe )ES pE> Z OVS
sfatus or 5Tpgr PtuSoogcCS pz54,hhffdRV Rg
sgOSrp 4+4zIOO ro OIOO IIrPI IFE5 OIVg PB5Z
P'/R 5rh'rus rl srodv I uSouR<ts ps5e, 1.lIPS voafAC,E -R
XTBsocf zA 0 ro Iso Yhc ITS IFc S' DIV I P85X.
$ 1IItus or SIOOV PuSoodcg5- Dz54.I 5 RREOf A
ZVSS top5<R 0 fo zco hhPS t'tvS II'g PIV I FIR
PACE ILop I+
rhEIE A (Nlc IIQESTI4II 4iteEC)
CIIIEC SD ecuechtk
DE~ED TD JllcehER
Phkhfl Efck
pgSCOIFT 4 V
E.G ~ lect1 REV 3phk hcvrrER
Vhkl NE EChSSIPChfceH
SEIISOR Oultc IFICRTI4II
gochrleht Sa 5rR, khah SESFIIC iT uckONENrh
Pda aa DISPIRITh5$ ukhNCE SQPPLV
c 4 41$ Ifccoowe LocheeTE 9
Itpfrs
SThfuS Ole Sfodr P»SeeRcef- 0>5/,
TIIQS VOI hot bzvttSFopsiS oro Icovhc yg5 yE 5 Dlv z. PE4IW
Cfhfuh OS Sfpef P»RMeRciS~ nz5lc
PS CQRREIIF 8Evessppsz8 o ro ecohecps
DIES
DIV Z NII
NIRSTRTQS OF Cfper Pb$ 4ORCES nz5c,
C V I ht'cExE3$ ERS I ~ dro rsd VAC g+S
JEST
TES5hhSI g5
514f QS OF $10ltl'P»SoukcCS- Dz544, x
C VEyggxth, 8 ct ro sooohecPS ygy lES DITe I OIA EC
TQT of 5TOE RSoeRCES D25II. Z sE35 Re 3 3 o 1»SO 'TS QE'5 PIV g TESSCLSS t5
Sr fe or 5SeekCE5- DLSp
V eZEJ$ CttsPI,B drfe 34oo he PS fE'5 lt'E5 gtV Z. PIPI ZC
NIRcuS ef 5T
TeehcCS'» DzeItI'V.Sa4t V rhhE
o ro l,tc Kv )ES Dlv I Pcs z5
IflR $ TO tu »F TOOlcES Dz5
VRV 5 CR RPIE
O~ IOOOSIQOR ol4$44
~r I See Feoccetcee L Fef relet
QES X Dtv I Pcs c z 1
$1 Tcc 4 $ TOS Fa~eFCCS- nz5
SIQORO ro AC ICV >ES TIES T Dlv z PsCT. z,5
Crltfu5 4F SfodrSeokcES oz54KV scut'cg cukRAIT
IOOO recce
ociftc PEEO t,pS QESO ~ Secs Heiewleec clear 41404
Z DIVt Pesz Zy
$ 1 OF$4ohcES- 025@. Z
V Socteh fhff oro WCKV YES DIII3 Ptt5a z5
PhCE I3oF If
thPCC 1 C yPC OOSSrrO> 4$ lipL)~ ~ ~ ~ ~ r ~
SPEC SD NvrrptR
Greco sp IrriolIFR
SFC yorE CS
Ph!hor ErfR,
olecplJ rroII
R.G ~ 49 I RSV 3PhlhleirFIL
SFHSOR
SSIPChPOII LOChtldH SaISSR ~ Rhyp
Srhrvs OF grP I,Sovrcf5-Il R oh hp5,
D 1rr pl
d Soo PiPo<lrla orrp
d I roo hopa ogr
r fv o LISovkcFS- Dzg„g.II V S CR cvRRSHS
IPuhc IFIch7loH Pp4EIL DlgpehphgSvhhyCE S„PP Pcaheslaroorrr Loch
yotE 3
I DlVQ PSSz,
HpfR5
Pb+hhy Cour uIoIhltA Rh hfdf
R $.
RnSPRElB D PW~~ r covrev>rvr"Rdh IehprhtroFI ~lb
HP
pRyrvELL . I -ID R/~„
DWSIELC l ID'(
lpga l fssd
SI'E borg SS SFcrurohhy convoy~Rh plhooH
POBO
SCC NorC30
SIC HotE 3g
VlthL IIPFARhplhtioH HoynnR5
El'FauChr ghplhr oHRfL shsPD FRore
h f
ec effNd E Sp FIOrC 3O jll0 Norr-IE
RhpNCoIIII>rfhdfhPrrCS
Fywdvve <hn,„ro „Ilhplohcrwtty
SCC AorC 5rP PICFCnCoLp p. II
3l 33I
@55 p - sPHLlol
ORS - Dooy
hcc>oc~arar wPhir hhr. CodahIIr ( IC'yco~rhAQArFIlr hgR
phpohe>ehr PiCRover AA
yoy'<E plSDR
IIoN~IC
phCE I4oF IrP
CsISS(F(Eb. 85 po~o~g,
ABOVE'5 F'R NR< QUES Tloral OZI 36 ra8CE A
4 couS]f 7$ o F j]<L. g. P'@hi >5
Pp t oi- 5
c.PRN- ERoDP 5
l-PRw - (Roof'
bPR~ - craved A
RPR~ - ch8u NEC 8
BERM - Ce8NNEl. C
)9I R< - cHAA@FL >BPRM - CW8eiVEL E
/PRE - CHANNEL f
C ZI cPR~'S)
~ . C ~~ I-PR+s3
C zy Lj g~'s)
6 XZ ~PJ'S 5)
C z I </'Re'sg
~Pe~'s)
C Z I LPEW 'Sg
Czz Lp8e's)
g P &$gA 55 Jvllbh TED V],'c UE 5 14hlbL fRou PgyTgog ~o~lrcgieg
C lRC~lTS.
3'. Hgg, PigPg]9-95', ]fgE PV>li ]48l E Ohl 5POQ OR RRDI8no4 ConPutE'R TEInrvi8LS
Ld cB r!~Ns pF fiNED pRov(DE 5oAn$ p Dl&rN. >40(cHrioA vn os pgtogg.
bbrR e8uCAt.bf'eta7CED TerO Cnm/ll,rgb,
~s, ii5 ~ plRd REFEFE+<E sS 8< 3 8D O'V < <+P +8 ccPF SuppsP7 /'COTE)
8~V INVERT (> o.o" REF<llE>cE, E'$ lire>H o'r87 Pb'57(F(cgglopl Fog Nov co: ogNHPQ
PRRAHEiER Nor prg-1JSc:PED oR vcr irongb'I
PER Ba'R'oC IotirioA'e'er R so/ ~oRd ~egad coc Pcpa ARE
T~ZfP'P GTlUF, C 4 I9 ERR CORE 8'FCHG Sf d F VWERNO P F+84(C
daAI 5'/DFg )9 THOLE (p0$ /ricO 885ED g po hl )PA I Q7 )PEV 2 l
~
~
7~ DRY™EI< Sv+PS mD~lt~RfP Vi8 8'trPPRESSiON POOL
LEVFL ~mStkvmE+TS C PBEAAETER C7a.,b ) 81'TER 8Q
yacc iDFH7
Pg, z o45
8. VPI'EW g8u6E g i= Sag TR uaE)tl ~ C D VFg gl) 8 f KRC'8LE 8. 7$
se- rRN Q su s s'u oo-si Aaas (»
Assets'rs)
II. PH RhaS7ER Sa~F bs .Pbna~c~EP
1x pBRB<E~E< 58ntE g5 pbRhmgfER E I~ $
IB- /JAP-< W~~ 8 8R< ~ eo~vH]~en~ uf'C RI~& r%HE S'4 PP REH(oA'oal SENT YES P 5 pg 5 crpsP 8ZcgoSP
7'ur
si DE (of' o~r be or EA'r) pnz. pi~ & rrSuK 5 HRE xsocdrEb.'+
a@7'fdA IF'.- . Ecc5 5pcTrau" Leuk X'5 jq g
54 PfRESS I@4 p004 )d. W.L.. X 5 ZOG
I 5~ PBRB]v)ETER 5&ATE 85 pAR8)ngTEg, 8 7 cr 6-
7 PARBME~FR cAmE f9s PPRHAETFR5 87,h E
ovERMi'PIN6 o F g8uGES Is EEPo(RED ~e m gZ7 jP t'
<8. p><~~~r« ~~~E as paRa~s~~w sea,6.
lt, I'RRRmkvFR'tol BpP~IcHSLz ~o ~~p-z,
~o- X~sziur S~~ RQreE pfggT5 g~rgglf pp gag ggggg
al- p~I'-a y rr<rgES H pr-S r~ r.IEa. op ep'c X
F'akawZ rZR saeW Ps zPRAMErZR D I6
x 3. 5ER V(cd gHR h'e8 ~ Ecch'8+&ZRS
z rr 5FRUlcES Ent ERC EPr f D(E'SEC 6-EkZR~r4'R SF' )aors'ag y
g i ii iu iS WZB siiRE'D FAo& DicsE'8 V S T 0 DiES'c 6 .
BLESS Voc.rRCE ss mghsrEED
\ \ ~
24. P'>gt3RE TER cowSrSTS oF Tu 0 - 5QN)MLS, pole8L ( jJc. O'RA'f. Q
f'FED' ERR r. N7 g runts uoac ir~pvrs3
xV. Pf'lANETFR corvSriv5 nF AHA.'EE Sr&>8<5 - ucn~Rc HctFRHhrE
p ISRAEL <BEDE'R <4 CRENA (<+urv,nor. xeev rSg
z8. PBRANETER 58NE Hs pbthpfE7ER 910 L,c g, ~ p
Pp 4 o4'S
P+88&gTER Col ra con fcrrf+eg u irH GuiDE
f~>r+~r4+ ACA/70)85 If'' +>< Qv8crI=re T'c R 0 l 8 9
lu>7'i~i<ATrow ~+1 RELIC rnA Eua. Dug Ig ~a A cc Ws H8'dE
41= TER R one R
30'. paurTorr.'D
zRnts- RE l(8
<g>S -6 <zi
zRe5-RE Iel
26.5 -Q Iffy
2RN5-@ i%I
ZRn5 -RE iqZ>Res-RE ~qg
y pscprp lrc hr
Vir.bBMOC
5a,p]ok Roe
g~a,~u ~ml R'~
pl ig C~r'0/ g~
R'o|'ap E. Copyibr R~
H.P /la~leva/ Co Nuiy R
Rk/Rcd Ml Vagrk pczifor
Rai~ g<a.C tC gu,l~aS~ R~Rro~
%~57'. Rgg
i - (o ~ m a]~
ol - lc vR/h3
ci - I> MR/j,i3
.i Np R/q„
~ i -+gnR/„„
Y
i i -(0 I~R/~
(hrI (D
&vERE P iuro zwERC Eec V gEsr ovsZ plica.r v'e5
CERg) r-c ~purge
>2 fr PAP'E7<R ~~mE jg 5 PBgdnf+TgR 5 C t3 C I+ Jcrhjr'7/G+RL (
. i~4'n .- cp i ].Wc (Ds E~a+ Z~~(: Ip 'n i p,(„>3 r=ddu ED~ C) ICglll 5rRcK D IOZ >Od C, j/4j
z) Rv/Rale V~A - o - zg 1 3(o cFN
Hz(cg~~ <~~< l~uzi a ro ~ — r o
-. ro
PI5 og g
p~ I ] co~]o IIc n c~
R-G. IÃ7 PXIgyS POP . Pokr+8LF 5hHPI-1>6 Rub AICTlcA'ffAlll+L
SPEC rto~Etgg /'aRTRQLf ~~57RV~Emri97loN ParS ~o r aouFg
T+E EEg CrIRED rRugE 7h'l5'g uipwE'u r ~ h'oa EVER Rk-PPF Serg
VaE 8ES 7 Hah. R8LE rECr O~ol O6-f
'Yn R-G- (.97 Fglgr s p'6R-
I u C.Z CO~PC.I+jVCE
g,) QltuD D IRECTIoN
b) P~uD 5 PEED
0') +Tno5PHEgl C 5TH'>LlT
f'35.
H'-~- <~'Rcy'(OE RA 84 K~IS fROM LRB
Pull- via ISloHQL CODICRTiog nu / 8+/, VALVES loRracI.'f CcoSED
puR]u 5 Rx D PERR'rl>d
37 g) HLL Vr94l/E5 4AOrc& TEP cu Pbo~ - ~cF'g~« I5~,8 I6 R. 8 '!78 E
W+88
yacc. V]fcVG x~DIcHQD aIJ l'T3 - >cci ~W+ (>< I'+~, >45 ~7>
FBa) gLL VPivES x~oic+rru n~ PSn/ zS854 5'~V /6VIL5')
SLY VALVE5- ~DIcPlED oQ f 85I - Z$85 + 5'ov'lSd lgl'/d8'td lS'0 $5
39, TivDIe8rloP IC GÃoS5 &RS CrrauHEL <<usNureSAlr RIIb 'y ro co cP+,
LDCN GE124Attachment IPage I of 2
NINE MILE POINT 2 FSAR
QUESTION'
421.37(7.S)
RESPONSE
If reactor controls and vital instruments derive power fromcommon electrical distribution. systems, the failure of suchelectrical distribution systems may result in an eventrequiring operator action concurrent with failure of importantinstrumentation upon which these operator actions should bebased. IE Bulletin 79-27 addresses several concerns relatedto the above subject. You are requested to provideinformation and a discussion based on each IE Bulletin 79-27concern. Also, you are to:
1) Confirm that all a.c. and d.c. instrument buses thatcould affect the ability to achieve a cold shutdowncondition were reviewed. Identify these bus'es.
2) Confirm that all instrumentation and controls required byemergency shutdown procedures were considered in thereview. Identify these instruments and controls at thesystem level of detail.
3) Confirm that clear, simple, unambiguous annunciation ofloss of power is provided in the control room for eachbus addressed in item I above. Identify any exceptions.
4) Confirm that the effect of loss of power to each load oneach bus identified in item I above, including ability toreach cold shutdown, was considered in the review.
5) Confirm that the re-review of IE Circular No. 79-02 which-is required by Action item 3 of Bulletin 79-27 wasextended to include both Class lE and non-class lEinverter supplied instrument or control buses. Identifythese buses or conform that they are included in thelisting required by Item I above.
A methodology has been developed for addressing concerns raised in IEBul.letin 79-27. This methodology, applied on WNP2, has been reviewedand appr'ov'ed by the NRC. The same methodology will be used inperforming the required study for the NMP2 project. The NMP2 study iscurrently scheduled for completion in the second quarter of 1985. Themethodology provides for a systematic and comprehensive analysis toensure that, in the event of a single power bus failure, sufficientcontrol room indicators, instruments, and controls exist for 'theoperators to achieve reactor cold shutdown. The following paragraphsoutline the methodology to be used in addressing the concerns identifiedin IE Bulletin 79-27.
KC: pes/118B-6I/24/84
LDCN GE124Attachment 1
Page 2 of 2
1) Review the Class 1E and non-Class 1E buses, including inverters,supplying power to instrumentation and controls in systems used inattaining the cold shutdown condition. All buses that could affectthe ability to achieve cold shutdown are identified. Existingplant operating procedures and procedures already developed forthe event of certain 'power bus failures are used to ensure theidentification of all potential power buses.
2) Identify the instrumentation and control devices connected to eachidentified power bus. Evaluate the effects of a power loss to eachload, including the limiting effects on the ability to achieve coldshutdown.
3) Create "bus trees" denoting the bus hierarchy and cascading busconfiguration of all buses that power instrumentation and controlsused by the operator to achieve cold shutdown.
4) Determine the annunciators and alarms that would alert theoperators to a failure of any of the identified buses.
5) Determine the effect of any single power bus loss on the ability tocontinue in the particular shutdown path being used at the time thebus loss occurs. This analysis includes the cascading effects ofany bus los's and considers alternative indications and controlspowered by unaffected buses that may aid the operator in the eventof a bus loss. Identify alternative shutdown paths available inthe event of a bus loss and existing procedures for restoration ofthe affected bus.
6) Document the results of the analysis with recomendations ofhardware or procedural changes.
KC:pes/118B-6.11/24/84
NINE MILE POINT 2 FSAR
UESTION. 421. 42
The transient and accident analyses included in the FSAR are intended todemonstrate the adequacy of safety systems in mitigating anticipatedoperational occurrences and accidents.
Based on the conservative assumptions made in defining these "designbases" events and the detailed review of the analyses by the staff, it islikely that they adequately bound the consequences of single controlsystem failures. To provide assurance that the design basis event analy-sis for Nine Mile Point 2 adequately bounds other more fundamental credi-ble failures, provide the following:
(1) Identify those control systems whose failure of malfunction couldseriously impact plant safety..
(2) Indicat'e which, if any, of the control systems identified in (1)receive power from common power sources. The power sources whosefailure or malfunction could lead to failure or malfunction of morethan one control system and should extend to the effects of cascadingpower losses due to the failure of higher level distribution panelsand load centers.
(3) Indicate which, if any, of the control systems idehtified in (1)receive input signals from common sensors. The sensors consideredshould include common taps, hydraulic headers and impulse linesfeeding pressure, temperature, level or other signals to two or morecontrol systems.
(4) Provide justification that any malfunctions of the control systemsidentified in (2) and (3) resulting from failures or malfunctions ofthe applicable common power source or sensor including hydrauliccomponents are bounded by the analyses in Chapter 15 and would notrequire action or response beyond the capability of operators orsafety systems.
RESPONSE
Two system interaction studies, common power failure analysis and common sensorfailure or sensing line analysis, are required to address the issues of thisquestion. The methodology to be applied for these analyses for NHP-2 has
already been approved by the NRC for Grand Gulf, Shoreham and WNP-2 analyses.The studies will evaluate the consequences of single power source or sensingline failures on control grade systems and determine whether the limiting caseevents are bounded by Chapter 15 analyses. These studies are scheduled forcompletion second quarter of 1985.
BAM:rf:csc/G08077"-18/14/84
A. Common Power Source Failure
The following paragraphs outline the methodology to be used in the common
power source failure analysis.
1) Identify all non-safety control grade systems that could affect thecritical reactor parameters, i.e., water level, pressure, and power.
2)
3)
5)
6)
7)
Review these control systems at the component level. Identify theeffect of the loss of power to each system component and subsequentinteractions with other components and systems.
Generate "bus trees" which represent the bus hierarchy and cascadingconfiguration of all power buses that supply components of controlsystems under .study.
Perform a combined effects analysis. Evaluate the failure of eachpower bus, i.e., load center, motor control center, etc. startingwith the lowest level source common to multiple control systems and.working up the "bus trees" to the highest common power level. Ateach level, examine the effects of the single bus failure and conse-quential cascading bus failures on all control'ystems'omponentsaffected.
Postulate 'the limiting transient events as a result of the combinedeffect analysis. Compare these events to those analyzed inChapter 15.
Perform any additional transient calculations or analyses required todetermine whether the postulated transient events are bounded" byChapter 15 analyses, assuming there is a single active failure in asafety system required to mitigate effects of the event.
Identify any hardware or procedural change recommendations thatresult from this study.
B. Common Sensor or. Sensing Line Failure
The following paragraphs outline the methodology to be used in the common
sensor or sensing line failure analysis.
Identify all non-safety control grade systems that could affect thecritical reactor parameters, i.e., water level, pressure, and power.
2)
3)
Identify all instrument sensing lines and sensors common to two ormore of these control systems.
Analyze the effects of a failure of a common sensors, a completeplug, or a guillotine break in each of these common instrument lines.Examine the effects of the erroneous signals on each affected instru-ment and on each function, i.e., scrams, trips, permissives, etc.,actuated or rendered inoperative.
BAH:rf:csc/G08077"-28/14/84
4) Examine the interactive effects among.all systems affected by thecommon sensing line failure and the consequential combined effect onthe critical reactor parameters.
J
5) Compare the consequences of these postulated events with the Chapter 15analyses to ensure that Chapter 15 bounds the effects and the eventswould not require action or responses beyond the capability ofoperators or safety systems. Perform any additional transientcalculations or analyses necessary to determine whether the postulat-ed limiting event: are bounded" by those events analyzed in Chapter 15,assuming there is a single active failure in a safety system requiredto mitigate effects of the event.
6) Identify any hardware or procedural change recommendations thatresult from this study.
*The term "bounded" means within the consequence limits for abnormal operationaltransients given in Section 15.0.3.1.2 of the FSAR or, if the combined proba-
'ilityof occurrence of both the initiating event annJ the single active failureis similar to the occurrence probabilities of limiting faults (see Section15.0.3.1), "bounded" means within the consequence limits for limiting thefaults given in Section 15,0.3.1.3.
BAM:rf:csc/G08077"-38/14/84
NINE NILE POINT 2 FSAR
QUESTION
421.43 If control systems are exposed to the environment resultingfrom the rupture of reactor coolant lines, steam lines, orfeedwater lines, the control systems may malfunction in amanner which would cause consequences to be more severe thanassumed in safety analyses. IEE Information Notice 79-22discusses certain non-safety grade or control equipment, whichif subjected to the adverse environment of a high energy linebreak, could impact the safety analyses and the adequacy ofthe protection functions performed by the safety-related,systems.
The staff is concerned that a similar potential may exist atlight water facilities now under construction. You are,therefore, requested to perform a review per the IKEInformation Notice 79-22 concern to determine what, if any,
'esign changes or operator actions would be necessary toassure that high energy line breaks will not cause controlsystem failures to complicate the 'event beyond the FSARanalyses. Provide the results of your review including allidentified problems and the manner in which you have resolvedthem.
RESPONSE
The specific "scenarios" discussed in the above referencedInformation Notice are to be considered as examples of thekinds of'nteractions which might occur. Your review shouldconsider analogous interactions as relevant to the BWR design.
KC: pes/118B-12.I/24/84
HIGH. ENERGY LINE BREAK AND CONTROL
SYSTEM FAILURE EVALUATION
INTRODUCTION
IE Information Notice 79-22 identifies the concern that the performanceof nonsafety grade equipment subjected to an adverse environme'nt couldimpact the protective functions performed by safety grade equipment. The
purpose of this analysis is to determine if a malfunction of a nonsafetycontrol system, associated with a high energy line break, might result ina severe event not bounded by FSAR Chapter 15.
METHODOLOGY
The HELB/control system failure evaluation will be analyzed as follows:
1. Identify all nonsafety control systems and components withinthese systems which may impact critical reactor parameters(water level, pressure, power).
2. Establish the criteria for energy lines, break postulation, andconsequence evaluation.
3. Identify critical nonsafety grade components located in areasof high energy piping..
4. Postulate breaks in these areas and determine the resultanteffects on the components.
Evaluate the events to determine if the event is bounded byFSAR Chapter 15. If not bounded, additional analysis or a cor-rective action will be taken.
NONSAFETY CONTROL SYSTEMS
All plant nonsafety'. control systems are included in the initial evalua-tion for HELB. The following criteria is used for the elimination ofsystems from the initial list prior to performing a detailed HELB
analysis.
1. Dedicated inputs into the process computer, as well as the com-
puter itself.2. Control systems which have no direct or indirect interaction
with reactor operating parameters. Examples are communica-tions, lighting, ventilation for exterior buildings, machineshop systems, refueling or'maintenance systems, etc.
3. Control systems that do interact or interface with reactoroperating systems, but which cannot affect the reactor param-eters either directly or indirectly.
C3/l2177/367/5YH
4. Electrical systems, the loss of which will result in a condi-tion similar to- total or partial loss of offsite power. Ex-amples include the station transformers, ac instrument power,and dc instrument power.
5. Systems which are not used during normal power operation. Forexample, refueling systems, turning gear, and turbine bearinglift pumps.
6. Safety systems or safety portions of control systems.
7. Mechanical and structural type systems. Examples includestructural steel, turbines, cranes, etc.
All control components, including power sources, within systems noteliminated by the above criteria are evaluated for component eliminationby the following criteria prior to the final HELB analysis.
Instruments which provide only indication or position statusinformation are excluded from the detailed analysis.
2. Components which provide passive inputs into the control logic,examples of which are arming-type permissives which requireadditional manual action to command equipment to operate, areexcluded from the detailed analysis.
3. Instruments and other dedicated inputs to the process computerare excluded from the detailed analysis.
4. Position switches on air- and motor-operated valves which arenot interlocked with other equipment but rather provide posi-tion indication or position status to the process computer areexcluded from the detailed analysis.
5. Mechanical type components, such as structural steel, tanks,and pipes are not considered "components" which can fail. How-ever, associated instruments, taps, tubing, and control compo-nents not eliminated by Items 1 through 4 and physicallylocated on the above mechanical components, are evaluated.
PIPE BREAK CRITERIA
The pipe break criteria is taken directly from FSAR Section 3.6.
Pi e Criteria
High energy piping is defined as including those systems orportions of systems in which the maximum operating temperatureexceeds 200 F or the maximum operating pressure exceeds275 psig during normal full power operation. Those lines thatoperate above these limits for only a relatively short periodof time (less than 2 percent) to perform their intended func-tion, are classified as moderate energy and excluded from con-sideration.
C3/12177/367/5YH
2. Break Postulation
High energy pipes are assumed to break only at terminal endsand at each intermediate pipe fitting or weld attachment. Eachlongitudinal or circumferential break in high energy fluid svs-tem piping is considered separately as a single postulatedinitial event occurring during normal plant conditions.
3. Conse uence Evaluation
Pipe breaks are evaluated for the effects of pipe whip, jetimpingement, and environmental effects.
a. ~Pi e Whi
Pipe whip is assumed to occur in the plane defined by thepiping geometry and to cause movement in the direction ofthe jet reaction.
b. Jet Im in ement
Jet impingement loads are determined by taking the jetforce as being constant at all effective distances from,and normal to, the break area and by assuming that the jetstream diverges conically at a solid angle of 20 degrees.
ANALYSIS
l. Utilizing current plant drawings, the nonsafety control componentsand high energy systems will be located in particular
zones'.
In small zones it will be assumed that any HELB would incapacitateall nonsafety control components in the zone.
3. In large zones the effect of a high energy line break on each compo-nent will be evaluated based upon the pipe criteria.
4. Postulate breaks and evaluate the effects on the controls equipment.
5. Compare postulated effects with events as reported in CESAR
Chapter 15 to determine if they are bounded.
6. If not bounded, determine if protection or relocation of the con-trols equipment is appropriate. me. Ol '0
If requiredr ) additional analysi/tedetermine if the effect is significant and then a corrective actionwill be taken.
8. Draft final report.
C3/12177/367/5YH
NINE MILE POINT 2 FSAR
QUESTION 421. 44(7. 7)
RESPONSE
A.
B.
Table 7.1-1 of the FSAR lists the safety-relatedinstrumentation and control systems. Nonsafety-related systems are identified in Table 7.7-1. From areview of Chapter 15 of the FSAR the staff has deter-mined that the analysis of certain anticipated opera-tional occurrences (i.e., the feedwater controllerfailure-maximum demand) and design basis accidents(i.e., recirculation pump seizure) take credit for theoperation of nonsafety-related instrumentation andcontrol systems. It is the staff's position that forevents classified as anticipated operational occurrences,credit can be taken for nonsafety-related systems tomitigate the event provided only high availabilitynonsafety-related systems are being relied upon.Therefore, identify each instrumentation and controlsystem/component which is not classified as safety-related but assumed in the FSAR analyses to mitigatethe consequences of transients. Provide a justifica-tion for the assumption of operability of'his equip-
~ ment based upon'system design, equipment quality, andproposed technical specifications. In addition,
= provide a discussion on the interfaces with thesafety-related portions of the Nine Nile Point-Unit 2design.
It is the staff's position that no credit may be takenfor nonsafety-.related instrumentation and controlsystems/components in mitigating the consequences ofdesign bases accidents. Therefore, identify eachinstrumentation and control system/component which isclassified as nonsafety-related but assumed in theFSAR analyses to mitigate the consequences of accidents.Either redo the analysis assuming no credit for theoperation of this equipment, or propose modificationsto upgrade the equipment to safety-related status.
A. The following non-safety grade systems/components may be actuated duringthe course of anticipated operational occurrences (transients) shown inChapter 15:
a. Level 8 turbine trip,b. Level 8 feedwater trip,c. turbine bypass,
d. recirculation runback,
e. rod sequence control system,
f. rod block monitor, and
g. relief function of the safety relief valves.
PCY: pc: rf/L01242"-18/14/84
NINE NILE POINT 2 FSAR
None of these systems are required to mitigate the events analyzed inChapter 15.
The assumed performance of .the nonsafety grade system listed in Table 440.43-1,in response to guestion 440.43-1, is based on extensive. failure rate datafor equipment of similar design and quality requirements. Among thenonsafety grade systems listed in Table 440.43-1, the failures of the L8
trip and turbine bypass would have the most adverse effects on hCPR. Forthe most limiting transient, a feedwater controller failure at maximumdemand, the estimated increase in hCPR is about 0.02 for L8 trip failureand 0.11 for turbine bypass failure. Since this postulated event is 2 to3 seconds in duration, no fuel failure is expected.
In summary, certain transient events assume the operation of specificnonsafety-grade equipment to provide a realistic transient signature;however, failures of such equipment would still yield events bounded bythe safety limits of transient and limiting fault events analyzed inChapters 6 and 15. The peak vessel pressure is bounded by the overpressure protection analysis described in Chapter 5.
See FSAR Section 7.7.1.5 and 10.4.4 for turbine bypass and Section 7.7.1.3for L8 IKC design information.
B. FHEA's take no credit for nonsafety-related instrumentation and controlsystem/components in mitigating'he consequences of design basis accidents.
PCY: pc: r f/L01242"-28/14/84
NINE HILE POINT UNIT 2 FSAR
UESTION.4
From its review of the Nine Mile Unit 2 FSAR, the NRC staff has been unable toconclude that the separation of Class lE components and interconnecting cir-cuits is acceptable. Regulatory Guide 1.75, "Physical Independence of Electri-cal Systems" which endorses IEEE Standard 384, "IEEE Trial-Use StandardCriteria for Separation of Class 1E Equipment and Circuits" provides guidancewith regard to separation. To provide the level of detail necessary to com-plete our review, we'request that you submit a comparison of the Nine HilePoint Unit 2 design to the criteria contained in R.G. 1.75 and IEEE 384. Thiscomparison should focus on the instrumentation and control systems ~ithin boththe Power Generation. Control Complex and the balance of plant. The informationprovided should supplement FSAR Table 1.8-1 and FSAR Sections 7.1.2, 7.2.6 and8.3. 1 such that each regulatory position of R.G. 1.75 and each separationcriterion of .IEEE 384 is addressed. Alternate methods of providing separation
~ to those contained in R.G., 1.75 and IEEE 384 should be identified and justi-fied. Where barriers (e.g., flexible conduit, sheet metal enclosures, fireretardant tape) are used to provide separation, the details of the testing usedto qualify the barriers should be provided. Where analyses have been used tojustify lesser separation than that recommended in- R.G. 1.75 and IEEE 384, adetailed discussion of the analyses including the assumptions,, methods, sup-porting tests and conclusions should be provided.
RESPONSE
A comparison of the Nine Nile Point Unit 2 design to the criteria contained inR.G. 1.75 and IEEE 384 is shown in the following tables for instrumentationand control systems within the PGCC and balance of plant.
Note: Balance of plant response provided by SWEC.
BAM:rm/407274"-17/27/84
NIHE NILE POINT UNIT 2 FSARSEPARATION EVALUATION
QUESTION 421.47
IEEE 384-74 CRITERIA
OEFIHITIOHS
REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION PGCC
DES IGH COHFORHAHCE
Isolation device. A device in a circuitwhich prevents aalfunctions in onesection of a circuit froa causingunacceptable influences in othersections of the circuit or othercircuits.
Raceway. Any channel that is designedand used expressly for supporting wires,cable, or busbars. Raceways consistprlaarlly of, but are not restrictedto, cable trays, conduits, and interlocked araor enclosing cable.
C.13uppleaent IEEE 384 definitionas follows "interrupting devicesactuated only by fault currentare not considered to be isola-tion devices within the contextof this docusent.
C.2Mn erlocked araor enclosing cableshould not be, construed as a"raceway".
Since interrupting devices (fuses.and/or circuit breakers) actuatedonly by fault current are notconsidered as isolation devicesa coablnatlon of two interruptingdevices or an EPA in conJunctionwith. an interrupting device is used.
Interlocked armor cable is not usedas a raceway.
. Interrupting devices actuatedonly by fault current are notused as isolation devices forisolating non-class IE circuitsfroa class-IE circuits. In thecase of control/instr~ntassociated circuits, fuse/breakers actuated by faultcurrent have been used to isolatenon-class IE and devices.
Neets this requlreaent.
CRITERIA
4.l Re uired Se aration. Separation No coment.shall e prov e o aa ntain .the indepen-dence of sufficient nmaber of circuitsand equipaent so that the protectivefunctions required during and followingany design basis event can be accoa-
- plished. The degree of separationrequired varies with the potentialhazards in a particular area.
Separation is provided to aaintaln the)Odependence of sufficient nuaber ofcircuits and equipient r'equired for
'iotective'function.Independence isachieved through equipaent arrangeaent,aaterlals, wiring practices and isola-tion devices and/or space or byanalysis.
Heats this requireaent.
BAH:cal: na/A08305"-I8/30/84
. NINE HILE UNIT 2 FSAR
SEPARATIOH EVALUATIONQUESTION 421.47 (Continued)
IEEE 384-74 CRITERIA
4.2 E ui nt and Circuits Re uirinSe ara on. qu peen an c rcu srequ r ng separation shall be deterainedand delineated early in the plant designand shall be identified on doc|ssants anddrawings in a distinctive Ianner.
4.3 Hethods of Se aration. The separa-tion o c rcu s an equ paent shall beachieved by safety class structures,distance, or barriers, or any coebina-tion .thereof.
REGULATORY GUIDE 1.75, REV. 1REGULATORY POSITION
No couaent.
C.3whenever practicable and where itsuse does not conflict with other.safety ob)ectives, locate redundantcircuits and equipaent in separatesafety class structures.
PGCC
DESIGN CONFORHANCEBOP
Equipaent hand circuits requiringseparation are delineated in the plantdesign documents and identified in adistinctive Ianner.
Meets this requireeent.
The separation of circuits and equipaent Meets this requireaent.is achieved by locating'hea inseparate safety class structures,distance or barriers, or any
'oabinatfon thereof or by analysis.
4.4 C atibilit with Hechanical~S steas; e separa on o ass lE+c rcuuEs and equipaent shall be suchthat the required independence vill notbe coeproalsed by the failure ofaechanical systeas served by. theClass lE systees. For exaeple, Class lEcircuits shall be routed or protectedsuch that failure of related aechanicai
. equipaent of one redundant systeecannot disable Class lE circuits orequlpeent essential to the operationof the other redundant systea(s).
No coint. Class 1E circuits are routed and/orprotected such that failure of relatedaechanical equipaent of one Class 1Esysteo vill not disable Class 1Ecircuits or equipaent essential to theoperation of its redundant systea(s).
Meets this requireaent.
BAH:cal:rN/A08305*-28/30/84
HIKE MILE UNIT 2 FSAR
SEPARATIOH EVALUATIOH
(UESTIOH 421.47 (Continued)
IEEE 384-74 CRITERIAREGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION PGCC
DESIGN COHFORMAHCEBOP
4.5 Associated Circuits. Associated .
circu s s a coap y w th one of thefollowing:(1) They shall, be uniquely identified
as such and shall reiain with, or beseparated the same as, those Class lEcircuits with which they are associated.(2) They shall be in accordance with
(1) above froa the Class 1E equipeentto and including an isolation device.Beyond the isolation device a circuitis not subject to the requireientsof this docuaent provided it does notagain becoae associated with a Class lEsystea.(3) They shall be analyzed or,tested
to demonstrate that Class 1E circuitsare not degraded below an acceptablelevel.
4.6 HOH-CLASS lE CIRCUITS
4.6.1 Se aration frog Class lE Circuits.Hon-Class c rcu s s a separa efrow Class lE circuits by the ainlauaseparation requireaents specified inSections 5.1.3, 5.1.4, or 5.6 or theybecoie associated circuits.
C.4 and C.6Ksisoc s e clecults should besubject to all requireaents placedon Class 1E circuits such as cableder ating, environaental qualifica-tion, flaae retardance, splicingrestrictions and raceway fillunless it can be deaonstrated thatthe absence of such requireaentscould not significantly reduce theavailability of the Class 1Ecircuits.
Analysis should be subaitted as.part of Safety Analysis Report,and should identify those circuitsinstalled in accordance with thissection.
Ho coasent.
Associated circuits are either sub)ectto all requlreaents placed on Class 1Ecircuits or are analyzed to desonstratethat the associated circuits will notdegrade the Class 1E circuits below anacceptable level. Such an analysis,when perforsedb is aainta<ned as partof the design record./k'ote 5.
Kon-Class 1E circuits coaply with therequireaents of IEEE 384 Section 5.1.3,5.1.4 or 5.6 or they are treated asassociated circuits.
h
Associated circuits are treatedas class lE circuits.
Meets this requireaent except inthe case of non-class 1E conduitsproxiaate to class lE trays. Thealnlaea distance between a non-class lE conduit and a class lEcable tray (open) shall be 1 inch.See FSAR Section 1.8 RG 1.75position for justification.
BAM:cal: ra/A08305e-38/30/84
se e
HINE HILE UHIT 2 FSARSEPARATIOH EVALUATION
QUESTION 421.47 (Continued)
IEEE 384-74 CRITERIAREGULATORY GUIOE 1.75d REV. 1REGULATORY POSITION PGCC
DESIGN CONFORMANCEBOP
4.6.2 Se aration from AssociatedCircuits. on- ass c rcu s shalltse separated iron associated circuitsby the Iiniaua separation requirementsspecified in Sections 5.1,3, 5. 1.4,or 5.6.2 or (1) the effects of lesserseparation between the Hon-Class lEcircuits and the associated circuitsshall be analyzed to demonstrate thatClass 1E ~c rcu s are not degraded .
below an acceptable level or (2) theybecome associated circuits. Non-Classld instrtssentatton and contro~c rcu ~
are no re u re o e separa e romassoc a e c rcuits.
Figure 1 shows examples of acceptable'ircuit arrangements.
5. SPECIFIC SEPARATION CRITERIA
5.1 Cables and Racewa s5.1. enera
5.1.1~ie routing of Class lEcircuits and location of equipment sewedby these Class lE circuits shall bereviewed for exposure to potentialhazards such as high pressure piping,missiles, flasoable material flooding,and wiring that is not flaae retardant.A degree of separation coamensuratewith the damage potential of the hazardshall be provided such that the indepen-dence of redundant Class lE systems are
C.6analysis performed in accordancewith this section should besubmitted as part of SafetyAnalysis Report and should identifythose circuits installed in accordance with this section.
C.7Rona-Class 1E instrumentation andcontrol circuits should not beexempted from the provisions ofSection 4.6.2.
C.BSection 5.1.1.1 should not beconstrued to imply that adequateseparation of redundant circuitscan be achieved within a confinedspace such as a cable tunnel thatis effectively unventilated.
Hon-Class lE circuits are separatedfrom'Class 1E and associated circuitsin accordance with the requirementsof IEEE-384, Sections 5.1.3, 5.1.4,or 5.6.2 or effects of lesser separa-tion are analyzed to demonstrate thatClass lE circuits are not degradedbelow an acceptable level. Suchana]ysis, when performed, is a part .of the design record. Hon-Class lEinstrumentation and control circuitsare not exempted from the provisionsof Section 4.6.2.
Separation of Class lE circuits andequipment makes effective use of suchfeatures as different safety structures
, and separated areas for redundantcircuits and equipment. A degree ofseparation cosxsensurate with the damagepotential of the hazard is providedsuch that the independence of theredundant Class 1E systems is main-tained at an acceptable level.
Meets this requirement.
bfu/SID >~Generally, different quip-aent are located in d fferooms; different a lesare routed through differentareas; separate tunnels are usedfor routing cables of different
y Ip/gro&S
BAH:cal:rm/A08305*-48/30/84
. HIHE NILE P NIT 2 FSARSEPARATIOH EVALUATION
(UESTIOH 421. 47 .(Continued)
IEEE 384-74 CRITERIAREGULATORY GUIDE 1.75, REV. 1REGULATORY POSITION PGCC
DESIGN COHFORHANCEBOP
maintained at an acceptable level. Theseparation of Class 1E circuits andequipment shall make effective use offeatures inherent in the plant designsuch as using different rooms oropposite sides of rooms or areas.
5.1.1.2 In those areas where the. damage potential is limited to failuresor faults internal to the electricalequipment or circuits, the minimumseparation distance can be establishedby analysis of the proposed cableinstallation. This analysis shall bebased on tests performed to determinethe flame retardant characteristics ofthe proposed cable installation consider-ing features such as cable insulation andjacket materials, cable tray fill, andcable tray arrangement.
5.1.1.3 The minimum separationdistances specified in Sections 5.1.3and 5.1.4 are based on open ventiliatedcable trays of either the ladder ortrough type as defined in NEHA VE 1-1971,Cable Tray Systems. 10ere thesedistances are used to provide adequatephysical separation:(1) Cables and raceways involved shall
be flame retardant(2) The design basis shall be that the
cable trays will not be filled abovethe side rails
C.6Analysis performed in accordancewith this section should besubmitted as part of the SafetyAnalysis Report, and shouldidentify circuits installed inaccordance with these section.
C.9TRh section should be. supplementedwith Item 5.$ .1.3(4) as follows:"Cable splices in raceways shouldbe prohibited".
NOTE: Cable splices are not, bythemselves, unacceptable. If theyexist,-the resulting design shouldbe justified by analysis. Theanalysis should be submitted aspart of the Safety Analysis Report.
(See also FSAR, Section 8.3.1.4.2 forexception.)
Cable installations within PGCC have ~
been analyzed for separation
adequacy.'pen
ventilated cable trays andcable splices are not used.
(See FSAR Section 8.3.1.4.2for details.)
Analysis has been used in thecase noted in Section 4.6.1.The analysis is included inSection 1.8, RG 1,75 position.
Heets the criteria 1, 2 and 3 ofSection 5.1.1.3 where the minimumseparation distances of Sections5.1.3 and 5.1.4 are used; cablessplices in raceways are prohibited;splicing in electrical penetra-tions is considered to be exemptfrom this requirement.
BAH:cal:rm/A08305*-58/30/84
HIHE HILE UHIT 2 FSARSEPARATI EVALUATIOH
QUESTION 421.47 (Continued)
IEEE 384-74 CRITERIA
,(3) Hazards shall be li«ited to failuresor faults internal to the electric equip-«ent or cables.
If less separation distances are Usedthey shall be established as inSection 5.1.1.2.
REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION PGCC
OESIGN CONFORWNCE
5.1.2 Identification. Exposed Class lE C.10
per«anent «armer at intervals not to'fpoints" should be understood toexceed 15 ft and at points of entry to «ean at intervals not to exceedand exiting fro« enclosed areas. Class 5 ft throughout thy entire cablelE raceways shall be «arked prior to the length. Also the preferred «ethodinstallation of their cables. of «arking cable is color coding.Cables installed in these raceways shall
be «arked in a «armer of sufficient '.lldurability and at a sufficient nu«ber TQs section should be supple«antedof points to fac a e n a ver i- as follows: "The «ethod of identi-cation that the installation is in con- : fication used should be si«pie andfor«ance with the separation criteria. should preclude the need tp consultThese cable «arkings shall be applied any reference «aterial to distin-prior to or during installation. 'uish between Class 1E and Hon-
Class lE cables shall be identified by Class lE circuits, between Hon-e per«anent «arker at each end in accor Class lE circuits associated withdance with tKeeeslgn drawings or cable different redundant Class IEschedule. syste«s, and between redundantThe «ethod of identification used to Class lE syste«s.
«eet the above require«ents shallreadily distinguish between redundantClass lE syste«s and between Class 1Eand non-Class 1E syste«s.
Heets the requirement. Heets the require«ants exceptthat the cables are «arked atintervals of 15 ft. insteadof 5 ft.; see FSAR Section1.8, RG 1.75 position for theexplanations. See FSAR Sec.8.3.1.3 for the details ofthe «ethods of identificationused.
. BAN:cal:r«/A08305*-68/30/84
NIHE NILE HIT 2 FSARSEPARATIO VALUATIOH.
'UESTIONl2l.l7 (Continued)
IEEE 384-7I CRITERIA
5.1.3 Cable S readin Area The cablespreading area s e space s) adjacentto the aain control rooa where instru-aantation and control cables convergeprior to entering the control, terrain.ation, or instruaent panels. The cablespreading area shall not contain highenergy equipeent such as switch-gear,
'ransforwers, rotating equipment, orpotential sources of aissiles or pipewhip and shall not be used for storingflaaeable aaterials. Circuits in thecable spreading area should be lie(tedto control and instrmentation functionsand those power supply circuits andfacilities serving the control room andinstruaent systems. Power supply feedersto instruwent and control rooa distri-bution panels shall be installed inenclosed raceways that qualify asbarriers.
Other power circuits that are requiredto traverse this area Shall be assignedto a ainiam nuaber of routes consistentwith their separation requireaents andallocated solely for these power circuits.Such traversing power circuits shall beseparated froa other circuits in thisarea by 4 alnimum distance of 3 ft. andbarriers.
REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITIOH
C.12 Pending issuance of otheracceptance criteria, those portionsof Section 5.1.3 (exclusive of theNOTE following the second para-graph) that paralt the routing ofpower cables through the cablespreading area(s) and by iepli-cation, the control rooa, shouldnot be construed as acceptable.Also, Section 5.1.3 should besuppleaented as follows: "1&erefeasible, redundant cable spread-,ing areas should be utilized."
PGCCDESIGH COKFORNAKCE
Cables feeding power to controland instrueentatlon circuits are notrequired to run in conduit withinPGCC. These cables are treatedas control and instruwentation cablesand are run in PGCC ducts along withother cables in the saaa division.
Neets the requireaents; separatecable riser areas are used forthe redundant circuits. Powercables in the riser areas arerouted in enclosed raceways.See FSAR Sec. 8.3. l.i.2.
BAH:cal;rw/A08305"-78/30/Bi
NINE MILE UNIT 2 FSAR..—.'EPARATIONEVALUATION
QUESTION 421.47 (Continued)'I
REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITIONIEEE 384-74 CRITERIA
NOTE: An acceptable alternative rout1ng.for such traversing power circuits wouldbe to route thea in iabedded conduit orin a separate enclosure designed as safetyclass structure (for exaaple, a concreteduct bank or other suitable enclosure)which in effect reaoves thea froa thearea defined as the cable spreading area.
The ainiaua separation distance betweenredundant Class 1E cable trays shall bedeterained by Section 5.1.1.2 or, wherethe conditions of Section 5.1.1.3 a'e aet,shall be 1 ft. between trays separatedhorizontally and 3 ft. between traysseparated vertically.
NOTE: Horizontal separation is aeasuredfroa the side rail of one tray to the siderail of the ad)acent tray. Verticalseparation 1s aeasured froa the bottoa of .
the top tray to the top of the side railof the bottoa tray. (See also Section5.1.4).
PGCCOESIGN CONFORMANCE
BOP
@here tera1nation arrangeaents preclude C.13aaintaining the ainiaua separation dis- Ro significance should betance, the redundant circuits shall be attached to the different trayrun in enclosed .raceways that qualify widths illustrated in Figure 2.as barrters or other barriers shall beprovided between redundant circuits.The ainiaua distance between these
See notes 2, 3, 4, 6, 7, 9 and 10. Mhere the ainiaua separationrequireaents cannot be aet,Sil-teap tape aay be used as aseparation barrier.
.BAM:cal: ra/A08305e-88/30/84
NINE NILE UNIT 2, FSAR5EPARATIO EVALUATIOH
(UESTIOH 421.47 (Continued)
IEEE 384-74 CRITERIA
redundant enclosed raceways and betweenbarriers and raceways shall be in 1 in.Figs. 2, 3, 4 and 5 illustrate examplesof
acceptable'rrangeaantsof barriers
and enclosed raceways where the ainimeaseparation distance cannot be «aintalned.
REGULATORY GUIDE 1.75'EV. 1REGULATORY POSITION PGCC
DESIGN CONFORHANCE
5.1.4 General Plant Areas. In plant
as siss)les, external fires, and pipewhip are excluded, the ainiam separationdistance between redundant cable traysshall be determined by Section 5.1.1.2or, where the conditions of Section 5.1.1.3are set, shall be 3 ft. between traysseparated horizontally and 5 ft. betweentrays separated verticially. If, inaddition, high energy electric equipmentsuch as switchgear, transforwers, androtating equipment is excluded andpower cables are installed in enclosedraceways that qualify as barriers, orthere are no power cables, the ainimuaseparation distance aay be as specifiedin Section 5.1.3.
libera plant arrangewents preclude aain-taining the ainiaua separation distance,the redundant circuits shall be run inenclosed raceways that qualify asbarriers or other barriers shall beprovided between redundant circuits.The ainiaw distance between these
Hot applicable. Heats the requireeents.
~ BAH:cal:ra/A08305*-98/30/84
~ s e
HIHE NIL UNIT '2- FSARSEPARATION EVALUATION'- '".
QUESTION 421,47 (Continued)
4
IEEE 384-74 CRITERIA
redundant enclosed raceways and betweenbarr iers and raceways shall be in 1 in.Figs.'2, 3, 4 and 5 illustrate exaeplesof acceptable arrangeaents of barriersand enclosed raceways where the Iiniamseparation distance cannot be aaintained.
'.2 STAHOBY POWER SUPPLY
5.2.1 Standb Generatin Units. Redun-dant C ass s nd y genera ng unitsshall be placed in separate safety classstructures.
5.2.2 Auxiliaries and Local Controls.The aux ar as an oca contro s orredundant standby generating units shallbe located in the saae safety classstructure as the unit they serve or bephysically separated in accordance withthe requlreaents of Section 4.
5.3 DC SYSTEN
5.3.1 Batteries. Redundant Class lEbattert'ee~ s a be placed ie separatesafety 'class structur es.
5.3.2 Batte Char er s. Batterychargers or re un ant Class 1Ebatteries shall be physically separatedin accordance with the requireients ofSection 4.
BAN:cal: ra/A08305"-108/30/84
REGULATORY GUIDE 1.75p REV. 1REGULATORY POSITION
C.14Section 5.2.1 should be supple-mented as follows: And shouldhave independent air supplies."
C. 15Qfiere ventilation is required, theseparate safety class structuresrequired by Section 5.3.1 should beserved by independent ventilationsysteas.
No coswent
Hot Applicable
Hot Applicable
Not Applicable
PGCCDESIGN COHFORNANCE
Neets this requireaent.See Section 8.3.1.1.2.
Heats this requireeent.See Section 8.3.1.1.2.
Heets this requireaent. SeeSection 8.3.1.4.2.
Heets this requireaent. SeeSection 8.3.1.4.2.
NIKE HIL T UNIT 2 FSARSEPARATIOH EVALUATION
QUESTION 421.47 (Continued)
IEEE 384-74 CRITERIA
5.4 DISTRIBUTION SYSl'EH
REGULATORY GUIOE 1.75, REV. 1.REGULATORY POSITION PGCC
OESIGH CONFORHANCEBOP
5.4.1 Switch ear. Redundant Class 1Edistribut on sw chgrear groups shallbe physically separated in accordancewith the requireeents of Section 4.
5.4.2 Hotor Control Centers. Redun-dant Class no or contro centersshall be physically separated inaccordance with the requlreaents ofSection 4.
5.4.3 Oistribution Panels. RedundantClass 1 s r ut on panels shall bephysically separated in accordance withthe requirements of Section 4.
5.5 COHTAIHHEHT ELECTRICAL PEHETRA- No coeaentTIOHS. e un an ass con a naenteiecErical penetrations shall be physicallyseparated in accordance with the require"nants of Section 4. Coapliance vithSection 4 vill generally require thatredundant penetrations be widely dis-persed around the circuaference of thecontainaent. The ainiaua physical sep-aration for redundant penetrations shallneet the requireaents for cables andraceways given in Section 5.1.4.
Hot Applicable
Section'8.3.1.4.2.
Heats this requiresent. SeeSection 8.3.1.4.2.
Neets this requireeent. SeeSection 8.3.1.4.2.
Heets this requirenent.See Section 8.3.1.4.2.
Heats this requireaent. SeeSection 8.3.1.4.2.
BAH:cal:ra/A08305~-ll8/30/84
r
0
HINE NIL UHIT 2 FSAR
5EPARAT EVALUATIONQUESTION 421.47 (Continued)
IEEE 384-74 CRITERIA
Hon-Class lE circuits routed in pene-trations containing Class lE circuitsshall be treated as associated circuitsin accordance with the requlreaents ofSection 4.5.
REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION
I
II P
PGCC
OESIGN CONFORHAHCEBOP
BAN:cal: ns/A08305e-128/30/84
IEEE 384-74 CRITERIA
NINE HILE PO FSAR
SEPARATION EVALUATIONQUESTION 421.47
REGULATORY GUIOE 1.75 REV. 1REGULATORY POSITIOH
OESIGN CONFORNANCE
PGCC BOP
5.6 Control Switchboardsoca on an Arran eaent.
Ka)n contro sw c oar s s a elocated in a control rooa within asafety class structure. The controlrooa shall protect frea and 'shall notcontain high energy switchgear, trans-foraers, rotating equipuent, or poten-tial sources of aissiles or pipe whip.
Ho coszaent e See BOP ~ Heets the requ)reaents. The~a)n control switchboards (PGCC)are located in the controlbuilding which is a se)sa)cCat. I structure. The aa)ncontrol rooa does not containany high energy equ)paent.See Section 3.8.
Local control switchboards shall belocated so that hazards such as fires,a)ssiles, vibration, pipe wh)p, andwater sprays shall not cause failurescomon to redundant Class IE functions.
~ Hot applicable. ~ Heets this requ)resent.
Separation of redundant Class 1Eequ)paent and circuits aay be achievedby locating thea on separate controlswitchboards physically separated inaccordance with the requirements ofSection 4. '&ere operational considerations dictate that redundant Class IEequipaent be located on a single con-trol switchboard the requ)resents ofSections 5.6.2, 5.6.3, 5.6.4, and5.6.6 shall apply.
~ Controls for redundant Class 1E equip-aent are located on separate controlpanels. However, due to operationalconsiderations, some of the redundantClass IE controls, are located on thesaae control panel. These iteas areprovided with adequate separation toaeet the single failure criteria.
~ Heets this requ)resent.
BAN;N/A08302*-18/30/84
IEEE 384"74 CRITERIA
NINE HILE P FSARSEPARATION ATION
QUESTION 421. 47
REGULATORY GUIDE 1.75 REV. 1REGULATORY POSITION PGCC
DESIGN CONFORHANCE
BOP
5.6.2 Internal Se aration. The'inimum separa on s ance etween
redundant Class lE equipment and wiringinternal to the control switchboardscan be established by analysis of theproposed installation. Th1s analysisshall be based on tests performed todetermine the flame retardant charac-teristics of the wiring, wiring mate-rials, equipment, and other'materialsinternal to the. control switchboard.lkere the control switchboard mate-rials are flam retardant and analysisis not performed, the minimum separa-tion distance shall be 6in. In theevent the above separation distancesare not maintained, barriers shall beinstalled between redundant Class. 1Eequipment and wiring.
~ No comment. ~ The minimum separation distance betweenredundant Class 1E equipment and wiringinside the control panels is main-tained at 6". Due to the circuit con-figuration, if 6" is not achievable,alternate scans are used to justifylesser degree of separation, such asmetallic barriers, enclosures, conduits,isolation devices and/or analysis.See notes 2, 3, 4, 5, 7, 9, and 10.
~ Heets this requirement.
5.6.3 Internal Mirin Identifica-tion. Class w>re un es or'cCa Tes internal to the control boardsshall be identified in a distinctpermanent manner at a sufficientnumber of points to readily distinguishbetween redundant Class lE wiring andbetween Class 1E and non-Class lEwiring.
~ No coaaent. ~ Class IE wires and cables internal toane} are identified to distinguishetween redundant Class lE and
non-Class IE wiring. See notes 5 andand 8.
~ Heets this requirement.
5.6.4 Comon Terminations. lthere ~ No coaaent.
on coaaon device, the provisions ofSection 5.6.2 shall be met.
~ Cemon terminations within the control.„'anels meet the provisions of IEEE-384..=,para 5,6.2. 'See not'e 1,
~ Heets this requirement.
BAH: rm/A08302™28/30/84
IEEE 384-74 CRITERIA
NINE HILE 2 FSAR
SEPARATION EVALUATIONQUESTION 421.47
REGULATORY GUIOE 1.75 REV. 1 OESIGN CONFORHANCE
REGULATORY POSITION ~ PGCC BOP
5.6.5 Non-Class 1E Wirin .Non-Class w r)ng no separated froaClass 1E wiring by the ainiaua separa-tion distance (deterained inSection 5.6.2) or by a barrier shallbe treated as associated circuits inaccordance with the requirements ofSection 4.5.
~ No coaaent. ~ Non-Class lE wiring within the controlpanels is separated froa the redundantClass 1E wiring. Whereverthe non-Class 1E wiring cannot beseparated froa the Class 1E wiring,(1) it is treated as associated wiring,or (2) an analysis is per fonaed to deaon-strate the adequacy of lesser separa-tion, or (3) proper isolation (barrieror comon device) is provided to achievethe required separation.
~ Heets this requireaent.
5.6.6. Cable Entrance. Redundant ~ No coaaent.
board enclosure shall eeet the require-aent of Section 5.1.3.
~ Redundant Class lE cables entering thecontrol .board enclosure are (a) separatedby a siniaum distance of six inches or abarrier or (b) enclosed in a raceway.See notes 2 and 9.
~ Heets this requirement
5.7 Instreaentation Cabinets.Redun an ass ns roaents shallbe located in separate cabinets orcoapartaents of a cabinet. Whereredundant Class 1E instruaents arelocated in separate coepartaents ofa single cabinet, attention aust be
iven to routing of external cableso the instruaents to assure that
cable separation is retained.
C. 16 The first paragraph ofSection 5.7 should be auyaentedas follows: "The separation re-quireaents of 5.6 a~ply to instru-aentation cabinets.
~ Redundant Class lE instruments arelocated in separate cabinets or separatecoipartaents of a cabinet. If redun-dant instrqments are reguired to belocated on a single cab>net or singlesingle coapartjsent, barriers are pro-vided. Cables entering such cabinetsare separated by a ainiaua distance; or,barriers are provided between redundantcoaponents and wiring.
~ Heets this requireaent.
In locating Class 1E instruaentcabinets attention aust be givento the effects of all pertinentdesign basis events.
~ See BOP response. ~ Heets this requireaent.
BAH:ra/A08302~38/30/84
IEEE 384-74 CRITERIA
NINE 'NILE 2 FSARSEPARATIO LUATTON
QUESTION 421.47
REGULATORY 4UIOE 1.75 REV. 1REGULATORY POSITION = PGCC
DESIGN COHFORNAHCE
BOP
5.8 Sensors and Sensor to Process ~ Ko comment.Connec sons. e un an ass sen-sors anraietr connections to theprocess system shall be sufficientlyseparated that functional capabilityof the protection system will be main-tained despite any single design basisevent or result therefrom.. Considera-tion shall be given to secondaryeffects of design basis events such aspipe whip, steam release, radiation,missiles, or. flooding.
~ Sufficient number of redundant sensorsare provided to perform system levelsafety function, Adequate separation ismaintained between required number of re-dundant sensors to maintain the func-tional capability of the protection sys-tem. Neutron monitoring sensor cablesunder the vessel are exempt from thiscriterion because of the space limita-tions.
~ Neets this requirement.
Large components such as the reactorvessel can be considered a suitablebarrier if the sensor to process con-necting lines are brought out at widelydivergent points and routed so as tokeep component between redundant lines.Redundant pressure taps located onopposite'sides of a large pipe may beconsidered to be separated by the pipe,but the lines leaving the taps must beprotected against damage from acredible coloon cause unless otherredundant or diverse instresentationis provided.
BAH: rm/A08302~-48/30/84
~ n .s,~,
IEEE 384-74 CRITERIA
HIHE NILE FSAR
SEPARATIOH E ALUATIOHQUESTION 421.47
REGULATORY GUIDE 1.75 REV. 1REGULATORY POS IT IOH PGCC
DESIGH COHFORHAHCEBOP
5.9 Actuated E ui ent. Locationsof C ass ac ua e equipaent, suchas puap drive aotors and valveoperating aotors are noraally dic-tated by the location of the drivenequipeent. The resultant locationsof this equipment aust be reviewedto ensure that separation of redundantClass 1E actuated equipment isacceptable.
~ No cosssenti ~ Redundant Class lE actuated equipments ~ Heets this requireaent.are separated to eeet the single failurecriteria and assure sufficient safetyfunction to aitigate a OBE;
Hon-Class lE circuits not separated by 6 inches from Class 1E or associated circuits have been analyzed to deaonstrate the adequacy of lesserseparation. The iteas analyzed are:
1. Cemon devices such as relays and con actors for Cl ss IE/Clasp 1E nd lass 1E/non'-Class 1E interfaces. Test report and analyses areavailab e in GE 0 ign Record Files.
~5'F'4
2. Sil-Teay tape as a separation barr er. he tes report and analysis is available in GE ORFs.
3. Use of flexible or rigid conduigs a separation barrier. The test report and analysis is available in GE DRFs.
Justification of separation less than six inches between saoke detector, its wiring and Class 1E wiring is available in GE DRFs.
Coeaon devices are also covered under the response to guestion 421.13. Sil-Teep.tape and flexible conduit are covered under the responseto guestion 430.23.
5. NS panels P606, P608 and P633 are exceptions to RG 1.75.
6. Justification of running bare cable along with a conduit is available in GE ORF's.u W
7. Justification of separation of less than 1" between redundant enclosed raceways and between barriers sa raceways are available in GE
DRF's.
8. Pre~ired vendor equipaent that does not sect color coding is identified in GE specification.
9. Use of cable connector housing as an acceptable separation barrier is available in GE ORF's.
BAH:ra/A08302e-58/30/84
IEEE 384"74 CRITERIA
NINE NILE P FSAR
SEPARATION E LUATIONQUESTION 421. 47
REGULATORY GUIDE 1.75 REV. 1 DESIGN CONFORHANCE
REGULATORY POSITION PGCC BOP
10. Justification of separation of less than six inches between utility devices and its wiring and Class 1E siring is available in GE DRF's.
11. All analyses/)ustification for any exceptions are documented in GE DRF's and are available on request.
BAH:na/A08302e-68/30/84
2