10TENNESSEE VALLEY AUTHORITY

CHATTANOOGA, TENNESSEE 37401

400 Chestnut Street Tower II

November 18, 1981

Director of Nuclear Reactor RegulationAttention: Ms. E. Adensam, Chief

Licensing Branch No. 4Division of Licensing

U.S. Nuclear Regulatory CommissionWashington, DC 20555

Dear Ms. Adensam:

In the Matter of the Application ofTennessee Valley Authority

Docket Nos. 50-39050-391

In my letter to you dated October 9, 1981, TVA provided responses andassociated Final Safety Analysis Report revisions addressing NRC PowerSystems Branch (PSB) concerns for Watts Bar Nuclear Plant.

Enclosed are revised responses and additional clarification requested bythe NRC PSB reviewer during a telephone conference call on November 6, 1981.

If you have any questions concerning this matter, please get in touch withD. P. Ormsby at FTS 858-2682.

Sworn to nd subs .ibed before me

this, q-day of7~~!1981

Notary Public

My Commission Expires

Very truly yours,

TENNESSEE VALLEY AUTHORITY ;•

L. M. Mills, ManagerNuclear Regulation and Safe•y

Enclosure

'S

i/1

8111240601 811118PDR ADOCK 05000390

,,A PDR

An Equal Opportunity Employer

0 ENCLOSURE 0WATTS BAR NUCLEAR PLANT UNITS 1 AND 2

ADDITIONAL RESPONSES TO NRC POWER SYSTEIS BRANCH CONCERNS

Sections 8.2.2.2, 8.3.1.1, and 8.3.3.2

Auxiliary power system analyses made as part of scheduled designreview studies showed that the system now described in the Watts BarNuclear Plant FSAR could not perform its intended functions over thenecessary range of transmission grid conditions. A NonconformanceReport describing this deficiency dated September 23, 1980, was issuedand system design changes were begun.

The modified Watts Bar Nuclear Plant ac auxiliary power system isshown in sketches APS 1 and 2, which were provided to John Knox (NRC)during the meeting of September 17 and 18, 1981. The Class 1E acpower system is shown entirely in sketch APS 2.

Preferred shutdown power is supplied from TVA's 161-kV transmissiongrid at Watts Bar Hydro Plant switchyard pver two separate transmissionlines, each connecting to two 161-6.9-kV common station service trans-formers at Watts Bar Nuclear Plant. For any unit generator trip, the ClasslE power system for the tripped unit automatically fast transfers from itsunit-connected power source to offsite power supplied through common stationservice transformers C and D. There is no intentional delay in initiationof this transfer, and it is completed in approximately six cycles.

For all unit generator trips except those caused by electrical faultsthat open the main generator 500-kV circuit breaker, the Balance ofPlant (BOP) ac auxiliary power system remains connected to its unitsources for 30 seconds, then fast transfers to offsite power suppliedthrough common transformers A and B. If the unit trip is caused by anelectrical fault, the BOP system transfer is not delayed.

System analyses have been made that show for an acceptable range oftransmission grid conditions, one offsite power circuit consisting ofone transmission line and transformers A and D, or the othertransmission line and transformers B and C, is capable of starting andrunning all required safety-related loads, and at least half of allrunning BOP loads for a design basis accident in one unit and aconcurrent full-load rejection in the other unit. The analyses forthe Class IE power systems assumed that all equipment that is startedby a safety injection signal (SIS) started at the same time, allequipment that is tripped off by a SIS was tripped, and that allcontinuous loads that could be operating immediately after the SIS,whether safety-related or not, were running.

The Class lE ac power system for each unit is divided into tworedundant power trains. Each train includes a 6 9 0 0-volt shutdownboard powering the larger safety-related motors, pressurizer-heaters,and three 4 80-volt distribution subsystems. The 4 80-volt subsystemseach include a 6 90 0-4 8 0-volt power transformer, 4 80-volt switchgear,and 4 80-volt motor control centers. The Class 1E 480-volt subsystemssupply both safety-related and non safety-related electric equipment.A fourth 6 9 0 0-4 80-volt transformer will be provided in each powertrain as an installed spare. It will not normally be connected toeither the 6 90 0-volt shutdown board or to the 4 80-volt buses.

Each 690Y-volt shutdovoaoard can be powered through on@,f four supplybreakers. For normal unit startup and operation, the power is from the6 90 0-volt unit board connection, the breaker shown normally closed onsketch APS 2. Shown normally open are the first and second alternatesupply breakers connecting to the offsite power circuits, and the standby

___breaker connecting to a diesel generator. As stated above, for unit tripsboth 6 900-volt shutdown boards for the tripped unit automatically fasttransfer to offsite power via their first alternate breakers.

Each 6 90 0-volt shutdown board is equipped with loss-of-voltage relaying anddegraded voltage relaying. The loss-of-voltage relays initiate slow bustransfers (supervised by residual voltage relays) from the normal source tothe first alternate, the second alternate or standby supply, in that orderof preference. Relays monitor each source and permit connection only ifadequate power is available. When a 6 9 0 0-volt shutdown board is poweredfrom an alternate supply, the loss-of-voltage relays will initiateautomatic transfer from the first alternate to the second alternate orstandby supply, or from second alternate to the standby supply. Protectiverelays are provided in each shutdown board that lock out all supplybreakers if the loss of voltage is caused by overload or electrical fault.Transfer between power sources in the reverse order are operator controlledonly. The first alternate power connection for train A shutdown boards isto common transformer C, winding Y, and for train B shutdown boards is tocommon transformer D, winding X. The second alternate power connection fortrain A shutdown boards is transformer D, winding Y. For train B shutdownboards, the second alternate connection is to transformer C, winding X.Either transformer C or D can supply the Class lE power system for bothunits, with one unit in a design basis accident and the other unit in aconcurrent full load rejection, without exceeding its self-cooled powerrating.

The staff degraded voltage positions are addressed as follows:

1. Overvoltage relays alarm in the control room. Undervoltage relaysoperate if a 6 90 0-volt shutdown board bus voltage drops below the levelrequired to successfully start all safety-related equipment that wouldbe started for a SIS. The undervoltage relays initiate two time delaysequences. The first sequence will ride through normal system voltagetransients, but is short enough to allow safety-related equipment to bepowered within the time required by the safety analysis. At the end ofthe first sequence, the undervoltage will be alarmed in the controlroom; and if a SIS has been initiated, or is subsequently initiated,the shutdown board will transfer to its diesel generator. The secondtime delay is long enough to allow operator action but not allow damageto connected safety-related equipment. At the end of the secondsequence, the shutdown board will transfer to its diesel generator.The undervoltage relaying system design meets all the staffrequirements.

2. Degraded voltage relaying will not open the standby supply breaker andwill not initiate load shedding and resequencing if a 6 900-voltshutdown board is supplied by its diesel generator. The loss-of-voltage relays will initiate load shedding and resequencing. However,the voltage set point and time delay for these relays prevent theiroperation for any motor starting transients when adequate power isbeing supplied to the shutdown board. Maximum and minimum limits forthe loss-of-voltage relay set points will be included in the TechnicalSpecifications.

3. The auxiliary power system analyses for Watts Bar Nuclear Plantsatisfy the staff position and TVA's Quality Assurancerequirements for documentation. The analyses will be issued in aformal report.

4. The auxiliary power system analyses will be verified in thepreoperational test program.

Section 8.3.1.6 - Diesel Generator Reliability Qualification Testina

TVA supplied the required test report to the NRC in a letter from J. E.Gilleland to Bernard C. Rusche dated December 30, 1975. This informationwas submitted on the Sequoyah Nuclear Plant Docket (50-327, 50-328). Thediesel generators at Watts Bar are the same as those at Sequoyah.

A discussion of TVA's compliance to RG-1.9, Rev. 2, 'Selection, Design, andQualification of Diesel-Generator Units' follows:

Regulatory Position

C. 1 Full compliance

C. 2 Full compliance

C. 3 Full compliance

C. 4 Full compliance

C. 5 Environmental qualification of the WBN diesel generator units will bedetailed in TVA's response to NUREG-0588, Category II for class 1Eequipment in a mild environment.

C. 6 Full compliance

C. 7 (a) Full compliance

(b) Full compliance

C.8 Does not comply - Although a first-out surveillance system is notinstalled at Watts Bar, all diesel generator protective trips such asdifferential overcurrent have been provided with targets to indicatewhich protective device operated. In addition, the status ofprotective devices installed to shut down the diesel generator unitfor generator or engine trouble are alarmed in the main control room.Where more than one protective device target is operated, an analysisof the problem will be done to determine which device operated first.

C.9 It is TVA's position that the intent of this position has been fullymet. Please refer to TVA's response to NRC question 112.33 (attached)relating to seismic qualifications of Watts Bar safety-relatedequipment. In addition, please refer to FSAR Table 3.10.1, sheet 2,for a summary of the seismic qualification of electrical equipment,including the diesel generators. Further, please refer to Table3.10.3 'Watts Bar Seismic Qualifications,' sheets 11 through 20 fortests, results, and references of the seismic qualification of variouscomponents of the diesel generator unit.

C.iO Full compliance*b

C.11 Full compliance

C.12 N/A

C.13 N/A

C.14 Does not fully comply. The load qualification test was not doneas part of the type qualification test. This test has been runas part of the preoperational test program, but the requirementsof IEEE 387-1977 were followed. It is TVA's position thatrunning the short-time load test at the end is a more severetest and this sequence is justifiable. However, in order tomeet this position, subsequent periodic testing of these DGUswill be done per this regulatory guide. Also attached isdocumentation of TVAs compliance with IEEE 387-1977.

"I, Y7

IEEE STD 387-1977 FOR OVESEL-GENERATING UNITS APPLIED AIPSTANDBY POWERSUPPLIES FOR NUCLEAR POWER GENERATOR STATIONS

C = full compliance

5.

5.1

5.1.1

5.1.2

. Requirement

Principal Design Criteria

Capability

General

Mechanical and Electrical Capabilities

(1) Service environment(2) Starting and loading

(a) From normal standby condition(b) With no cooling available, . .(c) On a restart with initial engine

temperature . . .(3) Light load or no load operation(4) Design load profile

(5) Quality of power

5.2 Rating

5.2.1 General

5.2.2 General Application Rules (3.7)

Rule 1. Inspect and scheduled . . .Rule 2. Unscheduled . . .

5.2.3 Operation Application Rule(See 3.7.1 and 3.7.2)

5.3 Interactions

5.4 Qualification

5.4.1 The effects of aging . . .

5.4.2 Major changes to a qualified .

5.4.3 Modifications .

5.4.4 Minor changes . . .

(a) When replacement does not . . .

(b) When replacement alters . . .

(c) When replacement degrades . . .

Deeree of Comnliance

C

C

CCCC

CCCC

C

CC

C

C

RG-1.9 R2 Pos. 5

Environmentalqualification of theWBNP diesel generatingunits will be detailed inTVA response to NUREG0588 Category II forClass 1E equipment in amild environment.

Requiremen*

5.5 Design and Application Considerations

5.6 Design Features

5.6.1 Mechanical and Electrical DesignFeatures

5.6.1.1 Vibration

5.6.1.2 Torsional Vibration

5.6.1.3 Overspeed, Moving parts shall bedesigned

(1) Full short-time load rejection(2) Margin to allow overspeed . . .(3) As a minimum, the generator,

exciter, and flywheel

5.6.1.4 Governor Operation

5.6.1.5 Voltage Regulator Operation

5.6.2 Control

6.2.1 Contro. Modes

5.6.2.2-Automatic Control

(1) . . . override all other operatingmodes . . .

(2) • . . shall not override . . .manual .

5.6.2.3 Control Points

5.6.3 Surveillance Systems

5.6.3.2 Modes Surveyed

(1) Unit not running(2) Unit running - not loaded(3) Unit running - loaded(4) Unit out of service

5.6.3.3 Surveillance Instructions

(1) Starting system(2) Lubricating system(3) Fuel(4) Primary cooling system

(5) Secondary cooling system

Degreeof Compliance

C RG-1.9 R2

C

C

C

C

CCC

C

C

C

C

C

C

C

C

CCCC

C

CCCCC

Requirement0 Degree of Compliance

5.6.3.3 Surveillance Instructions (contd)

(6)(7)(8)(9)(10)

Combustion air systemExhaust systemGenerator systemExcitation systemVolt regulation system

(11) Governor system(12) Auxiliary electric system

CCCCThere is no alarm on thevoltage regulationsystem but there arevoltmeters for visualindication of voltageand loss of voltagealarm degraded voltagealarm, and overvoltagealarm.CC

6. Requirements for Testing andAnalyses

6.1 General

6.1.1 Implementation

6.1.2 Break-in run

6.1.3 Service environment

6.1.4 Documentation test shallbe completely documented

Type Qualification Test Shall Contain:

(1) The equipment performancespecifications.

(2) Identification of specificfeatures to be demonstratedby test.

(3) Test plan(4) Report of test results. The

report shall include:

(a) Objective(b) Equipment tested(c) Description of test

facility(d) Test procedures

(e) Test data and accuracy(results)

(f) Summary, conclusions, and

recommendations(g) Supporting data(h) Approval signature and date

0Requirement

6.1.5 Analyses

6.1.6 If type qualification tests areat the engine...

6.2 Factory Production Tests

(1) Diesel engine(2) Generator(3) Excitation, control and other

accessories/auxiliaries

6.3 Type qualification testing proceduresand methods

6.3.1 Load capability qualification

(1) Load...continues... 22 hrs

(2) Then 2-hr rating(3) The continuous load rejection...(4) Light load equal...

6.3.2 Start and load acveptance qualification300 valid start...

The start and load tests shall beconducted as follows:

(1) Engine cranking shall begin...(2) Immediately following (1) ....(3) At least 270 of the tests...

(4) At least 30 of the tests...(5) If these tests are performed

on more than one unit...

If cause of failure.. .withoutpenalty...

(a) Unsuccessful start attempts...(b) A starting or load or both

tests...(c) Test performed...trouble

shooting...(d) Successful start...(e) Failure of temporary...

Deeree of Comnliance

C

C

-C

CCC

RG-1.9 Rev 2 Seeposition 9 (attached) fordegree of compliance

C (RG-1.9 Rev 2\position 14)CCC

C

CCAll 300 tests were runfrom the standbytemperature

C

Requirement0 oDearee of Comnliance

6.3.3 Margin & Qualificationthe criteria for the margin qual.are as follows:

(1) Demonstrate the ability ofgen. and excitation system...

(2) Demonstrate that there issufficient engine torque...

6.4 Site Test Categories

6.4.1 Starting Test

6.4.2 Load Acceptance Test

6.4.3 Rated Load Test

(1) A load equal to continuous

rating...plus 1 hour

(2) A load equal to shorttimerating...for 2 hours

6.4.4 Design Load Test

6.4.5 Load Rejection Test

6.4.6 Electrical Test

C

C

All tests have been runas specified.Future test will be runper RG-1.9Rev 2, position 24.

C

C

C

6.4.7 Subsystem Test

6.5 Site Acceptance Testing

6.5.1 Test Loads

6.5.2 Test Conduct

6.5.3 Tests: The tests to be givento the DGU...:

Starting testLoad acceptance testsRated load testsDesign load testsLoad rejection testsElectrical testsSubsystem tests

SA...... - . . ,..',.,- - .VC'XtV..

0 _ _Requirement Degree of Compliance

6.6 Periodic Testing C

6.6.1 Availability Test C

6.6.2 Operational Test. The DGU .one cycle or each . . .

(1) Starting tests C(2) Load acceptance tests C(3) Design load tests C(4) Load rejection tests C(5) Subsystem tests C

6.7 Preventive Maintenance, Inspection, and CTesting

Section 8.3.3.1 (Partyo- Associated Circuits 0

Justification

The criteria used in the design for the separation of redundant cable traysrequire a minimum of three feet horizontally and a minimum of five feetvertically, except where trays containing cables of different division ofseparation cross. Where redundant cable trays cross, there is a minimumvertical separation of 12 inches (tray top of lower tray to tray bottom ofupper tray) with the bottom tray covered with a solid steel cover and thetop tray provided with a solid steel bottom for minimum distance of threefeet on each side of the tray crossing.

Nondivisional circuits that are routed in cable trays designated for Class1E circuits have not been identified as 'associated' circuits but have beentreated the same as the Class 1E circuits. The nondivisional circuits aresubject to the same environmental qualification, flame retardance, cablederating, splicing restrictions, and cable tray fill. Also, thenondivisional cables have the same circuit protection and short circuitcharacteristics as divisional cables. Thps, an electrically initiated fireis unlikely to occur.

The divisional cable tray systems are divided into separate networks (e.g.train A network is separate from train B network) by voltage level, such as6.9 kV and 480V. The computerized cable routing program ensures that oncea nondivisional cable is routed in a divisional tray, that 'associated'cable is not subsequently routed onto a tray containing redundant cables.

lhus, by cable design and restrictive routing, we conclude that'associated' cables are not a threat to Class 1E cables.

Section 8.3.3.1 (Part C) - Separation Criteria'Between Class 1E andNon-Class 1E Circuits

The nondivisional cables that are routed in nondivisional cable trayswithin Category I structures are the same types and have the same designrequirements, such as cable derating, voltage level separation, shortcircuit characteristics, and circuit protection, as Class 1E cables. Allcable tray supports have seismic Category I supports in areas of Category Istructures that contain safety-related equipment. In addition, in areasoutside primary containment containing one or both redundant divisions ofcable trays, (divisional circuits are routed in conduit within primarycontainment), all exposed surfaces of cables (including nondivisionalcables) in horizontal or vertical routings will be coated with a fire-resistant material.

TVA has evaluated the consequences of fires with regard to plant shutdowncapabilty. Internally initiated cable fires are not considered a hazardbased on the results of tests conducted for the NRC at Sandia Labora-tories. The Sandia tests demonstrated that a fire initiated in a shortedcable will not propagate to cables in adjacent trays, and that cablecoatings are effective in restricting fire propagation.

Based on the foregoing, it is our judgment that the TVA standard spacingcriteria between divisional and nondivisional cable trays is acceptable.

Section '8.3.3.2 -Reactor Containment-Electrical Penetrations

FSAR Section 8.1.5.3 Compliance to Regulatory Guides and IEEEStandards Note 1.

RG 1.63 Position C

CA1 The electric penetrations have been designed to withstand themaximum fault current for the time duration of the backupprotective device. A redundant overcurrent protection system isprovided (a breaker and a fuse) for all penetrations exceptinstrumentation circuits where fault current is not a problem andthe 6 9 00-volt penetration circuits which are for the reactorcoolant pumps (RCP).

The RCP penetrations when connected to unit power have a singlecircuit breaker equipped with dual overcurrent detection systems(CTs, relays, control power source, trip coils). When connectedto the offsite power through the common station servicetransformers, two breakers in serieslare provided. A reliabilityanalysis shows the one breaker equipped with dual overcurrentsystems to be 98.3 percent as reliable as two breakers inseries. This justifies acceptability of the installed system.

The 480-volt load center circuits have a low voltage powercircuit breaker backed up by a current limiting fuse. Thepenetration withstands the available fault current vs. timeduration for the load center breaker and fuse. The breakers havedirect acting trips and are independent of control power. Thefuse is located in the cable termination compartment of the loadcenter bolted to the breaker cable terminal.

The 4 8O-volt motor control center (MCC) c'ircuits have a molded casecircuit breaker backed up by a fuse. The penetration withstands theavailable fault current vs. time duration for the breaker and fuse.Molded case breakers have direct acting trips. The breaker-fuse wasfurnished in the standard design of the MCC and are located in thesame compartment with approximately two inches of air spaceseparation. This is considered adequate because of the diverseprinciple of operation of the fuse and breaker.

Low-voltage control circuits which have sufficient fault currentsavailable to damage a penetration have a molded case breakerbacked up by a fuse. The penetration withstands the availablefault current vs. time duration for the breaker and fuse. Themolded case breakers have direct acting trips.

The energy levels in the instrument systems are sufficiently lowso that no damage can occur to the containment penetration.

Table 8.1-2 lists the parameters that show the capability of eachtypical penetration to withstand without loss of mechanical integrity,the maximum fault current vs. time condition that could occur as aresult of a single random failure of the primary overload protection.Thus the single failure criterion of IEEE 279 is met.

In addition to the single failure criterion of IE 79, thefollowing requirements of IEEE 279 are met as follows:

1. Testability: The overcurrent protection system provided for 6900-volt penetration circuits include drawn out-type relays which arefield testable using manufacturer provided test sets or TVA testsets to simulate fault currents following established procedures.Low voltage power circuit breakers and molded case circuitbreakers are field tested using test se.ts built by MultiampCorporation or equal. Testing is done by simulating fault currentfollowing established procedures.

The only method recommended by fuse manufacturers for periodictesting of fuses is the measurement of their resistance.Resistance measurement is one of the final checks made at thefactory to assure fuses have been manufactured correctly and areproperly labled as to size. The validity of duplicating a factorytest that measures milliohms in the field is questionable. Inlieu of field testing by resistance, we propose to establish afuse inspection and maintenance program that will ensure: (1)that the proper size fuse is installed, (2) that the fuse shows nosign of deterioration, and (3) that the fuse connections are tightand clean. (See IEEE Std 242-1975, 'Recommended Practice forProtection and Coordination of Industrial and Commercial PowerSystems').

Penetration protective devices in 480V circuits energized duringplant operation are mounted in ei-.her motor cont:i:ol centers orClass 1E low voltage switchgear. Both Class 1E and non-Class 1Emotor control centers are ITE Imperial Corporation series 5600supplied under the same contract. All 480V non-Class 1Edistribution equipment that houses penetration protective devicesare located in the same seismic structure as Class 1E distributionequipment. Equipment bought to Class 1E standards is qualified tooperate both during and after an operating basis earthquake (OBE)or a safe shutdown earthquake (SSE). The non-Class 1E motorcontrol centers supplied under the same contract as Class 1E andare manufactured using the same materials and components whichresults in the same high degree of operational reliability duringan OBE.

C.2 The WBNP penetrations were purchased using IEEE Std. 317-1972 whichdid not include the x/r ratios of this guide. The short circuitratings were based on ANSI C37.9-1953. The current indicated in 1PCEAP-32-382 for a duration of 10 cycles were the values specified forWBNP penetrations.

C.3 (See position C.2.)

C.4 A dielectric-strength test based on ANSI C68.1-1953.

C.5 No aging tests were required by standards in effect at the time IVBNPpenetrations were specified.

C.6 N/A

C.7 N/A

Rated ServVolts Volts

WireSize

TABLE 8.1-2ELECTRICAL PENETRATION ASSEMBLY SHORT-CIRCUIT CAPABILITY

Rated Rated Tested Calcu;lated Primary DeviceShort Ckt 12t Short Ckt Short Ckt Opening TimeSym Amp (x 106 ) Sym Amp Sym Amp Sec

Backup DeviceOpening Time I't 6

Sec (x 10)

8,000 6,900 750MCM

6O0 480 350MCM

600 480 250MCM

600 480 2/0

600 480 4 AWG

600 480 8 AWG

600 10 AWG

600 12 AWG

36,000

30,000

28,000

22,000

12,500

6,000

3,600

2,300

2,910

634

324

91.7

9.01

1.41,

0.558

0.221

50,000*

35,000**

33,900**

28,300**

15,000**

5,960**

3,900**

2,410**

27,000

10,869

5,076

1,917

992

576

0.0165

0.024

0.014

0.043

0.019

0.013

2.70.0165

0.05

0.06

0.05

0.018

0.07

*Proposed test current

**These test currents are from the vendor's test report, which has not yet been reviewed and approved by TVA.

1,96812.03

5.9

1 .55

0.183

0.177

0.023

Section 8.3.3.3 - Submerged Electrical Equinment As a Resultof a LOCA

The Watts Bar FSAR (section 8.3.1.2.3, page 8.3-33) will be revised asfollows:

8.3 .1.2.3 - Safety-Related Equipment in Potentially HostileEnv i ronm en t

Electrical equipment located inside containment has been designed tomaintain equipment safety functions and to prevent unacceptable spuriousactuations. All power cables feeding equipment inside containment areprovided with individual breakers to protect the power sources (both lB andnon-IE) from the effects of electrical shorts. Additionally, each powercable is provided with a cable protector fuse which, in the event of abreaker failure, is designed to protect the containment penetration. Thesebreakers and protector fuses ensure that should an electrical short occurinside containment, the electrical power source will not be affected.

A listing of major nonsafety-related electrical components located insidecontainment that may be inundated following a LOCA appears in Table 8.3-28along with an explanation of the safety significance of the failure of theequipment due to flooding. In addition to the electrical equipment listedin the table, the water level inside containment may also flood nonsafety-related local control stations, electrical sensors, electric motors formotor-operated valves, and electric solenoids for air-operated valves. Thefollowing paragraphs illustrate how the flooding of this equipment does notaffect the plant safety. All local control stations located insidecontainment are provided with manual throw switches located outsidecontainment at the motor control center. These manual switches are used toremove control power from the local control stations during normaloperation. In order to utilize the local control stations during operatingconditions where containment access is permitted, the manual switch must beclosed to provide power to the local stations. Indications are provided inthe main control room whenever the manual throw switches are in the closedposition. Thus, spurious operation of safety-related equipment due to post-LOCA submergence of the local control station is prevented.

There are no electric motor-operated valves located inside containmentbelow the maximum LOCA water level that are required to function for otherthan containment isolation. Valves used for containment isolation willreceive a signal to close on the initiation of the accident signal. Thevalves will close in 10 seconds and will remain closed since failure of thecontrol circuitry can only yield operation in the closed direction from themotors before the flooding takes place. Therefore, these valves will notbe required to operate during or after the flooding.

The control air supply is automatically isolated outside containment in theevent of a LOCA. Therefore, the submergence of electric solenoids servingair-operated valves cannot affect the safe positioning of these valves.,

The plant operators are instructed to rely on the qualified postaccidentmonitors following a LOCA so that any spurious indications fromnonqualified electrical sensors that could become submerged would notjeopardize appropriate operator actions.

The safety-related electrical equipment that must operate in a hostileenvironment during and/or subsequent to an accident is identifiedbelow.

Analysis

The design of any 'associated' circuits (those sharing a Class 1E powersupply or a redundant raceway) and Class 1E circuits for components thatare not required to operate for a submerged condition have the sameredundant overcurrent protection (a breaker and a fuse) as the circuits forClass 1E components.

The maximum possible flooding that can occur following a loss-of-coolant-accident (LOCA) was conservatively calculated to reach elevation 717.7(14.9 feet) with an additional temporary surge to elevation 723.8 (21 feet)inside the crane wall. All components (both Class IE and non-Class IE)have been identified that can become submerged post-LOCA. These componentshave been evaluated for impact on LOCA-mitigation by assuming 'worse case'failure modes.

A failure analysis has been made on the ability of the electrical power(both AC and DC) systems to withstand failure of submerged electricalcomponent from the postulated LOCA flood levels inside containment. Someof the identified components are automatically deenergized in event of aLOCA, and other components are disconnected during normal operation. Theremaining components, powered from a Class IE source or sharing a racewaywith Class 1E circuits, were assumed to be electrically shorted for theanalysis. Cables and cable splices are qualified for submergence. Theresults of the evaluations indicate that the submergence of electricalcomponents will not prevent the Class 1E electric (either AC or DC) systemsfrom performing their intended safety function for the postulated submergedcondition.

From the safety evaluation, no non-Class 1E components were identified thatwill impact LOCA-mitigation as analyzed in the FSAR. Class 1E componentsbelow the maximum flood levels have been evaluated to determine which mustbe relocated or otherwise protected, and which can be accepted as is.Those Class IE components that must function in the longer term post-LOCAwill be relocated above the flood levels, or be replaced or otherwiseprotected with components qualified for submergence. All other Class 1Ecomponents subject to inundation have been analyzed separately and incombination and their loss and/or malfunction determined to be acceptablewhen they are submerged after a LOCA. For example, some containmentisolation valve limit switches will have completed their function(confirming valve position) prior to submergence (water will not spill intotheir area until a level of 13.2 feet, elevation 716 feet, is reachedinside the crane wall: see FSAR figure 1.2-13).

Section 8.3.3.8 (Part a) - Sharing of Raceway Systems Between Units

Justification

Shared safety-related systems are described in the compliance response...to GDC. 5 of section 3.1.2.1 of the FSAR. The design of these systems

is based on a functional requirement of either train A or train B.For example, the ERCW system (section 9.2 of FSAR) has two 100 percentcapacity redundant flow systems for the plant, e-ither of which iscapable of performing its safety function. Likewise, the class lEelectric systems (section 8.3 of PSAR) are diyided into the number ofredundant load groups (trains or channels) required for a givenfunction. Distribution circuits to circuits to redundant equipment arephysically and electrical'ly independent of each other. All sharedsystems are sized to carry all credible combinations of normal andaccident loads. The sharing of raceway systems between units isrestrictive to circuits that have the same characteristics such aspower supply, voltage level, and channel or train identity (referencesection 8.3.1.4.3 of the FSAR).

In the unit 1 area, 6.9-ky shutdown boards lA-A and 2A-A (units 1 and2, respectively) are located in the same room but are separated fromthe redundant 6.9-ky shutdown boards lB-B and 2B-B located in the unit2 area. The circuits between the diesel generators and these 6.9-kyshutdown boards are designed for a two divisional separation (train Aand train B). Redundant circuits for a required function have beenseparated or otherwise protected to prevent a common mode failure ofthe redundant cabL-. system.

TVA has conducted a fire hazard analysis based on a shutdown logicdiagram for a fire at Watts Bar Nuclear Plant (reference FireProtection Submittal dated September 1980).* The analysis postulatedan exposure fire having a zone of influence of 20 feet, and TVA hasevaluated the effects of this fire on systems, circuits or equipmentnecessary for safe plant shutdown. This analysis has identified whereadditional protection and/or separation was required, so the necessaryredundant division of circuits and equipment is free of fire damage.

Unit 1 and unit 2 cables of the same division may share that portionof the raceway which occurs between the power source and its connectedload. This sharing generally occurs for that short portion of theraceway where cables for unit 1 and unit 2 loads are routed inopposite directions from the equipment power source. In the unlikelyevent that an internally initiated electrical fault occurs in a cableof a shared raceway, the fault will not propagate to cables in theredundant raceway because exposed surfaces of cables in trays arecoated with a fire-resistant material and an automatic watersuppression system is provided according to the fire hazardsanalysis.

From our analysis, we conclude that the sharing of raceway systemsbetween units will not inhibit the capability to safely shutdown oneunit while the other unit is experiencing an accident.

Section"8.3.3.8 (Part)- Possible Sharing of DC Contro Power to ACSwitchgear

The surveillance period for the dc bus transfer switch will be seven days.

Section 8.3,3.8 (Part d) - Sharing of Structures and VentilationSystems Between Units

The major areas of the plant which share structures and ventilation systemsin which major electrical equipment is located are as follows:

1. Main control room - See FSAR, section 9.4.1.3

2. Auxiliary Building - See FSAR, section 9.4.3

3. Diesel Generator Building - See FSAR, section 9.5.8

Included in this area are the shutdown board room, the auxiliary boardroom, and the shutdown transformer room.

For a failure modes and effects analysis, see Table 9.4-4 (Diesel GeneratorVentilation System), Table 9.4-5 (Auxiliary Board Room Air ConditioningSystem), Table 9.4-6 (Shutdown Transformer Room Ventilation System), Table9.4-7 (Control Building HVAC System), Table 9.4-9 (Shutdown Board Room A/CSystem).

Section 8.3.3.8. (Part e) - Sharing of Loads Between Units

The following is a list of loads which are shared between units:

a. Denotes engineered safety features (ESF-Systems which take automaticaction to isolate the reactor and/or mitigate reactor accident for bothLOCA or blackout condition.)

Component Cooling System Pump C-S 480V Shutdown Bd 2B2-B 480V ShutdownBd 1A2-A

b. Denote essential supporting auxiliary system (ESFAS - Those systems andcomponents required for safe operation and control of the reactorduring a blackout condition or for support in mitigating LOCA.)

Spent Fuel Pit Pump C-S 480V Shutdown 480V ShutdownBd 1A1-A* Bd 2B1-B*

c. Denote a component neither a nor b

24V CAP Sys Bat Chgr Reactor MOV Bd 1A1-A Reactor MOV Bd 2A1-A

24V CAP Sys Bat Chgr Reactor MOV Bd 1B1-B Reactor MOV Bd 2B1-B

*These boards are neither the normal nor alternate supply but are theavailable boards from which the loads can be.supplied.