ML101610360

Amendment 99 to Final Safety Analysis Report (Fsar), Section 9 - Auxiliary Systems, Pages 9.4-1 Through 9.5-66

ML101610360
Person / Time
Site:	Watts Bar
Issue date:	05/27/2010
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
References
Download: ML101610360 (366)

Text

WATTS BAR WBNP-99 9.4 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4.1 Control Room Area Ventilation System 9.4.1.1 Design Bases The Control Building heating, ventilating, air-conditioning (HVAC), and air cleanup systems are designed to maintain temperature and humidity conditions throughout the building for the protection, operation, and maintenance and testing of plant controls, and for the safe, uninterrupted occupancy of the main control room habitability system (MCRHS) area during an accident and the subsequent recovery period. Refer to Section 6.4 for further information regarding control room habitability and definition of MCRHS area. The main control room habitability zone (MCRHZ) is designed to maintain a positive pressure relative to the outdoors and to the adjacent areas at all times, except during a tornado warning, to minimize air inleakage.

The Control Building air-conditioned equipment areas and normally occupied personnel spaces are maintained in the range of 60°F minimum to 104°F maximum temperature during all modes of operation. Adequate envirionmental conditions are provided for equipment operation and protection, and personnel comfort in the control room during normal, accident, and post-accident recovery conditions.

The Control Building outside air intakes are provided with radiation monitors, and smoke detectors. Indicators are provided with the radiation monitors. Main Control Room (MCR) common annunciation is provided. Isolation of the MCRHZ occurs automatically upon the actuation of a safety injection signal from either unit or upon indication of high radiation, or smoke concentrations in the outside air supply stream to the building. The Control Building HVAC outside air intakes can also be isolated by closing the tornado dampers. The tornado dampers are closed manually from the MCR during a tornado warning to protect the Control Building from tornado depressurization effects.

Upon receipt of a signal for MCRHS area isolation, Control Room Isolation (CRI), the following conditions are automatically implemented:

(1) The Control Building emergency air cleanup fans operate to recirculate a portion of the MCRHS area air-conditioning system return air through the cleanup trains composed of HEPA filters and charcoal adsorbers.

(2) The Control Building emergency pressurizing air supply fan operates to supply a reduced stream of outside air to the MCR air-conditioning system to maintain the MCRHZ pressurized relative to outside and the adjacent areas.

This fresh air is routed through the emergency air cleanup trains.

(3) The control room electrical board rooms (EBR) air handling units continue to draw outside air to maintain the lower floor spaces at atmospheric pressure.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-1

WATTS BAR WBNP-99 (4) The exhaust fan in the toilet rooms is stopped, and double isolation dampers are closed.

(5) The spreading room supply and exhaust fans are stopped and any operating battery room exhaust fan continues to run.

(6) Double isolation dampers in the spreading room supply duct and isolation dampers in the exhaust duct close.

(7) The Auxiliary Building Elevation 757 shutdown board rooms pressurizing air supply fans are automatically de-energized.

(8) Double isolation valves close to isolate the normal pressurizing supply to the MCRHZ.

MCRHZ isolation may be accomplished manually at any time by the control room operators.

The following building air-conditioning and ventilating system components are each provided with two 100% capacity units. Each meets the single failure criterion, and automatic switchover is assured if one of the units fails. These systems include the:

(1) MCR air-conditioning system, water chillers, air handling units, and piping.

(2) Control Building emergency air cleanup supply fans and filter assemblies.

(3) Control Building emergency pressurizing air supply fans.

The EBR air conditioning system is provided with two 100% capacity package water chillers and four 50% capacity air handling units with associated piping, valves, and controls. This system meets the single failure criterion, and automatic switchover is assured if one of the components fails.

Two existing isolation valves, 0-FCV-31-36 and 0-FCV-31-37, in the fresh air supply duct to the spreading room remain closed and the outlet is blanked off.

Fresh air for control room emergency pressurizing is taken from the outdoors from either of two intakes. One is the emergency air intake, located on the east end of the Control Building roof at Elevation 775 and the other is connected to the fresh air intake on the roof at the west end of the Control Building. Both intakes are isolated during a tornado warning.

All essential air-conditioning equipment, ventilating equipment, isolation dampers, and ducts are designed to withstand the safe shutdown earthquake (SSE). Nonessential components are seismically designed to the extent that they will not affect system operation if they should fail due to a seismic event. All air-conditioning and essential ventilating equipment are protected from the effects of a design basis tornado (Section 3.3.2), by isolation dampers located at all external openings to the Control Building. A 9.4-2 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 concrete hood located over the air intake provides additional protection from the effects of tornado generated missiles.

All air conditioning equipment necessary to ensure main control room habitability in the event of a flood is located in the Auxiliary and Control Buildings at elevations where the equipment remains functional during flooding up to the design basis flood elevation. The EBR air conditioning system is not required during a flood Piping which could be a source of pipe whip (i.e., high energy lines) does not pass through areas containing essential Control Building air conditioning or air cleanup equipment. The equipment is also separated from and protected from potential sources of missiles and jet impingement which could adversely affect operation of the system. See Section 3.5.1.1.4 for further discussion on Control Buiding internal missiles.

System and component quality group classification for the Control Building heating, ventilating, air conditioning and air cleanup systems is commensurate with the importance to safety of the function performed by the systems. For further discussion of quality group classification refer to Section 3.2.2.

9.4.1.2 System Description The Control Building HVAC, and air cleanup systems are shown on Figures 9.4-1, 9.4-2, and 9.4-3 and the logic and control on Figures 9.4-4, 9.4-4a, 9.4-5, 9.4-6 and 9.4-7 and consist of the following systems:

(1) MCR air-conditioning system (2) EBR air-conditioning system.

(3) Control Building emergency air cleanup system.

(4) Control Building emergency pressurizing system.

(5) Battery room ventilating system.

(6) Miscellaneous ventilating systems.

The MCR air-conditioning system water chillers are located in the Auxiliary Building at Elevation 737.0. The associated air handling units are located in the Control Building in the mechanical equipment room at Elevation 755.0. The area served by this system includes the MCR, the relay room, the DPSO engineers shop, Control Building offices, the technical support center (TSC), conference rooms, kitchen, toilets, locker rooms, the mechanical equipment room and the NRC Office at Elevation 755.0.

The EBR air-conditioning system water chillers are located in the Control Building in the east mechanical equipment room at Elevation 692.0. The associated air handling units are located in the west mechanical equipment room at Elevation 692.0. Rooms served by this system include the battery board rooms, battery rooms, battery room AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-3

WATTS BAR WBNP-99 exhaust fan room, the communications room, the secondary alarm station at Elevation 692.0, and the computer and auxiliary instrument rooms at Elevation 708.0.

The communications room located on Elevation 692.0 has two nonsafety-related air conditioning units to supplement the electric board room air conditioning system. The units receive cooling water from the raw service water system. The units are provided with local controls.

The MCR air conditioning system is provided with two 100% capacity package water chillers, two 100% capacity fan-coil type air handling units, and associated pumps, piping, ductwork, and controls.

The EBR air conditioning system is provided with two 100% capacity package water chillers, four 50% capacity fan-coil type air handling units, and associated pumps, piping, ductwork, and controls.

Fresh air is drawn in from the air intake by the operating MCR air handling unit to replace that mechanically exhausted to the outdoors plus makeup for leakage in order to pressurize the MCRHZ.

Fresh air is drawn in by the operating EBR air handling unit and supplied to spaces on Elevations 692.0 and 708.0. System airflow balancing provides for makeup air which replaces that mechanically exhausted to the outdoors and maintains atmospheric pressure at these floors.

During normal and CRI operating modes, all MCRHS air, fresh and recirculated, is filtered by passing through an air handling unit containing a bank of filters. Filters associated with an inactive air handling unit are available for servicing.

During normal operations, all fresh air supplied to the air conditioning systems is heated by a thermostatically controlled duct heater to maintain spaces within design temperature limits. Additional electric heaters are located in air supply ducts serving the battery board rooms at Elevation 692.0; the auxiliary instrument and computer rooms at Elevation 708.0; and the relay room, TSC, Control Building offices, conference rooms, toilets, locker room and kitchen at Elevation 755.0. The above heaters are each thermostatically controlled to maintain room design conditions.

During normal operation, air is exhausted from the Control Building by the toilet and locker room exhaust fan, a spreading room exhaust fan, and a battery room exhaust fan. The spreading room supply fan transfers air from the mechanical equipment room on Elevation 755.0 to the spreading room. The makeup air and pressurizing air is drawn into the Control Building by the operating MCR and EBR air handling units. The air supply quantity is manually preadjusted by balancing dampers, as required, to maintain a minimum 1/8-inch positive static pressure in the main control room and atmospheric pressure in the remainder of the building, except the spreading room which is manually preset at a slight negative pressure relative to outdoors.

During a CRI, double isolation valves automatically close to terminate the normal supply of fresh air to the MCRHZ. The EBR air handling units continue to draw a 9.4-4 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 measured quantity of outside air to maintain the lower floors at approximately atmospheric pressure.

In the event of a single active failure which causes the MCRHZ pressure to drop below 1/8-inch water gage positive pressure, any of the four differential pressure switches activate an alarm in the MCR. The control room operator provides corrective action in the normal operating mode and has the option of starting the standby air handling unit.

If there is a single failure during the isolation mode, the differential pressure switches automatically start the standby emergency pressurizing fan and its associated air cleanup unit to maintain the pressure in the MCRHZ. The switches also activate an alarm in the MCR.

The Control Building emergency air cleanup system is located within the mechanical equipment room at Elevation 755. This system is provided with two 100% capacity emergency air cleanup fans, and two 100% capacity air cleanup filter assemblies arranged in two parallel 100% capacity fan-filter trains. Refer to Section 6.5 for further information related to the emergency air cleanup units.

The emergency air cleanup system automatically operates upon a safety injection signal, indication of high radiation, or smoke concentrations in the building fresh air supply. This system can also be manually started from the MCR at any time. During an accident, both of the emergency air cleanup supply fans are started. Controls are provided to permit the control room operators to shut down either one of the air cleanup units and to keep it as a backup. The backup unit automatically starts in the event the operating unit fails.

During air cleanup system operation, a portion of the MCR air conditioning system return air is continuously routed through one or both of the air cleanup units and then to the system return air plenum. The cleaned air is thus recirculated to the MCR by the air-conditioning system. The system may be manually operated from the MCR at any time as required for periodic testing in accordance with the technical specifications filter testing program.

The Control Building emergency air cleanup fans are engineered safety features (ESF) equipment and are connected to separate divisions of the emergency power system.

The MCRHZ is pressurized with cleaned outdoor air during operation of the control room emergency air cleanup system. The minimum 1/8-inch positive pressure of the MCRHS area relative to the outdoors and adjoining spaces minimizes the inleakage of unprocessed air during the emergency mode. Section 6.4.3 discusses the three modes of system operation. The control room emergency pressurization system is provided with two 100% capacity emergency pressurizing air supply fans located within the mechanical equipment room Elevation 755. The fresh or pressurizing air is taken from either of two air intakes, one located on the Control Building roof at Elevation 775 near the east end of the building and the other located on the west end of the building. Each fan is duct-connected to an intake hood to provide two separate 100% capacity air supply systems. Air from each emergency intake is ducted to the associated emergency pressurizing fan. A cross-connection is provided just upstream of the fans AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-5

WATTS BAR WBNP-99 (refer to Figure 9.4-1) which allows either emergency pressurization fan to draw air from either emergency air intake if necessary. The manual damper in the cross connection is normally in the closed position. The damper, which is accessible from within the habitability area, is opened only if one of the emergency pressurizing fans has failed and contamination of the air intake associated with the non-failed fan is great enough to require air to be drawn from the other emergency intake. Determination of contamination level is discussed in Section 6.4.3.

Emergency pressurization air supply fans which discharge to the control room air-conditioning system return air upstream of the air cleanup filter assembly trains.

The emergency pressurizing fans are the vaneaxial type with a capacity to deliver 711 cfm. These fans (one redundant) are ESF equipment and are connected to separate divisions of the emergency power system.

Both emergency pressurizing fans (100% redundant) are started by the same accident signal that starts the air cleanup units. The capability is provided to place either of the operating air cleanup units and the associated emergency pressurizing fans in the standby mode. The standby components start automatically in the event of a failure of the operating air cleanup unit or its emergency pressurizing fan.

During non-tornado operation, power is removed from tornado isolation dampers 0-FCO-31-21 and 0-FCO-31-34, which are located in the ductwork connected to the two fresh air intakes. The dampers control circuits remain de-energized during all plant conditions, except tornado warning, to preclude the possibility of a single failure in their control circuit isolating both air intakes.

The battery rooms ventilation system consists of two 100% capacity and one reduced capacity exhaust fans. The fans are located on the Elevation 692.0 floor with the two 100% capacity fans located near the west end of the building and the other fan located in the east mechanical equipment room.

Fire dampers provided in each room's air exhaust duct and air supply opening operate to isolate the room upon high temperature due to fire.

The battery room ventilation system is required to operate at all times except during the design basis flood and during a 72-hour period following a fire. A standby fan automatically starts upon failure of the operating fan to produce airflow. The battery room fans are ESF equipment and are connected to the emergency power system.

The reduced capacity exhaust fan C-B is normally unpowered, but can be manually started if needed to control hydrogen in the battery rooms.

The spreading room is ventilated by one of two 100% capacity exhaust fans (one being on manual standby) located at the east end of the spreading room at Elevation 729.0. One spreading room supply fan, located in the mechanical equipment room at Elevation 755.0, supplies air from the mechanical equipment room. Because the spreading room is maintained at a slight negative pressure during normal operation, some air enters via leakage from the MCR and the electrical board room areas.

9.4-6 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 The spreading room supply and exhaust fans are nonsafety-related and are not connected to the emergency power system. During MCR isolation, the spreading room fans are automatically shut off and isolation dampers closed.

The mechanical equipment room at Elevation 755.0 is normally ventilated by the passage of air-conditioning system supply air from the system air handling unit.

The mechanical equipment room at Elevation 692.0 is ventilated at all times with air supplied by the EBR air-conditioning system supply and with air drawn through the room to the air-conditioning return air duct.

The kitchen, toilet, and locker rooms at Elevation 755.0 are ventilated by exhausting a portion of the MCRHZ conditioned air through the rooms. The toilet and locker room exhaust fan is located in the Elevation 755.0 mechanical equipment room and discharges directly to the outdoors.

The toilet and locker rooms exhaust fan is nonsafety-related and is not connected to the emergency power system. During MCR isolation the toilet and locker room exhaust fan is automatically shut down, and double isolation dampers close.

Dampers used to isolate the MCRHZ area from the outside and from portions of the ventilation systems serving other areas of the Control Building are low leakage type dampers. They are heavy-duty dampers provided with resilient seals along the blade edges. These dampers close following detection of high levels of radiation, concentrations of smoke, or receipt of an isolation signal. Refer to Section 6.4 for further information regarding damper leakage.

9.4.1.3 Safety Evaluation The Control Building air-conditioning systems are ESF. Each pair of full-capacity (one redundant) water chillers and each redundant set of air handling units is served from a separate train of the emergency power system and from a coordinated separate loop of the essential raw cooling water system (ERCW). Upon loss of offsite power, emergency power to the MCR and EBR chiller packages is automatically reestablished in sequence by the diesel generator in accordance with FSAR Table 8.3-3. The failure modes and effects analysis presented in Table 9.4-7 verifies the capability of the system to maintain acceptable environmental conditions within the Control Building during any mode of system operation following any single active failure.

All MCR equipment operates normally at an ambient temperature of 75°F. Abnormal excursions of short duration (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or less) to 104°F maximum and 60°F minimum may occur without adverse effects on the equipment. Loss of ventilation is discussed further in Section 3.11.6.

The air cleanup equipment installed to purify air supplied to the MCRHZ during emergencies is classified as an ESF air cleanup system. Good general agreement with Regulatory Guide 1.52 standards for air cleanup equipment is achieved. Details on this compliance are given in Table 6.5-4.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-7

WATTS BAR WBNP-99 Each of the Control Building emergency air cleanup units consists of a bank of HEPA filter cells and a bank of carbon adsorber modules. Test connections and appropriate instrumentation are also provided for each air cleanup unit. For further details refer to Section 6.5.1.

Filter banks are provided in the suction-side of each MCR and EBR air handling unit.

For discussions on radioactivity dose levels and detection of airborne contaminants, refer to Section 12.4 and 12.3.4.

Tornado dampers are provided to isolate the Control Building HVAC outside air intakes during a tornado warning. The isolation is provided upon damper closure during either normal system operation or MCR Isolation. The loss of MCRHZ pressurization during this time will not result in contaminated air leaking into the MCRHZ since a LOCA is not postulated concurrent with a tornado.

The only heating, ventilating, and air conditioning required in the Control Building in the event of a flood above plant grade is for the Elevation 755.0 rooms, including the MCR.

Equipment used during the flood mode operation includes the MCR air-conditioning subsystem components on Control Building Elevation 755.0 and the water chillers and the chilled water circulating pumps on Auxiliary Building Elevation 737.0. Equipment located at floor Elevation 755 of the Control Building is unaffected by the design basis flood. The water chillers and chilled water circulating pumps serving the MCR air handling units located in the Auxiliary Building at floor Elevation 737 are functional for floods up to the design basis flood level. Refer to Section 2.4.14 for additional discussion of the plant flood protection plan.

9.4.1.4 Tests and Inspection Historical Information: The system was tested initially as part of the preoperational test program (Chapter 14.0)

The Control Building air-conditioning systems are in continuous operation and are accessible for periodic inspection. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation.

The building emergency pressurizing air supply fans and air cleanup assemblies are tested periodically. Details of the testing program for the air cleanup units are included in Section 6.5.

Details of the radiation monitors are included in Section 11.4.

The battery rooms ventilating system is in continuous operation. The exhaust fans are accessible for periodic inspection.

9.4-8 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 9.4.2 Fuel Handling Area Ventilation System 9.4.2.1 Design Bases The fuel handling area ventilation system, a subsystem of the Auxiliary Building ventilating system, serves the fuel-handling area at Elevation 757, the penetration rooms at Elevation 737,Elevation 757 and Elevation 782, and the fuel, waste, and cask handling areas at Elevation 729 and Elevation 692.

The system is designed to: (1) maintain acceptable environmental conditions for personnel access, operation, inspection, maintenance, and testing, (2) protect mechanical and electrical equipment and controls, and (3) limit the release of radioactivity to the environment during all weather conditions. The environmental control system is designed to maintain building temperatures between 60°F minimum and 104°F maximum.

During accident conditions, the fuel handling area ventilation system is shut down and all environmental control is handled by the Auxiliary Building gas treatment system (ABGTS), described in Section 6.2.3.

All ductwork, dampers, and grilles of the fuel handling area ventilation system essential to operation of the ABGTS are designed to Seismic Category I and Safety Class 2b requirements. Each fuel handling area exhaust fan is provided with a primary circuit breaker and a shunt trip isolation switch which is tripped by a signal of the opposite train from that for the primary circuit breaker to ensure that power is isolated from the fan. All other system components, including exhaust fans and remaining ductwork and dampers, are designed to Seismic Category I(L) requirements.

To control airborne activity, ventilation air is supplied to clean areas, then routed to areas of progressively greater contamination potential. The fuel handling area is maintained at a slightly negative pressure to limit outleakage, and can be physically isolated from the outdoors in case of radiological contamination.

Air utilized to ventilate the fuel handling area, waste packaging, and cask shipping areas is exhausted through the fuel handling area exhaust fans. An exhaust duct system from the waste packaging area and cask loading area is connected to a duct system around the periphery of the spent fuel pit and fuel transfer canal. Thus, exhaust air from the fuel handling area passes across the spent fuel pit forming an air curtain across the pool. During periods of irradiated fuel movement in the fuel transfer canal, air curtain exhaust flow at the fuel transfer canal area is required to be interrupted. The fuel transfer canal exhaust flow is isolated to prevent the uptake of source terms emitted during a postulated fuel handling accident in the fuel transfer canal and to support proper spent fuel pool accident radiation monitor operation.

Exhaust is provided by two 100% capacity fuel handling area exhaust fans. During normal operation one fan is in operation with the other on standby. Both fans discharge to the Auxiliary Building exhaust stack.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-9

WATTS BAR WBNP-99 An inlet damper furnished with each fuel handling area exhaust fan is used to regulate the volume of air exhausted as required to maintain a 1/4 inch negative pressure within the building. These dampers are automatically operated by static pressure controllers.

During periods of high radiation in the fuel handling area or upon initiation of a containment isolation signal, or for high air temperature at the supply intake the Auxiliary Building supply and exhaust fans and the fuel handling exhaust fans are automatically stopped and isolation dampers located in the ducts that penetrate the Auxiliary Building Secondary Containment Enclosure (ABSCE) are closed.

Additionally, during refueling operations when containment and/or the annulus is open to the Auxiliary Building ABSCE space, a Containment Vent Isolation (CVI) signal will automatically stop the above described fans and close the same isolation dampers as described above. Similarly, the high radiation signal in the fuel handling area can also automatically initiate a CVI during refueling operations when containment and/or the annulus is open to the Auxiliary Building ABSCE spaces.

An isolation barrier is thus formed between the building and the outdoor environment, and the Auxiliary Building gas treatment system (ABGTS) is started up automatically (see Section 6.2.3) to maintain the ABSCE at less than a 1/4-inch water gauge negative pressure during these high radiation or accident periods.

The fuel-handling area ventilation system is located completely within Seismic Category I structures and all safety-related components are fully protected from floods and tornado-missile damage.

9.4.2.2 System Description The fuel-handling area ventilation system is shown on Figure 9.4-8, on logic Figures 9.4-9 and 9.4-10, and on control Figures 9.4-11 and 9.4-17.

The fuel-handling area is supplied with outdoor air from the Auxiliary Building general ventilation air supply system, described in Section 9.4.3. All supply air is ducted to clean areas of the fuel-handling area from where it flows to areas of progressively greater contamination potential before being exhausted through a duct system by the exhaust fans. The fuel-handling area exhaust fans are capable of being connected to emergency power.

The cask decontamination area on Elevation 729 is ventilated by a separate supply fan which circulates air through the area when the decontamination room is in use. This air flow assures an acceptable environment for motor reliability and preservation.

The cask decontamination room is kept under negative pressure at all times since the room is connected to the fuel handling area exhaust ductwork.

9.4.2.3 Safety Evaluation A fuel handling accident in the Auxiliary Building is detected by the two gamma radiation detectors mounted above the fuel pool, as shown in Figure 9.4-12. The high radiation signals via redundant trains will then shut off the fuel handling and Auxiliary Building general supply and exhaust fans and start the ABGTS, as shown in Figures 9.4-10 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 9.4-9 and 9.4-10. To accomplish its safety function following a fuel handling accident, the fuel handling area ventilation system must accomplish the following functions:

(1) Isolate the normal ventilation pathways between the spent fuel pool and the environment.

(2) Filter the contaminants out of the air by the ABGTS before exhausting it to the environment.

The two redundant radiation monitors (safety-related) located above the spent fuel pit assure that the accident is promptly detected and that a high radiation signal is provided to each ventilation train, even if one monitor fails. Also,during refueling operations when containment and/or the annulus is open to the Auxiliary Building ABSCE spaces, a Containment Vent Isolation (CVI) signal is procedurally configured to assure that a fuel handling accident in containment is promptly detected and the CVI signal is provided to each ventilation train.

In addition, the Auxiliary Building radiation monitor (non-safety related) which monitors the Auxiliary Building exhaust vent is also capable of providing a high radiation signal to the MCR.

A high radiation signal from either of the monitors located above the spent fuel pit or a CVI signal whenever containment and/or the annulus is open to the Auxiliary Building ABSCE spaces during refueling operations causes the fuel handling area (FHA) and Auxiliary Building general supply and exhaust fans to shut down and their associated dampers to close, as shown in Figures 9.4-9 and 9.4-10. Each of the two FHA exhaust fans has both train A and train B dampers, to ensure building isolation in the event of one dampers failure to close. As an added safety feature, all ABSCE boundary isolation dampers are designed to fail-closed on loss of instrument air or electrical power.

These two monitors also start the ABGTS upon detection of a high radiation signal in the Auxiliary Building spent fuel pool area. See Section 6.2.3 for a further analysis of the ABGTS.

From the study of anticipated failure modes and the analysis of their associated effects, it has been determined that the safety-related portions of the system are capable of functioning in spite of the loss of any active component. See Tables 9.4-8, 9.4-8A, and 9.4-8B for a detailed failure modes and effects analysis (FMEA) on the Auxiliary Building (including fuel handling area) HVAC system.

During normal operation the fuel handling areas are continuously maintained at a slightly negative pressure relative to outdoors to minimize outleakage.

During periods of high radiation or upon initiation of an Auxiliary Building isolation signal, the ABSCE , which includes the fuel handling areas, is maintained at a nominal 1/4-inch water gauge negative pressure by the ABGTS. See Sections 9.4.3 and 6.2.3 for further information.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-11

WATTS BAR WBNP-99 9.4.2.4 Inspection and Testing Historical Information: The system is tested initially as part of the preoperational test program.

The fuel handling area ventilation system is in continuous operation and is accessible for periodic inspection. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operational/functional integrity.

Details of the radiation monitors are included in Section 11.4.

See Section 6.2.3.4 for inspection and testing requirements for the ABGTS.

9.4.3 Auxiliary Building and Radwaste Area Ventilation System 9.4.3.1 Design Bases The Auxiliary Building ventilating systems serve all areas of the Auxiliary Building including the fuel handling area (see Section 9.4.2) and the radwaste areas. Separate subsystems are utilized for the environmental control of the shutdown board rooms, auxiliary board rooms, and other miscellaneous rooms and laboratories. The ventilating systems also incorporate individual cubicle coolers to provide supplementary cooling to specific safety feature equipment.

The Auxiliary Building ventilating systems are designed to: (1) maintain acceptable environmental conditions for personnel access, operation, inspection, maintenance and testing, and for protection of mechanical and electrical equipment and controls, and (2) control airborne activity during outside environmental conditions as stated on the Environmental Data drawings.

The shutdown board, auxiliary control, and battery board rooms at Elevation 757 and the auxiliary board and battery rooms at Elevation 772 are cooled by mechanical refrigeration to maintain the room temperatures within the range for which the equipment is environmentally qualified.

To control airborne activity, ventilation air is supplied to clean areas, then exhausted through areas of progressively greater contamination potential. Ventilation system design ensures that the areas of the building which are subject to radioactive contamination are maintained at a slightly more negative pressure to limit outleakage.

All exhaust air from the Auxiliary Building is routed through a duct system, and is discharged past a radiation monitor and into the Auxiliary Building exhaust vent, except the shutdown board rooms, auxiliary control room, battery board rooms on Elevation 757, and auxiliary board rooms, battery rooms, and transformer rooms on Elevation 772, which are not tied to the Auxiliary Building exhaust.

Upon indication of high radiation in the fuel handling area of the Auxiliary Building, high temperature in the Auxiliary Building air intake(s), or upon a safety injection signal from either reactor unit, the Auxiliary Building supply and exhaust fans are automatically stopped and isolation dampers located in the ducts which penetrate the ABSCE are 9.4-12 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 closed to complete the isolation barrier. In addition, a containment vent isolation signal during fuel handling operations with containment and/or the annulus open to the Auxiliary Building ABSCE spaces will result in the above actions. Two 100% capacity gas treatment system filter trains consisting of air heaters, prefilters, HEPA filters and carbon adsorbers, are automatically energized and a reduced quantity of building exhaust is diverted through the filter trains and discharged into the Shield Building exhaust vent (see Section 6.2.3). The exhaust vent is located within the annulus space of the Reactor Building and extends to the top of the Reactor Building.

Upon detection of smoke in the Auxiliary Building air intake rooms (Units 1 and 2), the affected units Auxiliary Building general ventilation air supply fans are automatically stopped and their isolation dampers closed.

The HVAC components in the shutdown board rooms, auxiliary board rooms, shutdown transformer rooms, ABGTS, and Auxiliary Building ESF coolers, associated ductwork and piping are designed to Seismic Category I requirements. Other parts of the Auxiliary and Radwaste Area ventilation system are designed to meet Seismic Category I(L) requirements.

For safety-related portions of the system, components are designed to assure that a single active failure cannot result in the loss of a safety-related function. This is accomplished by using 100% redundancy where required as described in the following sections. The Auxiliary Building is structurally designed to resist damage by missiles, either internally or externally produced. Specific design considerations for missile protection are also described in the following subsections.

9.4.3.2 System Description The Auxiliary Building ventilation systems are shown on Figures 9.4-13, to 9.4-16, on logic Figures 9.4-9 and 9.4-10, and on control Figures 9.4-11 and 9.4-17. The auxiliary and radwaste area ventilation systems consist of the following subsystems:

(1) Building air supply and exhaust system (general ventilation)

(2) Building cooling system (chilled water)

(3) Safety features equipment coolers (4) Shutdown board room air-conditioning system (5) Auxiliary board and battery room air-conditioning system (6) Shutdown transformer room ventilation system (7) Miscellaneous ventilation and air-conditioning system AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-13

WATTS BAR WBNP-99 9.4.3.2.1 Building Air Supply and Exhaust Systems (General Ventilation)

The Auxiliary Building air supply system filters 100% of outdoor air through a bank of filters for each of two mechanical equipment rooms located at opposite ends of the building at Elevation 737.0.

Ventilation supply air is heated or cooled at the air intake, as needed, to maintain suitable temperatures in the Auxiliary Building general spaces, for equipment protection and personnel comfort during normal operation.

The air supply system utilizes four 50% capacity supply fans, two being located in each of the two mechanical equipment rooms at Elevation 737.0. During normal operation, one fan in each equipment room is in operation with the other fan in the standby mode.

Supply air is ducted to various clean or accessible areas of the Auxiliary Building from which it flows to areas of progressively greater contamination potential before being exhausted through a duct system by the building exhaust fans. In the event of a fuel-handling accident, radiation monitors in the vicinity of the spent fuel pool initiate an Auxiliary Building isolation (ABI) signal which stops the building ventilation system and starts the ABGTS fans (see Sections 9.4.2 and 6.2.3). An ABI signal can also be initiated manually. In addition, during fuel handling operations when the containment and/or the annulus is open to the Auxiliary Building ABSCE spaces, a high radiation signal from the spent fuel pool radiation monitors will result in a containment ventilation isolation (CVI) along with an Auxiliary Building isolation and ABGTS start. Further, a CVI signal, including a CVI signal generated by a high radiation signal from the containment purge air exhaust radiation monitors, will initiate an Auxiliary Building isolation and start of ABGTS. These actions will ensure proper operation of the ABSCE.

The building supply air is provided by centrifugal fans located downstream of the heating/cooling coils. These fans which operate only during normal operating conditions, are not engineered safety features.

The general exhaust air from the Auxiliary Building is provided by four exhaust fans each rated at 50% of system capacity. These fans are located on the roof of the Auxiliary Building and discharge into the Auxiliary Building exhaust stack.

An inlet damper in series with each Auxiliary Building exhaust fan is used to regulate the volume of air exhausted as required to maintain the required negative pressure within the building with respect to the outside environment.

The isolation dampers and the ductwork between these dampers that make up part of the ABSCE are designed to the requirements of Safety Class 2b and Seismic Category I. For the exhaust fans, the trip circuits for the primary circuit breaker and the shunt trip isolation switch arranged in series with the primary circuit breaker are designed as Class 1E. All other portions of this system are Seismic Category I(L).

9.4-14 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 9.4.3.2.2 Building Cooling System (Chilled Water)

The purpose of the Auxiliary Building chlled water cooling system is to supplement the general ventilation system and to maintain temperatures within design limits in the general spaces of the Auxiliary Building during normal plant operating conditions. The cooling system consists of two 100% capacity packaged water chillers, two 100%

capacity primary loop circulating pumps, two 100% capacity secondary loop circulating pumps, heating/cooling coils, fan-coil type air handling units, and associated piping, ductwork, and controls.

9.4.3.2.3 Safety Feature Equipment Coolers The safety feature equipment coolers are described in Section 9.4.5.3.

9.4.3.2.4 Shutdown Board Room Air-Conditioning System Shutdown board rooms are located on Elevation 757.0 of the Auxiliary Building with a firewall separating Units 1 and 2 equipment. The electrical boards for either unit can provide the service necessary for the safe shutdown of both plant units following an accident in either unit. Environmental control is provided by four fan-coil air-handling units supplied with chilled water from two 100% redundant water chillers.

Environmental control for the auxiliary control room is maintained by the SDBR air-conditioning system. The four SDBR air-handling units are arranged so that each shutdown board room and battery board room is cooled by either of two redundant (train A or B) air-handling units. Each pair of Train A and Train B units is located in its respective reactor unit's mechanical equipment room. The air distribution system is arranged such that the auxiliary control room is cooled by two of the four fan-coil units from different equipment rooms. Four unit heaters provide heating as required to maintain the minimum design ambient conditions. Each SDBR air-conditioning system is connected to an emergency power source and rejects heat to the ERCW system.

Upon loss of offsite power, emergency power to both SDBR air-conditioning system chillers is automatically re-established in sequence by the diesel generator in accordance with FSAR Table 8.3-3. One of the two redundant chillers is normally operating and the other is in standby. The standby chiller starts if the operating chiller fails. The SDBR air-conditioning system is designed to meet Safety Class 2b and Seismic Category I requirements.

Each of two pairs of 100% capacity pressurizing fans is designed to maintain the SDBRs at a slight positive pressure with respect to the outdoors.

Each of the two air-handling units and each of the two pressurizing air supply fans serving one set of SDBRs is powered by different power trains.

Redundant tornado dampers are installed in the Elevation 757 shutdown board room pressurizing supply fan ductwork which extends to Elevation 772; this ductwork is designed for a pressure differential of 3 lb/inch2. In addition, ductwork penetrating the Elevation 757 personnel and equipment access rooms from the emergency gas treatment system and blowdown treatment rooms is designed for 3 lb/inch2. Thus, the AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-15

WATTS BAR WBNP-99 Elevation 757 electrical equipment areas are protected from tornado-induced depressurization.

9.4.3.2.5 Auxiliary Board Rooms Air-Conditioning Systems The Auxiliary Building electrical boards, located on floor Elevation 772.0, are separated into two sub-areas per unit corresponding to Train A and Train B emergency power. Four separate air-conditioning systems are provided, one to serve each of the four board room sub-areas. Train B areas which contain both Train A and Train B electrical equipment are cooled by Train A and Train B air conditioning subsystems.

Following an accident, the electrical boards in either sub-area have the capability to support a safe shutdown of the unit. Because each sub-area is served by an attendant air-conditioning system sized to remove 100% of the heat produced by electrical equipment in that sub-area, full redundancy is provided.

The Train A air-conditioning equipment located within the Elevation 772.0 mechanical equipment room and the Train B air-conditioning equipment located on the roof above are provided structural protection from environmental hazards, including tornado missiles, and floods. The system is also designed to meet Safety Class 2b and Seismic Category I requirements.

Each board room air-conditioning system contains a refrigerant compressor, air-cooled condenser, fan-coil air handling unit with direct expansion cooling coils, two 100%

pressurizing air supply fans, air supply distribution system and control and safety devices.

Two 100%-capacity roof ventilator exhaust fans located on the roof of each of the four separate battery rooms on Elevation 772.0 provide continuous ventilation to prevent the possible accumulation of dangerous hydrogen gas.

The two 100%-capacity pressurizing air supply fans per air-conditioning system serve a twofold purpose. One is to replace a portion of air-conditioning system air exhausted through the battery room and the other is to pressurize the electrical board room to prevent infiltration of contaminated air. The mixture of this makeup air and board room return air is conditioned upon passing through the air handling unit.

One pressurizing air supply fan and one battery room exhaust fan in each individual air-conditioning system are connected to Train A electric power, and the remaining fans are connected to Train B power. Control system interlocks provide simultaneous operation of the pressurizing air supply fan and battery room exhaust fan. The availability of this fan combination on either power train ensures continuous ventilation in each battery room regardless of operability of the direct-expansion air-conditioning equipment. In the event of air-conditioning system failure, pressurizing fan air is drawn through the normal board room supply ducts by the battery room exhaust fan.

Condensing unit cooling air for the Train A air-conditioning system of each plant unit is routed from intakes located on the roof at Elevation 786, through the condenser, and discharged through a roof-mounted exhaust housing. The Train B system condenser 9.4-16 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 cooling air is drawn through an intake on the side of the equipment housing on the roof and is discharged through an exhaust opening atop the equipment housing.

Each Train A and each Train B room air conditioning system air handling unit is designed to maintain the room temperature within the range for which the equipment is environmentally qualified. The minimum temperature is 50°F for the board rooms and the battery rooms. The maximum temperature for each room is 104°F. This ensures that the equipment and components are not exposed to environmental conditions that could degrade the operability of safety-related equipment.

Each battery room exhaust fan has a damper capable of withstanding pressure differentials imposed by tornado conditions. The dampers are mounted below the fans at Elevation 786.0. Small ventilation holes are provided in each damper frame between the exhaust fan and the damper to allow continuous venting of hydrogen gas even when the damper is closed. Each of these dampers is interlocked with its respective exhaust fan such that it will provide isolation of the fan when it is not operating. These dampers are locally operated and will automatically close when the exhaust fans are turned off upon tornado warning.

The fifth vital battery room exhaust fans also have dampers capable of withstanding pressure differentials imposed by tornado conditions. The dampers are mounted below the Elevation 786.0 between the ceiling and the in-line fan. The fifth vital battery room is cooled by air which is drawn from the 480 V Board Room 1A through an opening in the common partition wall at the T line and is exhausted directly to the outside. This configuration is similar to that of the four battery rooms discussed above, with the exception that the exhaust fans are in-line axial fans and are located in the room. The cooling system is designed to maintain temperatures in this room within the range of 50°F to 104°F, and for continuous venting of hydrogen gas.

9.4.3.2.6 Shutdown Transformer Room Ventilating Systems The shutdown transformers, located on Elevation 772.0, are located in Unit 1 and Unit 2 sub-areas. Each one of these two sub-areas contains three Train A, three Train B and one nondivisional transformers.

Outside air enters each sub-area through air intake structures located on the Auxiliary Building roof. Each roof-mounted exhaust ventilator is energized from the same train of the emergency power system that supplies power to the transformer for which it provides ventilation. Exceeding the temperature setpoints in a room automatically starts the exhaust fans, and opens the air operated dampers in the two air intake structures. Manually starting the exhaust fans also opens the air-operated dampers in the two air intake structures.

Electric motor-driven centrifugal-type roof exhaust fans in the individual transformer rooms are staged by thermostatic control to maintain the transformer temperatures within the range for which the safety-related equipment is environmentally qualified.

The pneumatically-operated air intake dampers have the capability of being manually powered to the open position without regard to thermostatic control by starting a fan.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-17

WATTS BAR WBNP-99 This ventilation system is designed to maintain the temperature in the transformer rooms within the range 19°F minimum and 110°F for which the equipment is environmentally qualified.

The system is designed to meet Safety Class 2b and Seismic Category I requirements.

9.4.3.2.7 Auxiliary Building Miscellaneous Ventilation and Air Conditioning Systems The control rod drive equipment room design temperature limits are maintained by two 100% capacity non-safety related air-conditioning units located in each room. During normal operation, one of the air-conditioning units in each room is in operation with the other on standby. Each unit is automatically controlled by a self-contained thermostat.

Electric unit heaters are located in each room to provide heating during cold weather.

The hot instrument shop is cooled by a chilled water cooling coil which utilizes 100%

makeup air to prevent the recirculation of any contaminants. The hot instrument shop exhaust is provided by a lab exhaust hood which is connected to the general building exhaust duct system.

The sample room is ventilated by five lab hoods, each with an exhaust fan. Air enters the sample room through doors with transfer grilles and back draft dampers. Each hood is provided with a separate exhaust fan and HEPA filter assembly. A differential pressure gauge is used to indicate the need for filter replacement. Each hood exhaust fan discharges into the general building exhaust system.

The Additional Equipment Buildings are cooled by non-safety related packaged air-conditioning units.

The Reactor Building steam valve rooms are cooled by independent ventilation systems, each consisting of two roof mounted exhaust fans. (See Failure Modes and Effects Analysis in Table 9.4-10).The fans draw outside ventilation air for room cooling through a wall opening near the floor. Space temperature is controlled by dampers which modulate airflow in response to a wall mounted thermostat. The exhaust fans operate until a low temperature setpoint is reached when the fans automatically stop.

9.4.3.3 Safety Evaluation Functional analyses and failure modes and effects analyses have shown that the auxiliary and radwaste area ventilation system has the capabilities needed for normal operations and for accident mitigation. These are described in the sections that follow.

9.4.3.3.1 Auxiliary Building General Ventilation System A functional analysis of the general ventilation system shows that:

(1) Adequate ventilation is provided to achieve acceptable air flow patterns needed for airborne activity control. See Section 9.4.3.2.1.

9.4-18 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 (2) There are three different signals that will automatically cause the system to change from the normal operating mode to the accident mode, the Phase A containment isolation signal, the high temperature signal from the Auxiliary Building air intakes, and the high radiation signal from the fuel handling area radiation monitors. Either a Train A or a Train B signal from any of these sources will cause the system to change to the accident mode of operation.

(3) Ventilation fan operations cease and isolation dampers in the intake and exhaust ducting close in the accident mode of operation. Air flow patterns and air cleanup operations appropriate for accident mitigation during the accident mode of operation are established and maintained by the ABGTS.

See Section 6.2.3 for further information.

(4) A smoke detection signal from either the Unit 1 or the Unit 2 Auxiliary Building air intake, will shut down that units supply fans and close their discharge isolation dampers.

(5) During normal mode operations, substandard airflow are detected by a low flow sensor and this sensor signals the MCR for operators to verify automatic start up of fan(s). Each redundant Auxiliary Building general ventilation supply and exhaust fan is automatically started upon low flow detection of the operating fan.

The failure modes and effects analyses performed on safety related systems interfacing with the general ventilation system have shown that:

(1) A failure of any one of the two radiation monitors above the spent fuel pool does not prevent a high radiation signal from being relayed to necessary isolation components.

(2) A failure of the whole or any part of either Train A or Train B components to complete isolation does not prevent total isolation. Each supply and exhaust line to the environment is equipped with both Train A and Train B low leakage isolation dampers.

(3) Essential portions of the system remain functional after a seismic event because of their design to Seismic Category I requirements. Nonessential portions of the system and other systems located close to essential components and not designed to Seismic Category I standards are designed to Seismic Category I(L) standards to prevent their failure from precluding operation of essential system components.

(4) All essential isolation valves and their associated ductwork are located above the maximum flood level in a Seismic Category I building that is designed to resist damage by tornado missiles.

(5) A loss of power causes closure of the isolation dampers by virtue of their fail-safe design (closed when unpowered). Preferred air flows will be maintained by the ABGTS.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-19

WATTS BAR WBNP-99 9.4.3.3.2 Building Cooling System This system serves no safety-related function. The air handling units and their associated piping, valves, ductwork, and dampers are all designed to Seismic Category I(L) requirements to prevent their failure from endangering safety-related equipment.

9.4.3.3.3 Safety Feature Equipment Coolers This system is discussed in Section 9.4.5.3.

9.4.3.3.4 Shutdown Board Room Air-Conditioning System A functional analysis of the shutdown board room air-conditioning system shows that:

(1) During all modes of operation, the system will maintain adequate air temperatures to assure optimum operation of the safety-related equipment it serves. See Section 9.4.3.2.4.

(2) There are redundant pressurizing air supply fans serving each of the two sub-areas to maintain a slightly positive pressure in the shutdown board areas to minimize contaminated inleakage.

The failure modes and effects analyses provided in Table 9.4-9 has shown that:

(1) During all operational modes, substandard cooling or pressurizing air flows are detected by local sensors and a corresponding warning is provided to the main control room.

(2) A failure of one air handling unit initiates the startup and loading of the standby redundant unit.

(3) The failure of one of the two pressurizing air supply fans serving each shutdown board area is detected by local sensors and a signal is provided to activate the standby redundant fan.

(4) The essential components of the system are designed to Seismic Category I standards to assure that they remain functional after a seismic event.

(5) All components of this system are located above the maximum probable flood level and are in a Seismic Category I building that is designed to resist damage by tornado missiles.

(6) Electrical components of this system are powered by one of two trains of emergency electrical power to ensure their operability upon loss of offsite power.

9.4.3.3.5 Auxiliary Board Rooms Air-Conditioning System A functional analysis of the auxiliary board rooms air-conditioning system shows that:

9.4-20 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 (1) During all modes of operation, the system maintains adequate air cooling to assure optimum operation of the safety-related equipment it serves. See Section 9.4.3.2.5.

(2) Two redundant pressurizing air supply fans serve each of the four sub-areas to maintain a slightly positive pressure in the sub-area to minimize contaminated inleakage.

(3) The four battery rooms receive continuous ventilation air supplies to prevent any accumulation of hydrogen gas.

The failure modes and effects analysis in Table 9.4-5 has shown that:

(1) During all operations, substandard cooling or pressurizing air flows are detected by local sensors and a corresponding warning is provided in the main control room.

(2) Failure of the air handling unit serving one of the two sub-areas per plant unit does not prevent the remaining sub-area and its air handling unit from accomplishing all the safety-related functions of the auxiliary board area for that unit. Essential Train A electrical equipment located in the Train B 480V board rooms is spot cooled by the Train A HVAC system, assuring it's operability should the Train B HVAC system fail.

(3) The failure of one of the two pressurizing air supply fans serving each of the four auxiliary board sub-areas is detected by local sensors and a signal is provided to activate the standby redundant fan.

(4) A battery room exhaust fan failure causes automatic activation of the standby exhaust fan and activates an alarm in the MCR. If the air supply to a battery room from the corresponding air handling unit is lost, air is provided by the associated pressurizing air supply fan.

(5) Essential portions of the system are designed to Seismic Category I standards to assure that they remain functional after a seismic event.

Nonessential portions of this system and other systems located close to essential components are designed to Seismic Category I(L) requirements to prevent their failure from precluding operation of essential system components.

(6) All components of this system are located above the maximum probable flood level and are in a Seismic Category I building that is designed to resist damage by tornado missiles.

(7) Upon a loss of offsite power, all essential functions provided by this system are powered by two trains of emergency electrical power.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-21

WATTS BAR WBNP-99 9.4.3.3.6 Shutdown Transformer Room Ventilating System A functional analysis of the shutdown transformer room ventilating system shows that adequate ventilation air flow is provided to the transformer rooms to maintain environmental conditions conducive to optimum transformer operation.

The failure modes and effects analyses in Table 9.4-6 indicate that:

(1) Failure of one or more fans in each room results in room temperature rise which is detected by temperature sensors located in the room. This alerts the operators to activate other available exhaust fans in the same room to replace the damaged unit(s).

(2) Loss of flow through one of the two intake structures serving each transformer room would be no safety concern since the second intake opening also opens (both intake structures open simultaneously).

(3) All required portions of this system are designed to Seismic Category I requirements to assure that they remain functional after a seismic event.

Other components, and systems, located close to this system are qualified to either Seismic Category I or I(L) standards; therefore, their failure can not preclude operation of this system.

(4) All components of this system are located above the maximum probable flood level and are in a Seismic Category I building that is designed to withstand the effects of tornado missiles. Where components are subject to tornado-generated missile damage, operator actions have been defined in the event of damage.

(5) In the event of a loss of offsite power, emergency electrical power is provided to the transformers and their associated exhaust fans. One of the two sub-areas serving each unit is provided with Train A power and the other with Train B power.

9.4.3.3.7 Auxiliary Building Miscellaneous Ventilation and Air-Conditioning System The miscellaneous ventilation and air-conditioning systems do not perform a safety function, however, the system components are designed to seismic category I(L) as necessary for the protection of safety related features.

The main steam valve vault ventilation exhaust airflow is regulated to maintain an adequate temperature environment for the main steam safety valves. During low temperature conditions, the exhaust fans are shutdown and electric heating is provided. The ambient temperature in the valve vault is periodically monitored in accordance with the Technical Requirements Manual area temperature monitoring program.

9.4-22 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 9.4.3.4 Inspection and Testing Requirements Historical Information: The system is tested initially as part of the preoperational test program. See Section 14.2 for testing acceptance criteria.

The Auxiliary Building environmental control systems are in continuous operation and are accessible for periodic inspection. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation.

See Sections 6.2.3.4 and 9.4.5.3.4 for inspection and testing requirements of the ABGTS and the ESF coolers.

Details of the radiation monitors are discussed in Section 11.4.

9.4.4Turbine Building Area Ventilation System 9.4.4.1 Design Bases The turbine building heating, cooling and ventilating systems are designed to maintain an acceptable building environment for the protection of plant equipment and controls; for the comfort and safety of operating personnel; and to allow personnel access for the operation, inspection, maintenance, and testing of mechanical and electrical equipment. The areas served by these systems are not considered potentially radioactive because the reactor is of the pressurized water type which does not normally produce radioactive steam. Potential sources of radioactivity were not, therefore, considered in establishing air flow paths, and the air flows are not monitored for radiation. For additional information on facility design features for radiation protection, refer to Section 12.3.1 The building's environmental control systems are designed to maintain building temperatures between a minimum of 50°F and a maximum of 110°F, by use of forced ventilation, mechanical cooling, and heating systems.

9.4.4.2 System Description The building can be considered to contain four large rooms: El 755.0 turbine room, El 729.0 spaces, El 708.0 spaces, and elevation 685.5 spaces. See Figure 9.4-18.

Because the El 755.0 floor is predominantly concrete and thus isolated from the floors below, the turbine building ventilation is provided by two separate systems. One system serves El 755.0 spaces, and the other system provides ventilation for the spaces on El 729.0 and El 708.0. Because the El 708.0 floor is predominantly grating, air supplied to El 708.0 spaces also provides ventilation for spaces on El 685.5.

Both ventilation systems operate on the basis of mechanically supplying the required flow of outside air to spaces being ventilated, and exhausting the building air to outdoors.

Each supply and exhaust fan is provided with a motor operated damper designed to automatically close when the fan is stopped, in order to prevent air back flow. Outside air is distributed to areas of heat concentration either by duct distribution systems or by AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-23

WATTS BAR WBNP-99 induction using the negative pressure caused by operation of roof exhaust fans, through strategically located air intake openings.

9.4.4.2.1 Elevation 755.0 Ventilation The ventilation system for elevation 755.0 consists of two mechanical air supply systems, one on the north side and the other on the south, free-air-intake openings on the east and west walls, and exhaust fans on the elevation 820.0 roof. Total air exhausted is 570,000 cfm, whereas only 206,000 cfm is mechanically supplied through supply ducts. The remaining 364,000 cfm is drawn through the east and west free-air-intake openings by the negative pressure created by the operation of exhaust fans.

9.4.4.2.2 Elevation 729.0 and Elevation 708.0 Ventilation The elevation 729.0 and elevation 708.0 ventilation system consists of two mechanical air supply systems, one on the north side and the other on the south, and exhaust fans on the elevation 755.0 roof. A total of 412,000 cfm is exhausted, and a total of 412,000 cfm outside air is supplied.

9.4.4.2.3 El. 685.5 Ventilation There is no direct air supply to, or exhaust from, the El. 685.5 areas. However, the El.

708.0 floor above it is predominately grating; therefore, the air supplied to El. 708.0 spaces, and the circulation effected by the space and pump coolers located on El.

685.5, together, provide adequate ventilation for spaces on this floor.

9.4.4.2.4 Cold Weather Building Pressurization During cold weather, all supply and exhaust systems can be isolated by closing the motor operated dampers to conserve heat. However, the two supply fans serving north elevation 708.0 floor may be operated at half speed since two hot water heating coils located in the supply duct connected to each of these fans heat the incoming air. With no exhaust fan running, the operation of these two supply fans will pressurize the entire Turbine Building to prevent infiltration of cold outside air. However the very slight positive pressure within the Turbine Building at the Main Control Room Habitability Zone (MCRHZ) elevation does not challenge the MCRHZ required positive minimum pressure of +1/8 inch water gauge with respect to the outdoors and adjacent areas during both normal or emergency modes of operation.

9.4.4.2.5 Miscellaneous Ventilating Systems The three toilet rooms and three janitor's closets are each ventilated by roof-mounted, roof-ventilator type exhaust fans. Plant air enters each room through a louvered door and is exhausted into the main room.

The lubricating oil purification room at elevation 708.0 is ventilated by a centrifugal fan mounted on the room wall, which discharges to the outdoors by means of a duct routed to a basement exhaust housing. A fire damper, mounted in the exhaust opening, and the room firedoor are designed to shut off all airflow in case of fire.

9.4-24 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 The elevator machinery room at elevation 708.0 is ventilated by a wall-exhauster type fan. The lubricating oil dispensing room at elevation 708.0 is ventilated by a wall-exhauster type fan. A fire damper mounted in the exhaust opening and the room's firedoor are designed to shut off all airflow in case of fire.

9.4.4.2.6 Coolers Fan-coil type raw water cooled cooling units have been installed throughout the Turbine Building to supplement the building ventilation system during peak cooling load conditions. Each cooling unit consists of a centrifugal fan and its motor, and a finned tube type water coil through which raw cooling water is circulated and over which air is passed and cooled.

Space coolers located on different elevations help prevent concentration of heat produced by various plant equipment by recirculating air in their immediate vicinities and so establishing the desired airflow patterns.

Pump coolers located in areas where miscellaneous turbine building pumps dissipate large amounts of heat, are each designed to remove heat produced by its pump to maintain maximum ambient temperature at 110°F.

9.4.4.2.6.1 Space Coolers Space coolers are located on elevation 729.0, elevation 708.0, and elevation 685.5 floors. A thermostat located near the return airflow to each cooler controls a solenoid valve on the raw cooling water supply line to each coil and the cooler fan. The solenoid valve and the fan on each cooler are interlocked to operate together.

9.4.4.2.6.2 Pump Coolers Pumps and the fans of the coolers assigned to them are interlocked to run simultaneously. However, raw cooling water to each cooling coil can be turned off and on manually to conserve water during off time. These coolers are not controlled thermostatically.

9.4.4.2.7 Building Heating System The building heating system serves the Turbine Building and the air preheating coils belonging to the auxiliary building general ventilation system, and the Reactor Building purge air preheating coils.

The heating system is a high-temperature hot water, closed, forced-circulation loop.

The system consists of two 100% capacity water circulating pumps, two 70% capacity steam to water heat exchangers, tanks, heating coils, space and unit heaters, nitrogen pressurization, demineralized water makeup, chemical treatment, controls, and supply and return water distribution piping.

Steam is normally taken from the turbo-generator cold reheat cycle during operation of either unit, or is taken from the plant auxiliary boiler during plant shutdown or when AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-25

WATTS BAR WBNP-99 both units are operating at less than 55% power. The heating system heat exchangers, pumps, and tanks are located at elevation 729.0 along the north end of Unit 2.

The heating system is designed to maintain the Turbine Building at a minimum temperature of 50°F with both units shutdown and a 13°F outdoor temperature. Heat is distributed by thermostatically controlled hot water unit and space heaters strategically located throughout the Turbine Building and by hot water heating coils mounted in the north elevation 708.0 air supply ducts. See Figures 9.4-19 and 9.4-20.

Fresh air may be supplied (136,000 cfm for plant) through the north elevation 708.0 air supply ducts. The hot water heating coils mounted in the ducts heat the incoming air.

The auxiliary building air preheating portion of the heating system consists of a secondary forced-circulation loop system for each plant unit containing two pumps and a 3-way temperature control valve. The valve is thermo-statically controlled to supply outdoor air heated to approximately 60°F.

9.4.4.3 Safety Evaluation The turbine building ventilating and heating systems are designed to assure their reliable operation during normal plant operation and are not safety related. The free air intake dampers, located along the east and west walls of the elevation 755.0 turbine room are designed to close if a power failure occurs. There is no safety related equipment located in their immediate vicinity. Portions of the building heating system piping which supply hot water to the Auxiliary Building Unit 1 and 2 air intake air-preheating coils, are supported to seismic Category I (L) requirements to preclude any adverse effects on nearby safely related equipment.

9.4.4.4 Inspection and Testing Requirements The Turbine Building environmental control systems are in continuous operation and are accessible for periodic inspection.

9.4.5 Engineered Safety Feature Ventilation Systems The function of the engineered safety features ventilation systems is to provide a suitable and controlled environment for engineered safety feature components during normal plant operation, during adverse environmental transients, and following design basis accidents.

9.4.5.1 ERCW Intake Pumping Station (IPS) 9.4.5.1.1 Design Bases The ERCW and the high pressure fire protection (HPFP) pump area at Elevation 741 and the raw cooling water and cooling tower makeup pump area at Elevation 728 are open to the outside environment and are therefore cooled by natural convection. The ERCW and HPFP pump area, the electrical equipment room, and the 100% redundant mechanical equipment rooms are the only areas containing safety-related equipment.

The nature of the ventilation system in the ERCW and HPFP pump area provides 9.4-26 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 assurance that a single active failure cannot result in loss of the ERCW and HPFP system functional performance capabilities.

The mechanical and electrical equipment rooms heating and ventilation systems are not safety-related. Their primary function is to maintain the room temperatures within the maximum and minimum design values during normal plant operation. Operator action is taken to periodically monitor the IPS mechanical and electrical equipment rooms space temperatures to ensure that the maximum and minimum design values are not exceeded.

The ERCW and HPFP pump areas may experience a maximum ambient air temperature of 120°F when the surrounding outside air is 95°F. Since they are exposed to the outside environment the pumps and their associated equipment are designed to withstand low ambient air temperatures, or else they are protected by periodic temperature monitoring and providing supplemental heating as necessary.

Electrical and mechanical equipment rooms are individually ventilated and heated during operation to maintain the room temperatures within the range of 40 to 115°F.

Low temperature is limited by means of thermostatically controlled electric duct heaters and unit heaters, to above 32°F during extreme outside conditions by periodic temperature monitoring and providing supplemental heating, as necessary.

Because the IPS contains no sources of potential radioactivity, there are no safety-related airflow directions that must be maintained and no required radiation monitors.

The IPS is a Seismic Category I structure that is protected from the threats of tornado missiles and floods. A grid-type roof system is utilized to provide both missile protection and allow natural ventilation to the ERCW and HPFP pump area. The roof is composed of a series of horizontal 'I' beams rotated 45° about their longitudinal axes.

The beams are supported by steel members which are in turn supported by concrete walls. The grillage is designed to meet Seismic Category I(L) requirements. The heating and ventilation equipment, ductwork, dampers, supply and exhaust fans, duct heater, and unit heater serving the electrical equipment and the mechanical equipment rooms meet Seismic Category I(L) requirements.

9.4.5.1.2 System Description The IPS heating and ventilating systems for the electrical and mechanical equipment areas are shown in Figure 9.4-21. The pump areas are cooled by natural convection.

The electrical equipment room and mechanical equipment rooms are individually ventilated by separate ventilation systems. Each system is provided with 100%

capacity supply and exhaust fans. The supply fan delivers air through a short vertical duct which encases the duct heater, a motor operated isolation damper, and a discharge grille. Two electric unit heaters are provided in each room. The duct heater and the unit heaters are thermostatically controlled.

Periodic temperature monitoring is necessary to ensure that the equipment room temperatures are maintained within design limits. Equipment room space AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-27

WATTS BAR WBNP-99 temperatures are monitored during all plant conditions. Ventilation fans are shut down during subfreezing outdoor temperatures, and portable electric heaters and power generators are utilized as necessary during potential loss of heating to prevent freezing conditions in the equipment rooms. Non-essential cooling loads are manually shut down as necessary to maintain the space temperatures within design limits if ventilation is not available.

9.4.5.1.3 Safety Evaluation The analysis of the ventilation system shows that:

(1) Adequate flow-through ventilation is provided for the ERCW and HPFP pump area by natural convection during all credible environmental conditions.

Compensatory actions are taken during severe environmental conditions. A structural failure of the grillage roof will not prevent supply of adequate ventilation air to the pump deck (2) Adequate heating and forced air ventilation are provided to each mechanical equipment room and electrical equipment room to maintain acceptable temperatures during normal operation. Compensatory actions are taken during abnormal or accident conditions, as needed. See Section 9.4.5.1.2 and Table 9.4-2.

A failure modes and effects analysis as shown in Table 9.4-2 indicates that the IPS ventilations sysems have the capabilities needed for normal operations, abnormal, and accident conditions. The IPS ventilations sysems are not classified as safety-related.

However, operator actions are taken to peridocially monitor mechanical and electrical room temperatures, and provide supplementary heating, shutdown fans, or shed nonsafety-related heat loads, as necessary, to maintain room temperatures between the minimum and maximum design values. The systems are also desinged to maintain their structural integrity during a seismic event to not damage safety-related equipment in their vicinity.

9.4.5.1.4 Inspection and Testing Requirements The IPS ventilating and heating system is accessible for periodic inspection and testing.

9.4.5.2 Diesel Generator Buildings 9.4.5.2.1 Diesel Generator Building 9.4.5.2.1.1 Design Bases The Diesel Generator Building (DGB) ventilating system is designed to provide adequate ventilation to the DGB spaces to maintain the required environmental conditions for safety-related equipment and prevent hydrogen buildup in the battery area during normal operation and design basis events (DBE) conditions.

9.4-28 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 The diesel units are redundant and are each served by a separate ventilation system consisting of two 50% capacity exhaust fans. Each ventilation system maintains a proper environment for the operation of safety-related components. Each diesel engine room ventilation subsystem consists of two room exhaust fans and one generator and electrical panel cooling fan. Each EBR is ventilated by a separate fan.

Battery area is ventilated by its associated diesel generator room exhaust fans. These are safety-related fans which are designed to provide adequate ventilation to maintain the required ambient temperature limits.

A backdraft damper is installed in the duct between the air intake room 1A-A and the carbon dioxide storage room in order to prevent carbon dioxide backflow into the diesel generator air intake room in the event of a carbon dioxide system rupture.

Each diesel generator unit room and electrical board rooms are separately ventilated in order to limit average room temperatures to a design maximum of 120°F respectively when outdoor air entering the room is 95°F and the diesel generator is in operation. Remaining areas of the DGB are ventilated to maintain maximum air temperatures within design limits. Personnel comfort conditions are maintained as required during low outside temperatures by means of thermostatically controlled electric unit heaters. Battery areas are ventilated by the operation of the diesel generator room exhaust fans. There is not a separate battery area ventilation system.

The diesels are started up and load-tested at least every 31 days. Although the DG room exhaust fans may not auto start and run during DG surveillance testing in the winter months, normal operation of the exhaust fans during surveillance testing of the DGs at the other times of the year in addition to the fans running during the summer months (without concurrent DG operation) will assure that the hydrogen concentration does not reach the Lower Explosion Limit (LEL) of 2% by volume. In addition, the exhaust fans operate whenever their room thermostats call for cooling, as described in Section 9.4.5.2.1.2 The generator for each engine room is supplied with outside air and the electrical control panels within the engine rooms are forced ventilated to assure adequate cooling.

Because the DGB contains no sources of potential radioactivity, there are no safety-related airflow directions that must be maintained and no required radiation monitors.

The DGB is a Seismic Category I structure that is designed to withstand the effects of tornado missiles and flood. The diesel generator room exhaust fans, the generator and electrical panel cooling fans, electrical board room exhaust fans, and all associated ductwork, fittings and dampers are located within the building and are designed to meet Safety Class 2b and Seismic Category I requirements. The portions of these systems, located on the roof of the building, are protected against missile damage by missile shields. These fans, their associated controls, and motor-operated dampers are connected to emergency power. The use of concrete air intake and exhaust hoods provides additional protection from the effects of missiles.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-29

WATTS BAR WBNP-99 9.4.5.2.1.2 System Description One diesel generator room exhaust fan automatically starts upon diesel startup. The second exhaust fan starts when the upper setpoint of a temperature switch mounted in the air exhaust-room is reached or on low flow of the first fan. The generator and electrical panel cooling fan can start along with either exhaust fan. The temperature switches mounted in the air exhaust room monitor the temperature of the air as it leaves the diesel generator room. Each switch may actuate its respective room exhaust fan upon detection of high diesel generator room temperature conditions or may deenergize its respective fan, as necessary, in order to maintain the diesel generator room exhaust temperature between 50°F and 120°F. All three fans automatically stop if the diesel generator room carbon dioxide fire suppression system is activated. Switches for manual operator action are provided to override the carbon dioxide system interlocks and start fans, open dampers to restore ventilation and fulfill the safety function if the carbon dioxide is activated by a failure in the carbon dioxide or fire detection systems.

The toilet room is ventilated by a manually controlled fan. The electrical board rooms, lube oil storage room, and fuel oil transfer room are ventilated by manually controlled fans at all times except when their respective carbon dioxide fire suppression systems are activated. The muffler rooms are ventilated as required to remove heat during warm weather. Muffler room exhaust fans are manually operated from hand switches located on the electrical board that serves the particular fan, or start along with the diesel when in the auto mode.

Fire dampers are provided in each air supply and exhaust opening to the diesel generator room, electrical board room, lube oil storage room, and oil-transfer room.

Motor-operated dampers located at the air intake to each diesel generator room are automatically opened whenever either of the exhaust fans starts. All fans except for the generator and electrical panel cooling fans are equipped with motor operated shutoff dampers which close when their associated fan is not operating. Similarly, all relief vents are provided with motor operated shutoff dampers except the electrical board room intake vents which are provided with fire dampers instead.

The DGB heating and ventilating system is shown on Figures 9.4-22,-23,-24,-24A and 9.4-25. Two diesel generator room exhaust fans, and one electrical board room exhaust fan are located in the air exhaust room at Elevation 760.5 for each of the four diesel generator units. These fans discharge to the outdoors. One generator and electrical panel cooling fan is located within each diesel generator room.

During tornadoes, the essential components of the system remain functinal because the components are located in a Seismic Category I structure that is designed to resist damage by tornado missiles. For tornado depressurization mitigation, intake, and exhaust dampers are opened to assist in pressure equalization.

Fresh air is introduced through each air intake room and drawn to the corresponding diesel generator room. The generator and electrical panel cooling fan draws air from the room intake vicinity for distribution to the generator air intake and to the electrical panel. Following absorption of the heat load in the room the air is drawn into the air 9.4-30 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 exhaust room by the room exhaust fan(s) and is discharged through the air exhaust hood.

Each battery area is ventilated by the operation of its respective diesel generator room exhaust fan during the periodic diesel generator testing as required by the Technical Specifications.

Each of the electrical board rooms is ventilated by a centrifugal exhaust fan . The fan draws outside air into the board room through its associated electrical board room intake vent.

Other building exhaust fans provide individual ventilation for the lubricating oil storage room, fuel oil transfer room, carbon dioxide storage room, toilet room, and muffler rooms.

The thermostatically controlled electric unit heaters located within the diesel generator rooms are designed to maintain the 50°F minimum temperature. Electric unit heaters in the equipment access corridor, storage rooms, radiation shelter rooms, and toilet room are designed to maintain normal temperature within these areas at not less than 40°F.

Thermostats in the diesel generator air exhaust rooms are designed to automatically stop all operating diesel generator room exhaust fans upon a drop in room exhaust air temperature to a low setpoint and to automatically start the exhaust fans upon a room temperature rise to a high setpoint. The thermostats will also start the standby exhaust fan during diesel generator operation, when the room exhaust air temperature exceeds the high setpoint.

9.4.5.2.1.3 Safety Evaluation A functional analysis and a failure modes and effects analysis have shown that the Diesel Generator Building ventilation system has the capabilities needed for normal operations and for accident mitigation. The functional analysis shows that:

(1) Adequate ventilation is provided to maintain the required environmental conditions for optimum equipment operation during all operational modes.

See Section 9.4.5.2.1.1.

(2) The battery area is adequately ventilated (except for system shutdown after a CO2 system actuation signal) to prevent hydrogen buildup in the diesel generator room.

(3) The lack of a dedicated battery hood exhaust fan will not prevent forced air circulation past the batteries. During testing of the diesel generators, the diesel room exhaust fans start automatically in response to diesel start if the temperature at the local temperature switches located in the exhaust fan rooms is greater than the required set point. Concurrent with fan operation, dampers in the diesel room exhaust structure and at the air intake to each diesel generator room also open to facilitate adequate air flow to pass AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-31

WATTS BAR WBNP-99 through the diesel generator room. Although the DG room exhaust fans may not auto start and run during monthly testing in the winter months, normal operation of the exhaust fans during testing of the diesel generators at other times of the year in addition to the fans running during the summer months (without concurrent DG operation) prevents a buildup of hydrogen gas above the Lower Explosion Limit (LEL) of 2% by volume.

(4) Essential portions of this system remain functional during and after a seismic event because of their design to Seismic Category I requiements.

Nonessential portions of this system and other system located close to essential components are designed to Seismic Category I(L) requirements to prevent their failure from precluding operation of essential system components.

The failure modes and effects analysis, as shown in Table 9.4-4, confirms that:

(1) During diesel generator operation, low air flows through the fans serving the diesel generator room and generator and electrical panels is detected by flow sensors. The failure will annunciate in the MCR.

(2) A failure of an electrical board room exhaust fan, and the resulting heat buildup in the room to above 110°F, may cause loss of the associated diesel generator. However, the redundant train diesel generator provides power to safely shut down the unit.

(3) During flooding conditions, all essential components of this system will remain functional because they are located above the maximum possible flood level.

(4) During tornadoes, the essential components of the system remain functional because they are located in a Seismic Category I structure that is designed to resist damage by tornado missiles. For tornado depressurization mitigation, intake, and exhaust dampers are opened to assist in pressure equalization.

(5) Upon loss of offsite power, each diesel generator provides emergency electrical power to its associated ventilation components. All are connected to their respective diesel generator engineered safety power supply, so operation of a diesel generator assures power to the corresponding fans.

9.4.5.2.1.4 Tests and Inspections Historical Information: This system is tested initially as part of the preoperational test program. See section 14.2 for testing acceptance criteria.

The Diesel Generator Building ventilating and heating systems are accessible for periodic inspection. After maintenance or modification activities that affect a system function, testing is performed as necessary to reverify the system or component operation.

9.4-32 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 9.4.5.3 Auxiliary Building Engineered Safety Features (ESF) Equipment Coolers 9.4.5.3.1 Design Bases The Auxiliary Building ESF equipment coolers are designed to maintain acceptable environmental conditions for (1) personnel access, operation, inspection, maintenance and testing and (2) the protection of safety-related mechanical and electrical equipment and controls. The system utilizes fan/coil type safety-related air cooling units. Air cooling units are provided for the following rooms and areas:

(1) Residual heat removal pump room (2) Safety injection pump room (3) Containment spray pump room (4) Centrifugal charging pump room (5) Reciprocating charging pump room*

(6) Unit 1 auxiliary feedwater and component cooling water pumps area (7) Unit 2 auxiliary feedwater and boric acid transfer pumps area (8) Component cooling water booster and spent fuel pool pumps area (9) Emergency gas treatment system filter room (10) Elevation 692.0 penetration rooms (11) Elevation 713.0 penetration rooms (12) Elevation 737.0 penetration rooms (13) Pipe chases

• Not safety-related All air coolers listed above, except the reciprocating charging pump coolers (indicated with an asterisk), are ESF equipment and are provided with coordinated emergency power and ERCW water sources (see Sections 8.3 and 9.2). Pumps 1 through 5 in the above list are each located in a separate room with their corresponding cooler. Safety-related pump rooms are paired with a 100% redundant room containing another pump/cooler set. Pumps and equipment listed in Items 6 through 13 are each provided with two 100% coolers in the room/area. In addition to the above coolers, this system includes two 100% emergency exhaust fans, one safety-related and the other nonsafety-related, in each turbine-driven auxiliary feedwater pump room. Each of these fans is capable of providing the required air flow in the room for the volume changes method of cooling.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-33

WATTS BAR WBNP-99 Rooms and areas containing ESF equipment are ventilated by airflows induced by the building ventilation exhaust subsystem during normal plant operation and when equipment is not required to operate. All air cooling units are thermostatically controlled to automatically operate upon room temperature rise above the setpoint. Air cooling units for pumps 1 through 4 will automatically start to provide the necessary additional cooling in the space whenever their associated pumps are operated. All other coolers for ESF equipment will automatically start on an Auxiliary Building isolation signal. If cooler starts due to ABI signal, it remains on until ABI is reset or hand switch position is changed. If cooler starts due to high temperature, a thermostat, located near the return airflow to each cooler, allows the cooler to remain in operation until the low limit temperature setpoint is reached. The cooling water valve and fan are interlocked to operate together for all coolers, except for the residual heat removal and centrifugal charging pump rooms, whose cooling water valves are electrically disconnected in the open position due to 100 CFR 50 Appendix R considerations.

The ESF equipment ventilation system is designed to maintain temperatures within the range for which the equipment is environmentally qualified, to ensure that equipment and components are not exposed to environmental conditions that could degrade the operability of safety-related equipment.

All components of this system, including air cooling units, fans, ductwork, dampers, valves, and grilles, are designed to meet Seismic Category I and Safety Class 2b requirements. The system is completely enclosed in a Seismic Category I structure that is designed against flood and tornado missile threats.

9.4.5.3.2 System Description The Auxiliary Building ESF coolers are shown on Figures 9.4-10, 9.4-13, 9.4-14, 9.4-16, 9.4-26, and 9.4-27. The individual coolers are listed below:

Number RHR Pump Room 4 Safety Injection Pump Room 4 Containment Spray Pump Room 4 Centrifugal Charging Pump Room 4 Reciprocating Charging Pump Room 2 Unit 1 Auxiliary Feedwater and Component 2 Cooling Water Pumps Unit 2 Auxiliary Feedwater and Boric Acid 2 Treatment Pumps Emergency Gas Treatment Room 2 Component Cooling Water Booster and Spent 2 Fuel Pool Pumps Pipe Chases 4 9.4-34 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 Number Elevation 692.0 Penetration Room 4 Elevation 713.0 Penetration Room 4 Elevation 737.0 Penetration Rooms 4 The turbine-driven auxiliary feedwater pump (TDAFWP) rooms are normally cooled by the Auxiliary Building general ventilation system. For emergency ventilation, two roof ventilator type exhaust fans are located on the roof of each room (See Figure 9.4-13),

venting into the general spaces of the Auxiliary Building. One of the two fans per room operates on 115v, 60 Hz ac emergency power while the other operates on 115V dc station vital battery power. The ac-powered fan is nonsafety-related and the dc-powered fan is safety-related. Both fans in each room are thermostatically controlled to automatically operate upon room temperature rise above setpoint . The dc powered fan also automatically runs upon pump start. Each fan is rated at 1200 cfm and designed to circulate a sufficient quantity of building air through their rooms to limit the maximum temperature rise to approximately 20°F above ambient.

In the event of a steam line break within the room, two isolation valves are provided in the common portion of the steam supply piping to the TDAFWP, to close on high room temperature.

9.4.5.3.3 Safety Evaluation A functional analysis and failure modes and effects analysis have shown that the Auxiliary Building ESF coolers have the capabilities needed for normal operations and for accident mitigation. These are described in the paragraphs that follow.

A functional analysis of the system shows that:

(1) Adequate ventilation is provided during normal operations by the Auxiliary Building general ventilation system. When the applicable equipment is operating, the ESF equipment area and TDAFWP room fans provide adequate temperature control to assure reliable equipment operation.

(2) The containment isolation Phase A signal, high radiation in the spent fuel pool area, a CVI signal when containment and/or the annulus is open to the Auxiliary Building ABSCE spaces, and high air temperature in the Auxiliary Building air intakes provide for a two-train isolation signal for the Auxiliary Building. Isolation of the general ventilation system, described in Section 9.4.3, results in the disruption of normal airflow patterns; and thus, provide for an effectively sealed ABSCE boundary.

(3) After the building is isolated from the environment, airflow patterns and air cleanup operations appropriate for accident mitigation during the accident mode of operation are established and maintained by the ABGTS, as described in Section 6.2.3.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-35

WATTS BAR WBNP-99 The failure modes and effects analysis, as shown in Table 9.4-3, indicates that:

(1) The safety-related radiation monitors in the Auxiliary Building refueling area provide redundant signals, for isolation of the Auxiliary Building.

(2) During normal operation, each ESF space is cooled by the general ventilation system and an ESF cooler. During accident conditions, cooling of the ESF equipment is provided by the ESF coolers. In the event of failure of one ESF area cooler, the redundant cooler is available. In the event of failure of one pump room cooler, the redundant pump and its associated room cooler are also available.

(3) During its emergency mode of operation, the TDAFWP receives cooling from the dc-driven TDAFW pump room fan, the failure of which is not postulated since a single failure in the two 50% capacity motor-driven AFW pumps would have already been postulated.

(4) Failure of any portion of this system as the result of a seismic event is prevented by use of only Seismic Category I components in this system.

(5) During the accident mode of operations, emergency electrical power is provided to the ESF pumps and their corresponding coolers or fans. In the event one emergency power train fails, the essential safety-related functions of the system are accomplished by the redundant parts of the system powered by the remaining power train.

(6) Water is supplied to each cooler from the ERCW system described in Section 9.2.1. Failure of one ERCW supply train, and the resulting failure of the area coolers supplied by that train, will not prevent the redundant coolers, supplied by a different ERCW train from supporting shutdown of the reactor unit. In the case of the loss of ERCW supply to a pump room cooler, the redundant pump is available.

9.4.5.3.4 Inspection and Testing Requirements Historical Information: The system is tested initially as part of the preoperational test program. See Section 14.2 for testing acceptance criteria.

The Auxiliary Building ESFcoolers are designed to be available for continuous operation and are accessible for periodic maintenance. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation.

9.4.6 Reactor Building Purge Ventilating System (RBPVS) 9.4.6.1 Design Bases The RBPVS is designed to maintain the environment in the primary containment and Shield Building annulus within acceptable limits for equipment operation and for personnel access during inspection, testing, maintenance, and refueling operations, 9.4-36 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 and to provide a filtration path for any through-duct outleakage from the primary containment to limit the release of radioactivity to the environment.

The RBPVS performs three distinct functions, the forced air purge function, the continuous pressure relief function, and the alternate containment pressure relief function.

The forced air purge function is performed by a purge supply and purge exhaust system consisting of two trains, each of which is desgined to provide 50% of the capacity needed for normal purging. Each train consists of a supply fan, an exhaust fan, a HEPA filter-charcoal adsorber assembly, containment isolation valves and associated dampers and ductwork. This function provides a means by which containment air may be forcibly exchanged and filtered. The purge function provides a means by which containment air may be forcibly exchanged and filtered. The purge function of the RBPVS is not a safety-related function. However, the filtration units are required to provide a safety-related filtration path following a fuel handling accident until all containment isolation valves are closed. The safety functions are to assure isolation of primary containment during an accident and to isolate the purge air supply intake upon receipt of an Auxiliary Building Isolation (ABI) signal.

During Operating Modes 1 thru 5, continuous pressure relief is provided by a passive ducting system which passes through containment penetration X-80, through two 100% redundant containment vent air cleanup units (CVACU) containing HEPA filters and charcoal adsorbers. Containment air is moved into the annulus by the motive force created by differential pressure between the two spaces. Filtration redudancy allows maintenance on one unit at a time while maintaining an open pathway through the other. This ventilation pathway is isolable using containment isolation valves FCV 40 and FCV-30-37 which are closed during Mode 6 or when containment isolation is required. This system is not required for fuel handling accident mitigation and is not available for that purpose since it is essentially isolated by containment isolation valves during fuel loading or handling activities (Mode 6).

The alternate pressure relief function is provided by way of a configuration alignment in the forced air purge system. This function is accomplished by opening lower compartment purge lines (one supply and one exhaust) or one of the two pairs of lines (one supply and one exhaust) in the upper compartment. During purging mode, the purge air fans may or may not be used. To prevent inadvertent pressurization of containment due to supply and exhaust side ductwork flow imbalances, the supply ductwork airflow may be temporarily throttled as needed.

The purge function of the RBPVS is not a safety-related function. However, the filtration units are required to provide a safety-related filtration path following a fuel-handling accident.

The design bases include provisions to:

(1) Supply fresh air for breathing and contamination control when the primary containment or annulus is occupied.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-37

WATTS BAR WBNP-99 (2) Exhaust primary containment and annulus air to the outdoors whenever the purge air supply system is operated.

(3) Clean up containment exhaust during normal operation by routing the air through HEPA-carbon filter trains before release to the atmosphere to limit potential release of radioactivity to the environment.

(4) Provide a reduced quantity of ventilating air to permit occupancy of the instrument room during reactor operation. The provisions for 1, 2, and 3 above will apply.

(5) Assure closure of primary and secondary containment isolation valves following accidents which result in the initiation of a containment ventilation isolation signal.

(6) Assure closure of the system air intake dampers, which form part of the ABSCE (see Section 6.2.3.2.1), upon receipt of a signal for Auxiliary Building isolation.

(7) Provide continuous containment pressure relief path through HEPA-carbon filter trains before release to the atmosphere during normal operations.

Items 5 and 6 above are safety-related functions.

The primary containment penetrations for the ventilation supply and exhaust subsystems are designed to primary containment structural standards. These are discussed in detail in Section 6.2.4.

The RBPVS is sized to maintain an acceptable working environment within the containment during all normal operations. The system has the capabilities to provide a filtration path for outleakage from the primary containment, and clean up containment atmosphere following a design basis accident. It also has provisions to filter air flow exhausted from containment for pressure control, during normal operation.

The controls are designed to have simultaneous starting and stopping of the matching supply and exhaust equipment and to initiate an automatic shutdown and isolation upon receipt of the containment ventilation isolation signal.

In addition, RBPVS supply fans will shut down and the ABSCE isolation dampers in purge air supply ducts will close on an ABI signal.

The RBPVS air cleanup equipment assures that activity released inside containment from a refueling accident and prior to containment isolation, is processed through both HEPA filters and carbon adsorbers before release to the atmosphere. Fuel handling operations inside the primary containment are constrained by the operability requirement for the RBPVS air cleanup units contained in the plant technical specifications.

9.4-38 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 The RBPVS components are designed or qualified to meet Seismic Category I requirements, except all purge ductwork within the containment, up to the inboard isolation valves, and the supply air ductwork from the downstream flange of the ABSCE isolation dampers to the upstream flange of the Shield Building isolation valves, which are designed to meet Seismic Category I(L) requirements.

The primary containment exhaust is monitored by redundant radiation detectors which provide automatic RBPVS isolation upon detecting the setpoint radioactivity in the exhaust air stream. The RBPVS isolation valves automatically close upon the actuation of a containment ventilation isolation signal or upon manual actuation from the MCR. In addition, during fuel handling operations in the Auxiliary Building with containment and/or the annulus open to the Auxiliary Building ABSCE spaces, the RBPVS isolation valves will close upon a high radiation signal from the spent fuel pool radiation monitors via a CVI signal.

The system air supply and exhaust ducts are routed through the Shield Building annulus to several primary containment penetrations. Two air supply locations are provided for each of the upper and lower compartments and one for the instrument room. Air is supplied to areas of low potential radioactivity and is allowed to flow to the air pickup exhaust points in areas of higher potential radioactivity. The air pickup points, located to exhaust air from the lower compartment and instrument room, also provide an air sweep across the surface of the refueling canal.

During cold shutdown and refueling operations, the entire containment may be purged using any number and size of purge supply and exhaust lines.

During reactor operation, the number and size of lines used for containment purging, are restricted to two 24-inch diameter lines (i.e., one supply line with 50°-open valves, and one exhaust line with 50°-open valves), or two 24-inch diameter lines with wide-open valves (i.e., one supply line and one exhaust line).

9.4.6.2 System Description The RBPVS is shown schematically in Figures 9.4-28 to 9.4-30. One complete and independent RBPVS is provided for each unit.

The containment upper and/or lower compartments are purged with fresh air by the RBPVS before occupancy. The annulus can be purged with fresh air during reactor shutdown or at times when the annulus vacuum control system of the EGTS is shut down. The instrument room is purged with fresh air during operation of the RBPVS or is separately purged by the instrument room purge subsystem.

The containment is vented into the annulus, during normal operation, continuously, through the containment vent air cleanup units (CVACUs), which contain HEPA and charcoal filters, to maintain the containment pressure within the Technical Specification limits. Exhaust air mixes with the annulus atmosphere before it is discharged into the Auxiliary Building exhaust stack by the annulus vacuum control fan(s) (See Section 6.3.2.2).

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-39

WATTS BAR WBNP-99 RBPVS for each unit consists of two trains, each designed to provide 50% of the capacity required for normal operation. Each train contains an air supply fan, an air exhaust fan, a cleanup filter unit, containment isolation valves, system air flow control valves, and all necessary ductwork. The system also includes single air supply distribution and air exhaust collection subsystems as well as an instrument room supply fan and an instrument room exhaust fan.

The RBPVS supply fans are located in the penetration rooms at elevation 737.0 in the Auxiliary Building. Filtered fresh air, heated when required, is taken from the Auxiliary Building air supply systems located in the mechanical equipment rooms at elevation 737.0. These fans are of centrifugal type and belt-driven, with adequate system air flow rate (See Figure 9.4-28).

The filtered air is discharged to the outdoors by means of the Shield Building exhaust vent located in the annular space of the Reactor Building and extending through the roof of the Reactor Building. The purge air exhaust fans are centrifugal type and belt-driven, with a combined flow of 22,949 ft3/min. The air cleanup units are described in Section 6.5.1.

Annulus purging air is taken from system ducts and routed through the annulus. The air supply and exhaust duct openings are located approximately 180° apart for maximum ventilation.

To permit personnel access to the instrument room during reactor operation or during RBPVS shutdown, the room can be purged by the instrument room purge subsystem fans. These supply and exhaust fans are located alongside the main system supply and exhaust fans and use the main system ducts and one of the filter trains. Butterfly valves are positioned to allow only the instrument room to be served.

Each RBPVS containment penetration is provided with both inboard and outboard air-operated isolation butterfly valves designed for minimum leakage in their closed position. A similar type of valve is mounted in each purge supply and exhaust air opening for the annulus, and in each of the main supply and exhaust ducts located exterior to the Shield Building. The purge air supply line is provided with two air-operated isolation dampers in series for ABSCE isolation. Each of the above butterfly valves and the intake dampers are designed to fail closed and are normally closed during purge system shutdown. See Section 6.2.4 for more on the containment isolation system.

The single air supply duct serving the two purge air supply fans and the instrument room supply fan is provided with two isolation dampers. These dampers are air operated, normally closed, failed closed dampers which close automatically on receipt of Auxiliary Building isolation or high radiation in refueling area signals. These dampers establish the boundary for the ABSCE. See Section 6.2.3.

Since the annulus is maintained at a 5-inch water gauge negative pressure by the annulus vacuum control system, the annulus portion of the purge system ducts is maintained at the negative pressure by four 1/2-inch leakoffs. This arrangement is 9.4-40 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 designed to prevent containment contamination leakage from escaping through the purge system ducts into the Auxiliary Building.

The purge function of the RBPVS is not a safety-related function. However, the filtration units are required to provide a safety-related filtration path following a fuel-handling accident. The primary containment isolation valves and intermediate piping of the RBPVS are designed in accordance with ANS safety class 2A; other portions are designated ANS safety class 2B except the purge fans, all purge ductwork within the containment, purge supply air ductwork from the ABSCE boundary, fire protection, and drain piping. The instrument room purge subsystem is not an engineered safety feature, and credit for its operability for a LOCA or a fuel-handling accident is not claimed.

A containment ventilation isolation signal automatically shuts down the fans and isolates the RBPVS by closing its respective dampers and butterfly valves. Each RBPVS primary containment isolation valve is designed for fail safe closing within 4 seconds of receipt of a closure signal for containment penetrations (See Tables 6.2.4-1 through 6.2.4-4 and Figure 6.2.4-21). The RBPVS primary containment isolation valve locations and descriptions are given in Table 6.2.4-1. Each valve is provided with an air cylinder valve operator, control air solenoid valve, and valve position indicating limit switches.

Smoke detectors, located in the Auxiliary Building air intake and the general ventilation supply ducts, shut down the purge air supply and the incore instrument room purge supply fans and their isolation dampers.

9.4.6.3 Safety Evaluation Functional analyses and failure modes and effects analysis have shown that the RBPVS meets the containment isolation requirements. The purge air filtration units and associated exhaust ductwork provide a safety-related filtration path following a fuel-handling accident. The CVACUs, performing a continuously filtered containment vent function during normal operation, are isolated by the closure of their containment isolation valves; therefore are not operable after accidents. In addition, the containment ventilation system is not allowed to be used during Mode 6.

A functional analysis of the system shows that:

(1) During normal operation, adequate fresh air is provided for breathing and for contamination control when the primary or secondary containment (annulus) is occupied.

(2) Primary and secondary containment exhaust air is cleaned up during normal operations and following a fuel handling accident.

(3) Purge supply and exhaust fan operations cease and isolation dampers in the intake and exhaust ducting close when the system is in the accident mode of operation.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-41

WATTS BAR WBNP-99 (4) Three signals cause the system to change from the normal purge mode to the accident isolation mode. These signals, which include manual, SIS auto-initiate, and high purge exhaust radiation (automatic), initiate a containment ventilation isolation signal. Additionally, during refueling operations whenever containment and/or the annulus is open to the Auxiliary Building ABSCE spaces, a high radiation signal from the spent fuel pool accident radiation monitors automatically cause the system to change from the purge mode to the accident isolation mode.

(5) Discharges from the annulus, during normal operation, which are exhausted through the Auxiliary Building exhaust stack, are monitored at the stack.

Although these radiation monitors do not initiate an automatic containment isolation signal, radioactive release limits have been established as a basis for controlling plant discharge during operation. Radioactive releases from the plant resulting from equipment faults of moderate frequency are within 10 CFR 50 Appendix I and 40 CFR 190 limits as specified in the ODCM (See Section 11.3 for further details). In addition, analyses have shown that any accident with the potential consequence to exceed the 10 CFR 100 limits, would be detected by other indicators (see item 4 above) and cause an automatic primary and/or secondary containment isolation.

Containment vent system is not allowed to be used during Mode 6.

The failure modes and effects analyses show that:

(1) Two filtration exhaust paths are provided to assure that particulate releases are within 10 CFR 100 guidelines following a fuel-handling accident and prior to closure of the associated isolation valves.

(2) Each purge supply and exhaust line is equipped with two primary containment isolation valves, each connected to different control and power trains. Failure of one train does not prevent the remaining isolation valve from providing the required isolation capability.

(3) Essential portions of the system remain functional after a seismic event because of their design to Seismic Category I requirements. Nonessential portions of the system and other systems located close to essential components and not designed to Seismic Category I standards are designed to meet Seismic Category I(L) requirements to prevent their failure from precluding operation of essential safety-related equipment.

(4) All essential equipment is located above the maximum possible flood level in a Seismic Category I building that is designed to resist tornado missiles.

(5) A loss of offsite power causes closure of the isolation valves.

9.4-42 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 (6) ABGTS safety-related functions are not impeded by the worst-case failure in the RBPVS; i.e., one train of ABI signal failing, thus resulting in only one ABGTS train starting, one RBPVS supply fan and the Incore Instrument Room supply fan continuing to run, all the ABSCE isolation dampers of the same train remaining open, and all RBPVS exhaust fans shutting down.

9.4.6.4 Inspection and Testing Requirements Before power operation, tests are conducted to assure that the RBPVS performs as designed. The system is tested initially as part of the preoperational test program.

After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation. Purge system containment penetration isolation valves are tested for inplace closing speed and leak tested in the closed position to comply with the requirements of 10 CFR 50, Appendix J. The inspection and testing of these valves is discussed in Section 6.2.4.

Details of the testing program for the air-cleanup units are included in Section 6.5.

9.4.7 Containment Air Cooling System 9.4.7.1 Design Bases The containment air cooling systems are designed to maintain acceptable temperatures within the reactor building upper and lower compartments, reactor well, control rod drive mechanism (CRDM) shroud, and instrument room for the protection of equipment and controls during normal reactor operation and normal shutdown. The instrument room is mechanically cooled to permit personnel access during normal reactor operation.

The lower compartment cooling (LLC) air system, together with operation of the CRDM air cooling system, is designed to maintain a maximum weighted average air temperature of 120°F in most lower compartment spaces during normal reactor operation. These spaces include the steam generator and pressurizer compartments, the space below the reactor vessel, the space around the reactor vessel, the spaces around the reactor vessel nozzles and supports and the upper reactor cavity well space around the CRDM shroud. For Unit 2, four 33-1/3% capacity and for Unit 1, three 33-1/3% and one 29.2% LCC fan coil assemblies are provided to allow three or less to operate during reactor normal operation with one or more on standby.

The LCC air system manual dampers are adjusted to provide sufficient air flow through the reactor well to maintain an approximate air temperature of 120°F. The system is designed for two of four units to recirculate air through the lower containment and equipment compartments, although all four may be operated, anytime there is a loss of normal containment cooling following any non-LOCA design basis event, which results in a hot standby condition. The LCC system is not required to operate after a LOCA. See Section 6.2.2.1 for detailed information and operation after a MSLB.

The CRDM air cooling system is designed to operate during normal reactor operation in conjunction with the LCC air system to maintain a maximum air temperature within the upper reactor cavity of 120°F and to route all of the reactor well air through the AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-43

WATTS BAR WBNP-99 CRDM shroud to maintain a maximum air temperature of 185°F. Air drawn through the CRDM shroud is cooled by the active fan-coil assemblies to approximately 120°F and discharged into the lower compartment of the Reactor Building.

When additional cooling in the lower compartment is required, an arrangement of dampers allows either or both standby CRDM fan-coil assemblies to be operated to recirculate and supplement the LCC system capacity.

The upper compartment cooling (UCC) air system is designed to maintain the upper compartment weighted average temperature at a maximum of 110°F during normal reactor operation.

The Reactor Building instrument room air cooling system is designed to automatically maintain the room air temperature between 50°F and 120°F during normal reactor operation.

The heat sink for each LCC, UCC, and CRDM air cooling fan-coil assembly, and for each instrument room air cooling system condensing unit, is the ERCW.

The LCC units and CRDM air fan-coil assemblies are manually energized from the emergency power system upon loss of offsite power; however, these components are not required to operate during LOCA conditions. The LCC units may be operated continuously throughout all accidents, except a MSLB, which does not initiate a Phase B containment isolation signal. Following a MSLB, two of the four LCC unit fans are required, but all four are started manually, within 1.5 to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the detection of the MSLB accident to recirculate air in the lower compartment dead-ended spaces.

This is a safety function of the LCC units' fans.

9.4.7.2 System Description The containment air cooling system flow scheme is shown in Figure 9.4-28. The system's control scheme is shown in Figures 9.4-30 and 9.4-31 and the logic scheme in Figures 9.4-29 and 9.4-32 through 9.4-34. The containment air cooling system is composed of four subsystems as follows:

(1) Lower Compartment Air Cooling (2) CRDM Air Cooling (3) Upper Compartment Air Cooling (4) Reactor Building Instrument Room Air Cooling 9.4.7.2.1 Lower Compartment Air Cooling System There are four LCC air fan-coil assemblies which are located in two annular concrete chambers around the periphery of the lower compartment at floor Elevation 716. Each fan-coil assembly consists of a plenum, eight air cooling coils, vaneaxial fan, backdraft damper, instruments, and controls. For Unit 1 only, LCC 1D-B has a reduced cooling 9.4-44 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 capacity of approximately 12.5% due to isolation of ERCW to one of its eight cooling coils.

These fan-coil assemblies are supplied water from the plant ERCW system. A cooling water throttling valve for each assembly is automatically controlled by a temperature indicating controller which utilizes an input from a thermocouple mounted in the assembly's return air supply and set to control the cooler outlet temperature as required to maintain the required weighted average temperature. The ERCW system is described in Section 9.2.1.

Lower compartment air passes directly to each active fan-coil assembly where it is cooled and supplied through a common duct distribution system to the lower compartment spaces. The system is designed for three of the four fan-coil assemblies to operate together, with one on standby. The cooled air is supplied directly to each steam-generator compartment, pressurizer compartment, letdown heat exchanger room, main lower compartment space, and to the space below the reactor vessel.

Connections are available in the A-Train ERCW supply and return headers for the lower compartment coolers that will allow chilled water from a non-safety related chiller to be used to provide additional cooling of the Unit 1 Reactor Building during outages.

9.4.7.2.2 Control Rod Drive Mechanisms Air Cooling System The four CRDM air cooling fan-coil assemblies are located in the main lower compartment space at floor elevation 702.78. Each assembly consists of a plenum, three air cooling coils, two vaneaxial fans, in series, assembly isolating motor-operated damper, instruments, and controls. Each fan-coil assembly is designed to cool the CRDM shroud to 185°F with water from the plant ERCW system. A cooling water throttling valve for each assembly is automatically controlled by a temperature indicating controller which utilizes an input from a thermocouple mounted on the intake side of the CRDM cooling unit .

The four CRDM air cooling fan-coil assemblies are divided into two pairs. One fan-coil assembly in each pair is normally operated to provide adequate cooling to the CRDM shroud during normal reactor operation. Reactor well air exiting the shroud is cooled by the fan-coil assemblies and discharged into the lower compartment spaces.

9.4.7.2.3 Upper Compartment Air Cooling System The four UCC air fan-coil assemblies are located within the upper compartment at Elevation 801.69. Fan-coil assemblies consist of plenums, air cooling coils, vaneaxial fans, instruments, and controls. They are designed to maintain the upper compartment weighted average temperature at a maximum of 110°F with water from the plant ERCW system. A cooling water throttling valve for each assembly is automatically controlled by a temperature indicating controller which utilizes an input from a thermocouple mounted in the return air supply.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-45

WATTS BAR WBNP-99 A portion of the upper containment air is continuously recirculated and cooled by the UCC fan-coil assemblies. The system is designed for three of the four assemblies to operate together with one on standby.

9.4.7.2.4 Reactor Building Instrument Room Air Cooling System The instrument room air cooling system consists of two 100% capacity air conditioning systems. Each system consists of a serviceable, packaged water chilling unit and chilled water pump located in the Auxiliary Building penetration room at Elevation 692, a fan-coil unit with air supply duct located in the Reactor Building instrument room, connecting chilled water piping with double containment penetration isolation valves, and all necessary and customary control and indicating devices. Chiller condensers are cooled by ERCW.

The chilled water piping penetrations through the primary containment vessel (See Tables 6.2.4-1, 6.2.4-2 and Figure 6.2.4-17D) are each provided with two isolation valves, one located inside and one located outside containment for each penetration.

These 2-inch valves are pneumatic-motor operated and are designed to fail closed.

9.4.7.2.5 Controls and Instrumentation Operation of each fan-coil unit (LCC, UCC, CRDM, and instrument room) is indicated in the MCR. The UCC system standby unit automatically starts when pressure differential to two of the four coolers is below the setpoint, or upon compartment high temperature signal. The LCC system standby unit automatically starts when airflow is below the setpoint in two of the four fans. A CRDM cooling system standby unit automatically starts on low air flow in an operating unit. The instrument room standby cooler automatically starts when airflow is below the setpoint in the operating cooler.

The LCC, UCC, and CRDM coolers are administratively controlled to prevent automatic starting of the standby unit during normal operation, Air temperature is continuously monitored to evaluate system performance for each of the four cooling systems. Class 1E temperature elements are mounted near the intake side air stream of each LCC with direct read-out in the MCR. Containment pressure is used by the operators as input for manual initiation of the air return fans and the containment spray system to maintain lower compartment temperature within limits during events in which the ERCW supplied coils are inoperable.

9.4.7.3 Safety Evaluation The LCC fans are started (only two are required) to recirculate air through the lower containment and equipment compartments anytime there is a loss of LCC following any non-LOCA design basis event resulting in the reactor in a hot standby condition.

After a MSLB, all four LCCs are started (only two are required) within 1.5 to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the MSLB, to recirculate air throughout the lower compartment spaces to prevent hot spots from developing. This is a safety function. Otherwise, the containment air cooling systems are not required for maintenance of temperature limits within the primary containment in the event of an accident, and therefore, are not engineered safety features. However, the reactor containment penetration valves for the 9.4-46 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR WBNP-99 instrument room air-conditioning chilled water system have a Nuclear Safety Class designation in accordance with ANS Safety Class 2A.

The capability of assuring containment ambient temperature levels and the anticipated degradation of equipment performance if temperature levels are exceeded are discussed in Section 3.11.

To prevent damage to adjacent safety related equipment necessary for the plant safe shutdown, UCC and CRDM air cooling assemblies, instrument room fan-coil units, water cooled condenser portions of the instrument room water chillers, ductwork and duct supports, and chilled water piping and pipe supports are designed and installed to Seismic Category I(L) requirements, and the LCC units (excluding cooling coils),

fans, ductwork, and duct supports are designed to Seismic Category I requirements.

9.4.7.4 Test and Inspection Requirements Historical Information: Air-cooling assemblies and their temperature-controlling devices which are located within the containment are tested prior to reactor operation and are generally accessible for inspection only during unit shutdown. The system is tested initially as part of the preoperational test program.

After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operations. Instrument room fan-coil units, control devices, and containment-isolation chilled-water valves are accessible for periodic inspection. Water-chilling equipment, pumps, and all essential electrical starting and switchover controls located in the Auxiliary Building are available for periodic inspection.

Instrument room chilled-water containment-isolation valve testing and inspection requirements are discussed in Section 6.2.4.

9.4.8 Condensate Demineralizer Waste Evaporator Building Environmental Control System The Condensate Demineralizer Waste Evaporator (CDWE) Building Environmental Control System is a separate nonsafety air conditioning system which is not required for Unit 2 operation.

The CDWE Building is inside the ABSCE boundary; therefore, it is connected to the AB ventilation exhaust system. The ventilation exhaust system provides a negative pressure inside CDWE Building.

9.4.9 Postaccident Sampling Facility (PASF) Environmental Control System (Unit 1 Only)

Unit 2 equipment has been abandoned in place.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-47

WATTS BAR WBNP-99 Table 9.4-1 Deleted 9.4-48 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-2 FAILURE MODES AND EFFECTS ANALYSIS INTAKE PUMPING STATION VENTILATION SYSTEM (Page 1 of 7)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS WINTER 1 All components of Provide Total loss of Electrical Surveillance Total loss of None. See 1) Room the Intake Pumping heating during heating failure (Loss the heating Remarks. temperature is Station Ventilation the winter. of power) system verified once a shift.

System Electrical resulting in Equipment Room room 2) Supplemental and Mechanical temperatures heating is provided Equipment Rooms lower than if necessary to A or B. design value. maintain the space temperatures above 32°F.

9.4-49 WBNP-99

Table 9.4-2 FAILURE MODES AND EFFECTS ANALYSIS INTAKE PUMPING STATION VENTILATION SYSTEM (Continued) 9.4-50 WATTS BAR (Page 2 of 7)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS SUMMER 2 All components of Provide Loss of all Electrical Surveillance Room None. See 1) Room the Intake Pumping ventilation Supply and and/or temperatures Remarks temperature is Station Ventilation cooling during Exhaust Fans mechanical higher than verified once a shift.

System; Electrical the Summer concurrent with failure design value.

Equipment Room operation of a 2) If the room or Mechanical Unit Heater temperatures are Equipment Room A 0-HTR-30-715 above 104°F, AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS or B or -716 in the Operator ensures Electrical that the duct heaters Equipment and unit heaters are Room "OFF" and that the supply and exhaust fans are operational.

If the fans are non-operable, non-essential loads are shed if necessary to maintain the room temperatures at less than 130°F.

WBNP-99

Table 9.4-2 FAILURE MODES AND EFFECTS ANALYSIS INTAKE PUMPING STATION VENTILATION SYSTEM (Continued)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Page 3 of 7)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS SUMMER 3 All components of Provide Operation of Electrical Surveillance Additional heat None. See 1) Room the Intake Pumping ventilation Supply and and/or added to the Remarks temperature is Station Ventilation cooling during Exhaust Fans, mechanical space. Room verified once a shift.

System; Electrical the Summer 0-FAN-30-714A failure temperature Equipment Room & -714B, will be higher 2) If the room or Mechanical concurrent with than design temperatures are Equipment Room A operation of value. above 104°F, or B Duct Heater 0- Operator ensures HTR-30-714 in that the duct heaters the Electrical and unit heaters are Equipment "OFF" and that the Room. Total supply and exhaust loss of fans are operational.

ventilation in the Mechanical Equipment Rooms.

9.4-51 WBNP-99

Table 9.4-2 FAILURE MODES AND EFFECTS ANALYSIS INTAKE PUMPING STATION VENTILATION SYSTEM (Continued) 9.4-52 WATTS BAR (Page 4 of 7)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS SUMMER 4 All components of Provide Loss of all Electrical Surveillance Room None. See 1) Room temperature the intake ventilation Supply and and/or temperatures Remarks is verified once a Pumping Station cooling during Exhaust Fans mechanical higher than shift.

Ventilation the Summer concurrent with failure design value.

System; Electrical operation of a 2) If the room Equipment Room, Unit Heater temperatures are or Mechanical 0-HTR-30-710 above 104°F, AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS Equipment Room or -711 in Operator ensures A or B Mechanical that the duct heaters Equipment and unit heaters are Room A "OFF" and that the supply and exhaust fans are operational.

If the fans are non-operable, non-essential loads are shed if necessary to maintain the room temperatures at less than 130°F.

WBNP-99

Table 9.4-2 FAILURE MODES AND EFFECTS ANALYSIS INTAKE PUMPING STATION VENTILATION SYSTEM (Continued)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Page 5 of 7)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS SUMMER 5 All components of Provide Operation of Electrical Surveillance Additional heat None. See 1) Room temperature the Intake ventilation Supply and and/or added to the Remarks is verified once a Pumping Station cooling during Exhaust Fans, mechanical space. Room shift.

Ventilation the Summer 0-FAN-30-708A failure temperature System; Electrical & -708B, will be higher 2) If the room Equipment Room concurrent with than design temperatures are or Mechanical operation of value. above 104°F, Equipment Room Duct Heater 0- Operator ensures A or B HTR-30-708 in that the duct heaters Mechanical and unit heaters are Equipment "OFF" and that the Room A. Total supply and exhaust loss of fans are operational.

ventilation in the Electrical Equipment Room and Mechanical Equipment Room B.

9.4-53 WBNP-99

Table 9.4-2 FAILURE MODES AND EFFECTS ANALYSIS INTAKE PUMPING STATION VENTILATION SYSTEM (Continued) 9.4-54 WATTS BAR (Page 6 of 7)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS SUMMER 6 All components of Provide Loss of all Electrical Surveillance Room None. See 1) Room the intake ventilation Supply and and/or temperatures Remarks temperature is Pumping Station cooling during Exhaust Fans mechanical higher than verified once a shift.

Ventilation the Summer concurrent with failure design value.

System: Electrical operation of a 2) If the room Equipment Room, Unit Heater temperatures are or Mechanical 0-HTR-30-712 above 104°F, AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS Equipment Room or -713 in Operator ensures A or B Mechanical that the duct heaters Equipment and unit heaters are Room B "OFF" and that the supply and exhaust fans are operational.

If the fans are non-operable, non-essential loads are shed if necessary to maintain the room temperatures at less than 130°F.

WBNP-99

Table 9.4-2 FAILURE MODES AND EFFECTS ANALYSIS INTAKE PUMPING STATION VENTILATION SYSTEM (Continued)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Page 7 of 7)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS SUMMER 7 All components of Provide Operation of Electrical Surveillance Additional heat None. See 1) Room the Intake ventilation Supply and and/or added to the Remarks temperature is Pumping Station cooling during Exhaust Fans, mechanical space. Room verified once a shift.

Ventilation the Summer N0-FAN failure temperature System; Electrical 709A & -709B, will be higher 2) If the room Equipment Room concurrent with than design temperatures are or Mechanical operation of value. above 104°F, Equipment Room Duct Heater 0- Operator ensures A or B HTR-30-709 in that the duct heaters Mechanical and unit heaters are Equipment "OFF" and that the Room B. Total supply and exhaust loss of fans are operational.

ventilation in the Electrical Equipment Room and Mechanical Equipment Room A.

9.4-55 WBNP-99

WATTS BAR WBNP-99 THIS PAGE INTENTIONALLY BLANK 9.4-56 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 1 of 21)

Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1 2-PMCL-30-180-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. Train B SI 1. Train A and Train B pump/cooler air to SI Pump while running; Train A power MCR for 2-FCV SIP 2A-A room with Pump is not affected sets are in separate rooms. Review of Safety Injection 2A-A Room Spuriously stops. failure; auto-start 176-A fully open (2- the potential for loss by the failure of Train schematics for the Train A and B Pump 2A-A Cooler signal failure; ZS-67-176). Fan of SIP 2A-A. A pump room cooler, coolers shows the trains to be (Train A) Operator error motor running light on and is 100% independent. The cooler automatically (handswitch placed MCC. redundant to Train A starts upon high temperature on 2-TS-in wrong position) pump. 30-180-A or SI Pump 2A-A start; and, manually by local handswitch 21-HS-See Remark # 3.30-180.

2. The Cooler Fan and the flow control valve 2-FCV-67-176-A are interlocked to operate together.

3. Train B equipment is located in SIP Room 2B. Failure of the Train A equipment, will not adversely impact Train B SI pump operation.

9.4-57 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 2 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 2 2-PMCL-30-179-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. Train A SI 1. Train A and Train B pump/cooler air to SI Pump while running; Train B power MCR for 2-FCV SIP 2B-B room with Pump is not affected sets are in separate rooms. Review of Safety Injection 2B-B Room Spuriously stops. failure; auto-start 182 fully open (2-ZS- the potential for loss by the failure of Train schematics for the Train A and B Pump 2B-B Cooler signal failure;67-182). Fan motor of SIP 2B-B. B pump room cooler, coolers shows the trains to be (Train B) Operator error running light on MCC. and is 100% independent. The cooler automatically (handswitch placed redundant to Train B starts upon high temperature on 2-TS-in wrong position) pump. 30-179-B or SI Pump 2B-B start; and, manually by local handswitch 2-HS See Remark # 3. 179.

2. The Cooler Fan and the flow control valve 2-FCV-67-182 are interlocked to operate together.

3. Train A equipment is located in SIP Room 2A. Failure of the Train B equipment will not adversely impact Train A SI pump operation.

9.4-58 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 3 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 3 2-FCV-67-176-A Provides Fails to open, Mechanical failure; Status monitor light in Loss of cooling water None. Train B SI 2-FCV-67-176-A flowpath for stuck closed Opening signal MCR (2-ZS-67-176) to SIP 2A-A pump Pump is not affected FCV fails open on loss of power or air.

Essential Raw cooling water failure room cooler with the by the failure of Train Cooling Water Flow from the ERCW potential for loss of A pump room cooler, Control Valve for Header 2A to the SIP 2A-A. and is 100%

the Safety Injection cooler for Pump redundant to Train A System Pump 2A-A 2A-A pump.

Cooler.

4 2-FCV-67-182-B Provides Fails to open, Mechanical failure; Status monitor light in Loss of cooling water None. Train A SI 2-FCV-67-182-B flowpath for stuck closed Opening signal MCR (2-ZS-67-182) to SIP 2B-B pump Pump is not affected FCV fails open on loss of power or air.

Essential Raw cooling water failure room cooler with the by the failure of Train Cooling Water Flow from the ERCW potential for loss of B pump room cooler, Control Valve for Header 2B to the SIP 2B-B. and is 100%

the Safety Injection cooler for Pump redundant to Train B System Pump 2B-B 2B-B pump.

Cooler.

5 2-PMCL-30-175-A Provides cooling Fails to start, fails Mechanical failure; Fan motor running Loss of cooling water None. Train A and Train B RHR pump/cooler air to RHR Pump while running; Train A Power light on MCC. to RHR Pump 2A-A Train B RHR Pump is sets are in separate rooms. Review of Residual Heat 2A-A Room. Spuriously stops. failure; Auto-start Room cooler with the not affected by the the schematics for the Train A and Removal Pump 2A- signal failure; Status monitor light in potential loss of RHR failure of Train A Train B coolers shows the trains to be A Cooler (Train A). Operator error MCR for 2-FCV Pump 2A-A. Pump Room Cooler independent. The cooler is started (handswitch placed 188 (2-ZS-67-188) and is 100% automatically upon high temperature at in wrong position). redundant to Train A 2-TS-30-175-A, or RHR Pump 2A-A Pump. start; Manually by local handswitch 2-HS-30-175.

9.4-59 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 4 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 6 2-PMCL-30-176-B Provides cooling Fails to start, fails Mechanical failure; Fan motor running Loss of cooling to None. Train A RHR Train A and Train B RHR pump/cooler air to RHR Pump while running; Train B power light on MCC. RHR Pump 2B-B Pump is not affected sets are in separate rooms. Review of Residual Heat 2B-B Room Spuriously stops. failure; auto-start Room with the by the failure of Train the schematics for the Train A and Removal Pump signal failure; Status monitor light in potential loss of RHR B Pump Room Train B coolers shows the trains to be 2B-B Cooler (Train Operator error MCR for 2-FCV 2B-B. Cooler, and is 100% independent. The cooler started B) (handswitch placed 190 (2-ZS-67-190) redundant to Train B automatically upon high temperature at in wrong position) pump. 2-TS-30-176-B or RHR Pump 2B-B start; Manually by local handswitch 2-HS-30-176.

7 2-FCV-67-188-A Provides See 'remarks' See 'remarks' See 'remarks' column. See 'remarks' See 'remarks' 2-FCV-67-188-A has been electrically flowpath for column column. column. column. disconnected due to App. 'R' Essential Raw cooling water interaction to keep the valve Cooling Water Flow from the ERCW permanently open.

Control Valve for Header to the the Residual Heat cooler for RHR Removal System Pump 2A-A.

Pump 2A-A Cooler.

8 2-FCV-67-190-B Provides See 'remarks' See 'remarks' See 'remarks' column See 'remarks' See 'remarks' 2-FCV-67-190-B has been electrically flowpath for column column column column disconnected due to App. 'R' Essential Raw cooling water interaction to keep the valve Cooling Water Flow from the ERCW permanently open.

Control Valve for Header to the the Residual Heat cooler for RHR Removal System Pump 2B-B.

Pump 2B-B Cooler.

9.4-60 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 5 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 9 2-PMCL-30-177-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. Equipment includes fan and motor.

air to CS Pump while running; Train A power MCR for 2-FCV CSP 2A-A Room Train B Pump is not Train A and Train B CS pump/cooler Containment Spray 2A-A Room Spuriously stops. failure; Auto-start 184-A (2-ZS-67-184). with the potential for affected by the failure sets are in separate rooms. Review of Pump 2A-A Cooler signal failure; Fan motor running loss of CSP 2A-A. of Train A the schematics for the Train A and B (Train A) Operator error light on MCC. pump/cooler, and is coolers shows the trains to be (handswitch placed 100% redundant to independent. The cooler is started in wrong position) Train A pump. automatically upon high temperature at 2-TS-30-177-A or CS Pump 2A-A start; manually by local handswitch 2-HS 177.

The cooler and the flow control valve 2-FCV-67-184 are interlocked to operate together.

10 2-PMCL-30-178-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. Equipment includes fan and motor.

air to CS Pump while running; Train B power MCR for 2-FCV CSP 2B-B Room Train A Pump is not Train A and Train B CS pump/cooler Containment Spray 2B-B Room Spuriously stops. failure; Auto-start 186-B (2-ZS-67-186). with the potential for affected by the failure sets are in separate rooms. Review of Pump 2B-B Cooler signal failure; Fan motor running loss of CSP 2B-B. of Train B schematics for the Train A and B (Train B) Operator error light on MCC. pump/cooler, and is coolers shows the trains to be (handswitch placed 100% redundant to independent. The cooler is started in wrong position) Train B pump. automatically upon high temperature at 2-TS-30-178-B or CS Pump 2B-B start; manually by local handswitch 2-HS 178.

The cooler and the flow control valve 2-FCV-67-186 are interlocked to operate together.

9.4-61 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 6 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 11 2-FCV-67-184 Provides Fails to open, Mechanical failure; Status monitor light in Loss of cooling to None. 2-FCV-67-184 fails to the open position flowpath for stuck closed. Opening signal MCR (2-ZS-67-184). CSP 2A-A room with Train B CS Pump is on loss of power or air.

Essential Raw cooling water failure. the potential for loss not affected by the Cooling Water Flow from the ERCW of CSP 2A-A. failure of Train A Control Valve for Header to the pump room cooler, the Containment cooler for CS and is 100%

Spray System Pump 2A-A. redundant to Train A Pump 2A-A Cooler. pump.

12 2-FCV-67-186 Provides Fails to open, Mechanical failure; Status monitor light in Loss of cooling to None. 2-FCV-67-186-B fails to the open flowpath for stuck closed. Opening signal MCR (2-ZS-67-186). CSP 2B-B room with Train A CS Pump is position on loss of power or air.

Essential Raw cooling water failure. the potential for loss not affected by the Cooling Water Flow from the ERCW of CSP 2B-B. failure of Train B Control Valve for Header to the pump room cooler, the Containment cooler for CS and is 100%

Spray System Pump 2B-B. redundant to Train B Pump 2B-B Cooler. pump.

13 2-PMCL-30-183-A Provides cooling Fails to start, fails Mechanical failure; Fan motor running Loss of cooling to CC None. Equipment includes fan and motor.

air to CC Pump while running; Train A power light on MCC. pump 2A-A Room Train B CC pump is Train A and Train B pump/cooler sets Centrifugal 2A-A Room. Spuriously stops. failure; Auto-start with the potential for not affected by the are in separate rooms. Review of Charging Pump signal failure; Status monitor light in loss of CC Pump 2A- failure of Train A schematics for the train A and B 2A-A Cooler (Train Operator error MCR for 2-FCV A. pump/cooler, and is coolers shows the trains to be A). (handswitch placed 168 (2-ZS-168) 100% redundant to independent. The cooler automatically in wrong position). Train A pump. starts upon high temperature at 2-TS-30-183-A, or pump 2A-A start; Manually by local handswitch 2-HS 183.

9.4-62 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 7 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 14 2-PMCL-30-182-B Provides cooling Fails to start, fails Mechanical failure; Fan motor running Loss of cooling to CC None. Equipment includes fan and motor.

air to CC Pump while running; Train B power light on MCC. pump 2B-B Room Train A CC pump is Train A and Train B pump/cooler sets Centrifugal 2B-B Room Spuriously stops. failure; Auto-start with the potential for not affected by the are in separate rooms. Review of Charging Pump signal failure; Status monitor light in loss of CC pump 2B- failure of Train B schematics for the Train A and B 2B-B Cooler (Train Operator error MCR for 2-FCV B. pump/cooler, and is coolers shows the trains to be B). (handswitch placed 170 (2-ZS-170) 100% redundant to independent. The cooler automatically in wrong position) Train B pump. starts upon high temperature at 2-TS-30-182-B or pump 2B-B start; Manually by local handswitch 2-HS-30-182.

15 2-FCV-67-168 Provides See 'Remarks' See 'Remarks' See 'Remarks' column See 'Remarks' See 'Remarks' 2-FCV-67-168 is electrically flowpath for column column column column disconnected to keep the valve Essential Raw cooling water permanently open.

Cooling water Flow from the ERCW Control Valve for Header to the the centrifugal cooler for CC Charging Pump Pump 2A-A.

Room 2A-A Cooler.

16 2-FCV-67-170 Provides See 'Remarks' See 'Remarks' See 'Remarks' column See 'Remarks' See 'Remarks' 2-FCV-67-170 is electrically flowpath for column column column column disconnected to keep the valve Essential Raw cooling water permanently open.

Cooling water Flow from the ERCW Control Valve for Header to the the centrifugal cooler for CC Charging Pump Pump 2B-B.

Room 2B-B Cooler.

9.4-63 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 8 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 17 1-PMCL-30-190-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts upon CCS and Aux. FW air to the CCS while running; Train A power MCR for 1-FCV in providing cooling The Train B Cooler Train A ABI signal or high temperature Pump Cooler A-A. and Aux. FW Spuriously stops. failure; Auto- 162 (1-ZS-67-162). air for CCS and Aux B-B is available to sensed by 1-TS-30-190A-A. Cooler fan pumps space. standby start signal Indicating light on FW pumps space. start on high motor and 1-FSV-67-162-A are failure; Operator MCC for fan motor temperature (1-TS- interlocked to open 1-FCV-67-162-A for error (handswitch running. 30-191-A-B) and is ERCW supply on cooler start. Review placed in wrong 100% redundant to of the schematics for the coolers A-A position) the Train A cooler. and B-B shows their independence.

18 1-PMCL-30-191-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts upon air to the CCS while running; Train B power MCR for 1-FCV in providing cooling The Train A Cooler Train B ABI signal or high temperature CCS and Aux. FW and Aux. FW Spuriously stops. failure; Auto- 164-B (1-ZS-67-164). air for CCS and Aux. A-A is available to sensed by 1-TS-30-191A-B. Cooler fan Pump/Cooler B-B pumps space. standby start signal Indicating light on FW pumps space. start on high motor and 1-FSV-67-164-B are failure; Operator MCC for fan motor temperature (1-TS- interlocked to open 1-FCV-67-164 for error (handswitch running. 30-190A-A) and is ERCW Supply on cooler start. Review placed in wrong 100% redundant to of the schematics for the coolers A-A position) Train B cooler. and B-B shows their independence.

19 1-FCV-67-162 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 1-FCV-67-162 fails open on loss of flowpath for stuck closed. Opening signal MCR (or in providing cooling Train B pump space power or air.

Essential Raw cooling water failure. 1-ZS-67-162). to CCS and Aux FW cooler is not affected Cooling Water Flow from the ERCW Pump space. by the failure of Train Control Valve for Header to the A pump room cooler, the CCS and Aux. Cooler for Pump and is 100%

FW Pump Cooler A- A-A. redundant to the train A. A pump space cooler.

9.4-64 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 9 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 20 1-FCV-67-164 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 1-FCV-67-164 fails open on loss of flowpath for stuck closed. Opening signal MCR (or 1-ZS in providing cooling Train A pump space power or air.

Essential Raw cooling water failure. 164). to CCS and Aux FW cooler is not affected Cooling Water Flow from the ERCW Pump space. by the failure of Train Control Valve for Header to the B pump room cooler, the CCS and Aux. Cooler for Pump and is 100%

FW Pump Cooler B- B-B. redundant to the B. Train B pump space cooler.

21 2-CLR-30-200-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts upon air to the EGTS while running; Train A power MCR for 2-FCV in providing cooling The Train B Cooler is Train A ABI signal or high temperature EGTS Cooler A-A Room Spuriously stops. failure; Auto- 336 (2-ZS-67-336). air for the EGTS available to start on at 2-TS-30-200A-A. Cooler fan motor standby start signal Fan motor running Room. high temperature (2- and 2-FSV-67-336-A are interlocked to failure; Operator light on MCC. TS-30-207A-B) and open 2-FCV-67-336 for ERCW supply error (handswitch is 100% redundant to on cooler start. Review of the placed in wrong Train A cooler. schematics for the coolers A-A and B-B position) shows their independence.

22 2-CLR-30-207-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts upon air to the EGTS while running; Train B power MCR for 2-FCV in providing cooling The Train A Cooler is Train B ABI signal or high temperature EGTS Cooler B-B Room Spuriously stops. failure; Auto- 338 (2-ZS-67-338). air for the EGTS available to start on at 2-TS-30-207A-B. Cooler fan motor standby start signal Fan motor running Room. high temperature at and 2-FSV-67-338-B are interlocked to failure; Operator light on MCC. 2-TS-30-200A-A and open 2-FCV-67-338 for ERCW supply error (handswitch is 100% redundant to on cooler start. Review of the placed in wrong Train B cooler. schematics for the coolers A-A and B-B position) shows their independence.

23 2-FCV-67-336 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-336 fails open on loss of flowpath for stuck closed. signal failure. MCR (2-ZS-67-336) in providing cooling Train B cooler is not power or air.

Essential Raw cooling water to EGTS room. affected by the failure Cooling Water Flow from the ERCW of Train A room Control Valve for Header to the A- cooler, and is 100%

WBNP-99 the EGTS Room A cooler for the redundant to the 9.4-65 Cooler A-A. EGTS Rooms. Train A room cooler.

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 10 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 24 2-FCV-67-338 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-338 fails open on loss of flowpath for stuck closed. signal failure. MCR (2-ZS-67-338). in providing cooling Train A cooler is not power or air.

Essential Raw cooling water to EGTS room. affected by the failure Cooling Water Flow from the ERCW of Train B room Control Valve for Header to the B- cooler, and is 100%

the EGTS Room B cooler for the redundant to the Cooler B-B EGTS Rooms. Train B room cooler.

25 0-PMCL-30-192-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts upon air to the CCS while running; Train A power MCR for 1-FCV in providing cooling The Train B Cooler is Train A ABI signal or high temperature CCS TB Booster TB Booster and Spuriously stops. failure; Auto- 213-A (1-ZS-67-213) air for CCS TB available to start on at 0-TS-30-192A-A. Cooler fan motor and Spent Fuel Pit Spent Fuel Pit standby start signal Fan motor running Booster and Spent high temperature (0- and 1-FSV-67-213-A are interlocked to Pump Cooler A-A Cooler Space. failure; Operator light on MCC. Fuel Pit Cooler TS-30-193A-B) and open 1-FCV-67-213-A for ERCW error (handswitch Space is 100% redundant to supply on cooler start. Review of the placed in wrong the Train A cooler. schematics for the coolers A-A and B-B position) shows their independence.

26 0-PMCL-30-193-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts upon air to the CCS while running; Train B power MCR for 1-FCV in providing cooling The Train A Cooler is Train B ABI signal or high temperature CCS TB Booster TB Booster and Spuriously stops. failure; Auto- 215 (1-ZS-67-215). air for CCS TB available to start on at 0-TS-30-193A-B. Cooler fan motor and Spent Fuel Pit Spent Fuel Pit standby start signal Fan motor running Booster and Spent high temperature (0- and 1-FSV-67-215-B are interlocked to Cooler B-B Cooler B-B failure; Operator light on MCC. Fuel Pit Cooler TS-30-192A-A) and open 1-FCV-67-215-B for ERCW space. error (handswitch space. is 100% redundant to supply on cooler start. Review of the placed in wrong the Train B cooler. schematics for the coolers A-A and B-B position) shows their independence.

27 1-FCV-67-213-A Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 1-FCV-67-213-A fails open on loss of flowpath for stuck closed. Opening signal MCR (1-ZS-67-213) in providing cooling Train B Pump area power or air.

Essential Raw cooling water failure. air to CCS TB cooler is not affected Cooling Water Flow from the ERCW Booster and Spent by the failure of Control Valve for Header to the Fuel Pit Coolers Train A pump area the CCS TB Cooler A-A. space. cooler, and is 100%

Booster and Spent redundant to the WBNP-99 Fuel Pit Cooler A-A Train A pump area 9.4-66 cooler.

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 11 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 28 1-FCV-67-215-B Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 1-FCV-67-215-B fails open on loss of flowpath for stuck closed. Opening signal MCR (1-ZS-67-215) in providing cooling Train A Pump area power or air.

Essential Raw cooling water failure. air to CCS TB cooler is not affected Cooling Water Flow from the ERCW Booster and Spent by the failure of Control Valve for Header to the Fuel Pit Coolers Train B pump area the CCS TB Cooler B-B. space. cooler, and is 100%

Booster and Spent redundant to the Fuel Pit Cooler B-B Train B pump area cooler.

29 0-BKD-31-2956 Provides Fails to open Mechanical failure Local position Loss of redundancy None.

flowpath for cool (stuck closed). indicator attachment in providing cooling The standby Train B CCS TB Booster air flow from on the damper would air to room. cooler will start upon and Spent Fuel Pit Cooler A-A to indicate if damper was high temperature on Pump Cooler A-A common stuck closed 0-TS-30-193B-B.

Backdraft Damper discharge headers to room.

Protects standby Fails to backseat Mechanical failure Local position Loss of redundancy None (See remarks) Operability of the dampers is Cooler A-A from (stuck open) indicator attachment in providing cooling periodically verified.

reverse air flow when Train B on the damper would air to room.

from running Cooler B-B is indicate if damper was cooler B-B. running. stuck open.

30 0-BKD-31-2957 Provides Fails to open Mechanical failure Local position Loss of redundancy None. Operability of the dampers is flowpath for cool (stuck closed). indicator attachment in providing cooling The standby Train A periodically verified.

CCS TB Booster air flow from on the damper would air to room. cooler will start upon and Spent Fuel Pit Cooler B-B to indicate if damper was high temperature on Pump Cooler B-B common stuck closed. 0-TS-30-192B-A.

Backdraft Damper discharge headers to WBNP-99 room.

9.4-67

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 12 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks Protects standby Fails to backseat Mechanical failure Local position Loss of redundancy None (See remarks) Operability of the dampers is Cooler B-B from (stuck open) indicator attachment in providing cooling periodically verified.

reverse air flow when Train A on the damper would air to room.

from running Cooler A-A is indicate if damper was cooler A-A. running. stuck open.

31 2-PMCL-30-184-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts upon air to the AFW while running; Train A power MCR for 2-FCV in providing cooling The Train B Cooler is Train A ABI signal or high temperature AFW and BAT and BAT pumps Spuriously stops. failure; Auto- 217 (2-ZS-67-217). air for AFW and BAT available to start on at 2-TS-30-184A-A. Cooler fan motor Cooler Fan A-A space standby start signal Fan motor running pumps space high temperature (2- and 2-FSV-67-217-A are interlocked to failure; Operator light on MCC. TS-30-185A-B) and open 2-FCV-67-217 for ERCW supply error (handswitch is 100% redundant to on cooler start. Review of the placed in wrong Train A cooler. schematics for the coolers A-A and B-B position) shows their independence.

32 2-PMCL-30-185-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The cooler automatically starts air to the AFW while running; Train B power MCR for 2-FCV in providing cooling The Train A Cooler is upon Train B ABI signal or high AFW and BAT and BAT pumps Spuriously stops. failure; Auto- 219-B (2-ZS-67-219). air for AFW and BAT available to start on temperature at 2-TS-30-185A-B.

Cooler Fan B-B space standby start signal Fan motor running pumps space high temperature (2- Cooler fan motor and 2-FSV failure; Operator light on MCC. TS-30-184A-A) and 219-B are interlocked to open 2-error (handswitch is 100% redundant to FCV-67-219 for ERCW supply on placed in wrong Train B cooler. cooler start. Review of the position) schematics for the coolers A-A and B-B shows their independence.

33 2-FCV-67-217 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-217 fails open on loss flowpath for stuck closed. Opening signal MCR (2-ZS-67-217) in providing cooling Train B Pump room of power or air.

Essential Raw cooling water failure. to AFW and BAT cooler is not affected Cooling Water Flow from the ERCW pumps space. by the failure of Train Control Valve for Header to the A pump room cooler, the AFW and BAT Cooler for Pump and is 100%

Cooler A-A A-A. redundant to the WBNP-99 Train A pump room 9.4-68 cooler.

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 13 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 34 2-FCV-67-219 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-219 fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-219) in providing cooling Train A Pump room power or air.

Essential Raw cooling water failure. to AFW and BAT cooler is not affected Cooling Water Flow from the ERCW pumps space. by the failure of Train Control Valve for Header to the B pump room cooler, the AFW and BAT Cooler for Pump and is 100%

Cooler B-B B-B. redundant to the Train B pump room cooler.

35 2-BKD-31-2952 Provides Fails to open Mechanical failure Local position Loss of redundancy None. Operability of the dampers is flowpath for cool (stuck closed). indicator attachment in providing cooling The standby Train B peridoically verified.

Aux FW and BAT air flow from on the damper would air to room. cooler will start upon Pump Cooler A-A Cooler A-A to indicate if damper was high temperature on Backdraft Damper common stuck closed 2-TS-30-185B-B.

discharge header to room.

Protects standby Fails to backseat Mechanical failure Local position Loss of redundancy None .

Cooler A-A from (stuck open) indicator attachment in providing cooling reverse air flow when Train B on the damper would air to room.

from running Cooler B-B is indicate if damper was cooler B-B. running. stuck open.

36 2-BKD-31-2953 Provides Fails to open Mechanical failure Local position Loss of redundancy None. Operability of the dampers is flowpath for cool (stuck closed). indicator attachment in providing cooling The standby Train A peridoically verified.

Aux FW and BAT air flow from on the damper would air to room. cooler will start upon Pump Cooler B-B Cooler B-B to indicate if damper was high temperature on Backdraft Damper common stuck closed 2-TS-30-184B-A.

discharge header to room.

9.4-69 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 14 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks Protects standby Fails to backseat Mechanical failure Local position Loss of redundancy None .

Cooler B-B from (stuck open) indicator attachment in providing cooling reverse air flow when Train A on the damper would air to room.

from running Cooler A-A is indicate if damper was cooler A-A. running. stuck open.

37 2-CLR-30-201-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The Train B The cooler automatically starts upon air to the pipe while running; Train A power MCR for 2-FCV in providing cooling Cooler Fan 2B-B is Train A ABI signal or high temperature Pipe Chase Cooler chase. Spuriously stops. failure; Auto- 342-A (2-ZS-67-342- air for the Pipe available to start on at 2-TS-30-201A-A. Cooler fan motor Fan 2A-A standby start signal A). Fan motor running Chase. high temperature (2- and 2-FSV-67-342-A are interlocked to failure; Operator light on MCC. TS-30-202A-B) and open 2-FCV-67-342-A for ERCW error (handswitch is 100% redundant to supply on cooler start. Review of the placed in wrong Train A cooler. schematics for the coolers A-A nd B-B position) shows their independence.

38 2-CLR-30-202-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of redundancy None. The Train A The cooler automatically starts upon air to the pipe while running; Train B power MCR for 2-FCV in providing cooling Cooler Fan 2A-A is Train B ABI signal or high temperature Pipe Chase Cooler chase. Spuriously stops. failure; Auto- 344-B (2-ZS-67-344). air for the Pipe available to start on at 2-TS-30-202A-B. Cooler fan motor Fan 2-B-B standby start signal Fan motor running Chase. high temperature at and 2-FSV-67-344-B are interlocked to failure; Operator light on MCC. 2-TS-30-201A-A and open 2-FCV-67-344-B for ERCW error (handswitch is 100% redundant to supply on cooler start. Review of the placed in wrong Train B cooler. schematics for the coolers A-A and B-B position) shows their independence.

39 2-FCV-67-342-A Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-342 fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-342) in providing cooling Train B Pump room power or air.

Essential Raw cooling water failure. air to the Pipe cooler is not affected Cooling Water Flow from the ERCW Chase. by the failure of Train Control Valve for Header to the A pump room cooler, the Pipe Chase Cooler 2A-A. and is 100%

Cooler 2A-A redundant to the Train A pump room WBNP-99 cooler.

9.4-70

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 15 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 40 2-FCV-67-344-B Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-344-B fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-344) in providing cooling Train A Pump room power or air.

Essential Raw cooling water failure. air to the Pipe cooler is not affected Cooling Water Flow from the ERCW Chase. by the failure of Train Control Valve for Header to the B pump room cooler, the Pipe Chase Cooler 2B-B. and is 100%

Cooler 2B-B redundant to the Train B pump room cooler.

41 2-BKD-31-2925 Provides Fails to open Mechanical failure Local position Loss of redundancy None. Operability of the dampers is flowpath for cool (stuck closed). indicator attachment in providing cooling The standby Train B periodically verified.

Pipe Chase Cooler air flow from on the damper would air to Pipe Chase. cooler will start upon 2A-A Backdraft Cooler 2A-A to indicate if damper was high temperature on Damper Pipe Chase stuck closed 2-TS-30-202B-B.

Header.

Protects standby Fails to backseat Mechanical failure Local position Loss of redundancy None (See remarks)

Cooler 2A-A (stuck open) indicator attachment from reverse air when Train A on the damper would flow from Cooler 2B-B is indicate if damper was running cooler running. stuck open.

2B-B.

42 2-BKD-31-2937 Provides Fails to open Mechanical failure Local position Loss of redundancy None. Operability of the dampers is flowpath for cool (stuck closed). indicator attachment in providing cooling The standby Train A periodically verified.

Pipe Chase Cooler air flow from on the damper would air to Pipe Chase. cooler will start upon 2B-B Backdraft Cooler 2B-B to indicate if damper was high temperature on Damper Pipe Chase stuck closed 2-TS-30-201B-A.

Header.

9.4-71 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 16 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks Protects standby Fails to backseat Mechanical failure Local position Loss of redundancy None (See Remarks)

Cooler 2B-B (stuck open) indicator attachment from reverse air when Train B on the damper would flow from Cooler 2A-A is indicate if damper was running cooler running. stuck open.

2A-A.

43 2-CLR-30-186-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The cooler automatically starts upon air to while running; Train A power MCR for 2-FCV Penetration Room The Train B Cooler is Train A ABI signal or high temperature Penetration Room Penetration Spuriously stops. failure; Auto-start 346 fully open (2-ZS- (El 692) with the available to start on at 2-TS-30-186A-A. Cooler fan motor Cooler Fan 2A-A Room (El 692) signal failure;67-346). Fan motor potential for loss of high temperature (2- and 2-FSV-67-346-A are interlocked to (Train A) Operator error running light on MCC. room equipment. TS-30-187A-B) and open 2-FCV-67-346 for ERCW supply (handswitch placed is 100% redundant to on cooler start. Review of the in wrong position) Train A cooler. schematics for the coolers A-A and B-B shows their independence.

44 2-CLR-30-187-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The Train A The cooler automatically starts upon air to while running; Train B power MCR for 2-FCV Penetration Room Cooler is available to Train B ABI signal or high temperature Penetration Room Penetration Spuriously stops. failure; Auto-start 348 fully open (2-ZS- (El 692) with the start on high at 2-TS-30-187A-B. Cooler fan motor Cooler Fan 2B-B Room (El 692) signal failure;67-348). Fan motor potential for loss of temperature at 2-TS- and 2-FSV-67-348-B are interlocked to (Train B). Operator error running light on MCC. room equipment. 30-186A-A and is open 2-FCV-67-348 for ERCW supply (handswitch placed 100% redundant to on cooler start. Review of the in wrong position) Train B cooler. schematics for the coolers A-A and B-B shows their independence.

45 2-FCV-67-346-A Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-346-A fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-346) in providing cooling Train B Pump room power or air.

Essential Raw cooling water failure. to Penetration Room cooler is not affected Cooling Water Flow from the ERCW (El. 692) space. by the failure of Train Control Valve for Header to the . A pump room cooler, the Penetration Cooler for the and is 100%

Room (El. 692) Penetration redundant to the Cooler 2A-A Room Space. Train A pump room WBNP-99 cooler.

9.4-72

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 17 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 46 2-FCV-67-348-B Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-348-B fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-348) in providing cooling Train A Pump room power or air.

Essential Raw cooling water failure. to Penetration Room cooler is not affected Cooling Water Flow from the ERCW (El. 692) space. by the failure of Train Control Valve for Header to the B pump room cooler, the Penetration Cooler for the and is 100%

Room (El. 692) Penetration redundant to the Cooler 2B-B Room Space. Train B pump room cooler.

47 2-CLR-30-196 Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The Train B The cooler automatically starts upon air to while running; Train A power MCR for 2-FCV Penetration Room Cooler is available to Train A ABI signal or high temperature Penetration Room Penetration Spuriously stops. failure; Auto-start 350-A fully open (2- (El 713) with the start on high (2-TS-30-196A-A). Cooler fan motor Cooler Fan 2A-A Room (El 713) signal failure; ZS-67-350). Fan potential for loss of temperature (2-TS- and 2-FSV-67-350-A are interlocked to (Train A). Operator error motor running light on room equipment. 30-197A-B) and is open 2-FCV-67-350-A for ERCW (handswitch placed MCC. 100% redundant to supply on cooler start. Review of the in wrong position) Train A cooler. schematics for the coolers A-A and B-B shows their independence.

48 2-CLR-30-197 Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The Train A The cooler automatically starts upon air to while running; Train B power MCR for 2-FCV Penetration Room Cooler is available to Train B ABI signal or high temperature Penetration Room Penetration Spuriously stops. failure; Auto-start 352 fully open (2-ZS- (El 713) with the start on high at 2-TS-30-197A-B. Cooler fan motor Cooler Fan 2B-B Room (el 713) signal failure;67-352). Fan motor potential for loss of temperature (2-TS- and 2-FSV-67-352-B are interlocked to (Train B). Operator error running light on MCC. room equipment. 30-196A-A) and is open 2-FCV-67-352 for ERCW supply (handswitch placed 100% redundant to on cooler start. Review of the in wrong position) Train B cooler. schematics for the coolers A-A and B-B shows their independence.

9.4-73 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 18 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 49 2-FCV-67-350 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-350 fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-350) in providing cooling Train B Penetration power or air.

Essential Raw cooling water failure. to Penetration Room Room cooler is not Cooling Water Flow from the ERCW (El 713) Space affected by the failure Control Valve for Header to the of Train A the Penetration Cooler for the Penetration Room Room (El 713) Penetration cooler, and is 100%

Cooler 2A-A. Room Space. redundant to the Train A Penetration Room cooler.

50 2-FCV-67-352 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-352 fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-352) in providing cooling Train A Penetration power or air.

Essential Raw cooling water failure. to Penetration Room Room cooler is not Cooling Water Flow from the ERCW (El 713) Space. affected by the failure Control Valve for Header to the of Train B the Penetration Cooler for the Penetration Room Room (El 713) Penetration cooler, and is 100%

Cooler 2B-B Room Space. redundant to the Train B Penetration Room cooler.

51 1-CLR-30-194-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The Train B The cooler automatically starts upon air to while running; Train A power MCR for 1-FCV Penetration Room Cooler is available to Train A ABI signal or high temperature Penetration Room Penetration Spuriously stops. failure; Auto-start 354-A fully open (1- (El 737) with the start on high at 1-TS-30-194A-A. Cooler fan motor Cooler Fan 1A-A Room (El 737) signal failure; ZS-67-354). Fan potential for loss of temperature (1-TS- and 1-FSV-67-354-A are interlocked to (Train A). Operator error motor running light on room equipment. 30-195A-B) and is open 1-FCV-67-354-A for ERCW (handswitch placed MCC. 100% redundant to supply on cooler start. Review of the in wrong position) Train A cooler. schematics for the coolers A-A and B-B shows their independence.

9.4-74 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 19 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 52 1-CLR-30-195-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The Train A The cooler automatically starts upon air to while running; Train B power MCR for 1-FCV Penetration Room (el Cooler is available to Train B ABI signal or high temperature Penetration Room Penetration Spuriously stops. failure; Auto-start 356-B (1-ZS-67-356). 737) with the start on high at 1-TS-30-195A-B. Cooler fan motor Cooler Fan 1B-B Room (el 737) signal failure; Fan motor running potential for loss of temperature (1-TS- and 1-FSV-67-356-B are interlocked to (Train B). Operator error light on MCC. room equipment. 30-194A-A) and is open 1-FCV-67-356-B for ERCW (handswitch placed 100% redundant to supply on cooler start. Review of the in wrong position) Train B cooler. schematics for the coolers A-A and B-B shows their independence.

53 2-FCV-67-354 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-354 fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-354) in providing cooling Train B Penetration power or air.

Essential Raw cooling water failure. to Penetration Room Room cooler is not Cooling Water Flow from the ERCW (El 737) Space affected by the failure Control Valve for Header to the of Train A the Penetration Cooler for the Penetration Room Room (El 737) Penetration cooler, and is 100%

Cooler 2A-A. Room Space. redundant to the Train A Penetration Room cooler.

54 2-FCV-67-356 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. 2-FCV-67-356 fails open on loss of flowpath for stuck closed. Opening signal MCR (2-ZS-67-356) in providing cooling Train A Penetration power or air.

Essential Raw cooling water failure. to Penetration Room Room cooler is not Cooling Water Flow from the ERCW (El 737) Space. affected by the failure Control Valve for Header to the of Train B the Penetration Cooler for the Penetration Room Room (El 737) Penetration cooler, and is 100%

Cooler 2B-B Room Space. redundant to the Train B Penetration Room cooler.

9.4-75 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 20 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 55 Backdraft Backseat to stop Fails to backseat Mechanical Failure See Remark #2 See Remark #2 1. Backdraft dampers 2-BKD-31-1790 Dampers flow of hot air (Stuck Open) and 2-BKD-31-5093 exist so that a 2-BKD-31-3136 developed due backdraft damper is provided in every 2-BKD-31-3137 to a HELB in the connection from the pipe chase to an 2-BKD-31-3138 pipe chase from adjacent room, and determined that the 2-BKD-31-3139 adjacent rooms single failure of a backdraft damper (to 2-BKD-31-3140 and maintains a close), when normal HVAC continues 2-BKD-31-3141 mild to operate, will not result in a severe 2-BKD-31-3142 environment in environment in the room with the failed 2-BKD-31-3143 rooms adjacent backdraft damper.

2-BKD-31-3144 to pipe chase.

2-BKD-31-3145 2. The ABI Signal does not 2-BKD-31-3204 automatically isolate the normal HVAC 2-BKD-31-3206 System during a HELB. As a result, the 2-BKD-31-3208 HELB in the pipe chase will not result in 2-BKD-31-3209 isolation of normal HVAC. Thus, proper air flow is maintained.

As a result, the single failure of any of the listed backdraft dampers will have no effect on the system or the plant.

56 2-CLR-30-194-A Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The Train B The cooler automatically starts upon air to while running; Train A power MCR for 2-FCV-354 Penetration Room Cooler is 100% Train A ABI signal or high temperature Penetration Room Penetration Spuriously stops failure; Auto-start fully open (2-ZS (El 737) with the redundant to train A at 2-TS-30-194A-A. Cooler fan motor Cooler Fan 2A-A Room (El 737) signal failure; 354 fully open). Fan potential for loss of cooler. and 2-FSV-67-354-A are interlocked to Operator error motor running light on room equipment open 2-FCV-67-354 for ERCW supply (handswitch placed MCC. on cooler start. Review of the in wrong position) schematics for the coolers A-A and B-B shows their independence, 9.4-76 WBNP-99

Table 9.4-3 FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: SAFETY FEATURE EQUIPMENT COOLERS (Sheet 21 of 21)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 57 2-CLR-30-195-B Provides cooling Fails to start, fails Mechanical failure; Status monitor light in Loss of cooling to None. The Train A The cooler automatically starts upon air to while running; Train B power MCR for 2-FCV-356 Penetration Room Cooler is 100% Train B ABI signal or high temperature Penetration Room Penetration Spuriously stops failure; Auto-start fully open (2-ZS (El 737) with the redundant to train B at 2-TS-30-195A-B. Cooler fan motor Cooler Fan 2B-B Room (El 737) signal failure; potential for loss of cooler.

356 fully open). Fan and 2-FSV-67-356-B are interlocked to Operator error room equipment motor running light on open 2-FCV-67-356 for ERCW supply (handswitch placed in wrong position) MCC. on cooler start. Review of the schematics for the coolers A-A and B-B shows their independence, 58 2-FCV-67-354 Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. Train B 2-FCV-67-354 fails open on loss of flowpath for stuck closed. Open signal failure. MCR (2-ZS-67-354) in providing cooling Penetration Room power or air.

Essential Raw cooling water to Penetration Room cooler is not affected Cooling Water Flow from the ERCW (El 737) Space by the failure of Control valve for the Header to the Train A Penetration Penetration Room Cooler for the Room cooler, and is (El 737) Cooler Penetration 100% redundant to 2A-A. Room Space. the Train A Penetration room Cooler.

59 2-FCV-67-356-B Provides Fails to open, Mechanical failure; Status monitor light in Loss of redundancy None. Train A 2-FCV-67-356 fails open on loss of flowpath for stuck closed. Open signal failure. MCR (2-ZS-67-356) in providing cooling Penetration Room power or air.

Essential Raw cooling water to Penetration Room cooler is not affected Cooling Water Flow from the ERCW (El 737) Space by the failure of Control valve for the Header to the Train B Penetration Penetration Room Cooler for the Room cooler, and is (El 737) Cooler Penetration 100% redundant to 2B-B. Room Space. the Train B Penetration Room cooler.

9.4-77 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-3A FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: TURBINE DRIVEN AUXILIARY FEEDWATER PUMP ROOM VENTILATION (Sheet 1 of 2)

Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1 2-FAN-30-214 Provides cooling Fails to start; Mechanical failure; No direct Loss of cooling None (See Remarks 1. The dc fan is intended to mitigate the to the TDAFW Fails while Temperature method of air/ventilation to the # 3 and 4) effects of station blackout on the TDAFW Turbine-driven Pump Room running; sensing failure; detection. TDAFW Pump Room Pump Room ventilation. During DBEs Auxiliary Feedwater Spuriously TDAFW Pump start from the safety- the TDAFW provides backup to the two Pump Room stopped. signal failure. See Remark # 2 related dc fan. 50% motor-driven AFW pumps. As such Ventilation Fan its operation during DBEs would imply a 125V Dc Loss of all single failure to have already occurred; cooling/ventilation to therefore, postulation of the failure of this the TDAFW Pump fan is not required.

Room during loss of all ac (LOAC). 2. Local temperature indication.

3. In the event of loss of all ac the TDAFW Pump cooling is entirely dependent on the dc fan. A single active failure is not postulated during a Station Blackout event; therefore, the fan and associated components are assumed to function properly during a loss of all ac power.

4. The dc fan starts automatically by either TDAFW pump start, or high temperature sensed by 1-TS-30-214. It can also be started manually.

9.4-78 WBNP-99

Table 9.4-3A FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: TURBINE DRIVEN AUXILIARY FEEDWATER PUMP ROOM AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR VENTILATION (Sheet 2 of 2)

Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 2 2-BKD-30-3035 Provides suction Spuriously closed Mechanical failure No direct Loss of cooling See Remarks During the loss of all ac, there will be no air flow path to method of /ventilating for cooling/ventilating capability for TDAFW Backdraft Damper the operating dc detection TDAFW Pump Room Pump room, with the possibility for loss exhaust fan from dc fan. of the TDAFW Pump. A non-safety, non-See Remarks seismic, non- 1E ac fan is present in the room. TDAFW is the backup for the motor-driven FW and is required to operate upon failure of motor-driven FW.

Thus, postulation of this failure is not required. A single active failure is not postulated during a Station Blackout event; therefore, the fan and associated components are assumed to function properly during a loss of all ac power 9.4-79 WBNP-99

WATTS BAR WBNP-99 THIS PAGE INTENTIONALLY BLANK AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-80

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 1 of 16)

METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1 Fire damper in Air Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC Intake Room between Air fire failure System need not to be Intake Room postulated as being 0-30-603 for and Diesel concurrent with fire.

Train 1A-A, Gen Room 0-30-604 for Train Closed Mechanical Diesel Gen. None (See None Redundant train diesel 2A-A, during other (fusible link) Room exhaust Remarks) (See Remarks) generator system is modes of failure fan low flow started by operator 0-30-605 for operation alarm in Main Train 1B-B, and Control Room from fans air flow 0-30-606 for Train switches 2B-B FS-30-447 or FS-30-451 for Train 1A-A, FS-30-449 or FS-30-453 for Train 1B-B, FS-30-448 or FS-30-452 for Train 2A-A, and FS-30-450 or FS-30-454 for Train 2B-B 9.4-81 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 2 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2 Motor-operated To prevent air Closed or Mechanical Diesel Gen. Complete or None (See Redundant train diesel intake dampers to flow when partially failure or Room exh. fan partial loss of Remarks) generator system is Diesel Gen. associated closed Actuator failure low flow alarm in ventilation of started by operator. If Room diesel during Main Control associated closed due to spurious generator associated Room from air safety train CO2 system actuation 1-FCO-30-443 exhaust fans exhaust flow switches Diesel Gen operator can verify and for Train 1A-A, are fan(s) FS-30-447 or Room. reopen damper.

deenergized operation FS-30-451 for 1-FCO-30-445 for Train 1A-A, Train 1B-B, FS-30-449 or FS-30-453 for 2-FCO-30-444 Train 1B-B, for Train 2A-A, FS-30-448, 452 for 2A-A, and 2-FCO-30-446 for FS-30-450, 454 Train 2B-B for 2B-B.

2 (Continued) (Contd) Spurious Dampers are Diesel Gen. Partial loss of None (See If closed due to CO2 system spring-loaded Room exh. fan ventilation of Remarks) spurious CO2 system actuation to open upon low flow alarm in associated actuation, operator can power loss; Main Control safety train verify and start the however, CO2 Room from air Diesel Gen fan(s), which in turn actuation flow switches FS- Room. reopen dampers, by signal can 30-447 or FS use of the CO2 bypass close them. 451 for Train 1A- switches 1-HS A, 447D, 1-HS-30-449D, FS-30-449 or FS- 2-HS-30-448D, and 30-453 for Train 2-HS-30-450D.

1B-B, FS-30-448, 452 for 2A-A, and FS-WBNP-99 30-450 or 454 for 9.4-82 2B-B.

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 3 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2 (Continued) To open and Fails to Mechanical DG Room exh. Tornado None (See Redundant DG system allow air flow open, or Failure fan low flow induced Remarks) is available if a during opens alarm in Main differential mechanical failure is the tornado initially and If the DG room Control Room pressure result of damper failure.

watch / then closes exhaust fan resulting from air across damper warning during low flow switches FS- in closed When a tornado watch conditions for tornado temperature 30-447 or FS position could or warning is declared pressure watch or switches have 451 for Train 1A- damage by the National Weather equalization warning cooled down A, damper and Service for this area, below their FS-30-449 or FS- result in partial the motor operated setpoint value,30-453 for Train or complete intake dampers can be they will 1B-B, loss of opened by starting the prevent FS-30-448, 452 ventilation to DG room exhaust fans.

manual start of for 2A-A, and FS- DG room To assure that the DG the fans and 30-450 or 454 for room exhaust fans will opening of the train 2B-B. start and continue to run subject during conditions when dampers until the DG exhaust fan low the reset temperature cut-out setpoint is switches would reached. normally prevent operation, tornado bypass switches have been added to the control system for each exhaust fan. These switches are placed in the bypass position during the tornado watch / warning and then returned to their WBNP-99 NORMAL position once 9.4-83 the tornado watch /

warning has been cancelled.

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 4 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2 (Continued) With the tornado bypass switches placed in the bypass position, the dampers can be opened by starting the DG room exhaust fans using handswitches mounted on the MCCS or locally in the exhaust fan rooms.

9.4-84 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 5 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 3 Fire damper Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC between Diesel between fire failure System need not be Generator Room Diesel Gen postulated as being

& Air Exhaust Room and concurrent with fire.

Room Air Exhaust Room 0-30-607 for Train Closed Mechanical Diesel Gen Partial loss of None Redundant train diesel 1A-A, during other (fusible link) Room exh fan ventilation of (See Remarks) generator system is modes of failure low flow alarm in associated started by operator 0-30-609 for Train operation Main Control safety train 1B-B, Room from fan Diesel Gen air flow switches Room.

0-30-608 for Train FS-30-447 or 2A-A, FS-30-451 for Train 1A-A, 0-30-610 for Train FS-30-449 or FS-2B-B 30-453 for Train 1B-B, FS-30-448 or FS-30-452 for Train 2A-A, and FS-30-450 or FS-30-454 for Train 2B-B 9.4-85 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 6 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 4 Diesel Generator Provide Fails to start Electrical or Diesel Gen Partial loss of None Redundant train diesel Room exhaust ventilation air Mechanical Room exh fan adequate generator system is fans low flow alarm in ventilation for started by operator.

Stops Electrical or Main Control maintenance of 1-FAN-30-447 running Mechanical Room (Refer to design *Operator can verify if 1-FAN-30-451 for Figure 9.4-25) temperature not result of fire, reopen Train 1A-A, from air flow fire dampers and start Stops on System logic switches exhaust fans from 1-FAN-30-449 spurious FS-30-447 or handswitches 1-FAN-30-453 for CO2 FS-30-451 for Train 1B-B, actuation* Train 1A-A, FS-30-449 or 2-FAN-30-448 FS-30-453 for 2-FAN-30-452 for Train 1B-B, Train 2A-A, and FS-30-448 or FS-30-452 for 2-FAN-30-450, Train 2A-A, and 2-FAN-30-454 for FS-30-450 or Train 2B-B FS-30-454 for Train 2B-B Fails to stop Electrical Surveillance Drop in DG None (See Redundant train diesel on low temp Room temp Remarks) generator system is available.

9.4-86 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 7 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 5 Motor-operated To prevent air Closed Mechanical Diesel Gen Loss of 50% None (See Redundant train diesel discharge flow when during Room exh fan ventilation flow Remarks) generator system is dampers of dieselassociated associated Loss of power low flow alarm in required to started by operator generator room diesel exhaust fan (dampers fail Main Control maintain the exhaust fans generator operation as-is) Room from air environmental exhaust fan (see note in flow switches qualification Train 1A-A is remarks) FS-30-447 or temperatues in 1-FCO-30-447 for deenergized FS-30-451 for the DG room.

Fan 1, and Train 1A-A, FS-1-FCO-30-451 for 30-449, or Fan 2 FS-30-453 for Train 1B-B, FS-30-448 or Train 1BB FS-30-452; 1-FCO-30-449 for for Train 2A-A, Fan 1, and and FS-30-450, 1-FCO-30-453 for FS-30-454 Fan 2 for Train 2B-B Train 2A-A, 2-FCO-30-448 for Fan 1, 2-FCO-30-452 for Fan 2 Train 2B-B 2-FCO-30-450 for Fan 1 ,

2-FCO-30-454 for Fan 2 9.4-87 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 8 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 5 (Continued) To open and Fails to Mechanical Diesel Gen. Tornado None (See Redundant DG system allow air flow open, or Failure Room exh. fan induced Remarks) is available if a during opens low flow alarm in differential mechanical failure is the tornado initially and If the DG room Main Control pressure result of damper failure.

watch / then closes exhaust fan Room from air across damper When a tornado watch warning during low flow switches FS- in closed or warning is declared conditions for tornado temperature 30-447 or FS position could by the National Weather pressure watch or switches have 451 for Train 1A- damage Service for this area, the equalization warning cooled down A, damper and motor operated intake below their FS-30-449 or FS- result in partial dampers can be opened setpoint value,30-453 for Train or complete by starting the DG room they will 1B-B, loss of exhaust fans. To assure prevent FS-30-448 or 452 ventilation to that the DG room manual start of for 2A-A, and FS- DG room exhaust fans will start the fans and 30-450 or 454 for and continue to run opening of the 2B-B. during conditions when subject the DG exhaust fan low dampers until temperature cut-out the reset switches would normally setpoint is prevent operation, reached. tornado bypass switches have been added to the control system for each exhaust fan. These switches are placed in the bypass position during the tornado watch / warning and then returned to their NORMAL position once the tornado watch WBNP-99

/ warning has been 9.4-88 cancelled.

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 9 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 5 (Continued) With the tornado bypass switches placed in the bypass position, the dampers can be opened by starting the DG room exhaust fans using handswitches mounted on the MCCs or locally in the exhaust fan rooms.

6 Fire dampers of Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC Elec. BD Rooms between fire failure System need not be intake vent Elec. BD postulated as being Room & concurrent with fire.

0-30-595 outside 0-30-596 0-30-597 Closed Mechanical Loss of None Redundant train diesel 0-30-598 during other failure ventilation of (See Remarks) generator system is modes of associated started by operator operation Elec. BD Room and rise of space temp.

9.4-89 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 10 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 7 Fire dampers of Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC Elec. BD Rooms between fire failure System need not be exhaust Elec. BD postulated as being Rooms & Air concurrent with fire.

0-30-599 Exh Rooms 0-30-600 0-30-601 Closed Mechanical Surveillance & Loss of None Redundant train diesel 0-30-602 during other failure Maintenance ventilation of (See Remarks) generator system is modes of associated started by operator operation Elec. BD Room and rise of space temp.

8 Electric BD Room Provide Fails to Electrical, Surveillance & Loss of None (See Redundant train diesel exhaust fans ventilation air start; stops Mechanical Maintenance ventilation of Remarks) generator system is running, associated started by operator 1-FAN-30-459 for Spurious Elec. BD Room Train 1A-A, CO2 system and rise of *If failures resulted from actuation* space temp spurious actuation of 1-FAN-30-461 for the CO2 system, Train 1B-B, operator can verify and restart the fans from 2-FAN-30-460 for hand switches.

Train 2A-A, and 2-FAN-30-462 for Operates Operator Surveillance Decrease of None (See Analyses have shown Train 2B-B during action not space temp. Remarks) that no adverse effect winter performed per below freezing will occur on safety-site operating related equipment as a procedure result of below freezing temperatures; therefore, operation of WBNP-99 the fan is allowed in 9.4-90 winter.

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 11 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 9 Motor-operated To prevent air Closed Mechanical Surveillance & Loss of None (See Redundant train diesel discharge damper flow when during Mechanical ventilation of Remarks) generator system is of Elec. BD Room associated associated associated started by operator exhaust fans Elec. BD exhaust fan Elec. BD Room Room operation and rise of 1-FCO-30-459 for exhaust fan space temp. NOTE: These dampers Train 1A-A, is are to be open by deenergiized handswitches 1-FCO-30-461 for 0-HS-30-459B Train 1B-B, or 0-HS-30-459C for Train 1A-A; 0-HS 2-FCO-30-460 for 461B or 0-HS-30-461C Train 2A-A, and for Train 1B-B; 0-HS-30-460B or 0-HS 2-FCO-30-462 for 460C for Train 2A-A Train 2B-B and 0-HS-30-462B or 0-HS-30-462C for Train 2B-B when tornado watch or warning is declared by National Weather Service for this area.

9.4-91 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 12 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 10 Generator & Provide Fails to Electrical Low air flow Loss of None Redundant train diesel Electrical Panels ventilation for start; stops Mechanical alarm in Main ventilation air (See Remarks) generator system is ventilation fans elec. panel & running Control Room via supply to started by operator to generator air flow switches associated 1-FAN-30-491 inlet FS-30-491 for elec. panel and for Train 1A-A, Train 1A-A, generator inlet FS-30-493 for 1-FAN-30-493 Train 1B-B, for train 1B-B, FS-30-492 for Train 2A-A, and 2-FAN-30-492 FS-30-494 for for Train 2A-A, Train 2B-B 2-FAN-30-494 for Train 2B-B 11 Filters for elec Filter the Clogged Accumulation Surveillance & Rise of temp in None Redundant train diesel panel ventilation ventilation air of dirt Maintenance the elec panel (See Remarks) generator system is air supply supplied to due to reduced started by operator elec panel supply of vent 1-FLT-30-491 for air Train 1A-A, 1-FLT-30-493 for Train 1B-B, 2-FLT-30-492 for Train 2A-A, 2-FLT-30-494 for Train 2B-B 9.4-92 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 13 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 12 Class 1E AC Provide Loss of or Electrical Indication and Loss of power None Redundant train diesel power Class 1E AC inadequate alarms in Main to diesel (See Remarks) generator system is power to power Control Room generator available for the plant safety- building safe shutdown related ventilation portions of system safety-the diesel related generator equipment building ventilation system 13 Class 1E AC Provide Loss of or Electrical Indication and Loss of control None Redundant train diesel power to Class 1E inadequate alarms in main of the diesel (See Remarks) generator system is instrumentation power to power control room generator available for the plant and control safety- ventilation safe shutdown.

related diesel system safety generator related building equipment ventilation system controls and instrumentati on 9.4-93 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 14 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 14 Non-safety Provide On during Spurious Surveillance & Increase of None. (See Redundant train diesel heaters heating summer operation Maintenance Diesel Gen. Remarks) generator system is during winter LOCA Room & Air available for the plant 1-HTR-30-471, normal operation Exh. Room safe shutdown 1-HTR-30-472 operation temp. above for Diesel Gen. environmental 1A-A Room; design conditions 1-HTR-30-473, 1-HTR-30-474 for Electrical Diesel Gen. 1B-B Off during Surveillance Drop in Diesel None. (See Same as above Room; winter Gen Room Remarks) conditions temp 2-HTR-30-475, 2-HTR-30-476 for diesel gen. 2A-A Room; and 2-HTR-30-477, 2-HTR-30-478 for diesel gen.

2B-B Room 9.4-94 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 15 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 15 Non-safety Provide On during Spurious Surveillance & Increase 480V None. (See Redundant train diesel heaters heating summer operation Maintenance BD Room Remarks) generator system is during winter LOCA temp. above available for the plant 1-HTR-30-487 for normal operation environmental safe shutdown 480V BD operation design Room 1-A-A, conditions 1-HTR-30-489 for 480V BD Off during Electrical Surveillance Drop in 480V None. (See Redundant trains diesel Room 1B-B, winter board room Remarks) generator system is operation temp. available for the plant 2-HTR-30-488 for safe shutdown.

480V BD Room 2A-A, and 2-HTR-30-490 for 2B-B Room 16 Nonsafety heaters Provide Off during Electrical Surveillance & Decrease in None. Minimum temperature in heating winter Maintenance Pipe Gallery (See Remarks) pipe gallery is calculated 0-HTR-30-479 during winter operation Room temp to be 36.3oF.

0-HTR-30-480 normal below 0-HTR-30-481 operation environmental 0-HTR-30-482 for design the Pipe Gallery conditions 17 Toilet Room Provide Fails to Electrical or Surveillance & Loss of None. (See Maximum temperature exhaust fan cooling and start; stops Mechanical Maintenance adequate Remarks) in corridor is calculated 0-FAN-469 ventilation for running ventilation for to be 120oF the toilet and maintenance of corridor design temp 9.4-95 WBNP-99

Table 9.4-4 FAILURE MODES AND EFFECTS ANALYSIS DIESEL GENERATOR VENTILATION SYSTEM (Sheet 16 of 16)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON

1. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 18 Muffler Rm Removes Fails ON Electrical Surveillance None. (See None,. Each fan, located on Exhaust Fan heat from during operation Remarks) (See Remarks) the roof, is interlocked Muffler Room minimum (Switch in with its respective 1-FAN-30-463 Area during outside wrong position) diesel. The fan starts 1-FAN-30-465 Diesel design when its diesel starts. It 1-FAN-30-464 Operation condition can also be started 1-FAN-30-466 and diesel from a hand switch. In not the event of a spurious operating start during minimum outside temperature conditons, and its diesel not operating, an analysis has shown that the fan would not cause any adverse conditions on the diesel operation.

9.4-96 WBNP-99

WATTS BAR WBNP-99 Table 9.4-4a Deleted by Amendment 94 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-97

WATTS BAR WBNP-99 THIS PAGE INTENTIONALLY BLANK AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-98

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-5 (Sheet 1 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1 1-AHU-31-461-A Provides cooling air Fails to run; Mechanical Annunciation of 480 V Loss of capability to None; See Remarks 1. Failures of the cooling coil, fan, supply to 480 V Board Fails while failure; Train A Board Room 1A HVAC provide cooling air to motor, and filter are enveloped by the Air Handling Unit Room 1A Battery running power failure; System abnormal for 480 V Board Room failure of the AHU.

1A-A for 480 V Room I, and to Train Control signal 1-FS-31-460 closed 1A and Battery Board Board Room 1A A equipment in Board failure; on low flow from AHU Room I and partial 2. The Condenser 1A-A and and Battery Room Room 1B, and Train Temperature 1A-A loss of cooling to Compressor 1A-A are interlocked to I (Train A) B press fan, Fifth Vital control sensing FVBR. automatically stop or start with the Battery Rm. (FVBR) failure at Indicating lights in AHU 1A-A stop or start.

1-TS-31-441A; MCR (1-HS-31-461A).

low flow control Motor running light on 3. Board Room 1B and Battery sensing failure at MCC. Room II provide the redundancy.

1-FS-31-460; Operator error No indication in MCR 4. Operator actions are defined to (handswitch of a low temperature deal with loss of train A cooling 1-HS-31-461B in sensing failure other wrong position) than indication that the 5. Battery Room 1 and FVBR can be Hardware related AHU is not running. exhausted from the pressurizing fan failures; i.e., supply air to provide hydrogen motor burns out, ventilation. Prepared calculations fan drive belt indicate that sufficient cooling is still failures, loss of available to assure the battery rooms refrigerant to the remain below the maximum Cooling Coil, temperature limits.

and/or restricted air flow path.

9.4-99 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 2 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 2 1-AHU-31-475-B Provides cooling air Fails to run; Mechanical Annunciation of 480 V Loss of capability to None; See Remarks 1. Failures of the cooling coil, fan, supply to 480 V Board Fails while failure; Train B Board Room 1B HVAC provide cooling air to motor, and filter are enveloped by the Air Handling Unit Room 1B Battery running power failure; System abnormal for 480 V Board Room failure of the AHU.

1B-B for 480 V Room II Control signal 1-FS-31-476 closed 1B and Battery Board Board Room 1B failure; on low flow from AHU Room II 2. The Condenser 1B-B and and Battery Room Temperature 1B-B Compressor 1B-B are interlocked to II (Train B) control sensing automatically stop or start with the failure at Indicating lights in Battery Room II will AHU 1B-B stop or start.

1-TS-31-447A; MCR continue to be low flow control (1-HS-31-475-A). ventilated. The 3. A review of the schemiatics sensing failure at Motor running light on pressurizing fan will establishes the separation of the AC 1-FS-31-476; MCC. supply air to the system: for the 480V Board Room 1A Operator error battery room through with Battery Room I and its redundant (handswitch the AHU duct. 480V Board Room II.

1-HS-31-475B in wrong position) Loss of Train A 4. Train A provides cooling to the No indication in MCR equipment located in Train A components in the 480V of a low temperature these rooms. Board Room 1B.

sensing failure other than indication that the 5. Operator actions are defined to AHU is not running. deal with a loss of Training B cooling 9.4-100 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 3 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 3 2-AHU-31-461-A Provides cooling air Fails to run; Mechanical Annunciation of 480 V Loss of capability to None; See Remarks 1. Failures of the cooling coil, fan, supply to 480 V Board Fails while failure; Train A Board Room 2A HVAC provide cooling air to motor, and filter are enveloped by the Air Handling Unit Room 2A Battery running power failure; System abnormal for 480 V Board Room failure of the AHU.

2A-A for 480 V Room III, and to Train Control signal 2-FS-31-460 closed 2A and Battery Board Board Room 2A A equipment in Board failure; on low flow from AHU Room III. 2. The Condenser 2A-A and and Battery Room Room 2B, and Train Temperature 2A-A Compressor 2A-A are interlocked to III B press fan control sensing automatically stop or start with the (Train A) failure at Indicating lights in Battery Room III will AHU 2A-A stop or start.

2-TS-31-441A; MCR continue to be low flow control (2-HS-31-461-A). ventilated. The 3. Board Room 2B and Battery Room sensing failure at Motor running light on pressurizing fan will IV provide the redundancy.

2-FS-31-460; MCC. supply air to the Operator error battery room through 4. Operator actions are identified to (handswitch the AHU duct. deal with a loss of Train A cooling.

2-HS-31-461B in wrong position) No indication in MCR Loss of Train A 5. Battery Rm I can be exhausted of a low temperature equipment located in from the pressurizing fan supply air to sensing failure other these rooms. provide hydrogen ventilation.

than indication that the Calculations indicate that sufficient AHU is not running. cooling is still available to assure the battery rooms remain below the maximum temperature limit.

9.4-101 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 4 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 4 2-AHU-31-475-B Provides cooling air Fails to run; Mechanical Annunciation of 480 V Loss of capability to None: See Remarks 1.Failures of the cooling coil, fan, supply to 480 V Board Fails while failure; Train B Board Room 2B HVAC provide cooling air to motor, and filter are enveloped by the Air Handling Unit Room 2B Battery running power failure; System abnormal for 480 V Board Room failure of the AHU.

2B-B for 480 V Room IV Control signal 2-FS-31-476 closed 2B and Battery Board Board Room 2B failure; on low flow from AHU Room IV 2. The Condenser 2B-B and and Battery Room Temperature 2B-B Compressor 2B-B are interlocked to IV (Train B) control sensing automatically stop or start with the failure at Indicating lights in Battery Room IV will AHU 2B-B stop or start.

2-TS-31-447A; MCR continue to be low flow control (2-HS-31-475A). ventilated. The 3. Board Room 2A and Battery Room sensing failure at Motor running light on pressurizing fan will III provide the redundancy.

2-FS-31-476; MCC. supply air to the Operator error battery room through 4. Train A provides cooling to the (handswitch the AHU duct. Train A components in the 480V 2-HS-31-475B in Board Room 2B.

wrong position) No indication in MCR Loss of Train A 5. Operator actions are defined to of a low temperature equipment located in deal with a loss of Train B cooling.

sensing failure other these rooms.

than indication that the AHU is not running.

9.4-102 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 5 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 5 1-COND-31-290-A Provides refrigerant Fails to run; Mechanical Motor running light on Loss of cooling to 480 None 1. Failure of the condenser to AHU 1A-A Stops while failure; Train A MCC V Board Room 1A envelopes failure of its fan, coils and Air Cooled running power failure; The Battery Room I motor.

Condenser Unit Start signal will be ventilated by 1A-A failure. the air supply from the 2. The condenser is interlocked to Pressurizing Fan to automatically start or stop with the provide Hydrogen AHU and compressor start or stop.

ventilation.

3. The condenser is interlocked to automatically open 1-FSV-31-290 when running and close it when stopped.

4. Board Room 1B and Battery Room II provide the redundancy.

5. Actions are defined that deal with a loss of Train A cooling.

6. Battery Room I can be exhausted from the pressurizing fan supply air to provide hydrogen ventilation.

Calculations indicate that sufficient cooling is still available to assure the battery rooms remain below the maximum temperature limit.

9.4-103 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 6 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 6 1-COND-31-289-B Provides refrigerant Fails to run; Mechanical Motor running light on Loss of cooling to 480 None (See Remarks) 1. Failure of the condenser to AHU 1B-B Stops while failure; Train B MCC V Board Room 1B envelopes failure of its fan, coils and Air Cooled running power failure; The Battery Room II motor.

Condenser Unit Start signal will be ventilated by 1B-B failure. the air supply from the 2. The condenser is interlocked to Pressurizing Fan to automatically start or stop with the provide Hydrogen AHU and compressor start or stop.

ventilation.

3. The condenser is interlocked to automatically open 1-FSV-31-289 when running and close it when stopped.

4. Board Room 1A and Battery Room I provide the redundancy.

5. The Train A equipment located in the Board Room 1B is cooled by Train A.

9.4-104 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 7 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 7 2-COND-31-290-A Provides refrigerant Fails to run; Mechanical Motor running light on Loss of cooling to 480 None (See Remarks) 1. Failure of the condenser to AHU 2A-A Stops while failure; Train B MCC V Board Room 2A envelopes failure of its fan, coils and Air Cooled running power failure; The Battery Room III motor.

Condenser Unit Start signal will be ventilated by 2A-A failure. the air supply from the 2. The condenser is interlocked to Pressurizing Fan to automatically start or stop with the provide Hydrogen AHU and compressor start or stop.

ventilation.

3. The condenser is interlocked to automatically open 2-FSV-31-290 when running and close it when stopped.

4. Board Room 2B and Battery Room IV provide the redundancy.

9.4-105 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 8 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 8 2-COND-31-289-B Provides refrigerant Fails to run; Mechanical Motor running light on Loss of cooling to 480 None (See Remarks) 1. Failure of the condenser to AHU 2B-B Stops while failure; Train A MCC V Board Room 2B envelopes failure of its fan, coils and Air Cooled running power failure; The Battery Room IV motor.

Condenser Unit Start signal will be ventilated by 2B-B failure. the air supply from the 2. The Condenser is interlocked to Pressurizing Fan to automatically start or stop with the provide Hydrogen AHU and compressor start or stop.

ventilation.

3. The condenser is interlocked to automatically open 2-FSV-31-289 when running and close it when stopped.

4. Board Room 2A and Battery Room III provide the redundancy.

5. The Train A equipment located in the Board Room 2B will be cooled by Train A.

9.4-106 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 9 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 9 1-FCO-31-290 Provides exhaust flow Fails to open Mechanical failure Indicating lights in Loss of ability to None (See Remarks) 1. Interlocked with Condensing Unit path for Condensing (stuck closed) MCR (1-ZS-31-290) exhaust from 1A-A via 1-FSV-31-290 to Exhaust Damper Unit 1A-A condensing Unit 1A-A automatically open on ACU start.

for ACU 1A-A

2. A review of the Control Air flow diagrams shows that nonsafety control air is supplied to both 1-FC0-31-290 and 289.

3. The exhaust damper is air operated and fails open upon loss of air or Train A power.

4. Board Room 1B and Battery Room II provide the redundancy.

9.4-107 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 10 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 10 2-FCO-31-290 Provides exhaust flow Fails to open Mechanical failure Indicating lights in Loss of ability to None (See Remarks) 1. Interlocked with Condensing Unit path for Condensing (stuck closed) MCR (2-ZS-31-290) exhaust from 2A-A via 2-FSV-31-290 to Exhaust Damper Unit 2A-A condensing Unit 2A-A automatically open on ACU start.

for AHU 2A-A

2. A review of the Control Air flow diagrams shows that nonsafety control air is supplied to both 2-FC0-31-290 and 289.

3. The exhaust damper is air operated and fails open upon loss of air or Train A power.

4. Board Room 2B and Battery Room IV provide the redundancy.

9.4-108 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 11 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 11 1-FAN-31-462-A Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train A MCR pressurizing air mounted stop-start push button Pressurizing Board Room 1A running power failure; (1-HS-31-462 A). supply to 480 V Board stations in conjunction with auto-start Supply Fan 1A1-A Battery Room I and Control signal Locally, Room 1A and Battery switches in MCR.

(Train A) partial makeup air to failure; Operator 1-HS-31-462B. ANN Room I and V the Fifth Vital Battery error (handswitch 19-9 low flow from 2. Pressurizing Fan 1A1-A is Room. in wrong position) Press. Fans Low flow on interlocked with Battery Board Room 1-FS-31-463-B will I Exhaust Fan 1A2-B and 480 V automatically stop Room 1A Fan 1A2-B such that when Fan 1A1-A and Fan 1A1-A is in auto-standby, low Battery Board Room flow on either of the 1A2-B Fans will Exhaust fan 1A1-A start 1-FAN-31-462-A and stop 1-and, will automatically FAN-31-463-B.

start Fan 1A2-B and Battery Room 3. A review of the schematics Exhaust fan 1A2-B. establishes the separation and redundancy of the train A and B fans.

(See Remark #2.) The loss of nondivisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None (See Remarks) Insignificant increase in air flow to when Train B signal; Hot short MCR (1-HS-31-462A). 480 V Board Room 480 V Board Room 1A and fan starts. in control wiring; 1A. Mechanical Equipment Room 1A.

Operator error. Battery room I will not be (See 'Remarks') overpressurized without second failure.

9.4-109 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 12 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 12 1-FAN-31-463-B Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train B MCR pressurizing air mounted stop-start push button Pressurizing Board Room 1A running power failure; (1-HS-31-463 A). supply to 480 V Board stations in conjunction with auto-start Supply Fan 1A2-B Battery Room I and Control signal Locally, Room 1A and Battery switches in MCR.

(Train B) partial makeup air to failure; Operator 1-HS-31-463B. ANN Room I and V the FVBR error (handswitch 19-9 low flow from 2. Pressurizing Fan 1A2-B is in wrong position) Press. Fans Low flow on interlocked with Battery Board Room 1-FS-31-462-A will I Exhaust Fan 1A1-A and 480 V automatically stop Room 1A Fan 1A1-A such that when Fan 1A2-B and Fan 1A2-B is in auto-standby, low Battery Board Room flow of either of the 1A1-A Fans will Exhaust fan 1A2-B start 1-FAN-31-463B and stop and, will automatically 1-FAN-31-462A.

start Fan 1A1-A and Battery Room 3. A review of the schematics Exhaust fan 1A1-A. establishes the separation and redundancy of the Train A and B (See Remark #2.) fans. The loss of nondivisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None (See Remarks) Insignificant increase in air flow to when Train A signal; Hot short MCR (1-HS-31-463A). 480 V Board Room 480 V Board Room 1A and fan starts. in control wiring; 1A. Mechanical Equipment Room 1A.

Operator error. Battery room I will not be (See 'Remarks') overpressurized without a second failure.

9.4-110 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 13 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 13 1-FAN-31-478-A Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train B MCR (1-HS-31-478A). pressurizing air mounted stop-start push button Pressurizing Board Room 1B running power failure; Locally, supply to 480 V Board stations in conjunction with auto-start Supply Fan 1B1-A Battery Room II and Control signal 1-HS-31-478B ANN Room 1B and Battery switches in MCR.

(Train A) partial makeup air to failure; Operator 19-11 low flow from Room II the FVBR error (handswitch Press. Fans 2. Pressurizing Fan 1B1-A is in wrong position) Low flow on interlocked with Battery Room I 1-FS-31-477-B will Exhaust Fan 1B-A and 480 V Room automatically stop 1B pressurizing Fan 1B2-B such that Fan 1B1-A and when Fan 1B1-A is in auto-standby, Battery Board Room low flow on either of the 1B2-B Fans Exhaust fan 1B1-A will start 1-FAN-31-478-A and stop and, will automatically 1-FAN-31-477-B.

start Fan 1B2-B and Battery Room 3. A review of the schematics Exhaust fan 1B2-B. establishes the separation and (See Remark #2.) redundancy of the Train A and B fans. The loss of nondivisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None (See Remarks) Insignificant increase in air flow to when Train B signal; Hot short MCR (1-HS-31-478A). 480 V Board Room 480 V Board Room 1B and fan starts. in control wiring; 1B. Mechanical Equipment Room 1B.

Operator error. Battery room I will not be (See 'Remarks') overpressurized without second failure.

9.4-111 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 14 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 14 1-FAN-31-477-B Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See 'Remarks') 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train B MCR (1-HS-31-477A). pressurizing air mounted stop-start push button Pressurizing Board Room 1B and running power failure; Locally, HS-31-477B supply to 480 V Board stations in conjunction with auto-start Supply Fan 1B2-B Battery Room II and Control signal ANN 19-11 low flow Room 1B and Battery switches in MCR.

(Train B) partial makeup air to failure; Operator from Press. Fans Room II the FVBR error (handswitch 2. Pressurizing Fan 1B2-B is in wrong position) Low flow on interlocked with Battery Room II 1-FS-31-478-A will Exhaust Fan 1B2-B and 480 V Room automatically stop 1B pressurizing Fan 1B1-A such that Fan 1B2-B and when Fan 1B2-B is in auto-standby, Battery Room low flow on either of the 1B1-A Fans Exhaust fan 1B2-B will start 1-FAN-31-477-B and stop and, will automatically 1-FAN-31-478-A.

start Fan 1B1-A and Battery Room 3. A review of the schematics Exhaust fan 1B1-A. establishes the separation and redundancy of the Train A and B (See Remark #2.) fans. The loss of non-divisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None (See 'Remarks') Insignificant increase in air flow to when Train A signal; Hot short MCR 480 V Board Room 480 V Board Room 1B and fan starts. in control wiring; (1-HS-31-477A-B). 1B. Mechanical Equipment Room 1B.

Operator error. Battery room II will not be (See 'Remarks') overpressurized without a second failure.

9.4-112 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 15 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 15 1-FAN-31-287-A Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan Battery Room 1 to Fails while failure; Train A for Damper exhausting Battery 1A1-A such that the Battery Room Exhaust Fan prevent hydrogen running. power failure; 1-FCO-31-287-A Room 1. Exhaust Fan starts when the 1A1- A for Battery build-up. spurious low flow closure. Motor Pressurizing Fan starts and stops Room 1 (Train A). signal. running light on MCC. On low flow from when the Pressurizing Fan stops.

pressurizing or Battery Room 2. A review of the schematics Exhaust Fan 1A1-A, establishes the independence of the the Train B Train A and B fans.

Pressurizing Fan 1A2-B and the Battery Room Exhaust Fan 1A2-B will automatically start. Damper 1-FCO-31-288-B will open.

9.4-113 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 16 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 16 1-FAN-31-288-B Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. (See Remarks) 1. Interlocked with Pressurizing Fan Battery Room 1 to Fails while failure; Train B for damper exhausting Battery 1A2-B such that the Battery Room Exhaust Fan 1A2- prevent hydrogen running. power failure; 1-FCO-31-288-B Room 1. Exhaust Fan starts when the B for Battery build-up. spurious low flow closure. Motor Pressurizing Fan starts and stops Room 1 (Train B). signal. running light on MCC. On low flow from when the Pressurizing Fan stops.

pressurizing or Battery Room 2. A review of the schematics Exhaust Fan 1A2-B, establishes the independence of the the Train A Train A and B fans.

Pressurizing Fan 1A1-A and the Battery Room Exhaust Fan 1A2-B will automatically start. Damper 1-FCO-31-287-A will open.

9.4-114 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 17 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 17 1-FAN-31-285-A Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan Battery Room II to Fails while failure; Train A for damper exhausting Battery 1B1-A such that the Battery Room Exhaust Fan 1B1- prevent hydrogen running. power failure; 1-FCO-31-285-A Room II. Exhaust Fan starts and stops whtn A for Battery II build-up. spurious low flow closure. Motor the Pressurizing Fan starts.

(Train A) signal. running light on MCC. One low flow from pressurizing or 2. A review of the schematics Battery Room restablishes the independance of the Exhaust Fan 1B1-A, Train A and B fans.

the Train B Pressurizing Fan 1B2-B and the Battery Room Exhaust Fan will automaticaly start.

Damper 1-FCO-31-286-A will open.

9.4-115 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 18 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 18 1-FAN-31-286-B Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan Battery Room II to Fails while failure; Train B for Damper exhausting Battery 1B2-B such that the Battery Room Exhaust Fan 1B2- prevent hydrogen running. power failure; 1-FCO-31-286-B Room II. Exhaust Fan starts when the B for Battery build-up. spurious low flow closure. Motor Pressurizing Fan starts and stops Room II (Train B). signal. running light on MCC. On low flow from when the Pressurizing Fan stops.

pressurizing or Battery Room 2. A review of the schematics Exhaust Fan 1B2-B, establishes the independence of the the Train A Train A and B fans.

Pressurizing Fan 1B1-A and the Battery Room Exhaust Fan 1B1-A will automatically start. Damper 1-FCO-31-285-B will open.

9.4-116 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 19 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 19 2-FAN-31-462-A Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train A MCR pressurizing air mounted stop-start push button Pressurizing Board Room 2A and running power failure; (2-HS-31-462-A). supply to 480 V Board stations in conjunction with auto-start Supply Fan 2A1-A Battery Room IV. Control signal Locally, Room 2A and Battery switches in MCR.

(Train A) failure; Operator 2-HS-31-462B. ANN Room IV error (handswitch 19-9 low flow from 2. Pressurizing Fan 2A1-A is in wrong position) Press. Fans Low flow on interlocked with Battery 2-FS-31-462-A will Room IV Exhaust Fan 2A2-B and 480 automatically stop V Room 2A Fan 2A2-B such that Fan 2A1-A and when Fan 2A1-A is in auto-standby, Battery Room low flow on either of the 2A2-B Fans Exhaust fan 2A1-A; will start 2-FAN-31-462-A and stop and, will automatically 2-FAN-31-463-B.

start Fan 2A2-B and Battery Room 3. A review of the schematics Exhaust fan 2A2-B. establishes the separation and redundancy of the Train A and B See Remark #2. fans. The loss of non-divisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None (See Remarks) Insignificant increase in air flow to when Train B signal; Hot short MCR (2-HS-31-462A). 480 V Board Room 480 V Board Room 2A and fan starts. in control wiring; 2A. Mechanical Equipment Room 2A.

Operator error. Battery room IV will not be (See Remarks) overpressurized without a second failure.

9.4-117 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 20 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 20 2-FAN-31-463-B Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train B MCR pressurizing air mounted stop-start push button Pressurizing Board Room 2A and running power failure; (2-HS-31-463-A). supply to 480 V Board stations in conjunction with auto-start Supply Fan 2A2-B Battery Room IV. Control signal Locally, 2-HS-31-463B Room 2A and Battery switches in MCR.

(Train B) failure; Operator ANN 19-9 low flow Room IV error (handswitch from Press. Fans 2. Pressurizing Fan 2A2-B is in wrong position) Low flow on interlocked with Battery Board Room 2-FS-31-463-B will IV Exhaust Fan 2A1-A and 480 V automatically stop Room 2A Fan 2A1-A such that when Fan 2A2-B and Fan 2A2-B is in auto-standby, low Battery Room flow on either of the 2A1-A Fans will Exhaust fan 2A2-B start 2-FAN-31-463-B and stop and, will automatically 2-FAN-31-462-A.

start Fan 2A1-A and Battery Room 3. A review of the schematics Exhaust fan 2A1-A. establishes the separation and redundancy of the Train A and B See Remark #2. fans. The loss of non-divisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None(See Remarks) Insignificant increase in air flow to when Train A signal; Hot short MCR (2-HS-31-463A). 480 V Board Room 480 V Board Room 2A and fan starts. in control wiring; 2A. Mechanical Equipment Room 2A.

Operator error. Battery room IV will not be (See Remarks) overpressurized without a second failure.

9.4-118 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 21 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 21 2-FAN-31-478-A Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train A MCR pressurizing air mounted stop-start push button Pressurizing Board Room 2B and running power failure; (2-HS-31-478-A). supply to 480 V Board stations in conjunction with auto-start Supply Fan 2B1-A Battery Room III. Control signal Locally, Room 2B and Battery switches in MCR.

(Train A) failure; Operator 2-HS-31-478B. ANN Room III error (handswitch 19-11 low flow from 2. Pressurizing Fan 2B1-A is in wrong position) Press. Fans Low flow on interlocked with Battery Board 2-FS-31-478-A will Room IV Exhaust Fan 2B2-B and 480 automatically stop V Room 2B Fan 2B2-B such that Fan 2B1-A and when Fan 2B1-A is in auto-standby, Battery Room low flow on either of the 2B2-B Fans Exhaust fan 2B1-A will start 2-FAN-31-478-A and, will automatically and stop 2-FAN-31-477-B.

start Fan 2B2-B and Battery Room 3. A review of the schematics Exhaust Fan 2B2-B. establishes the separation and redundancy of the train A and B fans.

See Remark #2. The loss of non-divisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None (See Remarks) Insignificant increase in air flow to when Train B signal; Hot short MCR (2-HS-31-478A). 480 V Board Room 480 V Board Room 2B and fan starts. in control wiring; 2B. Mechanical Equipment Room 2B.

Operator error. Battery room III will not be (See Remarks) overpressurized without a second failure.

9.4-119 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 22 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 22 2-FAN-31-477-B Provides pressurizing Fails to start; Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally air flow to 480 V Fails while failure; Train B MCR pressurizing air mounted stop-start push button Pressurizing Board Room 2B and running power failure; (2-HS-31-477-A). supply to 480 V Board stations in conjunction with auto-start Supply Fan 2B2-B Battery Room III. Control signal Locally, Room 2B and Battery switches in MCR.

(Train B) failure; Operator 2-HS-31-477-B. ANN Room III error (handswitch 19-11 low flow from 2. Pressurizing Fan 2B2-B is in wrong position) Press. Fans Low flow on interlocked with Battery Board Room 2-FS-31-477-B will III Exhaust Fan 2B1-A and 480 V automatically stop Room 2B Fan 2B1-A such that when Fan 2B2-B and Fan 2B2-B is in auto-standby, low Battery Room flow on either of the 2B1-A Fans will Exhaust fan 2B2-B start 2-FAN-31-477-B and, will automatically and stop 2-FAN-31-478-A.

start Fan 2B1-A and Battery Room 3. A review of the schematics Exhaust fan 2B1-A. establishes the separation and redundancy of the train A and B fans.

See Remark #2. The loss of non-divisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Failure to stop Spurious low flow Indicating lights in Overpressurization of None (See Remarks) Insignificant increase in air flow to when Train A signal; Hot short MCR (2-HS-31-477A). 480 V Board Room 480 V Board Room 2B and fan starts. control wiring; 2A. Mechanical Equipment Room 2B.

Operator error. Battery room III will not be (See Remarks) overpressurized without a second failure.

9.4-120 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 23 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 23 2-FAN-31-287-A Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. (See Remarks) 1. Interlocked with Pressurizing Fan Battery Room IV to Fails while failure; Train A for Damper exhausting Battery 2A1-A such that the Exhaust Fan Exhaust Fan prevent hydrogen running. power failure; 2-FCO-31-287-A Room IV. starts when the Pressurizing Fan 2A1- A for Battery build-up. spurious low flow closure. Motor starts and stops when the Room IV (Train A). signal. running light on MCC. On low flow from Pressurizing Fan stops.

pressurizing or Battery Room 2. A review of the schematics Exhaust Fan 2A1-A, establishes the independence of the the Train B Train A and B fans.

Pressurizing Fan 2A2-B and the Exhaust Fan 2A2-B will automatically start. Damper 2-FCO-31-288-B will open.

9.4-121 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 24 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 24 2-FAN-31-288-B Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. (See Remarks) 1. Interlocked with Pressurizing Fan Battery Room IV to Fails while failure; Train B for damper exhausting Battery 2A2-B such that the Exhaust Fan Exhaust Fan prevent hydrogen running. power failure; 2-FCO-31-288-A Room IV. starts when the Pressurizing Fan 2A2-B for Battery build-up. spurious low flow closure. Motor running starts and stops when the Room IV (Train B). signal. light on MCC. On low flow from Pressurizing Fan stops.

Pressurizing or Battery Room 2. A review of the schematics Exhaust Fan 2A1-B, establishes the independence of the the Train A Train A and B fans.

Pressurizing Fan 2A1-A and the Exhaust Fan 2A1-A will automatically start. Damper 2-FCO-31-287-A will open.

9.4-122 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 25 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 25 2-FAN-31-285-A Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. (See Remarks) 1. Interlocked with Pressurizing Fan Battery Room III to Fails while failure; Train A for damper exhausting Battery 2B1-A such that the Exhaust Fan Exhaust Fan prevent hydrogen running. power failure; 2-FCO-31-285-A Room III. starts when the Pressurizing Fan 2B1-A for Battery build-up. spurious low flow closure. Motor starts and stops when the III (Train A). signal. running light on MCC. On low flow from Pressurizing Fan stops.

Pressurizing or Battery Room 2. A review of the schematics Exhaust Fan 2B1-A, establishes the independence of the the Train B Train A and B fans.

Pressurizing Fan 2B2-B and the Exhaust Fan 2B2-B will automatically start. Damper 2-FCO-31-286-A will open.

9.4-123 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 26 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 26 2-FAN-31-286-B Exhausts air from Fails to start; Mechanical Local indicating light Loss of redundancy in None. (See Remarks) 1. Interlocked with Pressurizing Fan Battery Room III to Fails while failure; Train B for Damper exhausting Battery 2B2-B such that the Exhaust Fan Exhaust Fan prevent hydrogen running. power failure; 2-FCO-31-286-B Room III. starts when the Pressurizing Fan 2B2-B for Battery build-up. spurious low flow closure. Motor starts and stops when the Room III (Train B). signal. running light on MCC. On low flow from Pressurizing Fan stops.

pressurizing or Battery Room 2. A review of the schematics Exhaust Fan 2B2-B, establishes the independence of the the Train A Train A and B fans.

Pressurizing Fan 2B1-A and the Battery Room Exhaust Fan 2B1-A will automatically start.

Damper 2-FCO-31-285-A will open.

27 1-FCO-31-287-A Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 1A1-A in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room I. in control wiring; damper status lights Room I. open by Battery Room I Exhaust Fan (Exhaust Fan Operator error (1-ZS-31-287B-A). 1A1-A. A review of the schematics 1A1-A.) (handswitch Low flow from 1A1-A establishes the independence of the placed in wrong Fans will control of Dampers 1-FCO-31-288-B position). automatically stop the and fan from Train A, start 1-FCO-31-287-A.

Train B Press. Fan 1A2-B and Exhaust Fan 1A2-B which will WBNP-99 open 9.4-124 1-FCO-31-288-B.

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 27 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 28 1-FCO-31-288-B Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 1A2-B in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room I. in control wiring; damper status lights Room I. open by Battery Room I Exhaust Fan (Exhaust Fan 1A2- Operator error (1-ZS-31-288A-B). 1A2-B. A review of the schematics B) (handswitch Low flow from 1A2-B establishes the independence of the placed in wrong Fans will control of Dampers position). automatically stop the 1-FCO-31-287-A and fan from Train B, start 1-FCO-31-288-B.

Train A Press. Fan 1A1-A and Exhaust Fan 1A1-A which will open 1-FCO-31-287-A.

29 1-FCO-31-285-A Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 1B1-A in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room II. in control wiring; damper status lights Room II. open by Battery Room II Exhaust Fan (Exhaust Fan Operator error (1-ZS-31-285B-A). 1B1-A. A review of the schematics 1B1-A) (handswitch Low flow from 1B1-A establishes the independence of the placed in wrong Fans control of Dampers position). will automatically stop 1-FCO-31-285-A and the fan from Train A, 1-FCO-31-286-B.

start Train B Press.

Fan 1B2-B and Exhaust Fan 1B2-B which will open 1-FCO-31-286-B.

9.4-125 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 28 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 30 1-FCO-31-286-B Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 1B2-B in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room II. in control wiring; damper status lights Room II. open by Battery Room II Exhaust Fan (Exhaust Fan Operator error (1-ZS-31-286A-B). 1B2-B. A review of the schematics 1B2-B). (handswitch Low flow from 1B2-B establishes the independence of the placed in wrong Fans control of Dampers position). will automatically stop 1-FCO-31-285-A and the fan from Train B, 1-FCO-31-286-B.

start Train A Press.

Fan 1B1-A and Exhaust Fan 1B1-A which will open 1-FCO-31-285-A.

31 2-FCO-31-287-A Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 2A1-A in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room IV. in control wiring; damper status lights Room IV. open by Battery Room IV Exhaust (Exhaust Fan Operator error (2-ZS-31-287B-A). Fan 2A1-A. A review of the 2A1-A). (handswitch Low flow from 2A1-A schematics establishes the placed in wrong Fans independence of the control of position). will automatically stop Dampers 2-FCO-31-287-A and the fan from Train A, 2-FCO-31-288-B.

start Train B Press.

Fan 2A2-B and Exhaust Fan 2A2-B which will open 2-FCO-31-288-B.

9.4-126 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 29 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 32 2-FC0-31-288-B Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 2A2-B in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room IV. in control wiring; damper status lights Room IV. open by Battery Room IV Exhaust (Exhaust Fan Operator error (2-ZS-31-288A-B). Fan 2A2-B. A review of the 2A2-B. (handswitch Low flow from 2A2-B schematics establishes the placed in wrong Fans independence of the control of position). will automatically stop Dampers 2-FCO-31-287-A and the fan from Train B, 2-FCO-31-288-B.

start Train A Press.

Fan 2A1-A and Exhaust Fan 2A1-A which will open 2-FCO-31-287-A.

33 2-FCO-31-285-A Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 2B1-A in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room III. in control wiring; damper status lights Room III. open by Battery Room III Exhaust (Exhaust Fan 2B1- Operator error (2-ZS-31-285B-A). Fan 2B1-A. A review of the A). (handswitch Low flow from 2B1-A schematics establishes the placed in wrong fans independence of the control of position). will automatically stop Dampers 2-FCO-31-285-A and the fan from Train A, 2-FCO-31-286-B.

start Train B Press.

Fan 2B2-B and Exhaust Fan 2B2-B which will open 2-FCO-31-286-B.

9.4-127 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 30 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 34 2-FCO-31-286-B Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. (See Remarks) Damper is motor operated, and fails Exhaust Fan 2B2-B in closes. failure; Hot short Equipment Room exhausting Battery as is. Automatically controlled to Tornado Damper Battery Room III. in control wiring; damper status lights Room III. open by Battery Room III Exhaust (Exhaust Fan Operator error (2-ZS-31-286A-B). Fan 2B2-B. A review of the 2B2-B). (handswitch Low flow from 2B2-B schematics establishes the placed in wrong fans independence of the control of position). will automatically stop Dampers 2-FCO-31-285-A and the fan from Train B, 2-FCO-31-286-B.

start Train A Press.

Fan 2B1-A and Exhaust Fan 2B1-A which will open 2-FCO-31-285-A.

35 0-FAN-31-493A-A N/A N/A N/A N/A N/A N/A Abandoned in place.

Fifth Vital Battery Supply Fan 1A1-A.

36 0-FC-31-487A N/A N/A N/A Abandoned in place.

N/A N/A Battery Room V Intake Fan 1A1-A Hydramotor Controller.

37 0-FCO-31-483-A N/A N/A Abandoned in place in closed N/A N/A N/A N/A position.

Tornado Damper WBNP-99 for intake Fan 9.4-128 1A1-A FVBR.

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 31 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 38 0-FAN-31-493B-A Provides exhaust Fails to run; Mechanical ANN 19-8 for low flow Loss of redundancy in None. (See The fifth Vital Battery is housed in its from Battery Room Fails while failure; Train A from intake fan or exhausting Battery 'Remarks') own separate room, and functions as FVBR Exhaust running. power failure; exhaust fan from Room V. a spare to any of the four vital Fan 1B1-A. Auto-start signal either train. batteries during periodic testing and failure. The Train B fan is maintenance or cell failure during Motor running light on available to provide operation. The two trains of the MCC. exhausting of Battery ventilation system are 100%

Room V, and will redundant. Upon low flow from automatically start on Train A exhaust fan, the opposite low flow sensed in train fans will start automatically and Train A s exhaust its dampers will open. Auto-start of duct. the standby train is independent of the other train. Schematic diagrams were reviewed and it was determined that control from the opposite train flow element does not violate separation of redundant train.

39 0-FCO-31-485-A Provides flow path for Fails to open Mechanical Local control station Loss of redundancy in None. The Train B Damper is solenoid actuated to fail exhaust from Exhaust (stuck closed); failure; Train A indicating lights. providing exhaust exhaust fan and its closed upon loss of Train A power.

Tornado Damper Fan 1B1-A Spuriously power failure; flowpath. associated dampers for exhaust Fan closes. Operator error. are automatically Interlocked to automatically open 1B1-A FVBR. controlled to upon exhaust Fan 1B1-A start.

start/open upon low flow from the operating exhaust fan.

9.4-129 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 32 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 40 0-FAN-31-496A Abandoned in place.

N/A N/A N/A N/A N/A N/A FVBR supply Fan 1A2-B.

41 0-FC-31-488A-B Abandoned in place.

N/A N/A N/A N/A N/A N/A Battery Room V Intake Fan 1A2-B Hydramotor Controller.

42 0-FCO-31-484-B N/A Abandoned in place.

N/A N/A N/A N/A N/A Tornado Damper for Intake Fan 1A2-B FVBR.

9.4-130 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 33 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 43 0-FAN-31-496B Provides exhaust Fails to run; Mechanical ANN 19-8 for low flow Loss of redundancy in None. (See Remarks) The fifth Vital Battery is housed in its form Battery Room V Fails while failure; Train B from intake fan or exhausting Battery own separate room, and functions as FVBR Exhaust for ventilation. running. power failure; exhaust fan from Room V. a spare to any of the four vital Fan 1B2-B. Auto-start signal either train. batteries during periodic testing and failure. The Train A fan is maintenance or cell failure during Motor running light on available to provide operation. The two trains of the MCC. exhausting of Battery ventilation system are 100%

Room V, and will redundant. Upon low flow from automatically start on Train B exhaust fan, the opposite low flow sensed in train fans will start automatically and Train B exhaust its dampers will open. Auto-start of duct. the standby train is independent of the other train. Schematic diagrams were reviewed and it was determined that control from the opposite train flow element does not violate separation of redundant train.

44 0-FCO-31-486-B Provides flowpath for Fails to open Mechanical Local Control Station Loss of redundancy in None. The Train A Low flow switch FS-31-492-B turns exhaust from Exhaust (stuck closed); failure; Train B indicating lights providing exhaust exhaust fan and its on the redundant fan pair Tornado Damper Fan 1B2-B. Spuriously power failure; flowpath. associated damper is (supply/exhaust) for exhaust Fan closes. Operator error. automatically 1B2-B FVBR. controlled to start/open upon low flow from the operating exhaust fan.

9.4-131 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 34 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 45 1-BKD-31-2502 Prevents flow of air Fails to Mechanical No direct indication of Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure; dampers closing air to rooms served by Fan 1A2-B running in MCR. Local Back Draft Supply Fan 1A1-A the fan. Bypass flow indication of damper status resulting Damper when Fan 1A2-B is See Remark #1. through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-132 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 35 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 46 1-BKD-31-2503 Prevents flow of air Fails to Mechanical No direct indication of Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure. dampers closing air to rooms served by Fan 1A1-A running in MCR. Local Back Draft Supply Fan 1A2-B the fan. Bypass flow indication of damper status resulting Damper when Fan 1A1-A is See Remark #1. through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-133 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 36 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 47 2-BKD-31-2502 Prevents flow of air Fails to Mechanical See Remark #1. Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure. air to rooms served by Fan 2A2-B running in MCR. Local Back Draft Supply Fan 2A1-A No direct indication of the fan. Bypass flow indication of damper status resulting Damper when Fan 2A2-B is dampers closing through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-134 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 37 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 48 2-BKD-31-2503 Prevents flow of air Fails to Mechanical No direct indication of Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure. dampers closing air to rooms served by Fan 2A1-A running in MCR. Local Back Draft Supply Fan 2A2-B the fan. Bypass flow indication of damper status resulting Damper when Fan 2A1-A is See Remark #1. through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-135 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 38 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 49 1-BKD-31-2520 Prevents flow of air Fails to Mechanical No direct indication of Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure. dampers closing air to rooms served by Fan 1B2-B running in MCR. Local Back Draft Supply Fan 1B1-A the fan. Bypass flow indication of damper status resulting Damper when Fan 1B2-B is See Remark #1. through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-136 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 39 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 50 1-BKD-31-2521 Prevents flow of air Fails to Mechanical No direct indication of Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure. dampers closing air to rooms served by Fan 1B1-A running in MCR. Local Back Draft Supply Fan 1B2-B the fan. Bypass flow indication of damper status resulting Damper when Fan 1B1-A is See Remark #1. through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-137 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 40 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 51 2-BKD-31-2520 Prevents flow of air Fails to Mechanical No direct indication of Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure. dampers closing air to rooms served by Fan 2B2-B running in MCR. Local Back Draft Supply Fan 2B1-A the fan. Bypass flow indication of damper status resulting Damper when Fan 2B2-B is See Remark #1. through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-138 WBNP-99

Table 9.4-5 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR (Sheet 41 of 41)

FAILURE MODES AND EFFECTS ANALYSIS FOR ACTIVE FAILURES SUBSYSTEM: AUXILIARY BOARD ROOMS AIR CONDITIONING SYSTEM Item Method of No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 52 2-BKD-31-2521 Prevents flow of air Fails to Mechanical No direct indication of Loss of pressurizing None. (See Remarks) 1. ANN low flow. Indicating lights of through Pressurizing backseat. failure. dampers closing air to rooms served by Fan 2B1-A running in MCR. Local Back Draft Supply Fan 2B2-B the fan. Bypass flow indication of damper status resulting Damper when Fan 2B1-A is See Remark #1. through the standby from potential low flow from fan(s).

running. unit is required to start but may fail as a 2. Operability of dampers is result of motor periodically verified in accordance overload to overcome with preventative maintenance the reverse rotation. procedures.

This would result in the total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

9.4-139 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 1 of 18)

EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1 1-FAN-30-244F-A Exhausts air from Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The four (4) exhaust fans (3 safety- related) 480V Transformer while running. Train A power failure; light on MCC. safety related Remarks) in 480V Transformer Room 1A are interlocked Exhaust Fan Room 1A. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure.

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

1.The single failure condition of a fan continuing None. to run, or spuriously running during accident Spuriously runs. Control signal failure; Indicating (See Remarks) None. conditions concurrent with minimum outside Temperature control lights on MCC (See design temperature, is analyzed to conclude sensing failure; Hot for fan motor Remarks) that the space temeratures remain within short in control running. allowable limits.

wiring.

9.4-140 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 2 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2 1-FAN-30-244G-A Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train A power failure; light on MCC. safety related Remarks) in 480 V Transformer Room 1A are interlocked Exhaust Fan 1A. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure.

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. None. 1. The single failure condition of a fan Temperature control lights on MCC (See Remarks) (See continuing to run, or spuriously running during sensing failure; Hot for fan motor Remarks) accident conditions concurrent with minimum short in control running. outside design temperature, is analyzed to wiring. conclude that the space temeratures remain within allowable limits.

9.4-141 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 3 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 3 1-FAN-30-244H-A Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train A power failure; light on MCC. safety related Remarks) in 480 V Transformer Room 1A are interlocked Exhaust Fan 1A. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room Temperature is indicated on Local Panel L-362.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running. concurrent with minimum outside design wiring. temperature, is acceptable.

9.4-142 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 4 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 4 1-FAN-30-244J Exhausts air from 480 Spuriously runs. Control signal failure; Indicating None. None. 1. This fan is electrically separate from the 1E V Transformer Room Temperature control lights on MCC circuit for the three safety-related fans.

Exhaust Fan 1A sensing failure; Hot for fan motor . See (Non-safety) short in control running. Remark #2. 2. Analysis shows that the single failure wiring. condition of a fan continuing to run, or spuriously running during accident conditions concurrent with minimum outside design temperature, is acceptable.

9.4-143 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 5 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 5 1-FAN-30-248E-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The three (3) exhaust fans V Transformer Room while running. Train B power failure; light on MCC. safety related Remarks) (3 safety-related) in 480 V Transformer Room Exhaust Fan 1B. Temperature control fan 1B are interlocked to automatically start/stop in sensing failure; staged series by thermostatic control.

Control signal failure.

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. None. 1. Analysis shows that the single failure Temperature control lights on MCC condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running. concurrent with minimum outside design wiring. temperature, is acceptable.

9.4-144 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 6 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 6 1-FAN-30-248F-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The three (3) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. safety related Remarks) in 480 V Transformer Room 1B are interlocked Exhaust Fan 1B. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running concurrent with minimum outside design wiring. temperature, is acceptable.

9.4-145 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 7 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 7 1-FAN-30-248G-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The three (3) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. safety related Remarks) in 480 V Transformer Room 1B are interlocked Exhaust Fan 1B. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running concurrent with minimum outside design wiring. temperature, is analyzed to conclude that the space temperatures remain within allowable limits..

9.4-146 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 8 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 8 1-FCO-30-244A Permits flow of air Spuriously closes; Mechanical failure; MCR Loss of None. 1. Both intake dampers are interlocked to and -244B supply from air intake Fails to open. Auto-open signal indicating redundancy in automatically open when any of the four (4) to 480 V Transformer failure; Hot short in lights 1-ZS intake air See exhaust fans are either automatically or Intake Dampers Room 1A. control wiring. 244A and - supply. 100% Remark #3. manually started.

244B). redundant intake damper 2. Dampers fail open upon loss of control air or can supply Train A power to 1-FSB-30-244A and -244B.

sufficient air.

3. 1-FSV-30-244A and -244B and the air pressure regulators, 1-PREG-30-244A and -

244B, that regulate the air pressure to these FSVs are Q-Listed as Quality- related, not safety-related. Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to close the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly isolated in the 1E circuit.

9.4-147 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 9 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 9 1-FCO-30-248A Permits flow of air Spuriously closes; Mechanical failure; MCR Loss of None. 1. Both intake dampers are interlocked to and -248B supply from air intake Fails to open. Auto-open signal indicating redundancy in automatically open when any of the three (3) to 480 V Transformer failure; Hot short in lights intake air See exhaust fans are either automatically or Intake Dampers. Room 1B. control wiring. (1-ZS-30-248A supply. Remark #3. manually started.

and -248B).

100% 2. Dampers fail open upon loss of control air redundant loss or Train B power to 1-FSV-30-248A and -

intake damper 248B.

can supply sufficient air. 3. 1-FSV-30-248A and -248B and the air pressure regulators, 1-PREG-30-248A and -

248B, that regulate the air pressure to these FSVs are Q-Listed as Quality- related, not safety-related. Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to close the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly isolated in the 1E circuit.

9.4-148 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 10 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 10 2-FAN-30-250E-A Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The three (3) exhaust fans (3 safety-related)

V Transformer Room while running. Train A power failure; light on MCC. safety related Remarks) in 480 V Transformer Room 2A are interlocked Exhaust Fan 2A. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running. concurrent with minimum outside design wiring. temperature, is analyzed to conclude that the space temeratures remain within allowable limits.

9.4-149 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 11 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 11 2-FAN-30-250F-A Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. 1. The three (3) exhaust fans (3 safety-related)

V Transformer Room while running. Train A power failure; light on MCC. safety related (See in 480 V Transformer Room 2A are interlocked Exhaust Fan 2A. Temperature control fan. Remarks) to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running. concurrent with minimum outside design wiring. temperature, is analyzed to conclude that the space temeratures remain within allowable limits.

9.4-150 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 12 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 12 2-FAN-30-250G-B Exhausts are from Fails to run; Fails Mechanical Failure; Motor running Loss of one None. 1. The three (3) exhaust fans (3 safety-related) 480 V Transformer while running. Train A power failure; light on MCC. safety related (See in 480 V Transformer Room 2A are interlocked Exhaust Fan Room 2A. Temperature control fan. Remarks) to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running. concurrent with minimum outside design wiring. temperature, is analyzed to conclude that the space temeratures remain within allowable limits.

9.4-151 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 13 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 13 2-FAN-30-246F-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. safety related (See in 480 V Transformer Room 2B are interlocked Exhaust Fan 2B. Temperature control fan. Remarks) to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control wiring running. concurrent with minimum outside design temperature, is analyzed to conclude that the space temeratures remain within allowable limits.

9.4-152 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 14 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 14 2-FAN-30-246G-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. safety related Remarks) in 480 V Transformer Room 2B are interlocked Exhaust Fan 2B. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running. concurrent with minimum outside design wiring. temperature, is analyzed to conclude that the space temeratures remain within allowable limits.

9.4-153 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 15 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 15 2-FAN-30-246H-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one None. (See 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. safety related Remarks) in 480 V Transformer Room 2B are interlocked Exhaust Fan 2B. Temperature control fan. to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Two of the three safety-related fans are sufficient to adequately ventilate each 480V Transformer Room.

Spuriously runs. Control signal failure; Indicating None. (See None. (See 1. Analysis shows that the single failure Temperature control lights on MCC Remarks) Remarks) condition of a fan continuing to run, or sensing failure; Hot for fan motor spuriously running during accident conditions short in control running. concurrent with minimum outside design wiring. temperature, is analyzed to conclude that the space temeratures remain within allowable limits.

9.4-154 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 16 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 16 2-FAN-30-246J Exhausts air from 480 Spuriously runs. Control signal failure; Indicating None. None. 1. This fan is electrically separate from the 1E V Transformer Room Temperature control lights on MCC circuit for the three safety-related fans.

Exhaust Fan 2B sensing failure; Hot for fan motor See Remark See (Non-safety) short in control running. #2. Remark #2. 2. The single failure condition of a fan wiring. continuing to run, or spuriously running during accident conditions concurrent with minimum outside design temperature, is analyzed to conclude that the space temeratures remain within allowable limits.

9.4-155 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 17 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 17 2-FCO-30-246A Permits flow of air Spuriously closes; Mechanical failure; MCR Loss of None. 1. Both intake dampers are interlocked to and -246B supply from air intake Fails to open. Auto-open signal indicating redundancy in automatically open when any of the four (4) to 480 V Transformer failure; Hot short in lights intake air See exhaust fans are either automatically or Intake Dampers Room 2B. control wiring. (2-ZS-30-246A supply. Remark #3. manually started.

and -246B).

100% 2. Dampers fail open upon loss of control air or redundant Train B power to 2-FSV-30-246A and -246B.

intake damper can supply 3. 2-FSV-30-246A and -246B and the air sufficient air. pressure regulators, 1-PREG-30-246A and

-246B, that regulate the air pressure to these FSVs are Q-Listed as Quality- related, not safety-related.

Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to close the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly isolated in the 1E circuit.

9.4-156 WBNP-99

Table 9.4-6 Failure Modes and Effects Analysis for Active Failures Subsystem: 480 V Shutdown Transformer Room Ventilation (Sheet 18 of 18)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR EFFECT ITEM COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 18 2-FCO-30-250A Permits flow of air Spuriously closes: Mechanical failure; MCR Loss of None. 1. Both intake dampers are interlocked to and -250B supply from air intake Fails to open. Auto-open signal indicating redundancy in automatically open when any of the three (3) to 480V Transformer failure; Hot short in lights intake air (See exhaust fans are either automatically or Intake Dampers. Room 2A. control wiring. (2-ZS-30-250A supply. Remark manually started.

and -250B). #3) 100% 2. Dampers fail open upon loss of control air or redundant Train A power to 1-FSV-30-250A and -250B.

intake damper can supply 3. 1-FSV-30-250A and -250B and the air sufficient air. pressure regulators, 1-PREG-30-250A and

-250B, that regulate the air pressure to these FSVs are Q-Listed as Quality- related, not safety-related.

Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to close the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly isolated in the 1E circuit.

9.4-157 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 1 of 52)

METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1A Tornado Damper Isolation of Train A Fails to close -Mechanical Status indication in Control None. (See None. (See remarks) Redundant Train B Tornado 0-FCO-31-32 supply air normal (west) during tornado failure Room via Limit Switch remarks.) Damper 0-FCO-31-33 powered intake during tornado event -Electrical ZS-31-32 from Train B and installed in event failure series accomplished isolation during tornado event 1B Tornado Damper Isolation of Train B Fails to close -Mechanical Status indication in Control None. (See None. (See remarks) Redundant Train B Tornado 0-FCO-31-34 supply air normal (west) during tornado failure Room on Panel 1-M-9 via remarks.) Damper 0-FCO-31-35 powered intake during tornado event -Electrical Limit Switch ZS-31-34. from Train B and installed in event failure series accomplished isolation during tornado event Spuriously Mechanical Status indication in Control None. (See None. (See remarks) Operator removes power from closes failure Room via Limit Switch remarks.) damper, during non-tornado

-Electrical ZS-31-32 operation, to prevent spurious failure closure.

2A Tornado Damper Isolation of Train A Fails to close -Mechanical Status indication in Control None. (See None. (See remarks) Redundant Train A Tornado 0-FCO-31-33 supply air normal (west) during tornado failure Room on Panel 1-M-9 via remarks.) Damper 0-FCO-31-32 powered intake during tornado event -Electrical Limit Switch ZS-31-33 from Train A and installed in event failure series accomplished isolation during tornado event 2B Tornado Damper Isolation of Train B Fails to close -Mechanical Status indication in Control None. (See None. (See remarks) Redundant Train A Tornado 0-FCO-31-35 supply air normal (west) during tornado failure Room on Panel 1-M-9 via remarks) Damper 0-FCO-31-34 powered intake during tornado event -Electrical Limit Switch ZS-31-35 from Train A and installed in event failure series accomplished isolation during tornado event 3A Isolation Damper See remarks See remarks See remarks See remarks See remarks See remarks This isolation damper all controls 0-FCO-31-1 are disconnected and the damper is locked in fully open position 3B Isolation Damper See remarks See remarks See remarks See remarks See remarks See remarks This isolation damper all controls WBNP-99 0-FCO-31-2 are disconnected and the damper 9.4-158 is locked in fully open position

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 2 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 4A Flow Control See remarks See remarks See remarks See remarks See remarks See remarks This flow control damper all Damper controls are disconnected and the 0-FCO-31-1A damper is locked in fully open position 4B Flow Control See remarks See remarks See remarks See remarks See remarks See remarks This flow control damper all Damper controls are disconnected and the 0-FCO-31-2A damper is locked in fully open position 5A Pressurization See remarks See remarks See remarks See remarks See remarks See remarks This pressurization fan is Fan A-A disconnected and abandoned in place 5B Pressurization See remarks See remarks See remarks See remarks See remarks See remarks This pressurization fan is Fan B-B disconnected and abandoned in place 6A Backdraft Damper See remarks See remarks See remarks See remarks See remarks See remarks This backdraft damper is locked in 0-31-2097 open position 6B Backdraft Damper See remarks See remarks See remarks See remarks See remarks See remarks This backdraft damper is locked in 0-31-2098 open position 7 Isolation Valve Isolates Main Control Open (during -Mechanical Status indication in Control None None. See remarks Redundant safety Train B 0-FCV-31-3 Room Habitability Zone CRI) failure Room Panel 1-M-9 via See Remarks Isolation Valve installed in series (MCRHZ) from outside -Control Limit Switch ZS-31-3 will close to provide isolation makeup air supply failure 8 Isolation Valve Isolates MCRHZ from Open (during -Mechanical Status indication in Control None None. See remarks Redundant safety Train A 0-FCV-31-4 outside makeup air CRI) failure Room Panel 1-M-9 via (See Remarks) Isolation Valve installed in series supply -Control Limit Switch ZS-31-4 will close to provide isolation failure 9.4-159 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 3 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 9 Fire Damper To maintain fire barrier Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-3934 integrity between (see remarks need not be postulated as being Mechanical Equip. concurrent with fire Room Floor El 755.0' and Spreading Room El. 729.0' during fire Fusible link --Mechanical Surveillance and None (see None (see remarks) Fire damper has dual fusible links failure (see (fusible Maintenance (see remarks) remarks) link failure) remarks) 10 Isolation Valve See remarks See remarks See remarks See remarks See remarks See remarks This valve controls are 0-FCV-31-37 disconnected 11 Isolation Valve See remarks See remarks See remarks See remarks See remarks See remarks This valve controls are 0-FCV-31-36 disconnected 11A Isolation Damper See remarks See remarks See remarks See remarks See remarks See remarks The damper controls are 0-FCO-31-19 disconnected, and the duct is blanked off 11B Isolation Damper See remarks See remarks See remarks See remarks See remarks See remarks The damper controls are 0-FCO-31-20 disconnected, and the duct is blanked off 12 Fire Damper To maintain fire barrier Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-3938 integrity between (see remarks) need not to be postulated as Spreading Room El. being concurrent with fire 729.0' & Unit 1 Aux.

Instr. Room El. 708.0' during fire Fusible link -Mechanical Surveillance and None. (See None (see remarks) Additional independent fusible link failure (see (fusible Maintenance remarks) is to be installed remarks) link WBNP-99 failure) 9.4-160

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 4 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 12A 0-XS-31-179 To detect smoke in the Spurious -Electrical Surveillance See remarks None (see remarks) Upon activation of air intake Control Building actuation of failure smoke detectors a CRI is initiated.

Pressurization Fan smoke detector Annunciation in MCR of Operator action will determine if Intake CRI signal the smoke detector activation was spurious and if so return system to Failure to detect -Electrical Smoke detectors in Abandon MCR None. Use Auxiliary normal operation valid smoke failure MCRHZ Control Room 12B 0-XS-31-183 To detect smoke in the Spurious -Electrical Surveillance See remarks None (see remarks) Upon activation of air intake Control Building actuation of failure smoke detectors a CRI is initiated.

Pressurization Fan smoke detector Annunciation in MCR of Operator action will determine if Intake CRI signal the smoke detector activation was spurious and if so return system to Failure to detect -Electrical Smoke detectors in Abandon MCR None. Use Auxiliary normal operation valid smoke failure MCRHZ Control Room 13 Fire Damper Maintain fire barrier Open during fire See remarks See remarks See remarks None. (See remarks) Single failures of HVAC system 0-ISD-31-3931 between Control Bldg. (see remarks need not to be postulated as roof and Main Control being concurrent with fire Room in case of fire on the roof at the east emergency air intake Closed during -Mechanical Loss of Control Room Loss of Control None. (See remarks) Control Bldg. Press. Diff. switches CRI (fusible Press. Diff. Common Room 0-PDS-31-1A, 2A, -3A & -4A start link) Alarm through switches 0- pressurization redundant Control Bldg.

PDS-31-1B, -2B, 3B & -4B due to loss of emergency press. fan A-A with its in Control Room emergency outdoor air intake (west) press. fan air flow path through east emerg. air intake 9.4-161 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 5 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 14 Tornado Damper Isolation of emergency Fails to close -Mechanical Status indication via Limit None. (See None. (See remarks) Redundant Train B Tornado 0-FCO-31-21 outdoor air intake for during Tornado failure Switch ZS-31-21 remarks) Damper 0-FCO-31-22 powered Emergency Press Fan Event -Electrical from Train B and installed in B-B during Tornado failure series accomplishes isolation Event during Tornado Event Spuriously closes -Electrical Annunciation in MCR on Momentary loss None. Use redundant Operator removes power from failure loss of +1/8 w.g. of MCRHZ air intake damper, during non-tornado pressure pressurization operation, to prevent spurious closure 15 Tornado Damper Isolation of east Fails to close -Mechanical Status indication via Limit None. (See None. (See remarks) Redundant Train A Tornado 0-FCO-31-22 emergency outdoor air during Tornado failure Switch ZS-31-22 remarks) Damper 0-FCO-31-21 powered intake for Emergency Event -Electrical from Train A and installed in Press Fan B-B during failure series accomplishes isolation Tornado Event during Tornado Event 16B Isolation Damper Isolates Emergency Closes during -Mechanical The Loss of Control Loss of air flow None (see remarks) Redundant Train B emerg. press.

0-FCV-31-6 Pressurization Fan A-A Emerg. Press. failure. Room Press. Diff. through Emerg. Fan B-B starts upon signal from from normal outdoor air fan A-A operation -Electrical Common Alarm through Press. Fan A-A the Control Room Press. Diff.

intake (west) supply air & aux. switches 0-PDS-31-1A, - switches 0-PDS-31-1B, -2B, -3B control air 2A, -3A & -4A and status and -4B failure indication in Control Room on Panel 1-M-9 via Limit Switch ZS-31-6 Fails to close -Mechanical The Loss of Control May reduce the None (see remarks) Same as above during standby failure Room Press. Diff. outside air operation Common Alarm through supply and switches 0-PDS-31-1A, - cause loss of 2A, 3A & -4A and status pressurization indication in Control Room on Panel 1-M-9 via WBNP-99 Limit Switch ZS-31-6 9.4-162

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 6 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 16A Isolation Damper Isolates Emerg. Closes during -Mechanical The Loss of Control Loss of air flow None (see remarks) Redundant Train A emerg. press.

0-FCV-31-5 Pressurization Fan B-B Emerg. Press. failure. Room Press. Diff. through Emerg. Fan A-A starts upon signal from from emerg. outdoor air Fan B-B -Electrical Common Alarm through Press. Fan B-B the Control Room Press. Diff.

intake (east) supply air operation & aux. switches 0-PDS-31-1B, - switches 0-PDS-31-1A, -2A, -3A control air 2B, -3B & -4B and status and -4A failure indication in Control Room on Panel 1-M-9 via Limit Switch ZS-31-5 Fails to close -Mechanical The Loss of Control May reduce the None (see remarks) Same as above during standby failure Room Press. Diff. outside air operation Common Alarm through supply and switches 0-PDS-31-1B, - cause loss of 2B, 3B & -4B and status pressurization indication in Control Room via Limit Switch ZS-31-5 17B Control Bldg. Pressurize Main Control -Fail to start -Mechanical The Loss of Control Loss of Control None. (See remarks) The Control Room Press. Diff.

Emergency Air Room Habitability Zone -Stops failure Room Press. Diff. Room Switches 0-PDS-31-1B, -2B, -3B Press. Fan A-A (MCRHZ) during CRI -Electric Common Alarm through pressurization and -4B start the Control Bldg.

failure Switches 0-PDS-31-1A, - due to loss of redundant Train B Emergency Air

-Control 2A, 3A & -4A in Control air flow path Press. Fan B-B failure Room through Train A 17A Control Bldg. Pressurize Main Control -Fails to -Mechanical The Loss of Control Loss of Control None. (See remarks) The Control Room Press. Diff.

Emergency Air Room Habitability Zone start failure Room Press. Diff. Room Switches 0-PDS-31-1A, -2B, -3A Press. Fan B-B (MCRHZ) during CRI -Stops -Electrical Common Alarm through pressurization and -4A start the Control Bldg.

failure switches 0-PDS-31-1B, - due to loss of redundant Train A Emergency Air

-Control 2B, 3B and 4B in Control air flow path Press. Fan A-A failure Room through Train B 9.4-163 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 7 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 18A Fire Damper To prevent a fire or Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-4608 smoke from entering the failure need not be postulated as being Control Bldg. concurrent with fire Emergency Air Cleanup Unit A-A Closed during -Mechanical Loss of Control Room Loss of air flow None. (See remarks) The Control Room Press. Diff.

CRI failure Press. Diff. Common through the Switches 0-PDS-31-1B, -2B, -3B (fusible Alarm through Switches Train A Air and -4B start redundant Train B link) 0-PDS-31-1A, -2A, 3A & - Cleanup Unit Air Cleanup Unit with its Fan B-B.

4A in Control Room and loss of (Existing dual fusible link is left in MCR place) pressurization 18B Fire Damper To prevent a fire or Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-3958 smoke from entering the failure need not be postulated as being Control Bldg. concurrent with fire Emergency Air Cleanup Unit B-B Closed during -Mechanical Loss of Control Room Loss of air flow None. (See remarks) The Control Room Press. Diff.

CRI failure Press. Diff. Common through the Switches 0-PDS-31-1A, -2A, -3A (fusible Alarm through Switches Train B Air and -4A start redundant Train A link) 0-PDS-31-1B, -2B, -3B & Cleanup Unit Air Cleanup Unit with its Fan A-A.

-4B and loss of (Existing dual fusible link is left in MCR place) pressurization 9.4-164 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 8 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 19A Isolation Damper Isolation of Emergency Closed during -Mechanical In Control Room Loss of Loss of air flow None. (See remarks) The Control Room Press. Diff.

FCO-31-8 Air Cleanup Unit A-A operation of failure Control Room Press. Diff. path for Switches 0-PDS-31-1B, -2B, -3B Emergency Air -Electrical Common Alarm through Emergency Air and -4B start redundant Train B Cleanup Unit Fan & Aux Switches 0-PDS-31-1A, Cleanup Unit Fan B-B with its emerg. air A-A Control -2A, -3A and -4A and Fan A-A and cleanup unit Air Failure Damper Status Indication loss of MCR via Limit Switch ZS-31-8 pressurization Open during -Mechanical Damper Status Indication Air flow path is None. (See remarks) Pressurization Air is still standby failure via Limit Switch ZS-31-8 open through adequately filtered and Control

-Electrical Air Cleanup Room Pressurization is still failure Unit during maintained standby 19B Isolation Damper Isolation of Emergency Closed during -Mechanical In Control Room Loss of Loss of air flow None (See remarks) The Control Room Press. Diff.

FCO-31-7 Air Cleanup Unit B-B operation of failure. Control Room Press. Diff. path for Switches 0-PDS-31-1A, -2A, -3A Emergency Air -Electrical Common Alarm through Emergency Air and -4A start the Control Bldg.

Cleanup Unit Fan & Aux Switches 0-PDS-31-1B, Cleanup Unit redundant Train A Fan A-A with B-B Control -2B, -3B and -4B and Fan B-B and its emerg. air cleanup unit Air Failure Damper Status Indication loss of MCR via Limit Switch ZS-31-7 pressurization Open during -Mechanical Damper Status Indication Air flow path is None (See remarks) Pressurization Air is still standby failure via Limit Switch ZS-31-7 open through adequately filtered and Control

-Electrical Air Cleanup Room Pressurization is still failure Unit during maintained standby 20A Control Bldg. Filters potentially Blocked -Dirty filters Loss of Control Room Reduced or no None. Control Room Press. Diff.

Emergency Air contaminated outside Press. Diff. common air flow through (See Remarks) Switches 0-PDS-31-1B, -2B, -3B Cleanup Unit A-A air prior to MCRHZ Alarm through Switches emergency air and -4B start redundant Train B during CRI 0-PDS-31-1A, -2A, -3A, cleanup unit Emerg. Air Cleanup Unit Fan B-B and -4A and loss of WBNP-99 MCR 9.4-165 pressurization

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 9 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 20B Control Bldg. Filters potentially Blocked -Dirty filters Loss of Control Room Reduced or no None. (See remarks) Control Room Press. Diff.

Emergency Air contaminated outside Press. Diff. common air flow through Switches 0-PDS-31-1A, -2A, -3A Cleanup Unit B-B air prior to introducing it Alarm through Switches emergency air and -4A start redundant Train A into MCRHZ during CRI 0-PDS-31-1B, -2B, -3B, cleanup unit Emerg. Air Cleanup Unit Fan A-A and and loss of

-4B MCR pressurization 21A Control Bldg. Draws recirc. and -Fails to start -Mechanical Loss of Control Room Loss of air flow None. (See remarks) Control Room Press. Diff.

Emergency Air outside air through air -Stops failure Press. Diff. common path through Switches 0-PDS-31-1B, -2B, -3B Cleanup Unit Fan cleanup unit during CRI -Electrical Alarm through Switches Train A and loss and -4B start redundant Train B A-A failure 0-PDS-31-1A, -2A, -3A, of MCR Emerg. Air Cleanup Unit Fan B-B and pressurization

-4A 21B Control Bldg. Draws recirc. and -Fails to start -Mechanical Loss of Control Room Loss of air flow None. (See remarks) Control Room Press. Diff.

Emergency Air outside air through air -Stops failure Press. Diff. common path through Switches 0-PDS-31-1A, -2A, -3A Cleanup Unit Fan cleanup unit during CRI -Electrical Alarm through Switches Train B and loss and -4A start redundant Train A B-B failure 0-PDS-31-1B, -2B, -3B, of MCR Emerg. Air Cleanup Unit Fan A-A and pressurization

-4B 9.4-166 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 10 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 22A Fire Damper Fire barrier at the Open during fire -Mechanical See remarks See remarks See remarks Single failure of HVAC system 0-ISD-31-3935 Control Bldg. Emerg. Air failure need not be postulated as being Cleanup Unit (ACU) concurrent with fire Fan A-A discharge.

(Prevents fire spreading downstream of the Fan A-A)

Closed during -Mechanical The Loss of Control Loss of air flow None. (See remarks) The Control Room Press. Diff.

CRI failure. Room Press. Diff. through the Switches 0-PDS-31-1B, -2B, -3B, (fusible Common Alarm through Train A ACU and -4B start Redundant Train B link) Switches 0-PDS-31-1A, - and loss of Emerg. Air Cleanup Unit with its 2A, -3A, and -4A MCR Fan B-B pressurization 22B Fire Damper Fire barrier at the Open during fire -Mechanical See remarks See remarks See remarks Single failure of HVAC system 0-ISD-31-3936 Control Bldg. Emerg. Air failure need not be postulated as being Cleanup Unit (ACU) concurrent with fire Fan B-B discharge.

(Prevents fire spreading downstream of the Fan B-B)

Closed during -Mechanical The Loss of Control Loss of air flow None. (See remarks) The Control Room Press. Diff.

CRI failure Room Press. Diff. through the Switches 0-PDS-31-1A, -2A, -3A, (fusible Common Alarm through Train B ACU and -4B start Redundant Train A link) Switches 0-PDS-31-1B, - and loss of Emerg. Air Cleanup Unit with its 2B, MCR Fan A-A

-3B, and -4B pressurization 9.4-167 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 11 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 23 Fire Damper 0- Fire barrier between Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system XFD-31-75 Conference Room and failure need not be postulated as being Technical Support -Electrical concurrent with fire Center failure Close during -ETL Link Surveillance and May result in None (see remarks) These areas are not essential for other modes of failure Maintenance overheating of safe shutdown operation Technical Support Center 24 Fire Damper 0- Fire barrier between Open during fire -Mechanical See Remarks See Remarks See remarks Single failures of HVAC system XFD-31-83 Relay Room and Main failure need not be postulated as being Control Room -Electrical concurrent with fire failure Close during -ETL Link Surveillance and None. (See None. (See remarks) The transfer opening with fire other modes of failure Maintenance remarks) Damper 0-XFD-31-153 provides operation alternate return air flow path 25 Fire Damper Fire barrier between Open during fire -Mechanical See Remarks See Remarks See remarks Single failures of HVAC system 0-XFD-31-153 Relay Room and Main failure need not be postulated as being Control Room -Electrical concurrent with fire.

failure Close during -ETL Link Surveillance and None. (See None. (See remarks) This fire damper has two ETL other modes of failure Maintenance remarks) operation 9.4-168 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 12 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 26 Fire Damper To prevent smoke or fire Open during fire. -Mechanical See remarks. See remarks. See remarks. Single failure of HVAC system 0-XFD-31-99 from the Shift Eng failure need not be postulated as being Office and Conference -Electrical concurrent with fire.

Room from being failure introduced into the air recirculation system.

Closed during -ETL link Surveillance and May result in None. (See remarks). These areas are not essential for other modes of failure. Maintenance. overheating of safe shutdown.

operation. Shift Eng Office and Conference Room.

27A Isolation Damper Isolate Main Control Close during Air -Mechanical Annunciation in MCR of Loss of air flow None (see remarks). Redundant AHU B-B starts on 0-FCO-31-12 Room (MCR) Air Handling Unit A- failure MCR Air Conditioning path through low air flow signal from AHU A-A Handling Unit (AHU) A- A operation. -Electrical Safety train switchover, AHU A-A. via Flow Switch FS-31-84.

A during standby or failure via Switches maintenance. 0-PDS-31-161, 0-FS-31-84 &

0-TS-31-88B Open during -Mechanical None (see remarks). Backdraft Damper 0-31-2105 standby failure prevents backflow.

operation. -Electrical

-Auxiliary Control Air Failure 9.4-169 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 13 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 27B Isolation Damper Isolate Main Control Close during Air -Mechanical Annunciation in MCR of Loss of air flow None (see remarks). Redundant AHU A-A starts on 0-FCO-31-11 Room (MCR) Air Handling Unit B- failure MCR Air Conditioning path through low air flow signal from AHU A-A Handling Unit (AHU) B- B operation. -Electrical Safety train switchover via AHU B-B. via Flow Switch FS-31-94.

B during standby or failure Switches maintenance. 0-PDS-31-186, 0-FS-31-94 &

0-TS-31-89B Open during -Mechanical None (see None (see remarks). Backdraft Damper 0-31-2104 standby failure remarks). prevents backflow.

operation. -Electrical

-Auxiliary Control Air Failure 28A Modulating Modulates the air flow Closed (coil -Mechanical Annunciation in MCR of Air bypasses None (see remarks). Temp. Switch TS-31-88B starts Damper 0-FCO- through cooling coil and section). failure MCR Air Conditioning the cooling coil the redundant AHU B-B upon 31-82 bypass to maintain the -Control Air Safety train switchover via and increase of high return temp.

temperature at failure Switches space thermostat 0-TE-31-82 0-PDS-31-161, temperature.

setpoint. 0-FS-31-84 &

0-TS-31-88B Spurious -Control Space None (see remarks). Temp. Switch TS-31-88B starts modulation. failure temperature is the redundant AHU B-B upon not maintained high return temp.

at thermostat setting.

9.4-170 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 14 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 28B Modulating Modulates the air flow Closed (coil -Mechanical Annunciation in MCR of Air bypasses None (see remarks). Temp. Switch TS-31-89B starts Damper through cooling coil and section). failure MCR Air Conditioning the cooling coil the redundant AHU A-A upon 0-FC0-31-91 bypass to maintain the -Control Air Safety train switchover via and increase of high return temp.

temperature at failure Switches space thermostat 0-TE-31-91 0-PDS-31-186, temperature.

setpoint. 0-FS-31-94 &

0-TS-31-89B Spurious -Control Space None (see remarks). Temp. Switch TS-31-89B starts modulation. failure temperature is the redundant AHU A-A upon not maintained high return temp.

at thermostat setting.

29A Main Control Room Air Handling Unit A-A

-Filter Filters the air Clogged - Surveillance (PDI-31-87) Reduced Air None. (See Remarks) Surveillancce (PDI-31-87) &

Accumulation and Maintenance and flow may result Maintenance of filters in of dirt Annunciation in MCR Air in rise of space accordance with maintenance Conditioning Safety Train temperature procedures. Either Temp. Switch Switchover via Switches 0-PDIS-31-161, 0-TS-31-88B or Flow Switch 0-FS-31-84 & 0-FS-31-84 starts redundant Air 0-TS-31-88B Handling Unit B-B

-Cooling Coil Cools the supply air to Cooling coil tube -Mechanical Annunciation in MCR Air Temperature None. (See Remarks) Redundant AHU B-B starts upon maintain design break or crack failure conditioning Safety Train increase in the signal from AHU A-A high temperature in the Switchover via Switches MCRHZ temperature switch 0-TS-31-88B MCRHZ 0-PDIS-31-161, 0-FS-31-84 &

0-TS-31-88B 9.4-171 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 15 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS

-Humidifier Provides moisture to No humidification -Steam Boiler Moisure Indicator Decrease of None. (See Remarks) Maintenance of the relative maintain the design failure MI-31-176 on Panel L-529 Relative humidity is not required for safe relative humidity in -Steam Humidity shutdown of plant MCRHZ during normal Control Valve operation mode closes

-Mechanical failure

-Electrical failure

-Mechanical failure

-Electrical failure Humidification Moisture Indicator None. (See None. (See Remarks) MCR moisture level will not Control Valve MI-31-176 on Panel L-529 Remarks) exceed design requirements fails open 9.4-172 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 16 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 29A -Fan Circulates the air -Fails to start -Mechanical Annunciation in MCR of Loss of air flow None. (See Remarks) Redundant AHU B-B starts upon Cont -Stops failure MCR Air conditioning through AHU signal from AHU A-A Air flow

-Electrical Safety Train Switchover A-A Switch FS-31-84 failure via Switches 0-PDIS-31-161, 0-FS-31-84 &

0-TS-31-88B Fails to stop or, -Electrical Annunciation in MCR of Increased None. (See Remarks) When both AHUs are operating starts failure MCR Air conditioning pressure in duct the common ductwork static Safety Train Switchover pressure does not exceed 6 via Switches inches wg safety-related duct 0-PDIS-31-161, 0-FS-31-84 & design pressure 0-TS-31-88B 29B Main Control Room Air Handling Unit B-B

-Filter Filters the air Clogged - Surveillance (PDI-31-97) Reduced Air None. (See Remarks) Surveillancce (PDI-31-97) &

Accumulation and Maintenance and flow may result Maintenance of filters in of dirt Annunciation in MCR Air in rise of space accordance with maintenance Conditioning Safety Train temperature procedures. Either Temp. Switch Switchover via Switches 0-PDIS-31-186, 0-TS-31-89B or Flow Switch 0-FS-31-94 & 0-FS-31-94 starts redundant Air 0-TS-31-89B Handling Unit A-A

-Cooling Coil Cools the supply air to Cooling coil tube -Mechanical Annunciation in MCR Air Temperature None. (See Remarks) Redundant AHU A-A starts upon maintain design break or crack failure conditioning Safety Train increase in the signal from AHU B-B high temperature in the Switchover via Switches MCRHZ temperature switch 0-TS-31-89B MCRHZ 0-PDIS-31-186, 0-FS-31-94 &

0-TS-31-89B 9.4-173 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 17 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 29B -Humidifier Provides moisture to No humidification -Steam Boiler Moisure Indicator Decrease of None. (See Remarks) Maintenance of the relative Cont. maintain the design failure MI-31-201 on Panel L-530 Relative humidity is not required for safe relative humidity in -Steam Humidity shutdown of plant MCRHZ during normal Control Valve operation mode closes

-Mechanical failure

-Electrical failure

-Mechanical failure

-Electrical failure Humidification Moisture Indicator None. (See None. (See Remarks) MCR moisture level will not Control Valve MI-31-201 on Panel L-530 Remarks) exceed design requirements fails open

-Fan Circulates the air -Fails to start -Mechanical Annunciation in MCR of Loss of air flow None. (See Remarks) Redundant AHU A-A starts upon

-Stops failure MCR Air conditioning through AHU signal from AHU B-B Air flow

-Electrical Safety Train Switchover A-A Switch FS-31-94 failure via Switches 0-PDIS-31-186, 0-FS-31-94 &

0-TS-31-89B Fails to stop or, -Electrical Annunciation in MCR of Increased None. (See Remarks) When both AHUs are operating starts failure MCR Air conditioning pressure in duct the common ductwork static Safety Train Switchover pressure does not exceed 6 via Switches inches wg safety-related duct 0-PDIS-31-186, design pressure 0-FS-31-94 &

0-TS-31-89B 9.4-174 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 18 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 30A Backdraft Damper Prevent backflow from Fails to open - Mechanical Annunciation in MCR of Loss of flow None (See Remarks) Redundant AHU B-B start upon 0-BKD-31-2105 AHU B-B through Failure MCR Air Conditioning through signal from AHU A-A Air Flow AHU A-A when on Safety Train switchover AHU A-A Switch FS-31-84 standby via Switches 0-PDIS-31-161, 0-FS-31-84, and 0-TS-31-88B Fails to close - Mechanical None (See None (See Remarks) Isolation Damper 0-FCO-31-12 (AHU A-A on Failure Remarks) prevents the backflow Standby) 30B Backdraft Damper Prevent backflow from Fails to open - Mechanical Annunciation in MCR of Loss of air flow None (See Remarks) Redundant AHU A-A starts upon 0-BKD-31-2104 AHU A-A through Failure MCR Air Conditioning through signal from AHU B-B Air Flow AHU B-B when on Safety Train switchover AHU B-B Switch FS-31-94 standby via Switches 0-PDIS-31-186, 0-FS-31-94, and 0-TS-31-89B Fails to Close - Mechanical None (See None (See Remarks) Isolation Damper 0-FCO-31-11 (AHU B-B on Failure Remarks) prevents the backflow Standby) 30C Backdraft Damper See Remarks See Remarks See Remarks See Remarks See Remarks See Remarks This backdraft damper is not 0-BKD-31-2103 required and is locked in open position 9.4-175 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 19 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 31 Fire Damper To prevent smoke Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-XFD-31-98 spreading to Failure need not be postulated as being Conference Room, Shift - Electrical concurrent with fire Eng. Office, Lockers, Failure Toilet, and Kitchen Close during - ETL Link Surveillance and None (See None (See Remarks) This fire damper has two ETL other modes of Failure Maintenance Remarks) links operation 32 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-XFD-31-86 Relay Room and Main Failure need not be postulated as being Control Room - Electrical concurrent with fire Failure Close during - ETL Link Surveillance and None (See None (See Remarks) This fire damper has two ETL other modes of Failure Maintenance Remarks) Links operation 33 Fire Damper Prevent fire spreading Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-4402 to Conference Room Failure need not be postulated as being concurrent with fire Maintenance of the room design Close during - Fusible Link Surveillance and Loss of supply None (See Remarks) other modes of Failure Maintenance air to room temperature is not essential to operation the Control Building Safety Function 9.4-176 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 20 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 34 Fire Damper Prevent fire spreading Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-4404 to NRC Office Failure need not be postulated as being concurrent with fire Maintenance of the room design Close during - Fusible Link Surveillance and Loss of supply See Remarks other modes of Failure Maintenance air to room temperature is not essential to operation the Control Building Safety Function 35 Fire Damper Fire barrier to Technical Open during fire -Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-XFD-31-76 Support Center (TSC) Failure need not be postulated as being concurrent with fire.

Close during -Fusible Link Surveillance and Loss of supply See Remarks Maintenance of the room design other modes of Failure Maintenance air to the room temperature is not essential to operation the Control Building Safety Function 36A MCR Water Chiller Cooling of Chilled Water -Fails to -Mechanical Annuniciation in MCR of Increase in None (See Remarks) Redundant MCR Air Conditioning A-A start Failure MCR Air Conditioning chilled water Train B is started by any of

-Stops -Electrical Safety Train Switchover temperature Switches 0-PDIS-31-161, 0-FS-Failure via Switches 0-PDIS 31-84 & 0-TS-31-88B 161, 0-FS-31-84 & 0-TS-31-88B 36B MCR Water Cooling of Chilled Water - Fails to start - Mechanical Annunciation in MCR of Increase in None (See Remarks) Redundant MCR Air Conditioning Chiller B-B - Stops Failure MCR Air Conditioning chilled water Train A is started by any of

- Electrical Safety Train switchover temperature Switches 0-PDIS-31-186, Failure via Switches 0-FS-31-94, and 0-TS-31-89B 0-PDIS-31-186, 0-FS 94 and 0-TS-31-89B 9.4-177 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 21 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 37A MCR Chilled Water Circulate the chilled - Fails to start - Mechanical Annunciation in MCR of Loss chilled None (See Remarks) Redundant MCR Air Conditioning Circulation water - Stops Failure MCR Air Conditioning water flow Train B is started by any of Pump A-A - Electrical Safety Train switchover Switches 0-PDIS-31-161, Failure via Switch 0-PDIS-31-161 0-FS-31-84, and 0-TS-31-88B Leakage through - Mechanical Annunciation in MCR of Decrease of None (See Remarks) Redundant MCR Air Conditioning seals Failure MCR Air Conditioning water content in Train B is started by any of Safety Train switchover the system Switches 0-PDIS-31-161, via 0-FS-31-84, and 0-TS-31-88B Switches 0-PDIS-31-161, 0-FS-31-84, and 0-TS-31-88B 37B MCR Water Circulate the chilled - Fails to start - Mechanical Annunciation in MCR of Loss of chilled None (See Remarks) Redundant MCR Air Conditioning Chiller B-B water - Stops Failure MCR Air Conditioning water flow Train A is started by any of

- Electrical Safety Train switchover Switches 0-PDIS-31-186, Failure via Switch 0-PDIS-31-186 0-FS-31-94, and 0-TS-31-89B Leakage through - Mechanical Annunciation in MCR of Decrease of None (See Remarks) Redundant MCR Air Conditioning seals Failure MCR Air Conditioning water content in Train A is started by any of Safety Train switchover the system Switches 0-PDIS-31-186, via 0-FS-31-94, and 0-TS-31-89B Switches 0-PDIS-31-186, 0-FS-31-94, and 0-TS-31-89B 9.4-178 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 22 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 38A Check Valve Prevents reverse flow Stuck closed - Mechanical Annunciation in MCR of Loss of chilled None (See Remarks) Redundant MCR Air Conditioning 0-CKV-31-2193 Failure MCR Air Conditioning water flow Train B is started by any of Safety Train switchover Switches 0-PDIS-31-161, via 0-FS-31-84, and 0-TS-31-88B Switches 0-PDIS-31-161, 0-FS-31-84, and 0-TS-31-88B Stuck open - Mechanical None (See None (See Remarks) The subsystem has only one Failure Remarks) pump. Check valve is preventing backflow during maintenance 38B Check Valve Prevents reverse flow Stuck closed - Mechanical Annunciation in MCR of Loss of chilled None (See Remarks) Redundant MCR Air Conditioning 0-CKV-31-2235 Failure MCR Air Conditioning water flow Train B is started by any of Safety Train Switchover Switches 0-PDIS-31-186, via Switches 0-FS-31-94, and 0-TS-31-89B 0-PDIS-31-186, 0-FS-31-94, and 0-TS-31-89B Stuck open - Mechanical None (See None (See Remarks) The subsystem has only one Failure Remarks) pump. Check valve is preventing backflow during maintenance 39 Chilled Water Provide chilled water Pipe break or - Mechanical Annunciation in MCR of Decrease of None (See Remarks) Redundant MCR air conditioning Piping system flow path crack Failure MCR Air Conditioning water content in subsystems are started by any of Safety Train switchover the system the associated switches via Switches 0-PDIS-31-161, 0-FS-31-84, and 0-PDIS-31-161, 0-TS-31-88B for Train A and 0-FS-31-84, and 0-TS-31-88B for Train A 0-PDIS-31-186, 0-FS-31-96, and and 0-PDIS-31-186, 0-TS-31-89B for Train B 0-FS-31-94, and 0-TS-31-89B for Train B.

9.4-179 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 23 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 40 Chilled Water Provides shut-offs - Leakage - Mechanical Annunciation in MCR of Decrease of None (See Remarks) Redundant MCR air conditioning System Manual Failure MCR Air Conditioning water content in subsystems are started by any of Shut-off Valves Safety Train switchover the system the associated switches via 0-PDIS-31-161, 0-FS-31-84, and Switches 0-PDIS-31-161, 0-TS-31-88B for Train A and 0-FS-31-84, and 0-TS-31-88B for Train A 0-PDIS-31-186, 0-FS-31-96, and and 0-PDIS-31-186, 0-TS-31-89B for Train B 0-FS-31-94, and 0-TS-31-89B for Train B.

41 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3978 Secondary Alarm Failure need not be postulated as being Station Room and concurrent with fire Communications Room Closed during - Fusible Link Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of Failure Maintenance Remarks) operation 42 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks None (See None (See Remarks) Single failures of HVAC system 0-ISD-31-2037 Communications Room Failure Remarks) need not be postulated as being and Mechanical concurrent with fire Equipment Room 692.0-C10 Closed during - Fusible Link Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of Failure Maintenance Remarks) operation 9.4-180 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 24 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 43 Fire Dampers (4) Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2036, Communication Room Failure need not be postulated as being 0-ISD-31-2038, and Mechanical concurrent with fire 0-ISD-31-2039, Equipment Room and 692.0-C10 and 0-ISD-31-3951 Communication Room and corridor, respectively Closed during - Fusible Link Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of Failure Maintenance Remarks) operation 44 Fire Damper (2) Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-4617 corridor and Mechanical Failure need not be postulated as being and Equipment concurrent with fire 0-ISD-31-3941 Room 692.0-C2 Closed during - Fusible Link Surveillance and None (See See Remarks Fire damper has dual fusible links other modes of Failure Maintenance Remarks) operation 45 Fire Damper Fire barrier and isolation Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 2-ISD-31-2058 between Unit 2 Auxiliary Failure need not be postulated as being Instrument Room and - Electrical concurrent with fire. See Item Computer Room Failure 69B for CO2 system spurious actuation Closed during - Fusible Link Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of Failure Maintenance Remarks)

WBNP-99 operation 9.4-181

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 25 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 46 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3968 Computer Room and Failure need not be postulated as being Unit 1 Auxiliary concurrent with fire Instrument Room Closed during - Fusible Link Surveillance and None (See None (See Remarks) Fire damper has two independent other modes of Failure Maintenance Remarks) fusible links installed operation 47 Fire Dampers (2) Fire barrier and isolation Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3956 between Computer Failure need not be postulated as being and Room and Unit 1 - Electrical concurrent with fire. See Item 0-ISD-31-3957 Auxiliary Instrument Failure 69B for CO2 system spurious Room (CO2 actuated) activation.

Closed during - Fusible Link Surveillance and None (See None (See Remarks) Additional independent fusible other modes of Failure Maintenance Remarks) link to be installed operation 48 Fire Dampers (3) Isolation of the Unit 1 Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 1-ISD-31-3958, Auxiliary Instrument Failure need not be postulated as being 1-ISD-31-3959, Room - Electrical concurrent with fire. See Item and 1-ISD- Failure 69B for CO2 system spurious 31-3961 actuation Closed during - Fusible Link None (See None (See Remarks) Additional independent fusible other modes of Failure Remarks) link is installed operation 9.4-182 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 26 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 49 Fire Damper Prevent spreading of Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-4297 fire Failure need not be postulated as being concurrent with fire Closed during - Fusible Link Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of Failure Maintenance Remarks) operation 50 Backdraft Damper See Remarks See Remarks See Remarks See Remarks See Remarks See Remarks This backdraft damper is not 0-BKD-31-2086 required since the air flow can be controlled by Balancing Damper 0-31-2087 and is locked in open position 51 Fire Damper To maintain fire barrier Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3971 integrity between Unit 1 (See Remarks) Failure need not be postulated as being Auxiliary Instrument concurrent with fire Room Elev. 708.0 and Mechanical Equipment Room 692.0-C2 Fusible link Mechanical Surveillance and None (See None (See Remarks) This fire damper has two failure (See (fusible link Maintenance Remarks) independent fusible links Remarks) failure) 9.4-183 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 27 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 52A Isolation Damper Isolate Electrical Board Close during - Mechanical Annunciation in MCR of Loss of air flow None (See Remarks) Redundant Train B AHUs C-B 0-FCO-31-30 Room AHUs A-A and AHUs A-A and Failure MCR Air Conditioning path through and D-B start on low air flow B-B while on standby B-A operation - Electrical Safety Train Switchover AHUs A-A and signal from AHUs A-A and B-A Failure via Switches B-A Air Flow Switches FS-31-117 or 0-PDIS-31-211, FS-31-123 0-FS-31-117 and -123, and 0-TS-31-150B Open when - Mechanical None (See None (See Remarks) Backdraft dampers 0-31-2001A AHUs are on Failure Remarks) and 0-31-2001B prevents standby - Electrical backflow and Auxiliary Control Air Failure 52B Isolation Damper Isolate Electrical Board Close during - Mechanical Annunciation in MCR of Loss of air flow None (See remarks) Redundant Train A AHUs A-A 0-FCO-31-31 Room AHUs C-B and AHUs C-B and Failure MCR Air Conditioning path through and B-A start on low air flow D-B while on standby D-B operation - Electrical Safety Train Switchover AHUs C-B and signal from AHUs C-B and D-B Failure via Switches D-B Air Flow Switches FS-31-126 or 0-PDIS-31-241, FS-31-154 0-FS-31-126 and -154, and 0-TS-31-157B Open when - Mechanical None (See None (See Remarks) Backdraft Dampers 0-31-3972 AHUs are on Failure Remarks) and 0-31-3973 prevents backflow standby - Electrical and Auxiliary Control Air Failure 9.4-184 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 28 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 53A Modulating Modulates the air flow Open - Mechanical Annunciation in MCR of Air bypasses None (See Remarks) Temperature Switch TS-31-150B Dampers (2) through cooling coil and Failure MCR Air Conditioning the cooling coil starts the redundant AHUs upon 0-FCO-31-335 & bypass of AHU's A-A & - Control Air Safety Train and results in Temp. Element TE-31-150B 0-FCO-31-336 B-A to maintain the Failure Switchover[1] via increase of sensing high return air temperature at Switches 0-FS-31-117 space temperature thermostat setpoint and -123, and 0-TS temperature 0-TE-31-335 and -336 150B Spurious - Control Space is not None (See Remarks) Same as above modulation Failure maintained at set temperature 53B Modulating Modulates air flow Open - Mechanical Annunciation in MCR of Air bypasses None (See Remarks) Temperature Switch TS-31-157B Dampers (2) through cooling coil and Failure MCR Air Conditioning the cooling coil starts the redundant AHUs upon 0-FCO-31-337 and bypass of AHUs C-B - Control Air Safety Train Switchover and results in Temp. Element TE-31-157B 0-FCO-31-338 and D-B to maintain the Failure via Switches increase of sensing high return air temperature at 0-FS-31-126 and -154, space temperature thermostat setpoint and 0-TS-31-157B temperature 0-TE-31-337 and 0-TE-31-338 Spurious - Control Space is not None (See Remarks) Same as above modulation Failure maintained at set temperature 9.4-185 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 29 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 54A Electrical Board Rooms (EBR) Air Handling Units (AHU) A-A and B-A

-Filters Filters the air Clogged Accumulation of Surveillance Reduced air None. (See Remarks) Surveillance (PDI-31-120 and dirt PDI-31-120 and flow

-121) and maintenance of filters 121, and Maintenance and in accordance with maintenance Annunciation in procedures. Either Temp. Switch MCR of EBR Air 0-TS-31-150B or Flow Switches Conditioning Safety 0-FS-31-117 and -123 starts Train Switchover via redundant AHUs C-B and D-B Switches 0-FS-31-117 and

-123, and 0-TS-31-150B

-Cooling Coil Cools the supply air Cooling coil tube -Mechanical Annunciation in Temperature None (See Remarks) Redundant AHUs C-B and D-B break or crack Failure MCR of EBR Air increases in the starts upon signal from AHUs A-A Conditioning Safety EBR spaces. and B-A High Temp Switch Train Switchover via Switches TS-31-150B 0-PDIS-31-211, 0-FS-31-117 and

-123, and 0-TS-31-150B

-Humidifier Provides moisture to No humidification -Steam Boiler Moisture Indicator None (See None (See Remarks) Maintenance of the relative maintain the design Failure MI-31-231 on Local Remarks) humidity is not required for safe Relative Humidity in -Steam Control Panel L-523 shutdown of plant EBR spaces during Valve closes normal operation mode -Mechanical Failure

-Electrical Failure 9.4-186 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 30 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS

-Fan Circulates the air -Fails to start -Mechanical Annunciation in Loss of air flow None (See Remarks) Redundant AHUs C-B and D-B

-Stops Failure MCR of EBR Air through AHU starts upon signal from AHUs A-A

-Electrical Failure Conditioning Safety and B-A Air Flow Switches Train Switchover via Switches FS-31-117 or FS-31-123 0-FS-31-117 and

-123, and 0-TS-31-150B

-Fails to stop or Electrical Failure Annunciation in Increased None (See Remarks) When both AHUs are operating, start MCR of EBR Air pressure in duct the common ductowork static Conditioning Safety pressure does not exceed Train Switchover via 6 inches wg safety-related duct Switches design pressuer 0-FS-31-117 and

-123, and 0-TS-31-150B 54B Electrical Board Rooms (EBR) Air Handling Units (AHU) C-B and D-B

-Filters Filters the air Clogged Accumulation of Surveillance Reduced air None. (See Remarks) Surveillance (PDI-31-125 and dirt PDI-31-125 and flow may result

-152) and maintenance of filters PDI-31-152, and in rise of space Maintenance and temperatures in accordance with maintenance Annunciation in procedures. Either Temp. Switch MCR of EBR Air 0-TS-31-157B or Flow Switches Conditioning Safety 0-FS-31-126 and -154 starts Train Switchover via redundant AHUs A-A and B-A Switches 0-FS-31-126 and

-154, and 0-TS-31-157B 9.4-187 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 31 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS

-Cooling Coil Cools the supply air Cooling coil tube -Mechanical Annunciation in Temperature None (See Remarks) Redundant AHUs A-A and B-A break or crack Failure MCR of EBR Air increases in the starts upon signal from AHUs C-B Conditioning Safety EBR spaces. and D-B High Temp Switch Train Switchover via Switches TS-31-157B 0-PDIS-31-241, 0-FS-31-126 and

-154, and 0-TS-31-157B

-Humidifier Provides moisture to No humidification -Steam Boiler Moisture Indicator None (See None (See Remarks) Maintenance of the relative maintain the design Failure MI-31-261 on Local Remarks) humidity is not required for safe Relative Humidity in -Steam Control Panel L-524 shutdown of plant EBR spaces during Valve closes normal operation mode -Mechanical Failure

-Electrical Failure 54B -Fan Circulates the air -Fails to start -Mechanical Annunciation in Loss of air flow None (See Remarks) Redundant AHUs A-A and B-B Cont. -Stops Failure MCR of MCR Air through AHUs starts upon signal from AHUs C-B

-Electrical Failure Conditioning Safety C-B and D-B and D-B Air Flow Switches Train Switchover via FS-31-126 or FS-31-154 Switches 0-FS-31-126 and

-154, and 0-TS-31-157B

-Fails to stop or Electrical Failure Annunciation in Increased None (See Remarks) When both AHUs are operating, start MCR of MCR Air pressure in duct the common ductwork static Conditioning Safety pressure does not exceed Train Switchover via 6 inches wg safety-related duct Switches 0-FS-31-126 and design pressuer WBNP-99

-154, and 9.4-188 0-TS-31-157B

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 32 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 55A Backdraft Prevent backflow from Fails to open - Mechanical Annunciation in Loss of air flow None (See Remarks) Redundant AHUs C-B and D-B Dampers (2) Train B AHUs through Failure MCR of EBR Air through AHUs starts upon signal from AHUs A-A 0-BKD-31-2001A Train A air handling Conditioning Safety A-A and B-A or B-A Air Flow Switches and units when on standby Train Switchover via FS-31-117 and FS-31-123, 0-BKD-31-2001B Switches respectively 0-PDIS-31-211, 0-FS-31-117 and

-123, and 0-TS-31-150B Fails to close None (See None (See remarks) Isolation Damper 0-FCO-31-30 (AHUs A-A and - Mechanical Remarks) prevents the backflow B-A on standby) Failure 55B Backdraft Prevent backflow from Fails to open - Mechanical Annunciation in Loss of air flow None (See Remarks) Redundant AHUs A-A and B-A Dampers (2) Train A AHUs through Failure MCR of EBR Air through AHUs starts upon signal from AHUs C-B 0-BKD-31-3972 Train B air handling Conditioning Safety A-A and B-A or D-B Air Flow Switches and units when on standby Train Switchover via FS-31-126 and FS-31-154, 0-BKD-31-3973 Switches 0-PDIS-respectively 241, 0-FS-31-126 and

-154, and 0-TS-31-157B Fails to close None (See None (See Remarks) Isolation Damper 0-FCO-31-31 (AHUs C-B and - Mechanical Remarks) prevents the backflow D-B on standby) Failure 9.4-189 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 33 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 56 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3942 Mechanical Equipment Failure need not be postulated as being Room 692.0-C2 and concurrent with fire 250V Battery Room #1 Closed during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Mechanical Maintenance Remarks) operation Failure 57 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3943 250V Battery Room #1 Failure need not be postulated as being and 250V Battery Board concurrent with fire Room #1 Fire damper has dual fusible links Closed during Surveillance and None (See None (See Remarks) other modes of - Fusible Link maintenance Remarks) operation Failure 58 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3944 250V Battery Board failure need not be postulated as being Room #1 and 250V concurrent with fire Battery Board Room #2 Fire damper has dual fusible links Closed during Surveillance and None (See None (See Remarks) other modes of - Fusible Link Maintenance Remarks) operation Failure 9.4-190 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 34 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 59 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3947 250V Battery Board Failure need not be postulated as being Room #2 and 250V concurrent with fire Battery Room #2 Fire damper has dual fusible links Closed during Surveillance and None (See See Remarks other modes of - Mechanical Maintenance Remarks) operation Failure 60 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3948 250V Battery Room #2 Failure need not be postulated as being and 24V and 48V concurrent with fire Battery Room Fire damper has dual fusible links Closed during None (See None (See See Remarks other modes of - Fusible Link Remarks) Remarks) operation Failure 61 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3949 24V and 48V Battery Failure need not be postulated as being Room and 24V and 48V concurrent with fire Battery Board and Charge Room Fire damper has dual fusible links Closed during Surveillance and None (See See Remarks other modes of - Mechanical Maintenance Remarks) operation Failure 9.4-191 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 35 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 62 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3950 24V and 48V Battery Failure need not to be postulated as Board and Charge being concurrent with fire Room and Central Alarm Station Room Closed during Surveillance and None (See See Remarks Additional independent fusible other modes of - Fusible Link Maintenance Remarks) link is installed operation Failure 63 Fire Dampers (2) Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3976 Central Alarm Station Failure need not to be postulated as and 0-ISD Room and being concurrent with fire 3977 Communication Room Closed during Surveillance and None (See See Remarks Additional independent fusible other modes of - Mechanical Maintenance Remarks) link is installed operation Failure 64 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC systems 0-ISD-31-3970 Unit 1 Auxiliary Failure need not to be postulated as Instrument Room and being concurrent with fire the Mechanical Equipment Room 692.0-C2 Closed during Surveillance and None (See None (See Remarks) This fire damper has two other modes of - Mechanical Maintenance Remarks) independent fusible links operation Failure 9.4-192 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 36 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 65 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3969 Unit 1 Auxiliary Failure need not to be postulated as Instrument Room and being concurrent with fire Computer Room Closed during Surveillance and None (See None (See Remarks) Fire damper has two independent other modes of - Mechanical Maintenance Remarks) fusible links installed operation Failure 66 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 2-ISD-31-3955 Computer Rooms and Failure need not be postulated as being Unit 2 Auxiliary concurrent with fire. See Item Instrument Room 69B for CO2 system spurious actuation Closed during Surveillance and None (See None (See Remarks) other modes of - Fusible Link Maintenance Remarks) Fire damper has dual fusible links operation Failure 67 Fire Damper Fire barrier in EBR Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-4296 supply to computer Failure need not be postulated as being room concurrent with fire Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 9.4-193 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 37 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 68 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3956 Unit 1 Auxiliary Failure need not be postulated as being Instrument Room and concurrent with fire. See Item Computer Room 69B for CO2 system spurious failure Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 69A Fire Damper Provide isolation of Unit Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 1-ISD-31-3960 1 Auxiliary Instrument Failure need not be postulated as being Room during CO2 fire concurrent with fire. See Item extinguishing 69B for CO2 system spurious failure. This fire damper has CO2 actuator without fusible link See Item 69B for CO2 system spurious failure 69B Fire Damper Provide isolation of Closed during a - Electrical Failure Annunciation in Loss of cooling None (See Remarks) Plant can be shut down from 2-ISD-31-2058 Unit #1 and Unit #2 spurious MCR following a in Unit #1 and Auxiliary Control Room 2-ISD-31-3955 Auxiliary Instrument actuation of the CO2 discharge Unit #2 Auxiliary 0-ISD-31-3956 Rooms and Computer CO2 system Instrument 0-ISD-31-3657 Room during CO2 fire Rooms and 1-ISD-31-3958 extinguishing. Computer 1-ISD-31-3959 Room 1-ISD-31-3960 1-ISD-31-3961 9.4-194 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 38 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 70A EBR Water Cooling of chilled water - Fails to start - Mechanical Annunciation in Increase in None (See Remarks) Redundant EBR air conditioning Chiller A-A - Stops Failure MCR of EBR Air chilled water subsystem is started by any of

- Electrical Failure Conditioning Safety temperature Switches 0-PDIS-31-211, Train Switchover via 0-FS-31-117 and -123, and Switches 0-TS-31-150B 0-PDIS-31-211, 0-FS-31-117 and

-123, and 0-TS-31-150B 70B EBR Water Chiller Cooling of chilled water - Fails to start - Mechanical Annunciation in Increase in None (See Remarks) Redundant EBR air conditioning B-B - Stops Failure MCR of EBR air chilled water subsystem is started by any of

- Electrical Failure conditioning safety temperature Switches 0-PDIS-31-241, train switchover via 0-FS-31-126 and -156, and Switches 0-TS-31-157B 0-PDIS-31-241, 0-FS-31-126 and

-154, and 0-TS-31-157B 9.4-195 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 39 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 71A EBR Chilled Water Circulate the chilled - Fails to start - Mechanical Annunciation in Loss of chilled None (See Remarks) Redundant EBR air conditioning Circ. Pump A-A water - Stops Failure MCR of EBR air water flow Train B is started by any of

- Electrical Failure conditioning safety Switches 0-PDIS-31-211, train switchover via 0-FS-31-117 and -123, and Switch 0-TS-31-150B 0-PDIS-31-211 Leakage through Annunciation in Decrease of None (See Remarks) Same as above seals - Mechanical MCR of EBR air water content in Failure conditioning safety the system train switchover via Switches 0-PDIS-31-211, 0-FS-31-117 and

-123, and 0-TS-31-150B 71B EBR Chilled Water Circulate the chilled - Fails to start - Mechanical Annunciation in Loss of chilled None (See Remarks) Redundant EBR air conditioning Circ. Pump B-B water - Stops Failure MCR of EBR air water flow Train A is started by any of

- Electrical Failure conditioning safety Switches 0-PDIS-31-241, train switchover via 0-FS-31-126 and -154, and Switch 0-TS-31-157B 0-PDIS-31-241 Leakage through Annunciation in Decrease of None (See Remarks) Same as above seals - Mechanical MCR of EBR air water content in Failure conditioning safety the system train switchover via Switches 0-PDIS-31-241, 0-FS-31-126 and

-154, and 0-TS WBNP-99 157B 9.4-196

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 40 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 72A Check Valve Prevent reverse flow Stuck closed - Mechanical Annunciation in Loss of chilled None (See Remarks) Redundant EBR air conditioning 0-CKV-31-2307 Failure MCR of EBR air water flow Train B is started by any of conditioning safety Switches 0-PDIS-31-211, train switchover via 0-FS-31-117 and -123, and Switches 0-TS-31-150B 0-PDIS-31-211, 0-FS-31-117 and

-123, and Stuck open 0-TS-31-150B None (See None (See Remarks) The subsystem has only one

- Mechanical Remarks) pump. Check valve prevents Failure backflow during maintenance 72B Check Valve Prevent reserve flow Stuck closed - Mechanical Annunciation in Loss of chilled None (See Remarks) Redundant EBR air conditioning 0-CKV-31-2364 Failure MCR of EBR air water flow Train A is started by any of conditioning safety switches 0-PDIS-31-241, train switchover via 0-FS-31-126 and -154, and Switches 0-PDIS- 0-TS-31-157B.31-241, 0-PS 126 and -154 and 0- None (See TS-31-157B Remarks)

Stuck open None (See Remarks) The subsystem has only one

- Mechanical pump. Check valve prevents Failure backflow during maintenance.

9.4-197 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 41 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 73 Chilled Water Provide chilled water Pipe break or - Mechanical Annunciation in Decrease of None (See Remarks) Redundant EBR air conditioning Piping system flow path crack Failure MCR of EBR air water content in subsystem is started by any of conditioning safety the system Switches 0-PDIS-31-177 and train switchover via -123, 0-TS-31-150B for Train A, Switches and 0-PDIS-31-241, 0-FS-31-126 0-PDIS-31-211, and -154, and 0-TS-31-157B for 0-FS-31-117 and Train B

-123, and 0-TS-31-150B for Train A, and 0-PDIS-31-241, 0-FS-31-126 and

-154, and 0-TS-31-157B for Train B.

74 Chilled Water Provide Shut-Offs - Leakage - Mechanical Annunciation in Decrease of None (See Remarks) Redundant EBR Air Conditioning System manual Failure MCR of EBR air water content in Subsystems are started by any of shut-off valves conditioning safety the system the associated Switches train switchover via 0-PDIS-31-211, 0-FS-31-117 and Switches -123, and 0-TS-31-150B for 0-PDIS-31-211, Train A, and 0-PDIS-31-241, 0-FS-31-117 and 0-FS-31-126 and -154, and

-123, and 0-TS-31-157B for Train B 0-TS-31-150B for Train A, and 0-PDIS-31-241, 0-FS-31-126 and

-154, 0-TS-31-157B for Train B 9.4-198 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 42 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 75 Fire Dampers (3) Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2013 Battery Board Rooms Failure need not be postulated as being 0-ISD-31-2018 and Corridor concurrent with fire.

0-ISD-31-2029 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 76 Fire Dampers (3) Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2010 Battery Rooms and Failure need not be postulated as being 0-ISD-31-2021 Corridor concurrent with fire.

0-ISD-31-2028 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 77 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2024 24V and 48V Battery Failure need not be postulated as being Room and 250V Battery concurrent with fire.

Room #2 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 78 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2019 250V Battery Room #2 Failure need not be postulated as being and 250V Battery Board concurrent with fire.

Room #2 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Mechanical Maintenance Remarks) operation Failure 9.4-199 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 43 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 79 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3945 250V Battery Board Failure need not be postulated as being Room #2 and 250V concurrent with fire.

Battery Board Room #1 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 80 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2012 250V Battery Board Failure need not be postulated as being Room #1 and 250V concurrent with fire.

Battery Room #1 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 81 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2007 Battery Room #1 and Failure need not be postulated as being Mechanical Equipment concurrent with fire.

Room 692.0-C2 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 82A Battery Room Battery rooms exhaust - Fails to start - Mechanical Alarm in MCR via Loss of battery None (See Remarks) Redundant Battery Exhaust Fan Exhaust Fan A-A to prevent hydrogen -Stops Failure Airflow Switch rooms exhaust B-B starts on Low Air Flow signal buildup - Electrical Failure 0-FS-31-402 from Fan A-A Air FLow Switch 0-FS-31-402 82B Battery Room Battery rooms exhaust - Fails to start - Mechanical Alarm in MCR via Loss of battery None (See Remarks) Redundant Battery Exhaust Fan Exhaust Fan B-B to prevent hydrogen -Stops Failure Airflow Switch rooms exhaust A-A starts on Low Air Flow signal WBNP-99 buildup - Electrical Failure 0-FS-31-401 from Fan B-B Air Flow Switch 9.4-200 0-FS-31-401

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 44 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 83A Backdraft Damper Prevents backflow Fails to open - Mechanical Alarms in MCR via Loss of airflow None (See Remarks) Redundant Battery Exhaust Fan 0-BKD-31-2163 Failure Airflow Switch path through B-B starts on Low Air Flow signal 0-FS-31-402 Exhaust Fan from Fan A-A Air Flow Switch B-B 0-FS-31-402 Fails to close None (See None (See Remarks) Isolation Damper 0-FCO-31-28

- Mechanical Remarks) prevents backflow Failure 83B Backdraft Damper Prevents backflow Fails to open - Mechanical Alarms in MCR via Loss of airflow None (See Remarks) Redundant Battery Exhaust Fan 0-BKD-31-2162 Failure Airflow Switch path through A-A starts on Low Air Flow signal 0-FS-31-401 Exhaust Fan from Fan B-B Air Flow Switch B-B 0-FS-31-401 Fails to close None (See None (See Remarks) Isolation Damper 0-FCO-31-29

- Mechanical Remarks) prevents backflow Failure 84A Isolation Damper Isolates Fan A-A when Close during Fan - Mechanical Alarm in MCR via Loss of Airflow None (See Remarks) Redundant Battery Exhaust Fan 0-FC0-31-28 on standby A-A operation Failure Airflow Switch 0-FS- Path through B-B starts on Low Air Flow signal

- Electrical Failure 31-402 Exhaust Fan A- from Fan A-A Air Flow Switch 0-A FS-31-402.

Open when Fan Damper Status None (See None (See Remarks) Backdraft Damper A-A is on Standby - Mechanical Indication on Panel Remarks) 0-BKD-31-2163 will prevent Failure 1-M-9 in MCR via backflow through fan.

- Electrical Failure Limit Switch ZS 28 9.4-201 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 45 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 84B Isolation Damper Isolates Fan B-B when Close during Fan - Mechanical Alarm in MCR via Loss of Airflow None (See Remarks) Redundant Battery Exhaust Fan 0-FC0-31-29 on standby B-B operation Failure Airflow Switch 0-FS- Path through A-A starts on Low Air Flow signal

- Electrical Failure 31-401 Exhaust Fan A- from Fan B-B Air Flow Switch 0-A FS-31-401.

Open when Fan Damper Status None (See None (See Remarks) Backdraft Damper 0-BKD B-B is on Standby - Mechanical Indication on Panel Remarks) 2163 will prevent backflow Failure 1-M-9 in MCR via through fan.

- Electrical Failure Limit Switch 0-MTR-31-29/BRE-B 85 Fire Damper Fire Barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3940 Mechanical Equipment Failure need not be postulated as Room 692.0-C2 and concurrent with fire.

Unit #1 Aux. Instr. Rm 708.0 C1 Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 86 Fire Damper Fire Barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3939 Unit #1 Aux. Instr. Failure need not be postulated as Room 708.0 C1 and concurrent with fire.

Spreading Room Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 9.4-202 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 46 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 87 Fire Damper Fire Barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3932 Spreading Room and Failure need not be postulated as MCRHZ concurrent with fire.

Close during Surveillance and None (See None (See Remarks) Fire damper has dual fusible links other modes of - Fusible Link Maintenance Remarks) operation Failure 88 Tornado Damper Isolation during Tornado Fails to close - Mechanical Status Indication in None (See None (See Remarks) Redundant Tornado Damper 0-0-FC0-31-14 Event during Tornado Failure Mechanical Equip. Remarks) FC0-31-13 powered from Train B Event - Electrical Failure Rm. via Limit Switch and installed in series ZS-31-14 accomplishes isolation during Tornado Event Isolates exhaust from Spuriously closes -Electrical Failure Loss of Flow Alarm Loss of None (See Remarks) Operator turns on redundant Battery Room Exhaust in MCR, zone ventilation for exhaust fan C-B Fans A-A and B-B switches ZS-31-13 Battery Rooms and ZS-31-14 89 Tornado Damper Isolation during Tornado Fails to close - Mechanical Status Indication in None (See None (See Remarks) Redundant Tornado Damper 0-0-FC0-31-13 Event during Tornado Failure Mechanical Equip. Remarks) FC0-31-14 powered from Train A Event - Electrical Failure Rm. via Limit Switch and installed in series ZS-31-13 accomplishes isolation during Tornado Event Isolates exhaust from Spuriously closes -Electrical Failure Loss of Flow Alarm Loss of None (See Remarks) Operator turns on redundant Battery Room Exhaust in MCR, zone ventilation for exhaust fan C-B Fans A-A and B-B switches ZS-31-13 Battery Rooms and ZS-31-14 90 Spreading Room Supply of Ventilation Air Fails to Stop on - Electrical Failure None (See None (See Remarks) Isolation Dampers 0-FC0-31-9 &

Supply Fan to Spreading Room CRI signal Remarks) 10 are closed during CRI and no air is supplied to Spreading Room 9.4-203 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 47 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 90A Spreading Room Fan: Supply ventilation Failure of the - Mechanical Surveillance and None (See None (See Remarks) Amount of outleakage generated Non-Safety Supply air to spreading room nonsafety related Failure Maintenance for fan. Remarks) by this failure will not increase the Fan and Isolation dampers: Provide fan to stop - Electrical Failure Status indication in total MCRHZ outleakage beyond Damper 0-FC0 isolation of MCRHZ concurrent with MCR on Panel 1-M- the maximum allowable make-up 10 or 0-FC0-31-9 from spreading room failure of one of 9 for dampers. air quantity. Therefore, the the two dampers positive pressure of 1/8" wg failing to close on minimum is maintained even a CRI signal under this failure condition 91 Isolation Damper Isolation of MCRHZ Open during CRI - Mechanical Status Indication in None (See None (See Remarks) Redundant Safety Train B 0-FC0-31-10 from Spreading Room Failure MCR on Panel 1-M- Remarks) Isolation Valve 0-FC0-31-9

- Electrical Failure 9 via Limit Switch installed in series will be closed ZS-31-10 during CRI to provide isolation 92 Isolation Damper Isolation of MCRHZ Open during CRI - Mechanical Status Indication in None (See None (See Remarks) Redundant Safety Train A 0-FC0-31-9 from Spreading Room Failure MCR on Panel 1-M- Remarks) Isolation Valve 0-FC0-31-10

- Electrical Failure 9 via Limit Switch installed in series will be closed ZS-31-9 during CRI to provide isolation 93 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3933 Mechanical Equipment Failure need not be postulated as being Room and Spreading concurrent with fire Room Close Surveillance and None (See None (See Remarks) Spreading Room ventilation is

- Mechanical Maintenance Remarks) isolated during CRI Failure 94 Spreading Room Exhaust of Spreading Fails to stop - Electrical Failure None (See None (See Remarks) Isolation Dampers 0-FC0-31-9 Exhaust Fans (2- Room during CRI Remarks) and 0-FC0-31-10 are closed 100%) A-A & B-B during CRI 95 Isolation Dampers Isolation of Spreading Open during CRI - Mechanical Status Indication in None (See None (See Remarks) The fans are stopped during CRI 0-FC0-31-25 for Room from outside Failure MCR on Panel 1-M- Remarks)

Fan A-A and 0- - Electrical Failure 9 via Limit Switches WBNP-99 FCO-31-26 for Fan ZS-31-25 & ZS 9.4-204 B-B 26

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 48 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 96 Backdraft Damper Prevent backflow to Open during CRI - Mechanical Surveillance and None (See None (See Remarks) Isolation Dampers 0-FC0-31-25 0-BKD-31-2152 Spreading Room Failure Maintenance Remarks) and 0-FC0-31-26 are closed during CRI 97 Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3953 Spreading Room and Failure need not be postulated as being Turbine Room concurrent with fire Closed during Surveillance and None (See None (See Remarks) Spreading Room ventilation is other modes of - Mechanical Maintenance Remarks) isolated during CRI operation Failure 98 Tornado Damper Isolation during Tornado Fails to close - Mechanical Status Indication in None (See None (See Remarks) Redundant Tornado Damper 0-0-FC0-31-24 Event during Tornado Failure Mech Equip Room Remarks) FC0-31-23 powered from Train A (Train B) Event - Electrical Failure via Limit Switch ZS- and installed in series 31-24 accomplishes isolation during Tornado Event Isolates Battery Room Closes spuriously -Electrical Failure Loss of flow alarm in Loss of None (See Remarks) Spreading Room ventilation is not exhaust fans C-B and MCR, zone switches ventilation for essential and Battery Rm Exhaust spreading room ZS-31-23, -24 spreading room Fan C-B does not normally run.

exhausts (Battery Rm fan C-B is idle) 99 Tornado Damper Isolation during Tornado Fails to close - Mechanical Status Indication in None (See None (See Remarks) Redundant Tornado Damper 0-0-FC0-31-23 Event during Tornado Failure Mech Equip Room Remarks) FC0-31-24 powered from Train B (Train A) Event - Electrical Failure via Limit Switch ZS- and installed in series 31-23 accomplishes isolation during Tornado Event Isolates Battery Room Closes spuriously -Electrical Failure Loss of flow alarm in Loss of None (See Remarks) Spreading Room ventilation is not exhaust fans C-B and MCR, zone switches ventilation for essential and Battery Rm Exhaust spreading room ZS-31-23, -24 spreading room Fan C-B does not normally run.

exhausts (Battery Rm fan WBNP-99 C-B is idle) 9.4-205

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 49 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 100 Toilet & Locker Provide exhaust of Fails to stop - Electrical Failure Surveillance and None (See None (See Remarks) Isolation Dampers 0-FC0-31-16 Room Exhaust toilets and lockers during CRI Maintenance Remarks) and -17 will close during CRI and Fan prevent exhaust air flow during CRI 100A Toilet & Locker Fan: Provides exhaust Failure of the - Mechanical Maintenance for fan. None (See None Amount of outleakage generated Room Non-Safety of toilets & lockers. nonsafety related Failure Status indication in Remarks) by this failure will not increase the Exhaust Fan & Dampers: Provide fan to stop - Electrical Failure MCR on Panel 1-M- total MCRHZ outleakage beyond Isolation Damper isolation of MCRHZ concurrent with 9 for dampers the maximum allowable make-up 0-FCO-31-17 or 0- from outside during CRI failure of one of air quantity. Therefore, the FCO-31-16 the two dampers positive pressure of 1/8" wg failing to close on minimum is maintained even a CRI signal under this failure condition 101 Isolation Damper Isolation of MCRHZ Open during CRI - Mechanical Status Indication in None (See None (See Remarks) Redundant Safety Train B 0- FCO-31-17 during CRI from outside Failure Control Room on Remarks) Isolation Damper 0-FCO-31-16

- Electrical Failure Panel 1-M-9 via will be closed during CRI Limit Switch ZS 17 102 Tornado Damper Isolation of MCRHZ Open during CRI - Mechanical Status Indication in None (See None (See Remarks) Redundant Safety Train A 0-FCO-31-16 during CRI from outside Failure Control Room on Remarks) Isolation Damper 0-FCO-31-17

- Electrical Failure Panel 1-M-9 via will be closed during CRI Limit Switch ZS 16 103 Tornado Damper Isolation of MCRHZ Fails to close - Mechanical Status Indication via None (See None (See Remarks) Redundant Tornado Damper 0-FCO-31-18 during Tornado Event during Tornado Failure Limit Switch ZS Remarks) 0-FCO-31-15 powered from (Train B) Event - Electrical Failure 18 Train A and installed in series accomplishes isolation during Tornado Event 9.4-206 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 50 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 104 Tornado Damper Isolation of MCRHZ Fails to close - Mechanical Status Indication via None (See None. (See Remarks) Redundant Tornado Damper 0-FCO-31-15 during Tornado Event during Tornado Failure Limit Switch ZS Remarks) 0-FCO-31-18 powered from (Train A) Event - Electrical Failure 15 Train B and installed in series accomplishes isolation during Tornado Event 105A Emergency Power Provide power to the Power Train A - Mechanical Alarm/indication in Loss of Train A None (See Remarks) Redundant Train B Control to Train A Control Building HVAC fails Failure MCR Control Building Building HVAC System with its System Train A (Diesel Generator HVAC Systems Train B electrical power is Failure) available

- Electrical Failure 105B Emergency Power Provide power to the Power Train B - Mechanical Alarm/indication in Loss of Train B None (See Remarks) Redundant Train A Control to Train B Control Building HVAC fails Failure MCR Control Building Building HVAC System with its System Train B (Diesel Generator HVAC Systems Train A electrical power is Failure) available

- Electrical Failure 106A Auxiliary Control Provide safety related Loss of Auxiliary - Mechanical Alarm/indication in Loss of Train A None (See Remarks) Redundant Train B Control Air System Train A control air to Train A Air System Train Failure MCR Control Building Building HVAC System with Train valves, dampers and A - Electrical Failure HVAC Systems B Aux. Control Air System is instruments available 106B Auxiliary Control Provide safety related Loss of Auxiliary - Mechanical Alarm/indication in Loss of Train B None (See Remarks) Redundant Train A Control Air System Train B control air to Train B Air System Train Failure MCR Control Building Building HVAC System with Train valves, dampers and B - Electrical Failure HVAC Systems A Aux. Control Air System is instruments available 9.4-207 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 51 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 107 Roof ventilators 1- Provide Turbine - Loss of power - Electrical Surveillance and None (See None Loss of power to Board 1A stops FAN-30-912, -913, Building El 755' to Board 1A maintenance Remarks) five roof ventilators and north

-916, -917 & -918 ventilation supply Fan 1, and results in on Board 1A operation of 15 roof ventilators @

28,500 cfm each and north supply 1-FAN-30-909, - Fan 2 @ 68,000 cfm and 2 south 910, -911, -914 & supply fans @ 35,000 cfm each

-915 on Board 1B resulting in lower than atmospheric pressure (68,000 +

2-FAN-30-912, - 2x35,000 - 15X28,500 = -289,500 913, -916, -917 & - cfm) 918 on Board 2A 2-FAN-30-909, -

910, -911, -914, & -

915 on Board 2B North El 755 - Loss of power Surveillance and None (See None Loss of power to Board 1B stops Supply Fan 1, 1- to Board 1B maintenance Remarks) five roof ventilators and south FAN-30-924 on supply Fan 1, and results in Board 1A operation of 15 roof ventilators @

28,500 cfm each and 2 north South El 755 supply fan @ 68,000 cfm each Supply Fan 1, 1- and one South supply fan @

FAN-30-921 on 35,000 cfm resulting in lower than Board 1B atmospheric pressure (2x68,000 cfm + 35,000 - 15X28,500 cfm = -

North El 755 256,500 cfm)

Supply Fan 2, 2-FAN-30-924 on Board 2A 9.4-208 WBNP-99

Table 9.4-7 Failure Modes and Effects Analysis Control Building HVAC (Sheet 52 of 52)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 107 South El 755 - Loss of power Surveillance and None (See None Loss of power to Boards 1B and Cont. Supply Fan 2, 2- to Boards 1B and maintenance Remarks) 2B stops 10 roof vents and 2 FAN-30-921 on 2B south supply fans and results in Board 2B operation of 10 roof vents @

28,500 cfm each and 2 north supply fans @ 35,000 cfm each resulting in lower than atmospheric pressure (2x68,000 cfm 28,500 = -149,000 cfm)

Note:

1. Refer to TVA Calculation No. TI-639.

9.4-209 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 1 of 11)

Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 1 1-FAN-30-103 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 1A within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 1A and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers 1-FCO- supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 30-86, Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point

-87, -106 and - ABI signal. that one ABGTS filtration unit cannot 107. Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

5. The spurious operation of the supply fans and failure of one damper will not affect the safe shutdown of the plant, in accordance with analyses and test results.

Fan fails to stop Same as above, plus Same as above. AB air intake room None. (See An analysis has shown that the low with one safety- the non-safety temperature may reach Remarks). temperature condition inside the AB air related isolation building heating the minimum outside intake room would have no adverse damper failed system is not design temperature of impact on the ability of the plant to cope open during the operating. 13°F with an accident situation.

minimum outside design WBNP-99 conditions.

9.4-210

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 2 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 2 1-FAN-30-103 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation, the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 1A and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.Supply fan failure concurrent with an ABGTS Fan (handswitch placed ABGTS. ABGTS failure during a LOCA and FHA operates to in wrong position). has been determined not to be credible.

maintain a In addition, an analysis has shown that negative pressure For ABGTS Fan: ABGTS safety functions will not be in the ABSCE Mechanical failure, impeded by failures in ABI signals or relative to the train power failure, spurious actuation of AB general supply outside train signal failure. fans..

environment.

9.4-211 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 3 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 3 2-FAN-30-105 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 2B within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 2B and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 2-FCO-30-21, - Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point 22, -108, ABI signal. that one ABGTS filtration unit cannot

-109. Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

5. The spurious operation of the supply fans and failure of one damper will not affect the safe shutdown of the plant, in accordance with analyses and test results.

Fan fails to stop Same as above, plus Same as above. AB air intake room None. (See An analysis has shown that the low with one safety- the non-safety temperature may reach Remarks). temperature condition inside the AB air related isolation building heating the minimum outside intake room would have no adverse damper failed system is not design temperature of impact on the ability of the plant to cope open during the operating. 13°F with an accident situation.

minimum outside design conditions 9.4-212 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 4 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 4 2-FAN-30-105 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation. the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 2B and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.Supply fan failure concurrent with an ABGTS Fan (handswitch placed ABGTS. ABGTS failure during a LOCA or FHA operates to in wrong position). has been determined not to be credible.

maintain a Also, see remark No. 2 for Item 2.

negative pressure For ABGTS Fan:

in the ABSCE Mechanical failure, relative to the train power failure, outside train signal failure.

environment.

9.4-213 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 5 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 5 1-FAN-30-102 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 1B within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 1B and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 1-FCO-30-86, - Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point 87, -106 and -107 ABI signal. that one ABGTS filtration unit cannot Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

5. The spurious operation of the supply fans and failure of one damper will not affect the safe shutdown of the plant, in accordance with analyses and test results.

Fan fails to stop Same as above, plus Same as above. AB air intake room None. (See An analysis has shown that the low with one safety- the non-safety temperature may reach Remarks). temperature condition inside the AB air related isolation building heating the minimum outside intake room would have no adverse damper failed system is not design temperature of impact on the ability of the plant to cope open during the operating. 13°F with an accident situation.

minimum outside design conditions 9.4-214 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 6 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 6 1-FAN-30-102 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation. the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 1B and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.Supply fan failure concurrent with an ABGTS Fan (handswitch placed ABGTS. ABGTS failure during a LOCA or FHA operates to in wrong position). has been determined not to be credible.

maintain a Also, see remark No. 2 for Item 2.

negative pressure For ABGTS Fan:

in the ABSCE Mechanical failure, relative to the train power failure, outside train signal failure.

environment.

9.4-215 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 7 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 7 2-FAN-30-104 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 2A within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 2A and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 2-FCO-30-21, - Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point 22, -108 and -109 ABI signal. that one ABGTS filtration unit cannot Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

5. The spurious operation of the supply fans and failure of one damper will not affect the safe shutdown of the plant, in accordance with analyses and test results.

Fan fails to stop Same as above, plus Same as above. AB air intake room None. (See An analysis has shown that the low with one safety- the non-safety temperature may reach Remarks). temperature condition inside the AB air related isolation building heating the minimum outside intake room would have no adverse damper failed system is not design temperature of impact on the ability of the plant to cope open during the operating. 13°F with an accident situation.

minimum outside design conditions 9.4-216 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 8 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 8 2-FAN-30-104 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation. the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 2A and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.Supply fan failure concurrent with an ABGTS Fan (handswitch placed ABGTS. ABGTS failure during a LOCA or FHA operates to in wrong position). has been determined not to be credible.

maintain a Also, see remark No. 2 for Item 2.

negative pressure For ABGTS Fan:

in the ABSCE Mechanical failure, relative to the train power failure, outside train signal failure.

environment.

9 1-FAN-30-159 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, MCR for dampers. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 1A and and remain closed (exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers isolation prevent flow of remark 1). open to A-Auto. separately receive independently trained Dampers unfiltered exhaust ABI or RAD detection signals.

1-FCO-30-160,- air from Aux. Bldg.

161 to outside, after an 3. Ventilation space maintained below ABI signal. outside pressure. Reverse flow through operable (closed) damper prevents release by fan flow path.

9.4-217 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 9 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 10 2-FAN-30-274 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, MCR for dampers. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 2A and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers prevent flow of remark 1). open to A-Auto. separately receive independently trained 2-FCO-30-271, - unfiltered exhaust ABI or RAD detection signals.

272 air from the Aux.

Bldg. to outside, 3. Venitilation space maintained below after an ABI outside pressure. Reverse flow through signal. operable (closed) damper prevents relaease by fan flow path.

11 1-FAN-30-162 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, MCR for damper. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 1B and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers prevent flow of remarks). open to A-Auto. separately receive independently trained 1-FCO-30-166, - unfiltered exhaust ABI or RAD detection signals.

167 air from the Aux.

Bldg. to outside, 3. Ventilation space maintained below after an ABI outside pressure. Reverse flow through signal. operable (closed) damper prevents release by fan flow path.

9.4-218 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 10 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 12 2-FAN-30-278 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, the MCR. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 2B and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers prevent flow of remark 1). open to A-Auto. separately receive independently trained 2-FCO-30-275, - unfiltered exhaust ABI or RAD detection signals.

276 air from the Aux.

Bldg. to outside, 3. Ventilation space maintained below after an ABI outside pressure. Reverse flow through signal. operable (closed) damper prevents release by fan flow path.

13 0-FAN-30-136 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, the MCR. Remarks. required to stop running during a DBE.

Fuel Handling during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related Area Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan A-A and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers 0-FCO- prevent flow of remark 1). open to A-Auto. separately receive independently trained 30-137, -138 unfiltered exhaust ABI or RAD detection signals.

air from the Aux.

Bldg. to outside, 3. Ventilation space maintained below after an ABI outside pressure. Reverse flow through signal. operable (closed) damper prevents release by fan flow path.

9.4-219 WBNP-99

Table 9.4-8 Failure Modes and Effects Analysis for Active Failures Subsystem: Auxiliary Building General Ventilation (Sheet 11 of 11)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item Component Method of Effect on No. Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 14 0-FAN-30-139 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, the MCR for damper. Remarks. required to stop running during a DBE.

Fuel Handling during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related Area Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan B-B and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers 0-FCO- prevent flow of Remark 1). open to A-Auto. separately receive independently trained 30-140, -141 unfiltered exhaust ABI or RAD detection signals.

air from the Aux.

Bldg. to outside, 3. Ventilation space maintained below after an ABI outside pressure. Reverse flow through signal. operable (closed) damper prevents release by fan flow path.

9.4-220 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-8A Failure Modes And Effects Analysis for Active Failures for Components Common to the Aux Bldg Hvac Subsystem (Sheet 1 of 2)

Method of Item No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1 Auxiliary Building Deenergizes Signal fails. Train A vital ac bus MCR indiation of Loss of redundancy in None. (See Remarks) Train A and Train B ABI Isolation (ABI) solenoid valves to failure; Relay VKA only one train of ABSCE isolation and initiating signals are derived signal Train A. close associated 1 failure; Train A ABGTS fan starting ESF coolers actuation. from independent (train dampers; stops AB initiating signal and one train of separated) qualified devices.

general ventilation (Phase A ABSCE dampers fans; starts various containment closing. Either train signal will stop all ESF room coolers. isolation, high rad general supply and exhaust in refueling area) fans, and fuel handling area failure. exhaust fans. An analysis has shown that the failure of an Operator error, Unnecessary isolation ABI signal will not have an Spurious signal. spurious initiating None. of ABSCE, initiation of None. (See Remarks) adverse effect on the ABGTS signal (initiating ESF coolers and safety function.

signals listed startup of ABGTS.

above.)

2 Auxiliary Building Deenergizes Signal fails. Train B vital ac bus MCR indiation of Loss of redundancy in None. (See Remarks) Train A and Train B ABI Isolation (ABI) solenoid valves to failure; Relay only one train of ABSCE isolation and initiating signals are derived signal Train B. close associated VKB1 failure; Train ABGTS fan starting ESF coolers actuation. from independent (train dampers; stops AB B initiating signal and one train of separated) qualified devices.

general ventilation (Phase A ABSCE dampers fans; starts various containment closing. Either train signal will stop all ESF room coolers. isolation, high rad general supply and exhaust in refueling area) fans, and fuel handling area failure. exhaust fans. An analysis has shown that the failure of an Operator error, Unnecessary isolation ABI signal will not have an Spurious signal. spurious initiating None. of ABSCE, initiation of None. (See Remarks) adverse effect on the ABGTS signal (initiating ESF coolers and safety function.

WBNP-99 signals listed startup of ABGTS.

9.4-221 above.)

Table 9.4-8A Failure Modes And Effects Analysis for Active Failures for Components Common to the Aux Bldg Hvac Subsystem (Sheet 2 of 2)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Method of Item No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 3 Train A Provides Class 1E Loss of or Diesel generator Alarm and indication Loss of redundancy in None. (See Remarks) Redundant Train B HVAC Emergency diesel-backed inadequate failure; bus fault in MCR. safety-related HVAC system available.

Power. power supply to voltage. (Train A); Operator system.

active components error.

of Train A of AB HVAC subsystems.

4 Train B Provides Class 1E Loss of or Diesel generator Alarm and indication Loss of redundancy in None. (See Remarks) Redundant Train A HVAC Emergency diesel-backed inadequate failure; bus fault in MCR. safety-related HVAC system available.

Power. power supply to voltage (Train B); Operator system.

active components error.

of Train B of AB HVAC subsystems.

9.4-222 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-8B Failure Modes and Effects Analysis for Auxiliary Building HVAC Subsystem Passive Failures (Sheet 1 of 2)

Method of Item No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1 Intake opening Provides air supply Blockage Mechanical ----------------- Loss of Redundancy None. (See Remarks) Redundant intake opening will (one for each of intake to 480V Failure. Foreign in providing air supply. supply sufficient air to the room two dampers in Transformer Room Object.

each Transformer 1A, 1B, 2A, and Room). 2B.

2 Refrigerant Provides flowpath Leakage Cracks No direct indication Loss of effectiveness None. (See Remarks) Redundant Chillers and AHUs Piping and Valves for refrigerant from of leakage. of one Chiller and are provided.

for Chiller or Chiller to AHU and associated AHUs Condensing Unit back to Chiller. redundant loop.

Opposite Train Chiller and AHUs are independent and remain available.

3 Close in the event Spuriously See Remarks See Remarks None. (See Remarks) None. (See Remark #2.) 1.Double fusible links will of fire. closes. prevent spurious closure..

Fire Dampers 2.An analysis has shown that fire dampers have no identifiable realistic failure mechanisms as passive components.

3.Single active failure is not postulated per WB-DC-40-64 Design Basis Events Design Criteria.

Fails to close See Remarks See Remarks None. (See Remarks) None. (See Remarks) Fire Protection Report postulates no failures other than those directly attributable to the fire.

9.4-223 WBNP-99

Table 9.4-8B Failure Modes and Effects Analysis for Auxiliary Building HVAC Subsystem Passive Failures (Sheet 2 of 2)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Method of Item No. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 4 Ductwork in the Provides Leakage Cracks --------------------------- Minimal localized None Only small cracks are Auxiliary Building containment for air reduction of negative postulated due to seismic Gen. Vent and flow path and pressure and qualification of ductwork. Most A/C subsystems controlled minimized effect on of air leaking from flow path distribution and temperature of areas. will enter the areas for which it exhausting of is intended.

cooling/ventilating air. Loss of fluid (air) is not a concern since the system is in the same fluid.

9.4-224 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 1 of 26)

Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 1 0-CHR-31-36/2-A Provides Fails to start; Fails Mechanical failure; Annunciator of (See Remarks) None 1.Equipment includes CW pump and chilled water while running. Train A power Shutdown Board motor and compressor and motor.

Chilled Water to Train A failure; Control Room HVAC System (See Remarks)

Package A-A (Train A) AHUs. signal failure from A-A Abnormal. 2.Control of the CWCP, 0-PMP 0-PDIS-31-101-A; Indicating lights in 36/1-A, and AHUs A-A and B-A is 0-FS-31-43-A; MCR (0-HS-31-400A). interlocked with Chiller A-A.

0-FS-31-38-A; Compressor running 3.The system design intent is such 0-TS-31-40B-A; and light on MCC. that loss of one chiller results only in O-TS-31-48B-A. the loss of redundancy in providing chilled water for cooling Unit 1 and Unit 2 Shutdown Board Rooms. The redundant train chiller serves AHUs C-B and D-B. Chiller A-A will stop automatically and Chiller B-B will start automatically on:

Low DP at Circulating Water Cooling Pump for Chiller A-A.

T > Setpoint at air inlet to Train A AHUs.

Low air flow at AHU A-A or B-A.

4.The switchover to the standby chiller uses separation relays in a non-divisional Train A associated power supply.

9.4-225 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 2 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 1 0-CHR-31-36/2-A Reduction of Loss of refrigerant; Inlet temperature Loss of None, (See (cont cooling capacity Chiller freeze up; indication on L-551 or redundancy in remarks)

Chilled Water Control signal L-538 for AHU air cooling air flow.

Package A-A failure. intake in 6.9 kV (Train A) (cont'd) Shutdown Board See remark #3.

Room.

See remark #1.

2 0-CHR-31-49/2-B Provides Fails to start; Fails Mechanical failure; Annunciation of Loss of None, See remark 1.Equipment includes CW pump &

chilled water while running Train B power Shutdown Board Redundancy #3 motor and compressor & motor.

Chilled Water Package to Train B failure; Control Room Hvac System 2.Control of the CWCP, 0-PMP B-B (Train B) AHUs. signal failure from B-B Abnormal. 49/1-B, and AHUs C-B and D-B is 0-PDIS-31-131-B, Indicating lights in interlocked with Chiller B-B.

0-FS-31-51-B, MCR (0-HS-31-49A). 3.The system design intent is such 0-FS-31-57-B, Compressor running that loss of one chiller results only in 0-TS-31-60B-B, light on MCC. the loww of redundancy in providing 0-TS-31-52B-B. chilled water for cooling Unit 1 and Unit 2 Shutdown Board Rooms. The redundant train dchiller seves AHUs A-A and B-A. Chiller B-B will stop automatically and Chiller A-A will start automatically on:

Low DP at Circulating Water Cooling Pump for Chiller B-B.

T > Setpoint at air inlet to Train B AHUs.

Low air flow at AHU C-B or D-B.

4.The switchover to the standby chiller uses separation relays in a non-divisional Train A associated WBNP-99 power supply.

9.4-226

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 3 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 2 0-CHR-31-49/2-B Reduction of Loss of refrigerant; Inlet temperature Loss of None, (See (cont cooling capacity. chiller freeze up; indication on L-540 or redundancy in remarks)

Chilled Water Package Control signal L-537 for AHU air cooling air flow.

B-B (Train B) (cont'd) failure. intake in 6.9 kV Shutdown Board Room.

9.4-227 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 4 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 3 0-AHU-31-45 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Redundant Review of the schematics cooling air to while running. Train A power Shutdown Board redundancy in Train B Chiller B-B establishes that the AHUs A-A and Air Handling Unit A-A maintain failure. Control Room HVAC System cooling air to Unit and AHU C-B on C-B (on Unit 1 side) are (Train A) required signal failure; A-A Abnormal. 1 side Shutdown Unit 1 side will independent.

temperatures sensing failure for Indicating lights in Board rooms. automatically start for Shutdown 0-TS-31-40A or MCR (0-HS-31-400A- on: AHU A-A is interlocked to Board Rooms 0-TS-31-48A A). AHU A-A running automatically start on Chiller A-A safety-related light on MCC. Low DP at start.

equipment on Circulating the Unit 1 Chilled Water Either train of AHUs (Train A AHUs side. Pump. A-A and B-A or Train B AHUs C-B Low Air flow at and D-B) is capable of providing cooling air to the Aux. Control Room.

AHU A-A or T > Setpoint at inlet to Train A AHU.

Fails to stop or Electrical Failure Annunciation in the Increased None (See When both Air Handling Units are starts while unit C- MCR. pressure in supply Remarks) operating the common ductwork B is operating. duct. static pressure does not exceed 6 in. wg. duct design pressure.

9.4-228 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 5 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 4 0-AHU-31-44 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Review of the schematics cooling air to while running. Train A power Shutdown Board redundancy in Redundant Train B establishes that the AHUs B-A and Air Handling Unit B-A maintain failure; control Room HVAC System cooling air to Unit Chiller B-B and D-B (on Unit 2 side) are (Train A) required signal failure; A-A Abnormal. 2 side Shutdown AHU D-B on Unit 2 independent.

temperatures sensing failure for Indicating lights in Board rooms. side will for Shutdown 0-TS-31-40A or MCR (0-HS-31-400A- automatically start AHU B-A is interlocked to Board Rooms 0-TS-31-48A. A). AHU B-A running on: automatically start on Chiller A-A Safety-related light on MCC. start.

equipment on Low DP at the Unit 2 Circulating Either train of AHUs (Train A AHUs side. Chilled Water A-A and B-A or Train B AHUs C-B Pump. and D-B) is capable of providing Low Air flow at cooling air to the Aux. Control Room.

AHU B-A or T > Setpoint at inlet to Train A AHU.

Fails to stop or Electrical Failure Annunciation in the Increased None (See When both Air Handling Units are starts while unit D- MCR. pressure in supply Remarks) operating, the common ductwork B is operating. duct. static pressure does not exceed 6 in. wg. duct design pressure.

9.4-229 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 6 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 5 0-AHU-31-55 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Review of the schematics cooling air to while running. Train B power Shutdown Board redundancy in Redundant Train A establishes that the AHUs A-A and Air Handling Unit C-B maintain failure. Control Room HVAC System cooling air to Unit Chiller A-A and C-B (on Unit 1 side) are (Train B) required signal failure; B-B Abnormal. 1 side Shutdown AHU A-A on Unit 1 independent.

temperatures sensing failure for Indicating lights on Board rooms. side will for Shutdown 0-TS-31-52A or MCR (0-HS-31-49A- automatically start AHU C-B is interlocked to Board Rooms 0-TS-31-60A B). AHU C-B running on: automatically start on Chiller B-B safety-related light on MCC. start.

equipment on Low DP at the Unit 1 Circulating Either train of AHUs (Train A AHUs side. Chilled Water A-A and B-A or Train B AHUs C-B Pump. and D-B) is capable of providing Low Air flow at cooling air to the Aux. Control Room.

AHU C-B or T > Setpoint at inlet to Train B AHU.

Fails to stop or Electrical Failure Annunciation in the Increased None (See When both Air Handling Units are starts while unit A- MCR. pressure in supply Remarks) operating, the common ductwork A is operating. duct. static pressure does not exceed 6 in. wg. duct design pressure.

9.4-230 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 7 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 6 0-AHU-31-61 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Review of the schematics cooling air to while running. Train B power Shutdown Board redundancy in Redundant Train A establishes that the AHUs B-A and Air Handling Unit D-B maintain failure; control Room HVAC System cooling air to Unit Chiller A-A and D-B (on Unit 2 side) are (Train B) required signal failure; B-B Abnormal. 2 side Shutdown AHU A-A on Unit 2 independent.

temperatures sensing failure for Indicating lights in Board rooms and side will for Shutdown 0-TS-31-52A or MCR (0-HS-31-49A- 480V Shutdown automatically start AHU D-B is interlocked to Board Rooms 0-TS-31-60A B). AHU D-B running Board Room Unit on: automatically start on Chiller B-B safety-related light on MCC. 2 side. start.

equipment on Low DP at the Unit 2 Circulating Either train of AHUs (Train A AHUs side. Chilled Water A-A and B-A or Train B AHUs C-B Pump. and D-B) is capable of providing Low Air flow at cooling air to the Aux. Control Room.

AHU D-B or T > Setpoint at inlet to Train B AHU.

Fails to stop or Electrical Failure Annunciation in the Increased None (See When both Air Handling Units are starts while unit MCR. pressure in supply Remarks) operating, the common ductwork A-A is operating. duct. static pressure does not exceed 6 in. wg. duct design pressure.

9.4-231 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 8 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 7 0-PMP-31-36/1-A Provides Fails to start; Fails Mechanical failure; Annunciator 2-113 for Loss of None. Control of 0-PMP-31-36/1-A is water to the while running. Train A power 0-PDIS-31-101-A. redundancy in Redundant Train B interlocked with Chiller A-A to Chilled Water Package Water Chiller failure; Control Indicating lights for 0- supplying cooling Chiller B-B will automatically start after chiller start.

A-A A-A loop. signal failure; start HS-31-400A in MCR. air to the automatically start Review of the control and schematic Cooling Water signal failure; Shutdown Board on Lo DP at the diagrams establishes the Circulating Pump operator error Chilled water Rooms of both pump and will redundancy and independence of (handswitch placed Temperature and units. provide cooling the Train A and Train B pumps.

in wrong position). Pressure indication on water to AHUs C-B L-541. and D-B.

8 0-PMP-31-49/1-B Provides Fails to start; Fails Mechanical failure; Annunciator 2-120 for Loss of None. 0-PMP-31-49/1-B is interlocked to water for to while running. Train B power 0-PDIS-31-131-B. redundancy in Redundant Train A automatically start after Chiller B-B Chilled Water Package the Water failure; Control Indicator lights for 0- supplying cooling Chiller A-A will start. Review of the control and B-B Cooling Water Chiller B-B signal failure; start HS-31-49A in MCR. air to the automatically start schematic diagrams establishes the Circulating Pump loop. signal failure; Shutdown Board on Lo DP at the redundancy and independence of operator error Chilled Water Rooms of both pump and will the Train A and Train B pumps.

(handswitch placed Temperature and units. provide cooling in wrong position). Pressure indication on water to AHUs A-A L-542. and B-A.

9.4-232 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 9 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 9 TCV-31-112 Provides Spuriously bypass Mechanical failure; See Remark #1. Potential loss of None. 1.Local indication on L-551 of inlet control of too much flow. Control Air failure; redundancy of Redundant Train B air temperature to AHU A-A.

Temperature Control water Sensor failure. Train A Chiller A-A Chiller B-B and Valve for AHU A-A. temperature and AHU A-A associated AHUs 2.Temp. rise in Shutdown rooms >

to AHU A-A resulting in air C-B and D-B can Setpoint will automatically cause from Chiller A- temperature rise in provide cooling air Train A Chiller with AHUs A-A and B-A by Shutdown Board supply. A to stop, and Train B with AHUs C-regulating the Room. B and D-B to start.

flow of chilled See Remark #2.

water to AHU. 3.The temperature control valves for the AHUs are served by the Aux. Air Supply. The trains are separate.

Provides Spuriously bypass Mechanical failure; See Remark #1. Potential loss of None. 1.Local indication on L-538 of inlet 10 0-TCV-31-108 control of too much flow. Control Air failure; redundancy of Redundant Train B air temperature to AHU B-A.

water Sensor failure. Train A Chiller A-A Chiller B-B and Temperature Control temperature and AHU B-A associated AHUs 2.Temp. rise in Shutdown rooms >

Valve for AHU B-A. to AHU B-A resulting in air C-B and D-B can Setpoint will automatically cause from Chiller A- temperature rise in provide cooling air Train A Chiller with AHUs A-A and B-A by Shutdown Board supply. A to stop, and Train B with AHUs C-regulating the Room. B and D-B to start.

flow of chilled See Remark #2.

water to AHU. 3.The temperature control valves for the AHUs are served by the Aux. Air Supply. The trains are separate.

9.4-233 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 10 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 11 0-TCV-31-142 Provides Spuriously bypass Mechanical failure; See Remark #1. Potential loss of None. 1.Local indication on L-537 of inlet control of too much flow. Control Air failure; redundancy of Redundant Train A air temperature to AHU C-B.

Temperature Control water Sensor failure. Train B Chiller B-B Chiller A-A and Valve for AHU C-B. temperature and AHU C-B associated AHUs 2.Temp. rise in Shutdown rooms >

to AHU C-B resulting in air A-A and B-A can Setpoint will automatically cause from Chiller B- temperature rise in provide cooling air Train B Chiller with AHUs C-B and B by Shutdown Board supply. D-B to stop and Train A with AHUs regulating the Room. A-A and B-A to start.

flow of chilled See Remark #2.

water to AHU. 3.The temperature control valves for the AHUs are served by the Aux. Air Supply. The trains are separate.

12 0-TCV-31-138 Provides Spuriously bypass Mechanical failure; See Remark #1. Potential loss of None. 1.Local indication on L-540 of inlet control of too much flow. Control Air failure; redundancy of Redundant Train A air temperatures to AHU D-B.

Temperature Control water Sensor failure. Train B Chiller B-B Chiller A-A and Valve for AHU D-B. temperature and AHU D-B associated AHUs 2.Temp. rise in Shutdown rooms >

to AHU D-B resulting in air A-A and B-A can Setpoint will automatically cause from Chiller B- temperature rise in provide cooling air Train B Chiller with AHUs C-B and B by Shutdown Board supply. D-B to stop and Train A with AHUs regulating the Room. A-A and B-A to start.

flow of chilled See Remark #2.

water to AHU. 3.The temperature control valves for the AHUs are served by the Aux. Air Supply. The trains are separate.

9.4-234 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 11 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 13 0-BKD-31-2706 Prevents Fails to backseat Mechanical failure. See Remarks A) Loss of cooling None. (See 1.Indirect indication of functional backflow of air to room served Remarks) failure of AHU; MCR indication of Backdraft Damper cooling air Local position by the AHU AHU A-A and B-A motors running; through indicators on the local indication on L-551 of high inlet standby AHU damper will indicate if B) Bypass flow temp. to AHU A-A.

C-B when damper is stuck open. through the AHU A-A is standby unit can 2.Operability of the dampers is running. cause standby fan periodically verified.

to rotate in reverse. Due to loss of cooling to room. Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total loss of cooling air 1.Normally opens when AHU is in the Shutdown running.

Board Rooms See Remark #2. 2.Indirect indication of functional Provides flow Fails to open Mechanical failure. Loss of None. failure of AHU; local indication on path for air (Stuck closed) redundancy in Low flow from AHU L-537 of inlet temperature to flow from when AHU C-B is cooling air flow will automatically AHU C-B.

AHU. running (Train B) from Shutdown initiate Train "A" Board Room. chiller and AHUs.

9.4-235 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 12 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 14 0-BKD-31-2761 Prevents Fails to backseat. Mechanical failure. See Remark #1. A) Loss of cooling None. (See 1.Indirect indication of functional backflow of Local position air to room served Remarks) failure of AHU; MCR indication of Backdraft Damper cooling air indicators on the by the AHU. AHU B-A and A-A motors running; through damper will indicate if local indication on L-538 of high inlet standby AHU damper is stuck open B) Bypass flow temperature to AHU B-A.

D-B when when the fan is idle. through the AHU B-A is standby unit can 2.Operability of the dampers is running. cause standby fan periodically verified..

to rotate in reverse. Due to loss of cooling to room, Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total loss of cooling air in the Shutdown Board Rooms. 1.Normally opens when AHU is running.

2.Indirect indication of functional Provide flow Fails to open Mechanical failure See Remark #2. Loss of None. failure of AHU; local indication on path for air (Stuck closed) redundancy in L-540 of inlet temp. to AHU D-B.

flow from when AHU D-B is cooling air flow Low flow from AHU AHU. running (Train B) from Shutdown will automatically board Room. initiate Train "A" WBNP-99 Chiller and AHUs.

9.4-236

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 13 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 15 0-BKD-31-2705 Prevents Fails to backseat. Mechanical failure. See Remark #1. A) Loss of cooling None. (See 1.Indirect indication of functional backflow of Local position air to room served Remarks) failure of AHU; MCR indication of Backdraft Damper cooling air indicators on the by the AHU. AHU C-B and D-B motors running; through damper will indicate if local indication on L-537 of inlet standby AHU damper is stuck open. B) Bypass flow temperature to AHU C-B.

A-A when through the AHU C-B is standby unit can 2.Operability of the dampers is running. cause standby fan periodically verified..

to rotate in reverse. Due to loss of cooling to room, Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total loss of cooling air in the Shutdown Board Rooms. 1.Normally opens when AHU is running.

2.Indirect indication of functional Provide flow Fails to open Mechanical failure. See Remark #2. Loss of None. failure of AHU; local indication on path for air (Stuck closed) redundancy in L-551 of inlet temperature to flow from when AHU A-A is cooling air flow (Low flow from AHU AHU A-A.

AHU. running. from Shutdown will automatically Board Room. initiate Train B WBNP-99 Chiller and AHUs.)

9.4-237

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 14 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 16 0-BKD-31-2760 Prevents Fails to backseat. Mechanical failure. See Remark #1. A) Loss of cooling None. (See 1.Indirect indication of functional backflow of Local position air to room served Remarks) failure of AHU; MCR indication of Backdraft Damper cooling air indicators on the by the AHU. AHU D-B and C-B motors running; through damper will indicate if local indication on L-540 of inlet standby AHU damper is stuck open. B) Bypass flow temperature to AHU D-B.

B-A when through the AHU D-B is standby unit can 2.Operability of the dampers is running. cause standby fan periodically verified..

to rotate in reverse. Due to loss of cooling to room, Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total loss of cooling air in the Shutdown Board Rooms. 1.Normally opens when AHU is running.

2.Indirect indication of functional Provide flow Fails to open Mechanical failure. See Remark #2. Loss of None. failure of AHU; local indication on path for air (Stuck closed) redundancy in (Low flow from AHU L-538 of inlet temperature to flow from when AHU B-A is cooling air flow will automatically AHU B-A.

AHU. running. from Shutdown initiate Train "B" Board Room. chiller and AHUs).

9.4-238 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 15 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 17 0-FAN-31-62-A Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressur- while running. Train A power MCR (1-HS-31-64A) redundancy in required to mitigate the effects of a Pressurizing Air Supply ization to failure; Control and CISP indicating providing DBE.

(After trip due to lo Fan A-A maintain signal failure. lights in MCR pressurization to suction flow to Fan 6.9kV (1-HS-31-64A). 6.9 kV Shutdown A-A, the redundant 2.Fans can be restarted after reset Shutdown Board Room. Train B Fan C-B will after Phase A CIS from Unit 1.

Board Room automatically start.) Review of the schematics at slightly See Remark #1. establishes the separation and positive independence of the Train A and pressure with Train B fans.

respect to atmosphere.

Indicating lights in None Fails to stop. Mechanical failure; MCR and CISP See Remark #2. (See Remark #3). 1.Fans can be stopped via Hot short in control indicating lights in HS-31-64 A or B.

wiring; Control MCR signal failure; CIS (1-HS-31-64A). 2.Over pressurization of 6.9 kV Phase A Control Shutdown Board Room A with signal failure. respect to MCR.

Alarm is MCR when CRI Control Room P between MCRHZ 3.)Differential pressure switches will Isolation signal - and ABSDBR is alarm if the P is not adequate and Train A fails. <1/8- inch w.g. start standby C-B emergency pressurizing fan during CRI mode to restore MCR P with respect to Shutdown Bd. Rooms.

9.4-239 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 16 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 18 0-FAN-31-67-B Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressuri- while running. Train B power MCR redundancy in required to mitigate the effects of a Pressurizing Air Supply zation to failure; Control (1-HS-31-64A) and providing DBE.

(After trip due to lo Fan C-B maintain 6.9 signal failure. CISP indicating lights pressurization to suction flow to Fan kV Shutdown in MCR 6.9 kV Shutdown C-B, the redundant 2.Fan can be restarted after reset Board Room (1-HS-31-64A). Board Room. Train A Fan A-A will after Phase A CIS from Unit 1.

at slightly automatically start.) Review of the schematics positive See Remark #1. establishes the separation and pressure with independence of the Train A and respect to Train B fans.

atmosphere.

Fails to stop. Mechanical failure; Indicating lights in See Remark #2. None 1.Fans can be stopped via HS-31-67 Hot short in control MCR and CISP (See Remark #3.) A or B.

wiring; Control indicating lights in signal failure; CIS MCR 2.Differential pressure switches will Phase A Control (1-HS-31-64A). alarm if the P is not adequate and signal failure. start standby CB emergency pressurizing fan during CRI mode to CRI Control Room Alarm in MCR when Over restore MCR P with respect to Isolation signal - P between MCRHZ pressurization of Shutdown Bd. Rooms.

Train A fails. and ABSDBR is 6.9 kV Shutdown

<1/8 inch w.g. Board Room A.

9.4-240 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 17 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 19 0-FAN-31-64-A Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressuri- while running. Train A power MCR and CISP redundancy in required to mitigate the effects of a Pressurizing Air Supply zation to failure; Control indicating lights in providing DBE.

(After trip due to lo Fan B-A maintain 6.9 signal failure. MCR pressurization to suction flow to Fan kV Shutdown (1-HS-31-62A). 6.9 kV Shutdown B-A, the redundant 2.Fan can be restarted after reset Board Room Board Room. Train B Fan D-B will after Phase A CIS from Unit 1.

at slightly automatically start.) Review of the schematics positive See Remark #1. establishes the separation and pressure with independence of the Train A and respect to Train B fans.

atmosphere.

None Fails to stop. Mechanical failure; Indicating lights in See Remark #2. (See Remark #3.) 1.Fans can be stopped via Hot short in control MCR and CISP HS-31-62 A or B.

wiring; Control indicating lights in signal failure; CIS MCR 2.Differential pressure switches will Phase A Control (1-HS-31-62A). alarm if the P is not adequate and signal failure. start standby C-B emergency pressurizing fan during CRI mode to restore MCR P with respect to CRI Control Room Alarm in MCR when Over Shutdown Bd. rooms.

Isolation signal - P between MCRHZ pressurization of Train A fails. and ABSDBR is 6.9 kV Shutdown

<1/8 inch w.g. Board Room A.

9.4-241 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 18 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 20 0-FAN-31-68-B Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressur- while running. Train B power MCR and CISP redundancy in required to mitigate the effects of a Pressurizing Air Supply ization to failure; Control indicating lights in providing DBE.

(After trip due to lo Fan D-B maintain 6.9 signal failure. MCR (1-HS-31-68A). pressurization to suction flow to Fan kV Shutdown 6.9 kV Shutdown D-B, the redundant 2.Fan can be restarted after reset Board Room Board Room. Train A Fan B-A will after Phase A CIS from Unit 1.

at slightly automatically start.) Review of the schematics positive See Remark #1. establishes the separation and pressure with independence of the Train A and respect to Train B fans.

atmosphere.

Fails to stop. Mechanical failure; Indicating lights in See Remark #2. None 1.Fans can be stopped via HS-31-68 Hot short in control MCR and CISP (See Remark #2.) A or B.

wiring; Control indicating lights in signal failure; CIS MCR (1-HS-31-68A). 2.Differential pressure switches will Phase A Control alarm if the P is not adequate and signal failure. start standby C-B emergency pressurizing fan during CRI mode to restore MCR P with respect to CRI Control Room Alarm in MCR when Over Shutdown Bd. rooms.

Isolation signal - P between MCRHZ pressurization of Train A fails. and ABSDBR is 6.9 kV Shutdown

<1/8 inch w.g. Board Room B.

9.4-242 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 19 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 21 0-BKD-31-2756 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan C-B Backdraft Damper airflow to (when Fan C-B is Local position C-B. Loss of powered and running (HS-31-67A) in Pressurizing running). indicators on damper. redundancy in Train A Fan A-A will MCR and CISP.

Fan C-B. providing supply the pressurizing air pressurizing air. 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Rooms. the effects of a DBE.

Lo flow at FS 66 will be detected and automatically start fan A-A.

See Remark #2.

Mechanical failure. See Remark #1. Loss of None. 1.MCR and CISP indication of Fan Isolates idle Fails to backseat. Local position pressurizing air to A-A powered and running (HS Fan C-B from indicators on damper. room served by See Remarks #2. 64A).

running Fan the fan.

A-A. 2.The functioning of the Pressurizing Fans is not required for mitigating the effects of a DBE.

3.Operability of dampers is periodically verified.

9.4-243 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 20 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 22 0-BKD-31-2755 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan A-A airflow to (When Fan A-A is Local position A-A. Loss of powered and running (HS-31-64A) in Backdraft Damper Pressurizing running). indicators on damper. redundancy in (Train B Fan C-B MCR and CISP.

Fan A-A. providing will supply the pressurizing air pressurizing air.) 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Rooms. Lo the effects of a DBE.

flow at FS-31-65 will be detected and automatically start fan C-B.

See Remark #2.

Isolates idle Fails to backseat. Mechanical failure. See Remark #1. Loss of None. 1.MCR and CISP indication of Fan Fan A-A from Local position pressurizing air to C-B powered and running (HS running Fan indicators on damper. room served by (See Remark #2.) 67A).

C-B. the fan.

2.The functioning of the Pressurizing Fans is not required for mitigating the effects of a DBE.

9.4-244 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 21 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 23 0-BKD-31-2812 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan B-A airflow to (When Fan B-A is (Local position B-A. Loss of powered and running (HS-31-62A) in Backdraft Damper Pressurizing running). indicators on redundancy in (See Remark #2.) MCR and CISP.

Fan B-A. damper.) providing pressurizing air 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Rooms. Lo the effects of a DBE.

flow on FS-31-63 will be detected and automatically start Fan D-B.

(See Remark #2.)

Isolates idle Fails to backseat. Mechanical failure. See Remark #1. None. 1.MCR and CISP indication of Fan Fan B-A from Local position Loss of C-B powered and running (HS running Fan indicators on damper. pressurizing air to (See Remark #2.) 67A).

D-B. room served by the Fan. 2.The functioning of the Pressurizing Fans is not required for mitigating the effects of a DBE.

9.4-245 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 22 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 24 0-BKD-31-2811 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan D-B airflow to (when Fan D-B is (Local position D-B. Loss of powered and running (HS-31-68A) in Backdraft Damper Pressurizing running). indicators on redundancy in (Train A Fan B-A MCR and CISP.

Fan D-B. damper.) providing will supply the pressurizing air pressurizing air.) 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Room. Lo the effects of a DBE.

flow at FS-31-69 will be detected and automatically start fan B-A.

See Remark #2.

Isolates idle Fails to backseat. Mechanical failure. See Remark #1. Loss of None. 1.MCR and CISP indication of Fan Fan D-B from (Local position pressurizing air to B-A powered and running (HS running Fan indicators on room served by (See Remark #2.) 62A).

B-A. damper.) the Fan.

2.The functioning of the Pressurizing Fans is not required for mitigating the effects of DBE.

9.4-246 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 23 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 25 0-FCO-31-276-A Provides Spuriously Closes Mechanical failure; Indicating light in Loss of suction to None. 1.Fails as is. Normally open.

suction flow (no tornado) Hot short in MCR (0-HS-31-34-A). Shutdown Board Tornado Damper Train path for the electrical supply. Mechanical Room Press. fans (See Remark #2.) 2.Pressurizing fans are not required A 6.9kV/480V Equipment Room on Unit 1 side. to mitigate the effects of a DBE.

shutdown indication. Locally, Loss of board room 0-ZS-31-276A-A pressurization There is no effect pressurizing status indication. function to 6.9 kV on the plant with the Fans A-A and Shutdown Board failure of the C-B. Indicating lights in Room A. damper to close.

MCR (0-HS-31-34). Redundant Mechanical failure, Mechanical Loss of tornado isoloation Fails to close when electrical equipment room isolation components are required for failure,Operator indication. Locally, redundancy. installed which Tornado error (hand switch 0-ZS-31-276A-A prevent the Pressurizing fans are not required protection. placed in wrong status indication. pressure differential during a tornado event.

position). from affecting the components downstream of this device.

9.4-247 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 24 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 26 0-FCO-31-275-B Provides Spuriously Closes Mechanical failure; Indicating lights in Loss of suction None. 1.Fails as is. Normally open. Motor suction flow (no tornado). Hot short in MCR (0-HS-31-35-B). due to Shutdown operated valve.

Tornado Damper Train path for the electrical supply. Mechanical Board Room (See Remark #2.)

B 6.9kV/480V Equipment Room Press. fans on Unit 2.Pressurizing fans are not required Shutdown indication. Locally, 1 side. Loss of to mitigate the effects of a DBE.

Board Rooms 0-ZS-31-275 status pressurization Pressurizing indication. function to 6.9 kV Fans A-A and Shutdown Board C-B. Room A.

Fails to close when Mechanical failure, Indicating lights in Loss of tornado There is no effect Pressurizing fans are not required required for electrical failure, MCR (0-HS-31-35). isolation on the plant with the during a tornado event.

Tornado Operator error Mechanical redundancy. failure of the protection. (hand switch placed Equipment Room damper to close.

in wrong position). indication. Locally, Redundant isolation 0-ZS-31-275A-B components are status indication. installed which would prevent the pressure differential from affecting the components downstream of this.

9.4-248 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 25 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 27 0-FCO-31-278-A Provides Spuriously Closes Mechanical failure; Indicating lights in Loss of suction None. 1.Fails as is. Normally open.

suction flow (no tornado) Hot short in MCR 0-(HS-31-32-A). due to Shutdown Tornado Damper path for the electrical supply. Mechanical Board Room (See Remark #2.) 2.Pressurizing fans are not required Train A 6.9kV/480V Equipment Room Press. fans on to mitigate the effects of a DBE.

Shutdown indication. Locally, Unit 2 side. Loss Board Rooms 0-ZS-31-278 status of pressurization Pressurizing indication. function 60 6.9 kV Fans B-A and Shutdown Board D-B (Unit 2). Room B.

Fails to close Mechanical failure, Indicating lights in Loss of tornado There is no effect Pressurizing fans are not required when required for electrical failure, MCR (0-HS-31-32). isolation on the plant with the during a tornado event.

Tornado Operator error Mechanical redundancy. failure of the protection. (hand switch placed Equipment Room damper to close.

in wrong position). indication. Locally, Redundant isolation 0-ZS-31-275A-A components are status indication installed which would prevent the pressure differential from affecting the components downstream of this.

9.4-249 WBNP-99

Table 9.4-9 Failure Modes and Effects Analysis Subsystem: Shutdown Board Room Air Conditioning and Ventilation (Sheet 26 of 26)

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 28 0-FCO-31-277-B Provides Spuriously Closes Mechanical failure; Indicating lights in Loss of suction None. 1.Fails as is. Normally open.

suction flow (no tornado) Hot short in MCR (0-HS-31-33-B). due to Shutdown Tornado Damper Train path for the electrical supply. Mechanical Board Room (See Remark #2.) 2.Pressurizing fans are not required B 6.9kV/480V Equipment Room Pressurization to mitigate the effects of a DBE.

Shutdown indication. Locally, fans on Unit 2 Board Rooms 0-ZS-31-277 status side. Loss of Pressurizing indication. pressurization Fans B-A and function to 6.9 kV D-B (Unit 2). Shutdown Board Room B.

Fails to close Mechanical failure, Indicating lights in Loss of tornado There is no effect Pressurizing fans are not required when required for electrical failure, MCR (0-HS-31-33). isolation on the plant with the during a tornado event.

Tornado Operator error Mechanical redundancy. failure of the protection. (hand switch placed Equipment Room damper to close.

in wrong position). indication. Locally, Redundant isolation 0-ZS-31-277A-B components are status indication installed which would prevent the pressure differential from affecting the components downstream of this.

9.4-250 WBNP-99

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS WATTS BAR Table 9.4-10 Failure Modes and Effects Analysis for Active Failures Subsystem: Main Steam Valve Vault Ventilation System (Sheet 1 of 1)

Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 1 1-FAN-30-26 and Provides Continues to run Electrical control No direct detection None, (See None, (See System Description and Freeze 1-FAN-30-302 outside air for after shutdown failure, operator method for the fan; Remarks) Remarks) protection procedure require that cooling of the command is given error (switch left in the indicating lights door and ventilation covers be South Steam or spuriously starts incorrect position). and hand switch are installed on both the north and south Valve Vault. after shutdown. local devices. main steam valve vaults should the This failure is of outside temperature drop below concern during 35°F. With the covers installed there periods when the would be little if any air flow ambient produced as a result of the fans temperature is at continuing to run. Therefore this the design failure would have no adverse minimum. impact on the plant.

2 1-FAN-30-25 and 301 Provides Continues to run Electrical control No direct detection None, (See None, (See System Description and Freeze outside air for after shutdown failure, operator method for the fan; Remarks) Remarks) protection procedure require that cooling of the command is given the indicating lights door and ventilation covers be error (switch left in North Steam or spuriously starts and hand switch are installed on both the north and south Valve Vault. after shutdown. incorrect position). local devices. main steam valve vaults should the This failure is of outside temperature drop below concern during 35°F. With the covers installed there periods when the would be little if any air flow ambient produced as a result of the fans temperature is at continuing to run. Therefore this the design failure would have no adverse minimum. impact on the plant.

9.4-251 WBNP-99

9.4-252 WATTS BAR Table 9.4-10A Failure Modes and Effects Analysis for Active Failures Subsystem: Post Accident Sampling System (Sheet 1 of 1)

Item No. Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 1 1-FAN-31-18A1 Provides Continues to run Electrical control No direct detection None, (See None, (See 1. An anaylsis was performed to heated (if after shutdown failure, operator method for the fan; Remarks) Remarks) show that the space temperatures required) command is given error (switch left in the indicating lights would remain within allowable outside air to or spuriously starts incorrect position). and hand switch are limits.

the post after shutdown. local devices.

accident One of the 2. Post accident, this system is sampling redundant manually energized. Post facility during isolation dampers accident sampling ventilation is periods of fails open controlled by procedures. These times that a (1-FCO-31-350 or procedures control operation of post accident 365). Heater this system and require the AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS sample is (1-HTR-31-479) ventilation system be shut down required. fails off. Outside after sampling is complete.

temperature at minimum design value.

WBNP-99

WATTS BAR WBNP-99 Table 9.4-11 Deleted by Amendment 56 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-253

WATTS BAR WBNP-99 THIS PAGE INTENTIONALLY LEFT BLANK 9.4-254 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-1 Powerhouse, Control Building Units 1 & 2 Flow Diagram for Heating, Ventilating, and Air Conditioning Air Flow 9.4-255

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-2 Powerhouse Units 1 & 2 Flow Diagram for Air Conditioning Chilled Water 9.4-256

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-3 Powerhouse, Control Building Units 1 & 2 Flow Diagram for Air Conditioning Chilled Water 9.4-257

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-4 Powerhouse, Control Building Units 1 & 2 Electrical Control Diagram Air Conditioning 9.4-258

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-4a Control Building Units 1 & 2 Electrical Air Conditioning Control Diagram - Chilled Water 9.4-259

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-5 Control Building units 1 & 2 Electrical Air Conditioning Control Diagram - Chilled Water 9.4-260

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-6 Control Building Units 1 & 2 Electrical Logic Diagram Air Conditioning System 9.4-261

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-7 Control Building Units 1 & 2 Electrical Logic Diagram Ventilation System 9.4-262

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-8 Powerhouse Units 1 & 2 Auxiliary Building Flow Diagram, Heating, and Ventilating Air Flow 9.4-263

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-9 Auxiliary Building Units 1 & 2 Electrical Logic Diagram for Ventilation System 9.4-264

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-10 Auxiliary Building Units 1 & 2 Electrical Logic Diagram for Ventilation System 9.4-265

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-11 Powerhouse Units 1 & 2 for Containment Ventilation Sytem Control Diagram WBNP-99 9.4-266

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-12 Powerhouse Units 1 & 2 Electrical Control Diagram for Radiation Monitoring System 9.4-267

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-13 Powerhouse Units 1 & 2 Auxiliary Building Flow Diagram for Heating, Cooling, and Ventilating Air Flow 9.4-268

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-14 Auxiliary Building Units 1 & 2 Flow Diagram for Heating, Cooling, and Ventilating Air Flow WBNP-99 9.4-269

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-15 Powerhouse Units 1 & 2 Auxiliary Building Flow Diagram for Heating, Ventilation and Air Conditioning Air Flow 9.4-270

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-16 Powerhouse Units 1 & 2 Auxiliary Building & Additional Eqpt Bldg Flow Diagram for Heating, Cooling & Ventilating Air Flow WBNP-99 9.4-271

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-17 Powerhouse Units 1 & 2 Electrical Control Diagram for Containment Ventilating System 9.4-272

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-18 Turbine Building Units 1 & 2 and Control Flow Diagram for Heating and Ventilating Air Flow 9.4-273

WATTS BAR WBNP-99 Figure 9.4-19 Powerhouse Units 1 & 2 Flow Diagram Building Heating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-274

WATTS BAR WBNP-99 Figure 9.4-20 Powerhouse Unit 2 Flow Diagram Building Heating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-275

Security-Related Information - Withheld Under 10CFR2.390 WATTS BAR WBNP-99 Figure 9.4-21 Pumping Stations Units 1 & 2 Mechanical Heating and Ventilating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-276

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-22 Diesel Generator Building Units 1 & 2 Flow and Control Diagram for Heating, Ventilating Air Flow WBNP-99 9.4-277

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-22a Additional Diesel Generator Building Units 1 & 2 Flow and Control Diagram for Heating and Ventilating Air Flow 9.4-278

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-22b Additional Diesel Generator Building Units 1 & 2 Electrical Logic Diagram for 5th Diesel Generator Ventilator System 9.4-279

Security-Related Information - Withheld Under 10CFR2.390 WATTS BAR WBNP-99 Figure 9.4-22c Additional Diesel Generator Building Mechanical Heating and Ventilating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-280

Security-Related Information - Withheld Under 10CFR2.390 WATTS BAR WBNP-99 Figure 9.4-23 Diesel Generator Building Mechanical Heating and Ventilating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-281

Security-Related Information - Withheld Under 10CFR2.390 WATTS BAR WBNP-99 Figure 9.4-24 Diesel Generator Building Mechanical Heating and Ventilating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-282

WATTS BAR WBNP-99 Figure 9.4-24a Diesel Generator Building Mechanical Heating and Ventilation AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-283

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-25 Diesel Building Units 1 & 2 Electrical Logic Diagram for Ventilation System 9.4-284

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-26 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilation System 9.4-285

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-27 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilation System 9.4-286

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-28 Reactor Building Units 1 & 2 Flow Diagram for Heating and Ventilation Air Flow 9.4-287

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-28a Powerhouse Reactor Building Unit 2 Flow Diagram Heating & Ventilation Air Flow 9.4-288

WATTS BAR WBNP-99 Figure 9.4-29 Powerhouse Unit 1 Electrical Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-289

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-30 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilating System 9.4-290

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-30 owerhouse Unit 2 Electrical Control Diagram Containment Ventilating System (Sheet A) 9.4-291

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-30 Powerhouse Unit 1 Electrical Control Diagram Containment Ventilating System (Sheet B) 9.4-292

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-31 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilating System 9.4-293

WATTS BAR WBNP-99 Figure 9.4-32 Powerhouse Unit 1 Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-294

WATTS BAR WBNP-99 Figure 9.4-33 Powerhouse Unit 1 Electrical Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-295

WATTS BAR WBNP-99 Figure 9.4-34 Powerhouse Unit 1 Electrical Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-296

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-35 Powerhouse Post-Accident Sampling System Unit 1 Flow Diagram for Heating, Ventilating and Air Conditioning Air Flow 9.4-297

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-36 Auxiliary Building Units 1 & 2 Electrical Post-Accident Sampling System Logic Diagram WBNP-99 9.4-298

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-99 Figure 9.4-37 Auxiliary Building Units 1 & 2 Electrical Post-Accident Sampling Control Diagram 9.4-299

WATTS BAR WBNP-99 THIS PAGE INTENTIONALLY BLANK AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-300

WATTS BAR WBNP-99 9.5 OTHER AUXILIARY SYSTEMS 9.5.1 Fire Protection System The WBN Fire Protection Program is described in the WBN Fire Protection Report.[2][3][4][5] For interface with a auxiliary feedwater system, see Section 10.4.9.

9.5.1.1 Deleted by Amendment 87 9.5.1.2 Deleted by Amendment 87 9.5.1.3 Deleted by Amendment 87 9.5.1.4 Deleted by Amendment 87 9.5.1.5 Deleted by Amendment 87 9.5.2 Plant Communications System 9.5.2.1 Design Bases Interplant and/or Offsite Systems The design basis for interplant and/or offsite communications is to provide dependable systems to ensure reliable service during normal plant operation and emergency conditions.

The primary interplant offsite communications systems are microwave radio, fiber optics circuits, telephone systems and radio systems.See Section 9.5.2.3 for a general description of each system.

Intraplant Communications The design basis for the intraplant communications is to provide sufficient equipment of various types such that the plant has adequate communications to start up, continue safe operation, or shutdown safely.

The primary intraplant communications systems are the TSS telephone system, intercoms, sound powered telephones, two-way VHF cellular radios, VHF radio paging, codes (code call is not used), alarms (accountability/evacuation and fire/medical), and paging.

See Section 9.5.2.2 for a general description of each system.

9.5.2.2 General Description Intraplant Communications The plant communications systems are installed and maintained by TVA with the exception of the cellular radio system which is maintained by the cell radio provider.

The following paragraphs describe the basic functions of the intraplant communications systems.

OTHER AUXILIARY SYSTEMS 9.5-1

WATTS BAR WBNP-99 Telephone System Telephone Switching System (TSS) - A TSS is installed to provide primary 2-way voice communications and data transmission throughout the Watts Bar Nuclear Plant as well as access to offsite circuits.

The Node 1 and Node 2 TSSs are powered from separate 48V dc systems. Each 48V system consists of battery chargers, a regulating power board, and a 48V battery.

Each battery charger is capable of assuming the total load for its respective Node. The selected charger provides 48V dc to its TSS with the battery available as needed. Each battery is sized to carry the load at full capacity for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> without the chargers. The Node 1 chargers are powered by dual ac voltage sources supplied from Train A and Train B diesel-backed boards. The Node 2 chargers are powered by dual ac voltage sources. The main source is the construction sub-station and the other is from the telephone diesel generator unit.

Sound-Powered Telephone Systems Plant Operation Systems - The primary purpose of these systems is to provide communications for maintenance and operations personnel. There are 7 separate systems provided for each unit.

Backup Control Center System - The primary purpose of this sound powered system is to provide alternative communications between the auxiliary control room and other stations which must be manned to shutdown the reactor if the MCR is abandoned.

This system consists of two completely redundant subsystems. Each subsystem is wired directly and independently of all other communications systems. Wiring routes avoid the spreading room, unit control rooms, and auxiliary instrument rooms.

Sound-powered equipment and circuits are provided in the Diesel Generator Buildings, the 480V ac shutdown board rooms, the 6.9 kV ac shutdown board rooms, and the auxiliary control room.

Health Physics System - The primary purpose of this sound powered telephone system is to provide an alternate communications link between the health physics office and the MCR. A direct dedicated circuit is provided between the health physics office and the Unit control room (physically on the electrical control area desk).

Diesel Building to Main Control Room - The primary purpose of this sound powered telephone system is to provide an alternate communications link between the Diesel Generator Building and main control room. A direct dedicated circuit is provided between the shielded waiting room in the Diesel Generator Building and the MCR at the diesel generator control panel.

9.5-2 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 Closed-Circuit Television Portable closed circuit television systems are provided, when necessary, for remotely viewing radwaste packaging operation, refueling operations, area and equipment surveillance, and maintenance activities.

Codes, Alarms, and Paging System The codes, alarms, and paging (CAP) system is one system that combines assembly and accountability alarm, fire and medical emergency alarm, and paging. Control logic, tone generation, and power and signal distribution equipment is located in the communications room with speakers with solid-state amplifier as end devices located throughout the plant.

All alarms are controlled from the MCR. The assembly/accountability and paging alarms are also controllable from the auxiliary control room.

Paging may be accessed from selected TSS telephones. Paging may also be accessed by paging handsets in the main and auxiliary control room.

The CAP system operational priority sequence is fixed by relay logic as follows:

(1) Site Assembly alarm (2) Fire and medical emergency alarm (3) Paging Paging can be advanced to a higher priority in emergencies by using the evacuation alarm control unit cancel push button.

Design consideration has been given to increase system reliability with the following features provided:

(1) Redundant operating centers.

(2) Three separate tone generator units.

(3) Two physically separate power distribution networks with approximately half of the amplifier-speaker units in each area of the plant fed from each fuse panel via alarm-type fuses.

(4) Redundant chargers are used and can be switched into service as required.

(5) DC supervision of each individual audio pair.

(6) Isolation of evacuation alarm actuating devices.

OTHER AUXILIARY SYSTEMS 9.5-3

WATTS BAR WBNP-99 (7) Electrical separation of amplified-speakers in each area into two circuits such that adequate coverage can be maintained in the event of one circuit failure.

Radio System Onsite Radio Paging System - The primary purpose of this system is to provide onsite paging of key plant personnel. This system is accessible from the TSS telephone system.

Inplant VHF Radio System - The primary purpose of this system is to provide voice communications throughout the plant for plant operations and maintenance personnel.

This system consists of several repeaters, numerous remote control units, and portable VHF radios. One or more repeaters may be used by the fire brigade for communications during a fire emergency. Nuclear Security personnel also have access to these repeaters as an alternative to the Nuclear Security Radio System.

Inplant Cellular Radio System - The primary purpose of this system is to provide voice communications throughout the plant and owner controlled property for use by operations and maintenance personnel. The system consists of a cell site, remote interface unit (to interface with the inplant distributed antenna system), and cell radio/phones. Nuclear Security and Fire Operations also have access to this system.

9.5.2.3 General Description Interplant System Microwave Radio Microwave circuit provides access to the power system control center (PSCC).

Redundant 24V dc-dc converters supplied from the 48V dc telephone power system are installed for the exclusive use of this microwave circuit.

Fiber Optic Circuit The fiber optic circuit provides high speed digital communication connecting major communication centers and administrative offices through TVA. This fiber optic circuit is integrated into the 161kV insulated shield wire. Electro-optical interface and channel equipment are located in Telecommunications Node 2 Building.

Telephone System Commercial Telephone Service - Public telephone service is provided to all TSS telephones with proper class of service, to pay telephones, and to dedicated data circuits.

Emergency Notification System (ENS) - The primary purpose of this telephone circuit is to provide a direct circuit from Watts Bar Nuclear Plant to the NRC in the event of a serious emergency as well as ongoing information on plant system, status and parameters at the nuclear plant reactor. A dedicated telephone line that is independent of the public telephone switching network is provided for the NRC.

9.5-4 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 Health Physics Network (HPN) - The primary function of this telephone circuit is to report directly to the NRC on radiological and meteorological conditions as well as assessment of trends and the need for protective measures on-site and off-site. A dedicated telephone line that is independent of public telephone switching network is provided for the NRC.

Transmission & Power Supply - The primary purpose of this system is to provide communications for Transmission & Power Supply engineers, but it may also be used by plant operations personnel during emergencies. This system is capable of contacting local mobile units and other TVA power generating facilities.

Nuclear Security Radio - The primary purpose of this system is to provide effective communications between all Nuclear Security officers.

Emergency Radio Communication System - This system is integrated with inplant repeater system for coordination with field monitoring teams and other personnel.

Sheriffs' Radio - The primary purpose of this system is to provide communications between Nuclear Security officers and the Meigs and Rhea County sheriffs.

9.5.2.4 Evaluation The following evaluation is intended to establish adequacy and redundancy of the plant communications systems design.

Interplant Systems There are four basic types of plant-to-offsite communications: microwave radio, fiber optics circuits, radio, and telephone systems. The availability of these systems during or after an emergency is enhanced by the fact that each enters the plant via different means.

The redundancy of the communications systems is of further significance. The microwave and fiber optics equipment design employs redundancy both in the channelizing and in the RF circuitry. The microwave system is powered from a battery-battery charger system through parallel-connected, redundant dc-dc converters. Each charger is fed from two separate ac sources, and each battery is capable of operating its system for a minimum of three hours without chargers.

The major electronic portions of the microwave are housed in the communications room which is located in the Control Building (Node 1). This building is a Seismic Category I structure.

The commercial telephone lines are terminated in Bell Hut and extend to Node 1 and 2 and from there to instruments located throughout the plant via the TSS. Local central office lines are available in the control room in the event of the loss of the TSS.

The Transmission & Power Supply radio have no components in the communications room and, therefore, would not be affected by the total destruction of this room. The Nuclear Security and Sheriffs RCUs in the Secondary Alarm Station (SAS) would be OTHER AUXILIARY SYSTEMS 9.5-5

WATTS BAR WBNP-99 affected by the total destruction of the communication room and would be inoperable.

Hand held radios would still be available to communicate from the SAS. The emergency radio communications system, however, depends on equipment in the communications room and would be inoperative.

All of the VHF radio systems are powered by battery- and/or diesel-backed ac sources and would remain operative following loss of offsite power.

Refer to Figure 9.5-19 for availability of interplant communications during various postulated conditions.

Intraplant System The automatic telephone equipment is one of the primary systems is designed so that failures in individual switches or lines do not interrupt service. However, such failures are annunciated and repairs are made promptly. The main (Node 1) switching equipment for this system is located in the communications room which is in a Seismic Category I building. Communication between TSS phones within seismic Category I buildings is through Node 1. In times of emergency, the TSS can be programmed to limit access only to key people to ensure that they will always have telephone service.

The codes, alarms (assembly/accountability) and paging system is designed for survivability with the following features:

(1) Duplicate operating locations: one in the main control room and the other in the auxiliary control room. Isolation of the duplicate controls is provided in the communications room.

(2) Three tone generator consoles powered from two separate sources:

(a) The operating console is normally aligned to the A source.

(b) A standby console which automatically is inserted upon power failure of the operating console. The standby console is normally aligned to the B source. It may also be manually switched at any time.

(c) A third console which may be manually substituted for either of the other consoles.

(3) Plug-in features:

(a) The tone generators are solid-state plug-in devices.

(b) The amplifier in the speaker unit is solid-state, easily unplugged and replaced.

(4) The power-leads to each speaker-amplifier are fused and annunciated.

9.5-6 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 (5) The signal-leads to each speaker-amplifier are supervised with dc while idle.

Any occurrence which causes a short of the signal-leads will cause the fuse to blow and annunciate. The rest of the units will function normally with single or multiple open-circuited signal-leads to individual speaker-amplifiers.

(6) There are two sources of 24V dc power distributed to the speaker- amplifiers and approximately half in each area of the plant are supplied from each source. Each source is quite reliable since it is supplied from chargers which are backed up by batteries capable of supplying the load for three hours.

The failure of the TSS equipment will not impair the use of the paging equipment from the local stations located at the unit operator's desk or the auxiliary control room.

The sound-powered telephone systems are completely independent of power, each other, and all other systems provided. As long as a complete metallic path exists between instruments, communications can be maintained since the instruments supplied with these systems are very rugged and will successfully withstand high shocks, negligence, and abuse. If permanently installed wires are rendered unusable for any reason, a temporary pair of wires can be used with the sound-powered instruments.

Neither the Inplant VHF Radio System nor the Inplant Cellular Radio System have any components in the communications room and, therefore, would not be affected by the total destruction of this room. The Onsite Radio Paging System, however, depends on equipment located in the communications room and would be inoperative.

The Inplant VHF Radio System, the Cellular Radio System, and the Onsite Radio Paging System are powered by battery- and/or diesel-backed ac sources and would remain operative following loss of offsite power.

Refer to Figure 9.5-19 for availability of intraplant communications during various postulated conditions.

9.5.2.5 Inspection and Tests The two communication systems are covered by Special Performance Tests (SPT-251-02 and SPT-252-02):

(1) The sound-powered telephone systems provided for the backup control center, health physics office, and Diesel Building shielded room; (2) The codes, alarms, and paging system.

All systems are carefully installed and checked for proper operation initially by construction forces. Routine maintenance is performed by operating personnel on a regular basis and includes such items as checking for proper switch operation, checking for proper operating levels, visual inspection, etc.

OTHER AUXILIARY SYSTEMS 9.5-7

WATTS BAR WBNP-99 The most comprehensive testing, however, results from the heavy daily usage of the equipment and the subsequent reports of any of the users. Individual power failures in the equipment are annunciated.

9.5.3 Lighting Systems 9.5.3.1 Design Bases There are three basic lighting systems in the plant designated as follows: normal, standby, and emergency. These systems are designed in accordance with TVA design guides and standards which use the recommendations of the Illuminating Engineering Society of North America as their basis, and good engineering practice to provide the required illumination necessary for safe conduct of plant operations and under normal conditions to make the plant personnel as comfortable as possible.

The normal lighting system is designed to economically provide the amount and quality of illumination to meet normal plant operations and maintenance requirements.

The standby lighting system upon loss of the normal lighting system, provides adequate illumination for the safe shutdown of the reactor and the evacuation of personnel from vital areas of the plant if the need should occur. It forms an integral part of the normal lighting requirements but is fed from an entirely independent source.

The emergency lighting system is composed of two separate systems: (1) The 125V dc lighting system, which is designed to provide immediately the minimum illumination level in areas vital to the safe shutdown of the reactor for the period required for diesel loading or upon loss of ac auxiliary power for the duration of capacity of the 125V vital dc batteries and (2) an individual eight-hour battery pack network, which is used to supplement the 125V dc emergency lighting to provide emergency lighting in areas that must be manned for safe shutdown; and for access and egress to and from fire areas, which meet the requirements of 10CFR50, Appendix R, III.J. Other battery pack units are provided for building egress for personnel safety purposes.

9.5.3.2 Description of the Plant Lighting System All plant lighting systems have the following features in common: adequate capacity and rating for the operation of the loads connected to the systems, independent wiring and power supply, overcurrent protection for conductor and equipment using nonadjustable inverse time circuit breakers, copper conductor with 600-volt insulation run in metal raceways.

The insulated cable used inside the primary containment areas is resistant to nuclear radiation and chemical environmental conditions in this area.

The plant lighting system consists of three basic schemes, the first of which is the normal lighting. This system is for general lighting of the plant: the major power supply is through two alternate feeders from the 6.9kV common boards A and B to selective and interrupter switch and 3-phase 6900-120/208-volt ac transformers, feeding a lighting board. These lighting boards are located in the Turbine and Auxiliary Buildings of the main plant. Other lighting boards in the Service Building, Office Buildings, 9.5-8 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 gatehouse, etc., are fed from 480V boards through 3-phase 480-120/208V ac transformers. These lighting boards feed the normal lighting cabinets, designated by the prefix LC___, distributed throughout the main plant. In the MCR, alternate rows of fixtures or alternate fixtures are fed from different lighting boards to prevent total blackout in a particular area in case of failure of one of the other lighting boards or cabinets.

The second system is the standby lighting, which forms a part of the normal lighting requirements and is normally energized at all times. This system is fed from 480V Reactor MOV boards 1A2-A, 1B2-B, 2A2-A, and 2B2-B to 3-phase 480-120/208V ac transformers to each standby lighting cabinet, designated by the prefix LS___ . The Reactor MOV boards have a normal and alternate ac power supply and in event of their failure are fed from the standby diesel generators. The cable feeders to the standby cabinets located in the Seismic Category I structure are routed in redundant raceways and the fixtures are dispersed among the normal lighting fixtures.

The third lighting system is referred to as the emergency system. It consists of two systems as described in Section 9.5.3.1. The 125V dc emergency lighting system is electrically held in the off position until a power failure occurs on the associated standby lighting systems. Then the emergency lighting cabinets, designated by the prefix LD___, are automatically energized from the 125V dc vital battery boards. This system is an essential supporting auxiliary system for the ESF, and the cable feeders to the LD cabinets are routed on the redundant ESF cable tray system or in conduit.

The fixtures are incandescent type and are dispersed among the normal and standby fixtures with alternate emergency fixtures being fed from redundant power trained LD cabinets.

The individual eight-hour battery pack emergency lighting system is automatically held in the de-energized state until loss of the normal ac supply. A charger monitors battery voltage and charges on fast rate when necessary. Solid-state circuits continually monitor both ac and dc current. The transfer switch circuit instantly connects lamps to battery on ac failure and disconnects them when normal power is restored. In some cases, the lamp heads are mounted remote from the units to obtain adequate light distribution.

9.5.3.3 Diesel Generator Building Lighting System The Diesel Generator Building lighting cabinets are fed through 480-208/120V 3-phase local lighting transformers, which in turn are fed from the diesel 480V auxiliary boards respectively. Each of these auxiliary boards has dual feeders from the 480V shutdown boards during normal operation. In the event of an ac power failure to the 480V shutdown boards, the diesel should start within the prescribed time to provide the 480V ac power requirements for the safe shutdown of the plant through the standby feeders to the 480V shutdown boards, thus supplying power again to the Diesel Generator Building lighting transformers. Each diesel generator unit has a lighting cabinet which supplies the normal lighting for that unit. Low-level lighting required for maintenance or operating procedures and ingress/egress in the event of loss of normal lighting is supplied from fixtures with a self-contained battery and inverter charger and also individual eight-hour battery pack lighting units.

OTHER AUXILIARY SYSTEMS 9.5-9

WATTS BAR WBNP-99 9.5.3.4 Safety Related Functions of the Lighting Systems The lighting system is adequate for the operation and evacuation of the plant to the extent that the supports for the components of the system, that are located in areas of Seismic Category I structures containing safety-related equipment are qualified to prevent failure that could impair the functioning of any safety-related plant feature.

Lighting systems are classified as non-safety related. However, due to their functions, standby and emergency lighting systems shall be of a high reliability design so as to ensure necessary illumination in areas of the plant needed for operation of safe shutdown equipment and in access and egress routes thereto.

9.5.3.5 Inspection and Testing Requirements Following the complete installation of a lighting system, it will be tested and inspected and short circuits, grounding of potential conductors, other faults, etc. will be eliminated and damaged or nonoperable fixtures replaced or repaired. The operation of the lighting system shall be observed during the initial and periodic testing of the normal and alternate feeder systems and during the 125V dc emergency power tests to the various boards from which these emergency lighting systems are fed. Maintenance and relamping of the normal and standby lighting systems shall be according to routine plant operating procedures.

The 125V dc emergency lighting system shall be tested periodically by tripping the holding coil circuit fed from the LS standby cabinet, thus closing the feeder circuit to the LD emergency cabinet. A written record of dates and results of these tests shall be maintained by plant personnel responsible for these tests.

The individual eight-hour battery pack lighting units will be tested periodically to ensure that the lamps are operational in according with routine plant procedures.

9.5.4 Diesel Generator Fuel Oil Storage and Transfer System 9.5.4.1 Design Basis The diesel generator fuel oil system provides independent storage and transfer capacity to supply the four diesel generator units operating at continuous ratings with No. 2 Fuel Oil for a period of seven days without replacement.

The buildings are Seismic Category I structures and will withstand the effects of tornadoes, credible missiles, floods, rain, snow, or ice, as defined in Chapter 3, Section 3.3, 3.4, and 3.5.

The design code requirements for the system are as follows:

(1) Diesel Generator Building 7-day fuel oil storage tanks - Code for Unfired Pressure Vessels, ASME Section VIII. Division I.

(2) Piping from the 7-day fuel oil storage tanks to the interface with the skid-mounted diesel generator unit fuel oil piping - Boiler and Pressure Vessel Code, ASME Section III, Class 3 (Per NFPA Code 30-1973).

9.5-10 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 Skid mounted piping and components for the fuel oil system were designed, manufactured and installed in accordance with ANSI B31.1. This subsystem performs a primary safety function and is supported to Seismic Category I requirements. The scope of this work was done to meet 10CFR50, Appendix B quality assurance requirements. Future modifications performed on this subsystem piping are required to meet the intent of ASME Section III, Class 3.

(3) Remaining piping, valves, pumps, and associated equipment - Power Piping Code, ANSI B31.1-1973.

The 7-day diesel fuel oil storage tanks are designed for embedment within the Diesel Generator Building foundation. The fuel oil day tanks are skid-mounted on the diesel generator units.

The diesel fuel oil system for the diesel generator units meets the single failure criterion. That portion of the system from the 7-day storage tanks to the diesel generator units meets Seismic Category I requirements. The remainder of the system within the Diesel Generator Building meets Seismic Category I (L) requirements.

9.5.4.2 System Description The flow diagram of the diesel generator fuel oil system is shown in Figure 9.5-20. The control and logic diagrams are shown in Figures 9.5-21 and 9.5-22, respectively.

The diesel generator fuel oil system consists of four 7-day embedded storage tank assemblies, one assembly for each diesel generator unit, with their associated day tanks, pumps, valves, and piping. The 7-day tanks are embedded in the Diesel Generator Building substructure and have a capacity of approximately 70,248 gallons of fuel for each diesel generator unit. The fuel day tanks (one per diesel engine) are mounted to the diesel engine skid and were supplied by the diesel generator vendor.

These tanks have a capacity of approximately 550 gallons.

Level transmitters are provided on the 7-day storage tank assemblies to provide the following functions:

(1) Provide local fuel level indication.

(2) Annunciate an alarm in the MCR when the fuel level approaches a seven-day supply.

(3) Annunciate an alarm in the MCR on high level above the pump shut-off setting.

(4) Provide an interlock with the outside transfer pump at the yard storage tanks to shut off the pump automatically on high level of any of the four 7-day tanks which is being filled. Provide a high level interlock with the DG transfer pump in the DG Building when transferring fuel to fill any of the 7-day tanks from another 7-day tank within that building. Interlocks are not provided when using the DG transfer pump to transfer fuel to any other tanks.

OTHER AUXILIARY SYSTEMS 9.5-11

WATTS BAR WBNP-99 A truck fill connection, condensate sump suction connection, and inspection dipstick gauge manholes are provided for each 7-day storage tank assembly. The vents to the atmosphere on all tank assemblies, with the exception of the skid-mounted day tanks, are provided with double fire screens to prevent an outside spark from entering the assemblies and igniting the gases within. The National Fire Code (NFC) does not require flame arrestors for Class 2 combustible liquid storage tank vents. Therefore, in order to facilitate the installation of missile protection devices, the skid mounted fuel oil day tank vent lines are not flame-proofed. However, the open vent lines are shielded from the atmosphere and equipped with bird screens. All tank connections and vents are above maximum flood elevation. That portion of the 7-day fuel oil tank vent above the roof level is encased in reinforced concrete for missile protection.

Two skid-mounted, electric motor driven, 15 gpm fuel oil transfer pumps, powered from the 480V diesel auxiliary boards (See Figure 8.3-32), are provided for each generating unit to transfer fuel from the 7-day storage tank assembly to the two skid-mounted day tanks of each generating unit. Each of these pumps supplies fuel to both day tanks.

Two sets of level switches are provided for each day tank and associated transfer pumps to maintain day tank level. An additional set of level switches provide both Main Control Room (MCR) and Auxiliary Control Room (ACR) alarms to indicate high and low fuel oil level in the day tanks.

From each day tank, fuel is supplied to the diesel injectors by a diesel engine driven pump. An electric motor-driven fuel pump is provided as a backup for the engine driven fuel pump. Separate suction and discharge lines serve each pump. Each pump has a suction strainer and dual element fuel filters are provided at each pump discharge. Additional filters at the inlet and outlet of each fuel injector protect the working parts of the injector. Pressure gauges are provided on both sides of the dual element fuel filters to provide a means of determining filter pressure drop. Pressure switches are provided between the fuel pumps and the dual element filters and between the final filters and the fuel injectors. The pressure switches provide ACR and MCR alarms on low pressure. Maintenance procedures call for periodic changing of filters and surveillance test runs verify the cleanliness of these filters.

Screens are provided in the suction lines of the Diesel Generator Building transfer pumps which transfer the fuel from the yard storage tank to the 7-day storage tanks.

The 7-day tanks are sloped to collect water and sediment at the low end and can be "dip leg" pumped as necessary. The fuel storage and transfer system is protected against the entry of rain water, and the day tanks and 7-day tanks are not harmed by flood waters.

Each shipment of No. 2 diesel fuel oil can be sampled prior to pumping to the yard tanks. Samples collected may be used for analyses to verify site specific criteria prior to offloading the tanker and to ensure contractual requirements are met if necessary.

Shipments of diesel fuel can be held in the yard tanks until the specified criteria are met and the fuel oil is transferred to one of the 7-day storage tanks or the fuel is burned in the auxiliary boilers. If necessary the fuel is discarded. Sampling and analyses of fuel 9.5-12 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 oil that is transferred to or stored in the 7-day storage tanks is completed in accordance with Technical Specifications.

The 7-day storage tanks are inspected in accordance with the Technical Specifications.

The methods for maintaining acceptable levels of fuel quality for the standby diesel generators at Watts Bar Nuclear Plant meet the guidelines set forth by NRC Regulatory Guide 1.137, Revision 1, except for pressure testing required by Section C1.e which was accepted by SER Supplement 5, Section 9.5.4.1 and exceptions to C2, given as follows:

(a) C2.a the reference year of ASTM D 975 used is 1990 or later revision instead of the year 1977 which is specified in the Regulatory Guide.

(b) C2.b methods for water and particle detection in fuel oil prior to transferring fuel oil to supply tank is specified in the Technical Specifications.

(c) C2.b analytical results to be completed after transfer of fuel to supply tanks are completed within time frames given in the Technical Specifications instead of the listed 2 weeks.

(d) C2.c fuel oil samples are collected using applicable ASTM method specified in the Technical Specifications instead of the listed ASTM D 270.

A transfer pump located adjacent to the yard fuel oil storage tanks provides the following functions:

(1) Transfer fuel oil from a tank truck to either of two yard fuel oil storage tanks.

(2) Transfer fuel oil from either yard fuel oil storage tank to the other.

(3) Transfer fuel oil from either yard fuel oil tank to any of the four 7-day fuel oil storage tank assemblies.

(4) Reject fuel oil from either yard fuel oil tank through a reject connection in the yard.

Seismically qualified fuel oil transfer pumps are also located in the Diesel Generator Building.

The Diesel Generator Building fuel oil transfer pump allows fuel oil to be transferred from any one of the 7-day fuel oil storage tanks in the Diesel Generator Building to any other 7-day fuel oil storage tanks in the Diesel Generator Building or either yard storage tank.

OTHER AUXILIARY SYSTEMS 9.5-13

WATTS BAR WBNP-99 9.5.4.3 Safety Evaluation With a 7-day supply of diesel fuel in each tank assembly, and each assembly embedded in the concrete substructure of a Seismic Category I building and separated by 18 inches of concrete, the diesel generator units are assured of a sufficient fuel supply for any of the conditions discussed in Section 9.5.4.1. The diesel generator fuel oil tank assemblies, piping, and pumps are so arranged that malfunction or failure of either an active or passive component associated with the source of supply for any one diesel generator unit does not impair the ability of the other sources to supply fuel oil to the other units. Each diesel generator is aligned so as to be able to supply power to its own auxiliaries so that a single failure can not result in loss of more than one diesel generator unit. The system thus meets the requirements of the single failure criterion.

Automatic carbon dioxide fire protection is provided in the Diesel Building fuel oil transfer pump room and the four rooms housing the diesel generator units.

A corrosion allowance is provided in the design wall thickness for the Diesel Generator Building 7-day fuel oil storage tanks. The interiors of the tanks were coated for added corrosion protection. The fuel oil piping and fittings within the Diesel Generator Building have ample corrosion allowance, having been designed per the codes noted in Section 9.5.4.1, and will operate at a pressure considerably below the maximum allowable for the schedule of pipe and fittings used.

It is expected that additional fuel oil beyond that stored onsite can be procured and delivered to the plant site within a reasonable period of time since:

(1) The plant site is served by a railroad spur owned by TVA. The yard transfer pump is provided for transferring fuel oil from a tank car to either of the two fuel oil tanks in the yard, or directly to the diesel fuel oil storage tank assemblies.

(2) State Route 68 provides vehicle access to the site and intersects: State Route 58 and Interstate 75 (I-75) east of the site and State Route 29 (US 27) west of the site. State Routes 29 (US 27) and 58 pass within 10 miles of the site and I-75 within 30 miles of the site. These thoroughfares provide year round access (extreme weather conditions could interrupt traffic flow for short periods of time) to both Chattanooga and Knoxville. With access to both of these major cities it would be very unlikely that tanker truck deliveries would be interrupted for any significant period of time, even in periods of extreme weather conditions.

(3) If rail or road transportation is unavailable, barge or tanker delivery can be accepted at the dock area on the west bank of the Tennessee River near the plant site.

A failure modes and effects analysis for the diesel generator fuel oil storage and transfer subsystem is presented in Table 9.5-2.

9.5-14 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 9.5.4.4 Tests and Inspections The engine-mounted, motor and engine-driven fuel oil transfer pumps and day tanks were functionally tested in the vendor's shop in accordance with the manufacturer's standards to verify the performance of the diesel generator units and accessories. The fuel oil transfer pumps in the yard and Diesel Generator Building were tested in the manufacturer's factory to verify their performance. The 7-day fuel oil storage tanks were tested with compressed air to 20 psig prior to shipment to the plant site.

The entire diesel fuel oil system is flushed with oil and is functionally tested at the plant site in accordance with Chapter 14.0. The diesel fuel oil system will be periodically tested to satisfy the Technical Specifications.

9.5.5 Diesel Generator Cooling Water System 9.5.5.1 Design Bases A closed-loop circulating water cooling system is furnished for each engine of the four tandem diesel generator units housed within the Diesel Generator Building. The system maintains the temperature of the diesel engine within a safe operating range, under all load conditions, and maintains the coolant pre-heat during stand-by conditions. The heat sink for this system is the ERCW system, which flows through the tube side of the skid-mounted heat exchangers. See Section 9.2.1 for discussion of the ERCW system.

The diesel generator skid-mounted cooling water piping and components between the skid interface connection and the engine interface are vendor supplied, safety-related, ANSI B31.1, Seismic Category I with the exception of the cooling water heat exchangers which are ASME Section III, Class 3. All modifications to the skid-mounted diesel generator cooling water system piping are performed to meet the intent of ASME Section III, Class 3 (TVA Class C).

These buildings are designed to Seismic Category I requirements, and are designed to withstand the effects of tornadoes, credible missiles, hurricanes, floods, rain, snow, or ice as defined in Chapter 3 (Sections 3.3, 3.4, and 3.5).

9.5.5.2 System Description Each cooling system includes a pump, heat exchanger expansion tank, and all accessories required for a cooling loop. (See Figure 9.5-23.)

To preclude long term corrosion or organic fouling the engine cooling water system requires de-ionized water with a corrosion inhibitor. The water chemistry is maintained in conformance with the engine manufacturer's recommendations, Electromotive Division of General Motors Corporation MI 1748. The closed-loop engine cooling water is circulated through the shell side of each skid-mounted heat exchanger by two diesel-engine shaft-driven pumps. Jacket water immersion heaters are provided for each engine to maintain the jacket water within the vendor recommended temperature range in order to reduce thermal stresses and assure the fast starting and load OTHER AUXILIARY SYSTEMS 9.5-15

WATTS BAR WBNP-99 accepting capability of the diesel generator units in performing their required safety function.

Temperature switches are used to control the immersion heater and to annunciate on high or low jacket water temperature. For temperature switch set points, see Figure 9.5-23.

Jacket water flows through the lubrication oil cooler by thermosyphon action when the diesel generators are idle. An electric motor driven lubrication oil circulation pump, powered from the 480V diesel auxiliary board, is also provided for each engine to circulate the lubrication oil through the lubrication oil cooler, which is warmed by the engine jacket water, and return the oil to the engine sump. The jacket water immersion heaters are controlled by thermostats, and the lubrication oil circulation pumps run continuously when the engine is not running. This recirculation ensures the lube-oil temperature is maintained at 85°F (minimum) during the standby mode. (See Figures 8.3-33, -33A, -33B, -33C, and -35.)

Each diesel generator unit is provided with two closed engine cooling water loops (one for each engine), for which the heat sink is provided by the ERCW system. (Refer to Section 9.2.1). The ERCW flows through the tube side of the skid-mounted heat exchangers.

9.5.5.3 Safety Evaluation The cooling water is supplied to the heat exchangers of each diesel generator unit through redundant headers of the ERCW system. The system isolation valves are so arranged as to provide the capability to isolate either cooling source in the event of a component malfunction or excessive leakage from the system. Refer to Figures 9.2-1 and 9.2-4A. These valves are powered from the 480V diesel auxiliary board and closure signals for these valves are manually initiated (See Figures 8.3-33, -33A, -33B,

-33C, and -35.) Therefore a malfunction (single failure of a component) or loss of one cooling water source can not jeopardize the function of a diesel generator unit. Both the non-skid-mounted air-start piping and fire protection piping located in the vicinity of the diesel generator cooling water system are designed to Seismic Category I(L) to ensure that no seismic event will degrade the functional capability of the diesel generator cooling water system. A failure modes and effects analysis for the diesel generator cooling water system is presented in Table 9.5-2.

9.5.5.4 Tests and Inspections The ERCW system within the Diesel Generator Building is hydrostatically tested in accordance with the requirements of ASME Section III and is functionally tested in accordance with Chapter 14.0. System components are accessible for periodic inspections during operation.

The skid-mounted diesel generator cooling water system components are inspected and serviced as specified in the scheduled maintenance program for the Watts Bar Nuclear Plant diesel generator units.

9.5-16 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 9.5.6 Diesel Generator Starting System 9.5.6.1 Design Bases Each diesel engine is equipped with an independent pneumatic starting system to provide reliable, automatic starting of the engines. See Figure 9.5-24. The diesel starting air system components are housed with their respective diesel generator units within the diesel generator rooms in the Diesel Generator Building.

The supply headers from each air compressor to the isolation check valve on its skid-mounted accumulator are designed to Seismic Category I(L) requirements. The supply headers from each loadless start device to the isolation check valve and the normally closed bypass valve at the skid-mounted accumulator are designed to Seismic Category I requirements.

The diesel generator skid-mounted starting air system piping and components are vendor supplied, safety-related, ANSI B31.1, Seismic Category I. All modifications to the skid-mounted starting air system piping are required to be performed to meet the intent of ASME Section III, Class 3 (TVA Class C).

9.5.6.2 System Description Each diesel engine has two pairs of air starting motor units (hence, there are four pairs per diesel generator unit). A minimum of two pairs of air start motors are needed to start the diesel generator unit. A set of two skid-mounted air accumulators is provided for each diesel engine; four accumulators per diesel generator unit.

The accumulators are designed in accordance with the ASME Boiler and Pressure Vessel Code,Section VIII. Each set of accumulators is sized for a compressed air storage capacity sufficient to start the diesel generator unit five times without recharging. Each set of accumulators is equipped with pressure gauges, drains, shutoff valves, safety relief valves, check valves, instrumentation, and controls.

Two 480V ac motor-driven compressors supply compressed air to each of the two sets of accumulators for each diesel generator unit. Controls for the compressors have been designed for automatic start-stop operation. Manual test-start selector switches are also provided for each compressor. Pressure switches are provided on each air starting system for actuating low air pressure alarms both in the MCR and ACR (see Figure 9.5-25A, -25B, and -25C).

To prevent moisture and rust accumulation in the air starting system, a fully automatic heatless air dryer has been installed between the air compressor and the accumulators. The air dryer unit contains dual desiccant drying chambers which are alternately cycled through drying and regeneration cycles, a forced air after cooler, and associated cycle and fan controls. One chamber of the desiccant dryers is on stream at all times. Moisture traps are also located downstream of the dryers to collect any residual moisture. The two air storage systems for each diesel generator unit provide redundancy so that a single failure will not jeopardize the design starting capacity of the system.

OTHER AUXILIARY SYSTEMS 9.5-17

WATTS BAR WBNP-99 9.5.6.3 Safety Evaluation All equipment necessary to start the diesels upon receipt of a start signal is Seismic Category I.

The diesel air start system is classified as quality group D. Section B of Regulatory Guide 1.26 discusses quality groups A through D and generally the types of equipment falling in each group. Section B also discusses systems and components not covered by groups A-D. Examples of these non-covered items are provided in Regulatory Guide 1.26 and include instrument and service air systems, auxiliary support systems and diesel engines. Part NA-1130,Section III of the ASME code states that drive system and other accessories are not part of the code. Regulatory Guide 1.26 states that non-covered items should be designed, fabricated, erected, and tested to quality standards commensurate with the safety functions performed. As a quality group D system, it is considered to meet quality standards commensurate with the safety function performed.

The piping for the air start system is designed to minimize rust accumulation in the system. Moisture is accumulated at the low points in the system and removed by administrative blowdown procedures. ASME Section III, Class 3 soft-seated check valves are provided downstream of the air accumulators. A strainer is also provided in the air start piping system upstream of the air start motors which prevents carry over of oil or rust, etc., to the motors. An oil mist type lubricator located in the air start system piping downstream of the line strainer and before the air start motors, provides lubrication for the motors. The typical arrangement for each engine is a strainer and lubricator for each pair of air start motors. The diesel starting air system is shown in Figures 9.5-25A, 25B, and 25C. A failure modes and effects analysis for the diesel generator starting air system is presented in Table 9.5-2.

9.5.6.4 Tests and Inspections The entire diesel generator starting system is functionally tested in accordance with Chapter 14.0. The system is periodically tested to verify its ability to function as part of the diesel generator unit to satisfy the Technical Specification requirements. Under normal standby conditions, the diesel generator starting system is maintained and inspected at intervals as prescribed in the plant maintenance instructions for the diesel generator units.

9.5.7 Diesel Engine Lubrication System 9.5.7.1 Design Bases The diesel engine lubrication system for each diesel engine shown in Figure 9.5-26 (this figure depicts the diesel lube oil system for Diesel Generator 1A-A which is representative of the other three diesel generator sets), is a combination of four subsystems: the main lubricating subsystem, the piston cooling subsystem, and the scavenging oil subsystem and the motor-driven circulating pump, and soak back pump system.

9.5-18 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 The main lubricating subsystem supplies oil under pressure to the various moving parts of the diesel engine. The piston cooling subsystem supplies oil for piston cooling and lubrication of the piston pin bearing surfaces. The scavenging oil subsystem supplies the other systems with cooled and filtered oil. Oil is drawn from the engine sump by the scavenging pump through a strainer in the strainer housing located on the front side of the engine. From the strainer the oil is pumped through oil filters and a cooler. The filters are located on the accessory racks of the engines. The oil is cooled in the lubricating oil cooler (as shown in Figure 9.5-27) by the closed circuit cooling water system in order to maintain proper oil temperature during engine operation.

During standby, the lube-oil temperature is maintained at 85°F or greater by the closed cooling-water system.

The required quality of oil is maintained by scheduled maintenance of strainers, separators, and filters and by oil changes in accordance with the engine manufacturer's owners group recommendation.

A crankcase pressure detector assembly is provided to cause the engine to shut down in case the normal negative crankcase pressure changes to a positive pressure. This is accomplished by relieving the oil pressure to the engine governor. The crankcase pressure detector shutdown device is operative only during diesel generator testing; see Section 8.3.1.1 under the heading, "Standby Diesel Generator Operation."

An overspeed mechanism is provided to shut down the engine by stopping the injection of fuel into the cylinders should the engine speed become excessive.

The piping and components for the skid-mounted diesel engine lubrication system are vendor supplied, safety-related, ANSI B31.1, Seismic Category I. All modifications to the skid-mounted diesel engine lubrication system are performed to meet the intent of ASME Section III, Class 3 (TVA Class C).

9.5.7.2 System Description The system is a combination of four separate systems. The four systems are the main lube oil system, piston cooling system, scavenging oil system, and the motor-driven circulating pump and soak-back pump system. Each system has its own pump. The main lube oil pump and piston cooling oil pump, although individual pumps, are both contained in one housing and are driven from a common shaft and are the helical gear type. The main lubricating, piston cooling, and scavenging oil pumps are driven from the accessory gear train at the front of the engine. The auxiliary system has a circulating oil pump and a soak-back oil pump driven from electric motors mounted on the side of engine base. All pumps are mounted on the engines, skid, or Diesel Generator Building floor.

The main lube oil system supplies oil under pressure to the majority of the engine moving parts. The piston cooling system supplies oil for piston cooling lubrication of the piston pin bearing. The scavenging oil system supplies the other systems with cooled, filtered oil.

OTHER AUXILIARY SYSTEMS 9.5-19

WATTS BAR WBNP-99 In the operation of these systems, oil is drawn from the engine sump by the scavenging oil pump through a strainer in the strainer housing. From the strainer, the oil is pumped through the oil filter and the lube oil cooler. The cooler absorbs heat from the jacket water to maintain proper operating temperature during standby operation. The oil then flows to the strainer housing to supply the main lubricating and piston cooling pumps.

After being pumped through the engine, the oil returns to the engine sump to be recirculated.

To enhance the reliability of and to minimize wear due to automatic fast starting, each DG has an auxiliary lube oil system driven by two electric motors. The motors drive two pumps, each of which has a separate function. A soak-back pump draws oil from the engine sump and pumps it through the accessory rack-mounted auxiliary turbocharger lube oil filter and through the head of the engine-mounted turbocharger oil filter into the turbocharger bearing area. The auxiliary turbocharger oil filter purifies the oil supplied to the turbocharger. A relief valve allows oil to be bypassed to the circulating pump system when the outlet pressure exceeds 75 psig.

The soak-back system has a two-fold job. It prelubes the turbocharger bearing area so that the bearing will be fully lubricated when the engine receives a start signal requiring rated speed and application of rated load within a matter of seconds. It also removes residual heat from the turbocharger bearing area upon engine shutdown.

The lube oil circulating pump draws oil from the engine sump and pumps it through a check valve, in-line wye strainer, main lube oil filter, lube oil cooler, and returns it to the engine sump through the strainer housing.

This system also serves to continuously prelube the lower portion of the engine. The main engine oil galley stays full and the camshaft area is supplied through a separate exterior line. The pump operates continuously.

The water jacket immersion heater heats the engine cooling water which circulates through the lube oil cooler. As the oil is circulated through the cooler (operating as a heater) it is warmed.

A backup DC lube oil pump provides lube oil to the turbocharger in case the AC pump fails.

Low lube oil pressure alarms are located in the MCR and in the ACR. Lube oil low alarm pressure varies with engine operating conditions. At rated speed, the engine shuts down if lube oil pressure drops below setpoint during non-accident conditions.

There are no other interlocks on this system.

9.5.7.3 Safety Evaluation Each engine crankcase sump contains a sufficient volume of lubricating oil, ample for at least 7 days of diesel generator unit full load operation without requiring replenishment. The established oil consumption rate is 0.83 gallons per hour. An additional standby oil reserve is stored within the plant's power stores to replenish the engines for longer periods of operation and to "top off" the engines after their periodic 9.5-20 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 test operations as specified in the Technical Specifications. A failure modes and effects analysis for the diesel generator lube oil system is presented in Table 9.5-2.

9.5.7.4 Test and Inspections As identified in Chapter 14.0, pre-operational testing for Watts Bar Unit 1 included functional testing of the diesel generator lubricating oil system. Any additional required testing of the diesel generator lubricating oil system for Watts Bar Unit 2 pre-operational testing is also identified in Chapter 14.0. The diesel generator lubricating oil system components are inspected and serviced as specified in the scheduled maintenance program for the Watts Bar diesel generator units. The inspection and service of the lubricating oil systems include visual checking for, and the correction of, oil leakage. This program sets overall standards and testing instructions to qualify the lubricating oil for use in the diesel generator engines.

9.5.8 Diesel Generator Combustion Air Intake and Exhaust System 9.5.8.1 Design Bases Each diesel engine associated with each of the tandem diesel generator units is equipped with an independent combustion air intake and exhaust subsystem. The four subsystems for the plant are housed in physically separated rooms within the Diesel Generator Building. Each of the four diesel generator subsystems has a dedicated air intake and exhaust system.The Diesel Generator Building is designed to Seismic Category I requirements, and is designed to withstand the effects of tornadoes, credible missiles, hurricanes, floods, rain, snow, and ice as defined in Sections 3.3, 3.4, and 3.5. The combustion air intake and exhaust piping, filters, and silencers are so arranged in the individual rooms for each diesel generator unit that a malfunction or failure of any system component associated with any single unit will not impair the operation of the remaining three units. The air intake and exhaust systems thus meet the requirements of the single failure criterion. The piping and components for the diesel generator combustion air intake and exhaust systems are designed in accordance with ANSI B31.1, Seismic Category I.

9.5.8.2 System Descriptions The general arrangement of the diesel generator combustion air intake and exhaust systems is shown in Figure 8.3-1. The flow diagrams are shown in Figures 9.5-29 and 9.5-30. Each diesel generator combustion intake and exhaust subsystem includes but not limited to an air intake filter, air intake silencers, and piping of the air intake subsystem from the air intake to its connection to the engine; and an exhaust silencer and piping of the exhaust subsystem from its connection to the engine to a point just above the Diesel Generator Building roof level where the exhaust exits to the atmosphere. As shown in Figure 8.3-1, the major components of the diesel generator combustion air and exhaust systems are housed within the Diesel Generator Building which provides protection from missiles, snow, and ice. That portion of the exhaust subsystems exposed above the roof level is short and below the parapet level to reduce the vulnerability to tornado missiles. Drain holes are provided at appropriate points to expel any rainfall that enters the exhaust piping.

OTHER AUXILIARY SYSTEMS 9.5-21

WATTS BAR WBNP-99 9.5.8.3 Safety Evaluation The diesel generator combustion air intake and exhaust systems are designed to function before, during, and after a SSE, to ensure that a seismic event will not degrade the combustion air intake and exhaust systems to the point that the function of a diesel generator unit is jeopardized.

An analysis of diesel generator exhaust recirculation utilizing a model developed by Halitsky[1] for transverse jet plumes, established that the exhaust plume will be carried well above the level of the air intakes and thus will not degrade the intake air. The diesel generator units can withstand a concentration of 20% carbon dioxide (by volume) in the intake air stream and continue to function at rated, full-load power. The redundancy and separation of the four intake and exhaust subsystems are discussed in Section 9.5.8.1. The protection against missiles, snow, rainfall, and ice are discussed in Section 9.5.8.2.

A failure modes and effects analysis for the Diesel Generator Building ventilation intake and exhaust subsystems is presented in Table 9.4-4. A failure modes and effects analysis for the diesel generator combustion air intake and exhaust systems is presented in Table 9.5-2.

9.5.8.4 Tests and Inspection As identified in Chapter 14.0, pre-operational testing for Watts Bar Unit 1 included functional testing of the entire installed diesel generator combustion air intake and exhaust system. Any additional required testing of that system for Watts Bar Unit 2 pre-operational testing is also identified in Chapter 14.0.

Each diesel generator combustion air intake and exhaust subsystem is periodically tested to verify its ability to function as part of the diesel generator unit testing in accordance with Technical Specifications.

Under normal standby conditions, the diesel generator combustion air intake subsystem is inspected at intervals as prescribed in the plant maintenance instructions for the diesel generator units. These inspections include the air intake filter oil level, oil viscosity, and sludge accumulation.

The diesel generator combustion air exhaust silencer has a continuous drain to remove any water which may accumulate due to condensation or rain.

REFERENCE (1) James Halitzky, 'A Method for Estimating Concentrations in Transverse Jet Plunes.' Air and Water Pollution Int. J., Pergamon Press. 1966, Vol. 10, pp.

821-843 (2) Letter to NRC dated February 5, 1992, "Watts Bar Nuclear Plant (WBN) -

Submittal of TVA Fire Protection Report."

9.5-22 OTHER AUXILIARY SYSTEMS

WATTS BAR WBNP-99 (3) Letter to NRC dated June 15, 1995, "Watts Bar Nuclear Plant (WBN) - Fire Protection Report (FPR) Revision (TAC M63648)."

(4) Letter to NRC dated September 28, 1995, "Watts Bar Nuclear Plant (WBN) -

Submittal of Fire Protection Report (FPR) Revision 4 (TAC M63648)."

(5) Letter to NRC dated October 1995, "Watts Bar Nuclear Plant (WBN) -

Submittal of Fire Protection Report (FPR) Revision 5 (TAC M63648)"

OTHER AUXILIARY SYSTEMS 9.5-23

WATTS BAR WBNP-99 Table 9.5-1 Deleted by Amendment 52 9.5-24 OTHER AUXILIARY SYSTEMS

OTHER AUXILIARY SYSTEMS WATTS BAR Table 9.5-2 Failure Modes and Effects Analysis of the Standby Diesel Generator Auxiliary Systems (Sheet 1 of 4)

METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS 1 Fuel oil system Forward fuel to Delivers insufficient Passive failures such Control room None: None 1. Fuel oil systems of each diesel generator from 7-day tank injectors of respective quantity of fuel to as tank ruptures or indication of Remaining set are completely independent of each forward to engine engines. engines. piping leaks, clogging failure of diesel three diesel other.

on any one of four of strainers or generator set to generators diesel generator injectors. See Note 2 start or shuts furnish 100% 2. Due to redundant pumps and valving sets in standby in Remarks. down. standby power arrangements within each DG FO system, service. required by single active failures that disable the system Also, failure of plant. are not credible.

instrumentation to provide proper signal to pumps and controls.

9.5-25 WBNP-99

Table 9.5-2 Failure Modes and Effects Analysis of the Standby Diesel Generator Auxiliary Systems (Sheet 2 of 4)

OTHER AUXILIARY SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS 2 Starting air system Crank engine to start Either one of two sets Active failure of any Control room None; None Each one of two engines in a diesel from diesel diesel generator set. of cranking systems one pneumatic valve indication of Duplicate air generator set includes a cranking system generator skid- fails to crank engines. or air start motor that failure of diesel start system on independent of its mate or of the other mounted air would prevent all four generator to other engine in diesel generator sets.

accumulator inlet air motors of one of start. the diesel check valve two engines to generator set is forward to the air engage and crank capable of starting motors on diesel generator set, providing 100%

any one of eight or passive failure due cranking power engines in standby to leakage of air from for both service. the accumulator or engines in the piping in one of the diesel two cranking generator set.

systems.

Also, failure of instrumentation to provide start signal or failure providing a false signal.

9.5-26 WBNP-99

Table 9.5-2 Failure Modes and Effects Analysis of the Standby Diesel Generator Auxiliary Systems (Sheet 3 of 4)

OTHER AUXILIARY SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS 3 Lube oil system of Lubricate engine Insufficient lube oil Failure of any one Control room None; None Lube oil system of each individual engine is any one of eight wearing surfaces and flow or oil temperature pump or passive indication of Remaining separate and independent of all others.

engines in standby maintain proper exceeds limits. failure such as shutdown of three diesel service. piston temperature of system leakage or affected diesel generator sets respective engine. filter clogging. generator set. are capable of furnishing 100% of the required plant standby power.

None; Remaining Provide cooling for Control room three diesel Jacket cooling lube oil coolers, Fails to maintain Active failure of indication of generator sets Jacket cooling water system of each water system and cylinder liner and correct engine either pump, high engine are capable of None individual engine is separate and 4 heat exchanger of heads and temperature. thermostatic control coolant furnishing independent of all others.

any one of eight turbocharger valve or immersion temperature in 100% standby engines in standby aftercoolers of water heater, or affected engine power required service. respective engine. passive failure of requiring by plant.

piping or heat shutdown of exchanger pressure diesel generator boundary. set.

9.5-27 WBNP-99

Table 9.5-2 Failure Modes and Effects Analysis of the Standby Diesel Generator Auxiliary Systems (Sheet 4 of 4)

OTHER AUXILIARY SYSTEMS WATTS BAR METHOD OF ITEM COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT NO. IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS 5 Combustion air Direct filtered air to Insufficient or Passive failure of Control room None; None Combustion air intake system of each intake system from turbocharger. unfiltered air flow to either filter silencer or indication of Remaining individual engine is separate and intake filter through respective engine. flexible connection engine three diesel independent of all others.

silencer and flexible that would either malfunction or generator sets connection up to restrict air flow or shut down. are capable of turbocharger inlet induct unfiltered air furnishing on any one of eight into engine. 100% of engines in standby standby power service. required by plant.

6 Exhaust system Provide path for Restricts flow. Passive failure of Control room None; None Exhaust system on each individual engine is from turbocharger exhaust. silencer. indication of Remaining separate and independent of all others.

through expansion engine three diesel joint and silencer malfunction or generator sets on any one of eight shut down. are capable of engines in service. furnishing 100% of standby power required by plant.

9.5-28 WBNP-99

WATTS BAR WBNP-99 Figure 9.5-1 Deleted by Amendment 87 Other Auxiliary Systems 9.5-29

WATTS BAR WBNP-99 Figure 9.5-2 Deleted by Amendment 87 Other Auxiliary Systems 9.5-30

WATTS BAR WBNP-99 Figure 9.5-3 Deleted by Amendment 87 Other Auxiliary Systems 9.5-31

WATTS BAR WBNP-99 Figure 9.5-4 Deleted by Amendment 87 Other Auxiliary Systems 9.5-32

WATTS BAR WBNP-99 Figure 9.5-5 Deleted by Amendment 87 Other Auxiliary Systems 9.5-33

WATTS BAR WBNP-99 Figure 9.5-6 Deleted by Amendment 87 Other Auxiliary Systems 9.5-34

WATTS BAR WBNP-99 Figure 9.5-7 Deleted by Amendment 87 Other Auxiliary Systems 9.5-35

WATTS BAR WBNP-99 Figure 9.5-8 Deleted by Amendment 87 Other Auxiliary Systems 9.5-36

WATTS BAR WBNP-99 Figure 9.5-9 Deleted by Amendment 87 Other Auxiliary Systems 9.5-37

WATTS BAR WBNP-99 Figure 9.5-10 Deleted by Amendment 87 Other Auxiliary Systems 9.5-38

WATTS BAR WBNP-99 Figure 9.5-11 Deleted by Amendment 87 Other Auxiliary Systems 9.5-39

WATTS BAR WBNP-99 Figure 9.5-12 Deleted by Amendment 87 Other Auxiliary Systems 9.5-40

WATTS BAR WBNP-99 Figure 9.5-13 Deleted by Amendment 87 Other Auxiliary Systems 9.5-41

WATTS BAR WBNP-99 Figure 9.5-14 Deleted by Amendment 87 Other Auxiliary Systems 9.5-42

WATTS BAR WBNP-99 Figure 9.5-15 Deleted by Amendment 87 Other Auxiliary Systems 9.5-43

WATTS BAR WBNP-99 Figure 9.5-16 Deleted by Amendment 95 Other Auxiliary Systems 9.5-44

WATTS BAR WBNP-99 Figure 9.5-17 Deleted by Amendment 95 D

9.5-45 Other Auxiliary Systems

WATTS BAR WBNP-99 Figure 9.5-18 Deleted by Amendment 90 Other Auxiliary Systems 9.5-46

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-19 Watts Bar Nuclear Plant-Communications Equipment Availability 9.5-47

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-20 Yard, Powerhouse, and Diesel Generator Building Units 1 & 2 Flow Diagram Fuel Oil Atomizing Air & Steam 9.5-48

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-20a Additional Dsl Gen Bldg Units 1 & 2 Flow Diagram Fuel Oil Atomizing Air & Steam 9.5-49

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-20b Diesel Generator Building Unit 2 Flow Diagram Fuel Oil Atomizing Air & Steam 9.5-50

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-21 Powerhouse Units 1 & 2 Electrical Control Diagram for Fuel Oil System 9.5-51

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-22 Powerhouse Units 1 & 2 Electrical Logic Diagram for Fuel Oil System 9.5-52

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-23 Schematic Diagram -Jacket Water System With Heat Exchanger 9.5-53

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-24 Diesel Generator Building Unit 1 Flow Diagram for Diesel Starting Air System 9.5-54

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-24a Additional Diesel Gen Bldg Unit 1 & 2 Flow Diagram Diesel Starting Air System 9.5-55

WATTS BAR WBNP-99 Figure 9.5-25 Deleted by Amendment 88 Other Auxiliary Systems 9.5-56

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-25a Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG 1B-B 9.5-57

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-25b Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG 2A-A 9.5-58

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-25c Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG 2B-B 9.5-59

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-25d Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG OC-S 9.5-60

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-26 Schematic Diagram Lube Oil System 9.5-61

WATTS BAR Other Auxiliary Systems WBNP-99 Figure 9.5-27 Diesel Engine Lubrication System 9.5-62

WATTS BAR WBNP-99 Figure 9.5-28 Deleted by Amendment 41 Other Auxiliary Systems 9.5-63

WATTS BAR Other Auxiliary Systems ENG EXHAUST SINLENCER 1A1 SILN-82-101 1A2 SILN-82-102 1B1 SILN-82-103 1B2 SILN-82-104 2A1 SILN-82-201 2A2 SILN-82-202 2B1 SILN-82-203 2B2 SILN-82-204 WBNP-99 Figure 9.5-29 Diesel Air Intake Piping Schematic 9.5-64

WATTS BAR Other Auxiliary Systems ENG EXHAUST SINLENCER 1A1 SILN-82-101 1A2 SILN-82-102 1B1 SILN-82-103 1B2 SILN-82-104 2A1 SILN-82-201 2A2 SILN-82-202 2B1 SILN-82-203 2B2 SILN-82-204 WBNP-99 9.5-65 Figure 9.5-30 Diesel Exhaust System Piping Schematic

WATTS BAR WBNP-99 Figure 9.5-31 Deleted by Amendment 87 Watts Bar FSAR Section 9.0 Auxiliary Systems Other Auxiliary Systems 9.5-66