ML061730396

Operability Determination for the Callaway Plant Technical Specifications Requirements When One Main Steam Isolation Valve Actuator Train Is Removed from Service

ML061730396
Person / Time
Site:	Callaway
Issue date:	10/19/2006
From:	Holden C Plant Licensing Branch III-2
To:	Howell A NRC/RGN-IV/DRP
Donohew J N, NRR/DORL/LP4, 415-1307
References
Download: ML061730396 (17)

Text

October 19, 2006 MEMORANDUM TO: Arthur T. Howell, III, Director Division of Reactor Projects Region IV FROM: Cornelius F. Holden, Deputy Director /RA/

Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

SUBJECT:

OPERABILITY DETERMINATION FOR THE CALLAWAY PLANT TECHNICAL SPECIFICATIONS REQUIREMENTS WHEN ONE MAIN STEAM ISOLATION VALVE ACTUATOR TRAIN IS REMOVED FROM SERVICE The purpose of this memorandum is to provide an assessment by the Office of Nuclear Reactor Regulation (NRR) of concerns identified by Region IV staff at the Callaway Plant relating to the operability of a main steam isolation valve (MSIV) when one of the two actuator trains on an MSIV is inoperable.

The requested operability determination pertains to an inspection finding in December 2004 that the licensee removed the Train A MSIV actuator from its MSIV for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> for corrective maintenance without declaring either the MSIV or the MSIV actuation logic inoperable. The Region IV staff considered the MSIV inoperable with the Train A actuator removed from service since the MSIV would not close on a Train A engineered safety features actuation system (ESFAS) signal to the Train A actuator, as stated in the Callaway Final Safety Analysis Report (FSAR). As also described in the FSAR, each MSIV has two actuator trains, either of which can close the valve.

The enclosed operability determination (Enclosure 1) addresses the following three questions identified by the Region IV staff (Enclosure 2).

1. Should the operability determination consider the current licensing basis commitment to meet the single failure criterion?

2. Does the operability determination need to demonstrate MSIV safety function (to close) with the single failure described in the accident analysis?

3. Is the MSIV operable with an actuator train removed from service?

In Amendment No. 172, issued on June 16, 2006, Technical Specification (TS) conditions, required actions and completion times were added to TS 3.7.2, "Main Steam Isolation Valves (MSIVs)," for inoperable MSIV actuator trains. Previous to this amendment, the Callaway TS 3.7.2 did not list the MSIV actuator trains and did not address an inoperable actuator train.

This led to differences of opinions among the licensee, the Region IV staff, and the NRR staff about what the TS required when an MSIV actuator train was found inoperable. The NRC Region IV staff believed, with one actuator train being inoperable, the MSIV (the valve itself) should be declared inoperable and TS 3.7.2 requires an inoperable MSIV to be restored to

Arthur T. Howell, III operable status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The licensee believed with one actuator train being inoperable, the MSIV was "degraded but operable," in accordance with Regulatory Information Summary (RIS) 2005-20, because the Callaway MSIVs have two independent actuator trains per valve, and the MSIV could still perform its safety function with the remaining operable actuator train. In its application for Amendment No. 172, the licensee stated that an MSIV can close within the required closure time with only one actuator train working; however, the licensee agreed that its TSs did not adequately address the condition when an MSIV actuator train is inoperable.

By letter dated May 26, 2005 (Enclosure 3), the licensee submitted proposed TS changes to address loss of actuator trains under the guidance of Administrative Letter 98-10 to address this concern by providing TS conditions, required actions, and completion times for inoperable MSIV actuator trains. These TS changes were approved in Amendment No. 172. The licensee reiterated its position in its amendment application that "inoperability of one of the two actuator trains associated with an MSIV does not by itself make the MSIV incapable of closing since the remaining operable actuator train can alone effect valve closure on demand."

On January 23, 2006, NRR (Technical Specifications Branch (ITSB) and Plant Licensing Branch IV) and Region IV staff met at headquarters (Rockville) to discuss the operability of the MSIV with respect to a single inoperable actuator train. After much discussion, it was found that there were strong differences of opinion on this issue. Consequently, on January 26, 2006, ITSB formed a panel from Region I, II, and III, and ITSB staff to establish a uniform position on this question. The ad hoc panel concluded in a May 8, 2006, memorandum from P. Hiland to C. Haney (Agencywide Documents Access and Management System (ADAMS) Accession No. ML061180309; non-publicly available) that the affected MSIV at Callaway should have been declared inoperable when the Train A actuator, which is not listed in MSIV TS 3.7.2, was removed from service. One NRR/DORL staff person disagreed with this finding and submitted a non-concurrence memorandum (ADAMS Accession No. ML061440108; non-publicly available) dated May 22, 2006. The reply to the non-concurrence memo was provided in a memo dated June 12, 2006 (ADAMS Accession No. ML061630120; non-publicly available). The non-concurrence is resolved by this memorandum.

The enclosed operability determination for the Callaway MSIVs concludes that, for the Callaway TSs up to June 15, 2006, the loss of an MSIV actuator train would result in the licensee having to declare the associated MSIV inoperable or enter limiting condition for operation (LCO) 3.0.3.

The significance of the June 15, 2006, date is that the Callaway TSs were amended on June 16, 2006, to incorporate new TS conditions, required actions, and completion times for inoperable MSIV actuator trains and, thus, the operability determination is not applicable to the current Callaway TSs. The licensee's application for the amendment is Enclosure 3.

In summary, based on the enclosed operability determination, the following conclusions have been made:

• Based on the rules and practices of the TSs and in accordance with RIS 2005-20, the functionality of support structures, systems, or components (SSCs) not listed in the TSs must be considered in determining the operability of SSCs in the TSs. Additional failures of support or supported SSCs should not be postulated.

• Specifically for the Callaway MSIVs, with one of the redundant actuator trains out of service for an MSIV, the licensee should have declared the MSIV inoperable, because SR 3.7.2.2 could not be met and, therefore, LCO 3.7.2 was not being met.

Arthur T. Howell, III

Enclosures:

1. Operability Determination

2. Email Dated January 23, 2006

3. Callaway Letter dated May 26, 2005 (ADAMS Accession No. ML051590442)

ML051590442)

DISTRIBUTION:

PUBLIC LPLIV Reading RidsNrrDorl (CHaney/CHolden) RidsNrrDorlLpl4 (DTerao) RidsNrrPMJDonohew RidsNrrLALFeizollahi RidsAcrsAcnwMailCenter RidsOgcRp RidsRegion4MailCenter (BJones) PHiland, DIRS TKobetz, ITSB CSchulten, ITSB MPeck, RIV ACCESSION NO.: ML061730396 OFFICE NRR/LPL4/P NRR/LPL4/L NRR/LPL4/B NRR/ITSB/BC OGC NRR/DORL/DD M A C NAME JDonohew LFeizollahi DTerao TKobetz MZobler CHolden DATE 10/19/06 10/19/06 10/19/06 8/30/06 9/13/06 10/19/06 OPERABILITY DETERMINATION FOR CALLAWAY MAIN STEAM ISOLATION VALVE (MSIV)

WITH ONE MSIV ACTUATOR TRAIN IS REMOVED FROM SERVICE The following addresses the operability of an MSIV with one MSIV actuator train inoperable by addressing three questions raised by the senior resident inspector at Callaway in his email to Patrick Hiland dated January 23, 2006 (Enclosure 2), on pressurized-water reactor (PWR) MSIV operability issues. The operability determination was made by the Technical Specifications Branch (ITSB)/Division of Inspection and Regional Support (DIRS)/Office of Nuclear Reactor Regulation (NRR) selecting a panel to review and assess the documentation in Enclosure 2, which is related to the plant technical specifications (TSs) and final safety analysis report (FSAR) operability requirements for the MSIVs.

Question 1: Should the operability determination consider the current licensing basis commitment to meet the single failure criterion?

Response to Question 1 It is the panel position that when the licensee removed the Train A MSIV valve actuator from one MSIV, the single failure criterion was not met; however, the TSs provide a temporary relaxation of the criterion to provide a limited time (i.e., the TS-specified completion time (CT))

for the licensee to fix the equipment or otherwise make it operable.

The single failure criterion is defined in 10 CFR 50, Appendix A, General Design Criterion, as follows:

Single failure. A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure.

Fluid and electric systems are considered to be designed against an assumed single failure if neither (1) a single failure of any active component (assuming passive components function properly) nor (2) a single failure of a passive component (assuming active components function properly), results in a loss of the capability of the system to perform its safety functions.

The assumption for TS Limiting Conditions for Operation (LCOs) is that a safety system is operable when all required redundant and non-redundant components described in the plant safety analyses are operable. If the single failure criterion cannot be met, the requirements of 10 CFR 50.36(c)(2)(i) apply:

When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shutdown the reactor, or follow any remedial action permitted by the technical specifications until the condition can be met.

ENCLOSURE 1

Guidance in Generic Letter (GL) 80-30, dated April 10, 1980, contains a clarification of the term "Operable" as it applies to single failure criterion for safety systems required by TSs. GL 80-30 states:

[T]he single failure criterion is preserved by specifying LCOs [limiting conditions for operation] that require all redundant components of safety related systems to be OPERABLE. When the required redundancy is not maintained, either due to equipment failure or maintenance outage, action is required, within a specified time, to change the operating mode of the plant to place it in a safe condition.

The specified time to take action, usually called the equipment out-of-service time, is a temporary relaxation of the single failure criterion, which, consistent with overall system reliability considerations, provides a limited time to fix equipment or otherwise make it OPERABLE. If equipment can be returned to OPERABLE status within the specified time, plant shutdown is not required.

Thus, during Callaway corrective maintenance with the Train A actuator removed from service from one MSIV, the MSIV is inoperable and the LCO Required Actions should be met, because the affected MSIV can not meet SR 3.7.2.2 for both (redundant) actuator trains. SR 3.7.2.2 requires testing of both trains of MSIV actuators to ensure that the actuation signal from the two required trains of ESFAS instrumentation for steam line isolation (TS Table 3.3.2-1, Function 4) will perform their related support function to actuate the MSIVs to the isolation position.

Therefore, although SR 3.7.2.2 states that each MSIV must actuate to its isolation position on "an actual or simulated signal," both actuators must in fact be tested to demonstrate that the MSIV is operable as designed and described in the FSAR.

The conclusion for the Callaway operability determination is that, with one or more actuator trains (non-TS support systems) inoperable, the requirements of the LCO 3.7.2, "Main Steam Isolation Valves (MSIVs)," are not met. This conclusion is consistent with the position in GL 80-30.

Question 2: Does the operability determination need to demonstrate MSIV safety function (to close) with the single failure described in the accident analysis?

Response to Question 2 Yes, as discussed above in the response to Question 1, design redundancy requirements are included in an operability determination. The assumption for TS LCOs is that operability determinations must demonstrate that a safety system can function as designed given the single active failure described in the safety bases.

Question 3: Is the MSIV operable with an actuator train removed from service?

Response to Question 3 No. The panel's operability determination for the plant condition of the Train A actuator removed from service from one MSIV was reached by applying Callaway Technical Specifications and the guidance contained in RIS 2005-20, which included as an attachment, NRC Inspection Manual, Part 9900 Technical Guidance, "Operability Determinations &

Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety (ODP)."

The panel considered whether the actions taken by the licensee established noncompliance with either LCO 3.3.2, ESFAS Instrumentation Table 3.3.2-1, Function 4 or LCO 3.7.2. These are the two LCOs that are related to the equipment removed from service.

Application of ODP Guidance The Callaway licensing basis requires that the MSIV acutators function to isolate their respective MSIV on an ESFAS instrumentation steam line isolation signal, therefore, the MSIV actuators perform a required support function for the safety-related MSIVs. Since the actuators are not included in the MSIV LCO, the MSIV actuators are non-TSs support functions required by the TS definition of operability.

Inspection Manual Chapter Part 9900: Technical Guidance, "Operability Determinations &

Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety," discusses TS requirements as they relate to supported and support systems in Appendix C.9, "Support System Operability."

"The definition of operability assumes that a structure, system or component (SSC) described in TSs can perform its specified safety function when all necessary support systems are capable of performing their related support functions. The definition of operability encompasses both TS and non-TSs support systems. Upon discovery of a support system that is not capable of performing its related support function(s), the most important consideration is the possibility of having lost all capability to perform a specified safety function.

Upon declaring a support or supported system inoperable in one train, the required actions in the TSs should be implemented."

The panel concludes that the MSIV actuators are within the scope of an operability determination (ODP Section 2.1) for the MSIVs since the Callaway licensing basis (TS Table 3.3.2-1, Function 4,"Steam Line Isolation" and SR 3.7.2.2, "Verify each MSIV actuates to the isolation position on an actual or simulated actuation signal") require demonstration that each MSIV have two operable acutators to perform the required support function to isolate their associated MSIV.

Surveillance Requirements (SRs)

LCO 3.7.2 requires four MSIVs to be operable. MSIV surveillance test 3.7.2.1 verifies the isolation times of each MSIV is no more than 5 seconds in accordance with the inservice testing program. MSIV SR 3.7.2.2 verifies that each MSIV actuates to the isolation position on an actual or simulated actuation signal at a frequency of once every 18 months.

LCO 3.3.2, ESFAS Instrumentation requires two trains of instrument functions to be operable to perform the steam line isolation safety function. The steam line isolation TS-required functions include manual initiation, actuation logic, containment pressure and steam line pressure. The Callaway TSs require performing periodic actuation logic tests for both trains of ESFAS

instrumentation. MSFIS Actuation logic is tested every 31 days, solid-state protection system (SSPS) actuation logic is tested quarterly.

Thus, ESFAS Steam Line Isolation instrumentation in conjunction with MSIV operability requirements ensure that both Trains (Train A and Train B) of MSIV actuators are capable of performing their specified support functions to actuate their associated MSIVs on valid ESFAS isolation signals.

By removing the Train A actuator from service the associated MSIV will not close on a Train A ESFAS signal to the Train A MSIV actuator, as stated in the FSAR. Thus, removing one MSIV actuator resulted in SR 3.7.2.2 being not met because, as stated in SR 3.0.1:

SR 3.0.1. SRs shall be met during the MODES or other specified conditions in the Applicability for individual LCOs, unless otherwise stated in the SR. Failure to meet a Surveillance, whether such failure is experienced during the performance of the Surveillance or between performances of the Surveillance, shall be failure to meet the LCO...

Upon discovery that SR 3.7.2.2 is not met, then LCO 3.0.2 applies, and LCO 3.0.2 requires that the required actions of an LCO (i.e., the remedial actions) must be entered at time of discovery that the LCO is not met. The required actions of LCO 3.7.2 specify an 8-hour completion time to restore an inoperable MSIV to operable status, otherwise the plant must be in Mode 2 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The panel concludes that Callaway LCO 3.7.2 for MSIVs was not met when the Train A MSIV actuator was removed from service because both trains of MSIV actuators must be able to meet SR 3.7.2.2, and the actuator taken out of service could not meet SR 3.7.2.2. Based on this, LCO 3.7.2 was not being met and the licensee is required by the TSs to enter the remedial actions specified for LCO 3.7.2. In entering the remedial actions specified for LCO 3.7.2, the licensee either restores the inoperable MSIV to operable status (i.e., restore the inoperable actuator train to operable status) in the specified CT, or enters LCO 3.0.3.

Operability Determination The panel finds that the affected MSIV was required to be declared inoperable when the Train A actuator (a component of a support safety system not listed in the TSs) was removed from service. This is because, in this plant condition, SR 3.7.2.2 could not be met since, as required by SR 3.7.2.2, the MSIV was not capable with one actuator train removed from service of actuating to the isolation position on a signal to each actuator train. Pursuant to SR 3.0.1, failure to meet a surveillance is failure to meet an LCO and pursuant to LCO 3.0.2 upon discovery of failure to meet an LCO the required actions of the associated conditions (i.e., the remedial actions per 10 CFR 50.36 for the LCO) shall be met. For the LCO 3.7.2 required actions at the time the actuator train was taken out of service, the licensee must declare the associated MSIV inoperable and comply with LCO 3.0.2, or enter LCO 3.0.3 to exit the LCO 3.7.2 applicability requirements. Either action must be done even though the associated MSIV could be actuated to the isolation position with an ESFAS signal by the remaining operable actuator train on the affected MSIV.

EMAIL DATED JANUARY 23, 2006 From: Michael S. Peck To: Patrick Hiland Date: Mon, Jan 23, 2006 6:55 PM

Subject:

ACT: PWR MSIV Operability Issues Gentlemen:

The Callaway resident inspector (Michael Peck), Region IV representative (Bill Jones), NRR Projects and Technical Branch met to review the operability of a degraded MSIV with a isolated valve actuator. The attached file outlines Region IV's application of RIS 2005-20 for degraded MSIV. From the meeting, we learned that a gap may exist between the Region IV application and Technical Specification Branch intent concerning how the Agency applies single failure criteria during operability determinations. Your help is needed to better understand the extent of this gap. Please review the following example using the guidance in RIS 2005-20 and provide a conclusion/recommendation concerning the operability of the affected MSIV.

- One MSIV valve actuator is removed from service for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> for corrective maintenance.

- CWY has one MSIV per steam line with a TS LCO of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

- CWY has two MSIV Logic Trains, with a TS LCO 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> for the loss of a single train.

- Each MSIV has two valve actuators. Each actuator is fed by an independent MSIV Logic Train.

- Each MSIV Logic Train and valve actuator are completely redundant and meet Class IE separation criteria. Either logic train/valve actuator combination will independently close the MSIV.

- The CLB stated: "The assumed single failure of one of the redundant actuators will not prevent the MSIV from closing." and "Safety Evaluation Three - As indicated by Table 10.3-3, no single failure will compromise the system's safety functions."

- The limiting main steam line break containment pressure and temperate accident analysis assumed all MSIVs close with a single failure of one MSIV Logic Train (an SI Instrument Train failure which results in an MSIV Logic failure). The bounding DBA case containment pressure and temperate are exceeded if an MSIV stays open due to the additional energy from the crossover piping (with SI Instrument Train failure).

- The MSIV will close with one actuator removed from service, if the assumed single failure of a MSIV Logic Train does not occur.

- The licensee did not declare the MSIV inoperable nor apply any TS LCO out of service times.

ENCLOSURE 2

Questions:

1. Should the operability determination considered the CLB commitment to meet failure single failure criteria?

2. Does the operability determination need to demonstrate MSIV safety function (to close) with the single failure described in the accident analysis?

3. Is the MSIV operable with a actuator removed from service Thank you for your thoughts on Callaway MSIVs.

Attached is the operability evaluation of Callaway MSIV actuators.

ATTACHMENT TO ENCLOSURE 2 Operability Evaluation of Callaway MSIV Actuators The Callaway resident inspections concluded that both actuators are required attendant equipment for main steam line isolation valve (MSIV) Technical Specification (TS) 3.7.2 operability. The inspectors reached this conclusion based on the guidance provided in NRC Inspection Manual, RIS 2005-20, Part 9900: "Technical Guidance Operability Determinations &

Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety," (RIS) to review MSIV operability.

Figure 1 indicates the normal system configuration and function. Each MSIV has two valve actuator trains. Either actuator is capable of closing the MSIV. Each safety injection (SI) and MSIV logic train output a closure signal to each valve actuator. The SI and MSIV logic trains are explicitly converged under TS 3.3.2. The inoperability of either train results in a 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> plant shutdown LCO. Each MSIV is covered under TS 3.7.2. The inoperability of any MSIV results in an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> plant shutdown LCO.

Figure 2 illustrates the MSIV response to the main steam line (MSL) design bases accident (DBA). The accident analysis assumes a single failure of an SI instrument train (Train A shown in red). This single failure results in the loss of function of one MSIV logic train and all four of the corresponding MSIV actuators. The other logic train (Train B) provides a closure signal to the other four (Train B) MSIV actuators.

Figure 3 represents the energy assumed added to containment from the faulted steam generator and piping between the MSIV and the break in the accident analysis. Because this assumed single failure (SI instrument train) also disables one containment cooling train, this DBA results in the most limiting post accident containment pressure and temperature for the Callaway Plant.

Degraded Actuator AmerenUE removed an MSIV actuator from service during December 2004 without applying the TS 3.7.2 LCO out of service time. The resident inspectors performed an operability determination (OD) of the degraded MSIV using RIS 2005-20. The inspectors used the following assumptions in the OD:

• The OD included current licensing bases (CLB) requirements and/or commitments for the affected SSC - FSAR Section 10.3.3 Safety Evaluation Safety Evaluation Three, states that no single failure will compromise the MSIV safety functions (RIS Section 4.4.a(3)).

• The OD included the effect or potential effect of the degraded condition on the ability of the MSIV specified safety function - To close during MSL break DBA (RIS Section 4.4(5)).

• The inspectors applied the signal failure of an SI instrument train, described in the accident analysis, because the licensee did not declare the MSIV inoperable nor apply the LCO out of service time (the MSIV allowed out of service time was actually exceeded, RIS Appendix C, "Specific Operability Issues," C.2 Single Failures).

• The OD considered the single failure as the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from the single occurrence were considered to be a single failure. The single failure of the SI instrument train resulted in the loss of function of the corresponding MSIV logic train (RIS Appendix C, "Specific Operability Issues," C.2 Single Failures).

Figure 4 illustrates the system response with the Train B actuator removed from service with the single failure of the Train A SI Instrument Logic. The MSIV, with the actuator removed from service, fails to close.

Figure 5 illustrates the affect of the failed MSIV on the post accident containment response.

Additional enthalpy from the MSL cross over piping steam is added to containment as result of the MSIV to close. The resulting peak postulated containment pressure and temperature exceed the bounding DBA analysis case. The licensee proposed adding this new accident case to the licensing bases but concluded prior NRC approval was required.

RIS Section 2.1.b states that SSCs that are not explicitly required to be operable by TS, but perform required support functions (as specified by the TS definition of operability), are also required to be operable by TS. The actuators, a sub component of the MSIV, fall into this category. The MSIV safety function, with the assumed single failure of an SI instrument train, cannot be accomplished without both MSIV actuators available. The MSIV TS out of service time must be applied if an actuator is not capable of performing the intended function.

Safety Concern - Severe Accident Consequences are Possible Without TS Controls on MSIV Actuators one steam Severe accident consequences (in excess of Part 100 Guidelines) are possible if the operability MSIV actuators are not control under TS. For example, at Wolf Creek the licensee assumes only one actuator is required for MSIV TS operability. Under this assumption, the licensee would be permitted to remove one valve actuator from service on each MSIV without applying the TS out of service time. An uncontrolled blow down of all steam generators is possible if the MSL break DBA occurs under these conditions (with the single failure of the SI instrument Train A, shown in Figure 6). The blowdown of more than one steam generator would result in containment.

pressure much greater than the design value of 60 psig, directly challenging the fission product barrier. The uncontrolled blowdown of all steam generators qualifies as an severe accident.

The resulting rapid reactor coolant system cool down and depressurization would also indirectly challenge the fuel clad by a return to power (local peaking) and the depart from nucleate boiling.

10 CFR 50.36(c) (ii) (C), Criterion 3, requires TS for SSC that are part of the primary success path and which function or actuate to mitigate a DBA or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier. The MSIVs fall into this category. Both actuators on each MSIV are also required to be functional for the MSIV to perform the safety functions described in the accident analysis. Both actuators must be functional for the MSIV to be operable under TS 3.7.2.