· ac-regulatory information distribution system (rids) accession nbr g 8409140165 „doc ~ date:...

AC-

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR g 8409140165 „DOC ~ DATE: 84/09/13 NOT'ARI'ZEDS YES, DOCKETFACIL:50 410 Nine= Mile Point Nuclear Station< Unit 2i Niagara Moha 05000410

AUTH,NAME AUTHOR AFFILIATIONMANGANiC,VN . Niagara Mohawk Power Corp,

RECIP ~ NAME~ RECIPIENT AFFILIATIONSCHNENCER i A, Licensing Branch 2

SUBJECT: Forwards responses to SER Open Items 421 3i4i lOF 13F15F18y20»23<25i27g28i34i36i37,42i43»44 L 47ito aid in NRC revi,ew ofapplication for license; Info will be included in next'SARamend ~

DISTRIBUTION CODEF B001D COPIES RECEIVED:LTR .ENCL SIZE':TITLE': Licensing Submittal: PSAR/FSAR Amdts 8 Related Correspondence

INOTES:FNL icy FSAR'S & AMDTS ONLY, LleasW@l Glk. 05000410

RECIPIENTID CODE/NAME

NRR/DL/ADLNRR LB2 LA

INTERNAL; ADM/LFMBIE FILE"IE'/DEPER/IRB 35NRR/DE/AEABNRR/DE/EHEBNRR/DE/GB 28NRR/DE/MTEB 17NRR/DE/SGEB 25NRR/DHFS/LQB

32'RR/DL/SSPB

NRR/DSI/ASBNRR/DSI/CSB 09NRR/DS I/METB 12"N .L/ B 22R F1 04

M I/MIB

EXTERNAL) ACRS 4$DMB/DSS (AMDTS)LPDR 03NSIC 05

NOTES'OPIES

LTTR ENCL'

1

1

1

1

1

21

1

1

1

1

1c

1

1

1

1

1'»

RECIPIENTID CODE/NAME

NRR LB2 BCHAUGHEYFM 01

ELD/HDS3IE/DEPER/EPB 36IE/DQASIP/9 AB21NRR/DE/CEO 11NRR/DE/EQB 13NRR/DE/MEB 18NRR/DE/SAB 24NRR/DHFS/HFEB40NRR/DHFS/PSRBNRR/DS I/AEB 26NRR/DSI/CPB 10NRR/DS I/ICSB 16NRR/DS I/PSB 19NRR/DS I/RSB '23RGN1

BNL(AMDTS ONLY)FERA REP DIV 39NRC PDR 02NTIS

COPIESLTTR ENCL

,1 01 1

1

31

1

21

1

1 1

1

1

1

1

3

1 1»

1 1.

"TOTAL NUMBER OF COPIES REQUIRED: LTTR 55 ENCL

I

~ 01 ~ rr

I'~Ii

~'ll j' " '9 rV -(fV

(f'I

I'e(fj« ',ll li I ll(

~rI,,r' r~

( 4" 4')<

,f

~ S (f

l)r,

f j'x 'v v

It

~ 4

~ I'( I

«j,jj l 1jg

I

'4 )jrf, 4 4

f fr(,

«4 t)I

r1

3r'«V

' "Ijf' fr

«'( '1

8 1

1 lj, Q ( r$

ji

f,'VrS4'f

1

$ jv

v)I''f, 1

~ (I

a(

ijj II

lire "'

f( " '» ") J ifjf

«Ijg«r«'I

Yi

II ~,'[ jl, ji

~ 1('l s

4

Ij

rvvif,i

«Iv lf Ij«g ) ',ij I

I'.(, '

f(1v

('f )X

l«" 'vv l(')v I''l wT

f' 'jv

] (i

] gl )1/i

(') g t,,i

I'

l ""

(«

(, li

v

(1-If( 'VV

,I«j y

4

I,'' '(v lj

il iv

tf ) '1

"(v 4 v„

',

I

(g

A) I

.Tf

«()'f

'v«i«)I«

«

4 ., «))X

t «

V MIIASAIRA9 PgQO@g~g

NIAGARAMOHAWKPOWER CORPORATION/300 ERIE BOULEVARDWEST, SYRACUSE, N.Y. 13202/TELEPHONE (315) 474-1511

September 13, 1984(NMP2L 0152)

Mr. A. Schwencer, ChiefLicensing Branch No. 2U.S. Nuclear RecpQatory ConmissionWashington, D.C. 20555

Re: Nine Mile Point Unit 2Docket No. 50-410

Dear Mr. Schwencer:4

Enclosed for your use and information are the Nine Mile Point Unit 2responses to the Nuclear RecpQatory CoIImission's Safety Evaluation Reportopen items. This information has been previously discussed with your staffand is submitted to aid your review of the Unit 2 licence application forthe resolution of these open items. This information includes SafetyEvaluation Report open items 421.3, 421.4 421.10, 421.13, 421.15, 421.18,421 20 I 421 23'21 25I 421 27 421 28 g 421 34 g 421 36 g 421 37 '21 42 g

421.43, 421.44, 421.47.

The enclosed will be included in the next Final Safety Analysis ReportAaendrrent.

Very truly yours,

C.V. ManganVice PresidentNuclear Engineering 6 Licensing

NRL-gaEnclosurexc: Project File (2)

8<09>aortas se09SSPDR ADOCK 05000410,E' 'DR,', I,I

r

r 1

l

1

UNITED STATES OF AMERICANUCLEAR REGULATORY COMMISSION

In the Matter of

Niagara Mohawk Power Corporation )

(Nine Mile Point Unit 2)

Docket No, 50-410

AFFIDAVIT

C.V. Mangan, being duly sworn, states that he is Vice Presidentof Niagara Mohawk Power Corporation; that he is authorized onthe part of said Corporation to sign and file with the NuclearRegulatory Commission the documents attached hereto; and thatall such documents are true and correct to the best of hisknowledge, information and belief.

Subscribed and sworn to before me, a Notary Public in and thethe State of Maryland and County of Montgomery, this 13 day ofSeptember 1984.

Notary Public in an forMontgomery County, Maryland

My Commission expires:

Nine Mile Point Unit 2 FSAR

QUESTION F421.3 (7.1, 7.2, 7.3, 7.4, 7.5, 7.6)

Identify any "first-of-a-kind" instruments used in orproviding inputs to safety-related systems. Identify eachapplication of a microprocessor, multiplexer or computersystem where they are in or interface with safety-relatedsystems.

RESPONSE

Per k>~.The Unit 2 transient analysis recording system utilizes thevalidyne remote signal multiplexer, MC3TOAD-Q2, to provide'solation of lE signals from non-1E equipment. Themultiplexer unit a d associated plug-in signal conditioningmodules provide he signal conditioning, multiplexing, andA/ conversion to rocess and transmit up to 32 channels ofnput data.

The following components describe the multiplexer and itsassociated components:

1. 10

1. 12, 1.14

1.15

1.16

1.18

1.201.211.22

1.23

1.25

.1.2.3.

5.6.7.8.9.

10.

MC370AD-Q2AB295,-Q2AD296-Q2PS294-Q2PS171-Q2PS324-Q2CD173-Q2BA332-Q2BA332-150-Q2DI338-24-Q2

Remote multiplexer/module caseAna1og multiplexer boardA/D converter hoardMultiplexer/AID power supply brandSignal/conditioning power, supplyRemote DC power supplyHigh gain carrier demodulatorBuffer amplifierBuffer amplifierDigital encoder plug-in module

1.281.291.301.311.321.331.341.351.361.37

KESIM Kaman safety radiation monitoring:system isolation module provideselectrical isolation between theserial data lines of the Class 1Edata acquisition units and thenon-lE redundant microcomputers.

For details of testing against EMI, short circuit failures,voltage faults and/or surges, and the summary of performancecharacte ristics, see the Environmental Qualificationdocument. p gs ~~„,.g ~g Pei F i~s ~~ cc ~I'~c I +i~~]~

Pace 6» g g< @~A fi] P(Lg P ~seg~4» ~ ay~The Unit. 2 digital radiation monitoring system (DRMS)supplied by Kaman Instrumentation provides isolation of lEdigital, analog, and communication signals from non-1Eequipment.

The following modules describe the DRMS isolators.

1.401.41

iS

l.43

1.45

1. 47

1.50

.1.51

Amendment 9 .QEcR F421 ~ 3-1 March 1984

ch1217718fqr9c 02/06/84 112

NOR 8u091u0165u10 Nine Vii 1 i


2. KEI-D

3 . KEI "A

Kaman digital isolation moduleprovides isolation between theClass 1E and non-1E digital signals.

Kaman analog isolation moduleprovides isolation between theClass 1E and non-1E analog signals.

1.54

1.57

For details of testing against EMI, short circuit failures,voltage faults and/or surges, and the summary of performancecharacteristics, see the Environmental Qualificationdocument.

2.12.22.3

gPKPg .~va /3wa~ p~w~nJ ~ ~PS'6N~ ~Wg~ibD-y'~''os)-a+4E mR rh'a bawdy. 7M5'.,a</~~ ~~ .p~ g~s w4-s a~an W~mur~M~ ~+@& + 'u'~rwlc~zd~- ~h V~/bh9pros&+ - +eW Wb:5'ew

W4'~~~~~a+~ p ever w ww::i wazw r ~tw~~ /ur~su+w~P st~~~; Y-~srPvip.c Flo&s 5g~w/EP *~0~ /4'c'4 4'5'Iorv

pgppy y~~pe+Aa Luu.< /w WM7~ .gNv'r~Fr@, gy rgb c~~. 7+rs rarr uzi~8K Roe /u Tee k'&vb~w ~ ShSP w~W'~4<i=8.uidwaer 'c u~wacp-ap ~~8 oPaMrro~44.

Amendment 9 QEcR F421.3-2 March 1984

chl217718fqr9c 02/06/84 112

s'EST ~~DFSc 8LH75g

i 4E ~M~gv'Wt~p<,~>r~p gyes ~d~r ~iy~> Oa~ry ~cg~i~grSM?Z.W Comsm~~~F M<~~EEcW<V~om~~mcZED c,a~Ps:

P CPPZZZZP ZZLLLIZPPPLLP~ IL ~ I

A'tran>gg,

d~lkfPLIILLZP~ZPLLL2 Ef LP~oPPP~PZPddd

N Z'.Pdd E

~ACIIIZLLZ.:rbY 'S

M~l70+ .

PZZP—~LZKZZILZZZ~ZZ~D~PP fff~d

~CiPr8% Cdn/&DP2vs ~

LZ PPZLZoNPEL ZZLPZPZ~.PP

P LLZfdlLZZZZLI~ILP.ZLZ'LSZZ l~/ 222~~PZ CIPLMZ.~dl~W.~MLLLZiZZ~~~af-~P—ZPP~ P PPPNLZPILZ.. ~— uLPLZIWZPILZZLL IP~ECLZLP LE~..PLL~—'~~~~PLLJIPLZ PZ dd.,. d'-

Lo&TZD /> irh ~WAA'L.

A'7ZD~Q(LCI~M'~hf~~.~fg(/C'6Q AFiBDLWCrfVSMELsYSifiiA~7 PF< rVOIV-g<~S ~c C iCCC+WLZSPPOK'7OES ~i&VIZu-CWTiVZ Low/XRO< d S +VAc.~~/ F~~

~8lB~MCESBW&~lttDYS(w~ C.DPS)~ ~s ~mac ~s'OCAI'L g

~HEM/M<~~E'NMf@~<(8SY52EMD85)~.MJ C.a~WuNdc29Z

~lych' CCA.SS M~8 ua~WWWuW~ Cpu)<%7RL~VK~CC/./e'CCum&c~~ ~Zd~MuVÃY~<> ~H DR.eR

eee/cess///c ooe-o/sm/sCo&ss ~see/e/oe~csa~asze~~~~y~~ RCC/„ul~9 gv' Th& OETR

on/S

// e/ee/seoees~</~o/Bs/~ca~i TTae~u~~~ >~Ski'KMKwEMw~~md~~

'5'3~Ã~mVW~65SM~ Cu..osaM~

d- - ~&MBA

o~ z//~.esse/s os*. Mo.

CRCu)M~i~ LC~/~wSua C EORMS'~)

e'/e///sess ~ ssso~ Q.~P

/s/ m //o s C'sou>

C~~W M~~~T'gQZa~i~rL~~r~~~~25 y+K5 A ~~gf<MEED

~c=Z~*~ ~~~~d~~l~'~~~~'~~&~mmo. /e o/e if+WiY..AM+~o~

L2onlwoR>pc 6R&s3~00er.E's MKwo <Da'pE.~Oe='CcrySs W~SocMDoW~O ZFE ORTS. lA)Cc~/.n.l~ SDBSgq~~ra

ZOP&), /Phoo/ ~D..L?i c~ye. /~D/'ÃDAs . R~> FK> <lro&P '///.8'use.ReCanCmC .uN'rr CHC<) Ou lu...is wZo~

. ~//e /Jo / c/A es~/ess-ooes ~/M~L/o/osso/ooe/ee,'~V~S

'IS//& C.8'DDE J ~P'ZA'IA'LASS~~.. ~<MEZS'dltlCH mg///'/'TCl/'-

\

~ ~~ — rs cw. err v~avem.

HOTEG AUG 1-g ~ps< H.PNSM;a.

2A CI IA Al

dCFS'J~'a'>-Cdm

v P'f U 8

~~i'5 Aom

~CA

~ C~Ad g~~u'

.s

CZc/

i'~n ~ %

J W. rt'~

5' - w ~ e. /ock4fADAdes /~Aft'f&~APu4i CngjI~J k gE ~

P ~ ~ ~ ~ ~

jt-ssdci~cd ~'PJj dg ~~cJ'a

jg~<&uL/~.~ I

it. j$0jiffu/" W (d~wd~ico /id'~IJ ~

ch~~~ef fi4r~ j4 Etna ja Q 8jJ (g~~ ~

-g r<>~sc ~e ~~ ~~„gi ./'gg ~~8v~G

~, ~ A

~ y

M 0 IAAFOtrfIOrvrer

COVSOICS

~ATA FAoct5511145005151cJIcows>

VVI VIV

ocr511I

CAV

ltslc~ IOW~SOI I

air

5rvfrr scAVI

NSTIArslACT/OIAD

golCPV

IrsrcvIOrrIVI

VV1 1I

Of»offIwivrIAS

NTIfirVATou vu rvot1

AIANNIDATADITJIAT sotsrlrcvIADDSI~

CATCOOIITt DVITSIjI5

fr@PAL A VolcANvcrs wi10A»IIIIAATCO»IVVIVV115 IACVSS

5AVS

VITAACDVISIno»5045flft»IOASI

IrncALelf ctovf t

DA» VIV ILIVI VAV VIII VIV

I ~

~14

AACrAf1'cfccf104

SVO 5 f5 TEVIAOSI CA

rt AAu ITlt v0»trvAC

CALI

TTPf4l Hg CATVVP

frpICA CAftt0CALS CAr.l CA1, ALC

TTPICAL VON CAfttVNT2 40»IIVVS

RSVVC t 5

~ ~

sfsrtAI corfncvvArfcsvFov AIAIp

D noae I'ONE 2-I

'

Ge/9o

NINE MILE POINT 2 FSAR

OUESTION

421.3

7.3I

7.S)7.6)

Identify any "first-of-a-kind" instruments used in orproviding inputs to safety-related systems. Identify'eachapplication of a mircroprocessor,.multiplexer or..computersystem where they are in or interface with safety-relatedsystems.

P

RESONSE

hiss) There are no "first of-a -k<-nd" instruments ued $ n or provSdfng

'nputs to safety-related systems.

2) Microprocessors are used as an integral part of.the RedundantReactivity Control System (RRCS). Four microprocessors(2/division) receive input signals, (e.g. low water level, high

.dome pressure, APRM downscale), process them against a time base.formula, and generate output signals (e.g. ARI, recirc pump trip,feedwater runback) to other systems. Details of RRCS operation arediscussed in Section (7.6.1.X). In addition to these dataprocessing microprocessors, the RRCS has 4 microprocessors

~

~

~

~2/division) for monitoring power supply status, 2 microprocessors1/division) for assisting in the calibration of RRCS process

instrumentation, and 2 microprocessors (1/division) to performautomatic on-line testing. of the safety related RRCS system.Hardware failures are annunciated and faults localized via use of alocal keyboard/display.

The performance monitoring system (PMS), which interfaces withsafety-related systems, is a non-safety-related system. Isolationof safety-related inputs to the PMS is shown functionally in the

-- logic diagrams and elementary diagrams listed in Table 1.7-1 andprovided to the NRC.

KC:pes:pc/1188-3.24/26/84

Nine Mile Point Unit 2 FSAR(g cj

QUESTION F421.4 (7.1, 7.2, 7.3, 7.4, 7.5, 7.6) 1.10

Section 7.1.2.3 of the FSAR provides a brief discussion on 1.11- conformance to Reg. CQide 1.47. Discuss in detail the 1.13

design of the bypassed and inoperable statue indication 1.14using detailed achamacica. Include Cho following 1. 15information in the discussion:

1. Compliance vith the recommendations of Reg. Guide 1.47 1. 17and Reg. Guide 1.22 Position D.3a and 3b; 1. 18

2. The design philosophy used in the selection of 1.19equipment/systems to be monitored, incand support ayatama.

uding auxiliary 1. 201.21

g YPindication ayatama comply with Positions Bl through B6 1.23of ICSB Branch Technical Position 21. 1.24

3. How the desi n of the b ass and noperabla status 1.22

4. The list. of system automatic and manual bypasses aa it 1.25pertains to the recommendations of Reg. Guide 1.47. 1.26

5. Discuss .hardware features- employed Co provide a 1.27consolidated, human factored, display of the bypassed 1.28and inoperable status of ESF equipment. 1.29

RESPONSE o 1.31,p .

g f gaa~hK1. Refer to er for degrees of compliance<'+ ~S~ "f1.33

2. Automatic bypassed and inoperable status indication iaprovided for all systems that affect, plant safety. ,Thisindication system accompanies any operational procedurefor all safety-related systems.

1.341.36

Any deliberate action vhich makes a support systeminoperable and also inhibits the proper function of adependant safety system will a'iso be automaticallyindicated.

Q&R F421.4-1CIMl I~~

~r - -

~r tha

is .annunciated (component evel). In thisgroup, e equipment Chat when bypassed causes a systemto be defeated, will contribute to its respective systemlevel annunciator and indicate a bypassed systemcondition. If a system is declared inoperable, vhetherit be a redundant portion of a system or a total system,and also supports other systems, the bypassed andinoperable indication vill cascade into the dependent~p 4Jc~5

Amendment. 9 March 1984

1.381.39

1. 401. 41~1.42 ~1. 43

1. 441. 45

1. 46

chl21771 02/06/84 112

I i~~g+5 pic I~+ +4l dE/w gg/rC C

ac~> n <yiiWcu a~el ruoi'ckR ae ~rSm'5'vcX><~<lCyPf 8+pz ogg. ~rqzg v>/c vo W SVS >u(/CAcrPr.aJ 4 pr y~'/ nyi 8N //

qu/JIC I"rica rAJrr g 9c PKoeIOzg>AT

~ iI+

+MAvcJQ

c Iri4 OF yh'E' YyR C> 8~0 raori6&+g

~~ A~~1.I~QIC 4riNI C pe~ ~ ++~ ~Oi(yg/~

I>odirro& ~wag - g / AC

D'/ )4~S n . ~c ~gg+iirrggZcy~>r!ewe'4 r~ reve~ ass-.y'+r-.~~IC ~ ~CW~reer'a~.

~r~g

rcpt

Rag ivo~/)~ 7irrcIc IiJDi<irrioiJ 0 >< Y h~ggrg iI~gC'Wg ~ +PROC'AP Ah/~ C ill 7+ QAAJCAVC. 4 P

~pPg 844rg iir7'Od C C. IIWIiiAld'rji

~—,4S . CO~~ a r i~~ ZrPR<S r~Qr.seZC'we. /~~6c< ~

MrrHIAJ

S~8u~ ~~ gtr g~ <a W a<Olcru&WOr-.

COCA~ ~ I l&~rAFT~rri AJOVE w~~ ~~~At~/ JBIC8VM . War4r p ~)Th'i< ~h Z ~84'4)/RG +8+ 7 AVAJA/J$ 7CQ

y-EH g c g /~i g P~Zg4 sr~ jyu~~/gWi~4 ~S /vs>Zcrud.:

Sg TEE Qe&c,~ oI .%K P6 r'Ms'ud ieoPaQA'Ecw- ~vu <

w rrcvV ~ ~ ~r~ >wc.c. iMdrcA~ arA~ ~A&vr~iRg—vc~ A QraC < j g gar R<6 ~FF~~ uIr~cnd

&cern~~ r 5 ~GE~ /~~4gCCc~I,g~ ~y ~~ i~RW~A ZfX~gW4~D~

G. MMhTOM gT'Jo. rid E

p/qg ~~ irurJo~r) y&. cue+H84dAC In]OP~i/6r P'9 FWCri'W( la'8rrCH S Paar

Re g)r/o4 KUwvrnQp 72V+7 Zo <or P>+< +iJggg47H47VC (o g(CrP77OAJ wd97'QJ~Q gCRiIJ 'ZE'i'yiYR P rim / C7)

-~au&~ +i

rM7 o+ wa. N0p~g y~o i~mt~ meAcciu3(<8yro~ S 4 S~ y- ~ gic3 reed'p~ag iN 7' eever +i<~WE M&'8&ci~ oa 4 ~~iCuA ucA4 Xf.<ra+ w)/r~6v~rM ~c.„~ «s caeg gu y gawewLc. ~oiM=vruhls ~dr w8vI~~~~ A P~~Ct(VW ~Iig~r ~ i y~~F~irI/~~

1A'4' pcprpirc+ y + gQ i~'45 $ $JprYAhz) A~ri IM~H~gQ


21'.. 22

23.24

die f Il~i 4f ofs s~g ~ p ~,~~g~Q I '+3$ <'n $4VoLlC

SystemMnemonic

ADS

BYS

Re uirements

Automatic De ressurizati

Battery System

4S stem VDC

2. 35K.2.36

-'ÃI~P.38+2.3~? 41

. CCP

CPS

CSH

CSK

DER

EGA

EGF

Reactor Building Closed l.oop Cooling Mater(Component Eevel'nly)Containment Atmosphere Monitoring

Primary Containment Purge (Component fevelOnly)

High Pressure. Core Spray - Power Supply

l,ow Pressure Core Spray

Reactor Building Equipment Drains (Componentf,evel Only)

Standby Diesel Generator Air Startup

Standby Diesel Generator Fuel

2.522.53

2.55

2.572.58

3.2

3.4

3.63.7

3.9

3.11

EGP Standby Diesel Generator Protection (Breaker) 3.13

EGS

EJS

ENS

Standby Diesel Generator Protection(Generator)

Standby Station Service Substation

Standby Station Service Supply Breakers

3.153.16

3.18

3.20

Amendment 9 QER F421. 4-3 March 1984

chl217718f qr9d 02/06/84 112


SystemMnemonic

S stems Containin B assed Ino erableRe uirements

Fire Protection - Water (Component Level Only) 3.22

GTS

HCS

Feedwater System (Component Level Only)

Standby Gas Treatment

COL Hydrogen Recombiner

Control Building Air Conditioning

Control Building Chilled Water

3.26

3.28

3.30

3.32

IAS

MSS

Standby Diesel Generator Building Ventilation 3.34iReactor Building Uentilation (CO Qg+l 4h .36

Yard struoture ventilation (tdenen+ Qrt[ onl4$ 3.38

Instrument Air (Component Ievel Only) 3.40

Main Steam (Component Level Only) -.. .3.42

SFC

SWP

WCS

5.

Residual Heat Removaleisa~

Fuel Pool Cooling andn Service Water

Reactor Water Cleanup (Component Level Only)~l

It is not a requirement of Regulatory Guide 1.47 thatthe bypassed and inoperable status indication system beClass 1E. However, the control circuit wiring isassociated with the Class lE components and is designedin accordance vith Class 1E requirements. Opticalisolation vill be employed to separate the annunciator,which is a non-Class lE circuit, from the bypassed andinoperable logic circuits.The component level inoperability vill be displayedusing master specialty svitch-light units vithin theirrespective operating area on the control panel.

The system=level indicators used are the standard plantannunciator vindovs separated into divisions ifapplicable. At the systcru level, the indicators will beaccompanied by an audible alarm. All bypassed and

3.44

3.46

3.48

3.50

3.573.584.14.2

'.3

4.64.7

4.84.94.104.11

Amendment, 9 QEcR F421.4-4 March 1984

chl217718fqr9d 02/06/84 112

inoperable


status indication has ga er illuminatio~

Amendment 9 @BR F421.4-5 March 1984

chl217718fqr9d 02/06/84 112


QUESTION F421.10 (7.1)

Section 1.10 of the FSAR provides a response to NUREG-0737.The discussion on item II.D.3 does not mention alarmsassociated with the valve position indication. Confirm thatalarms are provided zn conjunction with the positionmonitoring system. The discussions on items II '.3.13,II.K.3.21 and II.K.3.22 briefly address modifications thatwill be made to the RCIC and HPCS systems. Provide adetailed discussion on the design modifications proposed forthese systems. Use one-line diagrams and other drawings asappropriate.

RESPONSE

See revised Section 1.10 for Item II.D.3.TMI Item II.K.3.13 resulted in the-modification of the RCICsystem to allow automatic restart after RCIC system shutdowndue to high water level (Level 8) signal. Instead oftripping the RCIC turbine which required operator action toallow restart of the system, RCIC steam supply valveE51-F045 is closed, shutting down RCIC turbine/pumpoperation. Four separate transmitter/trip units energizeindividual relays, arranged in a one-out-of-two-twice logicconfiguration, to provide the closure signal for the valveF045. If the water level falls to Level 2, the systeminitiation logic will reopen the steam supply valve,restarting RCIC operation.

See revised Section 1.10 for Item II.K.3.21.TMI Item II.K.3'2 resulted in the modification of the RCICsystem to allow automatic switchover of pump suction fromthe condensate storage tank to the suppression pool if thecondensate storage tank falls to a preset low level. Lowlevel in the tank is monitored by two redundant leveltransmitters. If either transmitter senses low level, pumpsuction is automatically transferred to the suppressionpool. These are different transmitters/trip units fromthose that activate switchover for the HPCS system. Thecondensate storage tank suction valve will be signaled toclose upon opening of the suppression pool suction valve.The RCIC elementary (Drawing No. 807E173TY, Rev. 14) showsthe circuitry details.The PSID and elementary diagram will be revised to reflect arelocation of the transmitter to the pump suction line.

Se ~<scil- Amendment 10

e.Mg+ J.QEcR F421. 10-1 April 1984

Wc Mgcthe length of time the

operator will be required ocr hold the RCIC initiation button in adepressed condition to assure injection into the reactor. The concernis that if the manual initiation button is depressed only momentarilythe opening of the RCIC injection valve will not be sealed in andreactor injection will not occur. The NRC has recently indicated thathey feel this design may not satisfy IEEE-279, Paragraph 4.16, whichrequires the s stem corn

The logic for the RCIC injection valve E51-F013 is shown in Attachment1. Contacts of relays K3, K20, and K40 must all be closed for F013 toopen in response to a manual initiation signal or a low reactor waterlevel 2 signal. Relay K3 is a momentary contact relay which isenergized when the manual initiation button is depressed or when reactorwater level is below Level 2. Relay K20 is energized when the turbinetrip and throttle valve is partially or fully open. Since the trip andthrottle valve is open during system standby the contacts of relay K20will already be closed when RCIC is started. Relay K40 is energizedwhen the steam admission valve E51-F045 is fully closed. Since F045 isclosed when the system is on standby the contacts of K40 are open atthat time.

Given this logic, to manually initiate RCIC and assure the injectionvalve opening is sealed in, the operator must maintain the initiationswitch in a depressed condition until valve F045 comes off its seatcausing closure of relay K40 contacts. A red-valve position indicatinglight ill inform the operator when F045 has started to open. At thist m he initiation switch can be released since the seal-in circuit inthe MCC for valve F013 will now drive it to the full open position.

gd gJ

e0. ~

Limit switch LS6 energizes relay K40 when valve F045 is fully closed.Depending on the adjustment of this limit switch, it is not expected totake more than 1-2 seconds for relay K40 to be deenergized and itscontacts closed when F045 starts to open. This is the time required forthe operator to hold the initiation button down to assure vesselinjection.

As explained in the above the contacts of relay K3 in the initiationlogic have to be closed only 1 to 2 seconds before the injection valveopening logic is sealed in for automatic initiation. For an actualtransient event requiring the RCIC system (i.e., loss of feedwaterevents) reactor ~ater level will be below the initiation level for wellover this time required to seal-in the injection valve logic, sincewater level will not begin to recover until the RCIC and/or HPCS isinitiated. It is GE's position that this meets the intent of IEEE-279in that the RCIC system initiation will go to completion when

required'orit to perform its safety function. A momentary Level 2 lasting lessthat 1 to 2 seconds is considered very unlikely and could only occur iffeedwater flow is reestablished in time to reverse the water Mvel drop.In this case it would be preferable not to initiate RCIC, therebyavoiding injection of cold water into the reactor.

In conclusion, GE considers the current RCIC design to be adequate andthat it satisfies IEEE-279, Paragraph 4.16. Requiring the operator tohold the button for 1 to 2 seconds for a manual start does not impose a

hardship on the operator. Normally, on a manual start the operator willstay with RCIC for at least 30 seconds or more to verify turbine speed,flow and valve positions. Operating procedures will include aprecaution statement for the operator to ensure that he holds the manualinitiation switch/button for RCIC until the valve position indicatorshows the valve is opening.

~ 1~ ~


~ ~ ~ ~ ~ ~QUESTION F421.13 (7.1, 7.2, 7.3, 7.4, 7.5, 7-6)

Various instrumentation and control system circuits in thep?ant rely on certain devices to provide electricalisolation capability in order to maintain the independencebetween redundant safety-related circuits and betweensafety-related circuits and nonsafety-related circuits.Provide the following information:

1.10

l. 12l.131.141.151.161.17

(1) Identify the types of isolation devices which are usedas boundaries to isolate nonsafety-related circuits fromthe safety-related circuits or to iso)ate redundantsa foty-re 1atod ci rcui ts.

1.)91.201.211.22

(2) Provide a summary of the performance characteristics 1.24from the purchase specifications for each isolation 1.25dovico idantified in rosponao to part (1) above. 1.26

(3) Describe the, type of testing that was conducted on theisolation devices to ensure adequate protection againstthe effects of electromagnetic interference, short-circuit failures (line to lihe to ground), voltagefaults, and/or surges.

1.281.291.301.31

1.33RESPONSE

Fc r. SOP

) The following list identifies the types of isolation devicesthat are used to isolate nonsafety-related circuits from thesafety-related circuits or to isolate redundant safety-related circuits.

1. CE optical isolatorsr

2. Potter and Brumfield MDR relays3. Valedyne multiplexers (MC37OAD-QE)

4. Kaman Industries isolation devices

KESIMS (serial data line communicationisolator)~ b. KEI-D (digi ta 1 iso lati on module)

IC. KEI-A analog isolation module)9-&&7

a

421.13

Insert

Each type of device used to accomplish electrical isolation is tested

to demonstrate isolation capability under maximum credible fault conditions.

These tests verify that the maximum voltage/current to which the device

could be exposed within the panel/cabinet will not jeapordize the integ-

rity of the class lE circuits. In addition, it will be shown that any

destructive effects caused by application of the worst creditable fault

will not jeapordize the function of any redundent divisional circuits

or devices in physical proximity to the failed device. All isolation

devices comply with environmental qualifications (10CFR50.49) and seismic

qualifications requirements which are the bases for plant licensing.

0

~ NINE MILE POINT 2 FSAR

UESTION

421. 137.17.27.37.47.57.6

Various instrumentation and control system circuits in the plantrely on certain devices to provide electrical isolation capabilityin order to maintain the independence between redundant safety-related circuits and between safety-related circuits and nonsafety-related circuits. Provide the following information:

'1)

Identify the types of isolation devices which are used asboundaries to isolate nonsafety-related circuits from the-safety-related circuits or to isolate redundant safety-relatedcircuits.

4sss

(2) Provide a summary of the performance characteristics from thepurchase specifications for each isolation device identified inresponse to part (1) above.

(3) Oescribe the type of testing that was. conducted on the isolation.= "devices to ensure adequate protection against the effect of

.. electromagnetic interference, short-circuit failures (line to. I.ine to grouhd), voltage faults;. and/or surges.

< ~

RESPONSE

The isolation-'devices used to electrically separate nonessential and essentialcircuits are designed to the guidelines of IEEE 384. Both relay and opticalisolation devices are employed.

The optical isolators use a'fiber-optic light pipe'to electrically separate theinput from the output. For example, an essential logic signal activates a

light emitting diode; the light is transmitted through the light pipe to a

photo switch; and the switch changes state upon receipt of the light signal andeither blocks or transmits. These are the same types of optical >solators usedin other GE plants.

The relay isolation devices provide a functionally equivalent degree. of separa-tion and are used typically for control voltage separation applications, i.e.,120-Vac and 125-Vdc essential to nonessential and redundant essential circuits.The relays are designed and- mounted so that a metal barrier separates the coilfrom the contacts with a mihimum distance of one inch between the coil andbarrier and between the contact and barrier.

The designs of- isolation devices are responsive to the concerns regardingsusceptibility to noise, shorts, surges, and faults. Adverse conditions„affecting the coil or the semiconductor device cannot propagate through theisolation barrier (i.e., metal enclosure or fiber-optic light'ipe). Converse-

ly, adverse conditions affecting the contacts or receivinq semiconductor cannotpropagate through the isolating barrier and affect the coil or transmittingsemiconductor. Therefore, essential systems or circuits are electricallyisolated from nonessential and/or redundant systems or circuits.

BAN:rm/A08223"8/30/84

0

NINE NILE POINT 2 FSAR

Summary of Purchase Specification:

A. HDR RELAY

1. Design Specification

a. HIL-R-19523b. Contract Specificationc. Coil Specificationd. Insulation Specificatione., Design Lifef. Reliability

2. Class 1E Safety Function

a. Functional Specificationb. Reli abi 1 ity

h

gualification Testing

Ambient and Desi n Environments

3.

gb; Normal Hountfng

B. -'ISOLATOR'.

Application Data Specification2. Performance Specification3. gualification Testing

a. Tested as a part of panel subassembly

The documents listed above are available for review at the General Electricoffices in San Jose, CA.

The optical isolator comprises semiconductors, resistors, and capacitorsmounted on a printed circuit board. As designed, this device satisfies elec-trical isolation requirements.

The NHP-2 NSSS uses two qenerations of optical isolators to provide isolation/separation between two divisional or divisional and nondivisional circuits.The PGCC uses one generation of isolator cards, and the Redundant ReactivityControl System uses a later generation. The basic difference is that the latergeneration has current-limitsng resistors on its input circuits to more fullyprotect the card from damage due to excessive input signals. Installation inthe panels is the same for both generations. Each is mounted in panel racksdesigned to hold..the input and output cards separated by a 1" quartz rodthrough a ceramic barrier.

Specifications control the type of testing and qualification required on theisolators. The basic difference is that line to line voltage tests (140 VDC

for two minutes and 400 V pulse for one msec.) were performed on the new

generation isolators. Instead of this test, an input circuit 5KV line-to-ground

BAH:rm/A08223"8/30/84


test was performed on the older generation isolators. In either case, subse-

quent .to the test, it was confirmed that there was no degradation of the cardon the other side of the barrier.

Additionally, the RRCS used isolated lamp drivers (card mounted relays) toisolate class lE signals from certain non-class 1E loads (p. g., indicators);As part of its qualification, a 200 VDC line-to-line test across output con-

tacts was performed to determine no degradation will be propagated back to theinput circuit on the card.

Since the same kind of panel enclosures is used for both generations of isola-tors, running the 5KV test on the old generation will be sufficient to confirmthe barrier (dielectric) capability for both generations of isolator cards and

their housing. In addition, since the 5KV test greatly exceeds the voltage tobe applied during the line-to-line test of the new generation cards, it can be

considered equivalent to the test on the new generation cards, with respect tocausing detriment to the cards on the other ssde of the barrier.

The isolator enclosures are designed to hold either four or eight isolatorcards; only cards representing csrcuits from the same division are contained inthe same enclosure.' worse case failure would only cause loss of function toone division; because of built-in redundancies in other divisions, safetyfunctions would not be lost.

Copies of test plans, procedures, and results are on file at GE.

A summary of the qualification test performed on the MDR relay and the opticalisolators are given in Attachments 1 and 2.

An additional test of the optical isolators to verify that they can withstandthe maximum credible voltage applied in the'ransverse mode is being scheduled.This test will verify that the maximum credible voltage applied to the opticalisolator s in the transverse mode will-not be propagated through the quartzbarrier to the other side of the device.

COMMENT TO SMEC/NMPC

SPEC should provide the portion of the response concerning BOP devices used inelectrical isolation. This response should be incorporated into SPEC/NMPC FSAR

revision.

BAM:rm/A08223"8/30/84

-3-

'

k

ATTACHMENT 1 TO QUESTION 421.13SUMMARY OF QUALIFICATION TEST

PERFORMED ON HDR AUXILIARYRELAY

1. GENERAL

Rel ay Manufacturer:Relay Model:GE Drawing:GE Design Record File:

II. FUNCTIONAL TEST

Potter and BrumfieldMDR-4130-1169C9481AOO"901-1

The following tests were performed in the sequence listed.

a. Normal Operation:~ ~

~

~

~

~

~plication of normal coil rating voltage to coil terminals and

o servance of relay contact status change. Repeat test withgradually removing applied voltage.

b. Contact *Current Rating Test:

Application of contact rated load and observance of contact statuschange while relay coil energfzation and deenergization.

c'. Dropout and Pickup Voltage Test:

Gradual decrease and increase of relay coil voltage application,observance of contact status change.

d. Response Time Test:

Energization and deenergization of relay coil and recording of cycletime.

e. Dielectric Strength Test:

Application of appropriate voltage based on Hil Spec R-19523A (1230Vfor 120 VAC nominal, 2375V for 125 VDC nominal, 1265V for 24 VDC

nominal) for one minute between relay coil circuit and relay mainframe.

Acceptance Criteria - Relay shall not short out between coil circuitand contacts or frame during one minute exposure to applied voltage.

f. Typical Test Set-Up (see Figure421.13-1)'II.

SEISMIC TEST

Clutter and contact bounce monitoring in the. energized and* deenergizedstate at different times during seismic excitation.

BAM:pc:rm/L08225*-18/22/84

Rela State NC Contact NO Contact

Oe-energized 9 6.7g

Energized 0 17g

5 msec. max. No transfer of contact

No transfer of contact 2 msec. max.

IV. ENVIRONMENTAL TEST

Exposure to temperature and humidity environment of each extreme andvarious conditions in between and demonstration of relay operation before,during, and after such exposure.

Environmental Exposure

a. 710F~ HC RH

b 55oF'(g RH4loF''Hd. 614F, 35K RH

e 81oF'ly RH

f. 101 P, 65X RH

g. 102 F, 80K RH

h. 119 F 90K'RH

V. CONCLUSION

Test samples successfully demonstrated thatbefore, during, and after the test exposureall functional requirements as specified.

the relay wi.ll functionenvironment. The relay met

BAH:pc:rm/L08225"-28/22/84

~ ~

NUCLKARKNfAQYUSINESS GROUP

SKI)KRAKO KI.KCTRIC 40-901-Ib s~ ~o. II)IK; Qh

TYPICAL RECORDER CO lsiCTIG'.iS

+- Vo1 tage + Voltage

Contact

I Y 6 0)i."Coil

1030 GHN Recorder Recorder

TYPICAL TEST SET-UP'

Voltage

?n$ tietfngDevice ~ ~ ~0

RECC)"DER

RECORDER

Lo ic Rela;

ATTACHMENT 2 TO QUESTION 421.13

SUMMARY OF QUALIFICATION TESTPERFORMED ON OPTICAL ISOLATORS

OEVICE

Field Contact5V Logic Input12V Logic Input5V Logic InputHigh Speed Input.Analog InputAnalog InputFloating Low Level OutputHigh Level Output5V Logic OutputHigh Speed OutputAnalog Output .

Isolator Power SupplyOptical Isolator,Optical Isolator

FUNCTIONAL

TEST'04B6186AAG

004204B6190AAG 003204B6190AAG004204B6190AAG005204B6198AAG002204B6208AAG002204B6208AAG003198B6241AAG003204B6188AAG002204B6194AAG002204B6196AAG002204B6220AAG002198B6203AAG004133D9947G003133D9947G004

The optical isolators were tested to verify that they met the requirementsas specified in 272A8638, Isolator Application Data Information Document.

III. SEISMIC TEST.

The optical isolators were tested using 22A4320 Seismic qualificationProcedure for Class 1E Electrical Equipment Test Specification.

IV. ENVIRONMENTAL EXPOSURE

TEMPERATURE F

137153

70&+ 5 (Ambient)40

RELATIVE HUMIDITY RH

80'0K

50+15% (Ambient)80K

DURATION

100 hrs8 hrs

12 hrs100 hrs

V. HIGH VOLTAGE TEST

A 5KV hi-pot test was; performed on the Isolators to assure that electricalisolation between the input or output will not impair the function ofdevices on the other side of the barrier.

BAM:rm/A08294"-18/29/84

~ ~

VI. DETERMINATION OF TEST VOLTAGE

A generic review of the voltage sources present within the plants utiliz-ing optical isolators indicated that 4160 volts is the maximum voltagethat could conceivably be present. Therefore, a test voltage source of5OOO volts was chosen.

The actual voltages that could be present in a panel are determined by aspecific plant analysis.

VII. CONCLUSION

Test samples successfully demonstrated that the optical isolators willfunction before, during and after the test exposure environment and meetthe qualification requirements of IEEE 323-1971 and IEEE 344-1975. It wasalso demonstrated that electrical isolation is maintained between inputand output.

BAM:rm/AO8294*-28/29/84

TYPICAL TEST CONFIGURATION FOR OPTICAL ISOLATORS

XSo<A,~oK HouS[mg

~~ops>oa Chub S

t" Bra.~i<. ~4r r>e.r

Figure 421.13-2

Figure 421.13-3

~ ~ ~

~ ~

88r28~ 88 14 S8kJ CH3C 2739 2R M3. 881 ( PNine Nile Point Unit 2 FSAR

QUESTSN F421.15 {7.1, 7 ~ 3, 7.7)Tabl» 7.1-2 of the FSAR provides a listing of th» safetyrelated systems simi 1 arity to licensed reactors. Eleven~yscemo are shown to have no similarity. i'or these systemssufficient design details have not been provided to enablethe NRC ataf f to v»rffy con fnnnance to the acceptancecriteria of the Standard R»view Plan (NURRG 0800). For eachof these oyst»ms provid» a detailed comparison of the d»signto the app)icable raquirem»nte and recommendationsdelineated fn Table 7-1 of NUREG-0800. 8pecifical lyidentify and )beatify deviations from thea» provisions.

I

RESPONSE

S» S»ction 7. l, Tabl» 7 ~ I-S for applicability of standards;S»ction 1. 8, 'able 1.6J for D»gree of Compliance toRecclscosy ccidssI sod ssctios 7.1.1.2 soy sppli'cable ~ssection JSs syscew dssccipciop

doe'Beep~~.$*l IS I m Is eT>'V4

>) st~i ~ eyyIy 1 oI

1.12"1.141 '51.161.17le 191.24

X.22

1.27

1.29

hmendment 9 QhR F421.15»1 March 1984

ch1217718fqr9aiII

II

I

02/06/84

E.

r=C. Cur OS DE5'CRtP77onf NWg S~ Wpg Sa- red. mrna rIarwW.

L/euro ROGrorKOVE 4%~~ LHl5~ 5HfP I/.N. 3Ctl58049 Alee/cllv8~ gttS ~OF6. l/.3. 3SOuO afnetCVlyE~~ WSS - I/, V. 4

VOc, IIVoc ~ IIvor-. II

oH sr'terEaeo~~c. tfPtSPWaeArt

Or 9r3 A5-1 -Sr5-<C

er.~Z ee~r PMssce 'co5, LptS8OtuV OILY (r E-lrpl)

8'rA"I —S.k-t

Oveae jm~aw.' sZC~/r 7 us7,f~S '79848"'Ti I"I

VH8LE 7./-gVtatt'. I-3

5INec.K I-/IlurRB CA'Irt'RIII SF'Crorr. ~'TE'c7 nip 5v57Kpf

7iCA.7.3

wkvctlIL xillITIIITloivowPRo&cTIvd 8c roNS

CHS 7. S'2- 7II8LR7~-I

I.73 PAVSICr9I 27VDEP~OEivCE ~ C.ol ~+C~c, SV5va~s

~lr/e/Ino< OF XE swat XE ~csSYSl ert5

7r/rg. SSrB

%RE Xl-5

N~ y. Io/f-ITpg. 3, /red I

M-Aceo6VTPARA<ZrEC gPI=SKT

lrS

IrIOS'l)gI,roc TIIEMWOr/MLOWO Z '.RII.SRe~no~ oF mOmes ~St;mS

tr3rl:7 CFr3 IrloS

wlA

. I.llo FIRE p8OTECTIohlCur OS(.rH~

O.sr!~hr,'Mf tBIvlh

a

REchuppah,

OEScRtp77oH

/rl93 cnesz peePs M~oNPrre&Mrf

)RATSOacuPhOcHht. eeeAl7dV ~u~

ACfP5 cease rts~strv48LV'zrCYg~

s I

a ~

s ~

421.1(7.2)(7. 3)

s the Reactor Protection System (including Reactor Trip and Engineered

,r

8+provide a detailed discussion on the methodology used to es ab'lish

the technical specification trip setpoints and allowable values for

/P(f

Safety Feature .channels) assumed to operate in the FSAR accident and

transient analyses. Include the following information:

(1)

(2)

The trip setpoint and allowable value for the technicalspeci.fications.

The safety limits necessary o protect the integrityof the physical barriers which guard aoainst uncontrolledrelease of radioactivity. The safety limits should bethe limits established for licensing purposes, for examplethe technical specification safety limi s on minimum criticalpower ratio (1.06), and reactor coolant system pressure(1325 psig).

(4)

The values assigned to each component, of the combinedchannel error allowance (e.g., modelino uncertainties,analytical uncertainties, transient overshoot, responsetime, trip unit setting accuracy, test equipment accuracy,primary element accuracy, sensor drift, nominal and harshenvironmental allowances, trip unit driat), the basis forthese values, and the me hod used to sum the individualerrors. Mhere zero is assumed for an error a justificationthat the error is negligible should be provide .

The margin (i.e, the difference be ween the s fety limii andthe setpoint less the combined channel error allowanc ).

Identify any trip for which the setpoint and allowable valuein the technical specifications will be assigned bes- estimatevalues and for which you do not have an analysis of errors and/or uncertainties to confim that the trip function will occurbefore the actual value of the measured parameter exc ds thatassumed in the plant safety analysis. Provide justificationfor this nonanalytical aporoach.

Res e~ st

t Q|'.6 S

J- cAy~ g~ Cs ~4.

'V/w4~~ g) 2 / C +re4 v++a ~ ~A

NINE IlILE POINT 2 FSAR

4FI4!

QUESTION

421. 20(7. 2)(7-3)(7.a)

Operating reactor experience indicates that a number offailures have occurred in BWR reactor vessel level sensinglines and that in most cases the failures have resulted inerroneously high reactor vessel level indication. For BWRs,cownon sensing lines are used for feedwater control and as thebasis for establishing vessel level channel trips for one ormore of the protective functions (reactor scram, HSIV closure,RCIC, LPCI, ADS or HPCS initiation). Failures in such sensinglines may cause a reduction in feedwater flow and consequentialdefect of a trip within the related protective channel.

If an additional failure, perhaps of electrical nature, isassumed in a protective channel not dependent on the failedsensing line, protective action may not occur or may be delayedlong enough to result in unacceptable consequences. Thisdepends on the logic for combining channel trips to achieveprotective actions.

Identify each case where a reactor vessel water level tap orsensing line failure concurrent with an additional randomsingle electrical failure induces a transient and precludes theautomatic operation of reactor scram and/or engineered safetyfeature system. For 'each case identified provide an. evaluationwhich demonstrates how the redundancy or diversity of the plantdesign provides for reactor scram or safety system operationwithin acceptable limits. Where manual action is required bythe operators discuss the instrumentation and time availablefor the operator to take such corrective action.

To reduce the consequences of sensing line failures in combinationwith a single failure in a protection channel not dependent onthe failed sensing line, a modification of the protectionsystem logic may be required. Logic configurations which maybe considered for NRC approal on this plant are described inthe BWR owners group study entitled "Review. of BWR ReactorVessel Mater Level Measurement Systems", SLI-8211, prepared by.S. Levy Inc.

RESPONSE

A postulated break in an instrument line plus an additional failure isbeyond the design basis for this plant; however, an assessment of plantresponse to this event has been performed on the basis of the followingmethodolo'gy and assumptions.

Nethodolo

Determine the logic for combining channel trips to achieveprotective actions.

KC: pc/L01262"-14/27/84


4&Sf

2. Identify each case where a reactor vessel water level tap orsensing line failure concurrent with an additional randomsingle electrical failure induces a transient and precludes theautomatic operation of a reactor protection and/or an engineeredsafety feature (ESF) system.

3. For each case identified, demonstrate how the redundancy ordiversity of the plant design provides the reactor.protectionor ESF system operation within acceptable lfafts. For theworst failure combination scenarios, perform transient analysesto demonstrate that plant safety fs not compromised.

Assum tfons

Instrument reference line failure (break)Single electrical device failure (no power supply failure)ARI operableNo operator action.

A review of various failure combinations resulted fn the identificationof the worst postulated failure path as the failure of division 1 instrumentsreference leg line (f.e., connected to condensing chamber B21-D004A)combined with a failure 4high" of B21-NOBOC.

The manual selection switch for feedwater. controller is assumed to beonthe failed instrument line, and the operator fs assumed not to switchcontrol to the other instrument. line as would be expected. This causesthe feedwater controller to respond to the high water level error signalby reducing the feedwater flow. Following the loss of feedwater, waterlevel will decrease to level 4 initiating a low water level alarm. Waterlevel vill further decrease to level 3 initiating a second low waterlevel alarm, and reactor scram vill not occur due to the assumed failure.When water level decreases to lev'el 2, a third low water level alarm wfllbe initiated, reactor scram will occur due to Alternate Rod Insertion(ARI). RCIC system vill automatically start, and both recirculationpumps will trip.'PCS system fs unavailable (tripped) due to the assumedfaf lure.

The core thermal hydraulic analysis using the REDY transient code showsthat the water level inside the shroud drops to a minimum of 1.9 feetabove the top of the active fuel at 1436 seconds and slowly rises thereafter.Since the core remains covered throughout the transient, no core heatupfs expected.

Note: The justification of 'Assumption 2 fs as follows:

Section 4.4.3 of BWROG-8253, "BWR Owners Group Reactor Vessel Water LevelMeasurement System Report," from T. J. Dente (BWROG) to H. R. Denton(NRC), dated August 13, 1982, stated: "...the ATMS events...indicatethat mechanical failures, not instrument failures, fn the system...arethe largest contributor to core melt.. Events involving electricalfailure, which included instrument failures, are less than O.lX of thetotal core melt frequency."

KC: pc/L01262*-24/27/84


UESTION 421. 23~ f ~ $ ~ j 705)

Provide an evaluation of the effects of high temperatures on reference legs ofwater level measurinq instruments subsequent to high energy line breaks,including the potent>al for reference leg flashing)boil-o f, the indication/annunciation available to alert the control room operator of erroneously highvessel level indications resulting from high temperatures, and the effects onsafety systems actuation (e.g., delays).

RESPONSE:

High drywell temperature does not significantly affect measured reactor waterlevel when reactor pressure is greater than the saturation pressure of water inthe water level sensing lines because the vertical drop of the wide range,narrow range and fuel zone range reference and variable leg sensing lines inthe drywell are approximately equal. The water level indication is not affect-ed because the comparable vertical drops of the reference and variable legsensing lines in the drywell result in nearly equal changes in hydrostaticpressure in these lines due to reduced water density at increased drywelltemperature.

If reactor pressure decreases to less than the saturation pressure of the waterin the water level sensing lines, the water in the lines will flash and boil.

,The flashing and boiling may result in loss of some of the water in the sensinglines. Loss of water from the sensing lines results in reactor water -levelmeasurement error until'perator action refills the sensing lines.

Analyses have demonstrated that water level activated safety trips will beinitiated for high energy line breaks before reactor pressure decreases to lessthan the saturation pressure of the water in the sensing lines. Therefore,these safety trips will be initiated before high drywel1 temperature signifi-cantly affects water level measurement.

The NMP2 containment monitoring design consists of eighteen redundant Class 1Etemperature elements distributed throughout the Primary Containment: The

'ontainment temperature monitoring system constantly scans and selects thehighest containment temperatures fol control room indication and annunciation.The control room indication of containment temperatures includes meteredindication as well as temperature recorders. The control room annunicationalerts the operator of high containment temperatures which could lead topossible erroneous level indication. r

Long term (i.e. following RPV blowdown and reflooding) water level measurementerrors due to flashing and 'boiling of water in the sensing lines are postulatedto occur as a result of multiple failures by the operator to follow established

8AM: csc: rm/I08271""18/29/84

emergency procedures. The BWR Owners Group (BWROG) has established the posi-tion with the NRC that potentially large water level measurement errorsresulting from high drywell temperature increase the probability of core meltand that these errors should be minimized and/or eliminated. This position wasestablished with the NRC via the BWROG reports ¹SLI-8211, titled "Review of BWR

Reactor Water Level Heasurement System" and ¹SLI-8218, titled "Inadequate CoreCooling Oetection in BWR's" prepared by S. Levy, Inc.

This response provides the results of aii evaluation of the NHP2 reactor waterlevel sensing line arrangement in the drywell based upon the criterion accepted

- on the Shore4am docket. Specifically, t™he acceptance criterion is that:

"Following initial reactor water level stabilization after reactor depres-surization and assuming the operator fails to properly monitor reactorwater level during long term (on the order of hours) post-LOCA conditions,the operator shall receive a low reactor water level alarm before thelower tap is uncovered."

It should be emphasized that the stated criteria is based on the assumption ofmultiple failures., Under the highly unlikely scenario postulated it is assumedthat the operator:

1) fails to properly monitor reactor. water level (i.e., the most impor-tant post-LOCA parameter),

2) stops all systems providing reactor core inventory,')

fails to properly monitor drywell temperature 'and vessel pressure andreflood t'e reactor in order to recover/restore water level indica-tion, as required by the emergency procedures, when drywell tempera-ture near the- instrument lines exceeds that saturation temperature ofthe reactor vessel, and

4) fails to initiate the drywell spray at the high drywell temperaturespecified in the emergency procedures.

The evaluation assumes loss of all water in the part of the reference. legsensing line located in the drywell as a result of failure of the operators tofollow established emergency procedures. The loss of water from the referenceleg is assumed to occur due to high drywell temperature conditions (i.e.,flash-off that occurs when the reactor is depressurized and long-term boil-offof water due to drywell temperatures higher than reactor temperatures). Theerror resulting from flash-off and boil-off is proportional to the vertical'l

evati on change of the re ference 1 eg in the drywel 1 . NMP2 has a maximum ofg —// ~~ee4. vertical elevation of reference legs in the drywell. This evaluation

is based on the nominal trip setpoint.

The results of this evaluation indicate that a low reactorwater level 2 alarmwill be received before the lower instrument tap connected to the alarm isuncovered.

BAH:csc: rm/I08271"-28/29/84


QUESTION F421.25 (7.2, 7.3, 7.4, 7.5, 7.6, 7.7)

Reg. Guide 1.118, which provides guidance with respect toperiodic testing of the reactor protection system

(reactor'rip,

engineered safety features and supporting systems,RCIC) excludes lifting of leads to perform surveillancetests and accepts opening of a breaker to performsurveillance tests only if opening of the breaker causes thetrip of the associated channel. Confirm that the Nine Mile.Point Unit 2 surveillance tests will conform to the abovecited guidance.

RESPONSE

See Table 1.8-1, Regulatory Guide 1.118.said, Crf $hsn$ Mh

surveillance testing procedures i for the reactorsystem are currently under development. Lifting

is not normally utilized in procedure steps unless

Periodicprotectioof leadsthe procedure would require this action to 'ccomplish the =

purpose of she procedure and no other method, suoh asopening a breaker, is possible. Ahenever lifted leads areutilized, an analysis will be performed to Verify that thisis the only practical method available to accomplish thesurveillance. Within the body of a procedure speci ficinstructions are given to identify, lift, and replace theleads Such actions are performed under strictadmini trative control with independent verification forsafet related systems or components.

ov Sukftof

Qgl>Q~s

444'A'ovid'ilq ~~ < m~i4* L~fg~Aa. Pechs~fmQPn d$ . Z'EUO4~.Qg Pg gq

>s'zscosse'pP>442&% Q.PA+dW~Qg4)~

P&R,MRW ~7yp~g p-y )c. g~prp~g~W>~b ~urPw~7- ~r~~ ~ +

C ~ ~'cr ~~D+~s' pR V~(ddsc~ ~~H4WTEAj+nlc~)'~+~~@~ g~y p(cg~Ms~s IVY&W< )7- gy~~ ~>-P>4v~~ 7-usvrwe, uu.c ~~ ~~~<>~> ~ +&46W6'Vncrio~+c. gdder~

0. ~m~7f ~vl~eb @kSR& P-~w ~~

NINE NILE POINT-2 FSAR

CE/Q

QIIEom 421.27Mode switch contact and mode switch operating mechanism

.'alfunctionshave caused inadvertent protective actions .Similarmalfunctions could have rendered redundant channels of protectivefunctions inoperable. IE Information Notice 83-42 provided noti-fication of potentially significant events concerning mode switchmalfunctions. Section 7.2..1 of the FSAR indicates that the reactormode switch is used to bypass and enable protective functions, rodwithdrawal interlocks and refueling equipment interlocks. Provide adetailed discussion on how the mode switch is.incorporated into theoverall design, supplemented with detailed drawings and schematics.Please include the following:

.

(1) Identification of the reactor protection system, rod block,refueling interlock and other, functions important-to-safetythat are dependent on proper mode switch contact operation.

(2) Identification of the analyzed transients and accidents wherecredit is taken for the operation of any function identified in(1) above.

(3) The surveillance actions necessary to positively verify mode

switch contact positions, detect mode switch contact failuresand detect mode switch operating mechanism failures for eachfunction identified in (1) above.

RESPONSE dn assessment of the system impact of postulated misopeeatioesfor the presently installed mode switch is provided below. Theassessment includes an 'valuation of the impact of postulatedmisoperations on the analyies described in Chapter 15. It identi-fies normal switch contact positions for each mode of operation(RUN, SHUTDOWN, REBEL, and STARTUP), and summarizes the consequnceshould one or more pairs of contacts misoperate. '11 of thesemisoperations are detectable by annunciation, instrumentationa Schecks, ~urveillance testing.

~ m I

{ ~ s~ ~

1-02731

C

Assessment of Effects of Mode Switch Miso eration

NOTE: Each pair of svitch contacts is . identified by identicaldigits vith the letter C as a suffix on one digit <(e.g., 1-1C,2-2C, etc.). For brevity, only one digit vill be used, thus:contact 1, contact 3, etc.

I. Contacts Normall Closed in RUN Position

).1 IRM B ass Contacts-3 5 19 21 35 37 51 53

1.1.1 If any of the above contacts are open in the RUN positionthe IRM scram function would be enabled and half-scrams orscrams could result if IRM's vere upscale'or inoperative.

1.1.2. If any of the above contacts are closed in STARTUP,.

REFUEL, or SHUTDOWN svitch positiions, the IRM scram

function vould be bypassed. This would not be detectedimmediately. but vould be evident 'during weekly channelfunctional tests because half scrams due to the IRM

function could not be induced in the affected channel(s).

1.2 Shutdown Scram Interlock Contacts-9 25 41 57

(Note: These contacts are also normally closed in STARTUP and.

REFUEL.)

1.2.1 If any of the above contacts are open in the RUN

position a scram or half scram vill result.

1.2.2 If any of the above contacts are closed in SHUTDOWN,

the shutdown trip function of the affected logic circuitvould be disabled.

1-02732

1.3 APRM Interlock Contacts-ll 27 28 43 44 59

1.3.1 If any of the above contacts are open in the RUN

position, the APRM setdown scram trip function 'would bet

enabled and the APRM's would provide half acrams or fullscrams at reactor power levels of 15'r greater.

1.3.2 If any of the above contacts are closed in anyposition but RUN, the APRM setdown scram trip functionwould be disabled and the trips setpoints would be raisedto their high setpoint level of about 113'f reactorrated power.

1.4 Rod Block Interlock Contacts-30 62

1.4.1 If either of the above'contacts are open in the.RUN

position, an annunciated rod block signal would be sent tothe reactor manual control system to prevent removal ofmore than one control rod.

1.4.2 If either of the'bove contacts are closed in STARTUP,

REFUEL, or SHUTDOWN, there would be an unannunciatedpermissive for the reactor manual control system to move

more than one control rod. In the STARTUP or REFUEL

mode, the permissive would be redundant.

1.5 Conclusions

For multiple failures of mode switch contacts which are normallyclosed in the RUN mode, the principal concerns are:a. The unannunciated bypass of the IRM scram function in switch

positions other than RUN.

b. Failure to cause scram when moving the mode switch toSHUTDOWN-

1-02733

c. The unannunciated bypass of the APRN setdown scram functionin switch positions other than RUN.

d. The unannunciated permissive to move more than one control rodwhen in the SHUTDOWN mode.

II. Contacts Normall Closed in STARTUP Positions

Z.l KSIV Closure Scram B ass Contacts-7 23 39 55

(Note: These contacts are also normally closed in REFUEL andSHUTDOWN.)

2.1.1 If any of the above contacts are open in the STARTUP

position, the MSIV closure scram trip function would beenabled vithout immediate operator knovledge, unless one

of the tvo bypass'nnunciati'ons vere to cease. Thi:s vouldrequire at least tvo of the four sets of contacts to open.

2.1.2 If any of the above contacts are closed in RUN, an

annunciated bypass of the MSIV closure scram trip functionwould occur.

2.2 Shutdown Scram'Interlock Contacts-9 25 41 57

(Note: These'contacts are also normally closed in RUN and

REFUEL.)

2.2.1 If any of the above contacts are open in the STARTUP

position, a scram or half scram vill result.

2.2.2 If any of the above contacts are closed in the SHUTDOWN

position, the shutdown scram trip function of the affectedlogic circuit would be disabled.

2.3 Steamline Lov Pressure Isolation Tri B ass

Contacts-10 26 42 58

1-02734

(Note: These contacts are also normally closed in REFUEL and

SHUTDOWN. )

2.3.14

If any of the above contacts are open in the STARTUPS

position, the MSIV isolation-on-low-steamline-pressurefunction would be enabled; A MSIV isolation trip or halftrip would occur. The isolation trip could be followed bya scram or half scram on HSIV closure.

2.3.2 If any of the above contacts are closed in the RUN

position, HSIV isolation on low steamline pressure wouldbe bypassed.

2.4 Rod Block Interlock contacts-31 63

2.4.1 If ei;ther of the above contacts are open in the STARTUP

position, an annunciated rod block signal would be sent tothe 'eactor 'anual control system to prevent removal ofmore than one control rod.

2.4.2 If either of the above contacts are cloyed when not inSTARTUP, there would be an unannunciated permissive forthe reactor manual control system to move more than one

control rod. In the RUN and REFUEL modes the permissivewould be redundant.

2.5 Conclusions

For multiple failures of mode switch contacts which are normally closedin the STARTUP mode, the principal concerns are:

a. Qe annunciated bypass of the kSIV closure scram trip functionin the RUN mode.

b. The unannunciated bypass of the %IV-isolation-on-low-steam-line pressure function in the RUN mode.

1-02735'

c. The failure to initiate scram whea the mode switch is moved tothe SHUTDOWN position.

d. The uaannunciated permissive to move more thaa onc, coatrol rod

in the SHUTDOWN mode.

III Contacts Normall Closed ia REFUEL Position

3.1 HSIV Closure Scram B ass Contacts-7 23 39 55

(Note: Thyrse coatacts arc also normally closed in STARTUP and

mmOWN.)

3.1.1 If any of the above contacts are open in the REFUEL

position, the MSIV closure, scram trip functioa vould be

enabled vithout immediate operator knowledge, unless one

of the tvo bypass. annunciatioas vere to cease. This would

require at least tvo of the four sets of contacts to be

open.

3.1.2 If any of the above .contacts are closed in the RUN

position, aa annunciated bypass of the MSIV closure scram

trip 'function vould occur.3.2 SDV Hi h Vater Level Scram ass Contacts-8 24 40 56

(Note: These contacts are also normally closed in SHUTDOWN.)

3-2.1 If any of the above contacts are open in the REFUEL

position, the SDV high vatcr level scram trip functionvould be enabled for the affected logic channel.vithoutiamediate operator knowledge, ualess one of the tvo bypass

aanunciatioas vere to cease. This would require at leasttwo of the four sets of contacts to be open.

3.2.2 If any of the above contacts are closed in RUN or STARTUP,

1-02736

the SDV high-water-level scram trip bypass would be

enabled. (h separate bypass switch for each channel must

also be closed to effect the bypass.)

3.3 Shutdown Scram Interlock Contacts-9 25 41 57 0 ~

(Note: These contacts are also normally closed in RUN and STARTUP)

3 3.1 If any of the above contacts are open in the REFUEL

position, a scram or half scram will result.

332 If any of the above contacts are closed in the SHUTDOWN

position, the shutdown scram trip function of the~ ffected logic channel would be disabled.

t

3.4 Steailine Low Pressure Iso)ation Tri B ass Contacts-10 26 42 58

'(Note: These contacts are also normally closed in STARTUP and

Simoom.)

3.4.1

3.4.2

If any of the above contacts are open in the REFUEL

'position, the MSIV isolation-on-low-steamline-pressurefunction would be enabled. h ESIV isolation trip or halftrip would occur.If any of the above contacts are closed"in the RUN

position, MSIV isolation on low steamline pressure would

be bypassed.

3.5 Rod Block Interlock Contacts-29 61

3.5-1 If either of the above contacts are open in the REFUEL

position, an annunciated rod block signal would be sent tothe reactor manual control system to prevent removal ofmore than one control rod.

1-02737

3.5.2 If either of the above contacts are closed when not inthe REFUEL mode, there would be an unannunciatedpezmissive for the reactor manual control system to move

more than one control rod. In the RUN and SThRTUP modes,the permissive would be redundant.

3.6 Conclusions

For multiple failures of mode switch contacts which are normallyclosed in the REFUEL mode, the principal concerns are:

ao The annunciated bypass of the HSIV closure scram trip functionin the RUN mode.

b. The unannunciated bypass of the %IV-isolation-on-low-steamlinepressure function in the RUN

mode.'.

The failure to cause a scram when the mode switch is moved tothe SHUTDOWN position.

d. The unannunciated permissive to move more than one control rodin the SHUTDOWN mode.

e. The annunciated bypass of the SDV high-water-level scram in theRUN or STARTUP mode.

IV. Contacts Normall Closed in SHUTDOWN Position

4.1 Shutdown Scram Reset Controls-1 2 17 18 33 34 49 50

4.1. 1" If any of the above contacts are open in the SHUTDOWN

position, the shutdown scram/manual scram logic for theaffected logic channel will not be configured to pezmitthe logic channel to be reset after a scram trip.

4.1.2 If any of the above contacts are closed in any position

1-02738

45/Q

except SHUTDOWN, there vould be no immediate effect. Ifboth sets of contacts in any logic channel (1 and 2 forlogic hl, 17 and 18 for logic Bl, etc.) vere.. closed vhennot in SHUTDOWN, the shutdovn scram function vould be inthe "reset" configuration; and a scram trip vould notoccur for that logic channel vhen the mode svitch is moved

to the SAG'DOWN position.

4.2 NSIV Closure Scram ass Contacts-7 23 39 55

(Note: These contacts are also normally closed in STARTUP and

REFIT..)

4.2. 1'f any of the above contacts arc open in the SHUTDOWN

position, the NSIV closure scram trip function would be

enabled vithout immediate operator knovledge, unless one

of the tvo bypass annunciations vould cease. This vouldrequire at least two of the four sets of. contact to be

opene

4.2.2 If any of the above contacts are closed in the RUN

position, an annunciated bypass of the MSIV closure scram

trip'unction vould occur.4.3 SDV Hi h Water Level Scram B ass Contacts-8 24 40 56

(Note: These contacts are also normally closed in REFUEL.)

4.3.1 If any of the above contacts are open in the SHUTDOWN

position, the SDV high vater level scram trip functionvould bc enabled for the affected logic channel vithoutimmediate operator hnovledge, unlesi one of the tvo bypassannunciations vere to cease. This vould require at leasttvo of the four sets of contacts to be open.

4.3.2 If any of the above contacts arc closed in RUN or

I 02739

STARTUP, the SDV high vater level scram trip bypass vouldbe enabled. (Closure of a separate bypass svitch for each'channel vould be .required to complete the bypass.

4.4 Steamline Low Pressure Isolation Tri B ass Contacts-IO . 26 42 58

(Note: These contacts are also normally closed in STARTUP andREZOEL. )

4.4.1 If any of the above contacts are open in the K03TDOWN

position, the MSIV isolation-on-lov-steamline-pressurefunction vould be 'enabled. h MSIV isolation trip or halftrip vould occur.

4.4.2 If any of the above contacts are closed in RUN, MSIV

isolation on lov steamline pressure vould be bypassed.4.5 Conclusions

For multiple failures of mode switch contacts vhich are normallyclosed in the SHUTDOWN mode, the principal concerns are:

a. The annunciated bypass of the MSIV closure scram trip functionin the RUN mode.

b. The unannunciated bypass of the MSIV-isolation-on-low-steamlinepressure function in the RUN mode.

c. The annunciated bypass of the SDV high-water-level scram in theRUN or STARTUP mode.

V. Summa and Conclusions

,A. All failure modes for the mode switch contacts where contacts open

that should be closed vould result in scrams or half scrams

depending on the number of contacts that are open. At the same

1-027310

time, for conditions of operation vhere steamline pressure is low,isolation of the main steamlines vould occur.

P'.

In the "STARTUP", REFUEL", and "SHUTDOWN" positions of the mode

svitch, closures of contacts that should be open (3,5,19,21,wpv/d

35,37,51,53)>result in a bypass of the IRM scram function in one ormore of the RPS channels. Closure of contacts 11, 27, 28, 43, 44,59, would result in raising, the setpoint of the normally setdown

APRM high flux scram function from 15~ to 113$ in one or more of theRPS/NMS channels.

C. In. item B above, although the mode svitch failure,- (i.e., contactsclosing), would not be immediately apparent to the;.plant operator,the failure would be detected during the veekly IRM"and APRM channelfunctional tests. If these'ests veie performed prior to the powerincrease and after transferring the mode switch,.to the "STARTUP"'

position, then the IRM channel functional tests vould detect the IRM .

failures because no half scram vould result. The proposed technicalspecification requirement vill be that the IRM channel functionaltest and the APRM channel functional test be performed vithin 24

hours prior to startup, if it has not been perfozmed in the previousseven days. Meekly surveillance vould be required for the case

vhereby the "hot standby" (STARTUP position) condition is maintainedfor long periods of time.

D. In the 'RUN" position of the mode svitch, closures of contacts 7,23, 39, 55 vould result in the bypass of one or more RPS tripchannels related to the MSIV closure scram functions. Closure ofcontacts 10 '6, 42, 58 would result in the bypass of one or more

NSSSS trip channels related to the steamline low pressure isolationfunction. Concurrent vith the incorrect'ode switch contactclosures, there would be annunciations that one or more of the RPS

MSIV closure scram trip channels have been bypassed.

1-027311

ALSO'NCE A REFUELING CYCLE AFTER THE N3DE SWITCH IS PLACED IN THE STARTUP

POSITION A CHANNEL FUNCTION TEST OF THE IN S HIGH FLUX TRIP WILL BE PERFORNED

Closure of contacts 9, 25, 41, 57 can bypass the "SHUTDOWN¹'ode

scram function. If the contacts remain closed during and aftertransfer of the mode svitch to the "SHUTDON" position,'such closedcontacts would not allow a scram to occur from positioning'f thesvitch. That is, only a half scram or no scram vould re'suit. Thisfact would be immediately apparent to the operator. Mannual

scraming of the plant is accomplished by depressing the manuallyscram switch. The ability to scram the plant from the mode iwitchis only a secondary effect, and one of several backup alternates tothe scram pushbutton.In the "SHUTDOWN" mode, closure of mode svitch contacts 29, 30, 31,61, 62, 63 vould remove the normal rod vithdrawal block restrictionassociated vith this mode. This fact vould be apparent'o theoperator because the window for the normal rod vithdrawal blockannunciator vould be extinguished, and its change of state vouldalert the operator. The manual positioning of rods is under strictprocedural controls. The rod block positioning restrictions areonly backups to those controls. hdditionally, the operator vouldbecome avare of the situation via standard technical specificationdriection by verifying this rod block by attempting to vithdrav a

second rod after the first one is vithdravn.

1-027312


VI. Evaluation of the Effects of Mode Switch Miso eration on Cha ter 15~na ses.

The potential impacts of the effects of mode switch misoperation onthe analyses of transients and accidents presented in .Chapter 15were evaluated. The focus was on certain specific events becauseof previously expressed NRC concerns with those events or becausethe events might impact the limiting transients. These specificevents were classified into two groups according to theconsequences of mode switch misoperation.

1. ~Grou 1

The events in Group I include:

.a.. The abnormal startup of an idle recirculation loop..

b. The failure of the recirculation flow controllerwith increasing flow.

c. A rod drop accident.~ \

These are events for which the con'cern is related to thebypass of the scram function of the intermediate range monitor(IRM) while the mode switch is in the "STARTUP," "REFUEL," or"SHUTDOWN" positions. This would also raise the scramsetpoint of the average power-range monitor (APRM). from the15K "startup" value to the 118K "run" value, which correspondsto the analytical limit of 121% used for the analyses ofChapter 15 transients and accidents.

None of the Chapter 15 analyses of the events in Group I takescredit. for either the IRM scram function or the APRM scramfunction with the setpoint setdown to the 15-to-25K level.Events a-and b of Group I were analyzed from a "RUN"-modepower condition since the Chapter 15 analyses are initiatedfrom about 56K power and 40K core flow. In the "RUN" mode,the IRM trips are bypassed and the APRM flux scram-setpoint isapproximately 118K (121% analytical limit). The rod dropaccident analysis was initiated from OX power, (50K roddensity); consequently, the mode switch would be in the"STARTUP" position.

- No impact would result from the misoperation of the modeswitch in the "REFUEL" or "SHUTDOWN" modes.

a. For the analysis of the abnormal recirculation-loopstartup transient, no credit was taken for the flowreference in the scram for high neutron flux.. The highneutron flux setpoint of 121% was used. The Analysis ofthis event was initiated from a power level significantlyin excess of where recirculation-loop startups would

PCY: pes/1 lOBB-I4/27/84

b.

ce


normally originate and corresponding to the mode switchin the "RUN" mode. At lower power levels, tgeconsequences of the event would be less severe;consequently, the impact of the mode switch misoperationon the analysis of this event is of no significantconsequence.

The initiation of an abnormal recirculation-loop startuptransient when the mode switch is in the "STARTUP"position would also be of no consequence since operatingprocedures would require the initial power level to beless than IS%. The resulting power increase probablywould not cause a scram. If the resulting power levelwere in excess of technical specification requirementsrelated to power, pressure, and core flow, the operator .

would take corrective action in accordance with thoserequirements.

The Chapter 15 analyses of the recirculationflow-controller failure with increasing flow wereinitiated from a 55% power and 35.7X core flowconditions, with a 12ll flux:scram terminating the powerexcursion. Similar events originating from the startuppower range of O.to 15K power would be of lesserconsequence. Also, at this low power level, normaloperating procedures would infer minimum pump speed withindividual'oop operation. These operating conditionswould lessen the effect of a single-loop .flow increaseand would preclude the event of flow control failing withincreasing flow on both loops.

The analysis in Chapter 15 of the rod drop event onlytakes credit for the 121% APRM trip and takes no creditfor the IRM scram function. The event, as analyzed fromthe OX power level, is terminated by the Doppler effectarid is of significance only below about 2 to 3% power.At high power levels, the rod drop would be less of aproblem because of the influence of the resulting steamvoids in the core on the local high reactivity.

2. ~Grou 2

The events in Group 2 include:

a. The inadvertent closure of the main steam isolationvalve.

PCY: pes/IIOBB-24/27/84

b. The loss of an auxiliary power transformer.

c. The break of a main steam line outside thecontainment.

d. The failure in the open position of the steampressure controller.

NINE HILE POINT 2 FSAR

These are events for which the concern is either the bypass ofthe main steamline isolation function due to low steamlfnepressure by the nuclear steam supply shutoff system (NS ) inthe "RUN" mode or the loss of the position scram function ofthe HSIVs in the "RUN" mode. Only the isolation fbnction thatshould result whenever the turbine-inlet steamline Pressuredrops below the (analysis) setpoint level of approximately )20psig is of concern. Ko other isolation functions of the NSare impacted by the potential mode switch misoperations.

a.

b.

The analysis of the HSIV closure event in Chapter 15 doestake credit for the scram initiated from limit switchesof the HSIV while the mode switch is in the "RUN" mode.Potential mode switch misoperation could cause this scramfunction to be bypassed while the mode. switch is in the

'RUN"position. However, this bypass would beannunciated in the control room. The operatingprocedures would require corrective action since thetechnical specification requirement that all four-channels for the HSIV-closure trip function be operablein the "RUN: mode would be violated. Depending upon thenumber of inoperable channels, the affected channels andat least one trip system of'the reactor protection system(RPS) would have to be placed in the tripped conditionwithin one hour. If both RPS trip systems were affected,the plant would have to. be placed in the "STARTUP"condition'ithin 6 hours.

The consequences of the auxiliary power, as analyzed inChapter 15, are also not affected by any mode switchmisoperation. The scram and isolation that occur atabout 2 seconds (or later) are a direct result of the

'oss of power to the RPS motor-generator sets and thesubsequent disconnection of all power to the loads on theRPS bus.

Ce The analysis of the main steamline break outside of thecontainment does not take credit either for the lowsteamline isolation signal that would probably resultfrom low steamline pressure or for the scram from HSIVclosure. In this analysis, the event is initiated at theLevel 3 scram to start out with a minimum inventory. Atabout.0.5 seconds into the event the isolation is assumedto be initiated because of high steamline flow. Althoughthis is not addressed in the analysis, a level-8high-water turbine trip would be expected due to suddendepressurization.

PCY:pes/llOBB-34/27/84


d. Failure of the steam pressure controller in the openposition would result in a level-8 high-water. levelturbine trip, which would initiate a scram and a.recirculation pump trip. Further depressurization wouldbe limited to the capacity of the turbine bypa'ss. Sincean annunciation in the control room would have alerted tothe bypass of the isolation function, the operator wouldbe prepared to actuate HSIV closure manually should thisevent occur.

Conclusions from these evaluations are that all misoperationsof the mode switch are detectable. by one or more of thefollowing means.

a. The operator would be imnediately aware of a problem'because of the annunciation of bypasses that should not

. exist for the given postion of the mode switch. All modeswitch misoperations that, might impact the severity ofconsequences of transients and accidents analyzed inChapter 15 are in this category; Hence, the probability.of,a transient occuring be'fore the operator 'takes .

corrective action would be extremely low.

b. The operator would be iranediately aware of a problem inthe RPS because of scrams or half scrams, which are alsoannunciated.

c. The remaining modes of mode switch misoperation would bedetected during the weekly channel functional tests ofthe NMS channel inputs to the RPS. If these tests wereperformed prior to the power increase and after thetransfer of the mode switch to the "STARTUP" position,the IRM channel functional tests would detect thefailures because no half scram would result.

PCY:pes/110BB-44/27/84



onse to the concerns addressed by IEProvide a detailed response o

M h 13 1980 FoControls) issued to operating reactors Mare-e i ment, which does not remain nall safety-related-equ p t provide adequateemergency mode follow gowi n an ESF rese, pf h piece ofge chan e of state o eac

ro osed corrective ac monsequipment or p p in to its normal operationalchanges (e.g., equipment return ng ostatus).RESPONSE

See revised Section 7.3.2.1.2.2 1.

CCS RHR, NSSS) documents currentA review of ESF system (EM984 for Nine Mile Point - Unit

an ESF system reset control actionf IE B ll i 8o-06(

)'he

idance oNMP2'utomati'c depressurization systems

valve to .its close dtrois return eich ADS safety/relief,Th deliberate operator action clos'ing eposition. is e

N R, and U torelief''alves B22-F013 C, H, K, M,t. inadvertent reactor depressurization xs

e tion to IE 80-06 compliance.the idance in-Besides this exception, no deviation from e gu

dicated in IE Bulletin 80-06 was found.

RCIC (not considered an ESF) was revieweiewed andIn addition, noith the guidance of IEfound to be in conformance wi

Bulletin 80-06.

Amendment 10 QEcR F421.28-1 April 1984



Section 7.4.1.4 of the FSAR provides information on theRemote Shutdown System (RSS). Attachment 1 provides theinstrumentation and Control Systems Branch (ICSB) guidancefor remote shutdown capability. The attachment providesguidance for meeting the requirements of GDC 19. Providesupplemental information to identify the extent that thedesign of the RSS at Nine Mile Point - Unit 2 conforms tothe guidance provided . in Attachment 1. Include thefollowing information in your discussion using drawings asappropriate:

a) Design criteria for the -remote control station equipmentincluding the 'transfer switches and separationrequirements for redundant functions.

b) Discuss the separation arrangement between safetyrelated and nonsafety-related instrumentation andcontrols on the auxiliary shutdown panel.

c) Location of transfer switches and the remote controlstations.

. d) Description of isolation, 'eparation andtransfer/override provisions. This should include thedesign basis for, preventing electrical interactionbetween the control room and remote shutdown equipment.

e) Description of the administrative and procedural controlfeatures to both restrict and to assure access, whennecessary, to the displa'ys and controls located outsidethe control room.

f) Description of any communication systems required tocoordinate operator actions, including redundancy andseparation.

g) Means for ensuring . that cold shutdown can beaccomplished.

h) Descriptioncontrol orcontrol.

of control room annunciation of remoteoverride status of devices under local

Discuss the proposed start-up test program todemonstrate remote shutdown capability in accordancewith the guidance provided in R.G. 1.68.2.

Amendment, 10 QER F421-34-1 April 1984


j) Discuss the testing to be performed during plantoperation to verify the capability of maintaining theplant in a safe shutdown condition from outside thecontrol room.

k) Discus s the equipment c1 assi fication using theguidelines contained in FSAR Table 3.2-1.

RESPONSE

The response to Items a, b, c, and d is as follows:

Unit, 2 compliance with the guidance contained in Attach-ment 1 is escribed below:

1. The remote shutdown panel (RSP) is designed toachieve and maintain hot shutdown in the event thecontrol room is inaccessible. This is achieved bythe use of redundant, safety grade instrumentation~identical .(in. most all cases) to that used: in the ~~gj

A'ontrolroom. Additionally, some nonsafety-'relatedindicators and recorders are provided for operationuse.

2. See, Item 1.

3. No jumping, rewiring, circuit disconnection, ormanual action (in locations. other than the RSP) isused to achieve the desired shutdown condition.

4. The design of the RSP is such that cold shutdown isachieved using safety grade, redundantinstrumentation.

5. Loss of offsite power will not negate shutdowncapability since power is supplied by reliablesafety grade power sources.

6.

7.

Transfer of control to the RSP does not disable anyESF function gr change, the o crating status o anyequipment. 7 g PR R.s'wGU1C a r

The acces the rem e shutdown room iscontrolled at all times and the transfer switchesare the lockable type. See response to Item ebelow.

April 1984Q&R F421.34-2

8 ~ Design of the RSP is under evaluation forconformance to the requirements of Appendix R to10CFRSO.

'I

Amendment 10

~<SP~72 EEEAIMOP + M~PC ~<R~PCC OCC .

CC CCOR M+MCIOIOECMCCPE EEOC- —.CCE C E —EE--.E+e Can>OI/eel» rOi~~C ~~EEOPTPE RECCO

EO >T E CO CEO C C C O

COO�

5W)7C~

MO ICE ERE E EECCCEPPCC M WEMccastro l/g tlg (yew

EBS ~ R' 'ni ~<

~~i~d7

~ eo~tvoj/Yt 4, PyOVN

IZC'SFoEPlgO'. sacif

z2Z~FMM@s&8awd~ S

CECCCCE E EC~~2322L ~ECN~ EoC'CE

CO LZCo~—D~W OEICOCE .OE CEEI

y~r~&Zo FaZ .

PME ZS~ ~1M~Na eo~~~ Pl ceEs~

I aE-PEOCIOEOEIO 'CC OCCOCCOC PCCIE.

.au.C~C<CN7 ~R~~ C)PE~ieg~n~~gUK i~~A~nr W]n/

- ./4>2&hSg OOu)A'..

AJ.. 4~~&suing ~e, .~ PCW4k $ 4IA4 CLCA~All&lfJ

<paco'k06. ~


e. Access to the remote shutdown system controls will becontrolled by the plant security system. Access will berestricted as with other vital areas. In the event ofthe failure of the card reader, access will be possibleby use of metal keys. Additionally, key lock switchesrequiring the use of metal keys are utilized for paneltransfer/override functions. These keys will beadministratively controlled according to key controlprocedures and readily available to both the ControlRoom Operator and the Shift Supervisor in the event of acontrol room evacuation.

Use of communications to coordinate operator actions isnot required as all functions to safely shut down theplant can be performed independently from either thecontrol room or the remote shutdown system controls.

g. A description of how cold shutdown is achieved utilizingthe -remote shutdown panel is contained in Section7.4.1.4.

h. A description of control room annunciation when transferswitches are changed 'o the emergency position iscontained in Section 7.4.1.4.

1

A separate startup test procedure, as dyscribed in testabstracts, Table 14.2, will be performed to demonstratethe capability of the remote shutdown system to safelyshut down the plant within guidelines provided by Reg.Guide 1.68.2.

Instrumentation and controls associated with the remoteshutdown system shall be calibrated and functionallyverified by surveillance testing as required intechnical specifications. Remote shutdown system designis such that functional. testing of systems verifies theoperational capability to provide remote shutdown.Additionally, periodic testing of the transfer switcheswill be performed to verify control functions.

k. See revised Table 3.2-1.

Amendment 10 Q&R F421.34-3 April 1984


421.34 ATTACHMENT 1ICSB GUIDANCE FOR THE INTERPRETATION OF GENERAI DESIGN

CRITERIA 19 CONCERNING RE UIREMENTSFOR REMOTE SHUTDOWN STATIONS

A. BACKGROUND

GDC 19 requires that equipment at appropriate locationsoutside the control room be provided to achieve a safeshutdown of the reactor. Recent reviews of remoteshutdown station designs have demonstrated that, somedesigns cannot accommodate ~ a single failure inaccordance with the guidance of SRP Section 7.4{Interpregation of GDC-19). The following providessupplemental guidance for the implementation of therequirements of GDC-19 concerning remote . shutdownstations. Requirements for remote .shutdown capabilityfollowing a fire are detailed in Appendix R to 10CFRSO:It should be noted that although GDC 19 and Appendix Rrequirements are complementary, the potential'xiststhat modifications to bring a design into conformancewith GDC 19 will violate Appendix R criteria and viceversa. For example, remote manual devices for a seconddivision of instrumentation and controls added tosatisfy single failure requirements would not beacceptable if the added devices were located in the samefire area as existing transfer switches in the redundantdivision. In addition, transfer switches added toisolate the remote shutdown equipment from the controlroom fire area would not be acceptable if they disableESF actuation; unless this is done in accordance withItem B6 below. The acceptability of remote shutdownstation designs given a fire is determined by theAuxiliary Systems Branch (ASB) as outlined inSection 9.S.1 of the SRP.

B. ICSB GUIDANCE

To Meet GDC-19 As Inte reted In SRP Section 7.4

1) The design should provide redundant safety gradecapability to achieve and maintain hot shutdownfrom a location or locations remote from thecontrol room, assuming ,no ~ fire damage to anyrequired systems and equipment and assuming noaccident has occurred. The remote shutdown stationequipment should be . capable of maintainingfunctional operability under all service conditionspostulated to occur (including abnormalenvironments such as loss of ventilation), but need

Amendment 10 'GR F421.34-4 ~ April 1984


not be environmentally qualified for accidentconditions unless envi ronmental qua lification isrequired for reasons other than remote shutdown.The remote shutdown station equipment, includingindicators, should be seismically qualified.

2) Redundant instrumentation (indicators) should beprovided to display to the operator(s) at theremote shutdown location(s) those parameters whichare relied upon to achieve and verify that a safeshutdown condition has been attained.

3) Credit may be taken for manual actions (exclusiveof continuous control) of systems from locationsthat are reasonably accessible from the RemoteShutdown Stations. Credit may not be taken formanual actions involving 5umpering, rewiring, ordisconnecting circuits.The design should provide redundant safety gradecapability for. attaining subsequent cold ,shutdownthrough the use of suitable procedures.

5) Loss of offsite power should not negate shutdowncapability from the remote shutdown stations. Thedesign and procedures should be such that

following'ctivationof control from the remote;shutdownlocation, a loss of offsite power will not resultin subsequent overloading of essential buses or thediesel generator.= Manual restoration of power toshutdown loads i~ acceptable provided thatsufficient information is available such that itcan be performed in a safe manner.

6) .. The . design should be such that if manual transferof control to the remote location(s) disables anyautomatic actuation of ESF equipment, thisequipment can be manually placed in service fromthe remote shutdown station(s). Transfer to theremote location(s) should not change the operatingstatus of equipment.

Where either access to the remote shutdownstation( s) or the operation of equipment at thestation(s) is dependen't upon the use of keys (e.g.,key lock switches) access to these keys shall beadministratively controlled and shall not beprecluded by the event necessitating evacuation ofthe contxol room.

Amendment 10 QEcR F421.34-5 April 1984


8) The design should comply with the requirements ofAppendix R to 10 CFR 50.

Amendment 10 Q&R F421. 34-6 April 1984


QUESTION F421.36 (7.5)The NRC staff has recently issued Revision 2 to RegulatoryGuide 1.97, "Instrumentation for Light-Mater-Cooled NuclearPower Plants to Assess Plant and Environs Conditions Duringand Following an Accident" via Supplement 1 to NUREG-0737.This Reg. Guide revi sion re flects a number of ma jor changesin post-accident instrumentation. Supplement 1 toNUREG-0737 includes specific Reg. Guide 1.97 implementationrequirements for plants in the operating license reviewstage.

Provide a description of how the Nine Mile Point Unit 2design conforms to the provisions of Reg. Guide 1.97,Revision 2. This description should be in the form of atable that includes the following information for each TypeA, B, C, D, E variable shown in Regulatory Guide 1.97:

(1) instrument range

(2) environmental qualification (as stipulated in guide orstate criteria)

(3) seismic qualification (as stipulated in guide or statecriteria)

(4) quality assurance (as stipulated in guide or statecriteria)

(5) redundancy and sensor(s) location(s)(6) power supply (e.g., Class 1E, non-Class lE, battery

backed)

(7) location of display (e.g., control room board, SPDS,chemical laboratory

Deviations from the guidance in Reg.'uide 1.97 should beexplicitly shown, and supporting justification oralternatives should be presented.

RESPON

J«Ar «~d r««, Ii LC f V ~ iJ« ~P ~ e Q i/r

> Ia'f

1.121.131.141.151.161.181.191.20

1.211. 221.241.251.26

1.28

1.291. 30

l. 311.32

1.33

1.34

1.35

1.361.37

1. 391. 401.41

1.42

Amendment 9 QEcR F421.36-1 March 1984

chl217718fqr9ae 02/01/84 112

rhscf A . CHEC qudsrtotc vol.367

glotC 2D ttttttddh

Gf ttco To Ht4thER

Ph phot frdR

ptschIPtfoH

R.G. I.CIT REV 3phhhotrrfR

SEIISOR yyhc IFIch7toN 9 uhclrv Potttf R Pt spell PhSSvhhttCE Supply

CCRSSIC Cttnttttt41E S

Big DIf3PotttgR IttIG

Fltt> lfrfl.stRhrfhh p

RH6 ffuk g,yg. 8 't It.

flhSSIPICht H lochrtoH t '24tsrR ~ RRHS SE54CIC'

CoRE;4 5 I25$ Pst'2 Pgg.

<I+ . I Ct- tissu> PtdR y6I,II

P608

g hto If

PS'dfts

24t1E tPRN0 Pcox EEVER. B g <

c5I Nnozh tcteN

Sdc RC6 tttG

C5I N00I4 tlta. II Fluk ECVEL

cp& oc. RodPostltotl 87

cohf +i ~ I ktd cPS ~ QE5 I gg

utt rtt Ohhttt Cl

MES,IfE5'CRHM'"

COO~ If

ooo If Poof

paos ~

2 Z Sc EC. r I3 Rg21» Holt v J9

RV cooChttrcottc ~ B3

RthcroR ICESSEL

atrfl -A BCI a.~ C

3-'ttlr

I

Rr dtpc ~ ~ ~' ~«««~04rI 2304$ - ttso Cr . y<5

ltott~lt ~ Cp

otv S

ZZSC tf l.TABun VVg

REhcroR rESSEC

Cfrtk -S0 tt

R2 ocod ~ ttclfc cottfM1) 534.60- v3<6< 'E5 Va 5

rplv a PCOI g

dtIA Coht

rib 'TftopfhhTVRE

zzsctI PT6 4

I322 ttocxh

REhcroR VET5EC

PEESSoef «RRk dcOG + ~ ~

esto ctttf<+)j 0 1500 I SI6', /c~ 0(v I P64 I

ZZSc V PT6Bpu- NO6ZB

RfhcfoR vEssctPOES 5 OE'f' s6L.

RS ha,ddcsfc cctttttrJ O-ISoo Pst6 V+~ /~5

IE= ' Wll'X-- P6trt—

'hcf5 oF ICI

$ (OLC t D uoettl

DE~to go HrwhtR

~ ~

Phthe Ert4

ptScg(4 rfOH

R.G ~ (i%5 RLV )phkhmrrcR

vhh>A((IE Cchss(ich(NH

phd(,E A . ( lC C(utsrNN r(44)L)

SEH5OR OVAL(F(chTI4s

LOCI(THN! 5uSVR, l'AHS StsWc tuwtoHtH(A

PuhurV PawER b!SPSAPASSOAAACE Soppc

3'chrsurchnwrLochvora)

SOfaS

zchsS4PT zFI plv OLpgtssuRE 8 7q,. Ry QLob I

<Stc Co~r r) D '< . ~'< I(E S b«< P 6DIt''cNs c Pf x8 D 4'Y(uELL

PRE)SORE 8 87 6Rx hto4jSEc coum D-(So: ps b

I ;..)ES: I .4 V~5 p(v z PS%8

Zc&$ 4 P f 7A . 5PPPRE5$ !ouCuhrcdtR PRISS'A 8 7 C,

Rr ALOG ~ y,'stc cou~>) d ISD,~I+ D(V E, Pao I

rr

P

'rr'

~'

~c

SEE Hor8 g DRVtoELL SvtcP

LEVEL 88

cou™rh(N rht Nrltssuhf ~h

p g 58'arpltsswucNANbtA PRtss b 87 gr

4) ga oG ' I

(Stc'oarct) o ISo.pslb

gt gtoo((CC cour~r) -5.rOOC PSIG

)f5 '-. f'ES

r

~ .q r

o(v z PUB.

b(VI Paol

aced) g prg8 plwlhaVcourh(u~tsr

4 5 E 8896..

Ro tLPG ~ - ~

„'crccourarj -5 (e <5 Pyo ~; fES' QE5Pho(g

b I!Iz g

ZA8$ V acV is@~ (3$ PRiWARYcourhtua4tu vtV 8 (DW 5

A ou Ay, H(A Yzs kg oiv) (48$ (

xghs 4 acV I3L (st Par+ha YcourhfvHruf %tv

A5$

cc 4 NO I I PR(NAg VCourhlmtur VLV

8/DQ(

g(h I H(A~ ~

I Pl

':.t'FS 'yES D!Vg

X o(biPV53

4NO I r TV r ~ PcsCourei~ucur VLV 8(D, ~

OZ egrrothrrou H(h ) s(AI

. t'ES pto+z

P S(13

PACEZ oF IQ

J ~

Thd<d /3 . CttlC I/Otdt»tl eS/.dc)

Su tC SD trttr dtR

Frf Nto To ttrtttttR

SC»$ /f SOV AT iC 1CRC

32IIJ 33hJ 3 IA F'35 A ~

toht B r~ d LFIg B

Ph thoI BTCR

OIScOIPrtOH

PgttJthcotJJTA ItttrttotfXSachflltl ~CNIS

R-G ii%7 Rt~ 3Pht hlJttft'R

Vhltttt3IE tlhSSIFChftOII

8/D C I.

StHSOR

It/h At/A

LocllftON I 2A STR ghdd SCSIJIIC rHJJtttONthfh

WALIFICATtoht

I/ES

potttER DISplh3'SStthhttdt

SOPPC Vc 4hf5 IFrcrt tttttdoft 3

DIV1 P&3

Hd fgSJ

Tcr«s soV Arrd tt tCdD /thttrthRY3gdr 33d; 3lt; Std- COAtfhtOrttrrfdl///8 C3hr8 z5oc,AS OH .CH5 B/tt cx..

Atlh

4

ydfDIVX f~5

O Irr4 SAV rk rto PRIOJh

C oef htitttrrBAJT

htroAI ~cPS BIDE I,J

+/O'T..;. ylv5 fdf/3

P/tttrthgf4 V lar Cott fhIAJBIfit+

-cpSH/A" DIVZ

c Pttwtlo V4 JJIOV Io IOT lll lt 8/0 ~ f4

JJJ 8/SOJX Fdd On FOIS 25CAIIftOH -CS//

. j'RES'::;. " 'AS'

xcfco 0 0o Hov tow I

tsr - O

+pops oo I

PAJJJI hh YCOA fhtAJrrt4t< 8/Dg,Sfot hrtotl ~ C5g,

ht/g J '. /I/A ~ „It'" .. ll'g5 . QES DIVf f501 n

,15tt + trOV ter l3I PI I"I+Cotvfgtt ot tlrf 8/l5 Jt IISO hftOH DER d I yy ...'tljy .."'':;... P'ZS:.;-"/rg5 g DIVi fBV3

adtR V t«rV Itrti l30 Ptttrthk'YtoAtfhNIJI&T 8/I5

P I ~ Jt „... At//lS DER

'..IfES ' QES DIVZ fe /3

2DFR tt ptov tool t34/ trtrt RvCO*fhttt4ttAt1

DFRBIO/I I r At/h

(At/A . "..'rES '. pc& ww+. f573 ~

phtd3 OF Ir/

~ ~

VBBCB R .. (HlC Il&ESP(dtl ttdlrdC)

SlufC SD N((r(dcR

BE~CO VO tttltddR

phdttrt EICR

dfSOFIPItrrl

R. 5 ~ I« 'I V Rfv 3phl hrtd VER

SEIISC(A I3vhc IFIC41(rH

vhdth(3IE cchsslFLht(rpt cochstddl j 5r(SVR ~ Fttttd 5ESI(ttc Fttv(vdrtd(vttt

g V4LIVV45 S((R 4((cf

C c 455 Idtot t(r(v

potdKRSo/PLV

ol5PIII V

Lech ortIFFIE 3

lvofCS

WOPR P r(OV tetr IVO PR(r(r(RVCd(uVh(II»FV< Slob >,

5 Lhr(au «OTIC

I ~

Pt/A -; VIA . yes otv + ff13

zdd pf(u(P(kCdushttlr(EPV BIOI. I/P Itl

PIIA 'I'I

PtlA''.. 5 ., y'Eg:.. JES

2PP(r V srv t(RI zeal PF(rtttdvcr&fh(err(Eu+ ~ 8( ~

Sdchodrt - PPI(dtvlR ( 'giA' ': ",'/Ef. -:: Z '

d(V R P8(I(f

zdr Sd PIOVRIB(8'SX-

Fd C5 AI8

V,Fr(S It lld(t 53II(9

Bdl Po 3XA,(tj

//tr(((RVCdr(lrlr(r(fII< Bld Rt,gsrLAOotd ltd(5

/R(uhRV

CruIAIPr(dent(V

alo rf,z sdcANrtt Pws

~ /I/4 VlR.( ~ rt

O(Vj Pboa

are ~ IE /Co%

rr 5 fItrlIAIIII~34,((4,54 I'n,eau»du Std l,5 sr Lhf(OIJ « Iles I ~

iHCS d rd ld(dd(3f,ttfSd CB P(t(MII YCeufhtrtrt EI(1 Std fR ~III(rII NC5 ldl/I

Ptc'S-:. III'

r .,Vlh '. ' I/gp'<5.

X DIVE

T btv Z Pays

i$AS~ SOV ICV,ICC,ICr ICjj /RtrthhvCruse((ur(ous

5SIOet I ~

I3$

xzpsrSdVIL5 Idd IBC IB5 PR(»r(Rcert/h&r(ENd

Slo(RS,R tr

IV/4 ..

Hs D' ~ SS/SSl

f<5 „T, DIV1 / yg

<~cs(tr( ta(((aa (lC I C

IVS, ICV5 IIOV I5 5, (51

ESI FOCVr POCB Pd(3Pe 3(I Fd rtr Fddo

dst PO C5

l(g(P(hRyCo@'Zhtt(rl ftt 1

55OLPS(otl « 'Ec$ Slog),'/c5' f pl(o]

~ „ Phcf I/ df IIV

~ ~

fhgly 1 . (Hle Optsrsdsl 4cl.lc)

5tsstC CD «ssaidtR

CC Isco To HssdhcR

plllds RfCA

pgSCdlpsS44I

R.C ~ Ir'I'I RCV 5phl hsssdftR

SEIISOR IOsshL Ipsch old0

55CS<HdISs28 AB sfo PA+hgyCddrfhS«AC441

~'""Fdec. ~7+ ~s~h~~ -SC58 lo IIc

Cut SSIF4:hfsdu lo Chf»H s 5C5«SC P«SSIROSSghfSS

IHIA~: 'f55; PES

2L«SS u5OV 45~ sS57 PRS«IaafCdc fhSISFI Clsf 8loC5 'Pl IVI/ I

I,Issld -;;' ~.YES '-" - y-5

zms VSov I52I s5C. PRIFIhsfv r ~

cpdrfAsdras CHTc.«s PZ

~ '

2WSS v IloVHxlxoS Phs«duLYC

deaf

hssrsss Cssf «ii '".":,".-;.ill. '"s.jEg822 POI't <Sda hfsou

ehcsfv posvgR45 S sshhstC K $0 PPL

Cdhf 5SFSdl ps«

OISPIh tLdchf»sIHefts 3

o«x . P6ol

DIV I ft53

Dlvt PC)5

OsvS

pCox

HofR5

RdsSS II Hsdvlsl

B22 ~ pol C

Rs+IIAVcdafh idsssS tuf<Sdchfsdel PISS

244$5d IIVVvps,g,c, p pRI«4Rr Idio:Wps"'""'-Cpstsfhsum gssf 8soa z

D iso sffsdu -HISS'jfs.'fEgr

RPSosvg

Dlvz PROX

IISS RNVV4h,g g,P RsddhAycosssf ksds«siss F Blogf

822- FOXZ AsII,C 0 CSdLhfldu SSI5$IVI' rvIisl ':; ';"JEST',IFE5 RPS

osvX

Ca fds« 4«+c5l- J'oo4h,h c D E ssdLhfsdu 8sop ulh I«IR ' 'AS: t6o~ lo

Cy %40 dfSI dl44 ~ r'Lsd RSSdISse4' 'dd,fh 4 dscuf Slo5 ISSS-Fd2o XSochfsdu -Rc5

Sd fdtS m~ r S PRIINhR YdtC 4 Ssrs Cd*fhsudsfh1 Blo

Fd gsdchfsdss Rc5 5zt

HII} I

Hy} . ~... I„QES '.:. "- QE5 '

IHIP''";,'fES;:..'FES ow z.PcoZ

~II Phcf 5 of lf

VIIRSR R, ( HIC .OIEIS<ION 4ZIVJC)

Sloe c 5 D ttvtEbbR

OR&Co zo ttttdhbR

sttH51 Ho lh ashhvht zshr zch, xth,30h 3thcd to4',tt3

'hbhot gtbR

OISCIIFrtoN

PRIPI hR E/

Cotvfrtlltthbot15SOCWTIOtf ~RIIS

R.G ~ lr%~ RCV 3phhhotrrbR SgttSOR

vhh«eE glh5stptchoott Coctt ttoN E ygpSTR ghgb

OVRC IFIChttoN

$ 8544IC brtlnkootbtftg

Q yhsttV potat RRhSSVRhttCR SVFFECV

C 4 855 Its to Oorr

OI5PSh V

Cocher/HPTR 3

HotES

btz-FOCWhr FOthh,FOV hFetlfh,rotrh tsorErg ForthFtdfo r Fos flitFo sdh FoslhFofth'rd ZI'

oob'LHS

OVSOV Ib tC»58E8ggsvhrb 558 g C 8To83 538; 3TI5 ~ +o8$Otbr ltz

Its Foott8 c Folsb toEErt,c

FO4Sbisr Fddb FOIEthrrdrfb'FIOS8; Afro/Foboblrottb'ootgshs tt Itcv I6otl6/

PRtorhRV,cotv vhtstol Rbrt

5Sochttoto -Rlls

PhtNH4 fcoil thEHFEfdf

ost ghS

B/OTTz ~

l3/ou, I,

Ir/h

N/A

H/h

/VIR

r IE

Ve'5 'rES

~ E

yES

. IIFS

e/,ot

'DIVg

'tvl

I6 3 Ftt trrl8goEVfhttVtobolf

SAS6tIOgz

~ lt//3 " DIVZ

zSCrd <osoV 5ACtf t Pdogh

iolhhcool fhttvolb+1 «OVzsochttott SI-5 V lt ~ . Pr/P3'"'. '„'.',(E.5'. ', 'ES Otv l P6ol

g5CSE 4/LOV 58 . PR™hRVCdtrthihotblrl alovzCIII -Foo68 zSog.olttoN SI5

- I/O .: ',"IVjA'4'c.',fES:. f6'$

Sg HoV ttz i~A pR'tuhRV ~ ~ ~ ~: ' "'.''"."aE

Cdarhttrot/EHT g/o g ', /v//3 . Rt/R "..-"'=.. ~-.„YE>;" ".'p'ES.'- . X D v Isv 33 Fo ottr Fo f0 zsozh frost 8tcS TV I ~

RsvcS sl trtovtox@33rFOO(

PRttEI hRVCoo Ihtu<bstf B/ov/g i... ? It/R j /v/R "':.'ll'lc'5, .'' QE5zsocpf lot/ wcS

OIV 1 f6og,

Oiohdrlv«vvcoEHIhvo»stFW~IILV CPO~T cJ

QIEII1

It.o. a48" /A/ ltotlHR

phbR6 op IsF

sndi'E A . C Hlc.(lufsrloH vfi.sc)

S(u(C SD Hurg(R

bf.p,(O xO Alrh(R

fhfhe EtcR

p(scAIPHSN

u L OfRwlhR 7 Co oihu +

bhRHh Spfcthulh

R.G ~ I,91 R(V 5Phkh&ESER

VhhlAE(E ECHSSIFIChtHH

SEHSOR

LOCIItHNlisa SVR, RAHC

H.O. i IS

Ouh L IF(CA ZloH

sfsMIC fHINtoRCHth

guhiityhssuhhHCE

cihssIROIIuH

POUER OIsf(h ySuffiy

«utf 3

per-IE

H47f5

HIA CORESEH PER A1l(RE

f SIOSE I I EEA~R f ~A tSVSZEw -PRESSORE L 0

$ EE HOTC I I

SEE «4 C f Iushhy

hREII RAOIhttutl C (s ~'. 35 ~ ~

l

GAIA

HIA

phyllLL Pht}ll/Qlrps LEVEL

ZC~SWL7 IIA SufPR 5p04L &htfL LEVEL g 7 ~ $ ( fc ~~o) I$7 2o2.F ...'l (+.4 fg 5

6pius fbo l lg

~C~5 g(.7 II8 suPPRfss lou kv gioC ~ .. *

pco(. (uhtEIt Lf EL 4 7~- .f ( fc „~j H7 . gotff'; ti'gf. yf.5hhh R 67

Dip X p~g

zcfhS 6Lf (lA . SufPRCSSioH Ra gLOC: . ~

C7C ~ " (Sfc cornet) 'Ilk >(7 F7 ' fESl'I'E'Nb)

oiv I Pcol lW

xcRSWLt 9B SufPRhsslo> mRLOC - .

Pdoc cuhtER Lcv c, 7$ '.. (sfc

curtest

IQg, 7(7, Fl, .-.(I gg., "E 6

Z Divs ~ lg

SEE NoTE IS OhytufL<PRfssuRE

' ~ lt

SCE eotf (LCf otf IL

Itfhctoh coochutSystcfh PRfssuRE CQ

~ I Phgf 7 oF ICI

Thdt'E 1 . CHRC IItrdsttttt 4hl 36)

Sotdc sD wrvetR

g.g -iipo fO HtrhTR

PRRAPt ErLR

pgscgtPffolt

R.G. I.tIT Rdv 3PAR hat ttR

vhhthdtE ELASSiFcnnoH

sEHSDR

LOChfttH! OusTR, RAHC

EPOAL Ifich TtoN

5R5ot tC gHVikOttSHTA

POtrf IL DISPth thssvhhttCfCaASStacenwt Loch

H@TE3

HpffS

5EF uofE t7 PRirtha Vcpufh tv+

Etiam

PRRSStrRE l7

coafhlurt a fzc"5 + ttzt CA HVDRooEH I'. II'. ~coaccvfhh ftoH~ A

gx iILDG .

yoattt hafelt O-3o.Vi'-: '.,'f65': .= 'ftS Did I Pcol

@Lots'zT Cd couthlurtcut*VDROC E'H ' llgt

'Rh 8

Rf hLO& ~ ', ~, ~ ~

Sortii tse O'O'. 0-.3'.,fj '! '::t(k~t - I 'ES X 'D«z Peea

~S g AZTRIA coufhtuhigHTOk YgEhl C IXa. ~

A f ~

.DtV I PCoi

zc~sERrr ~ISO )a t'tiLrhl

tltilttoH 8'0-id'" "- /f5 Dt~ <

Pea�'RHS-

chg ITo coufhtveovEPF L ttftt TRh piohcftvtff

>R>S-CAa I o EFFt.vfuIthotohCftVITY

zfcts-FT gAtg . Pihttt FEED ahfcFLoto tq 8HDOIA 8

01

pth+ Sfhctt .XSotoPlCT'EHCLOSOAE o-t .Ios" tjg ':c~J, 'Qp-. 'g5

- SSOTOP IC.;*2 ." mRd Dpfl' S:"7 'i q'.7VO"FLooR 'O ~ io 'ACI/gc r; ' ~

Ttthd SLOE:

Crhcii7 . ':: IVI7: oo

ttotritE p gq<tePS7

kov-tE P gsglrPS)

Ilotl~lf fgo

-~

sfohhCE ca c vt. l7 ~PI 8

XRttS OFT f4R SoPPRESStoCHhriaEPL SPPIA V

EIIDFII FLo

9 ~ .. g T„lot o -Woo lt4PI L "~.',

Rx dLDC.SFc coitfoLTQ O 050 CPM "-'IPtp'5

. 'C5 Dill I PCDI

i~ r

h ISE PRAY O3b.lSD R 8

2Ra ELOO.Itic ccrc TN T)I

I g Ditt R Pfol

phof g op lff

thdd A . (HRC OkfsrISH 4hladc)

gOIEC SD wtrhhfR

Of~CO 5O NrrahfR

Phfhsl ESCR

pfSC RltrrfrH

R-fa ~ log1 REV 3phf hntr icR

rlthrh@E fch5slptchtrrH

sEH5OR

COCHVIPH a ~HS1R, RRH6

OarrhC IPICh7IPH

SfSlrrttC EHtrrrOHCHIS

PuhllrVhSSarhhHCE

C llISS IPlahtraH

PotaaER PISPCh uSuPPCaf

Nrrt3

HofES

SEE HorE IB PRYurf aLPRESSPRE re

Sff Horf Ig StrPPRESSIPH pnoC.OhrER LEVEL pg

Rrq

Sf tt crh f+,fghrrrh SOPPRESSIOpl PRaoL

IOASER vEPhp» A D 6aL ~

5pPPCCSSlnu

Proc. ~~ 50 fISO f" ;/to'5: . Ijgg D V] P6o

Cnrrcurf 618pCHd fgd>top SPP R jsstdll POOLuahrf'R tEMP ~B D bb

SrephfssrsHPOOI. 5o- x5OotrI

Pfg IDlv 2 Pvgs co

xcptsfrf lot rrlrfrsra apg pRlaarELLtcpaP -A DSR.,

ORWELL o-Ooo'P' CES, QEs Z Ptv I Pe13 zp

CCSISE rfltf rrrra gratr lsu. PRV IOECL IIrnaOSD7b,

tEpaP -BORVtaIBCL ~

~'q+",l pgaa DIV Xf515'RHS

FFr 63IS PRVrrEC

HEPIPER Floao -A 08aa.

xRHS VF1'38 . ORvr ELL SPROV

HthofR paaaraa B DBb.

R» EeocIlfc co+Star) p %50 QpHI

Rs dao&CSEC Carrrrtat7J 0 355O 4 PM 'S

PIV I P6o l

OIVZ P6c I

5df HO1EIg'ff

Hrrf Ig

raahru s 1 kaNcSsns artraOu yharaE p gCfhltitot COurhol,

T

Sv V+ t 7 fso —sr 3 prr»Rr SlrprrlhCCrfp VhaVE

sDtoac.

hCOar Srl CSEHSor nrtrhra Pr PE

IsSW-

Plv I pha l4o

gsqS y P1 IBI Phr~lrrv slPslurp vkaarrh05 HfhoER

ADtob,

Rs Iaoo ~ i, ~ . ~~

(sfr caaar isa 1)(

0 x50 oSl~ "QES . AS OIP I P605

~I phut 9 of IV

thdd Fl t Hdc,((odpr~ Qclrdc)

5(otC 5D Nvnp(R

DE~CO tO NeH C(R

PhdhH EICR

p(Sc pIP ~pH

R.G. I.Q I Rav 3PhC herr rCR

SEHSOR ~ 'vhg.(FlchttpN Q.phurrhSSVRhnct

C in S5 IdolI+fr

PO~ER OlSP(h tSvffCY

op&3

l(dfR5vhh(hl3(E gshSSIFch&H Loc(ITAIHI 5u5tR ghgd

ps(I$ 4Prs3o all s3L lown v 5 fcplaice vnc.vo 0(0hoS rnrK Fi C ~

t» dsoc(SEC Cour' .-' > P5'+'

sshSE Prl((6 fh~n gpfg r R» dadahfuCF VasVE p(oi.' .- LSE, CN+Otr) 0 Z50f5(g"-Pop Hcnogk

SESNIC 'HVCogggol

X Dlv I P6o(

OIV C,

I

AS 5 Pla53 53O, 53$ +3< I~n f~ 'i!. (SEC Cpurxg O;.COO,Pfkl6r .gory..;,.-~~>80$ thuc FhggRc

I

r ~ ~ .

DIVA ]do(:. ~ ..'.CIr( etg

rh5(5

~rr~

tsC Horj IS

$('E ott IS

SEE uprE IS

5EE HorE gv

c CN5I I 5ÃtllSiOC onrph aCVgg.

5$ oc,ho+uC oupo'N gfII Vh(llPr Si rsvp n( V

(r ~

5 JC5 4 FT Iog.

ESI Ilo5 I

xcSII RFI to5

Exx-HO Sc

gC SC F Loop ' (Stc coHVHr) O" SOO(rP(r('''. -)gj~:

(IEC ennrHt) D AJD(Y'Pl.", +jy,.'"... 'gpss

X ~ olv I II(A

blV3 3(IA

XCSLS FTIOT

E'Elr H05(

zRIIS 4 FTIVA

Elx-Ho (5A

I.Pc 5 F(dos DI5.~ .''v d(oo ..~ . ~ r', "„;~,- .

SIK. cpN>r) or Iopo 6PM yf5i

(SEC coutntf O-g)DD O~

jgV] pll

"o vl

1RH5 5Ff l+di C

E(5 IIOI5Sic

ESL5 v F1'II3CWI -HOor

LPCZ

5C.C5 FLoe

P(6d,

P(7

g3 Cspo ' ~ ~

(sEc ) o- B.&+P< ..I(Z'g ~,: . )E'5

Rx dcod(sn i~~rfl o- S6 GPNI ~

y<>

oiv z P6ol

~X ~V I" P6OI

Phdt lOoF IV

Thtlt A (IttC flktSTIOII 4tlrlo)

5IIIEC tD wutttfR

ftt&to To NttthtR

FhthH EftR

ptsCAIPftrlf

R.G ~ I.QT Rtv 5Pht her rtR SENSOR OIIRLIFIchTIIH

LochftdH Ta 5TR ~ Chit« StSHIC tltvttttlfthrh

pohclfvhssohhIICE

C LhfS IRthottf

pottiERSuppcy

OISFLhI'ochftftl

NoftlHOft5

%«LSD Lf/O3C frI ~ hl OO I

SEE NofE ttSct

5LcS 5 TORR6E

<Alt LEVEL

RHR SVSTEPh

FLooI

tchs«IFichorl

pityI

Rft ELObL«tt Cotter) 0-IOOOO 6IIL X otv I f60I

gZ

ZRNS 0 TEI3A ~ ticehoccA oowtr p tOILE It HozTFI Tttop A

Rw SLO6cstc ccwfrtr) 0 -6OO F holt ~If Pool

RHR Itt r~cH httoth oofLET y 10l, Z

Eis hloXT8 TCptF 3Ra gLOb(Stc CANftttr) 0 600 F NrH IE lt60l

SSIOP g TE Sip ueLtrvo IIIAI rCNPTo ESF «f$fCH Dzl<

hrhftftf5 A

SctltN atLLBa 06 35m I30 F f'ES QES Dlv I p60l zo

ZSIIIP g TE lip ooL+'o tohft TtrtPTo ESF SrsrtH P2IIIcoAtp S 8

SctttN acaL8Lob 35 I30"F YES DID 0 P6O I

xsoIP 4 Pf I3A

Et1 Noo TFI

Cool IOS tttlfCR FIOtrTO Ese SV«rtlffcotrrootltf5 -A

Rs 8Lobistc cooo r) 0-lo,ooo bFFS yE5 pE'5 PIV I P i 23

ZSIuP < FT I3B

JVOO 78

COOL IPtb Oth fthm

To CS F S VSTEFh D225, 7.c HFOIEHrS -8

6R cooc,geo fohft R FaotoTo ESF SrsrCltf pzZC ~ 2.

5

Rx tcobIstc co tt r) o- lo,ooo &R" yES

~ ttSEL OEH.@Los O- l6O H'hI 'fES 9ES

Dill2 P4OI 13

DIV] PT5X ZII

68 cooc. e~sESP SVSTEIts P2ZQI Z

LOAIAd*cAITS owl fft

OI ftc btNtco6 0- 56o &Flh II ES OiVZ'lsZ

mstttp«I FT 535 ooTo ESF Srsrco« P2Z + t

P

ottftc tetrtao& o- 650 &PNI yES yES Dlv 3 ltl5z x'tl

Phot ]I oF IIF

jIIItc sp wuogtR

pt~tp 5 0 BIohtROtSCOIPII4II

R.Go lo91 Rtv 3phg hrtd

fthm

vhglhBIE tch55lpch&H

fngit Pl (Igc outsf»H vzl.56)

SEN50R Ovhg, Iflch7IPPI

LOCRTIIN 'INSTR ~ gh5I6 5t5PIIC dluutfOPIghlh

qvaclfv pooka a pl5pch tASSuRNCE Sul'pC

C 5 A55 IIIOIOoII CrchIIrftW

HofI5

IIISIIg S- gh,dc 5th,d dfl dtOI0 VhtulC LEVEL $ 13

Rhoah55EBL05. IOO 1o jap Lure+

2K +~ IE cootcrtROthouIC5

Rohoplb,6RJMJIoR fgor h IIDhHPth Pos eoH

Rr Bt06Cstc covlulr) sllh IIES QES T plv I PB70

ItutWRrp I8,6B BB oBCA ~ N

h P

D1 ter Ru ei00CStc coueaf) Prjh PES DIES PlvZ PB'si

5 fh 18$ o F'rod vSooted s

hV V 8E-I DZ5o., Zz g.vs< ~ oo I

o Isovoc ITS tuv l lot5 1,

zB~ SI Eyt lg sfhlus OF sr v P»Soutct 5 pt5b ~ I.Boffgtl cutttl f I

Zd VS t Suo OO

troa ro Oslo hoiS OIV ) Pt5L

5 TVS op Io5ouhcts p XSc,ISoffgtl'4rhdf Z

~ 7zdfsgsosooIB

0 lco voc pe AS Jlvz I PB5z

<Bf5 II E/g IB SoutcES ~ DZ5$ ,lsh ERl cuhtthf-s

agfsdsvsrosdtooo ru O tcoo hoPs blv z. PBSZ.

MS rF 5fodl'aSroRCCS- p>S.e.llh R CE

z BCS <Avcro?O.lco voe )ES pE> Z OVS

sfatus or 5Tpgr PtuSoogcCS pz54,hhffdRV Rg

sgOSrp 4+4zIOO ro OIOO IIrPI IFE5 OIVg PB5Z

P'/R 5rh'rus rl srodv I uSouR<ts ps5e, 1.lIPS voafAC,E -R

XTBsocf zA 0 ro Iso Yhc ITS IFc S' DIV I P85X.

$ 1IItus or SIOOV PuSoodcg5- Dz54.I 5 RREOf A

ZVSS top5<R 0 fo zco hhPS t'tvS II'g PIV I FIR

PACE ILop I+

rhEIE A (Nlc IIQESTI4II 4iteEC)

CIIIEC SD ecuechtk

DE~ED TD JllcehER

Phkhfl Efck

pgSCOIFT 4 V

E.G ~ lect1 REV 3phk hcvrrER

Vhkl NE EChSSIPChfceH

SEIISOR Oultc IFICRTI4II

gochrleht Sa 5rR, khah SESFIIC iT uckONENrh

Pda aa DISPIRITh5$ ukhNCE SQPPLV

c 4 41$ Ifccoowe LocheeTE 9

Itpfrs

SThfuS Ole Sfodr P»SeeRcef- 0>5/,

TIIQS VOI hot bzvttSFopsiS oro Icovhc yg5 yE 5 Dlv z. PE4IW

Cfhfuh OS Sfpef P»RMeRciS~ nz5lc

PS CQRREIIF 8Evessppsz8 o ro ecohecps

DIES

DIV Z NII

NIRSTRTQS OF Cfper Pb$ 4ORCES nz5c,

C V I ht'cExE3$ ERS I ~ dro rsd VAC g+S

JEST

TES5hhSI g5

514f QS OF $10ltl'P»SoukcCS- Dz544, x

C VEyggxth, 8 ct ro sooohecPS ygy lES DITe I OIA EC

TQT of 5TOE RSoeRCES D25II. Z sE35 Re 3 3 o 1»SO 'TS QE'5 PIV g TESSCLSS t5

Sr fe or 5SeekCE5- DLSp

V eZEJ$ CttsPI,B drfe 34oo he PS fE'5 lt'E5 gtV Z. PIPI ZC

NIRcuS ef 5T

TeehcCS'» DzeItI'V.Sa4t V rhhE

o ro l,tc Kv )ES Dlv I Pcs z5

IflR $ TO tu »F TOOlcES Dz5

VRV 5 CR RPIE

O~ IOOOSIQOR ol4$44

~r I See Feoccetcee L Fef relet

QES X Dtv I Pcs c z 1

$1 Tcc 4 $ TOS Fa~eFCCS- nz5

SIQORO ro AC ICV >ES TIES T Dlv z PsCT. z,5

Crltfu5 4F SfodrSeokcES oz54KV scut'cg cukRAIT

IOOO recce

ociftc PEEO t,pS QESO ~ Secs Heiewleec clear 41404

Z DIVt Pesz Zy

$ 1 OF$4ohcES- 025@. Z

V Socteh fhff oro WCKV YES DIII3 Ptt5a z5

PhCE I3oF If

thPCC 1 C yPC OOSSrrO> 4$ lipL)~ ~ ~ ~ ~ r ~

SPEC SD NvrrptR

Greco sp IrriolIFR

SFC yorE CS

Ph!hor ErfR,

olecplJ rroII

R.G ~ 49 I RSV 3PhlhleirFIL

SFHSOR

SSIPChPOII LOChtldH SaISSR ~ Rhyp

Srhrvs OF grP I,Sovrcf5-Il R oh hp5,

D 1rr pl

d Soo PiPo<lrla orrp

d I roo hopa ogr

r fv o LISovkcFS- Dzg„g.II V S CR cvRRSHS

IPuhc IFIch7loH Pp4EIL DlgpehphgSvhhyCE S„PP Pcaheslaroorrr Loch

yotE 3

I DlVQ PSSz,

HpfR5

Pb+hhy Cour uIoIhltA Rh hfdf

R $.

RnSPRElB D PW~~ r covrev>rvr"Rdh IehprhtroFI ~lb

HP

pRyrvELL . I -ID R/~„

DWSIELC l ID'(

lpga l fssd

SI'E borg SS SFcrurohhy convoy~Rh plhooH

POBO

SCC NorC30

SIC HotE 3g

VlthL IIPFARhplhtioH HoynnR5

El'FauChr ghplhr oHRfL shsPD FRore

h f

ec effNd E Sp FIOrC 3O jll0 Norr-IE

RhpNCoIIII>rfhdfhPrrCS

Fywdvve <hn,„ro „Ilhplohcrwtty

SCC AorC 5rP PICFCnCoLp p. II

3l 33I

@55 p - sPHLlol

ORS - Dooy

hcc>oc~arar wPhir hhr. CodahIIr ( IC'yco~rhAQArFIlr hgR

phpohe>ehr PiCRover AA

yoy'<E plSDR

IIoN~IC

phCE I4oF IrP

CsISS(F(Eb. 85 po~o~g,

ABOVE'5 F'R NR< QUES Tloral OZI 36 ra8CE A

4 couS]f 7$ o F j]<L. g. P'@hi >5

Pp t oi- 5

c.PRN- ERoDP 5

l-PRw - (Roof'

bPR~ - craved A

RPR~ - ch8u NEC 8

BERM - Ce8NNEl. C

)9I R< - cHAA@FL >BPRM - CW8eiVEL E

/PRE - CHANNEL f

C ZI cPR~'S)

~ . C ~~ I-PR+s3

C zy Lj g~'s)

6 XZ ~PJ'S 5)

C z I </'Re'sg

~Pe~'s)

C Z I LPEW 'Sg

Czz Lp8e's)

g P &$gA 55 Jvllbh TED V],'c UE 5 14hlbL fRou PgyTgog ~o~lrcgieg

C lRC~lTS.

3'. Hgg, PigPg]9-95', ]fgE PV>li ]48l E Ohl 5POQ OR RRDI8no4 ConPutE'R TEInrvi8LS

Ld cB r!~Ns pF fiNED pRov(DE 5oAn$ p Dl&rN. >40(cHrioA vn os pgtogg.

bbrR e8uCAt.bf'eta7CED TerO Cnm/ll,rgb,

~s, ii5 ~ plRd REFEFE+<E sS 8< 3 8D O'V < <+P +8 ccPF SuppsP7 /'COTE)

8~V INVERT (> o.o" REF<llE>cE, E'$ lire>H o'r87 Pb'57(F(cgglopl Fog Nov co: ogNHPQ

PRRAHEiER Nor prg-1JSc:PED oR vcr irongb'I

PER Ba'R'oC IotirioA'e'er R so/ ~oRd ~egad coc Pcpa ARE

T~ZfP'P GTlUF, C 4 I9 ERR CORE 8'FCHG Sf d F VWERNO P F+84(C

daAI 5'/DFg )9 THOLE (p0$ /ricO 885ED g po hl )PA I Q7 )PEV 2 l

~

~

7~ DRY™EI< Sv+PS mD~lt~RfP Vi8 8'trPPRESSiON POOL

LEVFL ~mStkvmE+TS C PBEAAETER C7a.,b ) 81'TER 8Q

yacc iDFH7

Pg, z o45

8. VPI'EW g8u6E g i= Sag TR uaE)tl ~ C D VFg gl) 8 f KRC'8LE 8. 7$

se- rRN Q su s s'u oo-si Aaas (»

Assets'rs)

II. PH RhaS7ER Sa~F bs .Pbna~c~EP

1x pBRB<E~E< 58ntE g5 pbRhmgfER E I~ $

IB- /JAP-< W~~ 8 8R< ~ eo~vH]~en~ uf'C RI~& r%HE S'4 PP REH(oA'oal SENT YES P 5 pg 5 crpsP 8ZcgoSP

7'ur

si DE (of' o~r be or EA'r) pnz. pi~ & rrSuK 5 HRE xsocdrEb.'+

a@7'fdA IF'.- . Ecc5 5pcTrau" Leuk X'5 jq g

54 PfRESS I@4 p004 )d. W.L.. X 5 ZOG

I 5~ PBRB]v)ETER 5&ATE 85 pAR8)ngTEg, 8 7 cr 6-

7 PARBME~FR cAmE f9s PPRHAETFR5 87,h E

ovERMi'PIN6 o F g8uGES Is EEPo(RED ~e m gZ7 jP t'

<8. p><~~~r« ~~~E as paRa~s~~w sea,6.

lt, I'RRRmkvFR'tol BpP~IcHSLz ~o ~~p-z,

~o- X~sziur S~~ RQreE pfggT5 g~rgglf pp gag ggggg

al- p~I'-a y rr<rgES H pr-S r~ r.IEa. op ep'c X

F'akawZ rZR saeW Ps zPRAMErZR D I6

x 3. 5ER V(cd gHR h'e8 ~ Ecch'8+&ZRS

z rr 5FRUlcES Ent ERC EPr f D(E'SEC 6-EkZR~r4'R SF' )aors'ag y

g i ii iu iS WZB siiRE'D FAo& DicsE'8 V S T 0 DiES'c 6 .

BLESS Voc.rRCE ss mghsrEED

\ \ ~

24. P'>gt3RE TER cowSrSTS oF Tu 0 - 5QN)MLS, pole8L ( jJc. O'RA'f. Q

f'FED' ERR r. N7 g runts uoac ir~pvrs3

xV. Pf'lANETFR corvSriv5 nF AHA.'EE Sr&>8<5 - ucn~Rc HctFRHhrE

p ISRAEL <BEDE'R <4 CRENA (<+urv,nor. xeev rSg

z8. PBRANETER 58NE Hs pbthpfE7ER 910 L,c g, ~ p

Pp 4 o4'S

P+88&gTER Col ra con fcrrf+eg u irH GuiDE

f~>r+~r4+ ACA/70)85 If'' +>< Qv8crI=re T'c R 0 l 8 9

lu>7'i~i<ATrow ~+1 RELIC rnA Eua. Dug Ig ~a A cc Ws H8'dE

41= TER R one R

30'. paurTorr.'D

zRnts- RE l(8

<g>S -6 <zi

zRe5-RE Iel

26.5 -Q Iffy

2RN5-@ i%I

ZRn5 -RE iqZ>Res-RE ~qg

y pscprp lrc hr

Vir.bBMOC

5a,p]ok Roe

g~a,~u ~ml R'~

pl ig C~r'0/ g~

R'o|'ap E. Copyibr R~

H.P /la~leva/ Co Nuiy R

Rk/Rcd Ml Vagrk pczifor

Rai~ g<a.C tC gu,l~aS~ R~Rro~

%~57'. Rgg

i - (o ~ m a]~

ol - lc vR/h3

ci - I> MR/j,i3

.i Np R/q„

~ i -+gnR/„„

Y

i i -(0 I~R/~

(hrI (D

&vERE P iuro zwERC Eec V gEsr ovsZ plica.r v'e5

CERg) r-c ~purge

>2 fr PAP'E7<R ~~mE jg 5 PBgdnf+TgR 5 C t3 C I+ Jcrhjr'7/G+RL (

. i~4'n .- cp i ].Wc (Ds E~a+ Z~~(: Ip 'n i p,(„>3 r=ddu ED~ C) ICglll 5rRcK D IOZ >Od C, j/4j

z) Rv/Rale V~A - o - zg 1 3(o cFN

Hz(cg~~ <~~< l~uzi a ro ~ — r o

-. ro

PI5 og g

p~ I ] co~]o IIc n c~

R-G. IÃ7 PXIgyS POP . Pokr+8LF 5hHPI-1>6 Rub AICTlcA'ffAlll+L

SPEC rto~Etgg /'aRTRQLf ~~57RV~Emri97loN ParS ~o r aouFg

T+E EEg CrIRED rRugE 7h'l5'g uipwE'u r ~ h'oa EVER Rk-PPF Serg

VaE 8ES 7 Hah. R8LE rECr O~ol O6-f

'Yn R-G- (.97 Fglgr s p'6R-

I u C.Z CO~PC.I+jVCE

g,) QltuD D IRECTIoN

b) P~uD 5 PEED

0') +Tno5PHEgl C 5TH'>LlT

f'35.

H'-~- <~'Rcy'(OE RA 84 K~IS fROM LRB

Pull- via ISloHQL CODICRTiog nu / 8+/, VALVES loRracI.'f CcoSED

puR]u 5 Rx D PERR'rl>d

37 g) HLL Vr94l/E5 4AOrc& TEP cu Pbo~ - ~cF'g~« I5~,8 I6 R. 8 '!78 E

W+88

yacc. V]fcVG x~DIcHQD aIJ l'T3 - >cci ~W+ (>< I'+~, >45 ~7>

FBa) gLL VPivES x~oic+rru n~ PSn/ zS854 5'~V /6VIL5')

SLY VALVE5- ~DIcPlED oQ f 85I - Z$85 + 5'ov'lSd lgl'/d8'td lS'0 $5

39, TivDIe8rloP IC GÃoS5 &RS CrrauHEL <<usNureSAlr RIIb 'y ro co cP+,

LDCN GE124Attachment IPage I of 2


QUESTION'

421.37(7.S)

RESPONSE

If reactor controls and vital instruments derive power fromcommon electrical distribution. systems, the failure of suchelectrical distribution systems may result in an eventrequiring operator action concurrent with failure of importantinstrumentation upon which these operator actions should bebased. IE Bulletin 79-27 addresses several concerns relatedto the above subject. You are requested to provideinformation and a discussion based on each IE Bulletin 79-27concern. Also, you are to:

1) Confirm that all a.c. and d.c. instrument buses thatcould affect the ability to achieve a cold shutdowncondition were reviewed. Identify these bus'es.

2) Confirm that all instrumentation and controls required byemergency shutdown procedures were considered in thereview. Identify these instruments and controls at thesystem level of detail.

3) Confirm that clear, simple, unambiguous annunciation ofloss of power is provided in the control room for eachbus addressed in item I above. Identify any exceptions.

4) Confirm that the effect of loss of power to each load oneach bus identified in item I above, including ability toreach cold shutdown, was considered in the review.

5) Confirm that the re-review of IE Circular No. 79-02 which-is required by Action item 3 of Bulletin 79-27 wasextended to include both Class lE and non-class lEinverter supplied instrument or control buses. Identifythese buses or conform that they are included in thelisting required by Item I above.

A methodology has been developed for addressing concerns raised in IEBul.letin 79-27. This methodology, applied on WNP2, has been reviewedand appr'ov'ed by the NRC. The same methodology will be used inperforming the required study for the NMP2 project. The NMP2 study iscurrently scheduled for completion in the second quarter of 1985. Themethodology provides for a systematic and comprehensive analysis toensure that, in the event of a single power bus failure, sufficientcontrol room indicators, instruments, and controls exist for 'theoperators to achieve reactor cold shutdown. The following paragraphsoutline the methodology to be used in addressing the concerns identifiedin IE Bulletin 79-27.

KC: pes/118B-6I/24/84

LDCN GE124Attachment 1

Page 2 of 2

1) Review the Class 1E and non-Class 1E buses, including inverters,supplying power to instrumentation and controls in systems used inattaining the cold shutdown condition. All buses that could affectthe ability to achieve cold shutdown are identified. Existingplant operating procedures and procedures already developed forthe event of certain 'power bus failures are used to ensure theidentification of all potential power buses.

2) Identify the instrumentation and control devices connected to eachidentified power bus. Evaluate the effects of a power loss to eachload, including the limiting effects on the ability to achieve coldshutdown.

3) Create "bus trees" denoting the bus hierarchy and cascading busconfiguration of all buses that power instrumentation and controlsused by the operator to achieve cold shutdown.

4) Determine the annunciators and alarms that would alert theoperators to a failure of any of the identified buses.

5) Determine the effect of any single power bus loss on the ability tocontinue in the particular shutdown path being used at the time thebus loss occurs. This analysis includes the cascading effects ofany bus los's and considers alternative indications and controlspowered by unaffected buses that may aid the operator in the eventof a bus loss. Identify alternative shutdown paths available inthe event of a bus loss and existing procedures for restoration ofthe affected bus.

6) Document the results of the analysis with recomendations ofhardware or procedural changes.

KC:pes/118B-6.11/24/84


UESTION. 421. 42

The transient and accident analyses included in the FSAR are intended todemonstrate the adequacy of safety systems in mitigating anticipatedoperational occurrences and accidents.

Based on the conservative assumptions made in defining these "designbases" events and the detailed review of the analyses by the staff, it islikely that they adequately bound the consequences of single controlsystem failures. To provide assurance that the design basis event analy-sis for Nine Mile Point 2 adequately bounds other more fundamental credi-ble failures, provide the following:

(1) Identify those control systems whose failure of malfunction couldseriously impact plant safety..

(2) Indicat'e which, if any, of the control systems identified in (1)receive power from common power sources. The power sources whosefailure or malfunction could lead to failure or malfunction of morethan one control system and should extend to the effects of cascadingpower losses due to the failure of higher level distribution panelsand load centers.

(3) Indicate which, if any, of the control systems idehtified in (1)receive input signals from common sensors. The sensors consideredshould include common taps, hydraulic headers and impulse linesfeeding pressure, temperature, level or other signals to two or morecontrol systems.

(4) Provide justification that any malfunctions of the control systemsidentified in (2) and (3) resulting from failures or malfunctions ofthe applicable common power source or sensor including hydrauliccomponents are bounded by the analyses in Chapter 15 and would notrequire action or response beyond the capability of operators orsafety systems.

RESPONSE

Two system interaction studies, common power failure analysis and common sensorfailure or sensing line analysis, are required to address the issues of thisquestion. The methodology to be applied for these analyses for NHP-2 has

already been approved by the NRC for Grand Gulf, Shoreham and WNP-2 analyses.The studies will evaluate the consequences of single power source or sensingline failures on control grade systems and determine whether the limiting caseevents are bounded by Chapter 15 analyses. These studies are scheduled forcompletion second quarter of 1985.

BAM:rf:csc/G08077"-18/14/84

A. Common Power Source Failure

The following paragraphs outline the methodology to be used in the common

power source failure analysis.

1) Identify all non-safety control grade systems that could affect thecritical reactor parameters, i.e., water level, pressure, and power.

2)

3)

5)

6)

7)

Review these control systems at the component level. Identify theeffect of the loss of power to each system component and subsequentinteractions with other components and systems.

Generate "bus trees" which represent the bus hierarchy and cascadingconfiguration of all power buses that supply components of controlsystems under .study.

Perform a combined effects analysis. Evaluate the failure of eachpower bus, i.e., load center, motor control center, etc. startingwith the lowest level source common to multiple control systems and.working up the "bus trees" to the highest common power level. Ateach level, examine the effects of the single bus failure and conse-quential cascading bus failures on all control'ystems'omponentsaffected.

Postulate 'the limiting transient events as a result of the combinedeffect analysis. Compare these events to those analyzed inChapter 15.

Perform any additional transient calculations or analyses required todetermine whether the postulated transient events are bounded" byChapter 15 analyses, assuming there is a single active failure in asafety system required to mitigate effects of the event.

Identify any hardware or procedural change recommendations thatresult from this study.

B. Common Sensor or. Sensing Line Failure

The following paragraphs outline the methodology to be used in the common

sensor or sensing line failure analysis.

Identify all non-safety control grade systems that could affect thecritical reactor parameters, i.e., water level, pressure, and power.

2)

3)

Identify all instrument sensing lines and sensors common to two ormore of these control systems.

Analyze the effects of a failure of a common sensors, a completeplug, or a guillotine break in each of these common instrument lines.Examine the effects of the erroneous signals on each affected instru-ment and on each function, i.e., scrams, trips, permissives, etc.,actuated or rendered inoperative.

BAH:rf:csc/G08077"-28/14/84

4) Examine the interactive effects among.all systems affected by thecommon sensing line failure and the consequential combined effect onthe critical reactor parameters.

J

5) Compare the consequences of these postulated events with the Chapter 15analyses to ensure that Chapter 15 bounds the effects and the eventswould not require action or responses beyond the capability ofoperators or safety systems. Perform any additional transientcalculations or analyses necessary to determine whether the postulat-ed limiting event: are bounded" by those events analyzed in Chapter 15,assuming there is a single active failure in a safety system requiredto mitigate effects of the event.

6) Identify any hardware or procedural change recommendations thatresult from this study.

*The term "bounded" means within the consequence limits for abnormal operationaltransients given in Section 15.0.3.1.2 of the FSAR or, if the combined proba-

'ilityof occurrence of both the initiating event annJ the single active failureis similar to the occurrence probabilities of limiting faults (see Section15.0.3.1), "bounded" means within the consequence limits for limiting thefaults given in Section 15,0.3.1.3.

BAM:rf:csc/G08077"-38/14/84


QUESTION

421.43 If control systems are exposed to the environment resultingfrom the rupture of reactor coolant lines, steam lines, orfeedwater lines, the control systems may malfunction in amanner which would cause consequences to be more severe thanassumed in safety analyses. IEE Information Notice 79-22discusses certain non-safety grade or control equipment, whichif subjected to the adverse environment of a high energy linebreak, could impact the safety analyses and the adequacy ofthe protection functions performed by the safety-related,systems.

The staff is concerned that a similar potential may exist atlight water facilities now under construction. You are,therefore, requested to perform a review per the IKEInformation Notice 79-22 concern to determine what, if any,

'esign changes or operator actions would be necessary toassure that high energy line breaks will not cause controlsystem failures to complicate the 'event beyond the FSARanalyses. Provide the results of your review including allidentified problems and the manner in which you have resolvedthem.

RESPONSE

The specific "scenarios" discussed in the above referencedInformation Notice are to be considered as examples of thekinds of'nteractions which might occur. Your review shouldconsider analogous interactions as relevant to the BWR design.

KC: pes/118B-12.I/24/84

HIGH. ENERGY LINE BREAK AND CONTROL

SYSTEM FAILURE EVALUATION

INTRODUCTION

IE Information Notice 79-22 identifies the concern that the performanceof nonsafety grade equipment subjected to an adverse environme'nt couldimpact the protective functions performed by safety grade equipment. The

purpose of this analysis is to determine if a malfunction of a nonsafetycontrol system, associated with a high energy line break, might result ina severe event not bounded by FSAR Chapter 15.

METHODOLOGY

The HELB/control system failure evaluation will be analyzed as follows:

1. Identify all nonsafety control systems and components withinthese systems which may impact critical reactor parameters(water level, pressure, power).

2. Establish the criteria for energy lines, break postulation, andconsequence evaluation.

3. Identify critical nonsafety grade components located in areasof high energy piping..

4. Postulate breaks in these areas and determine the resultanteffects on the components.

Evaluate the events to determine if the event is bounded byFSAR Chapter 15. If not bounded, additional analysis or a cor-rective action will be taken.

NONSAFETY CONTROL SYSTEMS

All plant nonsafety'. control systems are included in the initial evalua-tion for HELB. The following criteria is used for the elimination ofsystems from the initial list prior to performing a detailed HELB

analysis.

1. Dedicated inputs into the process computer, as well as the com-

puter itself.2. Control systems which have no direct or indirect interaction

with reactor operating parameters. Examples are communica-tions, lighting, ventilation for exterior buildings, machineshop systems, refueling or'maintenance systems, etc.

3. Control systems that do interact or interface with reactoroperating systems, but which cannot affect the reactor param-eters either directly or indirectly.

C3/l2177/367/5YH

4. Electrical systems, the loss of which will result in a condi-tion similar to- total or partial loss of offsite power. Ex-amples include the station transformers, ac instrument power,and dc instrument power.

5. Systems which are not used during normal power operation. Forexample, refueling systems, turning gear, and turbine bearinglift pumps.

6. Safety systems or safety portions of control systems.

7. Mechanical and structural type systems. Examples includestructural steel, turbines, cranes, etc.

All control components, including power sources, within systems noteliminated by the above criteria are evaluated for component eliminationby the following criteria prior to the final HELB analysis.

Instruments which provide only indication or position statusinformation are excluded from the detailed analysis.

2. Components which provide passive inputs into the control logic,examples of which are arming-type permissives which requireadditional manual action to command equipment to operate, areexcluded from the detailed analysis.

3. Instruments and other dedicated inputs to the process computerare excluded from the detailed analysis.

4. Position switches on air- and motor-operated valves which arenot interlocked with other equipment but rather provide posi-tion indication or position status to the process computer areexcluded from the detailed analysis.

5. Mechanical type components, such as structural steel, tanks,and pipes are not considered "components" which can fail. How-ever, associated instruments, taps, tubing, and control compo-nents not eliminated by Items 1 through 4 and physicallylocated on the above mechanical components, are evaluated.

PIPE BREAK CRITERIA

The pipe break criteria is taken directly from FSAR Section 3.6.

Pi e Criteria

High energy piping is defined as including those systems orportions of systems in which the maximum operating temperatureexceeds 200 F or the maximum operating pressure exceeds275 psig during normal full power operation. Those lines thatoperate above these limits for only a relatively short periodof time (less than 2 percent) to perform their intended func-tion, are classified as moderate energy and excluded from con-sideration.

C3/12177/367/5YH

2. Break Postulation

High energy pipes are assumed to break only at terminal endsand at each intermediate pipe fitting or weld attachment. Eachlongitudinal or circumferential break in high energy fluid svs-tem piping is considered separately as a single postulatedinitial event occurring during normal plant conditions.

3. Conse uence Evaluation

Pipe breaks are evaluated for the effects of pipe whip, jetimpingement, and environmental effects.

a. ~Pi e Whi

Pipe whip is assumed to occur in the plane defined by thepiping geometry and to cause movement in the direction ofthe jet reaction.

b. Jet Im in ement

Jet impingement loads are determined by taking the jetforce as being constant at all effective distances from,and normal to, the break area and by assuming that the jetstream diverges conically at a solid angle of 20 degrees.

ANALYSIS

l. Utilizing current plant drawings, the nonsafety control componentsand high energy systems will be located in particular

zones'.

In small zones it will be assumed that any HELB would incapacitateall nonsafety control components in the zone.

3. In large zones the effect of a high energy line break on each compo-nent will be evaluated based upon the pipe criteria.

4. Postulate breaks and evaluate the effects on the controls equipment.

5. Compare postulated effects with events as reported in CESAR

Chapter 15 to determine if they are bounded.

6. If not bounded, determine if protection or relocation of the con-trols equipment is appropriate. me. Ol '0

If requiredr ) additional analysi/tedetermine if the effect is significant and then a corrective actionwill be taken.

8. Draft final report.

C3/12177/367/5YH


QUESTION 421. 44(7. 7)

RESPONSE

A.

B.

Table 7.1-1 of the FSAR lists the safety-relatedinstrumentation and control systems. Nonsafety-related systems are identified in Table 7.7-1. From areview of Chapter 15 of the FSAR the staff has deter-mined that the analysis of certain anticipated opera-tional occurrences (i.e., the feedwater controllerfailure-maximum demand) and design basis accidents(i.e., recirculation pump seizure) take credit for theoperation of nonsafety-related instrumentation andcontrol systems. It is the staff's position that forevents classified as anticipated operational occurrences,credit can be taken for nonsafety-related systems tomitigate the event provided only high availabilitynonsafety-related systems are being relied upon.Therefore, identify each instrumentation and controlsystem/component which is not classified as safety-related but assumed in the FSAR analyses to mitigatethe consequences of transients. Provide a justifica-tion for the assumption of operability of'his equip-

~ ment based upon'system design, equipment quality, andproposed technical specifications. In addition,

= provide a discussion on the interfaces with thesafety-related portions of the Nine Nile Point-Unit 2design.

It is the staff's position that no credit may be takenfor nonsafety-.related instrumentation and controlsystems/components in mitigating the consequences ofdesign bases accidents. Therefore, identify eachinstrumentation and control system/component which isclassified as nonsafety-related but assumed in theFSAR analyses to mitigate the consequences of accidents.Either redo the analysis assuming no credit for theoperation of this equipment, or propose modificationsto upgrade the equipment to safety-related status.

A. The following non-safety grade systems/components may be actuated duringthe course of anticipated operational occurrences (transients) shown inChapter 15:

a. Level 8 turbine trip,b. Level 8 feedwater trip,c. turbine bypass,

d. recirculation runback,

e. rod sequence control system,

f. rod block monitor, and

g. relief function of the safety relief valves.

PCY: pc: rf/L01242"-18/14/84


None of these systems are required to mitigate the events analyzed inChapter 15.

The assumed performance of .the nonsafety grade system listed in Table 440.43-1,in response to guestion 440.43-1, is based on extensive. failure rate datafor equipment of similar design and quality requirements. Among thenonsafety grade systems listed in Table 440.43-1, the failures of the L8

trip and turbine bypass would have the most adverse effects on hCPR. Forthe most limiting transient, a feedwater controller failure at maximumdemand, the estimated increase in hCPR is about 0.02 for L8 trip failureand 0.11 for turbine bypass failure. Since this postulated event is 2 to3 seconds in duration, no fuel failure is expected.

In summary, certain transient events assume the operation of specificnonsafety-grade equipment to provide a realistic transient signature;however, failures of such equipment would still yield events bounded bythe safety limits of transient and limiting fault events analyzed inChapters 6 and 15. The peak vessel pressure is bounded by the overpressure protection analysis described in Chapter 5.

See FSAR Section 7.7.1.5 and 10.4.4 for turbine bypass and Section 7.7.1.3for L8 IKC design information.

B. FHEA's take no credit for nonsafety-related instrumentation and controlsystem/components in mitigating'he consequences of design basis accidents.

PCY: pc: r f/L01242"-28/14/84

NINE HILE POINT UNIT 2 FSAR

UESTION.4

From its review of the Nine Mile Unit 2 FSAR, the NRC staff has been unable toconclude that the separation of Class lE components and interconnecting cir-cuits is acceptable. Regulatory Guide 1.75, "Physical Independence of Electri-cal Systems" which endorses IEEE Standard 384, "IEEE Trial-Use StandardCriteria for Separation of Class 1E Equipment and Circuits" provides guidancewith regard to separation. To provide the level of detail necessary to com-plete our review, we'request that you submit a comparison of the Nine HilePoint Unit 2 design to the criteria contained in R.G. 1.75 and IEEE 384. Thiscomparison should focus on the instrumentation and control systems ~ithin boththe Power Generation. Control Complex and the balance of plant. The informationprovided should supplement FSAR Table 1.8-1 and FSAR Sections 7.1.2, 7.2.6 and8.3. 1 such that each regulatory position of R.G. 1.75 and each separationcriterion of .IEEE 384 is addressed. Alternate methods of providing separation

~ to those contained in R.G., 1.75 and IEEE 384 should be identified and justi-fied. Where barriers (e.g., flexible conduit, sheet metal enclosures, fireretardant tape) are used to provide separation, the details of the testing usedto qualify the barriers should be provided. Where analyses have been used tojustify lesser separation than that recommended in- R.G. 1.75 and IEEE 384, adetailed discussion of the analyses including the assumptions,, methods, sup-porting tests and conclusions should be provided.

RESPONSE

A comparison of the Nine Nile Point Unit 2 design to the criteria contained inR.G. 1.75 and IEEE 384 is shown in the following tables for instrumentationand control systems within the PGCC and balance of plant.

Note: Balance of plant response provided by SWEC.

BAM:rm/407274"-17/27/84

NIHE NILE POINT UNIT 2 FSARSEPARATION EVALUATION

QUESTION 421.47

IEEE 384-74 CRITERIA

OEFIHITIOHS

REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION PGCC

DES IGH COHFORHAHCE

Isolation device. A device in a circuitwhich prevents aalfunctions in onesection of a circuit froa causingunacceptable influences in othersections of the circuit or othercircuits.

Raceway. Any channel that is designedand used expressly for supporting wires,cable, or busbars. Raceways consistprlaarlly of, but are not restrictedto, cable trays, conduits, and interlocked araor enclosing cable.

C.13uppleaent IEEE 384 definitionas follows "interrupting devicesactuated only by fault currentare not considered to be isola-tion devices within the contextof this docusent.

C.2Mn erlocked araor enclosing cableshould not be, construed as a"raceway".

Since interrupting devices (fuses.and/or circuit breakers) actuatedonly by fault current are notconsidered as isolation devicesa coablnatlon of two interruptingdevices or an EPA in conJunctionwith. an interrupting device is used.

Interlocked armor cable is not usedas a raceway.

. Interrupting devices actuatedonly by fault current are notused as isolation devices forisolating non-class IE circuitsfroa class-IE circuits. In thecase of control/instr~ntassociated circuits, fuse/breakers actuated by faultcurrent have been used to isolatenon-class IE and devices.

Neets this requlreaent.

CRITERIA

4.l Re uired Se aration. Separation No coment.shall e prov e o aa ntain .the indepen-dence of sufficient nmaber of circuitsand equipaent so that the protectivefunctions required during and followingany design basis event can be accoa-

- plished. The degree of separationrequired varies with the potentialhazards in a particular area.

Separation is provided to aaintaln the)Odependence of sufficient nuaber ofcircuits and equipient r'equired for

'iotective'function.Independence isachieved through equipaent arrangeaent,aaterlals, wiring practices and isola-tion devices and/or space or byanalysis.

Heats this requireaent.

BAH:cal: na/A08305"-I8/30/84

. NINE HILE UNIT 2 FSAR

SEPARATIOH EVALUATIONQUESTION 421.47 (Continued)


4.2 E ui nt and Circuits Re uirinSe ara on. qu peen an c rcu srequ r ng separation shall be deterainedand delineated early in the plant designand shall be identified on doc|ssants anddrawings in a distinctive Ianner.

4.3 Hethods of Se aration. The separa-tion o c rcu s an equ paent shall beachieved by safety class structures,distance, or barriers, or any coebina-tion .thereof.

REGULATORY GUIDE 1.75, REV. 1REGULATORY POSITION

No couaent.

C.3whenever practicable and where itsuse does not conflict with other.safety ob)ectives, locate redundantcircuits and equipaent in separatesafety class structures.

PGCC

DESIGN CONFORHANCEBOP

Equipaent hand circuits requiringseparation are delineated in the plantdesign documents and identified in adistinctive Ianner.

Meets this requireeent.

The separation of circuits and equipaent Meets this requireaent.is achieved by locating'hea inseparate safety class structures,distance or barriers, or any

'oabinatfon thereof or by analysis.

4.4 C atibilit with Hechanical~S steas; e separa on o ass lE+c rcuuEs and equipaent shall be suchthat the required independence vill notbe coeproalsed by the failure ofaechanical systeas served by. theClass lE systees. For exaeple, Class lEcircuits shall be routed or protectedsuch that failure of related aechanicai

. equipaent of one redundant systeecannot disable Class lE circuits orequlpeent essential to the operationof the other redundant systea(s).

No coint. Class 1E circuits are routed and/orprotected such that failure of relatedaechanical equipaent of one Class 1Esysteo vill not disable Class 1Ecircuits or equipaent essential to theoperation of its redundant systea(s).

Meets this requireaent.

BAH:cal:rN/A08305*-28/30/84

HIKE MILE UNIT 2 FSAR

SEPARATIOH EVALUATIOH

(UESTIOH 421.47 (Continued)

IEEE 384-74 CRITERIAREGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION PGCC

DESIGN COHFORMAHCEBOP

4.5 Associated Circuits. Associated .

circu s s a coap y w th one of thefollowing:(1) They shall, be uniquely identified

as such and shall reiain with, or beseparated the same as, those Class lEcircuits with which they are associated.(2) They shall be in accordance with

(1) above froa the Class 1E equipeentto and including an isolation device.Beyond the isolation device a circuitis not subject to the requireientsof this docuaent provided it does notagain becoae associated with a Class lEsystea.(3) They shall be analyzed or,tested

to demonstrate that Class 1E circuitsare not degraded below an acceptablelevel.

4.6 HOH-CLASS lE CIRCUITS

4.6.1 Se aration frog Class lE Circuits.Hon-Class c rcu s s a separa efrow Class lE circuits by the ainlauaseparation requireaents specified inSections 5.1.3, 5.1.4, or 5.6 or theybecoie associated circuits.

C.4 and C.6Ksisoc s e clecults should besubject to all requireaents placedon Class 1E circuits such as cableder ating, environaental qualifica-tion, flaae retardance, splicingrestrictions and raceway fillunless it can be deaonstrated thatthe absence of such requireaentscould not significantly reduce theavailability of the Class 1Ecircuits.

Analysis should be subaitted as.part of Safety Analysis Report,and should identify those circuitsinstalled in accordance with thissection.

Ho coasent.

Associated circuits are either sub)ectto all requlreaents placed on Class 1Ecircuits or are analyzed to desonstratethat the associated circuits will notdegrade the Class 1E circuits below anacceptable level. Such an analysis,when perforsedb is aainta<ned as partof the design record./k'ote 5.

Kon-Class 1E circuits coaply with therequireaents of IEEE 384 Section 5.1.3,5.1.4 or 5.6 or they are treated asassociated circuits.

h

Associated circuits are treatedas class lE circuits.

Meets this requireaent except inthe case of non-class 1E conduitsproxiaate to class lE trays. Thealnlaea distance between a non-class lE conduit and a class lEcable tray (open) shall be 1 inch.See FSAR Section 1.8 RG 1.75position for justification.

BAM:cal: ra/A08305e-38/30/84

se e

HINE HILE UHIT 2 FSARSEPARATIOH EVALUATION

QUESTION 421.47 (Continued)

IEEE 384-74 CRITERIAREGULATORY GUIOE 1.75d REV. 1REGULATORY POSITION PGCC

DESIGN CONFORMANCEBOP

4.6.2 Se aration from AssociatedCircuits. on- ass c rcu s shalltse separated iron associated circuitsby the Iiniaua separation requirementsspecified in Sections 5.1,3, 5. 1.4,or 5.6.2 or (1) the effects of lesserseparation between the Hon-Class lEcircuits and the associated circuitsshall be analyzed to demonstrate thatClass 1E ~c rcu s are not degraded .

below an acceptable level or (2) theybecome associated circuits. Non-Classld instrtssentatton and contro~c rcu ~

are no re u re o e separa e romassoc a e c rcuits.

Figure 1 shows examples of acceptable'ircuit arrangements.

5. SPECIFIC SEPARATION CRITERIA

5.1 Cables and Racewa s5.1. enera

5.1.1~ie routing of Class lEcircuits and location of equipment sewedby these Class lE circuits shall bereviewed for exposure to potentialhazards such as high pressure piping,missiles, flasoable material flooding,and wiring that is not flaae retardant.A degree of separation coamensuratewith the damage potential of the hazardshall be provided such that the indepen-dence of redundant Class lE systems are

C.6analysis performed in accordancewith this section should besubmitted as part of SafetyAnalysis Report and should identifythose circuits installed in accordance with this section.

C.7Rona-Class 1E instrumentation andcontrol circuits should not beexempted from the provisions ofSection 4.6.2.

C.BSection 5.1.1.1 should not beconstrued to imply that adequateseparation of redundant circuitscan be achieved within a confinedspace such as a cable tunnel thatis effectively unventilated.

Hon-Class lE circuits are separatedfrom'Class 1E and associated circuitsin accordance with the requirementsof IEEE-384, Sections 5.1.3, 5.1.4,or 5.6.2 or effects of lesser separa-tion are analyzed to demonstrate thatClass lE circuits are not degradedbelow an acceptable level. Suchana]ysis, when performed, is a part .of the design record. Hon-Class lEinstrumentation and control circuitsare not exempted from the provisionsof Section 4.6.2.

Separation of Class lE circuits andequipment makes effective use of suchfeatures as different safety structures

, and separated areas for redundantcircuits and equipment. A degree ofseparation cosxsensurate with the damagepotential of the hazard is providedsuch that the independence of theredundant Class 1E systems is main-tained at an acceptable level.

Meets this requirement.

bfu/SID >~Generally, different quip-aent are located in d fferooms; different a lesare routed through differentareas; separate tunnels are usedfor routing cables of different

y Ip/gro&S

BAH:cal:rm/A08305*-48/30/84

. HIHE NILE P NIT 2 FSARSEPARATIOH EVALUATION

(UESTIOH 421. 47 .(Continued)

IEEE 384-74 CRITERIAREGULATORY GUIDE 1.75, REV. 1REGULATORY POSITION PGCC

DESIGN COHFORHANCEBOP

maintained at an acceptable level. Theseparation of Class 1E circuits andequipment shall make effective use offeatures inherent in the plant designsuch as using different rooms oropposite sides of rooms or areas.

5.1.1.2 In those areas where the. damage potential is limited to failuresor faults internal to the electricalequipment or circuits, the minimumseparation distance can be establishedby analysis of the proposed cableinstallation. This analysis shall bebased on tests performed to determinethe flame retardant characteristics ofthe proposed cable installation consider-ing features such as cable insulation andjacket materials, cable tray fill, andcable tray arrangement.

5.1.1.3 The minimum separationdistances specified in Sections 5.1.3and 5.1.4 are based on open ventiliatedcable trays of either the ladder ortrough type as defined in NEHA VE 1-1971,Cable Tray Systems. 10ere thesedistances are used to provide adequatephysical separation:(1) Cables and raceways involved shall

be flame retardant(2) The design basis shall be that the

cable trays will not be filled abovethe side rails

C.6Analysis performed in accordancewith this section should besubmitted as part of the SafetyAnalysis Report, and shouldidentify circuits installed inaccordance with these section.

C.9TRh section should be. supplementedwith Item 5.$ .1.3(4) as follows:"Cable splices in raceways shouldbe prohibited".

NOTE: Cable splices are not, bythemselves, unacceptable. If theyexist,-the resulting design shouldbe justified by analysis. Theanalysis should be submitted aspart of the Safety Analysis Report.

(See also FSAR, Section 8.3.1.4.2 forexception.)

Cable installations within PGCC have ~

been analyzed for separation

adequacy.'pen

ventilated cable trays andcable splices are not used.

(See FSAR Section 8.3.1.4.2for details.)

Analysis has been used in thecase noted in Section 4.6.1.The analysis is included inSection 1.8, RG 1,75 position.

Heets the criteria 1, 2 and 3 ofSection 5.1.1.3 where the minimumseparation distances of Sections5.1.3 and 5.1.4 are used; cablessplices in raceways are prohibited;splicing in electrical penetra-tions is considered to be exemptfrom this requirement.

BAH:cal:rm/A08305*-58/30/84

HIHE HILE UHIT 2 FSARSEPARATI EVALUATIOH



,(3) Hazards shall be li«ited to failuresor faults internal to the electric equip-«ent or cables.

If less separation distances are Usedthey shall be established as inSection 5.1.1.2.

REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION PGCC

OESIGN CONFORWNCE

5.1.2 Identification. Exposed Class lE C.10

per«anent «armer at intervals not to'fpoints" should be understood toexceed 15 ft and at points of entry to «ean at intervals not to exceedand exiting fro« enclosed areas. Class 5 ft throughout thy entire cablelE raceways shall be «arked prior to the length. Also the preferred «ethodinstallation of their cables. of «arking cable is color coding.Cables installed in these raceways shall

be «arked in a «armer of sufficient '.lldurability and at a sufficient nu«ber TQs section should be supple«antedof points to fac a e n a ver i- as follows: "The «ethod of identi-cation that the installation is in con- : fication used should be si«pie andfor«ance with the separation criteria. should preclude the need tp consultThese cable «arkings shall be applied any reference «aterial to distin-prior to or during installation. 'uish between Class 1E and Hon-

Class lE cables shall be identified by Class lE circuits, between Hon-e per«anent «arker at each end in accor Class lE circuits associated withdance with tKeeeslgn drawings or cable different redundant Class IEschedule. syste«s, and between redundantThe «ethod of identification used to Class lE syste«s.

«eet the above require«ents shallreadily distinguish between redundantClass lE syste«s and between Class 1Eand non-Class 1E syste«s.

Heets the requirement. Heets the require«ants exceptthat the cables are «arked atintervals of 15 ft. insteadof 5 ft.; see FSAR Section1.8, RG 1.75 position for theexplanations. See FSAR Sec.8.3.1.3 for the details ofthe «ethods of identificationused.

. BAN:cal:r«/A08305*-68/30/84

NIHE NILE HIT 2 FSARSEPARATIO VALUATIOH.

'UESTIONl2l.l7 (Continued)

IEEE 384-7I CRITERIA

5.1.3 Cable S readin Area The cablespreading area s e space s) adjacentto the aain control rooa where instru-aantation and control cables convergeprior to entering the control, terrain.ation, or instruaent panels. The cablespreading area shall not contain highenergy equipeent such as switch-gear,

'ransforwers, rotating equipment, orpotential sources of aissiles or pipewhip and shall not be used for storingflaaeable aaterials. Circuits in thecable spreading area should be lie(tedto control and instrmentation functionsand those power supply circuits andfacilities serving the control room andinstruaent systems. Power supply feedersto instruwent and control rooa distri-bution panels shall be installed inenclosed raceways that qualify asbarriers.

Other power circuits that are requiredto traverse this area Shall be assignedto a ainiam nuaber of routes consistentwith their separation requireaents andallocated solely for these power circuits.Such traversing power circuits shall beseparated froa other circuits in thisarea by 4 alnimum distance of 3 ft. andbarriers.

REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITIOH

C.12 Pending issuance of otheracceptance criteria, those portionsof Section 5.1.3 (exclusive of theNOTE following the second para-graph) that paralt the routing ofpower cables through the cablespreading area(s) and by iepli-cation, the control rooa, shouldnot be construed as acceptable.Also, Section 5.1.3 should besuppleaented as follows: "1&erefeasible, redundant cable spread-,ing areas should be utilized."

PGCCDESIGH COKFORNAKCE

Cables feeding power to controland instrueentatlon circuits are notrequired to run in conduit withinPGCC. These cables are treatedas control and instruwentation cablesand are run in PGCC ducts along withother cables in the saaa division.

Neets the requireaents; separatecable riser areas are used forthe redundant circuits. Powercables in the riser areas arerouted in enclosed raceways.See FSAR Sec. 8.3. l.i.2.

BAH:cal;rw/A08305"-78/30/Bi

NINE MILE UNIT 2 FSAR..—.'EPARATIONEVALUATION

QUESTION 421.47 (Continued)'I

REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITIONIEEE 384-74 CRITERIA

NOTE: An acceptable alternative rout1ng.for such traversing power circuits wouldbe to route thea in iabedded conduit orin a separate enclosure designed as safetyclass structure (for exaaple, a concreteduct bank or other suitable enclosure)which in effect reaoves thea froa thearea defined as the cable spreading area.

The ainiaua separation distance betweenredundant Class 1E cable trays shall bedeterained by Section 5.1.1.2 or, wherethe conditions of Section 5.1.1.3 a'e aet,shall be 1 ft. between trays separatedhorizontally and 3 ft. between traysseparated vertically.

NOTE: Horizontal separation is aeasuredfroa the side rail of one tray to the siderail of the ad)acent tray. Verticalseparation 1s aeasured froa the bottoa of .

the top tray to the top of the side railof the bottoa tray. (See also Section5.1.4).

PGCCOESIGN CONFORMANCE

BOP

@here tera1nation arrangeaents preclude C.13aaintaining the ainiaua separation dis- Ro significance should betance, the redundant circuits shall be attached to the different trayrun in enclosed .raceways that qualify widths illustrated in Figure 2.as barrters or other barriers shall beprovided between redundant circuits.The ainiaua distance between these

See notes 2, 3, 4, 6, 7, 9 and 10. Mhere the ainiaua separationrequireaents cannot be aet,Sil-teap tape aay be used as aseparation barrier.

.BAM:cal: ra/A08305e-88/30/84

NINE NILE UNIT 2, FSAR5EPARATIO EVALUATIOH

(UESTIOH 421.47 (Continued)


redundant enclosed raceways and betweenbarriers and raceways shall be in 1 in.Figs. 2, 3, 4 and 5 illustrate examplesof

acceptable'rrangeaantsof barriers

and enclosed raceways where the ainimeaseparation distance cannot be «aintalned.

REGULATORY GUIDE 1.75'EV. 1REGULATORY POSITION PGCC

DESIGN CONFORHANCE

5.1.4 General Plant Areas. In plant

as siss)les, external fires, and pipewhip are excluded, the ainiam separationdistance between redundant cable traysshall be determined by Section 5.1.1.2or, where the conditions of Section 5.1.1.3are set, shall be 3 ft. between traysseparated horizontally and 5 ft. betweentrays separated verticially. If, inaddition, high energy electric equipmentsuch as switchgear, transforwers, androtating equipment is excluded andpower cables are installed in enclosedraceways that qualify as barriers, orthere are no power cables, the ainimuaseparation distance aay be as specifiedin Section 5.1.3.

libera plant arrangewents preclude aain-taining the ainiaua separation distance,the redundant circuits shall be run inenclosed raceways that qualify asbarriers or other barriers shall beprovided between redundant circuits.The ainiaw distance between these

Hot applicable. Heats the requireeents.

~ BAH:cal:ra/A08305*-98/30/84

~ s e

HIHE NIL UNIT '2- FSARSEPARATION EVALUATION'- '".

QUESTION 421,47 (Continued)

4


redundant enclosed raceways and betweenbarr iers and raceways shall be in 1 in.Figs.'2, 3, 4 and 5 illustrate exaeplesof acceptable arrangeaents of barriersand enclosed raceways where the Iiniamseparation distance cannot be aaintained.

'.2 STAHOBY POWER SUPPLY

5.2.1 Standb Generatin Units. Redun-dant C ass s nd y genera ng unitsshall be placed in separate safety classstructures.

5.2.2 Auxiliaries and Local Controls.The aux ar as an oca contro s orredundant standby generating units shallbe located in the saae safety classstructure as the unit they serve or bephysically separated in accordance withthe requlreaents of Section 4.

5.3 DC SYSTEN

5.3.1 Batteries. Redundant Class lEbattert'ee~ s a be placed ie separatesafety 'class structur es.

5.3.2 Batte Char er s. Batterychargers or re un ant Class 1Ebatteries shall be physically separatedin accordance with the requireients ofSection 4.

BAN:cal: ra/A08305"-108/30/84

REGULATORY GUIDE 1.75p REV. 1REGULATORY POSITION

C.14Section 5.2.1 should be supple-mented as follows: And shouldhave independent air supplies."

C. 15Qfiere ventilation is required, theseparate safety class structuresrequired by Section 5.3.1 should beserved by independent ventilationsysteas.

No coswent

Hot Applicable

Hot Applicable

Not Applicable

PGCCDESIGN COHFORNANCE

Neets this requireaent.See Section 8.3.1.1.2.

Heats this requireeent.See Section 8.3.1.1.2.

Heets this requireaent. SeeSection 8.3.1.4.2.

Heets this requireaent. SeeSection 8.3.1.4.2.

NIKE HIL T UNIT 2 FSARSEPARATIOH EVALUATION



5.4 DISTRIBUTION SYSl'EH

REGULATORY GUIOE 1.75, REV. 1.REGULATORY POSITION PGCC

OESIGH CONFORHANCEBOP

5.4.1 Switch ear. Redundant Class 1Edistribut on sw chgrear groups shallbe physically separated in accordancewith the requireeents of Section 4.

5.4.2 Hotor Control Centers. Redun-dant Class no or contro centersshall be physically separated inaccordance with the requlreaents ofSection 4.

5.4.3 Oistribution Panels. RedundantClass 1 s r ut on panels shall bephysically separated in accordance withthe requirements of Section 4.

5.5 COHTAIHHEHT ELECTRICAL PEHETRA- No coeaentTIOHS. e un an ass con a naenteiecErical penetrations shall be physicallyseparated in accordance with the require"nants of Section 4. Coapliance vithSection 4 vill generally require thatredundant penetrations be widely dis-persed around the circuaference of thecontainaent. The ainiaua physical sep-aration for redundant penetrations shallneet the requireaents for cables andraceways given in Section 5.1.4.

Hot Applicable

Section'8.3.1.4.2.

Heats this requiresent. SeeSection 8.3.1.4.2.

Neets this requireeent. SeeSection 8.3.1.4.2.

Heets this requirenent.See Section 8.3.1.4.2.

Heats this requireaent. SeeSection 8.3.1.4.2.

BAH:cal:ra/A08305~-ll8/30/84

HINE NIL UHIT 2 FSAR

5EPARAT EVALUATIONQUESTION 421.47 (Continued)


Hon-Class lE circuits routed in pene-trations containing Class lE circuitsshall be treated as associated circuitsin accordance with the requlreaents ofSection 4.5.

REGULATORY GUIOE 1.75, REV. 1REGULATORY POSITION

I

II P

PGCC

OESIGN CONFORHAHCEBOP

BAN:cal: ns/A08305e-128/30/84


NINE HILE PO FSAR

SEPARATION EVALUATIONQUESTION 421.47

REGULATORY GUIOE 1.75 REV. 1REGULATORY POSITIOH

OESIGN CONFORNANCE

PGCC BOP

5.6 Control Switchboardsoca on an Arran eaent.

Ka)n contro sw c oar s s a elocated in a control rooa within asafety class structure. The controlrooa shall protect frea and 'shall notcontain high energy switchgear, trans-foraers, rotating equipuent, or poten-tial sources of aissiles or pipe whip.

Ho coszaent e See BOP ~ Heets the requ)reaents. The~a)n control switchboards (PGCC)are located in the controlbuilding which is a se)sa)cCat. I structure. The aa)ncontrol rooa does not containany high energy equ)paent.See Section 3.8.

Local control switchboards shall belocated so that hazards such as fires,a)ssiles, vibration, pipe wh)p, andwater sprays shall not cause failurescomon to redundant Class IE functions.

~ Hot applicable. ~ Heets this requ)resent.

Separation of redundant Class 1Eequ)paent and circuits aay be achievedby locating thea on separate controlswitchboards physically separated inaccordance with the requirements ofSection 4. '&ere operational considerations dictate that redundant Class IEequipaent be located on a single con-trol switchboard the requ)resents ofSections 5.6.2, 5.6.3, 5.6.4, and5.6.6 shall apply.

~ Controls for redundant Class 1E equip-aent are located on separate controlpanels. However, due to operationalconsiderations, some of the redundantClass IE controls, are located on thesaae control panel. These iteas areprovided with adequate separation toaeet the single failure criteria.

~ Heets this requ)resent.

BAN;N/A08302*-18/30/84

IEEE 384"74 CRITERIA

NINE HILE P FSARSEPARATION ATION

QUESTION 421. 47

REGULATORY GUIDE 1.75 REV. 1REGULATORY POSITION PGCC

DESIGN CONFORHANCE

BOP

5.6.2 Internal Se aration. The'inimum separa on s ance etween

redundant Class lE equipment and wiringinternal to the control switchboardscan be established by analysis of theproposed installation. Th1s analysisshall be based on tests performed todetermine the flame retardant charac-teristics of the wiring, wiring mate-rials, equipment, and other'materialsinternal to the. control switchboard.lkere the control switchboard mate-rials are flam retardant and analysisis not performed, the minimum separa-tion distance shall be 6in. In theevent the above separation distancesare not maintained, barriers shall beinstalled between redundant Class. 1Eequipment and wiring.

~ No comment. ~ The minimum separation distance betweenredundant Class 1E equipment and wiringinside the control panels is main-tained at 6". Due to the circuit con-figuration, if 6" is not achievable,alternate scans are used to justifylesser degree of separation, such asmetallic barriers, enclosures, conduits,isolation devices and/or analysis.See notes 2, 3, 4, 5, 7, 9, and 10.

~ Heets this requirement.

5.6.3 Internal Mirin Identifica-tion. Class w>re un es or'cCa Tes internal to the control boardsshall be identified in a distinctpermanent manner at a sufficientnumber of points to readily distinguishbetween redundant Class lE wiring andbetween Class 1E and non-Class lEwiring.

~ No coaaent. ~ Class IE wires and cables internal toane} are identified to distinguishetween redundant Class lE and

non-Class IE wiring. See notes 5 andand 8.


5.6.4 Comon Terminations. lthere ~ No coaaent.

on coaaon device, the provisions ofSection 5.6.2 shall be met.

~ Cemon terminations within the control.„'anels meet the provisions of IEEE-384..=,para 5,6.2. 'See not'e 1,


BAH: rm/A08302™28/30/84


NINE HILE 2 FSAR

SEPARATION EVALUATIONQUESTION 421.47

REGULATORY GUIOE 1.75 REV. 1 OESIGN CONFORHANCE

REGULATORY POSITION ~ PGCC BOP

5.6.5 Non-Class 1E Wirin .Non-Class w r)ng no separated froaClass 1E wiring by the ainiaua separa-tion distance (deterained inSection 5.6.2) or by a barrier shallbe treated as associated circuits inaccordance with the requirements ofSection 4.5.

~ No coaaent. ~ Non-Class lE wiring within the controlpanels is separated froa the redundantClass 1E wiring. Whereverthe non-Class 1E wiring cannot beseparated froa the Class 1E wiring,(1) it is treated as associated wiring,or (2) an analysis is per fonaed to deaon-strate the adequacy of lesser separa-tion, or (3) proper isolation (barrieror comon device) is provided to achievethe required separation.

~ Heets this requireaent.

5.6.6. Cable Entrance. Redundant ~ No coaaent.

board enclosure shall eeet the require-aent of Section 5.1.3.

~ Redundant Class lE cables entering thecontrol .board enclosure are (a) separatedby a siniaum distance of six inches or abarrier or (b) enclosed in a raceway.See notes 2 and 9.

~ Heets this requirement

5.7 Instreaentation Cabinets.Redun an ass ns roaents shallbe located in separate cabinets orcoapartaents of a cabinet. Whereredundant Class 1E instruaents arelocated in separate coepartaents ofa single cabinet, attention aust be

iven to routing of external cableso the instruaents to assure that

cable separation is retained.

C. 16 The first paragraph ofSection 5.7 should be auyaentedas follows: "The separation re-quireaents of 5.6 a~ply to instru-aentation cabinets.

~ Redundant Class lE instruments arelocated in separate cabinets or separatecoipartaents of a cabinet. If redun-dant instrqments are reguired to belocated on a single cab>net or singlesingle coapartjsent, barriers are pro-vided. Cables entering such cabinetsare separated by a ainiaua distance; or,barriers are provided between redundantcoaponents and wiring.

~ Heets this requireaent.

In locating Class 1E instruaentcabinets attention aust be givento the effects of all pertinentdesign basis events.

~ See BOP response. ~ Heets this requireaent.

BAH:ra/A08302~38/30/84


NINE 'NILE 2 FSARSEPARATIO LUATTON

QUESTION 421.47

REGULATORY 4UIOE 1.75 REV. 1REGULATORY POSITION = PGCC

DESIGN COHFORNAHCE

BOP

5.8 Sensors and Sensor to Process ~ Ko comment.Connec sons. e un an ass sen-sors anraietr connections to theprocess system shall be sufficientlyseparated that functional capabilityof the protection system will be main-tained despite any single design basisevent or result therefrom.. Considera-tion shall be given to secondaryeffects of design basis events such aspipe whip, steam release, radiation,missiles, or. flooding.

~ Sufficient number of redundant sensorsare provided to perform system levelsafety function, Adequate separation ismaintained between required number of re-dundant sensors to maintain the func-tional capability of the protection sys-tem. Neutron monitoring sensor cablesunder the vessel are exempt from thiscriterion because of the space limita-tions.

~ Neets this requirement.

Large components such as the reactorvessel can be considered a suitablebarrier if the sensor to process con-necting lines are brought out at widelydivergent points and routed so as tokeep component between redundant lines.Redundant pressure taps located onopposite'sides of a large pipe may beconsidered to be separated by the pipe,but the lines leaving the taps must beprotected against damage from acredible coloon cause unless otherredundant or diverse instresentationis provided.

BAH: rm/A08302~-48/30/84

~ n .s,~,


HIHE NILE FSAR

SEPARATIOH E ALUATIOHQUESTION 421.47

REGULATORY GUIDE 1.75 REV. 1REGULATORY POS IT IOH PGCC

DESIGH COHFORHAHCEBOP

5.9 Actuated E ui ent. Locationsof C ass ac ua e equipaent, suchas puap drive aotors and valveoperating aotors are noraally dic-tated by the location of the drivenequipeent. The resultant locationsof this equipment aust be reviewedto ensure that separation of redundantClass 1E actuated equipment isacceptable.

~ No cosssenti ~ Redundant Class lE actuated equipments ~ Heets this requireaent.are separated to eeet the single failurecriteria and assure sufficient safetyfunction to aitigate a OBE;

Hon-Class lE circuits not separated by 6 inches from Class 1E or associated circuits have been analyzed to deaonstrate the adequacy of lesserseparation. The iteas analyzed are:

1. Cemon devices such as relays and con actors for Cl ss IE/Clasp 1E nd lass 1E/non'-Class 1E interfaces. Test report and analyses areavailab e in GE 0 ign Record Files.

~5'F'4

2. Sil-Teay tape as a separation barr er. he tes report and analysis is available in GE ORFs.

3. Use of flexible or rigid conduigs a separation barrier. The test report and analysis is available in GE DRFs.

Justification of separation less than six inches between saoke detector, its wiring and Class 1E wiring is available in GE DRFs.

Coeaon devices are also covered under the response to guestion 421.13. Sil-Teep.tape and flexible conduit are covered under the responseto guestion 430.23.

5. NS panels P606, P608 and P633 are exceptions to RG 1.75.

6. Justification of running bare cable along with a conduit is available in GE ORF's.u W

7. Justification of separation of less than 1" between redundant enclosed raceways and between barriers sa raceways are available in GE

DRF's.

8. Pre~ired vendor equipaent that does not sect color coding is identified in GE specification.

9. Use of cable connector housing as an acceptable separation barrier is available in GE ORF's.

BAH:ra/A08302e-58/30/84

IEEE 384"74 CRITERIA

NINE NILE P FSAR

SEPARATION E LUATIONQUESTION 421. 47

REGULATORY GUIDE 1.75 REV. 1 DESIGN CONFORHANCE

REGULATORY POSITION PGCC BOP

10. Justification of separation of less than six inches between utility devices and its wiring and Class 1E siring is available in GE DRF's.

11. All analyses/)ustification for any exceptions are documented in GE DRF's and are available on request.

BAH:na/A08302e-68/30/84

· ac-regulatory information distribution system (rids) accession nbr g 8409140165 „doc ~ date:...

Documents