ML13081A097

Updated Final Safety Analysis Report, Revision 16. Chapter/Section 9.3, Process Auxiliaries.

ML13081A097
Person / Time
Site:	Palo Verde
Issue date:	06/30/2011
From:	Arizona Public Service Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML112020462	List: ML13081A096 ML13081A097 ML13081A098
References
102-06375-DCM/TLC
Download: ML13081A097 (268)

Text

PVNGS UPDATED FSAR 9.3 PROCESS AUXILIARIES 9.3.1 COMPRESSED AIR SYSTEM 9.3.1.1 Design Bases 9.3.1.1.1 Safety Design Bases The compressed air system has no safety design bases.

9.3.1.1.2 Power Generation Design Bases Each generating unit is provided with its own independent compressed air system. The system is required for normal operation but is not required for safe shutdown.

The compressed air system is divided into two subsystems, the instrument air system and the service air system.

9.3.1.1.2.1 Instrument Air System. The instrument air system provides a continuous supply of filtered, dry, oil-free air at a pressure up to 125 psig for pneumatic instrument operation and the control of pneumatic actuators. This subsystem has three air compressors and three air receivers. Each air compressor operating alone has the capacity to provide all instrument requirements of the normally operating generating unit. The total air receiver storage capacity is adequate to supply instrument air requirements during the period required for the standby air compressor to come up to full pressure, in the event of an operating air compressor failure. Two air compressors are powered from one electrical bus while the other is powered from the redundant electrical bus. The system has nitrogen backup in the event the air compressors cannot maintain adequate instrument air header pressure.

June 2011 9.3-1 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.1.1.2.2 Service Air System. The service air system supplies oil-free air at a pressure of 125 psig to service air stations located throughout the generating unit. Service air stations are provided for the operating of miscellaneous pneumatic tools, stud tensioners, and stud tension hoists, and for resin transfer, refueling machine manual operation, and other service requirements. A piping connection is provided to use a portable air compressor in the event the permanent air compressor is unavailable.

9.3.1.1.3 Codes and Standards The compressed air system is designed to the codes and standards set forth in table 3.2-1. In addition, the compressed air system is designed to meet pertinent Occupational Safety and Health Administration (OSHA) requirements and the air compressors are supplied in conformance with noise limitations defined by the Walsh-Healy Act.

9.3.1.1.4 Protection Protection of the compressed air system from wind and tornado effects is discussed in section 3.3. Flood design is discussed in section 3.4. Missile protection is discussed in section 3.5.

Protection against dynamic effects associated with the postulated rupture of piping is discussed in section 3.6.

Environmental design is discussed in section 3.11.

June 2011 9.3-2 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.1.1.5 CESSAR Interface Requirements Refer to subsection 5.1.4 and paragraphs 6.3.1.3 and 9.3.4.1.

9.3.1.2 System Description 9.3.1.2.1 General Description The compressed air system (as shown in engineering drawings 01, 02, 03-M-IAP-001, -002 and -003) is composed of two subsystems, the instrument air system and the service air system. The major component parameters are given in table 9.3-1.

9.3.1.2.1.1 Instrument Air System. The instrument air system is provided with three 100% capacity rotary screw air compressors. Each compressor is furnished with a filter, an aftercooler, a moisture separator, and an air receiver.

Cooling water for the air compressor and aftercooler is supplied by the turbine cooling water system as discussed in subsection 9.2.8.

The three air receivers are connected on the discharge side by a header with nonsafety-related isolation valves. The discharge header conducts the instrument air supply through one of two coalescing prefilters, which removes liquid aerosols and particulate, then to a duplex heatless dessiccant dryer which lowers the dewpoint of the air to between minus 20F and minus 40F, depending on flowrate and inlet air temperature. The air next passes through one of two afterfilters which removes particles greater than 0.9 microns (absolute) in size. This instrument air is then distributed to the various pneumatic control systems.

June 2011 9.3-3 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES Table 9.3-1 COMPRESSED AIR SYSTEM MAJOR COMPONENT PARAMETERS (Sheet 1 of 2)

Equipment Parameters Value

1. Instrument Air System Air compressors Quantity 3 Capacity, standard ft3/min 571 Pressure, psig 125 Horsepower 125 Revolutions per minute 1775 Volts/Hz/phase 460/60/3 Air receivers Quantity 3 Size, ft3 151 Pressure, psig 140 Instrument air dryers Quantity 2 Type Duplex, heatless desiccant Capacity, standard ft3/min 1000 Pressure, psig/Temperature °F 110/125 Dew point, @ 500 SCFM, °F -40 Dew point, @1000 SCFM, °F -20 Instrument air afterfilters Quantity 2 Efficiency, % 100 Micron Size 0.9 absolute Instrument air coalescing prefilters Quantity 2 Efficiency, % (D.O.P. test) 99.9 Micron size 0.3 Liquid aerosols, ppmw 0.013-0.0014 June 2007 9.3-4 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Table 9.3-1 COMPRESSED AIR SYSTEM MAJOR COMPONENT PARAMETERS (Sheet 2 of 2)

Equipment Parameters Value

2. Service Air System Air compressors Quantity 1 Capacity, standard ft3/min 1,019 Pressure, psig 125 Horsepower 250 Revolutions per minute 1,780 Volts/Hz/phase 460/60/3 Air receivers Quantity 2 Size, ft3 214 Pressure, psig 150 Air Dryer Quantity 1 Type Refrigerated Capacity, standard ft3/min 1220 Pressure, psig 125 Dew Point Range, °F 35 to 45 Volts/Hz/Phase 460/60/3 June 2011 9.3-5 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES Carbon steel piping and carbon steel valves are used in the air lines upstream of the instrument air dryers. Copper piping and bronze valves are used in the instrument air lines downstream of the air dryers.

Should the compressors fail to maintain the instrument air header pressure in the normal operating range of 105 to 125 psig, nitrogen backup is available to assure continued pneumatic instrument operation. If the header pressure should fall below 85 psig, a solenoid valve in a nitrogen crosstie automatically opens to allow 115 psig nitrogen to repressurize the instrument air system.

The instrument air system is not required to achieve a safe reactor shutdown or to mitigate the consequences of an accident. Pneumatically operated valves that have a safety function and may be required to operate to ensure safe shutdown of the plant following an accident or to mitigate the consequences of an accident use a safety-related check valve to isolate their safety-related pneumatic backup supply from the nonsafety-related instrument air system. All other pneumatically operated valves that have a safety function are designed to fail to a safe position upon loss of instrument air and do not require a continuous air supply under emergency or abnormal conditions. Both types of valves are listed in table 9.3-2.

9.3.1.2.1.2 Service Air System. The service air system is provided with a two-stage, rotary screw air compressor furnished with a filter-silencer, an intercooler, an aftercooler, and a moisture separator. Cooling water for the air compressor package is supplied by the turbine cooling water system as discussed in subsection 9.2.8. A refrigerated air June 2011 9.3-6 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES dryer, located downstream of the two air receivers, removes moisture to a dew point between 35 to 45 °F at 125 psig.

The air compressor discharges into two air receivers. A flanged connection on the discharge piping is furnished to accommodate a portable air compressor which will be used to provide service air when the permanent air compressor is not available. The air receivers have sufficient capacity to allow safe egress of maintenance personnel after service air quality or pressure is alarmed.

The purity of the compressor discharge air entering the air receivers is continuously monitored. High carbon monoxide and low oxygen concentrations are alarmed to protect maintenance personnel. In addition, excessive temperature of the compressed air entering the air receivers is alarmed for personnel safety.

The outlets of two air receivers are piped to a common service air header which distributes service air throughout the unit.

This header is normally pressurized between 115 and 125 psig.

The low pressure alarm setpoint is 100 psig.

9.3.1.2.1.3 Environmental Design Conditions. The major compressed air system components are located in the turbine building and are designed to operate under all specified environmental design conditions. Refer to section 9.4 for a discussion of environmental design conditions associated with the turbine building.

9.3.1.2.1.4 Safe Shutdown. The necessary protective measures are taken to ensure that the equipment essential for a safe and maintained reactor shutdown is not jeopardized by June 2011 9.3-7 Revision 16

Table 9.3-2 June 2003 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 1 of 9)

System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Chemical and Volume Control (engineering drawings 01, 02, 03-M-CHP-001,

-002, -003, -004 and -005)

CHA-HV507 Containment Isolation Open Open Open CHA-UV506 Containment Isolation Open Closed Closed CHA-UV516 Containment Isolation Open Closed Closed PVNGS UPDATED FSAR CHA-UV560 Containment Isolation Closed Closed Closed 9.3-8 CHA-UV580 Auxiliary Bldg. Isolation Closed Closed Closed CHB-UV505 Auxiliary Bldg. Isolation Open Closed Closed CHB-UV515 Containment Isolation Open Closed Closed CHB-UV523 Containment Isolation Open Closed Closed CHB-UV561 Auxiliary Bldg. Isolation Closed Closed Closed CHE-FV204 Auxiliary Bldg. Flow control Modulating Open Open CHE-FV241 Containment Flow control Open Open Open CHE-FV242 Containment Flow control Open Open Open PROCESS AUXILIARIES CHE-FV243 Containment Flow control Open Open Open CHE-FV244 Containment Flow control Open Open Open Revision 12 CHE-HV239 Containment Isolation Open Closed Closed

a. A complete list of valves important to containment isolation is found in table 6.2.4-1.

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 2 of 9)

June 2005 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Chemical and Volume Control (engineering drawings 01, 02, 03-M-CHP-001,

-002, -003, -004 and -005)

(contd)

CHE-HV532 Auxiliary Bldg. Isolation Open Open Open CHE-LV110P Auxiliary Bldg. Flow control Modulating Closed Closed PVNGS UPDATED FSAR CHE-LV110Q Auxiliary Bldg. Flow control Modulating Closed Closed 9.3-9 CHE-PDV240 Containment Isolation Open Closed Closed CHE-PV201P Auxiliary Bldg. Pressure control Modulating Closed Closed CHE-PV201Q Auxiliary Bldg. Pressure control Modulating Closed Closed CHE-UV231P Auxiliary Bldg. Isolation Open Open Open CHE-UV500 Auxiliary Bldg. Flow control 3-way Open to Open to VCT VCT CHE-UV520 Auxiliary Bldg. Flow control 3-way Open to Open to VCT VCT CHE-UV521 Auxiliary Bldg. Flow control 3-way Open to Open to PROCESS AUXILIARIES VCT VCT CHE-UV565 Auxiliary Bldg. Selector (3-way) 3-way Open to Open to Revision 13 EDT EDT CHE-UV566 Auxiliary Bldg. Selector (3-way) 3-way Open to Open to EDT EDT

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 3 of 9)

June 2003 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Containment Purge (engineering drawings 01, 02, 03-M-HAP-001,

-002, -003 and -004)

CPA-UV004A Auxiliary Bldg. Containment power Closed Closed Closed access purge exhaust isolation CPA-UV004B Containment Containment power Closed Closed Closed PVNGS UPDATED FSAR access purge exhaust isolation CPB-UV005A Containment Containment power Closed Closed Closed access purge exhaust isolation 9.3-10 CPB-UV005B Auxiliary Bldg. Containment power Closed Closed Closed access purge exhaust isolation Auxiliary Bldg. HVAC (engineering drawings 01, 02, 03-M-HAP-001,

-002, -003 and -004)

PROCESS AUXILIARIES HAA-M01 Auxiliary Bldg. Isolation Open Closed Closed HAA-M02 Auxiliary Bldg. Isolation Open Closed Closed HAA-M03 Auxiliary Bldg. Isolation Open Closed Closed HAA-M04 Auxiliary Bldg. Isolation Open Closed Closed Revision 12 HAA-M05 Auxiliary Bldg. Isolation Open Closed Closed HAA-M06 Auxiliary Bldg. Isolation Open Closed Closed HAA-M214 MSSS Isolation Open Closed Closed HAA-M216 MSSS Isolation Open Closed Closed

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 4 of 9)

June 2003 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Auxiliary Bldg. HVAC (engineering drawings 01, 02, 03-M-HAP-001,

-002, -003 and -004)

(contd)

HAB-M01 Auxiliary Bldg. Isolation Open Closed Closed HAB-M02 Auxiliary Bldg. Isolation Open Closed Closed PVNGS UPDATED FSAR HAB-M03 Auxiliary Bldg. Isolation Open Closed Closed HAB-M04 Auxiliary Bldg. Isolation Open Closed Closed HAB-M05 Auxiliary Bldg. Isolation Open Closed Closed HAB-M06 Auxiliary Bldg. Isolation Open Closed Closed HAB-M215 MSSS Isolation Open Closed Closed 9.3-11 HAB-M217 MSSS Isolation Open Closed Closed Fuel Bldg. HVAC (engineering drawings 01, 02, 03-M-HFP-001)

HFA-M01 Fuel Bldg. Isolation Open Closed Closed PROCESS AUXILIARIES HFA-M02 Fuel Bldg. Isolation Open Closed Closed HFA-M03 Fuel Bldg. Isolation Open Closed Closed HFA-M04 Fuel Bldg. Isolation Open Closed Closed HFB-M01 Fuel Bldg. Isolation Open Closed Closed HFB-M02 Fuel Bldg. Isolation Open Closed Closed Revision 12 HFB-M03 Fuel Bldg. Isolation Open Closed Closed HFB-M04 Fuel Bldg. Isolation Open Closed Closed

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 5 of 9)

June 2005 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Control Bldg. HVAC (engineering drawings 01, 02, 03-M-HJP-001 and -002 and 02-M-HJP-003)

HJA-M01 Control Bldg. Isolation Open Closed Closed HJA-M15 Control Bldg. Isolation Open Closed Closed PVNGS UPDATED FSAR HJA-M16 Control Bldg. Isolation Open Closed Closed HJA-M23 Control Bldg. Isolation Open Closed Closed HJA-M25 Control Bldg. Isolation Open Closed Closed HJA-M28 Control Bldg. Isolation Open Closed Closed 9.3-12 HJA-M34 Control Bldg. Isolation Open Open Open HJA-M36 Control Bldg. Isolation Open Closed Closed HJA-M51 Control Bldg. Isolation Open Closed Closed HJA-M52 Control Bldg. Isolation Open Closed Closed HJA-M53 Control Bldg. Isolation Open Closed Closed HJA-M54 Control Bldg. Smoke exhaust Open Closed Closed PROCESS AUXILIARIES HJA-M55 Control Bldg. Isolation Open Closed Closed HJA-M56 Control Bldg. Smoke exhaust Closed Closed Closed HJA-M57 Control Bldg. Smoke exhaust Closed Closed Closed HJA-M58 Control Bldg. Isolation Open Closed Closed Revision 13 HJA-M59 Control Bldg. Isolation Open Closed Closed HJA-M62 Control Bldg. Isolation Closed Open Open HJA-M66 Control Bldg. Isolation Open Closed Closed

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 6 of 9)

June 2003 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Control Bldg. HVAC (engineering drawings 01, 02, 03-M-HJP-001 and -002 and 02-M-HJP-003)

(Contd)

HJB-M01 Control Bldg. Isolation Open Closed Closed HJB-M10 Control Bldg. Isolation Open Closed Closed PVNGS UPDATED FSAR HJB-M13 Control Bldg. Isolation Open Closed Closed HJB-M23 Control Bldg. Isolation Open Closed Closed HJB-M24 Control Bldg. Isolation Open Closed Closed 9.3-13 HJB-M28 Control Bldg. Isolation Open Closed Closed HJB-M31 Control Bldg. System operation Open Open Open HJB-M32 Control Bldg. System operation Open Open Open HJB-M34 Control Bldg. Isolation Open Closed Closed HJB-M38 Control Bldg. Isolation Open Closed Closed PROCESS AUXILIARIES HJB-M52 Control Bldg. Isolation Open Closed Closed HJB-M55 Control Bldg. Isolation Open Closed Closed HJB-M56 Control Bldg. Smoke exhaust Closed Closed Closed HJB-M57 Control Bldg. Smoke exhaust Closed Closed Closed Revision 12 HJB-M58 Control Bldg. Isolation Closed Open Open HJB-M66 Control Bldg. Isolation Open Closed Closed HJB-M67 Control Bldg. Isolation Open Open Open

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 7 of 9)

June 2003 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Reactor Coolant (engineering drawings 01, 02, 03-M-RCP-001,

-002 and -003)

RCE-PV100E Containment Flow control Closed Closed Closed RCE-PV100F Containment Flow control Closed Closed Closed PVNGS UPDATED FSAR Radioactive Waste Drains (engineering drawings 01, 02, 03-M-RDP-003)

RDB-UV24 Auxiliary Bldg. Isolation Open Closed Closed Main Steam (engineering drawings 9.3-14 01, 02, 03-M-SGP-001 and -002)

SGA-HV179 ADV MSSS Flow control Closed (b) (c)

SGA-HV184 ADV MSSS Flow control Closed (b) (c)

SGA-UV174 FWIV MSSS Isolation Open (b) (c)

PROCESS AUXILIARIES SGA-UV177 FWIV MSSS Isolation Open (b) (c)

SGB-HV178 ADV MSSS Flow control Closed (b) (c)

SGB-HV185 ADV MSSS Flow control Closed (b) (c)

SGB-UV132 FWIV MSSS Isolation Open (b) (c)

SGB-UV137 FWIV MSSS Isolation Open (b) (c)

SGE-UV170 MSIV MSSS Isolation Open (b) (c)

Revision 12 SGE-UV171 MSIV MSSS Isolation Open (b) (c)

SGE-UV180 MSIV MSSS Isolation Open (b) (c)

SGE-UV181 MSIV MSSS Isolation Open (b) (c)

b. Backup safety-related pneumatic supply will permit valve operation on failure of the instrument air system.

c. Not applicable. See note (b).

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 8 of 9)

June 2009 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Main Steam (engineering drawings 01, 02, 03-M-SGP-001 and -

002)(Contd)

SGA-UV172 MSSS Isolation Open Closed Closed SGA-UV175 MSSS Isolation Open Closed Closed SGA-UV1133 MSSS Isolation Open Closed Closed PVNGS UPDATED FSAR SGA-UV1134 MSSS Isolation Open Closed Closed SGB-UV1135A/B MSSS Isolation Open Closed Closed SGB-UV1136A/B MSSS Isolation Open Closed Closed SGA-UV500P Containment Isolation Open Closed Closed SGA-UV500S MSSS Isolation Open Closed Closed SGB-UV130 MSSS Isolation Open Closed Closed 9.3-15 SGB-UV135 MSSS Isolation Open Closed Closed SGB-UV500Q MSSS Isolation Open Closed Closed SGB-UV500R Containment Isolation Open Closed Closed SGE-UV169 MSSS Bypass Closed Closed Closed SGE-UV183 MSSS Bypass Closed Closed Closed PROCESS AUXILIARIES Shutdown Cooling (engineering drawings 01, 02, 03-M-SIP-001, -002 and

-003)

SIA-HV619 Containment SIT isolation Closed Closed Closed SIA-HV629 Containment SIT isolation Closed Closed Closed SIA-HV639 Containment SIT isolation Closed Closed Closed SIA-HV649 Containment SIT isolation Closed Closed Closed Revision 15 SIA-HV682 Containment SIT isolation Closed Closed Closed SIB-HV612 Containment SIT isolation Closed Closed Closed SIB-HV622 Containment SIT isolation Closed Closed Closed

Table 9.3-2 (a)

PNEUMATICALLY OPERATED VALVES THAT HAVE A SAFETY FUNCTION (Sheet 9 of 9)

June 2003 System, Figure Numbers Normal Fail Safe and Valve Number Location Design Function Position Position Position Shutdown Cooling (engineering drawings 01, 02, 03-M-SIP-001,

-002 and -003)

(Contd)

SIB-HV632 Containment SIT isolation Closed Closed Closed SIB-HV642 Containment SIT isolation Closed Closed Closed PVNGS UPDATED FSAR SIB-UV322 Containment Isolation Closed Closed Closed SIB-UV332 Containment Isolation Closed Closed Closed SIB-UV611 Containment SIT isolation Closed Closed Closed SIB-UV618 Containment SIT isolation Closed Closed Closed 9.3-16 SIB-UV621 Containment SIT isolation Closed Closed Closed SIB-UV628 Containment SIT isolation Closed Closed Closed SIB-UV631 Containment SIT isolation Closed Closed Closed SIB-UV638 Containment SIT isolation Closed Closed Closed SIB-UV641 Containment SIT isolation Closed Closed Closed SIB-UV648 Containment SIT isolation Closed Closed Closed SIE-HV661 Containment SIT isolation Closed Closed Closed PROCESS AUXILIARIES Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES the generation of missiles or high pressure air leakage from the compressed air system. This is accomplished by separation of the compressed air system from the engineered safety features (ESF) systems, or by use of barriers between systems.

Safety valves are provided in the system to prevent or mitigate a high-pressure rupture incident.

9.3.1.2.1.5 Containment Isolation. A normally open instrument air line and a normally closed service air line penetrate the containment (two separated penetrations), as shown in engineering drawings 01, 02, 03-M-IAP-001 and -002.

The instrument air line penetrating the containment serves the normally operating valves of the pressurizer spray system and the normally operating valve of the nitrogen supply to the safety injection tanks (used to maintain pressure on top of the liquid in the tanks). The penetrating instrument air line is provided with a check valve inside the containment and a solenoid-operated valve on the outside of the containment.

This solenoid-operated valve closes automatically upon a containment spray actuation signal (CSAS) or in case of an electrical (train A) failure. It can also be closed manually from the control room. Should the line rupture inside the 3

containment, airflow is limited to a flow of 10 actual ft /min by a restriction orifice upstream of the solenoid-operated valve.

The service air line penetrating the containment is used to support refueling operations and required maintenance. This line is provided with a check valve inside the containment and a manual block valve at the point of service connection in the containment. The line is provided with a locked closed manual isolation valve outside the containment.

June 2011 9.3-17 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.1.2.2 System Operation 9.3.1.2.2.1 Instrument Air System. One compressor is normally in operation with the other two on standby. Normally, the capacity of one compressor is adequate for base load operation. The other compressors cycle on and off as required to meet increased plant demands as evidenced by a drop in the instrument air header pressure. In order to equalize wear on each compressor, the compressors are periodically rotated for base load operation.

In the event that the one operating compressor fails to supply the full air demand, or an electrical trip of an operating compressor occurs, the resulting continuous low pressure in the supply line initiates an automatic start of the standby compressors.

Instrument air is filtered and dehumidified prior to its introduction into the instrument air distribution piping. This is accomplished by two trains of prefilters, regenerative duplex air driers, and afterfilters.

If plugging of a filter occurs, a high differential pressure alarm is provided to warn the operator who may then divert the air stream to the other train through manually operated valves.

Normally, filter elements are replaced on a regular basis to prevent plugging during operation.

The duplex (two tower) drier is operated in such a manner that one tower regenerates while the other tower is in service.

The two towers interchange automatically based on the moisture load on the desiccant bed of the in-service tower. A standard timed cycle operating mode is also available.

June 2007 9.3-18 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.1.2.2.2 Service Air System. Normally the service air compressor will maintain the header pressure in the 115 to 125 psig range. If the compressor runs unloaded for 30 minutes the drive motor is tripped.

The moisture collected downstream of the compressor intercooler and aftercooler and in the air receivers is automatically drained. Manual bypasses are to be used when the drain traps or automatic drain valves are out of service.

Letdown lines are provided for each air receiver to perform necessary maintenance with the receiver depressurized.

A refrigerated air dryer, located downstream of the air receivers, cools the air for removal of moisture, which is automatically drained.

9.3.1.2.3 CESSAR Interface Evaluation Refer to subsections 5.1.5 and 6.3.3 and paragraph 9.3.4.2.

9.3.1.3 Safety Evaluation Because the compressed air system has no safety design basis, no safety evaluation is provided. Paragraph 9.3.1.2 provides an assessment of the compressed air system design and operation.

9.3.1.4 Tests and Inspections The compressors, aftercoolers, receivers, filters, air dryers, and control panel are shop inspected, or tested, prior to installation. The complete, installed compressed air system is inspected, tested, and then operated to verify its performance requirements including operational sequences and alarm functions.

June 2011 9.3-19 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES The containment isolation valves, and piping between isolation valves, are tested in accordance with paragraph 6.2.6.3.

9.3.1.5 Instrumentation Requirements 9.3.1.5.1 Instrument Air Local indication is provided for the following changes in instrument air quality:

1. High differential pressure across the prefilter

2. High differential pressure across the dryer

3. High differential pressure across the afterfilter

4. Loss of power

5. Dryer bed is too wet (high alarm)

6. Dryer bed is too dry (low alarm)

7. Probe cable disconnected

8. Inlet valve malfunction

9. Exhaust valve malfunction Items 1 through 9 have a common trouble alarm in the control room.

APS utilizes ISA-S7.3 (1975), "Quality Standard for Instrument Air" as guidance for controlling air quality. This instrumentation is adequate for monitoring air quality to this standard. The afterfilter removes particulate matter in excess of 0.9 microns absolute. These specifications meet air supply requirements for safety-related valves. All valves fail in their safe position upon loss of instrument air.

An instrumentation package accompanies each of the air compres-sors and air dryer packages. Each package consists of locally June 2001 9.3-20 Revision 11

PVNGS UPDATED FSAR PROCESS AUXILIARIES mounted temperature and pressure switches, indicators, and auto-matic protection devices. The temperature and pressure instruments support the automatic control modes of compressor and dryer operation. A manual or hand mode of operation is also provided for each control room. The instrument air system also includes additional local instrumentation and controls necessary to ensure the ability of the system to perform its design functions.

9.3.1.5.2 Service Air An instrumentation package accompanies the air compressor. The package consists of locally mounted temperature and pressure switches, indicators, and automatic protection devices. The temperature and pressure switches support the automatic control mode of compressor operation. A manual or hand mode of operation is also provided from the control room. The service air system also includes additional local instrumentation and controls necessary to ensure the ability of the system to perform its design functions.

9.3.2 PROCESS SAMPLING SYSTEM 9.3.2.1 Design Bases The process sampling system design bases are as follows:

A. General The normal sampling system is designed to collect samples from the reactor coolant and auxiliary systems for analysis. It permits sampling during reactor operation and cooldown without requiring access to the containment. As a secondary function of the normal sampling system, the pressurizer team space sample line is capable of degassing the RCS by recirculating the June 2011 9.3-21 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES pressurizer steam space to the VCT via the sample line.

Remote samples of fluids in high radiation areas can be taken without requiring access to these areas. Neither sampling system performs a safety function. The radiological (shielding) evaluation for normal operation of the process sampling system is provided in section 12.2. The sample analyses may be performed:

1. Under normal conditions by drawing samples at a sample sink and conducting the analysis in the hot laboratory

2. Under post-accident conditions by obtaining grab samples and performing the required analyses in an appropriate laboratory facility.

B. Reactor Coolant System Samples Samples are taken from one hot leg, the pressurizer surge line, and the pressurizer steam space.

Sampling lines are connected to the reactor coolant system (RCS) piping downstream of a passive flow restriction device. Provisions can be made to permit sampling of the RCS during startup.

The sample line from the RCS hot leg is delayed in transit to the secondary shield wall to allow 16 sufficient time for the decay of N to less than 10% of the total activity in the line.

C. Sample Temperature and Pressure The high-pressure, high-temperature reactor coolant samples and intermediate pressure and temperature samples are cooled to 120F or less and depressurized. This permits analysis by standard sampling methods.

June 2009 9.3-22 Revision 15

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 1 of 11)

Continuous Design Parameters June 2011 Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering (b)

Sample Origin Cooler Analysis (b)

Capability Provided Location (psig) ture (°F) Drawing Primary Sampling System Hot Leg Loop 1 Rough pH, O2, H2, Yes None Remote 2485 621 01, 02, Total Dissolved Aux Bldg 03-M-RCP-001, Gas, NH3, El-140' -002 and -003 Lithium, Boron, 01, 02, Radio-activity, 03-N-SSP-001 Chloride, Fluoride Pressurizer Steam Rough H2 Hydrogen, Yes None Remote 2500 700 01, 02, Space Radioactivity, Aux Bldg 03-M-RCP-001, El-140' -002 and -003 01, 02, PVNGS UPDATED FSAR 03-N-SSP-001 Shutdown Cooling Rough Boron, Radio- No None Remote 485 350 01, 02, Suction Lines 1 activity, Aux Bldg 03-M-SIP-001,

& 2 Chloride, El-140' -002 and -003 Fluoride, Sulfate 01, 02, 03-N-SSP-001 9.3-23 ESF A&B Train Rough Boron, Radio- No None Remote 2050 350 01, 02, Safety Injection activity, Aux Bldg 03-M-SIP-001, Pump Mini Flow Chloride, El-140' -002 and -003 Line Fluoride, Sulfate 01, 02, 03-N-SSP-001 Purification Filter None pH, NH3 No None Remote 60 120 01, 02, Inlet Lithium, Boron, Aux Bldg 03-M-CHP-001, Radio-activity, El-140' -002, -003, -004 Chloride, and -005 Fluoride,Suspended 01, 02, Solids 03-N-SSP-001 Purification Filter None Suspended Solids, No Radio- Remote 50 120 01, 02, PROCESS AUXILIARIES Outlet, Ion Radioactivity activity (c) Aux Bldg 03-M-CHP-001, Exchanger Inlet El-140' -002, -003, -004 and -005 01, 02, Revision 16 03-N-SSP-001

a. Pressure value in psia.

b. Radioactivity samples can be analyzed for gross activity, isotopic composition, tritium or alpha activity.

c. Refer to section 11.5 for detailed descriptions of process and effluent radiation monitors.

d. Refer to section 11.3 for a description of the explosive mixtures monitoring.

e. Sample required to comply with NUREG-0737, Item II.B.3, and/or Reg. Guide 1.97, Rev. 2.

f. Sample not required - redundant or alternate sampling means.

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 2 of 11)

Design Parameters June 2011 Continuous Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering Cooler Analysis Capability Provided Location (psig) ture (°F) Drawing (b)

Sample Origin Primary Sampling System (Contd)

Purification Ion None pH, Lithium,

- No None Remote 50 120 01, 02, Exchanger Outlet Boron, , Aux Bldg 03-M-CHP-001, Radioactivity, El-140' -002, -003, -004 Sulfate, Decon and -005 Factor 01, 02, Chloride, 03-N-SSP-001 Fluoride Pressurizer Surge Rough Boron No None Remote 2500 700 01, 02, Line Aux Bldg 03-M-RCP-001, El-140' -002 and -003 01, 02, 03-N-SSP-001 PVNGS UPDATED FSAR Reactor Drain Pump None Conductivity No None Local 65 120 01, 02, Discharge Before pH, Boron, Aux Bldg 03-M-CHP-001, Filter Chloride El-120' -002, -003, -004 and -005 9.3-24 Reactor Drain Pump None Conductivity No None Local 65 120 01, 02, Discharge After pH, Boron, Aux Bldg 03-M-CHP-001, Filter Chloride El-120' -002, -003, -004 and -005 Pre-holdup Ion None Conductivity No None Local 65 120 01, 02, Exchanger Outlet pH Aux Bldg 03-M-CHP-001, El-120' -002, -003, -004 and -005 Holdup Tank Inlet None Conductivity No None Local 60 130 01, 02, pH, Boron,

- Aux Bldg 03-M-CHP-001, Chloride El-120' -002, -003, -004 and -005 Boric Acid Conden- None Conductivity No None Local 60 140 01, 02, PROCESS AUXILIARIES sate Ion Exchanger pH, Boron Aux Bldg 03-M-CHP-001, Inlet El-120' -002, -003, -004 Revision 16 and -005 Boric Acid Conden- None Conductivity No None Local 60 140 01, 02, sate Ion Exchanger pH, Boron Aux Bldg 03-M-CHP-001, Outlet El-120' -002, -003, -004 and -005 Reactor Makeup Water None Conductivity No None Local 130 120 01, 02, Pump Discharge pH, Boron,

- Aux Bldg 03-M-CHP-001, Chloride El-120' -002, -003, -004 and -005

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 3 of 11)

Continuous Design Parameters June 2011 Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering Sample Origin Cooler Analysis Capability Provided Location (psig) ture (°F) Drawing (b)

Primary Sampling System (Contd)

Reactor makeup Water None Conductivity No None Local 130 120 01, 02, Pump Recirculation pH, Boron Aux Bldg 03-M-CHP-001, El-120' -002, -003, -004 and -005 Boric Acid Makeup None Boron No None Local 130 120 01, 02, Pump Recircula- Aux Bldg 03-M-CHP-001, tion El-120' -002, -003, -004 and -005 Boric Acid Makeup None Boron No None Local Aux Bldg 130 120 01, 02, Pump Discharge El - 120' 03-M-CHP-001,

-002, -003, -004 and -005 PVNGS UPDATED FSAR Boric Acid Portable Boron No None Local Aux Bldg 5 160 01, 02, Batching Tank El - 120' 03-M-CHP-001,

-002, -003, -004 and -005 Reactor Makeup Water None Conductivity No None Local Aux Bldg 130 120 01, 02, 9.3-25 to Volume Control pH, Boron, El - 120' 03-M-CHP-001, Tank Chloride -002, -003, -004 and -005 Volume Control Tank None Conductivity No None Local Aux Bldg 50 120 01, 02, Drain to Recycle pH, Boron El - 120' 03-M-CHP-001, Drain Header -002, -003, -004 and -005 CVCS Letdown None Boron No Yes Remote 50 120 01, 02, Boron, Aux Bldg 03-M-CHP-001, Radioactivity El - 120' -002, -003, -004 and -005 Shutdown Cooling Portable Boron, Radio- No None Local 650 160 01, 02, PROCESS AUXILIARIES Heat Exchanger activity Aux Bldg 03-M-SIP-001, Outlet El - 120' -002 and -003 Revision 16 Safety Injection None Boron No None Local 610 120 01, 02, Tanks 1, 2, 3, 4 Containment 03-M-SIP-001, El - 80' -002 and -003 Secondary Sample Points Hotwell 1A, 2A, 1B, Fine Yes No Yes Remote Hotwell 2 (a) 121 01, 02, 2B, 1C, and 2C Cation Cation Analysis Station 03-M-CDP-001, Conductivity Conductivity Turbine Bldg El -002, -003 and Sodium Sodium 100' -004 01, 02, 03-M-SCP-005,

-006 and -007

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 4 of 11)

Continuous Design Parameters Engineering June 2011 Type of Typical Pressurized On Line Mode of Sample Drawing Sample Discrete Sample Sample Analysis Removal and Pressure Tempera-Sample Origin (b)

Cooler Analysis Capability Provided Location (psig) ture (°F)

Secondary Sample Points (Contd)

S/G 1 and 2 Hotleg Rough & Yes No Yes, Specific Con- Remote Cold 1179 554 01, 02, Blowdown Fine Conductivity ductivity, pH, Lab Aux Bldg 03-M-SGP-001 (c)

Radioactivity , El-140' and -002 pH & Radio- Cation Conductivity & 01, 02, activity Sodium 03-M-SCP-005, Concentration -006 and -007 S/G 1 and 2 Rough & Yes No Yes, Specific Con- Remote Cold 1179 554 01, 02, Downcomer Fine Conductivity ductivity, pH, Lab Aux Bldg 03-M-SGP-001 (c)

Radioactivity , El-140' and -002 pH & Radio- Cation Conductivity & 01, 02, activity Sodium Concentration 03-M-SCP-005,

-006 and -007 PVNGS UPDATED FSAR S/G 1 and 2 downcomer Rough & Yes No Yes, specific pH Remote cold Lab 1179 554 01, 02, 03-M-SGP-001 blowdown Fine Conductivity Ph cconductivity, PH, Aux Bldg 01, 02, 03-M-SCP-006

& Radio radioactivity, cation El-140 activity, pH conductivity & Sodium concentration Condensate LP Heater Portable Yes No None Local Turbine 400 396 01, 02, Train A, B, and C Conductivity Bldg, El-140' 03-M-CDP-001, Outlet -002, -003 and -004 9.3-26 FW Pump A and B Portable Yes No None Local Turbine 400 396 01, 02, Suction Conductivity Bldg, El-140' 03-M-FWP-001 HP Heater Train Portable Yes No None Local Turbine 1225 450 01, 02, A and B Outlet Conductivity Bldg, El-140' 03-M-FWP-001 (a)

MSR A, B, C and D Portable Yes No None Local Turbine 202 383 01, 02, Drain Conductivity Bldg, El-140' 03-M-EDP-001, -002, -

Iron, Copper 003, -004 and -005 (a)

First Stage RHTR Portable Yes No None Local Turbine 432 452 01, 02, Drain Tank A, B, Conductivity Bldg, El-140' 03-M-EDP-001, C and D Iron, Copper -002, -003, -004 and

-005 PROCESS AUXILIARIES (a)

Second Stage RHTR Portable Yes No None Local Turbine 985 543 01, 02, Drain Tank A, B, Conductivity Bldg, El-140' 03-M-EDP-001, C and D Iron, Copper -002, -003, -004 and

-005 Revision 16 (a)

Htr Drain Tank A Portable Iron No None Local Turb 433 371 01, 02, and B Drain Bldg El - 100' 03-M-EDP-001,

-002, -003, -004 and

-005

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 5 of 11)

Design Parameters Continuous June 2011 Type of Typical Pressurized On Line Mode of Sample Tempera-Sample Discrete Sample Sample Analysis Removal and Pressure ture Engineering Sample Origin Cooler Analysis (b)

Capability Provided Location (psig) (°F) Drawing Secondary Sample Points (Contd)

Htr Drain Tank A Portabl Iron No None Local Turb 202 393 01, 02, (a) and B Discharge e Bldg El - 100' 03-M-EDP-001,

-002, -003, -004 and -005 Spray Pond Water None Hardness, No None Remote 15 97 01, 02, Alkalinity, Chemical Pump 03-M-SPP-001 and pH, chlorine, House -002 Conductivity Yard Area Local SP Inlet Piping to DG Cooler DG,EW piping Circulating Water Fine Conductivity, No Yes Remote Cold 30 108 01, 02, Outlets pH Conductivity, pH, Lab Aux Bldg 03-M-CWP-001 Chlorine 140' 01, 02, Chlorine Analysis 03-M-SCP-005, Sta Turbine Bldg -006 and -007 PVNGS UPDATED FSAR 100' 9.3-27 Condensate Tank None Conductivity, No None Local 25 Ambient 01, 02, Sample pH, Chlorides, Yard Area 03-M-CTP-001 Silica Essential Chiller None pH No None Local Control 45 44 01, 02, A and B Outlets Bldg El 74' 03-M-ECP-001 Essential Cooling None pH No Radioactivity (c) Local Aux Bldg 105 89 01, 02, Water Pumps A El 70' 03-M-EWP-001 and B Discharge Normal Chillers None pH No None Local Aux Bldg 44 01, 02, 45 A, B, and C Outlet El 140' 03-M-WCP-001 Headers Nuclear Cooling None pH No Radioactivity Local Aux Bldg 80 105 01, 02, (c)

Water Pump El - 140' 03-M-NCP-001, Discharge Header -002 and -003 Shutdown Cooling None pH No None Local Radwaste Atmos. 120 01, 02, Heat Exchanger Bldg El - 88' 03-M-RDP-004 Revision 16 Room A and B Drain Radwaste Building Sumps PROCESS AUXILIARIES LRS Hold-Up Tank None Radioactivity No None Local LRS Atmos 120 01, 02, Leak Drain Hold-up Tank 03-M-RDP-004 Area El - 100' LRS Recycle Monitor None Radioactivity No None Local LRS Atmos. 120 01, 02, Tank Leak Drain Hold-up Tank 03-M-RDP-004 Area El - 100' Main Turbine Lube None Suspended No None Local Turbine 35 120 -

Oil Conditioner Solids Bldg El - 100' 01, 02, 03-M-Outlet OSP-001 FWPT Lube Oil None Suspended No None Local Turbine Bldg 52 120 -01, 02, 03-M-Centrifuge Outlet Solids El - 100' OSP-001

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 6 of 11)

Continuous Design Parameters June 2011 Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering Sample Origin Cooler Analysis Capability Provided Location (psig) ture (°F) Drawing (b)

Secondary Sample Points (Contd)

Cooling H20 Hold-up None Radioactivity No None Local Aux Bldg 10 75 01, 02, Tank pH El - 40' 03-M-CMP-001 and -002 Chemical Waste None Radioactivity No None Local Yard 10 75 01, 02, Neutralizer Tank pH Area El - 100' 03-M-CMP-001 (1 Sample Point at (V088 - V195) and -002 Each Tank)

Condensate Polishing None Radioactivity No None Local Yard 01, 02, Demineralizer Area El - 100' 60 100 03-M-CMP-001 (LO-TDS) Sump (V028, V031) and -002 (2 Sample Points)

Condensate Polishing None Radioactivity No None Local Yard 60 100 01, 02, PVNGS UPDATED FSAR Demineralizer Area El - 100' 03-M-CMP-001 (HI-TDS) Sump (V034, V037) and -002 (2 Sample Points)

Retention Tank None pH, Hydrazine No None South of Atmos. 116 A0-M-OWP-004 (Holdup Prior to Radioactivity Unit 3, 9.3-28 Evaporation Pond) El - 100' (2 Sample Points) (V227, V229)

Spent Regeneration None pH No Yes Water Rec 40 75 01, 02, Sump Water pH Facility 03-M-CMP-001 Reclamation and -002 Facility) A0-M-CMP-003 Demineralizer Fine Dissolved O2 No Cation and Local and Remote 450 120 01, 02, Influent Specific Cold Lab 03-M-CDP-001, Conductivities, Aux Bldg El - -002, -003 and pH, Sodium 140' -004 01, 02, 03-M-SCP-005,

-006 and -007 PROCESS AUXILIARIES Demineralizer Fine Conductivity, No Cation and Local/Remote 450 120 01, 02, Effluent pH, Chlorides, Specific Cold Lab 03-M-CDP-001, Sodium Conductivities Aux Bldg El - -002, -003 and Revision 16 140' -004 01, 02, 03-M-SCP-005,

-006 and -007

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 7 of 11)

Design Parameters Engineering June 2011 Continuous Type of Typical Pressurized On Line Mode of Sample Tempera- Drawing Sample Discrete Sample Sample Analysis Removal and Pressure ture Cooler Analysis Capability Provided Location (psig)

(b)

Sample Origin (°F)

Secondary Sample 01, 02, 03-M-Points (Contd) FWP-001 S/G 1 and 2 Feedwater Rough Conductivity, No Cation and Local/Remote 1300 450 01, 02, Fine pH, Dissolved Specific Cold Lab Aux 03-M-SGP-001 O2, Hydrazine, Conductivity, Bldg El - 140' and -002 Sodium, Boron pH, Hydrazine, 01, 02, Sodium 03-M-SCP-005,

-006 and -007 Main Steam S/G 1 Rough Chloride, No Cation Local/Remote 1100 575 01, 02, and 2 Fine Sodium, Conductivity Cold Lab Aux 03-M-SGP-001 Si, Sulfate, Bldg El - 140' and -002 Cation 01, 02, Conductivity 03-M-SCP-005, Silica -006 and -007 PVNGS UPDATED FSAR Reverse Osmosis None Chlorine Yes Yes Local Water 30 90 01, 02, Outlet Chlorine Treatment Bldg 03-M-CTP-001, A0-M-DSP-001 Domestic Water Filter None Chlorine Yes Yes Local Water 30 90 01, 02, Outlet Chlorine Treatment Bldg 03-M-CTP-001 9.3-29 A0-M-DSP-001 Domestic Water Filter None Chlorine Yes Yes Local Water 125 90 01, 02, Outlet Chlorine Treatment Bldg 03-M-CTP-001 A0-M-DSP-001 ESF Sump Pump A None pH No None Local Aux Bldg 50 120 01, 02, and B Discharge El - 40' 03-M-RDP-002 ESF Sump Pump A None pH No None Local Aux Bldg 15 120 01, 02, and B Discharge El - 40' 03-M-RDP-002 Blowdown Demineralizer Rough Na, Si, Silica, Yes Yes, Na, Cation Remote Yard Area 225 135 01, 02, Effluent (1) Conductivity Conductivity 03-M-SCP-004, Radioactivity -002 PROCESS AUXILIARIES Blowdown Demineralizer Rough Na, Si, Silica 01, 02, Effluent (2) Conductivity Yes Yes, Na, Cation Remote Yard Area 225 135 03-M-SCP-004, Radioactivity Conductivity -002 Revision 16 Blowdown Demineralizer None Conductivity Yes Yes Remote Yard Area 225 135 01, 02, Strainer Influent Conductivity 03-M-SCP-004, (1) -002 Blowdown Demineralizer None Conductivity Yes Yes Remote Yard Area 225 135 01, 02, Strainer Influent Conductivity 03-M-SCP-004, (2) -002 Blowdown Demineralizer None Conductivity Yes Yes Remote Yard Area 225 135 01, 02, Waste (High TDS) Radioactivity Conductivity (V182, V204) 03-M-SCP-002

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 8 of 11)

Continuous Design Parameters June 2011 Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering Sample Origin Cooler Analysis Capability Provided Location (psig) ture (°F) Drawing (b)

Secondary Sample Points (Contd)

Blowdown None Conductivity Yes Yes Remote Yard Area 225 135 01, 02, Demineralizer Radioactivity Conductivity (V182, V204) 03-M-SCP-002 Waste (Low TDS)

Diesel Fuel Oil None API° Gravity, No None Local Outside by 35 75 01, 02, Storage Tank A Viscosity, Water D.G. Bldg El - 03-M-RDP-004 and B and Sediment 100' Condenser Sump None Radioactivity No None Local Turb 20 75 01, 02, PVNGS UPDATED FSAR (North and South) Bldg El - 100' 03-M-OWP-001, Pump Discharges (V075, V078) -002 and -003 and A0-M-OWP-004 Turbine Building None Radioactivity No None Local Turb 20 75 01, 02, Sump Bldg El - 100' 03-M-OWP-001, (V076) -002 and -003 and A0-M-OWP-004 TCW Pump A and B None pH, Chloride No None Local Turb 90 110 01, 02, Discharge ions, Nitrite, Bldg El - 105' 03-M-WCP-001 Fluoride 9.3-30 Auxiliary Steam Portable pH, Conductivity No Radioactivity Local Aux 15 212 13-M-ASP-001 Condensate Sodium, (c) Bldg El - 40' Receiver Tank Chloride, Sulfate, Radioactivity Auxiliary Steam Rough pH, Conductivity No None Local Yard Area 250 405 A0-M-ASP-002 Nitrogen PROCESS AUXILIARIES Circulating Water None Foam, pH, No No Local Cooling Atmos. 108 01, 02, Cooling Towers Conductivity Tower Area 03-M-CWP-001 Silica, Calcium Demineralized Water None Water Chemistry Yes Yes Wtr Treatment 20 Ambient A0-M-DWP-001 and Surge-Rinse Tank pH, Silica, Area 01, 02, Conductivity, Oxygen, 03-M-DWP-002 Oxygen Conductivity Revision 16 Demineralized Water None Water Chemistry No None Local Yard Area 288" H20 Ambient A0-M-DWP-001 and Storage Tank Conductivity, 01, 02, Silica, 03-M-DWP-002 Radioactivity

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 9 of 11)

Continuous Design Parameters June 2011 Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering Sample Origin Cooler Analysis Capability Provided Location (psig) ture (°F) Drawing (b)

Secondary Sample Points (Contd)

Fuel Pool Clean-up None Boron, Sulfate, No None Local Fuel Bldg 90 125 01, 02, 03-M-PCP-Pump (1 & 2) pH, Chloride ions, El - 100' 001 Discharge (Spent Fluoride ions, Fuel Pool or Boric Acid, Refueling Pool) Ammonia, Lithium, Radioactivity Fuel Pool Clean-up None Conductivity, pH, No None Local Aux Bldg 50 125 01, 02, 03-M-PCP-Filter 1 & 2 Chloride ions, El - 120' 001 Outlet (Spent Sodium Fuel Pool or Radioactivity Refueling Pool)

Fuel Pool Clean-up None Conductivity, pH, No None Local Aux Bldg 50 125 01, 02, 03-M-PCP-Demineralizer 1 & 2 Chloride ions, El - 130' 001 PVNGS UPDATED FSAR Outlet (Spent Sodium, Sulfate Fuel Pool or Radioactivity Refueling Pool) Decon Factor Radwaste Sampling Points 9.3-31 Evaporator Feed from None pH No Yes Local Radwaste 01, 02, LRS Holdup Pumps pH Bldg El - 100' 107 psia 60 to 03-N-LRP-001, 120 -002 and -003 Chemical Drain Pump None pH, Conductivity Yes None Local Radwaste 88 psia 60 to 01, 02, Discharge Bldg El-140' 120 03-N-LRP-001,

-002 and -003 Hi-Lo TDS Holdup Pump None pH, Conduc-tivity Yes None Local Radwaste Hi-TDS 60- 01, 02, Recycle Boric Acid Bldg El-100' 55 psia 120 03-N-LRP-001, Concentration LO-TDS -002 and -003 42 psia Evaporator Concen- Portable Boric Acid Con- Yes None Local Radwaste 34 224 01, 02, trate Pumps Recycle centration, pH, Bldg El-120' 03-N-LRP-001, PROCESS AUXILIARIES to Vapor Body Wt% Solids -002 and -003 Revision 16 Gas Sampling System (d)

Gas Surge Tank None Radioactivity, O2 No O2 Remote Rad- 380 200 01, 02, waste Bldg 03-N-LRP-001, El-140 -002 and -003 01, 02, 03-N-SSP-001 01, 02, 03-N-GRP-001

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 10 of 11)

June 2011 Continuous Design Parameters Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering Sample Origin Cooler Analysis Capability Provided Location (psig) ture (°F) Drawing (b)

Gas Sampling System (Contd)

(d)

Gas Decay Tank None Radioactivity, O2 Yes O2 Remote Rad- 380 200 01, 02, waste Bldg 03-N-GRP-001 El-140' 01, 02, 03-N-SSP-001 (d)

Gas Stripper None Radioactivity, O2 Yes O2 , When Remote Rad- 200 120 01, 02, Selected waste Bldg 03-N-GRP-001, El-140' 01, 02, 03-N-SSP-001 (d)

Volume Control Tank None Radioactivity, O2 No O2 , When Remote Rad- 50 120 01, 02, Selected waste Bldg 03-M-CHP-001, El-140' -002, -003, -004 PVNGS UPDATED FSAR and -005 01, 02, 03-N-SSP-001 (d)

Equipment Drain Tank None Radioactivity, O2 No O2 , When Remote Rad- 3 120 01, 02, Selected waste Bldg 03-M-CHP-001, 9.3-32 El-140' -002, -003, -004 and -005 01, 02, 03-N-SSP-001 (d)

Reactor Drain Tank None Radioactivity, O2 No O2 , When Remote Rad- 3 120 01, 02, Selected waste Bldg 03-N-GRP-001 El-140' 01, 02, 03-N-SSP-001 Holdup Tank None H2 No None Local Rad- Atmos 120 01, 02, waste Yard 03-M-CHP-001, Area -002, -003, -004 PROCESS AUXILIARIES and -005 01, 02, Revision 16 03-N-SSP-001 Containment None Radioactivity No Radio- Local Aux 5 122 01, 02, Atmosphere activ- Bldg. 100' 03-M-CPP-001 ity

( c) Level NE Quad 01, 02, 03-M-HCP-001 Containment Purge None Radioactivity No Radio- Local Aux Atmos 120 01, 02, Exhaust activ- Bldg. 100', 03-M-CPP-001 (c) ity 140 Level NE Quad

Table 9.3-3 SAMPLING SYSTEM DESIGN PARAMETERS (Sheet 11 of 11)

Design Parameters June 2011 Continuous Type of Typical Pressurized On Line Mode of Sample Sample Discrete Sample Sample Analysis Removal and Pressure Tempera- Engineering Sample Origin Cooler Analysis Capability Provided Location (psig) ture (°F) Drawing (b)

Gas Sampling System (Contd)

Plant Vent None Radioactivity No Radio- Local Turb Atmos. 120 01, 02, activ- Bldg. 176' 03-M-CPP-001 (c) ity Level Containment None Moisture No Yes Local 1 at 5 122 01, 02, Atmosphere (4 points) El-104-6 NW 03-M-HCP-001 Moisture Quad; 1 at El (4 points) 124-9 NW Quad; Control Building None Radioactivity No Radio- Remote Con- Atmos 113 01, 03-M-HJP-001 PVNGS UPDATED FSAR Outside Air Smoke, Cl 2 activ- trol Bldg. and Intake (2 points each) ity

( c) 140 Level in 02-M-HJP-001 Smoke, Cl 2 Outside Air and -002 Chase (2 points each) 9.3-33 Revision 16 PROCESS AUXILIARIES

PVNGS UPDATED FSAR PROCESS AUXILIARIES D. Verification of Boron Concentration To verify the boron concentration of the water recirculated via the safety injection and shutdown cooling system, provisions for extracting, processing, and analyzing samples from the following points are provided: each of the two shutdown cooling suction lines and the safety injection pump miniflow lines.

E. Chemical and Volume Control System Samples (Normal Sampling Only)

Both liquid and gas sampling provisions are required to monitor chemical and volume control system (CVCS) performance.

1. In order to monitor the overall purification effectiveness, liquid samples are taken from the purification filter inlet stream for filterable corrosion products, the outlet stream for soluble activity, and the purification ion exchanger outlet for soluble activity.

2. Deleted F. Representative Samples In order to ensure that representative samples are obtained, the sampling lines are purged prior to sampling. Purge flow shall be high enough (i.e.,

turbulent) to inhibit deposition of suspended solids and to remove crud from sampling lines.

June 2011 9.3-34 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES G. Relief Protection Relief protection is provided to limit the sample pressure to a value below the design rating of the sampling system.

H. The seismic design classification and quality group classification of sample lines and components conform to the classification of the system to which each sampling line and component is connected out to such a point where classification to lower seismic and quality group classification is justified on the basis that adequate isolation valving or flow restric-tion is provided.

I. Sample lines penetrating the containment are provided with isolation valves in accordance with 10CFR50, Appendix A, General Design Criterion 55 or 56.

Containment isolation is described in subsection 6.2.4.

J. The configuration of the process sampling system provides the sample points and capability outlined in table 9.3-3.

K. The process sampling system provides the capability to conduct the continuous analyses indicated in table 9.3-3.

L. The process sampling system shall provide the capability to conduct discrete analyses on samples as indicated in table 9.3-3.

M. For the process sampling system, the reactor coolant sample lines shall be sized to assure complete turbulent flow during purging (i.e., Reynolds Number 4.000).

This ensures particle suspension.

June 2003 9.3-35 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES N. The process sampling system shall be designed to direct most reactor coolant sample purge fluids to the volume control tank or the recycle drain header.

Other radioactive samples that purge and overflow a sample collector are directed to the liquid radwaste system discussed in section 11.2.

O. Sample lines connected to ASME Section III code class lines or vessels shall be constructed in accordance with ASME Section III code class up to and including the first normally closed manual, automatic isolation, or throttling valve.

P. Consistency with the recommendations of Regulatory Guide 1.21, Revision 1, and ANSI N13.1-1969 is discussed in section 11.5.

Q. Codes and standards applicable to the process sampling system are listed in table 3.2-1.

9.3.2.2 System Description The normal process sampling system is illustrated in engineering drawings 01, 02, 03-N-SSP-001. The secondary sampling system and local sampling points are illustrated on the piping and instrumentation diagrams (P&IDs) referred to in table 9.3-3 and in engineering drawings 01, 02, 03-M-SCP-005,

-006 and -007.

Locations of sample points are shown on the appropriate system P&IDs for the systems to be sampled. The process sampling system includes sampling lines, heat exchangers, sample vessels, sample sinks or racks, analysis equipment, and instrumentation.

June 2003 9.3-36 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES The sampling points have been selected to provide the required chemical and radiological information while keeping the system simple for reliability and ease of maintenance. Separate lines from the various sampling points to the sample sink or sample vessel are provided to allow for simultaneous sampling. The normal process sampling system is operated from the cold or hot laboratory's sampling room, with the exception of the containment isolation valves which are operated from the control room.

Chemical and radiochemical analyses are performed to determine boron concentration, fission and corrosion product activity, crud concentration, dissolved gas and corrosion product concentrations, chloride concentration, coolant pH, conductivity of the reactor coolant, and noncondensable gas concentration in the pressurizer. Analyses results from the normal process sampling system are used to regulate the boron concentration, monitor the fuel cladding integrity, evaluate ion exchanger and filter performance, specify chemical additions to the various systems, and maintain the proper hydrogen concentration in the reactor coolant systems.

9.3.2.2.1 Normal Operation Reactor coolant system samples are taken from the hot leg piping of one reactor coolant loop, the pressurizer surge line, and the pressurizer steam space. These high-pressure, high-temperature samples are individually routed to the sampling room where they are first cooled in a sample heat exchanger to 120F or less, and then reduced in pressure by a throttling valve to approximately 25 psig. The reactor coolant flows to the volume control tank or to the equipment drain tank through a purge line until sufficient volume has passed to June 2003 9.3-37 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES permit the collection of a representative sample. The purge flow is normally directed to the volume control tank in the CVCS to minimize waste generation.

The hot leg is sampled to check reactor coolant chemistry and radioactivity. Piping is arranged so that the overall transit time from the loop to the containment wall is sufficient to permit decay of short-lived radioactivity. Two types of samples may be collected from the hot leg: a high-pressure, low-temperature sample may be collected in a sample vessel where amounts of oxygen, nitrogen, helium, hydrogen, and fission gases can be determined; or a low-pressure, low-temperature sample may be collected at the sampling sink where an analysis of the chloride and boron concentration can be made. The pressurizer surge line sample checks the boron concentration at the pressurizer surge line. This low-pressure, low-temperature sample is collected in the sampling sink only. Pressurizer steam space samples can be collected in a sample vessel at a high pressure and low temperature. These samples give a representation of fission products and noncondensable gases in the pressurizer steam space.

Liquid samples taken from the safety injection system are at intermediate temperature and pressure and are routed through a sample heat exchanger and a manually set throttling valve in the sampling room. Remote or local (dependent on RCS pressure) samples are taken separately from each of the two shutdown cooling suction lines. Remote samples are taken from the safety injection pump miniflow lines to check the boron concentration of the recirculated water. The safety injection pump sample points permit sampling during the recirculation period following a postulated loss-of-coolant accident (LOCA),

while the shutdown cooling samples allow for the verification June 2003 9.3-38 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES of the reactor coolant boron concentration prior to and during shutdown cooling.

Low-pressure, low-temperature samples from the CVCS and the secondary chemistry control system (SCCS) are routed directly to the hot laboratory and cold laboratory. The purification filter inlet and outlet samples from the CVCS verify filter performance for crud removal. The purification ion exchanger outlet sample, together with the purification filter outlet sample, verify ion exchange removal of soluble activity.

In order to assure that a representative sample is obtained, the sampling lines are purged prior to withdrawing the sample. The volume of the purge flow must be at least twice sampling line volume. This purge must be accomplished for two different sections of the sampling system. First, the lines are purged, usually to the volume control tank to minimize waste or to the equipment drain tank. Second, the lines to the sample sink are purged prior to withdrawing a hand sample. The pressure and flowrate of these purge flows are indicated in the sampling room.

The sample volume will vary according to the type of analysis to be performed. The hot leg and pressurizer steam space samples that will be collected as high-pressure, low-temperature samples within the sample vessel will have a volume of 1 liter. From this type of sample, corrosion product concentrations and activity levels, fission products and gases, or other noncondensable gases can be determined. However, these same samples can be collected at the sample sink as low-pressure, low-temperature samples. In this case, the sample volume required would be approximately 250 ml for a boron or chloride concentration analysis and could be as large as 5 liters for a crud concentration analysis. When testing for June 2003 9.3-39 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES coolant pH and conductivity at the various sample points, a sample volume of 250 ml will also be sufficient.

Samples can be collected at the sample sink located in a hooded, ventilated enclosure equipped with a fan exhausting to the plant vent system. A demineralized water line is routed to the sink for flushing purposes. The sink drains to the liquid radwaste system.

Relief protection is provided to limit the sample pressure to 140 psig. The relief valve discharge to the equipment drain tank located in the CVCS.

9.3.2.2.2 Post-Accident Post accident, PVNGS will use the normal sampling system to secure samples. This will be performed in accordance with ALARA guidelines.

9.3.2.2.3 Secondary Systems Drain Sampling There are eight sumps in or near turbine building structures with potential for transferring radioactivity to flow paths leading to the retention tanks/evaporation ponds.

In addition to the eight sumps, the Blowdown Flash Tank Overboard path and the Condensate Polishers Pre-Service Rinse Overboard path have the potential for transferring radioactivity to the retention tanks. These two paths discharge through a common line into the CWNT header. Prior to entering the CWNT header, the effluent is sampled by a continuous-acting radiation monitor, JSQN-RU0200. This monitor alarms in the control room and automatically closes the discharge valve, JSCN-HV1283, when radioactivity in the liquid effluent exceeds predetermined limits. In the event of a June 2009 9.3-40 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES radiation monitor failure or loss of power to the monitor or the isolation valve, the isolation valve will close and terminate this path. There are three drainage sumps in the turbine building: the north sump, the south sump, and the turbine building sump. Each sump has an analysis point on its discharge piping and can transfer fluids to the liquid radwaste system (LRS), either of two chemical waste neutralizing tanks (CWNTs), or to an oil/water separator. Each CWNT has separate analysis points and can be sampled prior to discharge. Each CWNT can discharge to the LRS or the retention tanks. The oil/water separator dis-charges to its sump (sump four), which in turn discharges to the retention tanks.

There is not a very great potential of introducing significant radioactivity to these sumps, and it is not likely that the sumps would be aligned to discharge radioactivity to the retention tanks. The following are the sources to these sumps:

North Sump Battery room neutralizing pit (nonradioactive)

Floor drains (equipment leakage and cleaning liquids)

Feedwater heaters Heater drain tank and pump Instrument air compressor drains (nonradioactive)

Air dryer/prefilter drains (nonradioactive)

Blowdown flash tank liquid drain Turbine cooling water heat exchanger drain (nonradioactive)

Turbine cooling water surge tank drain (nonradioactive)

Heater blowdown stack Condensate storage tank Condenser drains Generator stator cooler drain (nonradioactive)

June 2009 9.3-41 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES South Sump Floor drains (equipment leakage and cleaning liquids)

Low-pressure heaters and condenser drains Condenser evacuation drain Steam seal exhauster drain Isophase bus cooler drain (nonradioactive)

H2 seal oil cooler (nonradioactive)

Condensate pump drainage Turbine Building Sump Feedwater pump lube oil reservoir drains (nonradioactive)

Feedwater pump drain Turbine lube oil drains (nonradioactive)

Oil/Water Separator Sump North, south, and turbine building sumps Control building sumps (nonradioactive)

The only sources noted above that could contain any radio-activity are secondary system component sources -- condensate or blowdown. No regenerant chemicals are present. Thus, any radioactivity which is present must be at least as dilute as the secondary system.

The activity level in the secondary system is monitored at two points. Steam generator blowdown monitors 13-J-SQN-RU-4 and RU-5 will detect abnormal activity in the secondary as it is diverted to the blowdown processing equipment. The condenser gland seal exhauster monitor 13-J-SQN-RU-141 will detect abnormal activity in the condenser.

June 2003 9.3-42 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES If abnormal activity levels are present, sump transfer paths will be aligned to transfer to the LRS or the CWNTs with sub-sequent alignment to the LRS. However, if it is determined during operating (by sampling or monitoring) that the sumps do not contain significant radioactivity, they may be realigned to discharge to the CWNTs (aligned to the retention tanks) or the oil water separator and thence to the retention tanks.

The remaining four sumps are the high and low total dissolved solids (TDS) sumps that receive regenerant wastes from the condensate polishing demineralizers or the blowdown demineralizers, respectively. Each sump has local drains that will be used for grab sampling. For either processing stream, initial regenerant effluent is fed to the resin and subsequently directed to the high TDS sumps. These discharge to the CWNTs.

As noted previously, the CWNTs can discharge to the LRS or retention tanks and are sampled prior to discharge. Only after the TDS level of the regenerant has dropped (associated with activity levels), as measured by online conductivity cells, would flow be directed to the low TDS sumps or the circulating water system (and thence to the evaporation ponds via blowdown).

Thus, the systems are designed to send radioactive waste to the LRS and yet recover clean liquid for recycle to the greatest extent practical.

To ensure that abnormal levels of activity are not sent to clean systems, design provisions for sampling have been clarified.

Table 9.3-3 has been revised to show the sampling capabilities at these sumps. Operationally, when significant activity is present in the secondary (as detected by the steam generator or condenser gland seal exhaust monitors), the low TDS sumps will be aligned to discharge to the high TDS sumps. A grab sample analysis for June 2009 9.3-43 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES radioactivity will be required prior to changing this alignment to allow discharge to the circulating water.

In summary, the secondary systems are continuously monitored for activity. If abnormal activity is present, this will lead to alignment of leakage and cleanup stream discharge to the LRS.

If, after grab sampling, no abnormal activity is present in effluents, they can be directed to the circulating water or retention tanks.

9.3.2.2.4 Retention Tanks Sampling The divided retention tank is located south of the Unit 3 spray ponds. It has approximately a 1-million gallon capacity and is divided into two identical compartments. The compartments are approximately 123 feet x 93 feet with a nominal depth of 8 feet which includes a 2 foot freeboard. To avoid ponding on the bottom of the tank during dewatering cycles, the tank is sloped 1/8 inch per foot from North to South.

The tanks act as storage in the event the effluent is not within the standards for pH, Hydrazine, and radioactivity prior to discharge to the evaporation pond. One retention tank can store the normal waste effluent of 800 gallons per minute for a 10-hour period. The offline tank is monitored, chemically treated (if necessary), and discharged to the evaporation pond.

The waste effluent which meets the Offsite Dose Calculation Manual (ODCM) release limits will be pumped into evaporation ponds numbers 1 and/or 2.

June 2009 9.3-44 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES Sampling can be conducted directly by dip grab sampling or by sampling the retention tank pump discharge (engineering drawing A0-M-OWP-004, valve V227 or V229.)

If a portable ion exchanger is used to purify the retention tank, expended resins will be disposed of in one of two ways. If resins are radioactive, they will be transferred by truck or drum to the solid radwaste system of either Unit 1, 2, or 3. If resins are not radioactive, they will be hauled to a licensed disposal site. Regeneration is not currently contemplated due to the low frequency projected for this operation.

9.3.2.3 Component Description 9.3.2.3.1 Sampling Lines Sampling points are at locations where turbulence ensures representative sampling. Sampling nozzles are provided where deemed required as shown on the appropriate system P&ID. The sample line from the RCS hot leg has a delay that ensures adequate N-16 decay through a transit time of approximately 90 seconds to the secondary shield wall. Sampling lines from the primary coolant loop are provided with flow restriction orifices to limit coolant loss from a rupture of the sample line.

Fail-closed containment isolation valves are provided for sampling lines that penetrate the containment.

Relief valves provide protection to limit the pressure to a value below the design rating of the sampling system.

Waste handling is provided for purging the primary sample lines with sample fluid and flushing with demineralized water.

June 2009 9.3-45 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.2.3.2 Sample Coolers Rough and fine sample coolers are provided for remote sampling.

These coolers are heat exchangers. Cooling is provided by the nuclear cooling water system for the primary sampling system and by the nuclear cooling water system, turbine cooling water system, and chilled water system for the secondary sampling system.

Where temperatures are above 140F, portable coolers are used for local grab sample points to prevent injury to sampling personnel.

The primary sampling heat exchangers are located in the hot laboratory in the auxiliary building.

The maximum sample temperature out of the heat exchangers is 120F for all operating modes.

Table 9.3-5 stipulates the primary sampling system design parameters.

Table 9.3-6 contains the operating parameters for the sample heat exchangers.

9.3.2.3.3 Sample Vessels 9.3.2.3.3.1 Normal. A capability is provided to take pressurized samples from the sources indicated in table 9.3-3.

Each sample line from these sources is provided with connections for a sample pressure vessel to provide the capability to sample at the local RCS operating pressure. The vessel is sized to contain a sufficient volume to perform an analysis of reactor coolant for dissolved hydrogen or fission gas content. The vessel material is chemically compatible with reactor coolant.

Table 9.3-5 stipulates the sample vessel design parameters.

June 2003 9.3-46 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.2.3.3.2 Post-Accident. The capability is provided to take depressurized samples from the RCS.

9.3.2.3.4 Primary Sample Sinks The primary sample sinks are located in the hot laboratory along with the sample vessels and associated control panels.

The sample sink is drained to the liquid radwaste system through a water trap. Demineralized water is provided at the sample sink to flush and clean the sink. The sampling room and sample hood are ventilated. Additional ventilation requirement 9.3.2.3.5 Gas Analyzers Dual oxygen gas analysis equipment located in the radwaste building has the capability to analyze selected sample points.

Continuous sampling capability is provided for the gaseous radwaste system (GRS) surge tank and the waste gas header. The surge tank sample provides a representative sample of a mixture of gases that accumulate in the surge tank while the GRS compressor is not in operation.

These analyzers provide a direct readout of oxygen concentration. The dual oxygen monitors have automatic control functions which preclude the formation of explosive hydrogen and oxygen mixtures. Alarms are provided in the radwaste panel and main control room to notify the operators of high oxygen.

Samples may be collected in a sample vessel and taken to the hot laboratory for further analysis.

It is assumed that the waste gas holdup system contains greater than 4% hydrogen whenever the system is in service.

June 2009 9.3-47 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES Table 9.3-5 PRIMARY SAMPLING SYSTEM DESIGN PARAMETERS (NORMAL) (Sheet 1 of 1)

Sample Heat Exchanger Quantity 5 (identical units)

Type Shell and tube, vertical Tube side (sample)

Fluid 3.6 wt. % boric acid Design pressure 2485 psig Design temperature 700F Pressure drop 55 psi at 0.5 gal/min Material Stainless steel Shell side (component cooling water)

Fluid Nuclear cooling water Design pressure 150 psig Design temperature 200F Pressure drop 3 psi at 3 gal/min Material Carbon steel Safety class, tube/shell NNS/NNS Seismic class, tube/shell None/None Sample Vessel Quantity 2 Internal volume 1000 cm(3)

Design pressure 2485 psig Design temperature 200F Normal operating pressure 2250 psia Normal operating temperature 120F Material Stainless steel Fluid 3.6 wt % boric acid Safety class NNS Seismic class None June 2003 9.3-48 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES Table 9.3-6 OPERATING PARAMETERS FOR THE SAMPLE HEAT EXCHANGERS Tube Side Shell Side (Sample) (Cooling Water)

Flow Flow Heat Sample (gal/ (gal/ Transferred Heat T In T Out min) T In T Out min) (Btu/h)

Exchanger (F) (F) (max) (F) (F) (max) (max)

Pressuri- 653 120 1.0 105 125 30 5.1 x 105 zer steam space Pressuri- 653 120 1.0 105 135 30 5.1 x 105 zer surge line Hot leg 621 120 1.0 105 135 30 5.1 x 105 Safety 350 120 1.0 105 140 30 5.1 x 105 injection system Safety 350 120 1.0 105 140 30 5.1 x 105 injection sumps Contain- 350 120 1.0 105 140 30 5.1 x 105 ment radwaste sumps June 2003 9.3-49 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES Automatic control functions are provided to stop compressor operation on high-high oxygen alarm at 3.75%. Analyses are provided on the suction side of the compressor (by sampling the surge tank and waste gas surge header).

The O2 content of the sampled gas is indicated in the radwaste control room. Annunciating alarms are provided locally in the radwaste control room for each train of the gas analyzer, and a common radwaste trouble alarm is provided in the main control room via the plant computer. The O2 high alarm is set at 2% and the high-high alarm is set at 3.75%.

Table 9.3-7 provides sample points, alarms, and frequencies.

Table 9.3-7 SAMPLE POINTS, ALARMS, AND FREQUENCIES FOR GAS ANALYZERS Sample Point Frequency Alarm Train A Gas surge tank Continuous Oxygen Train B Waste gas Header Continuous Oxygen 9.3.2.3.6 Analysis Equipment and Instruments Modern chemistry instrumentation including ion chromatographs, auto-titrators, atomic absorption spectrophotometers, analytical balances and other common laboratory equipment and glassware are maintained in the both hot and cold chemistry laboratories.

Certain laboratory instrumentation is utilized inline (continuous monitoring of the sample stream). Many samples can June 2009 9.3-50 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES be drawn in the laboratory, however certain samples must be taken locally. Some inline instrumentation is located outside of the laboratory such as the hotwell monitoring skids located in the turbine building. Instruments for monitoring flow and pressure on the purge discharge line downstream of the common purge header are provided. The pressurizer steam space sample line, which is not connected to the header, has its own pressure and flow instruments. Post-accident analysis will be performed by laboratory analysis in an appropriate laboratory facility.

9.3.2.4 System Operation (For normal sampling only unless noted)

Except as discussed in paragraph 9.3.2.3.6, all primary and secondary sampling points can be sampled in the auxiliary building cold and hot laboratories. Secondary sampling points inside the turbine building can also be sampled in the turbine building cold laboratory. Remotely operated valves are controlled from the main control room or from the sampling laboratories.

9.3.2.4.1 Sample Line Purging Prior to discrete samples being taken, the sample line for the normal sampling system is purged with the fluid to be sampled so that a representative sample may be obtained. For RCS samples, initial purge of most of the sample line length can be directed to the equipment drain tank for normal sampling. Secondary sampling purge can be directed to the liquid radwaste system.

Final purging for the RCS during normal sampling is directed to the sample sinks. Sampling lines that are used for continuous samples do not require additional purging prior to taking a sample.

June 2009 9.3-51 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.2.4.2 Discrete Atmospheric Pressure Liquid Sampling (Normal sampling only)

Each sample container is rinsed with the liquid to be collected prior to sample collection. The container is then stoppered with a stopper previously rinsed with the sample water.

9.3.2.4.3 Discrete Pressurized Liquid or Gaseous Sampling (Normal sampling only)

After the sample vessel is purged, samples are collected by closing valves at each end of the sample vessel. Venting to achieve atmospheric pressure within the sample container is required prior to some analyses.

9.3.2.4.4 Continuous Sampling (Normal sampling only)

Liquids or gases that require constant monitoring are directed through pressure-reducing devices, sample coolers, and ion exchanger, as required, prior to flowing through the inline device.

9.3.2.4.5 Analysis of Samples (Normal sampling only)

A capability is provided to determine such reactor coolant parameters in discrete samples as boron concentration, fission and corrosion product activity, dissolved gas concentration, chloride concentration, pH and conductivity, fission gas content, and gas compositions in various vessels. Analytical results are used to regulate boron control adjustments, monitor fuel rod integrity, evaluate ion exchanger and filter performance, specify chemical additions to the various systems, maintain the proper hydrogen overpressure in the volume control tank, and establish conformance with applicable technical specifications. Water quality analyses are performed on June 2003 9.3-52 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES discrete and/or continuous secondary system samples as appropriate to determine such parameters as pH specific and cation conductivity, dissolved oxygen, residual hydrazine, sodium ion concentrations, and radioactivity. Conductivity and pH measurements in the circulating water system are used to control chemical addition and blowdown to maintain acceptable water chemistry. The remainder of the analyses are recorded to permit appropriate monitoring by the operating staff.

9.3.2.5 Post Accident Operation The operation of the sampling system requires communication between the chemistry technician and operators in the control room. Prior to sampling a specific point, the chemistry technician verifies with the control room operator to ensure that the system isolation valves are in the appropriate position to allow for sampling. This may involve overriding a CIAS to reopen certain valves.

9.3.2.5.1 Post Accident Sampling The chemistry technician will then operate the sampling system to obtain the desired sample. Once the sample arrives at the remote grab sampler, the chemistry technician will obtain a sample for laboratory analysis. The grab sample is then transported to the appropriate laboratory for analysis.

9.3.2.6 Design Evaluation The normally closed containment isolation valves are designed to fail closed, in addition to closing on a containment isolation signal. These valves can only be operated from the main control room.

June 2003 9.3-53 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES Connections made to ASME Section III code class systems are fitted with flow restriction devices to satisfy NRC General Design Criterion 33. Sample system piping, up to and including the passive flow restrictors, is designed and fabricated in accordance with the same code class as the system to which it is connected. The piping and components near the sample sink are of low pressure design and are provided with pressure relief for protection of personnel.

The sampling room and the sample hood are ventilated to reduce the potential for airborne radioactivity exposure. Operating procedures specify the precautions to be observed when purging and drawing samples.

9.3.2.7 Testing, Inspection, and Training The containment isolation valves associated with any sampling system will undergo inservice inspection as described in section 6.6.

9.3.2.8 Instrumentation Applications For the normal sampling system, pressure, temperature, and flow indicators and/or flow switches are used where required to facilitate manual operation and to verify sample conditions before samples are drawn.

A radiation sensing element monitors the steam generator sample for primary-to-secondary tube leaks (applicable to normal sampling only). A data logger records radiation levels and a high-radiation alarm in the control room warns of out-of-specification radioactivity.

Continuous analyzers monitor for normal sampling specific water quality conditions in the secondary plant. Alarms are sounded June 2003 9.3-54 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES when these sensors detect parameters that are out-of-specification.

9.3.2.9 CESSAR Interface Requirements Refer to paragraphs 5.4.7.1 and 6.3.1.3.

9.3.2.10 CESSAR Interface Evaluations Refer to paragraphs 5.4.7.2 and 6.3.1.4.

9.3.3 EQUIPMENT AND FLOOR DRAINAGE SYSTEMS The equipment and floor drainage system is divided into individual and segregated systems:

A. Radioactive waste drainage system B. Chemical waste system -- This system consists of five subsystems as follows:

• The radioactive chemical waste subsystem

• The cooling water waste subsystem

• The condensate polishers regeneration waste subsystem

• The spent regenerant waste subsystem

• The chemical tank drains C. Oily waste and nonradioactive waste system D. Sanitary drainage and treatment system June 2003 9.3-55 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.3.1 Design Bases 9.3.3.1.1 Safety Design Bases The safety design bases pertinent to equipment and floor drainage systems are as follows:

A. Safety Design Basis One The equipment and floor drainage system provided for each ESF equipment compartment shall not be interconnected to any other ESF compartment's equipment and floor drainage system unless check valves are utilized to prevent cross-flow.

B. Safety Design Basis Two The equipment and floor drainage system shall be capable of preventing a backflow of water that might exist from maximum flood levels resulting from external or system leakage to areas of the plant containing ESF equipment.

9.3.3.1.2 Power Generation Design Bases Power generation design bases pertinent to equipment and floor drainage systems are as follows:

A. Power Generation Design Basis One Radioactive or potentially radioactive contaminated waste materials are selectively collected by drainage and collection systems that are separated and isolated from the drainage and collection systems provided for handling of strictly nonradioactive waste materials.

June 2003 9.3-56 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES B. Power Generation Design Basis Two A leak detection system is provided in the containment radwaste sumps where the flowrate can be established and monitored during plant operation. The sumps are instrumented with level alarms and indicators capable of monitoring the rate of leakage.

C. Power Generation Design Basis Three A leakage detection system is provided to determine refueling pool and fuel pool liner plate leakage.

D. Power Generation Design Basis Four Conduit drains for safety channel excore detectors are separated and protected from overfill to enable operation of the nuclear instrumentation following a LOCA.

E. Power Generation Design Basis Five Watertight rooms are equipped with level switches in floor drains and room walls. Should a line rupture in the room, the control room would be informed by an annunciator activated by these switches. Each water-tight room is designed to contain water from a flood in that room until plant conditions are such that it can be drained into the normal drainage system.

F. Power Generation Design Basis Six With the exception of the containment building, fuel building, and holdup tanks area, the sumps of collection systems for potentially radioactive drainage are vented to the respective area's HVAC exhaust system.

June 2003 9.3-57 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES G. Power Generation Design Basis Seven Drainage lines from areas that are required to maintain an air pressure differential but drain into the same collection sump are provided with a water seal at the sump. This is accomplished by running separate branch drains with all inlets to the sump turned down and terminated at least 12 inches below the level at which the sump pump stops in pumping down the sump.

H. Power Generation Design Basis Eight Sump pumps are designed to discharge at a flowrate adequate for preventing sump overflow during normally anticipated drainage periods.

I. Power Generation Design Basis Nine Sump capacities provide a live storage capacity consistent with an operating period of not less than 5 minutes with one pump operating. Where necessary, additional live storage capacity is provided to minimize the possibility of drainage backup through floor drains.

9.3.3.1.3 Codes and Standards Generally, equipment and floor drainage collection piping from areas of potential radioactivity and nonradioactivity within the power block is constructed in accordance with ANSI B31.1.0.

All other drainage systems comply with the requirements of the State of Arizona plumbing code regarding permits, materials of construction, installation, tests, inspections, and approval. All drainage systems comply with the intent of the following sections of Title 29, Chapter XVII, Part 1910 (OSHA) of the Code of Federal Regulations, as set forth in June 2003 9.3-58 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES the Federal Register, Volume 37, Number 202, Sections 1910.96, 1910.106, 1910.141, 1910.151, 1910.156, and 1910.159 (c) (3),

dated October 18, 1972.

9.3.3.2 System Description 9.3.3.2.1 General Description 9.3.3.2.1.1 Radioactive Waste Drainage System. The radio-active waste drain system collects and transports noncorrosive, radioactive, or potentially radioactive liquid wastes from equipment and floor drains of the containment building, the auxiliary building, the fuel building, the radwaste building, the holdup tank area, and the decontamination and laundry facilities. The wastes collected are pumped to the liquid radwaste system for processing.

9.3.3.2.1.1.1 Containment Building. The radioactive waste drain system within the containment building consists of floor and equipment drains, vertical drain risers, sloped horizontal drain pipes, two containment radwaste sumps interconnected by piping, each with one 100%-capacity sump pump, one reactor cavity sump with two 100%-capacity sump pumps, piping, valves, controls, and instrumentation serving the equipment and areas shown in engineering drawings 01, 02, 03-M-RDP-001.

The maximum normal leakage to the containment radwaste sumps is estimated to be 30 gallons per day. During refueling operation, equipment decontamination is estimated to result in a total flow of 54 gallons per minute for 30 minutes directed to the containment radwaste sumps. The maximum reactor vessel seal ring leakage is estimated at 0.5 gallon per minute and is directed to the reactor cavity sump.

June 2003 9.3-59 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES The reactor cavity sump pumps, operating automatically under control of level instrumentation in the sump, pump the collected waste from the sump to the containment radwaste sump east. The containment radwaste sumps (east and west) are interconnected with a 4-inch line. Each containment radwaste sump is provided with one sump pump. Both sump pumps, operating automatically under control of their own level instrumentation, pump the collected waste from the sumps to the liquid radwaste system holdup tanks.

Leak detection is done by time level measurements in the reactor cavity sump and in the containment radwaste east and west sumps. Flowrate changes, which exceed a preset rate limit, are readily detected by monitoring the changes in sump water level. In the event that the rate of fill of the sumps exceeds the preset rate limit, an alarm will annunciate in the control room.

A leak detection station is provided to monitor leakage through the refueling pool liner plate. The detection system is divided into six leak chase zones such that a leak in the liner plate can be isolated to a specific zone. The leak chases for each zone are manifolded into one detection test station having a normally closed valve. The test station for each leak chase zone is monitored periodically for leakage.

Excore detector drains are provided to remove condensate buildup within the excore detectors. The conduit drains for the safety channel excore detectors are separated and pro-tected from overfill in the sump to enable operation of the nuclear instrumentation following a LOCA.

9.3.3.2.1.1.2 Auxiliary Building. The radioactive waste drain system within the auxiliary building consists of floor June 2003 9.3-60 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES and equipment drains, vertical drain risers, sloped horizontal drain pipes, three sumps, each with two 100%-capacity sump pumps, piping, valves, controls, and instrumentation serving the equipment and areas as shown in engineering drawings 01, 02, 03-M-RDP-002 and -003.

The drainage system for the rooms containing redundant ESF equipment are provided with separate drainage subsystems, utilizing independent drain trains (train A and train B), so that flooding of the redundant ESF rooms of one train will not jeopardize the operation of the remaining train of redundant ESF equipment. The two drainage subsystems providing drainage for the ESF equipment rooms are separate from the drains serving the non-ESF equipment rooms.

The ESF drain headers empty into independent and segregated sumps. A separate drain header is provided for the non-ESF equipment which empties into a separate sump. Engineered safety features train A sump, ESF train B sump, and the non-ESF sump are each equipped with two 100%-capacity sump pumps. The sump pumps, operating automatically under control of level instrumentation in the sump, pump the collected waste from the sump to the liquid radwaste holdup tanks.

The maximum normal leakage to the non-ESF sump is estimated at 116 gallons per day. Maximum abnormal leakage to the non-ESF sump is estimated at 10 gallons per minute. The maximum normal leakage to each ESF sump is estimated to be 10 gallons per day.

The maximum abnormal leakage to each ESF sump is estimated to be 50 gallons per minute.

The abnormal leakage of 50 gallons per minute conservatively bounds the total leakage from all ESF components, such as pumps, valves, etc. The auxiliary building is sized to accept 400,000 gallons of non-ESF leakage before any leakage would June 2003 9.3-61 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES affect ESF components. For flooding considerations, all nonseismic piping was assumed to have failed. The water volume released will not exceed the design 400,000-gallon capacity.

The auxiliary building rooms, including the ESF pump rooms on elevation 40, were analyzed for flooding due to rupture of the largest nonsafety-related piping for a duration of 30 minutes.

Flooding was also analyzed based on operation of fire protection systems, such as hoses and sprinklers, for 15 minutes without operator action or without operation of the sump pumps.

To assure train separation of ESF equipment necessary for the safe shutdown of the plant, each train-oriented piece of equipment is placed in its own room. These rooms prevent excessive amounts of water, from a tank or pipe rupture, from flooding redundant train-oriented equipment in the building.

These rooms are designed to handle a limited duration single failure of the heaviest flowing line in any compartment containing safety-related piping or equipment. A single failure of any line in an equipment area will affect, at worst, only one train of operation.

Engineered safety features equipment rooms are equipped with Class 1E level switches in leak detecting floor drains. Should a line rupture in the room, the control room would be informed by an annunciator activated by these switches (refer to section 7.6). The auxiliary building drains are run so that leakage external to the ESF equipment room does not flow into the rooms. Each room is protected from backflow by a check valve located in the drain line.

9.3.3.2.1.1.3 Radwaste Building. The radioactive waste drain system within the radwaste building consists of floor June 2003 9.3-62 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES and equipment drains, vertical drain risers, sloped horizontal drain pipes, one sump with two 100%-capacity sump pumps, piping, valves, controls, and instrumentation serving the equipment and areas as shown on engineering drawings 01, 02, 03-M-RDP-004.

The maximum normal leakage to the sealed sump is estimated at 12 gallons per day. Maximum abnormal leakage is estimated at 400 gallons per day.

The sump pumps, operating automatically under control of level instrumentation in the sump, pump the collected waste from the sump to the LRS holdup tanks.

The room containing the antifoam, caustic, and acid tanks and pumps has its floor and equipment drains routed to a neutralizer tank prior to draining to the building sump. The neutralizer tank is located in a concrete pit. Its neutralization medium can either be lump limestone or marble chips with a high calcium carbonate equivalent content in excess of 85%. Since this area of the radwaste building has insignificant potential for radioactive contamination, a trap is installed in the drain line upstream of the neutralizer tank to prevent acidic or caustic fumes from entering the room.

The LRS holdup tanks and the LRS recycle monitor tanks are located outside in the yard adjacent to the radwaste building in concrete compartments that are open to the atmosphere. The floor drains for these compartments are isolated from the radwaste building sump by means of a normally closed valve to prevent rainwater from entering the sump. In the event of a rainstorm, a pipe and closed valve are provided to drain the contained water to ground surface, or the rainwater may be pumped to portable containers and disposed of in accordance with station procedures. A level switch is provided in each June 2011 9.3-63 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES compartment which will alarm high level to the radwaste control panel in the event of a leaking or ruptured tank flooding the area. A local sample point is located upstream of the normally closed drain valve to provide an indication of whether the content of the compartment is either rainwater or radioactive waste.

An oil interceptor is provided to prevent the potential oily waste from the controlled machine shop and tool room from entering the LRS system via the building sump. The floor drains and sink are routed to the oil interceptor prior to draining to the sump. An isolation valve is located down-stream of the oil interceptor in order to provide for oil removal and maintenance of the oil interceptor.

9.3.3.2.1.1.4 Fuel Building. The radioactive waste drain systems within the fuel building consist of floor and equipment drains, vertical drain risers, sloped horizontal drains, one sump with two 100%-capacity sump pumps, piping valves, controls, and instrumentation serving the equipment and areas as shown in engineering drawings 01, 02, 03-M-RDP-005.

The maximum normal leakage to the sump is estimated at 10 gallons per day. The decontamination washdown of the transfer cask and transportable storage canister is estimated to result in a flow of 200 gallons per minute for a 5-minute operation. The sump pumps, operating automatically under control of level instrumentation in the sump, pump the collected waste from the sump to the LRS holdup tanks.

A leak detection station is provided to monitor leakage through the fuel pool liner plate. The detection system is divided into ten leak chase zones such that a leak in the liner plate can be isolated to a specific zone. The leak chases for each June 2011 9.3-64 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES zone are manifolded into one detection test station having a normally closed valve. Provisions are included upstream of the valve to provide helium leak testing of the liner plate in the event leakage is detected at the test station. The test station for each leak chase zone is monitored periodically for leakage.

9.3.3.2.1.1.5 Holdup Tank Area. The radioactive waste drain system within the holdup tank area consists of hardpipe over-flow drains from the holdup tank, the reactor makeup tank, the refueling water tank, hardpipe equipment drains, floor drain from the holdup pumps and room, one sump with two 100%-capacity sump pumps, piping, valves, and control and instrumentation as shown in engineering drawings 01, 02, 03-M-RDP-005.

Maximum normal leakage to the sealed sump is estimated at 20 gallons per day. Maximum abnormal leakage is estimated at 200 gallons per minute.

The sump pumps, operating automatically under the control of level instrumentation in the sump, pump the collected waste from the sump to the LRS holdup tanks.

9.3.3.2.1.1.6 Decontamination and Laundry Facilities. The radioactive waste drain system within the decontamination and laundry facilities consists of floor, equipment and sink drains, sloped horizontal embedded drainage pipe, one sump with two 100%-capacity sump pumps, piping, controls, and instrumentation serving equipment and areas as shown in engineering drawing A0-M-RDP-006.

The sump pumps, operating automatically under control of level instrumentation in the sump, pump the collected waste from the sump to the chemical drain tanks of the LRS system.

June 2011 9.3-65 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.3.2.1.1.7 Main Steam Support Structure. The radioactive waste drain system within the main steam support structure (MSSS) consists of floor and equipment drains, vertical drain risers, sloped horizontal drain pipes, valves, and leak detecting instrumentation as shown in engineering drawings 01, 02, 03-M-RDP-002.

Each auxiliary feedwater pump room is provided with a separate drain. Each drainage line to the auxiliary feedwater pump rooms is provided with a check valve so that the flooding of one room will not jeopardize the operation of the redundant train.

A common drain header carries the drainage from the MSSS to the non-ESF sump in the auxiliary building.

The maximum normal leakage from the MSSS drainage is estimated at 5 gallons per day. The maximum abnormal leakage is estimated at 10 gallons per minute.

9.3.3.2.1.2 Chemical Waste System. The chemical waste system consists of five subsystems as follows:

A. The radioactive chemical waste subsystem which collects by gravity the corrosive radioactive waste from the chemical laboratory and decontamination stations.

B. The cooling water waste subsystem which collects by gravity the chemically treated cooling water from the auxiliary and radwaste buildings for reuse or disposal.

C. The condensate polishers regeneration waste subsystem which collects and neutralizes the potentially radio-active waste for disposal. Those wastes exceeding the release limits stated in the Offsite Dose Calculation June 2003 9.3-66 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES Manual (ODCM) will be sent to the liquid radwaste system for disposal.

D. The spent regenerant waste subsystem which collects and neutralizes the rinse wastes from the makeup demineralizers for disposal.

E. The chemical tank drains in the yard areas.

Engineering drawings 01, 02, 03-M-CMP-001 and -002 show a piping and instrumentation diagram for the chemical waste system.

9.3.3.2.1.2.1 Radioactive Chemical Waste Subsystem. The radioactive chemical waste subsystem is a gravity collection system and includes only drains and piping as shown in engineering drawings 01, 02, 03-M-CMP-001 and -002.

The subsystem transports the liquid waste and drainage by gravity flow to the chemical drain tanks.

9.3.3.2.1.2.2 Cooling Water Waste Subsystem. The cooling water waste subsystem consists of drains, one cooling water holdup tank, two 100%-capacity cooling water holdup tank pumps, piping, controls, and instrumentation.

Separation and isolation of the drain headers from the ESF rooms are provided along with a separate drain header from the non-ESF rooms.

The system drains into the cooling water holdup tank. Since the cooling water holdup tank is a common collection point, valving is provided to prevent backflooding into the ESF rooms.

Two redundant holdup tank pumps take suction from this tank and discharge to the chemical waste neutralizer tanks. Branch lines are provided for diverting the pump discharge to the June 2003 9.3-67 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES essential cooling water surge tanks or to the nuclear cooling water surge tanks.

9.3.3.2.1.2.3 Condensate Polishing Demineralizer Waste Sub-system. The condensate polishing demineralizer waste subsystem consists of drains, two condensate polishing demineralizer sumps, each provided with two 100%-capacity sump pumps, two chemical waste neutralizer tanks, each equipped with an agitator, two neutralizer transfer pumps, piping, valves, controls, and instrumentation.

The subsystem collects liquid waste and drainage in the condensate polisher demineralizer sumps. The condensate polisher regeneration waste can be divided into two types:

high and low TDS. The high TDS waste is the acid and caustic rinses when chemically regenerating the spent resin. Low TDS results from two operations:

• The final rinsing of the regenerated resin to remove all traces of acid or caustic

• The overflow from the resin cleaning operation which removes particulates from the condensate polisher resins High TDS waste is collected in one sump, and low TDS waste in the other. The high TDS waste is pumped to the neutralizer tanks. The low TDS waste is normally pumped to the circulating water return line for reuse unless there is radioactive contamination, in which case the water is discharged to the low TDS LRS holdup tanks. The low TDS waste can also be diverted to the neutralizer tanks. The neutralizer tanks also receive waste from the cooling water holdup tank and from the condenser area sumps.

June 2003 9.3-68 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES Each neutralizer tank can receive the largest single batch of high and low TDS waste without processing so that a polisher may be regenerated without the necessity of operating the neutralizer transfer pumps.

The neutralizer tanks are provided with acid and caustic supply lines from the acid transfer pumps and the dilute caustic supply lines, respectively. Acid or caustic, as required, is added to the waste in the neutralizer tanks. The neutralized waste is then pumped to the retention tank by the neutralizer transfer pumps. The subsystem also has the capability for diverting the pump discharge to the liquid radwaste holdup tanks.

9.3.3.2.1.2.4 Spent Regenerant Waste Subsystem. The spent regenerant waste subsystem consists of drains, one spent regeneration sump provided with two 100%-capacity sump pumps, piping, valves, controls, and instrumentation.

The major discharge to the sump is the waste from the makeup demineralizers. The waste is treated in accordance with Water Reclamation Facility operating procedures and then pumped to the Water Reclamation Facility clarifier feed sump or the trickling filter sump emergency overflow. During Water Reclamation Facility (WRF) outages or emergencies, this wastewater can bypass the WRF clarifier feed sump or the trickling filter sump emergency overflow and be fed directly into the wet dry sump which feeds the 45 acre/or 85 acre reservoirs.

9.3.3.2.1.2.5 Yard Area Chemical Tank Drains Subsystem. The yard area chemical tanks and pumps, which are located outside, are installed on concrete slabs with retaining curbs. Small sumps are provided inside to collect equipment leakage.

Portable pumps or disposal tankers are used to dispose of the effluent.

June 2009 9.3-69 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.3.2.1.3 Oily Waste and Nonradioactive Waste System. The oily waste and nonradioactive waste (OW) system collects and transports liquid waste from equipment and floor drains of the turbine building, the control building, the diesel generator buildings, the fire pumphouse, and the yard area.

The system removes entrained oil from the wastewater for disposal and conveys the oil-free water to the evaporation pond.

Engineering drawings 01, 02, 03-M-OWP-001, -002, -003, A0-M-TBP-003 and A0-M-OWP-004 show piping and instrumentation diagrams for the oily waste and nonradioactive waste system.

9.3.3.2.1.3.1 Turbine Building. The OW system within the turbine building consists of floor drains, equipment drains, one turbine building sump with two sump pumps, two condenser area sumps with two sump pumps each, one turbine building oil/

water separator, one oil/water separator sump with two sump pumps, piping, valves, instrumentation, and controls.

The maximum normal leakage to each condenser sump is estimated at 380 gallons per day. The maximum normal leakage to the turbine building sump is estimated at 170 gallons per day.

Sump pumps, operating automatically under control of level instrumentation in each sump, pump the collected wastes from the sumps into a common discharge header. The discharge header normally conveys the wastes to the turbine building oil/water separator, but lines are provided for diverting the flow to either the chemical waste neutralizer tank or to the liquid radwaste system holdup tanks when required by the presence of chemicals or radioactivity greater than the Offsite Dose Calculation Manual (ODCM) release limits in the wastes.

June 2007 9.3-70 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES The oil/water separator receives effluent from the turbine building and condenser area sump pumps, the control building sump pumps, and the diesel generator building sump pumps. The oil/water separator is a gravity and coalescing separator system for removing free dispersed, and mechanical emulsified oils from water.

The wastewater from the turbine building oil/water separator gravity flows into the oil/water separator sump.

Sump pumps, operating automatically under control of level instrumentation in the sump, pump the wastewater to the duplex retention tank. A duplex retention tank is provided to act as a storage tank in the event the effluent is not within standards for pH, Hydrazine, and radioactivity prior to discharge to the evaporation pond. The radioactivity standard is the release limits in the ODCM. The retention tank also serves to retain the wastes in order to allow treatment to remove chromates when present.

In addition, the retention tank, along with the low TDS sumps and the chemical waste neutralizer tank, provide samples for radioactivity tests if online radiation monitors for the condenser air removal system or steam generator indicate primary-to-secondary leakage. If radioactivity greater than the release limits in the ODCM is present in the wastes, they will be sent to the liquid radwaste system for processing.

When the chemistry of the waste in one section of the retention tank is acceptable, or has been treated to make it acceptable, the pumps are manually started and discharge valves aligned to pump the waste from the retention tank to the evaporation ponds. The pumps are normally started manually, but stop automatically on low level signal from level instrumentation in the tank.

June 2009 9.3-71 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES A connection for a temporary (portable) ion exchanger is provided in the unlikely event that radioactivity (i.e.,

activity greater than the ODCM release limits) is detected in one of the retention tanks: In this situation the effluent is pumped through a portable ion exchanger and returned to the other retention tank where it is eventually discharged to the evaporation pond.

9.3.3.2.1.3.2 Control Building. The OW system within the control building consists of floor drains, equipment drains, two control building sumps with two sump pumps each, piping, valves, instrumentation and controls serving the equipment and areas shown in engineering drawings 01, 02, 03-M-OWP-001, -002,

-003 and A0-M-OWP-004.

Waste from the battery rooms flows through an acid neutralizer sump before flowing to the control building sumps.

The maximum normal leakage to the west sump is estimated at 1000 gallons per day. The maximum normal leakage to the east sump is estimated at 275 gallons per day.

Sump pumps, operating automatically under control of level instrumentation in the sumps, pump the collected wastes from the two sumps into a common discharge header, which conveys the wastes to the turbine building oil/water separator.

Wastes from the train A and train B cable spreading rooms do not flow to the control building sumps. These areas are each drained separately to the outside area.

June 2009 9.3-72 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.3.2.1.3.3 Diesel Generator Building. The OW system within the diesel generator building consists of floor drains, equipment drains, the diesel generator west building sump with two sump pumps, piping, valves, instrumentation, and controls serving the equipment and areas as shown in engineering drawings 01, 02, 03-M-OWP-004 and A0-M-OWP-004.

The maximum normal leakage to each sump is estimated at 15 gallons per day.

Sump pumps, operating automatically under control of level instrumentation in the sump, pump the collected wastes from the sump to the oil/water separator via the discharge headers of the control building sump pumps.

9.3.3.2.1.3.4 Fire Pumphouse. The OW system for the fire pumphouse consists of floor drains, equipment drains, an oil/

water separator, the fire pumphouse sump with two sump pumps, and piping, valves, controls, and instrumentation.

This subsystem is entirely separate from the other parts of the OW system.

The wastes from the floor and equipment drains flow to the fire pumphouse oil/water separator. The wastewater flows from the oil/water separator to the fire pumphouse sump.

June 2009 9.3-73 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES The sump pumps, operating automatically under control of level instrumentation in the sump, pump the wastewater from the sump to the spent regenerant sump.

9.3.3.2.1.3.5 Yard Area. The OW system in the yard area consists of equipment drains, one sump with two sump pumps, piping, valves, instrumentation, and controls.

The yard area sump normally receives drainage and liquid waste from the following equipment and areas:

• Demineralized water storage tank and pumps

• Auxiliary boiler and deaerator area

• Turbine building normal air handling units at elevation 100 The maximum normal input to the yard sump is approximately 30 gallons per minute of domestic water which is based upon a maximum continuous flow of 5 gallons per minute per normal air handling unit.

Sump pumps, operating automatically under control of level instrumentation in the sump, pump the collected effluent from the sump to the circulating water intake structure.

9.3.3.2.1.3.6 Roof Drainage. Except for turbine building roof drains, water resulting from precipitation is collected on all building roofs and open areaways within the buildings and is conveyed to the storm drainage. Turbine building roof drainage and Turbine building normal air handling units at elevation 176 can be aligned to drain to the CW System intake canal or yard sump.

June 2007 9.3-74 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.3.2.1.3.7 Storm Drainage. Except for the Turbine building roof drains rainwater from the roof drainage and surfaces outside the building is collected and conveyed to the natural site drainage. Turbine building roof drainage and Turbine building normal air handling units at elevation 176 can be aligned to drain to the CW System intake canal or yard sump.

9.3.3.2.1.4 Sanitary Drainage and Treatment System. The sanitary drainage and treatment system consists of drains, drain piping, one wet well, one sewage lift station, one surge tank, three package sewage treatment plants, one chlorine contact chamber, one sanitary waste water sump with two sump pumps, and piping, valves, controls, and instrumentation as shown in engineering drawing A0-M-STP-001.

The sanitary waste flows from facilities throughout the plant to the wet well at the sewage lift station. The wet well is equipped with bar screens and air bubblers. The bubbler level control system has been abandoned in place and their function has been replaced by a more advanced level control system.

Two vertical centrifugal dry pit type pumps, taking suction from the wet well, transfer the waste to the surge tank.

In the surge tank, the waste is again aerated by a bubbler system, and two submersible type surge pumps transfer the waste to a stilling well located in the surge tank. From the stilling well, three airlift pumps transfer the waste to the three package sewage treatment units.

In the sewage treatment unit, the waste is treated and clari-fied. The sludge is removed by air lifts, and the clarified wastewater overflows a weir into the discharge line which transports it to the chlorine contact chamber.

June 2011 9.3-75 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES In the chlorine contact chamber, the wastewater is chlorinated (only when the effluent is pumped to the retention tanks) and overflows a weir into a discharge line which conveys it to the sanitary wastewater sump.

Two sump pumps, operating automatically under control of level instrumentation in the sump, pump the wastewater from the sanitary wastewater sump to the water reclamation plant for further treatment and reuse. If the water reclamation plant is not in service, the effluent is pumped to the retention tanks.

9.3.3.2.2 Component Description 9.3.3.2.2.1 Cleanouts. Cleanouts are provided, when practi-cable, where the change in direction in horizontal lines is 90 degrees, at offsets where the aggregate change is 135 degrees or greater, and at maximum intervals of 50 feet.

Cleanouts are welded directly to the piping and are located with their access covers flush with the finished floor.

9.3.3.2.2.2 Floor Drains. All floor drains are installed with their rims flush with the low point elevation of the finished floor. Floor drains in areas of potential radioactivity are welded directly to the collection piping. Floor drains in areas not restricted, due to potential radioactivity, are provided with caulked or threaded connections.

9.3.3.2.2.3 Equipment Drains. Equipment vent and drain lines control valve station vent and drain lines handling radioactive fluids are welded directly to the collection piping. High point vents and low point drains of process piping handling radioactive fluids, when utilized, are routed to the collection piping with flexible hoses. Drain lines from equipment that June 2009 9.3-76 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES may be pressurized during drainage, and where the flow is by a direct or indirect connection to the floor drain system, are equipped with valves that may be throttled, so that the equip-ment discharge flow will not exceed the gravity flow capacity of the drainage header at atmospheric pressure.

9.3.3.2.2.4 Traps. Inlets to chemical drainage systems, and sanitary sewage treatment systems, except those in areas of potential radioactivity and those in storm drainage, are provided with a water seal in the form of a vented P-trap to minimize entry into the building of vermin, foul odors, and toxic, corrosive, or flammable vapors. Air pressure vent lines to the outside atmosphere are provided downstream of the P-traps to prevent excessive backpressures that could cause blowout or siphonage of the water seal. Traps are not installed at inlets in areas of potential radioactivity in order to preclude either a potential for an accumulation of radioactivity in the trap or difficult maintenance of seal water level.

9.3.3.2.2.5 Collection Piping. In areas of potential radio-activity, the collection system piping for the liquid system is stainless steel. Potentially radioactive chemical waste and detergent waste collection system piping is stainless steel.

Where necessary to vent potentially radioactive liquid waste collection systems, connections are provided to the gaseous radwaste system. Offsets in the piping are provided where necessary for radiation shielding. The fabrication and instal-lation of the piping provides for a uniform slope that induces waste to flow in the piping at a velocity of not less than 2 feet per second. Equipment drainage piping is terminated not less than one and one-half nominal pipe diameters above the finished floor or drain receiver at each location where the June 2007 9.3-77 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES discharge from equipment is to be collected, except in locations where hose manifolds are installed. The final connections are made after the equipment is installed in its proper location.

Note: Drain manifolds 13MRDNM01 - 13MRDNM18 discharge into the floor drains below floor grade, a minimum of 1 above the highest level of the floor drain pipe (collection piping). Plant systems will be connected to the drain manifolds via hoses.

9.3.3.2.2.6 Pumps. Redundant sump pumps are provided in each sump. Individual pump capacities are determined by the expected normal maximum inflow from the associated drainage subsystem. Alternating dual pumps are employed to even wear and eliminate operator responsibility for manual alternating of pumps. Sump pumps are designed to discharge at a flowrate adequate for preventing sump overflow during normal anticipated drainage periods. Normal drainage is that drainage expected to occur from equipment maintenance, leakage, and washdown during normal plant operation. The sump pump operating conditions are tabulated in table 9.3-8.

9.3.3.2.2.7 Collection Sumps. Drains located at a higher elevation than the designated receiving tanks are conveyed by gravity directly to the receiving tanks. All other drainage is conveyed by gravity to sumps and then is pumped to the appropriate receiving station.

Sump capacities provide a minimum active storage volume equal to at least the volume required for the operation of one pump for 5 minutes.

The various sump dimensions and capacities are tabulated in table 9.3-9.

June 2011 9.3-78 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.3.3 Systems Operation 9.3.3.3.1 Sump Pumps Each sump is equipped with two duplex type sump pumps with the exception of the containment radwaste east and west sumps.

However, the containment radwaste east and west sumps are interconnected with a 4-inch pipe that serves to treat both sumps as one.

The sump pumps are controlled by one control displacer type level switch per sump. When the sump level rises to a preset point, the pump selected by the alternator is started by the displacement action of the level switch. If the level con-tinues to rise, a second displacer starts the second pump.

Failure of one pump to start will not prevent the second pump from starting. If the level continues to rise, a separate high-high level switch is incorporated in the design to activate an annunciator in the control room advising the operators that a flooding condition is imminent. After the pumps lower the level to a point just above the pump suction, a third displacer on the control level switch stops both pumps.

9.3.3.3.2 Radioactive Waste Drainage System The radioactive waste is gravity drained directly to the respective sumps. Sump pumps are started automatically when a predetermined high level in the sump is reached. The waste effluent is pumped to the LRS holdup tanks for processing and reuse.

June 2011 9.3-79 Revision 16

Table 9.3-8 June 2009 SUMP PUMP OPERATING CONDITIONS (Sheet 1 of 2)

Total Location Flow Differential Elevation Sump Pump (gal/min) Head Location Bldg (ft)

Reactor cavity 30 45 Containment 55 Auxiliary building ESF 50 110 Auxiliary 40 (train A)

PVNGS UPDATED FSAR Auxiliary building ESF 50 110 Auxiliary 40 (train B)

Auxiliary building non-ESF 50 110 Auxiliary 40 Radwaste building 50 65 Radwaste 88 Fuel building 100 65 Fuel 100 9.3-80 Control building (west) 50 65 Control 74 Control building (east) 50 65 Control 74 Diesel gen (west) 30 35 Diesel gen 94 Diesel gen (east) 30 35 Diesel gen 94 Turbine building 50 60 Turbine 100 PROCESS AUXILIARIES Condenser area (south) 100 70 Turbine 100 Condenser area (north) 100 70 Turbine 100 Spent regen waste 525 63 Outdoor 100 Decontamination facility 50 45 Decont facility 100 Revision 15 Oil/water separator Unit 1 200 70 Outdoor N/A Unit 2 200 60 Outdoor N/A Unit 3 200 50 Outdoor N/A

Table 9.3-8 June 2009 SUMP PUMP OPERATING CONDITIONS (Sheet 2 of 2)

Total Location Flow Differential Elevation Sump Pump (gal/min) Head Location Bldg (ft)

Fire pump house 30 25 Outdoor N/A Sanitary waste return 200 60 Outdoor N/A Retention tank 500 130 Outdoor N/A PVNGS UPDATED FSAR Containment radwaste 50 75 Containment 80 (east)

Containment radwaste 50 75 Containment 80 (east)

Yard 50 80 Maintenance 100 9.3-81 Holdup tank area 150 65 Outdoor N/A PROCESS AUXILIARIES Revision 15

Table 9.3-9 June 2003 DIMENSIONS AND CAPACITIES OF SUMPS (Sheet 1 of 2)

Maximum Quantity Dimensions (feet) Usable Materials per Capacity Sump Unit Length Width Depth (gal) Sump Liner Cover Containment radwaste, east 1 4 3 6-1/4 530 Concrete Stainless Stainless steel steel Containment radwaste, west 1 4 3 6-1/4 530 Concrete Stainless Stainless steel steel PVNGS UPDATED FSAR Reactor cavity 1 5 4 5 710 Concrete Stainless Stainless steel steel ESF Train A 1 6 6 7 1800 Concrete Stainless Stainless steel steel ESF Train B 1 6 6 7 1800 Concrete Stainless Stainless 9.3-82 steel steel Non-ESF 1 6 4 7 1200 Concrete Stainless Stainless steel steel Fuel building 1 6 6 12 3100 Concrete Stainless Stainless steel steel Radwaste building 1 5 5 7 1250 Concrete Stainless Stainless steel steel Decontamination facility 1 5 5 6 1250 Concrete Stainless Stainless steel steel PROCESS AUXILIARIES Holdup tank area 1 6-1/2 6-1/2 7-1/2 2300 Concrete Stainless Stainless steel steel Revision 12

Table 9.3-9 June 2011 DIMESIONS AND CAPACITIES OF SUMPS (Sheet 2 of 2)

Maximum Quantity Dimensions (feet) Usable Materials per Capacity Sump Unit Length Width Depth (gal) Sump Liner Cover Condenser area, south 1 6 6 10 2600 Concrete None Carbon steel Condenser area, north 1 6 6 10 2600 Concrete None Carbon steel PVNGS UPDATED FSAR Turbine building 1 6 6 10 2600 Concrete None Carbon steel 9.3-83 Oil/water separator 1 5.5 5.5 10 2100 Concrete None Carbon steel Control building, west 1 5 5 6 1070 Concrete None Carbon steel Control building, east 1 5 5 6 1070 Concrete None Carbon steel DG building, east 1 4 4 5 570 Concrete None Carbon steel DG building, east 1 4 4 5 570 Concrete None Carbon steel 5 Dia.

PROCESS AUXILIARIES Fire pump house 1(a) 9 1200 Concrete None Carbon steel Yard 1 5.5 5.5 12 2716 Concrete None Carbon steel Revision 16 Sanitary waste 1(a) 15 15 10 15,000 Concrete None Carbon steel Spent regenerant 1(a) 30 30 12 60,000 Concrete HDPE Carbon steel

a. Common to all three units

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.3.3.3 Radioactive Chemical Waste Subsystem The radioactive chemical waste subsystem is designed to gravity flow directly to the chemical drain tanks.

9.3.3.3.4 Cooling Water Waste Subsystem The chemically treated cooling water waste is gravity drained directly to the cooling water holdup tank. When the liquid contents of the tank reach a preset level, a high level switch will alarm in the control room. A sample is taken of the tank contents to determine if radioactivity is present. The system is normally aligned to transfer the contents of the tank to the chemical waste neutralizer tanks. The pumps are manually started and will be automatically stopped by a low-low level signal from the holdup tank. The pumps can also be manually stopped.

In addition to collecting leakage, the system operates, during maintenance of plant equipment containing chemical treated cooling water, to accept drainage from such equipment. The holdup tank is sized to hold the capacity from the equipment item having the largest volume of cooling water. Piping is provided to the surge tanks of the essential cooling water system - train A and train B, and the nuclear cooling water system, for use only during maintenance, to return cooling water drained from equipment to the appropriate cooling water loop.

9.3.3.3.5 Condensate Polishing Demineralizer Waste Subsystem Rinse washes from the condensate polishing demineralizers are automatically sent to the high or low TDS sumps as determined by conductivity. The rinse water can also be sent directly to the retention tank by manually lining up the condensate June 2009 9.3-84 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES polisher pre-service rinse overboard line. Low conductivity waste is routed to the low TDS sump and high conductivity waste is routed to the high TDS sump. Conductivity values to determine High and Low TDS are included in station operating procedures. Each sump is equipped with dual pumps and level instrumentation to actuate the lead pump upon high level. The level switch assembly will start (and stop) the pump alternately by a contact closure on rising level at a preset high level, and stop on opening of the same contact on decreasing level at a preset low level.

The low TDS waste is normally pumped to the circulating water return line.

In the event the low TDS waste becomes radioactive due to steam generator leakage, manually operated valves are provided to reroute the waste effluent to the low TDS LRS holdup tank or high TDS LRS holdup tank. Radioactivity in the secondary side is detected by monitoring the air condenser removal system or steam generator by use of online radiation monitors. When these monitors indicate a steam generator tube leakage, periodic samples of the low TDS sump are taken for analyses.

Should the activity level exceed a predetermined level, the low TDS sump is manually diverted to the liquid radwaste system.

The high TDS waste is pumped directly to one of the two chemical waste neutralizing tanks. The pH of the waste and the radioactivity in the tanks are determined by analysis of samples taken manually from a sampling point valve on each tank. The high TDS waste is neutralized on a batch basis, by injection of concentrated acid or caustic solution into each tank.

After neutralization the waste can be gravity drained from the waste tanks to the retention tank, or the neutralizer transfer pump can be manually started to pump the waste to the retention tank. The pump discharge can be manually valved to divert the June 2009 9.3-85 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES neutralized waste to the liquid radwaste system holdup tanks in the event the waste exceeds the release limits stated in the Offsite Dose Calculation Manual (ODCM).

The low-low level switch is interlocked with the pumps' suction crossover valve. When the crossover valve is closed, each pump shuts off automatically by its associated low-low level switch.

When the crossover valve is open, a low level in either tank will automatically stop both pumps. Both pumps can also be manually shut off.

9.3.3.3.6 Spent Regenerant Waste Subsystem Rinse washes from the makeup demineralizers are automatically sent to the spent regenerant sump. The sump is equipped with dual pumps and level instrumentation to actuate the lead pump upon high level. The level switch assembly will start (and stop) the pump alternately by a contact closure on rising level at a preset high level, and stop by opening the same contact on decreasing level at a preset low level.

The waste collected in the sump is treated in accordance with Water Reclamation Facility operating procedures and then pumped to the Water Reclamation Facility clarifier feed sump or the trickling filter sump emergency overflow. During Water Reclamation Facility (WRF) outages or emergencies, this wastewater can bypass the WRF clarifier feed sump or the trickling filter sump emergency overflow and be fed directly into the wet dry sump which feeds the 45 acre/or 85 acre reservoirs.

9.3.3.3.7 Yard Area Chemical Tank Drains Subsystem The yard area chemical tanks and pumps are located outside on concrete slabs and surrounded by concrete curbs that function June 2009 9.3-86 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES as secondary containments. Small sumps are provided inside the secondary containments to collect the equipment drainage. In the event of rain, equipment drainage, or chemical spills, the collected liquids will be removed from the secondary containment according to environmental requirements or procedures. The removal of the liquids may be through pumping or through an embedded drainpipe.

9.3.3.3.8 Oily Waste and Nonradioactive Waste System The oily waste and nonradioactive waste system collects in sumps, via equipment drains and floor drains, nonradioactive waste from the diesel generator building, turbine building, and the control building and pumps the waste to an oil/water separator. Each turbine building sump is provided with valving for diverting the flow to either the chemical waste neutralizer tank or to the LRS holdup tanks when required by the presence of chemicals or radioactivity in the waste. Waste is pumped to the LRS holdup tanks when activity levels are greater than the release limits in the Offsite Dose Calculation Manual (ODCM).

From the oily/water separator, after the oil is removed, the clarified effluent is pumped to the retention tanks. A divided retention tank is provided to act as a storage tank in the event the effluent is not within standards for pH, conductivity, and radioactivity prior to discharge to the evaporation pond. The standard for radioactivity is the release limit values in the Offsite Dose Calculation Manual (ODCM). The waste water in the first section is treated as required until its chemistry is acceptable for discharge to the evaporation pond. When the chemistry is acceptable, the waste water is pumped to the evaporation pond by manually starting the retention tank pump and aligning the discharge valves. A line is also provided for recirculating the waste from the pump June 2009 9.3-87 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES to the supply end of the retention tank if required for mixing during treatment.

9.3.3.3.9 Sanitary Sewage and Treatment System The liquid waste and entrained solids discharged by all plumbing fixtures located in areas not restricted due to potential radioactivity are conveyed by gravity to the onsite sewage treatment facility.

9.3.3.4 Safety Evaluations The safety evaluations pertinent to the equipment and floor drainage systems are as follows:

A. Safety Design Basis One Equipment and floor drainage provided for each ESF equipment compartment are not interconnected to any other equipment or floor drainage unless check valves are utilized to prevent cross-flow.

B. Safety Design Basis Two Each ESF equipment room drainage system is equipped with backflow check valves.

9.3.3.5 Radiological Considerations The radiological considerations for normal operation and accidents are discussed in sections 11.2, 11.3, and 12.3.

9.3.3.6 Tests and Inspections 9.3.3.6.1 Preoperational Testing All waste collection systems from areas of no radioactivity potential are tested for 15 minutes at a hydrostatic test June 2009 9.3-88 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES pressure equal to a 10-foot head of water. All collection systems from areas with a radioactivity potential are tested to 75 psig in accordance with ANSI B31.1.0, Power Piping, dated 1967.

9.3.3.6.2 Operational Testing Capability The operability of equipment and floor drainage systems dependent on gravity flow can be checked by normal usage.

Portions of these systems, dependent upon pumps to raise liquid waste to gravity drains, may be checked through instrumentation and alarms in the control room.

9.3.3.7 Instrumentation Application Seismic Category I level alarms are provided for those safety feature sumps in the auxiliary building that serve safety feature pump rooms as described in paragraph 7.6.1.1.3.3. High temperature alarms and high level indication, in addition to the level-operated switch used for pump control, are provided for all sumps in the containment and the auxiliary building to provide backup indication of the presence of large leaks and to provide information as to the source. Level alarm is provided for all other sumps as well. Level alarms are displayed and monitored in the control room.

9.3.4 CHEMICAL AND VOLUME CONTROL SYSTEM The following system description incorporates all of the critical licensing attributes of the Chemical and Volume Control System (CVCS) formally contained in CESSAR and CESSAR SER section 9.3.4. Since the following text now contains all of the current licensing commitments, the subject portions of June 2003 9.3-89 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES the CESSAR and CESSAR SER are superseded and are no longer considered part of the active licensing basis.

9.3.4.1 Design Bases 9.3.4.1.1 Functional Requirements The Chemical and Volume Control System (CVCS) is designed to perform the following functions:

A. Maintain the chemistry and purity of the reactor coolant during normal operation and during shutdowns; B. Maintain the required volume of water in the Reactor Coolant System (RCS) compensating for reactor coolant contraction or expansion resulting from changes in reactor coolant temperature and for other coolant losses or additions; C. Receive, store, separate, and process reactor grade, borated waste for reuse or discharge.

D. Control the boron concentration in the RCS to obtain optimum Control Element Assembly (CEA) positioning and compensate for reactivity changes associated with major changes in shutdown margin for maintenance and refueling operations; E. Provide auxiliary pressurizer spray for operator control of pressurizer pressure whenever main sprays were not available and to provide a means for pressurizer cooling; F. Provide a means for functionally testing the check valves that isolate the Safety Injection System (SIS) from the RCS; June 2003 9.3-90 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES G. Provide continuous measurement of reactor coolant fission product activity; H. Provide seal injection water at the proper temperature, pressure, and purity for the reactor coolant pumps' seals and collect the controlled bleed-off; I. Leak test the RCS; J. Supply demineralized reactor makeup water to various auxiliary equipment; K. Provide a means for sluicing ion exchanger resin to the Solid Radwaste System (SRS);

L. Provide a means for continuous removal of noble gases from the RCS; M. Provide a source of borated water for engineered safety feature pump operation; N. Provide makeup to the spent fuel pool; O. Provide purification of shutdown cooling flow; P. Provide makeup for losses from small leaks in RCS piping.

9.3.4.1.2 Design Criteria The CVCS is designed in accordance with the following criteria:

A. The CVCS is designed to accept letdown and provide makeup in response to changes in reactor coolant volume resulting from normal plant heatup and cooldown. Rates of temperature change are administratively controlled within the CVCS capacity to maintain pressurizer level within Technical Specification limits.

June 2007 9.3-91 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES B. The CVCS is designed to supply makeup water or accept letdown to support 10% step power increases between 15%

and 90% of full power, 10% step power decreases between 100% and 25% of full power, and ramp changes of +/-5% of full power per minute between 15 and 100% power.

C. The CVCS Volume Control Tank (VCT) is sized with sufficient capacity to accommodate the inventory change resulting from a 100% to 0% power decrease (reactor trip) with no makeup system operation, assuming that the VCT level is initially in the normal operating level band.

D. The CVCS provides a means for suitably controlling the concentration of radioactivity in the reactor coolant:

• The CVCS is operated as required to maintain the Technical Specification limits on RCS specific activity in order to ensure offsite dose consequences from postulated accidents are bounded by the analyses in Chapter 15. The operational limit for Dose Equivalent Iodine-131 corresponds to nominal ~0.2% failed fuel at steady-state, full power conditions.

• Nominal CVCS performance was credited in the calculation of expected RCS radionuclide concentrations used to evaluate the effectiveness of radwaste treatment systems and plant shielding design in Chapters 11 and 12, respectively. The analyses conservatively assume continuous full power operation with 1.0% failed fuel.

June 2003 9.3-92 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES E. The CVCS is operated to maintain reactor coolant chemistry within the limits specified in the EPRI PWR Primary Water Chemistry Guidelines, as endorsed by NEI 97-06, Steam Generator Program Guidelines.

F. Letdown and charging portions of the CVCS are designed to withstand the design transients defined in Table 3.9-1 without any adverse effects.

G. The CVCS has the capacity to accommodate all liquid wastes generated due to the operations identified in Section 9.3.4.4.10.

H. The CVCS is designed to provide 30 GPM of filtered flow to the reactor coolant pump seal cavities and to accept a 22 GPM controlled bleed-off flow.

I. Components of the CVCS are designed in accordance with the requirements for the safety class and seismic class specified in Table 3.2-1. The applicable design codes are identified in that table as well.

J. The environmental design conditions of the CVCS components are given in Section 3.11.

K. The CVCS is designed to operate with no boric acid concentration above the point where precipitation could occur. The boric acid batching tank and the boric acid concentrator concentrate discharge line to the SRS are the only portions of the system requiring heat tracing to preclude boric acid precipitation. These portions of the system can contain fluid concentrated to 12 weight percent boric acid. The remaining portions of the system contain a lower boric acid concentration solution June 2009 9.3-93 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES (less than 4400 ppm) so heat tracing to prevent precipitation is not required.

L. The CVCS is configured as shown in engineering drawings 01, 02, 03-M-CHP-001, -002, -003, -004 and -005.

M. As described in UFSAR 9.3.4.4.11, the charging subsystem has a capacity sufficient to replace the flow lost to the containment due to breaks in small RCS lines, such as instrument and sample lines.

N. The CVCS is designed to receive discharges from drains and relief valves in the RCS, SIS and SCS.

O. The CVCS provides for boron concentration adjustment in the Reactor Coolant System by feed and bleed. The maximum possible rate of boron dilution is limited, such that the operator has sufficient time to identify and terminate a boron dilution incident prior to reaching criticality during any refueling operations.

P. The CVCS provides an emergency boration capability for recovery of lost shutdown margin (SDM). As described in the basis of the Technical Specifications, the CVCS can nominally add 1% k/k of negative reactivity in less than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

Q. The CVCS boric acid reserve is sufficient to make the reactor subcritical in the cold condition with the most reactive CEA withdrawn.

R. The CVCS is designed so that the minimum volume of borated water available in the Refueling Water Tank (RWT) is sufficient to support Emergency Core Cooling System (ECCS) and Containment Spray System (CSS)

June 2003 9.3-94 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES operation as described in the Technical Specifications bases.

S. The CVCS has been designed with the appropriate vents, drains, connections and other provisions necessary to permit the performance of inservice testing and inspection of Safety Class components in accordance with ASME OM Code and Section XI programs described in Technical Specifications.

T. The CVCS design supports the plant capability for conducting a natural circulation cooldown in accordance with the requirements of Branch Technical Position (BTP)

RSB 5-1 for a Class 2 plant.

9.3.4.2 System Description The normal process flow paths through the CVCS may be traced on the Piping and Instrumentation Diagrams, 01, 02, 03-M-CHP-001,

-002, -003, -004 and -005.

9.3.4.2.1 Process Overview Letdown originates from the suction of reactor coolant pump 2B and passes through a letdown delay "coil," actually two parallel sections of large diameter pipe. The resulting reduction in flow velocity provides sufficient delay to ensure that N-16 gamma emissions have a negligible contribution to the external dose rate of letdown piping outside the containment.

Letdown then flows through two inboard, air-operated isolation valves in series before entering the tube side of the Regenerative Heat Exchanger. To enhance reliability, solenoids for the isolation valves receive control power from opposite trains of class 1E electrical service. The Regenerative Heat Exchanger provides the initial process temperature reduction June 2009 9.3-95 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES before letdown flow reaches the containment penetration.

Outside of containment, the fluid passes through an outboard, class-powered, air-operated isolation valve and goes to the letdown control valves.

There are two letdown control valves arranged in parallel, only one of which is normally in service during power operation. A warm-up bypass line around the control valves is provided for re-establishing letdown flow after its isolation and cooldown.

The in-service letdown control valve adjusts flow rate based on input from the Pressurizer Level Control System (PLCS) to help keep pressurizer level at setpoint. In addition, flow through the valve also reduces process pressure within the operating range of the letdown heat exchanger. By rejecting heat to the Nuclear Cooling water system, the letdown heat exchanger provides a final reduction of temperature to that suitable for purification subsystem operation. Downstream of the letdown heat exchanger are two letdown backpressure control valves arranged in parallel. Normally, only one backpressure control valve is in service. It controls intermediate or "back" pressure to ensure that the piping between the letdown and backpressure control valves is adequately subcooled.

The properly conditioned flow then passes through a mechanical filter, one of three parallel ion exchangers, and an effluent strainer to remove resin fines. After filtration, but prior to demineralization, a portion of the flow also goes through the Boronometer* (abandoned in-place) and by the Process Radiation Monitor. Flow valve CH-204 located in the main letdown line is automatically controlled to ensure that the minimum flow is provided to the process instruments. The processed letdown goes directly into the Volume Control Tank via the three-way valve CH-500. This valve is normally June 2007 9.3-96 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES aligned to the VCT but will automatically divert letdown to the Holdup Tank upon high-high VCT level. The VCT inlet valve may also be manually repositioned to support reactor feed and bleed for adjustment of reactor coolant reactivity, inventory, and chemistry. In addition to letdown, the VCT also receives the reactor grade controlled bleed-off flow from the reactor coolant pump seals. The seal vendor has calculated that the design controlled bleed-off flow rate (total seal outflow) for all four pumps combined is 12.0 gpm at steady state and 13.6 gpm under transient conditions.

The VCT is maintained with a nominal 15-25 psig hydrogen overpressure to promote dissolution of hydrogen in letdown for the purpose of oxygen scavenging in the reactor coolant. The letdown flow enters the VCT via a spray nozzle to enhance mixing of the process fluid with the gas overpressure. The pressure of hydrogen (or nitrogen during shutdown conditions) is controlled by adjustment of a supply pressure regulation valve side or a discharge isolation valve, which allows venting of excess gas to the Gaseous Radwaste System (GRS) surge header.

Diverted letdown normally passes through the Pre-Holdup Ion Exchanger (PHIX) and the Gas Stripper prior to its direction to the Holdup Tank (HUT). Under normal conditions, the PHIX inlet/bypass valve is positioned to bypass the PHIX. The PHIX is normally loaded with a mixed bed to remove ionic impurities, including radionuclides, prior to their concentration in the boric acid recovery subsystem. The resins are normally both lithiated and borated to prevent pH or reactivity changes in the coolant. Once the VCT inlet valve shifts to the divert position on high VCT level, letdown flow will be automatically directed through the PHIX. In addition, the PHIX may be manually aligned to process the contents of the Holdup Tank, June 2007 9.3-97 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Reactor Drain Tank, or Equipment Drain Tank, if necessary. The PHIX may also be bypassed if not required for chemistry control.

Flow through or around the PHIX may then pass through the Gas Stripper where hydrogen, gaseous fission products, and other non-condensable gases are removed with high efficiency.

Stripping may be used to preclude the buildup of explosive gas mixtures in the Holdup Tank, minimize the release of radioactive fission product gases, and also to limit the concentrations of dissolved gases in the reactor coolant during startup and shutdown. Normally, the degassed liquid is automatically pumped from the Gas Stripper to the Holdup Tank.

In the event that the Gas Stripper is not available, up to 20 minutes of full flow letdown may be directed into the Equipment Drain Tank. If gas stripping is not required, the Gas Stripper may be bypassed using a manual valve alignment.

When continuous degasification of the RCS is desired, the letdown flow is diverted from the VCT to the Gas Stripper and then returned to the VCT. Sufficient hydrogen absorption occurs via the Volume Control Tank hydrogen overpressure to replace the hydrogen removed during the gas stripping process.

The radioactive water processing subsystem also contains the Reactor Drain Tank (RDT) and Equipment Drain Tank (EDT).

Reactor coolant quality water from equipment and valve (pressurizer spray control and bypass valve) leakoffs, drains, and reliefs within the containment are collected in the RDT.

Recoverable reactor coolant quality water outside the containment from various equipment leakoffs, reliefs, and drains are collected in the EDT. The contents of the RDT and EDT are periodically pumped to the Holdup Tank using the Reactor Drain Pumps on a batch basis through the reactor drain June 2007 9.3-98 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES filter, pre-holdup ion exchanger, and gas stripper, if necessary. Diverted letdown flow has priority over processing of the RDT, EDT, or the HUT. Once diversion occurs, the Reactor Drain Pumps and Holdup Pumps (only if CH-686 is open) are automatically secured.

When a sufficient volume accumulates in the Holdup Tank, the contents are pumped by one of two holdup pumps to the Boric Acid Concentrator in the boron recovery subsystem. If abnormal quantities of radionuclides or chemical impurities are present, the Holdup Tank contents may be recirculated back through the pre-holdup ion exchanger for further cleanup. Concentrator bottoms are continuously monitored for proper boron concentration and are normally pumped directly to the Refueling Water Tank when the bottoms reach 4000-4400 ppm boron. In the event that chemical impurity or radionuclide concentrations are too high, the bottoms may be processed further in the Liquid Radwaste System (LRS). If additional processing is not economical, the bottoms are concentrated to 12 wt percent boric acid and discharged to the Solid Radwaste System (SRS) for disposal. The vapor from the boric acid concentrator is condensed and cooled into a distillate, which then passes through a boric acid condensate ion exchanger to remove boric acid carryover. The distillate is collected in the Reactor Makeup Water Tank for reuse in the plant. If recycle is not desired, concentrator vapor may be directed to the Plant Vent for discharge to the atmosphere, or the distillate may be diverted to the LRS.

The inventories stored in Refueling Water Tank (RWT) and Reactor Makeup Water Tank (RMWT) are reused as reactor coolant makeup. Boric acid solution in the RWT is supplied via the Boric Acid Makeup Pumps while the reactor makeup water in the RMWT is supplied via the Reactor Makeup Water Pumps. The June 2007 9.3-99 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES normal makeup control system has four operational modes.

Except for the automatic mode, the makeup water may be lined up to the VCT via CH-512 or directly to the charging pump suction via the VCT bypass valve CH-527. In the dilute mode, a preset quantity of reactor makeup water is introduced at a preset rate. In the borate mode, a preset quantity of boric acid is introduced at a preset rate. In the automatic mode, a preset blended boric acid solution from both tanks is automatically introduced into the Volume Control Tank upon demand from the VCT level controller. The preset solution concentration is adjusted periodically by the operator to match the existing boric acid concentration in the RCS so that makeup for lost RCS inventory produces no net reactivity effect on the reactor core. The manual mode is used as an alternate method for accomplishing all of the makeup functions. In the manual mode, the flow rates of the reactor makeup water and the boric acid can be preset to give a blended boric acid solution with a concentration between zero and that in the RWT (4000-4400 ppm).

Boron may be added to the RWT using the boric acid batching tank (BABT). Reactor makeup water is first added to the BABT via the Reactor Makeup Water Pumps. After the fluid has been heated by electric immersion heaters, boric acid powder is added to the heated fluid while the solution is agitated by a mechanical mixer. Concentrations as high as 12 weight percent can be prepared. Immersion heaters and heat tracing of both the batching lines and the piping downstream of the eductor maintain the temperature of the batched solutions high enough to preclude precipitation. The level and/or boron concentration of the RWT is increased by drawing boric acid solution from the BABT into the RWT return flow by directing either the Boric Acid Makeup Pump or Reactor Makeup Water Pump June 2003 9.3-100 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES discharge as motive flow through the boric acid batching eductor.

Of the three parallel charging pumps, two are normally in service taking suction from the Volume Control Tank and delivering that inventory to the RCS. With two pumps running, the design charging pump discharge rate or "total charging flow" is 88 gpm. With the pump controls in automatic, signals from the PLCS may automatically secure a running charging pump or start another (third) charging pump in order to maintain pressurizer level. Seal injection water is supplied to the Reactor Coolant Pump seal packages by diverting a portion of the total charging flow upstream of the outboard containment isolation valve.

The seal injection flow is filtered and monitored for proper temperature prior to distribution to the Reactor Coolant Pump seals. The nominal flow rate is 6.6 gpm per RCP with the typical flow varying between 6.0 and 7.5 gpm. The combined nominal flow through the four RCPs is 26.4 gmp, and the design flow is 30 gpm. A Chemical Addition Tank and Chemical Addition Metering Pump are used to transfer chemical additives to charging downstream of the seal injection diversion. A separate connection is provided for the injection of hydrogen gas directly into the charging line. Isolation of the charging line containment penetration is provided by a class-powered, motor-operated outboard valve and by an inboard check valve. The motor-operated outboard valve is normally open and de-energized to ensure the operability of charging following a transient.

The charging fluid (approximately 62 gpm) goes to the shell side of the regenerative heat exchanger to recover some heat from the letdown fluid before introduction into the RCS on the discharge side of Reactor Coolant Pump 2A. The nominal temperature of the heat exchanger charging side outlet is June 2007 9.3-101 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES 455°F. Some portion of the return flow may also be manually directed to the auxiliary pressurizer spray. The charging line contains a differential pressure (backpressure) control valve in series with an isolation valve and in parallel with a spring-loaded check valve. In case the differential pressure control loop fails, the isolation valve can be closed forcing charging flow through the spring-loaded check valve. The setpoints of the differential pressure controller and the spring-loaded check valve ensure that return backpressure is sufficient to maintain operability of auxiliary pressurizer spray and seal injection.

The majority of the CVCS was designed to contain borated water solutions of 3.6% by weight. The exceptions include the BAC bottoms and the boric acid batching equipment, which are designed for 12% boric acid solutions, and the dilute makeup portions, which are designed for demineralized water. The latter would include the RMWT, the RMW pumps, and associated piping. The components and piping associated with the BAC distillate pathway are designed to accommodate 10 ppm boron solutions.

All of the major CVCS components in Table 9.3.4-2 are fabricated from austenitic stainless steel except the shell (NC) side of the letdown heat exchanger which is made of carbon steel. With respect to pumps, this description only applies to the wetted surface.

9.3.4.2.2 Components The major components of the CVCS are described in this section.

Supplemental component design data are provided in Table 9.3.4-2. Component seismic and safety classification as well as applicable design codes are discussed in Section 3.2.

June 2003 9.3-102 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES The design transients used in the thermal fatigue analysis of Class 1 CVCS components are listed in Table 3.9.1-1, and design transients for Class 2 and 3 components are in Table 9.3.4-1.

A. Regenerative Heat Exchanger: The regenerative heat exchanger is a vertically mounted, shell and U-tube heat exchanger. The regenerative heat exchanger conserves RCS thermal energy by transferring heat from the letdown flow to the charging flow. Heating the charging flow serves to minimize thermal transients on the charging nozzle that penetrates the RCS cold leg. Reducing letdown temperature with both the regenerative and letdown heat exchangers allows proper operation of the purification ion exchangers and process instruments.

The regen heat exchanger is designed to maintain letdown outlet temperature below 450°F under all normal operating conditions.

B. Letdown Heat Exchanger: The letdown heat exchanger is a horizontally mounted, shell and tube heat exchanger that transfers heat from letdown to the nuclear cooling water (NC) system. Nominal NC flow is 582 gpm. With NC at its design flow of 1500 gpm and the outlet temperature of the regenerative heat exchanger at its maximum of 450°F, the letdown heat exchanger is sized to cool the letdown flow down to the maximum allowable operating temperature of the ion exchange resins (140°F).

C. Purification Filters: Each of the two purification filters is designed to remove insoluble particulates from the letdown flow. Each filter is designed to pass the maximum letdown flow without exceeding the allowable differential pressure across the filter elements in the June 2007 9.3-103 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES maximum fouled condition. Due to the high radiation dose rates possible from the buildup of activity levels during filter operation, each filter is designed for efficient remote removal of the disposable cartridges.

D. Purification Ion Exchangers: The two purification ion exchangers are essentially identical, and each is designed to pass the maximum letdown flow. The ion exchange vessel normally contains mixed bed resins to remove radioactivity and corrosion products. The necessary connections are provided to replace resins by sluicing. Under normal conditions, one ion exchanger is usually in service continuously to control activity and impurity levels in the reactor coolant while the other is used intermittently to reduce the lithium concentration. The retention screen size is in the range from 80-300 mesh.

E. Deborating Ion Exchanger: The deborating ion exchanger is identical to the purification ion exchangers in mechanical design; however, the deborating ion exchanger is normally loaded with anion resin. The deborating ion exchanger is used to reduce the reactor coolant boron concentration at the end of core life when the low prevailing boron concentrations may make feed-and-bleed dilution impractical. The retention screen size is in the range from 80-300 mesh.

F. Volume Control Tank: The Volume Control Tank is designed to accumulate letdown and RCP controlled bleed-off water from the RCS, to adjust hydrogen concentration in the reactor coolant, and to provide a reservoir of reactor coolant for the charging pumps.

The tank has sufficient capacity below the normal June 2003 9.3-104 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES operating level band to provide makeup for a swing from Hot Full Power (HFP) to Hot Zero Power (HZP) without automatic makeup operation. The minimum tank level also ensures that operation of all three charging pumps will not result in vortexing and gas entrainment into the charging pump suction. The normal operating level band is sized so that a normal makeup at a VCT pressure of 50 psig will not result in a lift of the associated safety relief valve. The volume above the minimum operating band is sufficient to receive the thermal expansion of the reactor coolant in a swing from HZP to HFP under nominal plant conditions without lifting the associated safety relief valve. The tank has hydrogen and nitrogen gas supplies and provisions that allow venting of hydrogen, nitrogen, gaseous fission products, and other non-condensable gases to the Gaseous Radwaste System (GRS).

G. Charging Pumps: The three charging pumps are positive displacement (triplex) pumps with both primary and secondary sets of packing. The primary packing is cooled primarily by process flow. In addition, each pump contains a cooling and lubricating system that recirculates reactor makeup water over the secondary packing and otherwise non-wetted portions of the primary packing. Each pump is provided with vent, drain, and flushing connections to minimize radiation levels during maintenance operations. The wetted surface is composed of austenitic stainless steel. The design flow of each pump is 44 gpm. After the effects of pump inefficiencies are considered, the nominal flow rate is about 42 gpm. Each charging pump possesses an June 2003 9.3-105 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES associated suction stabilizer and pulsation dampener in order to reduce the magnitude of pressure fluctuations and the resulting cyclic stresses common to reciprocating pump operation.

H. Boric Acid Batching Tank: The Boric Acid Batching Tank allows the operator to mix, store, and process concentrated boric acid solutions. The tank is insulated and has a reactor makeup water supply. The associated mechanical mixer, 45 kW electric immersion heaters, temperature controller, heat tracing, and sampling connections allow handling of boric acid solutions of up to 12 percent by weight without precipitation. The contents of the batching tank may be transferred to the Refueling Water Tank or the Spent Fuel Pool with an eductor using either the boric acid makeup pumps or the reactor makeup water pumps as the motive fluid.

I. Refueling Water Tank: The Refueling Water Tank is sized to allow total boric acid recycle, to support back-to-back cold shutdowns to five percent subcritical with the most reactive CEA withdrawn and subsequent startups at 90% core life, to fill the refueling pool and transfer canal, to provide sufficient volume for engineered safety features pump operation, and to provide sufficient volume above the high outlet nozzle to support a natural circulation cooldown per the requirements of Branch Technical Position RSB 5-1.

J. Holdup Tank: The holdup tank is sized to store all recoverable reactor coolant generated by back-to-back cold shutdowns to five percent subcritical with the most reactive CEA withdrawn and subsequent startups at June 2003 9.3-106 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES 90 percent core life. The minimum pump operating level is sufficient to provide adequate NPSH to either holdup pump.

K. Reactor Makeup Water Tank: The Reactor Makeup Water Tank capacity is based on providing dilution to allow total boric acid recycle. The low level alarm for the Reactor Makeup Water Tank warns the operator that the tank may not contain the volume needed as the backup supply to the essential auxiliary feedwater pumps (if the Condensate Storage Tank becomes inoperable).

L. Boric Acid Makeup Pumps: The two Boric Acid Makeup Pumps are single stage, centrifugal pumps with induction, squirrel-cage motors. The capacity of each boric acid makeup pump is greater than the combined capacity of two charging pumps. The pumps are arranged in parallel and interlocked so that only one pump operates at a time.

M. Reactor Makeup Water Pump: The two Reactor Makeup Water Pumps are single stage centrifugal pumps with induction, squirrel-cage motors. The capacity of each reactor makeup water pump is greater than the combined capacity of two charging pumps. The pumps are arranged in parallel and interlocked so that only one pump operates at a time.

N. Holdup Pumps: The two Holdup Pumps are single stage, centrifugal pumps with induction, squirrel-cage motors.The pumps are arranged in parallel and interlocked so that only one pump operates at a time.

O. Chemical Addition Package: The chemical addition package consists of a Chemical Addition Tank, Chemical June 2003 9.3-107 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES Addition Pump, and a strainer. The capacity of the Chemical Addition Tank is nominally sized so that the maximum anticipated amount of lithium (or hydrazine under cold conditions) could be added to the RCS in one batch. The Chemical Addition Pump is a positive displacement pump with a variable capacity.

P. Boric Acid Filter: The boric acid filter is designed to remove insoluble particulates from the normal borated makeup flow and may also be used for limited cleanup of the refueling water tank.

Q. Reactor Makeup Water Filter: The reactor makeup water filter is designed to remove insoluble particulates from the reactor makeup water supply to the resin sluice supply header, makeup header, and makeup system.

R. Reactor Drain Pumps: The two Reactor Drain Pumps are single stage, centrifugal pumps with induction, squirrel-cage motors. The pumps are arranged in parallel and interlocked so that only one pump operates at a time.

S. Reactor Drain Filter: The reactor drain filter is designed to remove insoluble particulates from the contents of the Reactor Drain Tank, Equipment Drain Tank, and Holdup Tank.

T. Reactor Drain Tank: This horizontal, cylindrical tank is designed to receive and quench the discharge from the pressurizer safety valves. The minimum tank level has sufficient inventory (and volume) to quench the relief expected during a loss of load event under nominal plant conditions without exceeding the rupture disc setpoint.

This quench volume is also sufficient to receive the June 2003 9.3-108 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES maximum expected thermal relief valve discharge from the Shutdown Cooling/Safety Injection System without blowing the tank rupture disc. The tank is intended to receive gravity drains and leakage of reactor grade quality water from components located within containment and to receive gravity drains from the RCS. To comply with the manufacturer's recommended limit on the frequency of reactor drain pump starts, the normal operating volume is sufficient to accommodate the maximum expected leakage from the RCS for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This means the operating volume leaves sufficient room to accumulate the normally expected leakage from all sources for several days. The tank volume above the operating band is sufficient to receive reactor coolant pump (RCP) seal controlled bleed-off (CBO) flow for approximately 30 minutes without blowing the rupture disc. This is sufficient time for operator action in the event that the normal CBO pathway to the VCT becomes isolated. The minimum tank level is also sufficient to prevent vortexing and provide adequate NPSH for the reactor drain pumps. The tank has a nitrogen blanket with a normal operating pressure of about 1 psig.

U. Equipment Drain Tank: This horizontal, cylindrical tank receives gravity drains from the Recycle Drain Header and the Ion Exchanger Drain Header. The normal operating band corresponds to the volume of resin sluice water produced during two sluice evolutions under nominal conditions. The tank also accepts discharge from miscellaneous relief valves via the Recycle Vent Header. The volume above the operating band is sufficient to accommodate either the discharge from the June 2003 9.3-109 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES V. largest safety relief valve for 10 minutes or gas stripper bypass flow for 30 minutes. The minimum tank level is also sufficient to prevent vortexing and provide adequate NPSH for the reactor drain pumps. The tank has a nitrogen blanket with a normal operating pressure of about 3 psig.

V. Preholdup Ion Exchanger: The preholdup ion exchanger is identical to the purification ion exchangers in mechanical design. The component is used as required to provide additional removal of radioactivity and impurities in letdown/diversion flow before return to the VCT or direction to the Holdup Tank. The ion exchanger may be used to process the contents of the RDT and EDT as they are transferred to the Holdup Tank.

Cleanup of the Holdup Tank or the Refueling Water Tank in a recirculation mode is also permissible. The vessel normally contains mixed bed resin that is both borated and lithiated. It is designed to pass the maximum letdown flow.

W. Gas Stripper: The Gas Stripper achieves efficient gas stripping by heating the process fluid and passing it down through a packed tower. The stripping medium is steam produced by heating a portion of the degassed process fluid with auxiliary steam. Transfer pumps included on the gas stripper package take suction on the degassed process fluid and send it to the heat recovery heat exchanger and aftercooler. Once cooled, the fluid is then directed to the Holdup Tank or to the VCT during continuous degassing of letdown flow. Non-condensable gases, along with trace quantities of fission gases and water vapor, are directed to the Gaseous Radwaste June 2003 9.3-110 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES System. The design decontamination factor (ratio of inlet to outlet gas concentration) is 1,000. When the unit operates at its design flow rate of 140 gpm, it requires about 13,500 lbm/hour of auxiliary steam at 50 psig and 500 gpm of nuclear cooling water flow.

X. Boric Acid Concentrator Package: The Boric Acid Concentrator concentrates the process flow boron concentration by means of evaporation. The process flow enters the concentrator and is recirculated through a steam heater. The vapor evolved from the heated recirculation flow is normally stripped of entrained liquid by demisters, condensed, demineralized, and pumped to the Reactor Makeup Water Tank. In order to facilitate water management or reduce primary tritium concentrations, the BAC vapor may also be directed to the Plant Vent for offsite release. The concentrate (bottoms) is cooled and pumped to the Refueling Water Tank. The design decontamination factor (ratio of boron concentration in the bottoms to that in the distillate) is 10,000. The maximum distillate effluent boron concentration is less than 10 ppm. When the unit operates at its design flow rate of 20 gpm, it requires about 13,500 lbm/hour of auxiliary steam and 700 gpm of nuclear cooling water flow.

Y. Boric Acid Condensate Ion Exchanger: The boric acid condensate ion exchanger normally contains anion resin to remove boron carryover and ionic impurities from the boric acid concentrator distillate. It is designed to pass the maximum expected flow from a single distillate pump.

June 2007 9.3-111 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Z. Seal Injection Filters: These two redundant filters are designed to remove insoluble particles from the seal injection flow to the reactor coolant pumps. Each unit is designed to pass the maximum anticipated flow without exceeding the allowable differential pressure across the element in the defined maximum fouled condition. The media size is sufficiently small to meet the warranty requirements of the RCP seal vendor.

aa. Seal injection Heat Exchanger: The seal injection heat exchanger is a vertical heat exchanger that was intended to use auxiliary steam to heat the seal injection flow.

Operational experience has shown that the heat exchanger is not necessary to maintain seal injection water temperature stable in the desired range. Therefore, the auxiliary steam supply to the heat exchanger and its return have been capped off.

9.3.4.2.3 Process Instrumentation and Control The notes in the following discussion are located at the end of this section. They refer to instruments and controls that are required for safe shutdown and/or are located at the Remote Shutdown Panel.

9.3.4.2.3.1 Temperature A. Holdup Tank Temperature: The temperature of the tank contents is indicated in the main control room, and an alarm annunciates in the main control room to warn the operator of low temperature conditions.

B. Reactor Makeup Water Tank Temperature: The temperature of the tank contents is indicated in the main control June 2003 9.3-112 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES room, and an alarm annunciates in the main control room on low temperature.

C. Refueling Water Tank Temperature: Two temperature channels are installed in the Refueling Water Tank. One provides temperature indication in the control room, and the other provides indication locally. Both instruments provide an alarm in the control room to warn the operator of low temperature conditions in the tank.

D. Boric Acid Batching Tank Temperature: The batching tank temperature measurement channel controls the tank heaters. Local indication is provided to facilitate batching operations.

E. Letdown Line Temperature: The regenerative heat exchanger letdown outlet temperature is indicated in the control room and at the Remote Shutdown Panel (note 2).

A high alarm is provided to alert the operator to degraded regen heat exchanger performance or abnormal charging/letdown temperatures or flows. The high regen heat exchanger letdown outlet temperature alarm has been specifically identified in UFSAR 15.6.2 as a potential indication of a letdown line break outside of containment. The instrument also provides a signal that automatically closes a letdown isolation valve at a setpoint above the high temperature alarm. The valve must be manually opened to restore letdown flow.

F. Letdown Heat Exchanger Outlet Temperature: This channel is used to control the Nuclear Cooling Water System (NC) flow through the letdown heat exchanger in order to maintain the proper letdown temperature for purification system operation. This temperature is indicated in the control room.

June 2003 9.3-113 Revision 12

PVNGS UPDATED FSAR PROCESS AUXILIARIES G. Ion Exchanger Inlet Temperature: This channel provides indication at the Remote Shutdown Panel (see note 2).

It alarms in the control room if the letdown exiting the Letdown Heat Exchanger is above normal. On a high process temperature, the channel protects temperature sensitive equipment by terminating letdown with automatic closure of the outboard containment isolation valve. When letdown flow is stopped, high temperature fluid may be trapped by the temperature sensor. Once proper letdown cooling has been re-established, the operator may override the temperature interlock at the isolation valve hand switch if restoration of letdown flow is needed to clear the high temperature condition.

The channel also initiates a signal to bypass letdown flow around the purification and deborating ion exchangers, the boronometer and the process radiation monitor. Letdown flow through these components must be manually restored when the temperature decreases below the setpoint. On a high-high temperature, another control room alarm is generated. If the letdown backpressure controller is in automatic, purification flow is terminated by closure of the backpressure control valves.

H. Volume Control Tank Temperature: The Volume Control Tank is provided with temperature indication in the control room. An alarm is provided to alert the operator to abnormally high water temperature conditions in the tank.

June 2007 9.3-114 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES I. Charging Line Temperature: The regenerative heat exchanger charging outlet temperature is indicated in the control room. This indication is used to evaluate heat exchanger performance and monitor the thermal condition of auxiliary spray.

J. Preholdup Ion Exchanger Inlet Temperature: This channel provides control room indication of the temperature of influent to the Pre-Holdup Ion Exchanger (PHIX). A high temperature alarm is provided in the control room, and, on high inlet temperature, the flow is diverted to bypass the ion exchanger to preclude degraded resin performance.

K. Reactor Drain Tank Temperature: The Reactor Drain Tank is provided with temperature indication in the control room. A high temperature alarm is provided to alert the operator to possible relief valve discharge into the tank and the need for cooling the tank contents.

L. Seal Injection Temperature: This channel is used to monitor thermal conditions at the seal injection heat exchanger outlet. Indication is provided in the control room. Both high and low alarms are also provided in the control room to identify abnormal process conditions.

High-high or low-low outlet temperature signals will automatically isolate the seal injection flow by closure of valve CH-231P if temperature falls beyond acceptable limits for the reactor coolant pump seals.

June 2007 9.3-115 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES M. Equipment Drain Tank Temperature: The Equipment Drain Tank is provided with temperature indication in the control room. A high temperature alarm is provided to alert the operator to possible relief valve discharge into the tank and the need for cooling the tank contents.

9.3.4.2.3.2 Pressure and Differential Pressure A. Letdown Backpressure Controller: This channel measures pressure between the letdown heat exchanger and the letdown backpressure control valves. The controller, located in the control room, adjusts the letdown backpressure control valve(s) to maintain proper intermediate pressure. Backpressure must be sufficiently high to ensure subcooled conditions throughout the intermediate letdown piping and sufficiently low to prevent unnecessary lifts of the associated pressure relief valve. This pressure is indicated in the control room, locally, and at the Remote Shutdown Panel (see note 2). Both high and low pressure alarms are provided in the control room. The low backpressure alarm may serve as the "low letdown pressure" alarm described in UFSAR 15.6.2 as a potential indication of a letdown line break outside of containment.

B. Purification Filter Differential Pressure: Pressure taps are provided to monitor the differential pressure across the purification filters. The differential pressure indicator has a local readout and a high differential pressure alarm in the control room.

June 2007 9.3-116 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Periodic readings of the instrument will indicate any progressive particulate loading of the filter.

C. Purification Ion Exchanger and Letdown Strainer Differential Pressures: Pressure taps and valves are provided to monitor the pressure loss across the purification ion exchangers (including the deborating ion exchanger) or across the purification ion exchangers and letdown strainer combination in series. The differential pressure channel provides a local indicator and a high differential pressure alarm in the control room. Periodic readings of the instrument will indicate any progressive loading of the components.

D. Boric Acid Makeup Pump Discharge Pressure: Discharge pressure of each pump is indicated in the control room and locally. Low pressure alarms provided in the control room may be indicative of a pump failure. In the event of a sustained low pressure condition, the affected pump is stopped automatically and the alternate pump is automatically started to prevent significant interruption of borated makeup flow.

E. Charging Line Pressure: This safety grade channel monitors the pressure immediately downstream of the charging pumps. Indication is provided in the control room and at the Remote Shutdown Panel (see note 1). The instrument at the Remote Shutdown Panel is used primarily to verify proper charging pump operation. A low pressure alarm is provided in the control room.

Such an alarm during normal operation may indicate charging pump failure, safety relief valve lift, valve misalignment, or charging line break.

June 2007 9.3-117 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES F. Reactor Coolant Pump Controlled Bleed-off (CBO) Header Pressure: Pressure is measured at the reactor coolant pump controlled bleed-off header in order to monitor the status of CBO flow. Indication and high/high-high alarms are provided in the control room. The high alarm indicates that a valve in the normal flowpath to the Volume Control Tank has been closed, and CBO flow has been redirected to the Reactor Drain Tank via CH-507 and the CH-199 relief valve. The high-high alarm indicates that controlled bleed-off flow has stopped entirely.

G. Charging Pump Suction Pressure Switches: A pressure switch on the inlet to each charging pump suction trips the associated charging pump on low suction line pressure thus preventing damage due to cavitation.

H. Letdown Line Pressure: The letdown line pressure between the backpressure control valves and the purification filter is indicated in the control room, and both high and low pressure alarms are provided. The low backpressure alarm may be used as the "low letdown pressure" alarm described in UFSAR 15.6.2 as a potential indication of a letdown line break outside of containment.

I. Ion Exchanger Drain Header Strainer Differential Pressure: A local differential pressure indicator is provided with a local alarm. Periodic reading of this instrument will indicate any progressive loading of the strainer due to resin fines and other particulates.

J. Equipment Drain Tank Pressure: Indication of EDT pressure and a high pressure alarm are both provided in the main control room. On high-high pressure conditions, the channel automatically isolates the June 2007 9.3-118 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES equipment drain tank. Isolation occurs through closure of valves in lines to or from the gas analyzer in the gaseous radwaste system, the recycle drain header, and the reactor drain pumps.

K. Reactor Drain Pump Discharge Pressure: The pump discharge pressures are indicated locally and in the control room.

L. Reactor Drain Filter Differential Pressure: Pressure taps are provided to permit measurement of differential pressure across the filter. Periodic readings of this instrument will indicate any progressive loading of particulates. The differential pressure is indicated locally, and a high differential pressure alarm is provided in the control room.

M. Preholdup Ion Exchanger and Strainer Differential Pressures: A differential pressure channel and valves are provided to measure the pressure loss across the PHIX or across the PHIX and its outlet strainer in series. Periodic review of these readings will indicate any progressive loading of particulates on the components. Differential pressure is indicated locally, and a high differential pressure alarm is provided in the control room.

N. Reactor Drain Tank Pressure: The RDT possesses separate narrow and wide range pressure channels. Both instrument transmitters feed a dual indicator in the control room that displays both values simultaneously.

The narrow range instrument monitors the nitrogen blanket pressure and provides a control room alarm on high pressure. The wide range instrument is needed to monitor the pressure response during safety or relief June 2007 9.3-119 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES valve discharges into the tank. On high-high pressure, the associated wide range switch will close the isolation valve on the vent to the GRS (CH-540) and the inboard containment isolation valve on the tank outlet (CH-560). The operator should then take action to control the situation causing safety or relief valve operation and restore the tank to normal operating conditions.

O. Holdup Pumps Discharge Pressure: The pump discharge pressures are indicated locally.

P. Boric Acid Condensate Ion Exchanger and Strainer Differential Pressure: Pressure taps and valves allow measurement of the pressure drop across either the ion exchanger itself or the ion exchanger in series with its outlet strainer. A local differential pressure indicator with a high alarm at a local panel is provided. Periodic reading of this instrument will indicate any progressive loading on the components.

Q. Seal Injection Filter Differential Pressure: Local differential pressure indication and high differential pressure annunciation in the control room are provided to monitor the pressure loss across the seal injection filters. Periodic readings of this instrument will indicate any progressive loading of the filters.

R. Reactor Makeup Water Pump Discharge Pressure: The reactor makeup water pump discharge pressure is indicated locally and in the control room. Low pressure alarms provided in the control room may be indicative of a pump failure. In the event of a sustained low pressure condition, the affected pump is stopped automatically, and the alternate pump is automatically June 2007 9.3-120 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES started to prevent significant interruption of dilute makeup flow.

S. Volume Control Tank Gas Pressure: This channel provides Volume Control Tank pressure indication in the control room. High and low pressure conditions are annunciated in the control room as well. The low pressure alarm protects against loss of charging pump suction. The high alarm setpoint is established below the setpoint of the safety relief valve on the tank gas supply and so helps protect against tank overpressurization. Either alarm alerts the operator to the need to restore nominal pressure conditions in the tank by adjusting the inflow and outflow rate of cover gas and/or process liquid.

T. Charging Backpressure Control Valve Differential Pressure: Differential pressure across the charging backpressure control valve CH-239 and isolation valve CH-240 in series is indicated in the control room. This channel maintains sufficient backpressure upstream of the valves to ensure reactor coolant pump seal injection flow is adequate and the auxiliary spray subsystem remains operable. The range of permissible backpressure is defined by the channel high and low alarms in the control room. The controller setpoint and the high alarm are less than the differential pressure needed to open the spring-loaded check valve CH-435.

U. Boric Acid Filter Differential Pressure: The channel contains a local differential pressure indicator to monitor the buildup of particulate matter on the boric acid filter. A high differential pressure alarm in the control room indicates the need for filter replacement.

June 2007 9.3-121 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES V. Reactor Makeup Water Filter Differential Pressure: The channel contains a local differential pressure indicator to monitor the buildup of particulate matter on the reactor makeup water filter. A high differential pressure alarm in the control room indicates the need for filter replacement.

9.3.4.2.3.3 Level A. Holdup Tank Level: Level indication and alarms for this tank are provided in the control room. On low-low level in the Holdup Tank, the holdup pumps are automatically stopped. The high level alarm indicates that processing should be commenced, and the high-high level alarm indicates that filling of the tank should be secured.

B. Reactor Makeup Water Tank Level: Level indication and alarms for this tank are provided in the control room.

The low level alarm for the Reactor Makeup Water Tank warns the operator that the tank may not contain the volume needed as the backup supply to the essential auxiliary feedwater pumps (if the Condensate Storage Tank becomes inoperable). On low-low level in the tank, the reactor makeup water pumps are automatically stopped. The high level alarm in the Reactor Makeup Water Tank indicates that filling of the tank should be secured.

C. Volume Control Tank (VCT) Level: The VCT level is measured by two instrument channels utilizing the same high and low instrument taps. Although both are differential pressure type instruments, one has a dry reference leg and the other has a wet reference leg for enhanced reliability. A control room alarm is provided June 2007 9.3-122 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES to alert the operators when the two channels differ by a significant amount.

• The dry reference leg instrument (CH-226) provides VCT level indication and associated alarms in the control room. This channel controls the starting and stopping of the automatic makeup system to maintain VCT level in its normal operating band.

The high level alarm set above the level at which letdown diversion should have occurred. The low level alarm is established below the level at which automatic makeup should have occurred. An alarm is also provided whenever a VCT makeup demand signal is present.

• The wet reference leg instrument (CH-227) provides indication locally and at the Remote Shutdown Panel (see note 2). Associated switches actuate CVCS components to keep VCT level within design limits.

On high level, the channel automatically diverts letdown flow to the Holdup Tank. In addition, diversion will automatically send a stop signal to the reactor drain pumps and to the holdup pumps if CH-686 is open (that is, holdup pump discharge is aligned to the reactor drain filter). On a low-low level, CH-227 transfers charging pump suction from the VCT to the Refueling Water Tank by opening valve CH-514, closing VCT outlet valve CH-501, starting a boric acid makeup pump, and closing recirculation valve CH-510. If the low-low level occurs while CH-514 has no power, then CH-536 will open automatically to allow RWT inventory to gravity feed to the suction of the charging pumps.

June 2007 9.3-123 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES D. Equipment Drain Tank Level: A differential pressure type instrument indicates EDT level and activates high and low-low level alarms in the control room. A low-low EDT level automatically stops the reactor drain pumps if the EDT outlet valve CH-563 is open.

E. Reactor Drain Tank Level: A differential pressure type instrument provides RDT level indication as well as high and low-low level alarms in the control room. A low-low RDT level will automatically stop the reactor drain pumps if both RDT outlet containment isolation valves, CH-560 and CH-561, are open.

F. Refueling Water Tank Level:

• Two high level band instruments are provided to monitor level above the high suction nozzle with indication in the control room. In addition, these two independent channels provide safety grade indication of borated water supply status at the Remote Shutdown Panel (see note 1). Both channels provide high and low level annunciation in the control room. The low level alarm warns the operator of entering the volume required for engineered safety features pump operation. A low-low level alarm secures the boric acid makeup pumps.

• There are four independent, safety grade level indicators provided on the Refueling Water Tank with readout in the main control room. On a low Refueling Water Tank level, these level channels initiate the recirculation actuation circuitry as described in UFSAR sections 7.3 and 6.3.3. Any two June 2007 9.3-124 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES of four independent signals are required to initiate the signal thereby precluding spurious actions resulting from failure of one measurement channel. This arrangement results in a high degree of protective measurement channel reliability in terms of initiating safeguards action when required while avoiding unnecessary action.

9.3.4.2.3.4 Flow A. Letdown Flow: An orifice-type flow meter indicates letdown flow locally, at the Remote Shutdown Panel (note 2), and in the control room. This channel actuates a high flow alarm in the control room. High flow conditions may result from improper letdown flow or backpressure control or from a line break downstream of the instrument.

B. Process Radiation Monitor Flow: A rotameter located downstream of the boronometer* (abandoned in-place) is used to control the flow rate through the unit by adjustment of flow control valve CH-204. Indication is provided locally and in the control room. High and low alarm annunciation is provided in the control room as well. The process instrument low flow alarm is described in UFSAR 15.6.2 as a potential indication of a letdown line break outside of containment.

C. Reactor Makeup Water Flow Switch: A flow switch located downstream of the makeup flow element FE-210X alarms in the control room if dilute makeup water flow occurs during refueling operations when dilute makeup should be secured. During normal operations, the flow switch is disabled.

June 2007 9.3-125 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES D. Boric Acid Flow: A coriolis type sensor is provided to measure the flow rate of borated water to the blending tee.

This associated control channel positions the borated makeup water flow control valve CH-FV-210Y to obtain a flow rate preset by the operator. When the flow controller is in automatic, excessive deviation of borate flow rate from setpoint (Hi-Lo) produces a control room alarm to indicate improper control loop operation. When the makeup mode selector switch is in the AUTO mode, additional protection against unplanned changes in the reactor coolant boric acid concentration is provided by a trip signal on flow deviation from setpoint (Hi-Hi/Lo-Lo) which terminates both borate and dilute flow. To prevent unnecessary alarms and trips from expected setpoint deviations during initiation of flow, these signals are delayed to permit control action to establish the flow rate at setpoint. Since the maximum expected borate flow is less than the design flow of the boric acid filter, the high-high flow alarm and trip functions described in the CESSAR have been removed. A flow rate recorder and a borated water flow totalizer are provided in the main control room.

E. Reactor Makeup Water Flow: A coriolis type sensor is provided to measure the flow rate of dilute makeup water to the blending tee. The associated control channel positions the dilute makeup water flow control valve CH-FV-210X to obtain a flow rate preset by the operator.

When the flow controller is in automatic excessive deviation of dilute flow rate from setpoint(Hi-Lo)produces a control room alarm to indicate improper control loop operation. When the makeup mode selector switch is in the AUTO mode, additional protection June 2007 9.3-126 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES against unplanned changes in the reactor coolant boric acid concentration is provided by a trip signal on flow deviation from setpoint (Hi-Hi/Lo-Lo) which terminates both borate and dilute flow. To prevent unnecessary alarms and trips from expected setpoint deviations during initiation of flow, these signals are delayed to permit control action to establish the flow rate at setpoint. Since the maximum expected dilute flow is less than the design flow of the reactor makeup water filter, the high-high flow alarm and trip functions described in the CESSAR have been removed. A flow rate recorder and a dilute water flow totalizer are provided in the main control room.

F. Charging Flow: A safety grade orifice-type flow meter is installed in the charging line just downstream of the pumps. Indication of combined charging pump discharge (total charging) flow rate is provided in the control room and at the Remote Shutdown Panel (see note 1). At the Remote Shutdown Panel, the instrument is used primarily to verify proper charging pump operation. The setpoint for the low alarm provided in the control room is set below the nominal flow rate of a single charging pump in order to identify degraded pump operation.

G. Ion Exchanger Drain Header Flow Switch: A flow switch is provided with a flow present/non-present indicating light on a local panel. The indicator light is on whenever draining is in progress and goes off when an ion exchanger draining operation is complete. When refilling an ion exchanger after charging new resin, the light indicates overflow from the vent line drain and therefore completion of the filling evolution.

June 2007 9.3-127 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES H. Seal Injection Flow Rate: Orifice-type flow meters provide control room indication of seal injection supply flows to each reactor coolant pump. This channel controls the seal injection flow at a setpoint established by the operator in accordance with the recommendations of the pump seal vendor. Alarms for high, high-high, and low flow are provided in the control room to indicate abnormal seal flow conditions.

I. Boric Acid Batching Flow: This instrument indicates locally the flow of concentrated boric acid from the boric acid batching tank to the boric acid batching eductor. This instrument is used in combination with measurement of the motive fluid flow rate through the eductor from either FE-210X or Y to ensure the solution exiting the eductor is at the desired concentration.

J. Letdown Heat Exchanger Nuclear Cooling System Flow Switch: This instrument has been removed and its alarm and interlock functions have been moved to the Purification Ion Exchanger Inlet temperature channel described in Section 9.3.4.2.3.1.G.

K. Reactor Makeup Water Supply Header: This instrument provides local indication of reactor makeup water flow to the recycle drain header, equipment drain tank, and the reactor drain tank.

June 2007 9.3-128 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.4.2.3.5 Boronometer (abandoned in-place)

A slip stream off the letdown flowpath flows through the abandoned boronometer. A throttling valve, CH-204, located in the letdown line in parallel with the boronometer, is automatically controlled to ensure the proper slip stream flow rate through the instrument. A three-way valve located upstream of the boronometer bypasses flow around the instrument on high letdown heat exchanger outlet temperature.

The unit is provided with shielding as required to limit the maximum external radiation level from its neutron source to a low value. All wetted surfaces that contact reactor coolant are constructed of austenitic stainless steel for enhanced corrosion resistance. The unit's rated pressure and temperature of 200 psig and 200°F, respectively, are consistent with the design values of the letdown line.

9.3.4.2.3.6 Radiation Monitoring 9.3.4.2.3.6.1 Process Radiation Monitor. The Process Radiation Monitor provides a continuous reading in the control room of reactor coolant gross gamma radiation as a measure of fuel cladding integrity. The channel detector is an ion chamber mounted adjacent to the letdown piping, specifically the slip stream around CH-204. Since letdown piping external dose rate is roughly proportional to fuel defect, increasing trends in dose rate can be used as an indication of fuel element cladding failure. Verification of the Process Radiation Monitor reading is done by grab sample measurements.

Since the detector is located downstream of the Letdown Delay Coil, its response is not significantly affected by N-16 gamma radiation. Its process location upstream of the purification ion exchangers enhances sensitivity. However, it is positioned June 2007 9.3-129 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES downstream of the purification filters to reduce monitor response due to insoluble corrosion activation products, whose concentrations are not a function of fuel defect. The monitor is ranged to detect the radiation levels expected for 0.1% to 1% failed fuel.

The characteristic time of the detector is on the order of seconds; therefore, the overall response time of the monitor is limited by the sample transport time from the core. Since the transit time of the coolant from the reactor core to the detector is less than 6 minutes, the monitor can provide relatively rapid indications of degraded fuel cladding conditions.

The monitor is part of the Radiation Monitoring System (RMS) described in section UFSAR 11.5. All of the RMS capability for data acquisition, data storage, display, and trending are available. The monitor alert alarm setpoint is discretionary and is established high enough to prevent spurious actuation and low enough to identify significant changes in reactor coolant activity levels. The high alarm setpoint corresponds to a failed fuel fraction of 1% at steady state with the UFSAR Section 11.1 radionuclide distribution.

NOTE 1: These subject safety related instruments are identified in UFSAR 7.4.1.1.10, Emergency Shutdown Outside the Control Room, and are required to be operable per Technical Specifications.

NOTE 2: The subject instruments, although also identified in UFSAR 7.4.1.1.10, are non-safety related components located in a non-safety grade process instrument panel adjacent to Train A/C of the class Remote Shutdown Panel. These instruments are supplementary devices used to enhance June 2007 9.3-130 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES pressurizer level control during shutdowns where letdown remains in service. Letdown and the associated process instruments described above are neither required nor credited for either safe shutdown or remote shutdown outside the control room.

9.3.4.3 System Operation The Chemical and Volume Control System is designed to be operated as follows:

9.3.4.3.1 Reactor Coolant Inventories During normal power operations, the volume of water in the RCS is regulated automatically by the Pressurizer Level Control System (PLCS). To minimize the transfer of fluid between the RCS and CVCS during power changes, the pressurizer level setpoint or target RCS volume is programmed to vary as a function of the average RCS temperature. The relationshipbetween the pressurizer level setpoint and Tavg is shown in Figure 5.4-2. The PLCS master controller generates a level error signal by comparing the programmed setpoint with the measured pressurizer water level. Based on the level error signal, the controller regulates the inservice letdown control valve(s) as needed to keep pressurizer level on program. Large changes in pressurizer level due to power changes or abnormal operations will also result in PLCS operation of the normally running and/or standby charging pumps if needed to supplement letdown control valve action. Under steady state conditions, letdown flow rate will be the difference between the total charging flow rate and the controlled bleed-off flow.

The Volume Control Tank is provided to accommodate small and/or temporary mismatches between letdown and charging flow. The June 2007 9.3-131 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES level in the Volume Control Tank is normally controlled by the makeup system in the automatic mode of operation. When the control band high level is reached, letdown flow is diverted to the holdup tanks via the preholdup ion exchanger and gas stripper. In the automatic mode, makeup flow of a preset blend of boric acid from the RWT and demineralized water from the Reactor Makeup Water Tank (RMWT) is initiated by the Volume Control Tank low level signal. A low-low level signal automatically closes the outlet valve on the Volume Control Tank (CH-501), opens the boric acid feed valve (CH-514), and starts the boric acid makeup pumps. This alignment of an alternate borated water supply prevents charging pump trip due to loss of net positive suction head or gas-binding.

The CVCS is also used to handle thermally induced volume changes of the reactor coolant during normal plant heatups and cooldowns. As coolant volume expands during plant heatup, letdown flow is increased to keep pressurizer level on program, and the surplus inventory is diverted to the Holdup Tank.

Letdown may also be sent to the Equipment Drain Tank for small temperature changes. In a cooldown, the makeup system supplies the additional inventory needed to compensate for thermal contraction of the coolant and maintain pressurizer level. The makeup system can also replace reactor coolant inventory lost due to allowable system leakage. The overall RWT, RWMT, and HUT capacities are sufficient to support back-to-back shutdowns as noted in the individual tank descriptions in section 9.3.4.2.2. The CVCS design supports nominal heatup and cooldown rates. Regardless of system capacity, the operator limits the rate of temperature change in order to maintain pressurizer operability as required in the Technical June 2007 9.3-132 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Specifications. Rates are also adjusted as required to comply with Technical Specification pressure/temperature limits.

9.3.4.3.2 Reactivity Control The boron concentration of the reactor coolant is normally controlled using the feed and bleed method. To change RCS boron concentration, the makeup system supplies either dilute water from the Reactor Makeup Water Tank, boric acid solution from the Refueling Water Tank, or a blend of both. The makeup water goes to the Volume Control Tank or directly to the charging pump suction. Toward the end of a fuel cycle, with low boric acid concentration in the coolant, feed and bleed becomes inefficient, and the deborating ion exchanger is used to reduce the RCS boron concentration. The deborating ion exchanger contains an anion resin in the hydroxyl form initially and converts to a borate form as boron is removed from the reactor coolant.

9.3.4.3.3 Primary System Chemistry Control The reactor coolant system chemistry is controlled to reduce corrosion that may result in subsequent system leakage/failure, degradation of heat transfer surfaces, or increase in radionuclide specific activity concentration. Operational limits for reactor coolant impurities are established in accordance with the Technical Requirements Manual and the EPRI PWR Primary Water Chemistry Guidelines as endorsed by NEI 97-06, Steam Generator Program Guidelines. The EPRI guidelines and their bases represent the industry best practice, as developed from evaluation of the most recent experimental data and plant operating experience. Exceptions from that guidance required as June 2007 9.3-133 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES a result of site specific circumstances are fully evaluated and documented prior to implementation.

The rate of both general and localized corrosion in carbon steel, 300 series stainless steel, and alloys used in the reactor coolant system increases with the concentration of dissolved oxygen in the coolant. In addition, if chlorides and fluorides are present concurrently, then localized stress corrosion cracking is possible. Dissolved oxygen is expected in the reactor coolant following refueling when the system is open and exposed to atmosphere. Once the system is closed, filled, and vented, then oxygen may be introduced into the system through makeup water (both the RMWT and RWT are exposed to atmosphere) and possibly by air intrusion via in-leakage through the charging pump suction, which may operate at sub-atmospheric conditions. During power operations, oxygen is also produced from the decomposition of water due to exposure of neutron and high-energy gamma flux in the core. During plant heatup and at power, the dissolved oxygen concentration is limited by maintaining a hydrogen overpressure on the Volume Control Tank. The partial pressure of the hydrogen overpressure creates an excess of dissolved hydrogen gas in the coolant that favors the recombination of dissolved hydrogen and oxygen into water. Although not normally required, dissolved oxygen may be reduced by operation of the gas stripper during plant heatup if needed.

The pH of the reactor coolant is kept in the neutral and slightly basic region at system temperature in order to enhance passivation of system metals and to minimize the deposition of crud on core heat transfer surfaces. Operating experience has shown that the corrosion rates of Ni-Cr-Fe Alloy-600 and 300 series stainless steels decrease with time when exposed to June 2007 9.3-134 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES normal reactor coolant chemistry conditions due to the development of passive oxide film on reactor coolant system surfaces. Most of the film is established within 7 days at hot, high pH conditions and approaches low steady state values within approximately 200 days. Elevated pH conditions within the reactor coolant at operating temperature have the added benefit of reducing corrosion product solubility. This both decreases the dissolved crud inventory circulating in the reactor coolant and promotes selective deposition of corrosion products on cooler surfaces of the steam generator, rather than on hotter surfaces in the core. Higher pH environments also form a more stable and tenacious passive oxide layer on out-of-core system surfaces.

At low temperature, high pH conditions may be maintained through the addition of hydrazine (and ammonia formed through its decomposition) which also acts as an oxygen scavenger.

Thereafter, pH is adjusted by controlling RCS lithium concentration to values consistent with the concentration of boric acid maintained for reactivity control. For a given boron concentration, the coordinated boron-lithium program described in the EPRI guidelines prescribes an allowable range for lithium concentration, nominally 1-3 ppm. The lower limit on lithium concentration ensures that sufficient lithium hydroxide is present during operation to achieve the target pH while the upper limit provides a wide margin to the threshold for the accelerated attack of zircalloy. Although zircalloy attack does not occur until lithium concentration approaches approximately 35 ppm lithium, a large margin is appropriate in the event that any concentrating phenomena exist in the system.

During plant heatup and low power operation, lithium in the form of lithium hydroxide (LiOH) is added to the coolant to June 2007 9.3-135 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES increase pH. The LiOH is enriched in the lithium-7 isotope to minimize tritium production via the Li-6(n,)H-3 reaction.

During power operation, lithium is normally produced by the activation and decay of Boron-10 through the B-10(n,2)H-3 mechanism. As a result, periodic removal of lithium by ion exchange is required to keep lithium below the upper limit.

Late in core life, when large dilutions are necessary to maintain coolant temperature on program, lithium additions may again be necessary to keep lithium within the control band.

Lithium is not controlled during refueling operations, and no minimum concentration applies in that mode.

Particulates and other insoluble contaminants have the potential to increase reactor coolant specific activity by activation and to foul heat transfer surfaces. They are removed in part by the in-service purification filter located in the letdown line. In addition, the resin bed of the in-service ion exchanger provides some mechanical filtration of the process as well.

The presence of ionic impurities is associated with a variety of localized corrosion mechanisms. Of particular concern are halide induced stress corrosion cracking of sensitized austenitic stainless steels and Primary Water Stress Corrosion Cracking (PWSCC). The letdown line contains three ion exchange beds, and only one is usually in service at a time. The principal strategy for operation of the ion exchangers may be described as follows. Removal of ionic impurities is accomplished by the (essentially) continuous operation of a mixed bed whose cation resin is lithium saturated and whose anion resin is borated in order to prevent changes in either pH or reactivity. A second purification ion exchanger, a mixed bed whose cation/anion resins are in the hydroxide/borate form, June 2007 9.3-136 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES is operated intermittently to reduce lithium concentration.

The third ion exchanger is used to reduce the reactor coolant system boron concentration. This deborating bed is only used at the end of the core cycle when the quantities of waste water produced to adjust boron concentration through feed and bleed operations become excessive. The vessel contains an anion resin initially in the hydroxyl form that is converted to a borate form as boron is removed. While deviations from this strategy are not common, the design of both purification filters and ion exchangers provides a great deal of flexibility with respect to resin selection, process flowpath, and service times. Operations and Chemistry will operate the described purification equipment as needed to economically meet the requirements for reactor coolant water quality, water management, radwaste treatment, in-plant radiation exposure, and radioactive effluent release.

The reactor coolant also contains radioactive contaminants produced from fission, activation, and decay. The coolant specific activity may be limited by feed and bleed evolutions, radioactive decay, and operation of the purification filters and ion exchangers. The types and quantities of radioactive materials expected in the coolant and connecting systems are described in UFSAR Section 11.1.

9.3.4.3.4 Shutdown Purification When the unit is on shutdown cooling, portions of the CVCS may be aligned as required to control reactor coolant chemistry and specific activity. In the process known as shutdown purification, a fraction of the Shutdown Cooling Heat Exchanger outlet flow or its bypass is directed to the CVCS by opening cross-connect valve CH-363 and either SIB-420 and/or SIA-421.

June 2007 9.3-137 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES To simplify reactor coolant inventory control, normal letdown is secured by closure of one or more of the letdown containment isolation valves while shutdown purification is in service.

The diverted shutdown cooling flow enters the letdown line upstream of the letdown heat exchanger, which is used as needed to reduce temperature to levels suitable for proper operation of the process instruments and the purification ion exchangers.

The fluid is mechanically filtered and ion exchanged to reduce impurity and radioactivity levels per station chemistry control requirements. The processed fluid is returned to the suction of the in-service shutdown cooling pump(s) via CH-397 and either SIB-418 and/or SIA-419.

The differential pressure created by the shutdown cooling pump(s) provides the motive force needed to circulate coolant through the CVCS purification equipment. Coarse flow adjustment may be accomplished through positioning of manual valves in the purification flowpath or through repositioning of the cold leg injection valves provided that minimum required shutdown core cooling flow is maintained. The CVCS backpressure control valves permit fine control of purification flow from the control room. The normal letdown flow rate instrument is configured so that it also measures shutdown purification flow if in service. The purification flow may also be monitored continuously for radioactivity using the normal letdown process instruments.

With shutdown cooling in service, the shutdown purification flowpath may be modified to permit resumption of reactor coolant pump seal injection if desired. In the modified flow path, the purification flow exiting the ion exchangers is lined up to the VCT, instead of the SDC pump suction. One or more charging pumps is then used to supply seal injection flow and June 2009 9.3-138 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES RCS makeup. This configuration may also be used to control reactor coolant inventory and boron concentration by coordinated use of the backpressure control valves, the letdown diversion valve, and the normal makeup subsystem.

While shutdown cooling is in service, the total dissolved gas in the coolant is controlled to prevent gas binding and degraded performance of the shutdown cooling pumps. Total gas concentration is limited by proper filling and venting of the system and the use of chemical additives if necessary. With the system in the modified shutdown purification lineup, the gas stripper may also be employed to reduce dissolved and otherwise entrained gases in solution.

When the reactor coolant system is in a drained condition (pressurizer level less than 10%), portions of the CVCS may be used to adjust level/inventory. Of the various methods for raising RCS level, the following utilize CVCS components:

(1) the normal charging lineup, (2) the alternate charging discharge pathway through the hot leg injection path, (3) BAMP discharge through a SDC suction line, and (4) gravity drain of the RWT through a SDC suction line. RCS level can be lowered by diversions of shutdown purification flow to either the Holdup Tank (HUT) or Refueling Water Tank (RWT) via CH-500.

When inventory is added during either drained operations or system fill evolutions, the boron concentration and temperature of the makeup water are checked to ensure that shutdown margin and pressure/temperature limits are maintained.

9.3.4.3.5 Plant Startup Plant startup is the series of operations that bring the plant from a cold shutdown condition to a hot standby condition at June 2007 9.3-139 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES normal operating pressure and zero power temperature with the reactor critical at a low power level.

Typically, shutdown purification or modified shutdown purification is used to control pressurizer level once recovered from drained conditions. Normal letdown may be placed in service as needed to support reactor coolant system fill and vent, including drawing a steam bubble in the pressurizer, reactor coolant pump sweeps, and subsequent depressurizations to enhance evolution of gas out of solution.

The objective of the fill and vent process is to establish a "loops filled" condition where sufficient inventory is available in the hot and cold legs to support heat transfer from the core to the steam generators via natural circulation.

To help achieve this condition, the total gas concentration in the coolant may be controlled below that which may result in degraded natural circulation flow even if the system were depressurized to atmospheric conditions. Additional reduction of dissolved or entrained gas may be accomplished by further venting or by operation of the gas stripper. If the RCS is intact and the dissolved gas concentration is too high, then other administrative controls are required to establish the "loops filled" condition. This may include procedural restraints against lowering pressurizer pressure below that needed to support natural circulation or by maintaining a functional HPSI pump available to pressurize the system if forced circulation were lost.

The Volume Control Tank is initially purged with nitrogen.

Under most circumstances, this sweep gas contains very low concentrations of radioactivity. Therefore, the gas is normally directed to the plant vent for release offsite under the normal effluent control procedures. If necessary, high June 2007 9.3-140 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES activity sweep gas can be sent to the GRS for holdup and decay before release. Once the VCT is swept, the nitrogen sweep gas is replaced with a hydrogen overpressure to control dissolved oxygen in the coolant.

During the initial stages of heatup, both letdown control valves are in service. When pressurizer pressure reaches 1200 psia, the safety relief valve downstream of the letdown control valves may not have sufficient capacity to relieve the flow through two letdown control valves. Therefore, one letdown control valve is closed by the operator when the RCS pressure exceeds 1200 psi.

Pressurizer water level can be controlled by manually adjusting the output of the pressurizer level master controller or by using the controller in local automatic mode. When using the latter, the operator must adjust the control setpoint to compensate for the fact that the pressurizer level instruments are calibrated for normal operating temperature and pressure.

The heatup results in thermal expansion of the reactor coolant.

Since the operators maintain pressurizer level in its normal operating band, the expansion volume and dilution water result in an increase in Volume Control Tank level. To accommodate the additional inventory, the operators may divert letdown manually; otherwise, letdown flow is automatically diverted to holdup tanks when the highest permissible level is reached in the Volume Control Tank.

The RCS boron concentration may be reduced during heatup in accordance with shutdown margin limitations. The makeup controller is operated in the dilute mode to inject a predetermined amount of reactor makeup water at a preset rate.

Blended makeup is also permitted to control reactivity, but this method is less preferred because pure dilution generates June 2007 9.3-141 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES smaller volumes of radwaste per ppm change in boron concentration. Compliance with the shutdown margin limitations is verified by sample analysis.

9.3.4.3.6 Normal Plant Shutdown Plant shutdown is the series of operations that bring the reactor plant from a hot standby condition at normal operating pressure and zero power temperature to a cold shutdown condition for maintenance or refueling.

Prior to and during plant cooldown, the gas space of the Volume Control Tank is vented as needed to reduce fission gas activity and hydrogen concentration in the coolant. Degasification continues until station ALARA objectives are met and until RCS dissolved hydrogen concentration is low enough to provide reasonable protection against the formation of explosive pockets of gas when the system is finally depressurized.

Degassing the reactor coolant is accomplished by sweeps of the Volume Control Tank (VCT), venting of the pressurizer steam space, and diverting letdown flow to the gas stripper and returning the process fluid to the VCT. During the cooldown, purification rate may be increased to accelerate the degasification, ion exchange, and filtration processes.

Although not required, chemicals (other than boric acid) may be added to the reactor coolant during a plant shutdown in order to reduce short and long term corrosion rates, control in-plant and offsite radiological exposure, and enhance radwaste system efficiency. Such chemicals are evaluated for material and system compatibility prior to use. The amount and timing of chemical additions are controlled by procedure or Chemical Control Instruction.

June 2007 9.3-142 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES During a normal cooldown, the contraction of reactor coolant tends to decrease pressurizer level. In response the operators will use charging pumps and letdown control valves to maintain pressurizer level in the normal range. The consequent mismatch between charging and letdown flow results in a low level in the Volume Control Tank. Borated makeup water may be manually or automatically aligned to the VCT or directly to the suction of the charging pumps for inventory and reactivity control. Since a refueling shutdown requires a greater concentration in the RCS than can easily be obtained by the feed and bleed method, the suction on the charging pumps is normally switched to the Refueling Water Tank using one of the gravity feed pathways.

The concentration of boric acid in the makeup water is controlled so that temperature dependent shutdown margin requirements are met throughout the cooldown.

Charging flow may be used for auxiliary spray to reduce system pressure and to cool the pressurizer when main spray is not available.

After the reactor vessel head is removed, the Shutdown Cooling Pumps take the borated water from the Refueling Water Tank and inject the water into the reactor coolant loops via the normal flow paths thereby filling the refueling pool. The resulting concentration of the refueling pool and the RCS will be maintained above the minimum refueling concentration specified in Technical Specifications. However, the pool concentration may be lower than the minimum operating boron concentration for the RWT. Thus, when the refueling pool contents are returned to the RWT, use of the CVCS boric acid batching equipment may be required to return the tank to operability prior to entry into mode 6.

June 2007 9.3-143 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES During refueling shutdown, the reactor makeup water supply piping is monitored and alarmed for flow to prevent dilution of the refueling pool.

9.3.4.3.7 Testing and Inspection Pre-operational testing of the CVCS consisted of the following major elements:

• Each component was inspected and cleaned prior to installation into the CVCS.

• A high velocity flush using demineralized water was used to flush particulate material and other potential contamination from all lines in this system.

• Instruments were calibrated.

• Automatic controls were tested for actuation at the proper setpoints.

• Alarm functions were checked for operability and proper setpoints.

• The relief valve settings were checked and adjusted as required.

• All sections of the CVCS were operated and tested initially with regard to flow paths, flow capacity and mechanical operability.

• Pumps were tested to demonstrate head and capacity.

In addition, the CVCS was tested for integrated operation with the RCS during hot functional testing. This included the following elements:

• Heat exchanger performance was verified June 2007 9.3-144 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES

• Proper control of letdown flow and charging pumps by the pressurizer level control system was tested.

• The charging line was checked to assure that the piping was free of excessive vibration.

• Response of the makeup portion of the CVCS in the automatic, dilute, and borate modes was verified.

Defects in operation that could have affected plant safety were corrected before fuel loading. During the operational phase of plant life, the CVCS will be checked and tested to a comparable level of detail following system modification or major maintenance. If these activities could affect the performance requirements of CVCS equipment important to safety, then proper system operation will be verified by post-modification or post-maintenance testing prior to return of the equipment to service.

As part of normal plant operation, tests, inspections, data collection, and instrument calibrations are made to evaluate the condition and performance of the CVCS equipment and instrumentation. Appropriate vents, drains, instruments, test connections, and sampling capabilities are provided to permit inservice testing of active safety components such as pumps and valves. Inservice inspection and testing of class components in the CVCS will be conducted in accordance with the provisions of the ASME OM Code and Section XI. A listing of active valves in the CVCS is provided in Table 3.9.3-3.

In addition, sufficient instrumentation and sampling capabilities are provided to collect data on heat transfer capabilities and purification efficiency if required to evaluate system or component performance.

June 2009 9.3-145 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.4.4 Design and Safety Evaluation 9.3.4.4.1 Availability and Reliability A high degree of functional reliability is assured by providing standby components and by assuring fail-safe responses to the most probable modes of failure. Redundancy is provided as follows:

June 2007 9.3-146 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Component Redundancy Purification and Three identical mechanical components Deborating Ion Exchangers Charging Pumps One standby, two operating pumps Auxiliary Spray Valves Two parallel valves Letdown Control Valve One parallel standby valve Letdown Backpressure One parallel standby valve Control Valve Boric Acid Makeup Pump One parallel standby pump Reactor Makeup Water Pump One parallel standby pump Holdup Pump One parallel standby pump Reactor Drain Pump One parallel standby pump Gas Stripper The gas stripper package includes redundant standby pumps Boric Acid Concentrator The concentrator package includes redundant Package standby pumps Seal Injection Filter One parallel standby filter Purification Filter One parallel standby filter Letdown Containment Three valves in series (two required for Isolation Valves operability)

Controlled Bleed-Off Two valves in series Containment Isolation Valves Charging Containment One motor operated valve and one check Isolation Valves valve in series Seal Injection Containment One motor operated valve and one check Isolation Valves valve in series In addition to the normal makeup pathways, two independent, gravity-feed lines from the Refueling Water Tank to the charging pump suctions are provided to assure makeup, even during a loss of offsite power. In addition to the RWT, the charging pumps have an alternate source of borated water in the spent fuel pool, which is maintained above 4000 ppm boron concentration. While the normal charging path is through the regenerative heat exchanger, it is also possible to charge June 2009 9.3-147 Revision 15

PVNGS UPDATED FSAR PROCESS AUXILIARIES through the high pressure safety injection header, although seal injection and auxiliary spray would not be functional in this lineup.

In addition to the component redundancy, the CVCS may be operated in a manner such that some components are bypassed.

Transfers boric acid to the charging pump suction header (bypassing the Volume Control Tank) are permissible. The letdown filter and purification and deborating ion exchangers can be bypassed. The pre-holdup ion exchanger (PHIX) and/or the gas stripper may be bypassed if not required to control chemistry or coolant activity. The contents of the Holdup Tank may be recirculated through the PHIX if the process chemistry is not suitable for feed to the boric acid concentrator. The charging line backpressure control valve can be bypassed with the spring loaded check valve in the alternate pathway ensuring the operability of auxiliary spray and seal injection (if required). Controlled bleed-off flow can be routed to the Reactor Drain Tank rather than Volume Control Tank.

Most of the valves in the system are air-operated and designed to fail in a safe condition. In the unlikely event of a loss of all three instrument air compressors, a backup nitrogen supply can be automatically or manually aligned in order to restore functionality of the CVCS air-operated valves.

9.3.4.4.2 Emergency Boration The requirements for minimum shutdown margin are contained in the Technical Specifications and Core Operating Limits Report (COLR). When the reactor is critical (operational modes 1 and 2), shutdown margin requirements are met by maintaining control rods above the Power Dependent Insertion Limits (PDILs) presented in the COLR. In lower modes 3-5 and during June 2007 9.3-148 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES refueling, shutdown margin is achieved by keeping the reactor coolant soluble boron concentration above the limits provided in the Core Data Book. If the minimum shutdown margin requirements are not maintained, then the reactor coolant system must be borated at a rate of approximately 26 gpm with a minimum 4000 ppm boric acid solution. This process of borating to recover shutdown margin is known as emergency boration.

When required, it must be commenced within 15 minutes and continued until the margin is recovered. Emergency boration can be accomplished using components within either the Chemical and Volume Control System (CVCS) or the Safety Injection System (SIS). The Technical Requirements Manual contains operability requirements for borated water sources, gravity-feed boration flowpaths, and charging pumps within CVCS to ensure that the emergency boration capability exists if needed.

9.3.4.4.3 Accident Response This section describes the response of CVCS components to Engineered Safety Features Actuation Signals (ESFAS) generated by challenges to the principal fission product barriers. Those that interface with CVCS include Safety Injection Actuation Signal (SIAS), Containment Isolation Actuation Signal (CIAS),

Containment Spray Actuation Signal (CSAS), and Loss of Power (LOP). Detailed descriptions of the Reactor Protective System and ESFAS are presented in UFSAR Chapter 7.0.

Upon receipt of a SIAS the safety injection pumps take suction from the Refueling Water Tank. These pumps continue to drain the refueling water tank until a Recirculation Actuation Signal (RAS) occurs, at which point the ESF pumps switch suction to the containment sump. The operator then manually isolates the RWT by shutting CH-530 and CH-531. This action is time critical June 2011 9.3-149 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES to prevent ingress of air in the ESF pump suction piping during switchover to recirculation.

Charging pump status may change in response to the SIAS, CSAS, and LOP ESFAS signals in accordance with the various modes of BOP ESFAS Sequencer operation. The LOP signal in this case refers to that generated by loss of power on the class 1E 4160 bus that energizes the pump. Response to the signal combinations may be summarized as follows:

• Upon receipt of a SIAS or CSAS without a LOP, any running charging pump will continue to run. Idle pumps will be locked out from any automatic start signals for 40 seconds. After 40 seconds, the pump can respond to start demands from the Pressurizer Level Control System (PLCS).

• If a SIAS or CSAS is received, and a LOP signal is present with the associated emergency diesel generator output breaker closed, then all charging pumps on the bus are load shed. Following a 40 second time delay, the pumps will automatically start as required by the PLCS.

• If a LOP occurs and the associated diesel generator output breaker is closed with no SIAS or CSAS, then idle charging pumps on the bus are unaffected while running pumps are tripped and placed in an "anti-pump" breaker configuration and can only be manually restarted.

Automatic operation of the charging pumps is not required for any analyzed accident or malfunction. The control logic design provides improved availability of the charging pumps for reactivity control, makeup, seal injection, and auxiliary spray June 2011 9.3-150 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES without affecting the loading and sequencing requirements of the emergency diesel generators.

The charging line contains a motor-operated, outboard containment isolation valve in series with an inboard check valve. A handwheel is provided to allow local operation of the valve, if necessary. Because the availability of reactor coolant makeup, boration, and auxiliary spray enhances overall plant safety, the motor-operated containment isolation valve CH-524 does not receive any automatic close signals. In addition, the valve is locked in the open position with power removed. This administrative control is established to prevent loss of safety functions due to inadvertent valve closure.

Therefore, a CIAS, SIAS, CSAS, or LOP does not isolate the charging line. A sufficient volume of fluid exists in the VCT to provide sufficient time to manually align the gravity feed lines from the borated water sources to the charging pump suction header. Within the containment the charging line branches into two major pathways: direct charging flow to the reactor coolant loop or auxiliary spray to the pressurizer.

Both of these lines are provided with check valves that preclude back flow from the reactor coolant loop.

The seal injection line branches from the main charging line outside of the containment. Similar to the charging line itself, the seal injection line also contains a motor-operated outboard containment isolation valve in series with an inboard check valve. The motor-operated valve CH-255 does not receive any automatic close signals and is provided with a handwheel for local operation of the valve, if required. The four seal injection flow control valves in the distribution header are normally open valves that fail open on loss of instrument air, solenoid power, or control power. Maintaining charging and June 2011 9.3-151 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES seal injection flow following a CIAS reduces the potential for damage to the reactor coolant pump seals. Note that the seals may be further jeopardized following a CSAS due to the additional loss of nuclear cooling water.

The letdown line and the reactor coolant pump controlled bleed-off line penetrate the reactor containment with flow in the outward direction. The letdown line contains two air operated valves inside the containment and one air operated valve outside the containment. The two air-operated valves inside containment are automatically closed on a SIAS. One of the air-operated valves inside containment and the air operated valve outside containment are automatically closed on a CIAS.

The combined Controlled Bleed-Off (CBO) line from the reactor coolant pump seals to the Volume Control Tank contains two air-operated isolation valves (CH-506 and CH-505), which are located inboard and outboard of the containment penetration, respectively. These valves close automatically upon receipt of a CSAS, as do nuclear cooling water and instrument air containment isolation valves. On CSAS, the concurrent isolation of instrument air to containment will result in the CBO line relief isolation valve (CH-507) failing open and thus directing CBO flow through the relief valve to the reactor drain tank (inside containment). Isolation of these valves on CSAS instead of CIAS is an enhancement of the original CESSAR design that reduces operator actions needed to implement the "trip two/leave two" reactor coolant pump strategy when offsite power is still available. The modification allows use of reactor coolant pumps during steam generator tube ruptures, main steam line breaks, and other accident sequences where continued forced circulation is desired and the containment is not pressurized to the CSAS setpoint. The CH-507 valve is June 2011 9.3-152 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES designed to fail open to prevent catastrophic damage to the RCP seals should the combined CBO flow be inadvertently isolated with a pump running.

The inboard and outboard containment isolation valves on the Reactor Drain Tank (RDT) outlet as well as the makeup supply header and the post-accident sampling inputs to the tank all close automatically on a CIAS.

9.3.4.4.4 Safe Shutdown As described in UFSAR 7.4.1.1.9, the boron addition portions of the CVCS are required to achieve safe shutdown. Specifically, in the cooldown from normal operating temperature and pressure to shutdown cooling entry conditions, operation of the charging subsystem components is rquired to support three safety functions. The addition of borated water adds negative reactivity and thereby ensures that shutdown margin requirements are met as coolant temperature decreases. The makeup water volume is needed to maintain pressurizer level (RCS inventory control) as the coolant contracts during cooldown. Use of auxiliary pressurizer spray is required to reduce RCS pressure within the design limit of the shutdown cooling subsystem. The specific operability requirements for borated water sources, boration flowpaths, charging pumps, and auxiliary pressurizer spray are contained in the Technical Requirements Manual. The control logic for these safety related portions of CVCS are provided in Figure 9.3-1.

Letdown and controlled bleed-off portions of CVCS are in service during normal operations but are not required for safe shutdown. Because these reactor coolant losses may actually jeopardize the inventory control safety function, they are isolated during most design events. Closure of at least one June 2011 9.3-153 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES containment isolation valve in both the letdown and the reactor coolant pump controlled bleed-off pathways is required for proper CVCS operation during safe shutdown. The operability of containment isolation valves in CVCS is controlled in the Technical Specifications. In events where reactor coolant pumps are idle and complete isolation of the controlled bleed-off (including closure of CH-507) cannot be assured, then increased RCS leakage due to reactor coolant pump seal damage must also be considered.

CVCS instruments required for safe shutdown are identified in UFSAR Table 7.4-1. Their associated indicators are provided both in the main control room and at the Remote Shutdown Panel (RSP). There are also five non-safety related CVCS instruments identified in UFSAR Table 7.4-1. These instruments, located in a non-safety grade panel adjacent to safety train A/C Remote Shutdown Panel, are supplementary devices used to enhance pressurizer level control during shutdowns where letdown remains in service. These non-safety instruments are neither required nor credited for either safe shutdown (UFSAR 7.4.1.1.9) or shutdown outside the control room (UFSAR 7.4.1.1.10).

CVCS controls and status indications required for safe shutdown include those listed in Table 7.4-1 plus the controls for the charging pumps and remotely operated valves in the gravity feed boration flowpaths. While all CVCS controls required for safe shutdown are available in the main control room, only the ones in Table 7.4-1 are also provided at the RSP. The rest (e.g.,

the charging pumps and remotely operated valves in the boration flowpaths), however, may be controlled locally from associated breakers or disconnect switches. This is consistent with SRP 7.4 and UFSAR SER 7.4, which state that limited local June 2011 9.3-154 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES actions are acceptable for providing a remote shutdown capability as required in GDC 13 and 19.

Because of the CVCS role in achieving safe hot and cold shutdown, portions of CVCS are credited in the Appendix R fire protection analysis. The use of various safety related and non-safety related components within CVCS to mitigate the effects of postulated fires is described in UFSAR Appendix 9B and its supporting basis documents.

9.3.4.4.5 Natural Circulation Cooldown Portions of the CVCS are utilized to achieve safe shutdown under the natural circulation cooldown conditions described in Branch Technical Position RSB 5-1. In a cooldown from normal operating temperature/pressure to shutdown cooling entry conditions, operation of the borated water sources, boration flowpaths, charging pumps, and the auxiliary pressurizer spray within the CVCS are required to support three safety functions.

The addition of borated water adds negative reactivity and thereby ensures that shutdown margin requirements are met as coolant temperature decreases. The makeup water volume is needed to maintain pressurizer level (RCS inventory control) as the coolant contracts during cooldown. Use of auxiliary pressurizer spray is required to reduce RCS pressure within the design limit of the shutdown cooling subsystem. The specific operability requirements for these CVCS components are contained in the Technical Requirements Manual.

For Class 2 plants, the use of non-safety grade equipment to achieve safe shutdown may be acceptable if it can be shown that the effects of single failures may be corrected by manual actions outside the control room. Reliance on non-safety grade CVCS components at PVNGS has been conditionally accepted based June 2011 9.3-155 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES on the implementation of the following engineering and administrative controls:

• The power supplies to CH-501 (VCT outlet valve) and CH-536 (RWT gravity feed to the charging pump suction valve) were upgraded to class 1E sources.

• An interlock was added to ensure that, in the event of a Lo-Lo VCT level with a concurrent loss of power to the non-class valve CH-514 in the alternate boration pathway, the class 1E powered valve CH-536 would automatically open to provide a gravity feed pathway from the RWT to the charging pump suction.

• A second VCT level instrument was installed, and an alarm was added to detect excessive deviation between the two readings. Use of separate dry and wet reference legs reduces the chance of level instrument failure leading to loss of the charging pumps on low pump suction pressure. Note: low VCT level has the potential to allow dissolved hydrogen to come out of solution and gas bind the pumps.

• To ensure availability of the charging pumps, valves CH-532 (RWT to BAMP suction valve) and CH-524 (charging line outboard containment isolation valve) were locked open and their actuators de-energized.

• Procedures were developed for venting the charging pumps if they were to become gas-bound. Since the normal Auxiliary Building ventilation system above the 100' elevation is not available after a loss of offsite power, venting the hydrogen gas directly into the charging pump rooms is a fire and occupational safety June 2007 9.3-156 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES hazard. Therefore, hardware provisions were made to vent the gas to the Essential Pipe Density Tunnel via an intermediate Vent Receiving Tank. This configuration also ensures that the gas would be monitored for radioactivity before discharge to atmosphere.

• Calculations were performed to verify that one train of the high pressure injection in combination with one train of the reactor head vent system were capable of cooling the reactor from Hot Standby to shutdown cooling entry conditions within the specified time. Thus, these subsystems provide a diverse, safety-grade backup method for natural circulation cooldown in the event CVCS was not functional.

While not all credited CVCS components are safety grade, these enhancements give the system an acceptable level of reliability following a loss of offsite power, and only limited operation of system components outside the control room is required to mitigate the consequences of a single failure. As required by BTP RSB 5-1, the ability to perform a natural circulation cooldown using CVCS components was demonstrated by a test conducted at Unit 1 in January 1986. Therefore, the PVNGS design and operating limits provide reasonable assurance that a natural circulation cooldown could be conducted as described in Branch Technical Position RSB 5-1 for a Class 2 plant.

A complete summary of the RSB 5-1 Natural Circulation Cooldown Analysis is included at the end of Chapter 5 as Appendix 5C.

9.3.4.4.6 Overpressure Protection In order to provide for safe operation of the CVCS, the following relief valve protection is provided.

June 2007 9.3-157 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES A. Intermediate Pressure Letdown Relief Valve: The relief valve downstream of the letdown control valves protects the intermediate pressure letdown piping and letdown heat exchanger from overpressure. The valve capacity is equal to the flow expected through one letdown control valve in the full open position at normal operating system pressure. For a given valve position, letdown flow decreases with RCS pressure. When RCS pressure falls below 1200 psia, the relief valve will be capable of discharging the combined flow through two fully open letdown control valves. Consequently, operation of both letdown control valves in parallel is procedurally permitted only when RCS pressure is less than 1200 psia. Above that pressure, one letdown control valve must be closed. The relief valve set pressure is equal to the design pressure of the intermediate letdown piping.

B. Low Pressure Letdown Relief Valve: The relief valve downstream of the letdown backpressure control valves protects the low pressure piping, purification filters, ion exchangers, letdown strainer, and associated letdown components from overpressure. The valve capacity is equal to the capacity of the intermediate pressure letdown relief valve. The set pressure is equal to the design pressure of the low pressure piping and components.

C. Charging Pump Discharge Relief Valves: The relief valves on the discharge side of the charging pumps are each sized to pass the maximum rated flow of the associated pump against maximum backpressure without exceeding the rated head of the pump. The valves are set to open when the discharge pressure exceeds the RCS design pressure by 10 percent.

June 2007 9.3-158 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES D. Charging Pump Suction Relief Valves: A relief valve is located on the suction side of each charging pump. Each is sized to pass the maximum fluid thermal expansion rate that would occur if the associated pump were operated with the suction and discharge isolation valves closed. The set pressure is equal to the design pressure of the charging pump suction piping.

E. Volume Control Tank Relief Valve: The set pressure of the relief valve on the Volume Control Tank (liquid) is equal to the tank design pressure. The valve is sized to pass a liquid flow rate equal to the sum of the following inputs with one charging pump in operation:

(1) maximum operating reactor coolant pump controlled bleed-off flow, (2) letdown flow at the high letdown flow alarm setpoint, (3) design purge flow rate of the Sampling System (SS), and the maximum flow rate from a boric acid makeup pump with the VCT at its relief pressure setpoint.

F. Volume Control Tank Gas Supply Relief Valve: The relief valve is sized to exceed the combined maximum capacity of the nitrogen and hydrogen gas regulators. The set pressure is lower than the Volume Control Tank design pressure.

G. Reactor Coolant Pump Controlled Bleed-off Header Relief Valve: The relief valve located on the RCP controlled bleed-off header redirects flow to the Reactor Drain Tank in the event that the normal flowpath to the Volume Control Tank is isolated. It serves no overpressure protection function. The valve is sized to pass the flow rate from the failure of two seal stages in one reactor coolant pump plus the normal bleed-off from the June 2007 9.3-159 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES other three reactor coolant pumps. The relief valve set pressure is greater than the normal operating pressure of the header (aligned to the VCT) and less than the controlled bleed-off high-high pressure alarm.

H. Heat Traced Piping Relief Valves: Relief valves are provided for those heat-traced portions of the boric acid system (e.g., boric acid batching and the Boric Acid Concentrator bottoms) that can be individually isolated. The set pressure is equal to the design pressure of the corresponding portion of the system piping. Each valve is sized to relieve the fluid thermal expansion rate that would occur if maximum duplicate heat tracing power were inadvertently applied to the isolated line.

I. Equipment Drain Tank Relief Valve: The Equipment Drain Tank relief valve is sized to pass the liquid flow rate equivalent to the maximum expected tank input. The set pressure is equal to the design pressure of the Equipment Drain Tank.

J. Reactor Drain Tank Rupture Disc: An installed rupture disc, which vents to the containment atmosphere, provides overpressure protection for the Reactor Drain Tank if the discharge from pressurizer safety valves exceeds the quenching capacity of the tank. The rupture disc is designed to relieve at 120 psig tank pressure (with the containment at atmospheric pressure) and is sized to pass the rated flow from all four pressurizer safety valves.

K. Charging Line Spring-Loaded Check Valve: A spring-loaded check valve is arranged in parallel with the charging line differential pressure control valve June 2007 9.3-160 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES and its associated isolation valve. In the event that flow through the normal pathway is blocked by closure of either the control or isolation valve, the check valve provides an alternate pathway for charging flow to enter the RCS. The differential set pressure and capacity of the spring-loaded check valve are established to ensure that (1) charging pressure remains below the charging pump discharge relief valve setpoints, (2) auxiliary spray remains operable, and (3) minimum acceptable RCP seal injection flow is maintained.

9.3.4.4.7 Leakage Detection and Control The components in the CVCS are provided with welded connections wherever possible to minimize leakage to the atmosphere.

However, flanged connections are provided on all pump suction and discharge lines, on relief valve inlet and outlet connections, on the boric acid batching eductor, and on some flow meters to permit removal for maintenance.

All valves larger than 2 inches and all actuator-operated valves were provided with double-packing, lantern rings, and leakoff connections unless the valves are diaphragm (packless) valves. During original plant design, an evaluation determined that leakoffs piped to the equipment drain tank present a greater ALARA concern than capping the valve leakoff. The cap has been designed as part of the CVCS pressure boundary.

Diaphragm valves are utilized around the Volume Control Tank gas space. Thus, activity release due to valve leakage is minimized.

The CVCS may also be used to monitor the total RCS water inventory. The system role in the detection and quantification of RCS leakage is described in UFSAR 5.2.5. During refueling June 2007 9.3-161 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES shutdown, reactor makeup water flow is monitored to detect leakage past isolation valve CH-195 (locked shut during refueling shutdown). If leakage occurs, an alarm is annunciated in the control room.

9.3.4.4.8 Failure Mode and Effects Analysis Table 9.3.4-3 shows a Failure Mode and Effects Analysis (FMEA) for the CVCS. At least one failure is postulated for each major component of the CVCS. Additionally, various line breaks throughout the system are also considered. In each case, the possible cause of such a failure is presented as well as the local effects, detection methods and compensating provisions.

9.3.4.4.9 Radiological Evaluation Frequently used manually operated valves located in high radiation or inaccessible areas are provided with extension stem or "reach-rod" handwheels terminating in low radiation and accessible control areas. Manually operated valves are provided with locking provisions if unauthorized operation of the valve is considered a potential hazard to plant operation or personnel safety. A radiological evaluation of the CVCS is presented in Section 12.2.

9.3.4.4.10 Boron Recovery To reduce the amount of radioactivity that must be discharged from the site as radioactive waste or effluent, the boron recovery subystem has been sized to process the nominal borated waste water generation rates. The annual volume of water directed to the Holdup Tank during normal operation has been estimated to be:

June 2007 9.3-162 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Plant Evolution Volume (gal/yr)

Refueling, Startup and Shutdown 204,300 Cold Shutdowns and Startups (at 364,300 30%, 60% and 90% core life)

Hot Critical Shutdowns and 115,400 Startups (at 55% and 65% core life)

Boron Dilution/Fuel Burnup 240,800 Waste (out to approximately 97%

core life)

Back to Back Cold Shutdowns to 364,500 5% subcritical and Startups (at 90% core life)

Average Leakage to Reactor 91,250 Drain Tank and Equipment Drain Tank (250 gal/day)

Total 1,380,550 The capacities of CVCS tanks and the processing rate of the boric acid concentrator have been sized to allow complete boric acid recycle. However, full boron recovery may not be achievable under all operational conditions.

9.3.4.4.11 Small Line Break General Design Criterion (GDC) 33 requires that the normal makeup system be able to supply sufficient reactor coolant makeup in the event of a small line break to assure that Specified Acceptable Fuel Design Limits (SAFDLs) are not exceeded. Small lines at PVNGS, such as those used for instrumentation and sample collection, are connected to the reactor coolant pressure boundary via appropriately sized June 2011 9.3-163 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES flow restricting devices. These devices limit the potential break flow within the capacity of the charging system, which provides reactor coolant makeup during normal plant operation.

The CVCS design incorporates a high degree of functional reliability by provision of redundant components. The charging subsystem contains three pumps when only two of charging pumps are required to be operable in modes 1-4. In addition, the CVCS will function with either onsite or offsite electric power available. The charging pumps and auxiliary pressurizer spray valves are powered from vital electrical buses fed either from offsite power or from the emergency diesel generators. The charging pump suction pathway is gravity fed from multiple pathways using manual valves or valves that can be energized from vital power sources.

During the transient, charging flow is needed to compensate for inventory lost out of the break, contraction of coolant volume during cooldown, as well as anticipated system losses from controlled bleed-off and leakage. The maximum flow through the orifice is initially estimated to be approximately 45 gpm, which is less than the nominal capacity of the minimum number of operable charging pumps. Once letdown is isolated, analysis shows that the nominal capacity of two charging pumps provides sufficient makeup to allow pressurizer pressure to be stabilized above the SIAS setpoint.

The operators are then assumed to initiate a cooldown to cold shutdown entry conditions. During the cooldown, the capacity of charging and auxiliary spray are sufficient to control pressurizer level and RCS subcooling margin within the limits prescribed by the emergency operating procedures. Since the core remains covered and no bulk boiling occurs in the fuel June 2011 9.3-164 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES region, the SAFDL on Departure of Nucleate Boiling Ratio (DNBR) cannot be exceeded. The event terminates with entry into cold shutdown, which is achieved using only the minumum inventory of borated water stored in the RWT above the high suction nozzle.

Thus, analysis demonstrates that a small line break can be mitigated without challenging the emergency core cooling systems. Note that, as an evaluation of normal makeup system performance, the effects of a single failure and instrument uncertainty were not considered. Based on the analysis summarized above, it is concluded that the CVCS normal makeup system meets the requirements of GDC 33.

June 2007 9.3-165 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES TABLE 9.3.4-1 (Sheet 1 of 2)

DESIGN TRANSIENTS CVCS Code Class 2* Components Which Are Part Of The Reactor Coolant Pressure Boundary Assumed number of occurrences during the (1) 40-year design Affected Event life of the plant Component

1. Plant Startup 500 L,C

2. Step Power Change (90 Percent 2,000 L,C to 100 Percent)

3. Step Power Change 2,000 L,C (100 Percent to 90 Percent)

4. Ramp Power Change (15 Percent 15,000 L,C to 100 Percent at 5 Percent/Minute)

5. Ramp Power Change 15,000 L,C (100 Percent to 15 Percent at

-5 Percent/Minute)

6. Turbine Trip 120 L,C

7. Loss of Flow to the Core 40 L

8. Loss of Secondary Pressure 1 L,C

9. Switch from Normal 1,000 L,C Purification to Maximum Purification

10. Low-Low Volume Control Tank 80 L,C,S

Response

11. Charging cycles (on/off) 800 L,C during an Extended Loss of Letdown

12. Loss of Letdown Flow and 300 L,C Recovery

13. Loss of Charging Flow and 200 L,C Recovery June 2007 9.3-166 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES TABLE 9.3.4-1 (Cont'd.)

(Sheet 2 of 2)

DESIGN TRANSIENTS CVCS Code Class 2* Components Which Are Part Of The Reactor Coolant Pressure Boundary Assumed number of occurrences during the (1) 40-year design Affected Event life of the plant Component

14. Plant Cooldown 500 L,C

15. Reactor-Turbine Trip 234 L,C

16. Inadvertent Actuation of 10 L,C Pressurizer Heaters

17. Inadvertent Initiation of 5 C Auxiliary Spray at Full Power

18. Depressurization due to 5 L,C Inadvertent Actuation of One Pressurizer Safety Valve

19. Opening One Steam Bypass 40 L,C Valve at Full Power

20. Excess Feedwater Flow Due to 40 L,C Control System Malfunction at Full Power

21. Loss of Feedwater Flow to the 85 L,C Steam Generators

22. Pressurizer Level Control 100 L Failure to Full Letdown

23. Initiation of Auxiliary Spray 500 C During Cooldown NOTE (1): Code for symbols: L - Letdown line to and including CH-523 C - Charging line from and including CH-524 S - Seal injection line from and including CH-255

• Design transients for Code Class 1 components are listed in 3.9.1.1.

June 2007 9.3-167 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES Table 9.3.4-2 PRINCIPLE COMPONENT DESIGN DATA

SUMMARY

(Sheet 1 of 1)

Tanks Press Temp Minimum (internal/external) Volume Volume Control Tank 75 psig/15 psig 200°F 4,917 gal Boric Acid Batching Tank Atmospheric 200F 630 gal Equipment Drain Tank 60 psig/15 psig 300F 10,500 gal Reactor Drain Tank 130 psig/15 psig 350F 2,850 gal Holdup Tank 1.5 psig 200F 435,000 gal Reactor Makeup Water Tank 1.5 psig 200F 420,000 gal Refueling Water Tank 1.5 psig 200F 620,000 gal Chemical Addition Tank Atmospheric 150F 8 gal Pumps Press Temp NPSH Req. Head (Rated) Rated Flow Charging Pumps 2735 psig 200F 9.0 psia 2735 psig 44 gpm Boric Acid Makeup Pumps 200 psig 200F 14 ft 300 ft 165 gpm Reactor Makeup Water Pumps 200 psig 200F 14 ft 300 ft 165 gpm Holdup Pumps 100 psig 200F 10 ft 145 ft 50 gpm Reactor Drain Pumps 200 psig 200F 10 ft 145 ft 50 gpm Chemical Addition Pump 2735 psig 250F 5 psia 2735 psig 25 gph Ion Exchangers Press Temp Purification Ion Exchangers 200 psig 200F Deborating Ion Exchanger 200 psig 200F Preholdup Ion Exchanger 200 psig 200F Boric Acid Condensate Ion Exchanger 200 psig 200F Filters Efficiency (Nom.) Press Temp Flow Purification Filter 98% for 2 µ 200 psig 200F 150 gpm Boric Acid Filter 98% for 2 µ 200 psig 200F 200 gpm Reactor Makeup Water Filter 98% for 2 µ 200 psig 200F 200 gmp Reactor Drain Filter 98% for 2 µ 200 psig 200F 100 gpm Seal Injection Filter* 95% for 5 µ 2735 psig 200F 30 gpm

• See also Section 9.3.4.2.2.Z.

Heat Tube Shell Exchangers Press Temp Pressure Press Temp Pressure Loss Loss Regenerative HX. 2485 650F 60 psi @ 2735 550F 7.5 psi @

psig 135gpm/565F psig 44 gpm/130F Letdown HX. 650 550F 10 psi @ 150 250F 15 psi @

psig 135 gpm/450F psig 1500 gpm/105F Seal Injection 2735 200F 10 psi @ N/A N/A N/A HX psig 30 gpm/120F June 2007 9.3-168 Revision 14

Table 9.3.4-3 (Sheet 1 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2011 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

1) Letdown Stop a) fails open Mechanical Failure to automatically Position indicator in Remote manual closure of Temp. indicator/

Valve Inside binding terminate letdown flow on high control room; redundant valve for Hi controller TIC-223, will Containment, temperature. Loss of double temperature indicator, temp. condition: Series increase component CH-515 isolation for letdown line on TIC-221; flow redundant valve cooling water (CCW)

SIAS. indicator, FI-202. automatically closes on flow through letdown SIAS heat exchanger (LHX) to compensate for Hi.

temp. letdown flow.

Problem only if regenerative heat exchanger (RHX) discharge temp.

exceeds 413°F PVNGS UPDATED FSAR b) fails closed Loss of air or Loss of letdown flow, possible Letdown low pressure None Letdown not required for power supply, overcharging of RCS. Increase alarm (PIC 201), Safe Shutdown spurious in pressurizer (PZR) level. letdown flow signal, Possible overpressurization of indication (FI-202),

9.3-169 operator error RCS during startup. PZR level alarms, position indication in control room, PZR pressure indicators T-229 indication FSHL-204 low flow alarm.

2) Letdown a) fails open Mechanical Loss of redundance for letdown Position indication in Series redundant valve, Containment binding isolation on CIAS and/or SIAS. control room CH-515, for SIAS; series Isolation Valve redundant valve, CH-523 Inside for CIAS.

Containment, CH-516 PROCESS AUXILIARIES b) fails closed Same as 1b) Same as 1b) Same as 1b) Same as 1b) Same as 1b)

3) Regenerative a) plugged Corrosion Reduced letdown flow Flow indicator FI-202 None Complete plugging of all Heat Exchanger, tubes buildup, boron tubes is unlikely. Flow RHX buildup, deterioration would be foreign detected long before material in complete plugging RCS occurs b) insufficient Scale buildup, Letdown temperature may Hi temp alarm and TIC-223 will increase NC TIC-224 will isolate heat fouling exceed 450°F. Possible indication on TIC-221. flow to LHX. letdown by closure of Revision 16 transfer thermal damage to downstream Possible Hi temp CH-523 if TIC-223 components. alarm on TIC-224 TIC-221 will isolate cannot maintain LHX letdown by closing CH-515 outlet temperature limits.

on Hi temp.

Table 9.3.4-3 (Sheet 2 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects c) external Casing crack, Possible reduction in Containment radiation None, except series When leak is detected, leakage weld crack, charging/letdown flow, primary monitor, local leak redundant valve for seat the RHX can be isolated seat leakage coolant released inside detectors, excessive leakage on CH-393 for repair by terminating on vent valve containment make up rate. letdown/charging CH-393 Possible high temp T-221.

d) cross Corrosion, Reduced charging efficiency. Disparity between None When leak is detected, leakage vibration wear letdown samples and letdown must be mfg defect RCS samples during terminated to effect boration or deboration repair

4) Temperature a) reads high Electro- Possible erroneous Hi letdown Hi temp. alarm from None Letdown not required for PVNGS UPDATED FSAR Indicator/ mechanical temp. alarms, possible TIC-221 without safe shutdown Controller, setpoint drift termination of letdown flow by corresponding TIC-221 closure of CH-515 changes in indications from TIC-223, TIC-224, or PIC-201 b) false Electro- Loss of ability to detect Hi Hi temperature alarm TIC-223 will increase CCW Letdown flow can be 9.3-170 indication mechanical letdown temp condition and on TIC-224, Hi temp. flow thru LHX to help terminated by remote of low or failure terminate letdown flow. indication on TIC-223. compensate. TIC-224 will manually closing of normal Possible thermal damage to Routine periodic test. isolate letdown flow by valves CH-515 or temp downstream components closure of CH-523 on Hi CH-516.

temp.

5) Letdown a) fails open Mechanical Loss of redundancy for letdown Position indicator in Series redundant isolation On Hi temp, TIC-224 will Isolation Valve binding isolation on CIAS. Failure to control room. valve CH-516 on CIAS. divert CH-521 and 520 Outside secure letdown on Hi LHX outlet Possible high to bypass PIX, PRM, Containment; temp, with possible damage to temperature alarm and Boronometer.

CH-523 downstream components. from TIC-224.

PROCESS AUXILIARIES b) fails closed Same as 1 b) Same as 1 b) Same as 1 b) Spurious Hi temp signal Same as 1 b) may be manually overridden from HS-523.

Revision 14

Table 9.3.4-3 June 2011 (Sheet 3 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

6) Letdown Control a) regulates Valve operator Reduced letdown flow. PZR PZR level indications, Parallel redundant control One of the two Valve; CH-110P, low failure, mech. level increases, volume control Lo flow indication valve (CH-110Q) control CH-110Q failure, false tank (VCT) level decreases from FI-202. valves is normally signal isolated by manual isolation valves while the other valve controls flow.

Flow control can be switched by opening the isolation valves for the non operating control valve and isolating the operating valve.

PVNGS UPDATED FSAR b) regulates Valve operator Increased letdown flow, PZR PZR and VCT level Parallel redundant control high failure, false level decreases, VCT level indications, Hi flow valve. Also, if RHX signal increases. Possible increase in indication from discharge temp. exceeds 9.3-171 letdown temperature FI-202, Hi temp 413°F TIC-221 will close indication from valve CH-515, thereby TIC-221. terminating letdown c) fails closed Air or power Loss of letdown flow, possible Lo flow indication Parallel redundant control Rapid pressure transient failure, overcharging of RCS, possible from FI-202, Lo press. valve if failure occurs during spurious RCS over pressurization during indication from shutdown if solid plant.

signal shutdown, PZR level increase, PIC-201, PZR and Letdown not required for VCT level decrease VCT level indications, safe shutdown.

valve position indicator in control room.

7) Letdown Control a) fails open Mechanical No impact on system operation, Operator Two series redundant One set of isolation Valve Isolation failure unable to isolate one valve for isolation valves for each valves normally closed, Valve; CH-340, maintenance of standby control valve (for standby control PROCESS AUXILIARIES CH-341, condition valve), other set is CH-342, CH-343 normally open (for operating control valve).

b) fails closed Mechanical Unable to transfer letdown flow Operator None, if operating control failure control to standby control valve valve has malfunctioned c) seat Contamina- No impact on operation None None leakage tion, mechan-ical damage Revision 16

8) Letdown Flow a) fails closed Mechanical Unable to warm up letdown line Position indicator in None Operator can warm up Control Bypass failure, valve downstream of flow control control room (CR). letdown lines using Valve; CH-526 operator valves prior to instituting letdown control valve failure letdown under manual control

Table 9.3.4-3 (Sheet 4 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails open Mechanical No impact on operation CH-526 position PZR level control will binding, indication in control regulate letdown control spurious room valve to compensate for signal increased flow. Flow orifice will restrict flow to low level

9) Isolation Valve a) fails closed Mechanical Unable to divert shutdown Operator Purification during shutdown Inlet Line from binding, mech. cooling flow to IXs for can be accomplished via Shutdown failure purification letdown and charging Cooling System (SDCS) CH-363 b) fails open Mech. binding, No impact on operation. Operator Series redundant valve in PVNGS UPDATED FSAR mech. failure SDCS c) seat Contamination No impact on operation. None Series redundant check leakage valve in SDCS

10) Letdown Heat a) tube leak Corrosion, Contamination of CCW with CCW radiation monitors, None Exchanger LHX mfg defect primary coolant CCW surge tank level increases, increased 9.3-172 make up, possibly low flow indication from FI-202.

b) tubes Buildup of PLCS will gradually open Mismatch between PLCS will open LCV to Letdown not plugged corrosion, letdown control valve (LCV) to letdown flow FI-202 and control PZR level. required for safe boron, or RCS compensate for increased flow PLCS master controller shutdown.

contaminants resistance. output demand. TIC-223 will adjust NC flow Periodic Hx inspections. to control LHX outlet temp.

Degraded PZR level control once LCV is fully open.

PROCESS AUXILIARIES c) insufficient Scale buildup, Hi temperature in LHX letdown Hi temp alarm on TIC- TIC-223 will increase NC TIC-224 will isolate heat fouling outlet. Possible thermal 224. flow thru LHX to maintain letdown on Hi transfer damage to downstream letdown outlet temp. temperature.

components. Periodic Hx inspections.

d) external Casing crack, Primary coolant or CCW Area radiation monitors, None leakage seat leakage released outside containment. local leak detectors, Lo from vent flow indication from FI-valve CH-444 202, excessive makeup to VCT or CCW.

e) degraded Loss of NC Hi temperature in LHX letdown Hi temp alarm from TIC- TIC-224 will isolate letdown Once NC flow cooling flow, NC flow outlet. 224, Lo flow indication on either Hi temperature or recovered, operator Revision 14 flow control valve on NC-F208, Hi temp LOOP. can over ride and malfunction, Possible thermal damage to alarm and indication on open CH-523 to NC line break. downstream components. NC-T207. Numerous restore letdown if alarms for complete loss flow needed to clear of NC flow. high temp condition in stagnant piping.

Table 9.3.4-3 (Sheet 5 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Inherent Remarks and Symptoms and Local Effects No. Name Failure Mode Cause Method of Detection Compensating Other Effects Including Dependent Failures Provision

11) Temperature a) false low Electro- TIC-223 will throttle back NC Hi temp alarm from TIC-224 will isolate Letdown not required for safe Indicator/ temperature mechanical flow to LHX resulting in TIC-224. letdown flow on Hi shutdown.

Controller, failure decreased LHX heat removal. temperature.

TIC-223 Resulting high letdown outlet temp with possible damage to downstream components.

b) false high Electro- TIC-223 will increase CCW flow High flow indication None required. Low Letdown temp cannot be lower tempera- mechanical to LHX, increasing heat removal on NC-F208, Low temp discharge from than NC supply temp.

ture failure and resulting in lower letdown temp indication on LHX not considered a outlet temperature. NC-T207. Low VCT problem.

temperature indication on TIC-225.

12) NC Flow PVNGS UPDATED FSAR Sensor FSL-613

--Component Removed 9.3-173

13) Backpressure a) false low Electrical or Letdown backpressure control Possible Lo press. None CH-345 will protect the Indicator/ pressure mechanical valve will start to close, reducing alarm from PIC-201, letdown line from exceeding Controller, indication malfunct. letdown flow. Letdown control Lo press alarm from design pressure PIC-201 valve will open to compensate, PI-220, Lo flow increasing pressure in LHX, indication from FI-202 may lift safety valve, CH-345 b) false high Electrical or Letdown backpressure control High flow alarm from None This transient will continue pressure mechanical valve will start to open, FI-202, possible Hi until the operator terminates indication malfunction increasing letdown flow and pressure alarm from letdown, or takes manual decreasing backpressure on PI-220, PZR and VCT control of PIC-201 possible LHX. Flashing will occur level indication loss of primary coolant outside downstream of letdown control containment if water hammer PROCESS AUXILIARIES valve. Possible water hammer occurs and breaks an with damage to instrument tap, instrument line or small pipe valves and CVCS piping c) reverts to Loss of power The letdown backpressure Lo (No) flow indication None Letdown can not be restored manual control valve closes. When from FI-202. Low without operator intervention.

control power is restored controller pressure alarm and When power is restored, PSV-reverts to manual control. indication from (2) 345 & PSV-354 may relieve CH-PI-220 to the EDT depending on PIC-201 dial setting.

PSV-345 and PSV-354 provide over-pressure protection for the intermediate and low pressure (2)

NOTE Revision 14 letdown SSCs, respectively. See UFSAR Section 9.3.4.4.6, Items A & B.

Table 9.3.4-3 (Sheet 6 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

14) Letdown a) fails to Valve operator Possible flashing between Lo pressure alarm Parallel redundant control Two parallel backpressure Backpressure close malfunction, letdown control valve and from PIC-201, Hi valve control valves, one standby.

Control Valve; properly mechanical backpressure control valve, pres. alarm from Standby control valve is CH-201Q, on binding possible water hammer in PI-220, Hi flow alarm isolated by manual valves CH-201P decreased letdown piping. Increased from FI-202, PZR &

upstream letdown flow, with PZR level VCT level indications pressure decrease and VCT level increase b) fails to Valve operator Pressure increase upstream, Hi pressure alarm Parallel redundant control Same as 14a) open malfunction, may lift safety valve, CH-345. from PIC-201, Lo pres valve properly mech. binding Reduced letdown flow. alarm from PI-220, Lo on Increase in PZR LVL and flow indication on increased decrease in VCT level FI-202, PZR and VCT PVNGS UPDATED FSAR upstream level indications pressure c) fails closed Air or power Loss of letdown flow. Hi pres. Hi press. alarm from Parallel redundant control If letdown and charging in failure, upstream may lift safety valve PIC-201, Lo press. valve. PZR level control to progress during startup or spurious CH-345. PZR level increase alarm from P-220 stop charging pumps shutdown cooling, this failure 9.3-174 signal and VCT level decrease. PZR and VCT level (except the always running will result in a rapid RCS over Possible RCS overpress., indications pump). press. transient if the RCS is especially during shutdown solid. Letdown not required cooling or startup. for safe shutdown.

15) Temperature a) false low Electro- Loss of LHX outlet temp CH-523 fails to close TIC-223 will adjust NC flow Operator action required to Indicator/ tempera- mechanical protection. If high letdown temp with high temp to control temperature in isolate letdown for concurrent Controller; ture failure exists, possible damage to indication on TIC-223. response to letdown loss of NC flow to LHX.

TIC-224 down-stream components. Hi temp initiated transients.

alarm/indication on NC-T207. Low flow indication on NC-F208.

PROCESS AUXILIARIES b) false high Electro- Letdown isolates by auto High alarm from TIC-223 provides Letdown not required for safe temperature mechanical closure of CH-523. PIX, PRM, TIC-224, low flow redundant temp reading. shutdown.

. failure and boronometer are bypassed. alarm on FI-204; Auto Backpressure control valves actuations occur with On partial actuation or high If CH-201P/Q closes without CH-201P/Q go closed. normal indication on temp override, CH-523 will auto or manual isolation of TIC-223. still close on CIAS. letdown, PSV-345 will lift and Buildup of primary letdown flow will be diverted to contaminants. Loss of process the EDT.

monitoring. Loss of letdown effects as described in 1b).

16) Letdown a) fails open Mechanical No impact on system operation. Operator Series redundant isolation Two sets of isolation valves, Revision 14 Pressure Control binding Unable to isolate backpressure valve one set normally closed (for Valve Isolation control valve for maintenance or standby backpressure control Valves; CH-347, standby status valve) and the other set is CH-348, normally open (for operating CH-349, CH-350 backpressure control valve)

NOTE(1) The boronometer is abandoned in-place.

Table 9.3.4-3 (Sheet 7 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mechanical Unable to transfer letdown Operator None if operating binding backpressure control to standby backpressure control valve valve has malfunctioned c) seat Contamina- No impact on operation None Series redundant isolation leakage tion, mechan- valve ical damage

17) Pressure a) Spurious Electrical or No direct impact on system Hi pressure alarm None required PI-220 serves no control Indicator, PI-220 Hi mechanical operation from PI-220 with function pressure malfunction normal indications alarm from FI-202, TIC-223 and TIC-224 b) Spurious Electrical or No direct impact on system Lo pressure alarm None required Lo mechanical operation from PI-220 with pressure malfunctions normal indications PVNGS UPDATED FSAR alarms from FI-202, TIC-223 and TIC-224

18) Purification a) does not Punch Particle and radiation level Lo differential Parallel redundant Unlikely failure 9.3-175 Filter; Filter 1, filer through of buildup in IXs. Eventually high pressure indication purification filter, can be Filter 2 element differential pressure across IXs. from PDI-202 valved in b) blocked Element Reduced letdown flow Hi differential Parallel redundant filter plugged with pressure indication can be valved in. Filters particles from PDI-202, Hi can be bypassed through pressure indication valve CH-355 if both need from PI-220 maintenance.

c) external Casing crack, Loss of primary coolant outside Local leak detectors, Parallel redundant filter leakage seat leakage containment. Possible reduced Lo flow indications can be valved in. Filters from vent letdown flow. from FI-202, Lo can be bypassed thru valve CH-359 differential pressure valve CH-355 if both need or CH-366 indication from maintenance PROCESS AUXILIARIES PDI-202

19) Purification Filter a) fails open Mech. binding No direct impact on system Operator Series redundant isolation Two sets of manual Isolation Valves; operation. Unable to isolate valve valves. One set normally CH-358, filter for maint. or cartridge open (for on-line CH-360, replacement purification filter) Other CH-373, set normally closed (for CH-376 standby filter) b) fails closed Mech. binding Unable to put standby filter on Operator None line Revision 14 c) seat Contamina- No impact on system operation None Series redundant isolation leakage tion, mech. valve damage

Table 9.3.4-3 (Sheet 8 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

20) Differential a) spurious Electrical or No direct impaction operation. Hi differential None required Pressure Hi differen- mechanical Early replacement of a purif. pressure alarm from Indicator; tial pres- malfunction filter cartridge PDI-202 with normal PDI-202 sure alarm indications from FI-202, PI-220, PI-225 b) false Lo Electrical or No direct impact on system Lo differential None required differential mechanical operation pressure indication pressure malfunction from PDI-202 with indications normal indications from FI-202, PI-220, and PI-225

21) Differential a) fails open Mech. binding No direct impact on system Operator None Pressure operation. Unable to isolate Indicator PDI-202 for maint.

PVNGS UPDATED FSAR Isolation Valves; CH-356 CH-357 b) fails closed Mech. binding Unable to place PDI-202 back Operator None 9.3-176 on line after maint.

22) Purification Filter a) fails closed Mech. binding Unable to divert letdown flow Operator Two full capacity purif.

Bypass Valve past purif. filters, during maint. filters; should never have CH-355 or cartridge replacement to use bypass valve.

b) fails open Mech. binding Continued diversion of letdown Operator Same as above flow past purif. filters when attempt to place filter back on line. Build-up of particles in IXs c) seat Contamina- Minor diversion of letdown flow In long term, IX diff. None IXs designed to remove leakage tion, mech past purif. filters. Gradual pres. indicator, particulate matter. Any damage, valve particle buildup in IXs PDI-203, otherwise, diversion should be not seated none. minor PROCESS AUXILIARIES properly

23) Flow Indicator a) spurious Electrical or No direct impact on system Hi flow alarm from None FI-202 Hi flow mechanical operation FI-202 with normal alarm malfunction indications from FIC-204, PI-220, PIC-201, and L-110X, Y (PZR level).

b) spurious Electrical or No direct impact on system Lo flow indication Lo flow mechanical operation from FI-202 with Revision 14 indication malfunction normal indic. from PI-220, PIC-201, FIC-204, and L-110X, Y (PZR level).

24) Upstream a) fails open Mech. binding No direct impact on system Operator None Isolation Valve operation. Unable to isolate for Diversion diversion valve, CH-521 for Valve; CH-364 maint.

Table 9.3.4-3 (Sheet 9 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mech. binding Unable to reestablish flow thru Operator None (1) boronometer and past PRM after maint. on diversion valve, CH-521

25) Diversion Valve; a) fails in the Mech binding, Unable to divert Hi temp Position indicator in High letdown temperature Letdown would have to CH-521 straight valve operator letdown flow around PRM and control room. Flow would cause CCW to the be terminated to provide (1) thru malfunction Boronometer . indication from FI-204 LHX to increase to protection for PRM position during Hi temp condit. maintain a normal temperature to the PRM b) fails to the Loss of air or Letdown flow diverted around No flow indication None bypass power, PRM and boronometer. Loss of from FI-204, valve position spurious continuous radiation monitoring position indicator in signal control room

26) Isolation valve; a) fails open Mech. binding Partial loss of isolation capability Operator Downstream isolation PVNGS UPDATED FSAR CH-413 for diversion valve CH-521 valve for FIC-204 can be used.

b) fails closed Mech. binding Unable to divert Hi temp Operator PRM not affected by Flow past PRM and 9.3-177 (1) letdown flow around PRM and process Temp changes Boronometer should (1)

Boronometer not be re-established after maint on CH-521 unless this valve is open (1)

27) Isolation Valves; a) fails open Mechanical Unable to isolate PRM (CH-409) Operator Entire PRM/boronometer (1)

CH-409, CH-410 binding or Boronometer (CH-410) after Loop can be isolated using maint. valve CH-364 b) fails closed Mech. binding Unable to reestablish flow Operator None through PRM (CH-409) or (1)

Boronometer (CH-410) after maint.

28) Process a) spurious Elect. No direct impact on system Comparison with grab Sampling system backup Radiation Hi malfunction operation sample iodine PROCESS AUXILIARIES Monitor (PRM) radiation analysis alarms b) false Lo Elect. No direct impact on system Iodine analysis of Sampling system backup radiation malfunction operation. May not detect fuel grab sample level indi- element failure if one occurs.

cation (1)

29) Boronometer Revision 14 NOTE(1) The boronometer is abandoned in-place

Table 9.3.4-3 (Sheet 10 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

30) DELETED

31) Throttle Isolation a) fails Mech. binding, Unable to establish flow through Operator None required (1)

Valve CH-245 closed mech failure boronometer after maint.

(1) (1) b) fails open Mechanical Unable to isolate boronometer Operator boronometer and flow binding or flow indicator/controller, indicator, FIT-204 can be FIC-204 (CH-245) for isolated using valves maintenance CH-422, CH-410, and PVNGS UPDATED FSAR CH-413 c) wont Mechanical Unable to obtain proper flow Operator flow Valve CH-410 and CH-409 (1) throttle binding rates thru boronometer indicator/controller can be used to throttle flow (1) properly CH-409, CH-245 for given back FIC-204 flow thru the boronometer pressure. indicator, FI-202 (1)

32) Isolation Valve a) fails open Mech. binding Unable to isolate flow Operator Boronometer loop can be CH-422 indicator/controller FIC-204 isolated using isolation (CH-422) for maint. valve CH-364, and check 9.3-178 valve CH-449 b) fails closed Mech. binding Unable to reestablish flow Operator None (1) through boronometer and past PRM (CH-422) after maint. on flow indicator

33) DELETED

34) Flow Indicator/ a) false Elect. or FIC-204 will open valve CH-204 Lo flow alarm from None Sampling system is Controller, Indications mech. thereby reducing flow past PRM FIC-204 backup for radioactivity PROCESS AUXILIARIES (1)

FIC-204 of high malfunction and boronometer . This will concentration flow rate reduce the accuracy of their determination indications b) false Elect or mech. FIC-204 will close valve CH-204 Hi flow alarm from None Same as 34) a)

Indication malfunction increasing flow thru PRM, FIC-204 of low flow thereby altering the accuracy of rate its indications

35) Check Valve, a) fails closed Mech. binding Unable to establish flow through Lo flow alarms from None Sampling system is (1)

CH-449 boronometer and past PRM FIC-204 backup for radioactivity concentration determination b) fails open Mech. binding No direct impact on system None None operation Revision 14 NOTE(1) The boronometer is abandoned in-place

Table 9.3.4-3 (Sheet 11 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

36) Diversion valve; a) fails closed Mech. binding Unable to divert letdown flow Operator None Sampling system is CH-424 around control valve CH-204 backup for radioactivity when maint. required on concentration CH-204 determination and iodine analysis b) fails open Mech. binding Letdown flow will be diverted Operator, Low flow None Same as 36) a) around control valve CH-204, indication/alarm from thereby eliminating ability to FIC-204 properly regulate flow thru (1) boronometer .

37) DELETED

38) Control Valve, a) wont Valve operator Unable to maintain proper flow Flow Indicator/ None Proper flow required to PVNGS UPDATED FSAR (1)

CH-204 regulate malfunction rates thru boronometer . controller, FIC-204 ensure slip stream is back- mech binding, representative of pressure loss of air letdown process.

properly power b) fails to Sheared valve Sudden diversion of full letdown Hi flow alarm from None 9.3-179 (1) closed stem flow thru boronometer FI-204 position

39) Isolation Valves; a) fails open Mech. binding No direct impact on system Operator None CH-367, CH-368 operation. Unable to isolate control valve, CH-204 for maint.

b) fails Mech. binding Unable to re-establish flow thru Operator None closed valve, CH-204 after maint.

Unable to properly regulate flow (1) thru boronometer

40) Ion Exchanger a) fails in IX Mech. binding No direct impact on system None until demand, None Alternate Bypass flow bypass Valve; position valve operator operation. Unable to divert Hi then, Hi temp alarm paths can be manually PROCESS AUXILIARIES CH-520 failure temp letdown flow past IXs. from TIC-224 with no established Possible damage to IX resin change in valve position indic. in control room or in the diff. press indic. from PDI-203

41) Ion Exchanger a) false Lo Elect. No direct impact on system None None Differential differential malfunct; operation. Unable to detect Pressure Pres mech malfunct clogged ion exchangers PDI-203 indication b) false Hi. Elect or mech No direct impact on system No change in indic. None Revision 14 diff. pres malfunct. operation when IXs are indication switched. Possible high P alarm NOTE(1) The boronometer is abandoned in-place

Table 9.3.4-3 (Sheet 12 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

42) Isolation Valves; a) fails open Mech. binding No impact on system operation. Operator None CH-407; CH-408 Unable to isolate IX Diff. Pres Indic., PDI-203, for maint b) fails closed Mech. binding Unable to put PDI-203 back on Operator None line after maint

43) Ion Exchangers a) fails open Mech. binding Unable to isolate associated IX Operator Valves, CH-374 and Inlet Isolation for maint or when capacity is not CH-392 for valves CH-383 Valves; CH-369, required and CH-404. For valve CH-383, CH-404 CH-369 letdown flow would have to be diverted past IXs until valve was repaired PVNGS UPDATED FSAR b) fails closed Mech. binding Unable to place associated IX in Operator None service

44) Ion Exchangers a) fails closed Mech. binding Same as 43 b) Operator None Inlet Check Valves; CH-370, 9.3-180 CH-384, CH-403 b) fails open Mech. binding No impact on system operation. None Inlet isolation valves Possible release of gas to CH-369, CH-383, and letdown line during flush and CH-404, respectively drain of associated IX

45) Ion Exchanger a) fails closed Mech. binding Unable to add new resin to Operator None Resin Addition associated IX Valves; CH-372, CH-387, CH-402 b) fails open Mech. binding No impact on system operation. Operator None Valve would be repaired before PROCESS AUXILIARIES IX would be returned to service

46) Ion Exchanger a) fails closed Mech binding Unable to vent associated IX to Operator None Vent Valves; gaseous waste management CH-377, system (GWMs) during flush CH-386, and drain. No impact on system CH-401 operation b) fails open Mech binding No impact on system operation. Operator None Valve would be repaired before IX returned to service Revision 14

Table 9.3.4-3 (Sheet 13 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

47) Ion Exchanger a) fails closed Mech binding Unable to place associated IX in Operator None CH-382 can be used to Discharge service isolate PIX #1.

Isolation Valves; CH-378, CH-389, CH-398 b) fails open Mech binding Unable to isolate associated IX Operator None

48) Ion Exchanger a) fails closed Mech binding No direct impact on system Operator None Resin Drain operation. Unable to flush resin Valves; CH-380, from associated IX CH-391, CH-400 b) fails open Mech binding No direct impact on system Operator None PVNGS UPDATED FSAR operation. Unable to refill associated IX with new resin until valve repaired

49) Ion Exchanger a) fails closed Mech binding Unable to drain or flush Operator None Drain and flush associated IX 9.3-181 Valves; CH-379, CH-390, CH-399 b) fails open Mech binding No impact on system operation. Operator None Valve would be repaired before returning IX to service

50) IX Drain and a) fails closed Mech. binding Unable to drain IXs to drain Operator None Flush Header to header. No impact on normal Drain Header system operation Isolation Valve; CH-377 b) fails open Mech. binding No impact on system operation Operator None PROCESS AUXILIARIES IX flush water diverted to drain header during resin sluicing

51) Purification Ion a) fails open Mech. failure Unable to establish effective Operator PIX 2 can be used Exchanger (PIX) series flow through PIX's 1 and independently if lithium 1 and 2 Outlet 2 removal required Cross-connect, CH-382 b) fails closed Mech. failure Unable to re-establish Operator PIX 2 is capable of full independent flow thru PIX 1 spectrum ion removal

52) PIX 2 to a) fails open Mech. failure Unable to establish series flow Operator None if lithium removal Revision 14 Deborating Ion thru PIX(s) and DIX required. Otherwise, Exchanger (DIX) series flow can be Outlet Cross- established thru PIX 1 and Connect Valve, DIX CH-395

Table 9.3.4-3 (Sheet 14 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mech. failure Unable to re-establish Operator None independent flow thru PIX 1 and 2

53) PIX Series Flow a) fails closed Mech. failure Unable to establish PIX 1/PIX 2 Operator Can establish PIX 2/PIX 1 Cross-over series flow series flow using valve, Valve CH-381 CH-385 b) fails open Mech. failure Partial diversion of letdown flow Operator Other manual valves if either PIX is being used provide adequate isolation independently to prevent flow diversion

54) PIX Series Flow a) fails closed Mech. failure Unable to establish PIX 2/PIX 1 Operator PIX 1/PIX 2 series flow can Crossover Valve, series flow be established using valve CH-385 CH-381 PVNGS UPDATED FSAR b) fails open Mech. failure Letdown flow diverted past Operator Return to PIX 2/PIX 1 This failure could occur PIX's if PIX 1/PIX 2 series flow series flow or, for only when transferring is in progress. Letdown flow independent use of PIX 1, from PIX 2/PIX 1 series diverted past PIX 1 if it is being other isolation valves flow to another flow used independently provide adequate isolation. configuration 9.3-182

55) PIX 1, PIX 2 Inlet a) fails closed Mech. failure Unable to establish independent Operator PIX 1/PIX 2 series flow Crossover flow through PIX 2 or DIX, or config. can be used unless Isolation Valve, PIX 2/PIX 1 series flow PIX 1 plugged CH-374 configurations b) fails open Mech. failure Unable to establish PIX 1/PIX 2 Operator PIX 2/PIX 1 series flow can series flow be established, or PIX 1 or 2 can be used independently (using PIX 1 independently requires additional manual value operation)

PROCESS AUXILIARIES

56) PIX 2, DIX Inlet a) fails closed Mech. failure Unable to establish independent Operator Alternate flow path can be Crossover flow thru DIX manually aligned Isolation Valve; CH-392 b) fails open Mech. failure Unable to establish series Operator None if lithium removal configurations PIX 1/PIC 2/DIX, required, otherwise series or PIX 2/DIX flow can be established thru PIX 1 and DIX with additional manual valve operation

57) PIX 2 Outlet to a) fails closed Mech. failure Unable to establish series flow Operator None if lithium removal Revision 14 DIX Inlet Cross- thru PIX 2 and DIX required, otherwise series over Isolation flow can be established Valve; CH-394 thru PIX 1 and DIX b) fails open Mech. failure Diversion of letdown flow if in Operator Other manual valves any IX config. other than provide adequate isolation PIX/DIX series flow capability

Table 9.3.4-3 (Sheet 15 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

58) Purification Ion fails to remove Resin Buildup in RCS activity PRM Hi activity alarm, Redundant IXs except for Exchangers; contamination exhausted sample analysis for lithium removal. IXs can PIX 1, PIX 2 radioactivity be bypassed for resin replacement

59) Deborating Ion fails to remove Resin Decreased boron removal Sample analysis for Continue feed and bleed Exchanger, DIX boron exhausted capability at end of life. Unable boron, decrease in while restore DIX resin to maintain power at end of core power.

cycle

60) Letdown Strainer a) plugged Contaminant Reduced letdown flow Hi diff pres alarm from IXs and strainer can be buildup PDI-203 bypassed while strainer element replaced b) fails to Element Possible deposition of particles Lo diff pres. indic from Same as above strain "punch and resin in VCT. Possible PDI-203, sample PVNGS UPDATED FSAR properly through", contam. of charging pumps analysis wrong size element c) external Mfg. defect, Primary coolant released Local leak detectors, Same as above 9.3-183 leakage corrosion outside containment radiation monitors

61) Isolation Valve; a) fails open Mech. failure Unable to isolate letdown Operator None CH-415 strainer for maint.

b) fails closed Mech. failure Unable to restore letdown flow Operator None through IXs and letdown strainer after maint. on letdown strainer

62) Letdown Strainer a) fails closed Mech. failure No impact on system operation. Operator None Drain Valve, Unable to drain letdown strainer CH-419 for maint.

b) fails open Mech. failure Part of letdown flow diverted to VCT level indications, None SRS. VCT level decreases operator

63) Check Valve a) fails open Mech. failure No impact on system operation None None PROCESS AUXILIARIES CH-396 b) fails closed Mech. failure Unable to route shutdown Lo flow indications Purification during cooling flow through IXs for from FI-202, and flow shutdown cooling can be purification indicator in SDCS accomplished via normal letdown and charging

64) Discharge Valve a) fails closed Mech. failure Same as 63 b) Operator Same as 63 B) to SDCS; CH-397 Revision 14 b) fails open Mech. failure Diversion of letdown flow to Operator, VCT level Series redundant isolation SDCS during normal operation. indications valve in SDCS VCT level decrease

65) Isolation Valve, a) fails closed Mech. failure No impact on system operation. Operator None CH-414 Unable to get a differential pressure reading across just the IXs

Table 9.3.4-3 (Sheet 16 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails open Mech. failure Unable to transfer PDI-203 from Operator None reading diff. pres across IXs and letdown strainer

66) Letdown Line a) fails open Mech failure No impact on system operation. Operator Series redundant isolation Sample Valves; Unable to isolate affected valves in sampling system CH-426, sample line (SS)

CH-353, CH-420 b) fails closed Mech. failure Unable to obtain sample at Operator None Sample valves are specified point normally open

67) Letdown Line a) fails closed Mech. binding, No impact on system operation. High pressure alarm None Safety Valves; blockage Loss of over pres. protection for from P-201 and P-220 CH-345, CH-354 potentially closed line section respectively, on PVNGS UPDATED FSAR demand. Periodic tests b) fails open Broken spring, Letdown flow diverted to VCT and EDT level None 9.3-184 setpoint drift equipment drain tank (EDT) indications, Lo flow indication from FI-202 Lo pressure alarm P-201, P-220

68) Letdown Line a) fails closed Mech. failure No impact on system operation. Operator None Test Connection Unable to drain line section or CH-853, CH-855 test valves per ASME OM Code.

b) fails open Mech. failure, Possible loss of primary coolant None These drain valves/test seat leakage conn. blind flanged

69) VCT Bypass a) fails open Mech. failure Unable to isolate VCT bypass Operator Valve CH-415 and CH-520 Valve Isolation valve, CH-500, for maint. No can be used Valve; CH-418 impact on normal system PROCESS AUXILIARIES operation b) fails closed Mech. failure, Unable to reestablish letdown Operator None binding flow after maint. on CH-500

70) VCT Bypass a) fails to Valve operator Unable to divert letdown flow to Hi VCT level None. Letdown would Letdown not required for Valve; CH-500 VCT malfunct., pre-holdup ion exchangers indications/alarm from have to be terminated to safe shutdown.

Mech. failure, (PHIX) during feed and bleed LIC-226 or LIC-227. repair valve Revision 15 Loss of air or operations or for degassing of letdown flow b) fails to the Operator Decreasing VCT level during Low VCT level alarms Makeup system will Note: Normal letdown PHIX error, spurious normal charging and letdown from LIC-227 and maintain VCT level. and charging could position signal operations. Excessive amounts LIC-226 excessive Letdown would have to be continue via the gas of primary coolant diverted for use of boric acid terminated to repair valve stripper boron reclamation make up

71) VCT Inlet Check a) fails open Mech. binding No impact on normal system None None Valve, CH-101 operation. Unable to perform maintenance on CH-500 with pressure in VCT.

Table 9.3.4-3 (Sheet 17 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mech. binding, Unable to establish normal Low flow indication Continuous bypass to the mech. failure letdown flow to VCT. PZR level from FI-202, Hi pres PHIX with return to VCT blockage increases, VCT level decreases indic from PI-220, can be used, but letdown VCT and PZR level would have to be alarms terminated and the valve repaired before normal letdown and charging could resume.

72) Gas Stripper a) fails closed Mech. binding Unable to establish return flow VCT level alarms, None (GS) to VCT blockage from GS to VCT. Loss of possibly Lo flow indic Inlet Check continuous degasification from FI-202, and Hi Valve, CH-139 capability for letdown flow. VCT pressure indic from level decrease during PI-220 PVNGS UPDATED FSAR continuous degasification. No impact on normal operation b) fails open Mech. binding Possible diversion of letdown VCT Lo Level None This failure mode is 9.3-185 flow to GS discharge line. indications unlikely Unable to perform maintenance on CH-567 with pressure in VCT.

73) H2 Supply Valve a) fails open Mech. binding No impact on normal system Operator None Isolation Valves operation. Unable to isolate CH-107, CH-108 VCT H2 supply valve for maint.

b) fails closed Mech. failure Unable to re-establish H2 supply Operator O2 control can be to VCT. Loss of 02 control for maintained by H2 injection primary coolant into the charging line

74) VCT H2 Supply a) regulates Mech. mal- Decreased H2 pres. in VCT and Low VCT pressure Same as above Valve, CH-502 VCT pres. funct. Elect. indication/alarm from PROCESS AUXILIARIES RCS, partial loss of RCS 02 low malfunct. PI-225 control mech. binding b) regulates Elect. or Increased H2 pres. in VCT. Hi VCT pres. alarm Relief valve, CH-105 will CH-502 can be isolated VCT pres mech. possible overpressurization of from PI-225 keep H2 addition header and 02 control can be Hi. malfunct. pres. down. VCT can be VCT and increased H2 concen- maintained by H2 vented to GRS Revision 15 tration in RCS injection into the charging line.

75) H2 Flow a) Erro- Elect. or No impact on system operation. Operator None indicator, FI-206 neously H2 mech. Local readout only flow malfunct.

indications

76) VCT N2 Supply a) fails closed Mech. binding No impact on normal operation. Operator None Valve Isolation Unable to purge VCT with N2 CH-109, CH-644 during shutdown b) fails open Mech. binding Unable to isolate N2 supply Operator Series redundant valve purging VCT

Table 9.3.4-3 (Sheet 18 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

77) VCT N2 Supply a) regulates Elect. or No impact on normal operation. Lo pres alarm from None Valve, (CH-503) pressure mech. Insufficient N2 supply to VCT PI-225 low malfunction during purge. Incomplete VCT purge b) regulates Elect. or Possible overpressurization Hi pres alarm from Vent control valve will open pressure mech. while purging VCT. No impact PI-225 to maintain VCT pres.

high malfunction during normal operation Valve CH-105 provides overpres. protection for gas supply header

78) N2 Flow Rate erroneous Elect. or No impact on system operation. Operator None Indicator, FI-215 flow indi- mech. Local indication only cations malfunction PVNGS UPDATED FSAR

79) Gas Supply a) fails closed Mech. binding, No impact on normal operation. None None Header Safety blockage Loss of overpressure protection Valve; CH-105 for gas supply header 9.3-186 b) fails open Mech. failure H2 or N2 diverted to GRS. Possibly Hi pres High pressure H2 injection setpoint drift alarms from GRS into charging line is backup Possible decrease in H2 otherwise none. source concentrate, in RCS and increase in RCS 02 concentration

80) Gas Supply a) fails closed Mech. binding, Unable to add H2 (or N2) to RCS sampling. H2 injection into charging Header Check blockage Possibly, Lo pres line VCT, H2 concentration in RCS Valve; CH-112 alarm from PI-225 decreases and RCS O2 concentration increases, possible VCT press. decrease b) fails open Mech. binding No impact of normal operation. None None mech. failure Possible diversion of radioactive PROCESS AUXILIARIES gasses to GRS or H2 supply

81) Gas Supply a) fails open Mech. binding No impact on system operation. Operator None Header Isolation Unable to isolate gas supply Valve; CH-645 header for maintenance b) fails closed Mech. failure, Unable to add H2 (or N2) to Operator H2 injection into charging Revision 15 mech. binding lines VCT. Decrease in RCS H2 concentration and Increase in RCS 02 concentration

82) Gas Analyzer a) fails open Mech. binding No impact on system operation. Operator None Isolation Valve, Unable to isolate gas analyzer CH-104 for maintenance b) fails closed Mech. binding No impact on system operation. Operator None Unable to sample VCT with gas analyzer.

Table 9.3.4-3 (Sheet 19 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

83) VCT Pressure a) spurious Elect. or No Direct impact on system Hi pressure alarms H2 supply valve will Indicator, PI-225 high mech. operation. Operator may vent from PI-225 with maintain VCT pres.

pressure malfunct. VCT, resulting in Lo VCT pres normal H2 flow alarms and excessive use of H2 indication from FI-206 (local readout only) b) spurious Elect. or No direct impact on system Lo pres alarm from Same as above low pres mech. operation PI-225 with normal H2 alarms malfunct. flow indic. from FI-206 (local readout only)

84) VCT Vent Line a) fails closed Mech. fail Unable to vent VCT to GRS Valve position N2 supply valve should Control Valve Loss of air or during purge. Possible indicator in control prevent overpres. of VCT CH-513 power overpres. of VCT during purge. Rm. Hi pres. indic. by closing PVNGS UPDATED FSAR No impact on normal indication from PI-225 b) fails open Spurious For spurious signal: unwanted Lo pres. alarm from Manual isolation valve, HC signal mech. venting of VCT, loss of VCT PI-225, valve position can be closed. H2 supply 9.3-187 malfunct. pres. decreased H2 concen- indicator in control valve (or N2 supply valve) tration in RCS with increased room. Valve position will maintain VCT pressure indicator in control RCS O2 concentrat. for mech.

room malfunct. Unable to terminate venting of VCT during purge

85) VCT Vent Line a) regulates Elect. or No impact on normal operation. Lo pres. alarm from None Pressure pressure mech. Excessive use of N2 during NCT PI-225, Hi N2 flow Regulator, Hi malfunct. purge indic. from FI-215 CH-643 (local readout only) b) regulates Elect. or No impact on normal system Hi pres alarm from None pres. Lo mech. operation. During VCT purge PI-225, Lo N2 flow malfunct. VCT pres. too high and the N2 indic. from FI-215 PROCESS AUXILIARIES supply valve will close to (local readout only) counteract VCT pres. increase.

Incomplete VCT purge

86) Vent Line a) fails open Mech. failure No impact on normal operation. Operator None Isolation Valves Unable to isolate vent line for CH-100 maint.

Revision 15 b) fails closed Mech. failure No impact on normal operation. Operator None Unable to vent or purge VCT

87) Reactor Coolant a) fails closed Hi or Lo spring Loss of controlled seal bleedoff Flow and pressure None Associated RCP must Pump Controlled tension, for reactor coolant pump (RCP). indicators on bleedoff be shut down Bleedoff Excess plugged, Possible damage to RCP seals lines Flow Check mech. failure due to overpressurization of Valves, CH-301, seals CH-302, CH-303, CH-304

Table 9.3.4-3 (Sheet 20 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

88) Pressure a) erroneous Elect. or No direct impact on system Hi pres alarms from Redundant instruments on PI-215 is used to Indicator, PI-215 high or mech. failure, operation. Erroneous indication PI-215 with normal bleedoff lines inside determine bleed-off high-high setpoint drift of loss of controlled bleedoff readings from all containment throttle valve setting pressure flow. other bleedoff line during startup. Once alarms instruments throttle valve is set it is rarely changed.

b) false Lo Elect. or No direct impact on system Bleedoff line None pressure mech. operations. Loss of bleedoff instrumentation Indications malfunction header pres. indication needed for setting throttle valve during startup

89) RCP Controlled a) fails in Mech. failure No impact on normal operation. Valve position Redundant isolation valve PVNGS UPDATED FSAR Bleedoff Line open Loss of redundant isolation indicator in control Containment position capability for bleedoff lines on room Isolation Valves; CIAS CH-506, 9.3-188 CH-505.

b) fails to Loss of air or Sudden loss of normal RCP Valve position CH-199 will lift, directing closed power, controlled bleedoff flowpath. indicator in control bleedoff flow to reactor position spurious Safety valve CH-199 will lift room, Hi pres alarm drain tank (RDT).

signal, mech. from bleedoff line failure instrumentation

90) RCP Controlled a) fails in Loss of air or No impact on normal operation. Valve position None Bleedoff Relief open power, mech. Unable to isolate relief valve if indicator in control Valve Stop position failure relief valve starts to leak room on valve Valve; CH-507 demand b) fails closed Spur signal, No impact on normal operation. Valve position Normal controlled bleedoff mech. failure Loss of backup controlled indicator in control via CH-505, CH-506 PROCESS AUXILIARIES bleedoff flow path. room

91) RCP Controlled a) fails open Mech. failure Controlled bleedoff flow diverted Lo pres indication Valve CH-507 can be Bleedoff Header to RDT from PI-215, temp. closed to isolate CH-199 Relief Valve; pres. and level CH-199 indications on RDT b) fails closed Mech. failure No impact on system operation. Periodic Test Normal controlled bleedoff Revision 14 blockage Loss of backup controlled via CH-505, CH-506 bleedoff flow path

92) Controlled a) fails closed Mech. failure Unable to establish controlled Operator Backup controlled bleedoff Startup delayed until Bleedoff Throttle bleedoff flow to VCT on startup flow path via CH-199 valve repaired.

Valve; CH-198 b) fails open Mech. binding Unable to throttle controlled Operator None Throttle valve is set bleedoff flow properly during startup, and is rarely changed during operation

Table 9.3.4-3 (Sheet 21 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

93) Controlled a) fails closed Mech. binding Unable to establish controlled Hi pres alarm from Backup controlled bleedoff Bleedoff Line blockage bleedoff flow to VCT during PI-215 flow path via CH-199 Check Valve; startup CH-646 b) fails open Mech. failure No impact on normal operation. None Excess flow check valves Possible reverse flow in bleedoff will be closed during line during shutdown if VCT is at shutdown higher pressure than bleedoff lines

94) Controlled a) fails closed Mech. failure No impact on normal operation. Operator None Bleedoff Line Unable to drain bleedoff line for PVNGS UPDATED FSAR Test Connec- one pump or inservice test tions, CH-740, CH-505 or 506 CH-741, CH-742, CH-743 9.3-189 b) fails open Seat leakage, Possible loss of primary coolant Local leak detectors Valves are all blind flanged mech. failure inside containment containment radiation monitors. Bleedoff line flow indicators

95) Primary Sample a) fails closed Mech. failure No impact on normal operation. Operator None Purge Check blockage Unable to purge primary sample Valve; CH-197 system before obtaining primary sample

96) VCT a) spurious Elect. or No direct impact on system Hi temp alarm from None Temperature Hi temp mech. failure, operation. False indication of Hi TI-225, with normal Indicator, TI-225 alarms setpoint drift temp in VCT pressure and temp.

Indication from PROCESS AUXILIARIES letdown, charging, and controlled bleedoff instruments b) false lo Elect. or No impact on normal operation. Periodic test None temp. mech. failure, Unable to detect Hi temp indications setpoint drift condition in VCT

97) VCT Level a) spurious Elect or mech Possible overfilling of VCT due Excessive use of LIC-227 will alarm on Hi Excessive use of Revision 14 Indicator/ low level failure setpoint to actuation of automatic makeup. Diversion level and divert letdown makeup and excessive Controller indication drift makeup. Letdown diverted to valve position flow to PHIX to prevent generation of liquid LIC-226 and alarm PHIX on High level in VCT indicator in control overfilling VCT waste room, in combination with Lo level alarm from LIC-226 b) spurious Elect or mech Early termination of makeup Hi level alarm from On Lo-Lo VCT level, Hi level failure, flow, RCS losses not LIC-226 with diversion LIC-227 will switch indication setpoint drift compensated for. Possible PZR valve not changing charging pump suction to and alarm level decrease. Gradual position refueling water tank (RWT) emptying of VCT

Table 9.3.4-3 (Sheet 22 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects

98) VCT Level a) spurious Elect. or VCT will be isolated and Lo Level alarm from CH-115 will relieve, if Controller, Lo level mech. charging pump suction aligned LIC-227 with normal necessary LC-227 alarms malfunction to RWT. VCT will be overfilled or Hi level indic. from setpoint drift because letdown will not be LIC-226 diverted b) spurious Elect. or Letdown flow will be diverted to Hi level alarm from LIC-226 will initiate Hi level mech. PHIX and holdup tank, VCT will LIC-227 with normal automatic makeup on Lo alarms malfunction start to empty or low level level.

setpoint drift indications from LIC-226

99) Volume Control a) breach Weld failure, Loss of primary coolant outside Low level alarms from None Operator action required Tank mfg defect containment LIC-226 and LIC-227. to terminate this event.

PVNGS UPDATED FSAR Local leak detectors VCT not required for safe shutdown.

100) VCT Discharge a) fails closed Blockage. No impact on normal operation. Periodic test None Relief Valve; mech. failure Loss of overpressure protection 9.3-190 CH-115 for VCT and VCT discharge line b) fails open Mech. failure Minor losses of primary coolant EDT level indications, Makeup system to equipment drain tank (EDT). possibly VCT level compensates for minor Possible trip of charging pumps indicator LIC-226, coolant losses. LIC-227 on low suction pressure possible charging will switch charging pump pump trouble alarm. suction to RWT via BAMP on low low level in the VCT 101) VCT Discharge a) fails closed Mech. failure No impact on normal operation. Operator None Local Sample Unable to sample VCT contents Valve, CH-116 b) fails open Seat leakage Minor loss of primary coolant Local leak detectors, None outside containment radiation monitors PROCESS AUXILIARIES 102) VCT Drain Valve a) fails closed Mech. failure No impact on normal operation. Operator Other drain valves CH-117 mech. binding Unable to drain VCT available downstream b) seat Contamination Minor loss of primary coolant to Possibly low level None leakage mech. drain header indications from damage LIC-226 103) VCT Discharge a) fails open Mech. failure Unable to isolate VCT on low Valve position LIC-227 will switch Revision 14 Isolation Valve, loss of power level signal from LIC-227. indication in control charging pump suction to CH-501 Possible emptying of VCT. room RWT via boric acid Possible charging pump trip on makeup pumps (BAMP) on low suction pressure with loss of Lo-Lo level in the VCT charging flow b) fails to Mech. failure, Sudden loss of charging flow. VCT and PZR level None Charging Pump Suction closed spur signal PZR level decreases, loss of indicators, charging can be switched to RWT position letdown due to high temp. trip pump trip indications by opening valve (TIC-221) of CH-515 CH-514 and starting BAMP

Table 9.3.4-3 (Sheet 23 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects c) fails in Mech. failure, Unable to switch charging pump Valve position Charging pump can still be Valve normally aligned closed loss of power suction back to VCT indicator in control aligned to RWT to VCT position room 104) VCT Discharge a) fails open Mech. failure No impact on normal operation. None Valve CH-501 will be Check Valve; Possible leakage into VCT when closed when charging CH-118 charging pumps taking suction pumps taking suction from from RWT via BAMP RWT b) fails closed Mech. failure, Unable to switch charging pump Charging pump trip, Charging pumps can still mech. binding, suction back to VCT. Possible VCT level indications be aligned to RWT blockage charging pump trip on Lo suction pres.

105) Charging Pump a) fails open Mech. binding Unable to isolate one charging Operator None PVNGS UPDATED FSAR Isolation Valves, pump for maint. No impact on CH-316, normal operation CH-339, CH-319, 9.3-191 CH-337, CH-322, CH-335 b) fails closed Mech. binding, Unable to return charging pump Operator Redundant charging blockage to service after maint. pumps 106) Charging Pump a) fails closed Mech. binding, No impact on normal operation. Operator Some redundance Drain Valves; blockage Unable to drain pump for maint. between suction and CH-317, discharge drain valves CH-329, CH-320, CH-332, CH-323, PROCESS AUXILIARIES CH-336 b) seat Contamina- Minor loss of primary coolant to Possibly Hi level Makeup system leakage tion, Mech. recycle drain header indications from EDT, compensates for minor damage or low level indic. from coolant losses VCT 107) Charging Pump a) fails open Mech. failure No impact on normal operation. None Charging pump discharge Discharge Check Possible reverse flow into relief valves provide Revision 14 Valves; CH-328, standby pump. Possible overpressure protection CH-331, CH-334 damage to pump b) fails closed Mech binding Unable to use affected charging Charging line flow Redundant charging blockage pump. Possible pump damage indicator, Lo flow pumps. Charging pump due to dead heading indication discharge relief valves provide recirculation for charging pumps 108) Charging Pump a) fails open Mech. failure, Charging pump discharge Lo flow indication Redundant charging Discharge Relief setpoint drift diverted to charging pump from charging line pumps Valves; CH-326, suction. Reduced charging flow flow indicator, FI-212 CH-325, CH-324 from affected pump

Table 9.3.4-3 (Sheet 24 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mech. binding No impact on normal operation. Periodic test None blockage Loss of discharge overpressure protection.

109) Charging Pump a) fails closed Mech. failure, No affect on normal system Periodic test None Suction Relief blockage operation. Loss of overpressure Valves; CH-315, protection for potentially closed CH-318, CH-321 suction line b) fails open Setpoint drift Loss of primary coolant to EDT. EDT level indications, Makeup System spring failure Gradual VCT level reduction VCT level indications Compensates for minor coolant losses 110) Charging Pump, a) erron- Mech. failure, Spurious charging pump trip Charging pump trip Redundant charging PVNGS UPDATED FSAR Suction Pressure eously setpoint drift indications. Low flow pumps Switches; senses Lo indication from PS-216, PS-217, press. FI-212, PZR and VCT PS-218 level indic.

b) senses Mech. failure, No impact on normal system Periodic test None 9.3-192 pressure setpoint drift operation. Failure to sense Lo too high point drift suction pressure. Possible cavitation damage to charging pump 111) Charging Pumps a) operating Loss of power, Reduced charging flow, VCT Lo flow alarm from PZR level control will start Normally two pumps are (CP) CP-1, pump seizure, other level increase, PZR level FI-212, VCT and PZR standby CP always running.

CP-2, CP-3 stops mech. failure decrease. Letdown temp. level indications, increases letdown temp indications b) standby Loss of power Unable to deliver maximum Lo PZR level alarm Letdown Control Valves pump fails mech. failure charging flow when needed. CP run indicator CH-110P, Q modulate PROCESS AUXILIARIES to start PZR level drop. Possible SIAS letdown flow to maintain if PZR empties PZR level.

c) spurious Spurious Excess charging flow, PZR level CP run indicator, Hi PZR level control could startup of signal, increase, possible overpres. of flow indication from shut down one pump, or standby operator error RCS FI-212, PZR level and open letdown control valve pump pres. alarms further. PZR spray would come on to hold pres.

Revision 14 down 112) Charging Pump a) fails closed Mech. binding Unable to test HPSI check Operator Any one of the three CP's to HPSI Header valves or to establish alternate can be used through the Isolation Valves; charging path using associated associated valve CH-796, CP CH-797, CH-798 b) fails open Seat leakage Part of charging flow routed Lo flow indication Series redundant isolation through HPSI header from FI-212, flow valve in the SI System indications from HPSI indicators

Table 9.3.4-3 (Sheet 25 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 113) Charging Pump a) fails closed Mech. failure No impact on normal operation. No flow through HPSI None to HPSI Header blockage Unable to use charging pumps check valves during Check Valve; to test HPSI check valves or to test and subsequent CH-440 establish alternate charging check valve inspec.

path.

b) fails open Mech. failure No impact on normal operation. None Series isolation valves are Possible diversion of HPSI flow normally closed to charging pumps during safety injection 114) Hydrostatic Test a) fails closed Mech. failure No impact on normal system Operator None Connect. operation PVNGS UPDATED FSAR Isolation Valves; CH-314, CH-642 b) seat Contamination Minor loss of primary coolant Local leak detectors Test connections are blind leakage mech. outside containment flanged damage 9.3-193 115) Charging a) spurious Elect. or No direct impact on system Low pres. alarm from None Pressure Lo pres. mech. failure operation. False indication of PI-212 with normal Indicator, PI-212 alarm charging pump degradation or indications from charging line break FI-212, TI-229, and PDIC-240 b) erroneous Elect. or No impact on system operation Periodic test FI-212 will provide Hi or mech. failure failure to detect CP degradation indication of CP normal or charging line break degradation or charging pres. line break indication PROCESS AUXILIARIES 116) Charging Flow a) spurious Elect. or No direct impact on system Lo flow alarm with None Indicator FI-212 Lo flow mech. failure operation normal indication from alarms setpoint drift PI-212, and stable PZR level b) erroneous Elect. or No impact on system operation. Periodic test, charging None Hi or mech. failure Failure to detect decreased pump run indicator normal setpoint drift charging flow flow Revision 14 indications 117) H2 Inject. a) fails closed Mech. binding, No impact on normal operation. Operator H2 concentration normally Isolation Valves, blockage Unable to inject H2 directly into maintained by H2 blanket CH-436, CH-828 charging line in VCT b) fail open Mech. failure Unable to terminate H2 injection Operator Redundant isolation valves directly into charging line 118) H2 Inject. Check a) fails closed Mech. failure, No impact on normal operation. Lo flow alarm from Same as 117 a)

Valve, CH-827 blockage Unable to inject H2 directly into FI-207 charging line

Table 9.3.4-3 (Sheet 26 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails open Mech. binding No impact on normal operation. None Manual isolation valves Possible diversion of charging CH-436, CH-828 flow to H2 header 119) H2 Inject. Flow a) spurious Elect. or No impact on normal operation. Alarm and RCS None H2 blanket in VCT is Indicator, FI-207 Hi flow mech. Incorrect indication of H2 sample analysis for preferred method of H2 alarms malfunct. addition rate H2 concentration control in setpoint drift RCS b) spurious Elect. or Same as above Same as above Same as above Same as above Low flow mech.

alarms malfunction, PVNGS UPDATED FSAR setpoint drift 120) Charging Line a) fails open Mech. binding No impact on normal operation. Operator Valve, CH-524 can be Manual Isolation Unable to isolate charging line closed Valve; CH-429 for maint. or for alternate path charging thru HPSI header 9.3-194 b) fails closed Mech. binding Unable to reestablish charging Operator Alternate charging path flow thru normal path thru HPSI header 121) Charging Line a) fails open Mech. binding, No impact on normal operation. Valve position Manual isolation valve, Handwheel on valve can Isolation Valve; valve operator Unable to isolate charging line indicator in control CH-429 be used to close valve if CH-524 failure, loss of for maint. or alternate path room, flow indicator, operator malfunction.

power charging thru HPSI header FI-212 b) fails closed Mech. binding, Unable to reestablish charging Valve position Alternate path charging valve operator thru normal path; if this occurs indicator in control thru HPSI header failure during normal operation the chg. room, flow indicator, pump disch relief will lift. FI-212 122) Test Connection a) fails closed Mech. binding No impact on normal operation. Operator None PROCESS AUXILIARIES CH-854 Unable to test charging line isolation valves IAW ASME XI.

b) seat Contamina- Minor loss of primary coolant Local leak detectors Drain line is blind flanged leakage tion, mech. outside containment damage 123) Temperature erroneous Elect. or No impact on system operation Periodic test None Indicator, TI-229 temperature mech. TI-229 has no control function Revision 14 indications malfunct.,

setpoint drift 124) Auxiliary Spray a) fails closed Mech. binding, No impact on normal operation. Valve position Redundant valves from Cold shutdown can be Valves; CH-203, valve operator Unable to use the charging indication in control separate power supplies achieved without CH-205 failure, loss of pumps to provide aux. PZR room auxiliary spray.

power spray for PZR pres. control during plant shutdown b) fails open spurious Excess PZR spray flow, Valve position None PZR heaters will come signal, resulting in reduction of RCS indicators in control on to maintain PZR pres operator error pres. room

Table 9.3.4-3 (Sheet 27 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 125) Charging Line a) fails closed Mech. failure, Sudden loss of charging flow, VCT and PZR level Alternate charging path Pressure Control spurious VCT level increases, PZR level indications, Lo flow through HPSI header.

Valve, CH-240 signal decreases. Pressure increases alarms from FI-212, Spring check valve CH-435 in charging line Hi pres indic. from will open to maintain PI-212 charging flow b) regulates Valve operator Short term decrease in RCP Lo flow indications or Seal injection flow control back malfunction, seal injection flow and increase alarms from seal valves will open to pressure mech. binding in charging flow injection flow increase flow, thereby too low indicators. Lo delta reestablishing flow balance pres. indication or PVNGS UPDATED FSAR alarm from PDIC-240 c) regulates Valve operator Short term increase in RCP seal Hi flow indications or Seal injection flow control back malfunction, injection flow and decrease in alarm from seal valves will close to limit pressure mech. binding charging flow. Increase in injection flow flow. Spring check valve too high partial charging line pres. indicators. Hi delta CH-435 will open to blockage pres. indication or maintain charging flow if 9.3-195 alarm from PDIC-240 necessary.

126) Auxiliary Spray a) fails closed Mech. binding, No impact on normal operation. Lo flow indication None Plant can be brought to Line Check blockage Unable to provide aux. PZR from FI-212, PZR cold shutdown without Valve; CH-431 spray for PZR pressure control pres., not decreasing. auxiliary spray.

during plant shutdown b) fails open Mech. failure Diversion of PZR spray flow to PZR pres. indicators Aux. spray valves CH-203 charging line. Possible PZR and CH-205 are closed pres. increase during normal operation 127) Differential a) spurious Elect. or PDIC-240 will drive CH-240 Hi flow alarms from Seal injection flow control Pressure Lo diff. mech. closed trying to maintain a DP of seal injection flow valves will maintain seal PROCESS AUXILIARIES Indicator/ pres malfunct., 30 lbs. seal injection flow will indicators, Hi pres inject. flow. Spring check Controller; readings setpoint drift increase, charging line pressure indic. from PI-212, valve, CH-435 will open to PDIC-240 will increase CH-240 position maintain charging flow if indicator necessary.

b) spurious Elect. or PDIC-240 will drive CH-240 Low flow alarms from Seal inject flow control Hi diff mech. open trying to maintain proper seal inject flow indic., valves will open to press. malfunct., DP. Charging flow will increase Lo pres. indic. from maintain seal inject flow, reading setpoint drift and seal injection flow will PI-212, CH-240 thereby reestablish Revision 14 decrease position indic. charging flow balance 128) PDIC-240 a) fails open Mech. binding No impact on system operation. Operator None Isolation Valves; Unable to isolate PDIC-240 for CH-405, CH-406 maint b) fails closed Mech. binding Unable to place PDIC-240 back Operator None in service after maint 129) Spring Check a) fails closed Mech. failure, No impact on normal operation. None None Valve; CH-435 blockage Loss of pressure surge protection for charging line and CH-240

Table 9.3.4-3 (Sheet 28 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails open Mech. binding Charging flow diverted past Low flow alarms from Seal inject flow control CH-240. Short term reduction in seal inject flow indic., valves will open to seal inject. flow Lo DP alarm from maintain seal inject. flow.

PDIC-240 CH-435 can be isolated using valve, CH-434 130) Isolation Valve, a) fails open Mech. binding No impact on normal operation. Operator None CH-434 Unable to isolate spring check valve, CH-435 b) fails closed Mech. failure Same as 129 a) Operator None 131) Charging Line a) fails closed Mech. binding, Unable to establish charging Lo flow indic. from Alternate charging path Unlikely event since PVNGS UPDATED FSAR Check Valve; blockage flow via normal path FI-212, Lo DP alarm through HPSI header valve is normally open.

CH-433 from PDIC-240 b) fails open Mech. binding No impact on normal operation None None 132) Seal Injection a) fails open Mech. failure, No impact on normal operation. Periodic test, RCP component cooling Steam supply to SIHX Isolation Valve; valve operator Unable to terminate seal CH-231P position flow will provide protection has been flanged off.

CH-231P malfunct., loss injection on Hi-Hi or Lo-Lo seal indication on Hi-Hi or for RCP seals 9.3-196 of air or power injection flow temp. Possible Lo-Lo SIHX outlet damage to RCP seals temp.

b) fails closed Mech. failure, Sudden loss of RCP seal Lo flow alarms from RCP component cooling spurious injection flow. Possible damage RCP seal inject. flow water flow will provide signal to RCP seals indicators protection for RCP seals 133) Seal Injection a) fails open Mech. binding No impact on normal operation. Operator Valve CH-231P and HX Isolation Unable to isolate seal injection CH-255 can be closed Valves; CH-839, heat exchanger (SIHX) for CH-836 maint.

PROCESS AUXILIARIES b) fails closed Mech. failure Unable to reestablish seal inject. Operator None flow after maint on SIHX 134) Vent Valves; a) fails closed Mech. failure No impact on normal operation. Operator None CH-612, CH-613 Unable to vent SIHX during maint.

b) seat Contamina- Minor loss of primary coolant Local leak detectors Series redundant isolation leakage tion, mech. outside containment valves damage Revision 14 135) Seal Injection a) improper VCT or RCS Seal injection temp changes, Hi-Lo temp alarms CH-231P auto closes on Steam supply to SIHX Heat Exchanger, seal makeup temp possible thermal damage to from TSHL-231. Hi-Hi or Lo-Lo seal inject. has been flanged off.

SIHX injection variation RCP seals. temp. NC flow to RCPs Letdown isolates before temp provides adequate seal Hi-Hi seal inject temp cooling without seal inject. occurs. RMWT and RWT have heaters to raise makeup temp.

b) cross Tube Contamination of condensate Hi alarm on RU-7, Aux steam condensate leakage corrosion, with primary coolant. chem analysis, RCS return from SIHX can be If needed, closure of manufact. leak rate test, manually isolated. CH-231P will terminate defect possible low seal leak without damage to injection flow alarms. RCP seals.

Table 9.3.4-3 (Sheet 29 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects Seal Injection c) external Weld failure, Release of primary coolant RCS leak rate test, Manual closure of Heat Exchanger, leakage casing crack outside CTMT. local leak indication, CH-231P will terminate SIHX possible low seal leak without damage to injection flow RCP seals.

indications 136) Relief Valve N/A N/A N/A N/A Relief valves on CHG Steam supply to SIHX CH-865 pumps' discharge provide has been flanged off.

(Component adequate protection. Over-pressure due to PVNGS UPDATED FSAR Removed) high seal injection temp not credible.

137) Temperature a) Spurious Elec/Mech CH-231P auto closes on Hi-Hi Hi-Lo temp alarms NC flow to RCPs provides Steam supply to SIHX Indicator/ Hi-Lo malfunct., or Lo-Lo temp. The resulting from TSHL-231, valve adequate seal cooling has been flanged off.

Controller; indication setpoint drift termination of seal injection may CH- 231P position without seal injection. TIC-231, which TIC-231 possibly damage RCP seals. indication, low flow regulates AS-TV231 in alarms from seal the steam return line, inject. controllers. produces no control action.

9.3-197 b) False Elect. or No impact on normal operation, Periodic tests None indication mech. but possible RCP seal thermal of normal malfunction shock if SIHX discharge temp. is SIHX Hi or Low discharge temp 138) Seal Injection a) plugged Normal Reduced seal injection flow. Hi Delta P alarm from Parallel redundant full Seal inject flow normally Filters, SIF 1, contaminant Possible RCP seal damage PDI-241, Lo flow capacity filters comes from VCT which PROCESS AUXILIARIES SIF 2 buildup alarms from seal has relatively Lo inject. flow indicators particulate concentrations b) doesn't filter Mfg. defect, Contamination of RCP seals, RCS chemistry Parallel redundant filter Same as above properly wrong filter possible seal damage. analysis cartridge Contaminant buildup in RCS 139) SIF Isolation a) fails open Mech. No impact on normal operation. Operator None Valves; CH-816, binding Unable to isolate one SIF for CH-8I8, CH-819, element replacement CH-821 Revision 14 b) fails closed Mech. failure Unable to return filter to service Operator None if other filter needs after element replacement element replacement 140) SIF Drain a) fails closed Mech. failure No impact on normal operation. Operator None Valves; CH-822, Unable to drain filter for element CH-823 replacement b) seat Contamina- Seal injection flow diverted to EDT Level Seal inject. flow control leakage tion, mech. recycle drain header indications, Lo flow valves will open to damage indications from seal maintain seal inject. flow inject. flow indicators rate. Makeup system will compensate for losses

Table 9.3.4-3 (Sheet 30 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 141) Differential a) false Elect. or mech No impact on system operation Periodic test None Pressure indications malfunct.,

Indicator; of Lo Delta setpoint drift PDI-241 pres.

b) false Hi Elect. or No direct impact on system Hi Delta P alarm None Delta P mech. operation. Possible early alarms malfunct., replacement of filter element setpoint drift.

142) PDI-241 a) fails open Mech. binding No impact on normal operation. Operator None Isolation Valves; Unable to isolate PDI-241 for PVNGS UPDATED FSAR CH-825, CH-826 maint b) fails closed Mech. failure Unable to return PDI-241 to Operator None service after maint 143) Local Drain a) fails closed Mech. binding No impact on normal operation. Operator None Valves; CH-833, Unable to drain affected line CH-834, section or test isolation valves 9.3-198 CH-848, IAW ASME OM Code.

CH-849, CH-859, CH-860 b) seat Contamina- No impact on system operation None Drain lines are blind leakage tion, mech. flanged damage 144) Seal Injection a) fails closed Spurious Same as 132 b) Same as 132 b) Same as 132 b) Same as 132 b)

Line Isolation signal, mech Valve; CH-255 failure PROCESS AUXILIARIES b) fails open Mech. binding, No impact on normal operation. Periodic test Check valve, CH-835. CH-255 can be closed valve operator Loss of redundant seal injection Isolation valve, CH-231P via handwheel if failure line isolation capability provide isolation problem is operator failure.

145) Seal Injection a) fails open Mech. binding No impact on normal operation. None Redundant check valves in Line Check Partial loss of seal injection line individual seal injection Valve, CH-835 isolation lines b) fails closed Mech. binding, Unable to establish seal Lo flow alarms from None Startup delayed until Revision 15 blockage injection flow on startup seal injection flow valve repaired indicators 146) Seal Injection a) false Elect. or Flow indicator/controller will Lo flow alarm, and None Flow Indicator/ indication mech. drive associated control valve valve position Controllers; of Lo flow malfunction, open, causing excess flow to indicator in control FIC-241, rate setpoint drift associated RCP seal room (if fully open).

FIC-242, FIC-243, FIC-244

Table 9.3.4-3 (Sheet 31 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2011 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) false Elect. or Flow indicator/controller will Hi flow alarm, and RCP component cooling indication mech. drive associated control valve valve position water flow provides of Hi flow malfunction, closed, resulting in a loss of seal indicator in control protection for RCP seal on rate setpoint drift injec. to one RCP. Possible loss of seal injection seal damage 147) Seal Injection a) fails open Loss of air Seal injection flow to one RCP Hi flow alarm from None Flow Control power seal will increase associated flow Valves; CH-241, indicator valve CH-242, position indicator in CH-243, control room PVNGS UPDATED FSAR CH-244 b) fails closed Mech. failure, Loss of seal injection flow to one Lo flow alarm from RCP component cooling spurious RCP seal. Possible seal associated flow indic., water flow provides signal damage valve indic. in control protection for RCP seal room c) won't Mech. binding, Results are similar to a) or b),

respond to valve operator but less severe 9.3-199 control failure signal 148) Seal Injection a) fails open Mech. binding No impact on normal operation. None Four pairs or series Check Valves; Loss of isolation for seal redundant check valves CH-787, injection line CH-866, CH-802, CH-867, CH-807, CH-868, PROCESS AUXILIARIES CH-812, CH-869 b) fails closed Mech. binding, Unable to establish seal Lo flow alarm from None Startup delayed until blockage injection flow to one RCP flow indicator/ valve repaired controller on affected line 149) Refueling Water a) external Mfg. defect, Boric acid solution lost. Lo level alarms from None Reactor would have to Tank, RWT leakage mech. Reduced inventory for RCS RWT level indicators be shut down until RWT damage, makeup. Unable to fill refueling repaired and refilled.

Revision 16 corrosion pool for refueling loss of The fuel pool could be inventory or for safety injection used to supply sufficient water for cooldown contraction and boration.

Table 9.3.4-3 (Sheet 32 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2011 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 150) Refueling a) spurious Lo Elect. or No direct impact on normal CVCS Redundant level 4 redundant level Water Tank level indication mech. operation. These indicators detectors indicator/controllers Level or spurious Hi malfunct., provide input to plant protection Indicators level indication setpoint drift system to generate recirculation (Safety Ch.); actuation signal during safety LIC-203A, injection. Four redundant, LIC-203B, independent channels with two of LIC-203C, four logic, so a single failure will LIC-203D not affect the PPS 151) Level Indicator, a) spurious Hi Elect. or No impact on normal operation. Hi level alarms from LI- Redundant level indicators PVNGS UPDATED FSAR LI-201 level alarms mech. LI-201 serves no control function 201 with normal level malfunct., indications from other setpoint drift RWT level indic.

b) spurious Lo Elect. or No impact on normal operation Lo level alarm LI-201 Redundant level indicators level alarms mech. with normal indic. from malfunct., other RWT level setpoint drift indicators 152) RWT Level a) spurious Hi Elect. or No direct impact on normal Hi level alarms or indic. Redundant RWT level Indicator/ level alarms or mech. operation. BAMPs will not auto from LI-200, with indication and alarms.

Controller indications malfunct., stop on actual Lo-Lo RWT level. normal or Lo level Manual control of BAMPs 9.3-200 LIC-200 setpoint drift Operator may terminate boric acid indic. from other RWT batching to RWT. level indicators.

b) spurious Lo-Lo Elect. or If makeup operations are in Lo-Lo level alarms from Redundant RWT level During makeup to the VCT level indications mech. progress, BAMPs will be stopped. LALL-200 with normal indicators. Safety related or charging pumps, a BAMP malfunct., Possible decrease in VCT level. indic. from other RWT functions can be performed trip will automatically secure setpoint drift Possible deboration. level indicators using gravity-fed boration the make-up evolution to pathways. prevent deboration 153) RWT Isolation a) fails open Loss of No impact on CVCS operation. Valve position indic. in None required PROCESS AUXILIARIES Valves; CH- power, mech. Unable to isolate RWT during control room 530, CH-531 binding, valve recirculation phase of safety operator injection failure b) fails closed Loss of No impact on normal operation. Valve position indic. in 100% redundant paths. These valves are normally power, mech. Loss of safety injection inventory. control room Alternate path for charging locked open binding, valve Unable to fill refueling pool for pump suction operator refueling. For CH-530 charging failure pumps unable to take direct suction from RWT through one gravity feed line.

c) fails to close Electrical Degraded performance of one Valve position Parallel redundant path for Timely operator action Revision 16 (manual action malfunction, train of HPSI and CS (if air is indicator; periodic HPSI and CS required to close after RAS) mechanical entrained) testing failure 154) RWT Isolation a) fails open Mech. binding No impact on CVCS operation. None CH-305 and CH-306 are Check Valves; Possible flow to RWT during qualified as "active" to CH-305, CH- recirculation phase of safety preclude this failure.

306 injection b) fails closed Mech. Same as 153 b) Flow indic. on approp. Same as 153 b) binding, flow paths blockage

Table 9.3.4-3 (Sheet 33 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 155) RWT a) spurious Elect. or No direct impact on system Lo temp alarm from Redundant temp sensor, Temperature Low temp. mech. operation. TI-200 has no TI-200 without alarm TI-201 Indicator, TI-200 alarms malfunction, control function from TI-201 setpoint drift b) false Hi or Elect. or Failure to detect Lo temp condit. Periodic test Redundant temp sensor normal mech. in RWT, possible precipitation of TI-201 temp. malfunction, boric acid indications setpoint drift 156) RWT Temp- a) spurious Elect. or No impact on system operation. Lo temp. alarm from Redundant temp indicator, PVNGS UPDATED FSAR erature Sensor, Low temp mech. (Local read-out only) TI-201 with normal TI-200 TI-201 alarms malfunction, temp indic. from setpoint drift TI-200 b) fails to Elect. or Loss of redundant temp. Periodic test Redundant temp indicator, senses Lo mech. indication for Lo temp in RWT. TI-200 temp. malfunction, Possible boric acid precipitation condition setpoint drift if Lo temp. condition goes undetected 9.3-201 157) RWT to a) fails closed Mech. failure No impact on normal operation. Operator Alternate direct suction Charging Pump Charging pumps unable to take path available Isolation Valve; direct suction from RWT via one CH-327 gravity feed line for HPSI check valve test or other requirements b) seat Contamina- No impact on normal operation, None Isolation valves at charging leakage tion, mech. minor diversion of RWT pump suction damage inventory PROCESS AUXILIARIES 158) RWT to a) fails closed Mech. binding Unable to align affected Operator Redundant charging pump Charging Pump charging pump to RWT via one can be used/redundant Line, CP Suction gravity feed line for test of HPSI feed feed line can be used Isolation Valves; check valves or other CH-755, requirements CH-756, CH-757 b) seat Contamina- Minor diversion of charging flow None Isolation valve CH-327 leakage tion, mech.

damage Revision 14 159) RWT Isolation a) fails open Mech. binding, No impact on normal system Valve position None Valve; CH-532 valve operation. Unable to isolate indicator in control operator, loss RWT in the event of a makeup room of air or power line break b) fails closed Mech. failure, Loss of makeup flow to VCT or Valve position BAMPs will trip on Lo spurious RCS. Possible cavitation indicator in control discharge pres makeup signal damage to BAMPs room, Lo flow alarm can continue by aligning from FQRC-210Y, Lo charging pumps to RWT discharge pres. alarm via valve CH-327 from PI-206, 207

Table 9.3.4-3 (Sheet 34 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 160) Boric Acid a) fails open Mech. binding No impact on normal system Operator None without terminating Makeup can continue Makeup Pump operation. Unable to isolate makeup using redundant pump Suction Isolation BAMP for maint.

Valves; CH-143, CH-145 b) fails closed Mech. failure Unable to return BAMP to Operator None service after maint.

161) Boric Acid a) fails to Electrical Unable to start makeup flow or Pump run indicator, Redundant pump or gravity Makeup Pumps; start malfunction, to recirculate RWT contents Lo discharge pres. feed BAMP 1, mech. binding alarm PVNGS UPDATED FSAR BAMP 2 b) stops Elect. Loss of makeup flow. Possible Lo discharge pres. Redundant pump or gravity During makeup to the malfunction deboration of RCS alarm, Lo flow from feed VCT or charging pumps, mech. seizure FQRC-210Y a BAMP trip will automatically secure the makeup evaluation to prevent deboration 9.3-202 c) fails to Excess seal Reduced makeup flow. Low discharge pres Redundant pump deliver leakage, Possible deboration of RCS indic., Lo flow indic rated flow mech. from FQRC-210Y malfunct.

162) BAMP Discharge a) spurious Elect. or BAMP will be tripped, causing Lo pres. alarm Redundant BAMP can be Same as 161) b)

Pressure Lo pres. mech. loss of makeup flow followed by Lo flow placed in service Indicators; indications malfunction, alarm from PI-206, PI-207 or alarms setpoint drift FQRC-210Y b) false Hi or Elect. or No impact on normal operation, Periodic test. Lo flow Redundant BAMP can be Same as 161) b)

PROCESS AUXILIARIES normal mech. but unable to detect Lo alarm from placed in service pres. malfunction discharge pres. Possible pump FQRC-210Y if Lo indications damage pres. condit develops.

163) BAMP Discharge a) fails open Mech. binding No impact on normal operation None None Check Valve; possible reverse flow through CH-154, CH-155 standby BAMP b) fails closed Mech. failure, Unable to establish makeup flow Hi discharge pres Redundant BAMP, gravity blockage with affected BAMP. Possible indic., Lo flow alarm feed Revision 14 pump damage due to dead from FQRC-210Y heading 164) BAMP Discharge a) fails open Mech. binding No impact on normal operation Operator BAMP discharge check Isolation Valves; unable to isolate affected pump valve provides some CH-152, CH-153 for maint isolation b) fails closed Mech. binding, Unable to return affected pump Operator Redundant pump, gravity blockage to service after maint feed

Table 9.3.4-3 (Sheet 35 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2011 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects PVNGS UPDATED FSAR 165) BAMP a) fails open Mech. binding No impact on normal operation. Operator Valves CH-510 and Recirculation Unable to isolate recirculation CH-647 provide adequate Valves; CH-192, line for maint. on BAMP isolation CH-130 b) fails closed Mech. failure Unable to establish recirculation Operator Redundant BAMP This valve would be flow path for one BAMP. available repaired before starting Possible damage to pump if it is affected pump. Valves dead headed into a closed closed only for pump makeup line maint 166) BAMP Suction to a) fails closed Mech. binding, No impact on normal operation. Operator RWT is normal source of Pool Cooling and blockage Unable to obtain borated borated makeup water Purification makeup water from PCPS Alternate gravity feed path System (PCPS) Unable to supply boric acid to individual charging Isolation Valve; solution from RWT via one pump suction lines.

CH-144 gravity feed line and from the SFP via one gravity feed line to PROCESS AUXILIARIES charging pump suction header.

b) seat Contamina- BAMP will draw suction on Spent fuel pool level Redundant isolation valve 9.3-203 leakage tion, mech. spent fuel pool, gradually indicators in PCPS damage reducing its level. Reduced shielding and cooling for spent fuel 167) BAMP Discharge a) fails closed Mech. failure, No impact on normal operation. Operator Alternate gravity feed path to PCPS blockage Unable to supply boric acid to individual charging Isolation Valve, solution from RWT via one pump suction ilnes.

CH-753 gravity feed line and from the SFP via one gravity feed line to charging pump suction header.

b) seat Contamina- Minor diversion of makeup flow SFP Level indicators. None leakage tion, mech. to spent fuel pool (SFP). Possibly Lo flow indic.

damage Gradual SFP level increase from FQRC-210Y 168) RWT Gravity a) fails closed Mech. failure, No impact on normal operation. Valve position Alternate gravity feed path Feed to blockage, loss Unable to supply boric acid indication in control to individual charging Charging Pump of power solution from RWT via one room. pump suction lines Suction Isolation gravity feed line to charging Valve; CH-536 pump suction header b) seat Contamination Diversion of boric acid solution Sample analysis. None Revision 16 leakage mech. from RWT to RCS via charging Decreasing reactor damage pumps. Possible over boration power of RCS c) fails open Mech. failure Diversion of boric acid solution Sample analysis. None from RWT to RCS via charging Decreasing reactor pumps. Possible over boration power of RCS.

Table 9.3.4-3 (Sheet 36 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 169) RWT Gravity a) fails closed Mech. failure, Same as 168 a) None Same as 168 a)

Feed to blockage Charging Pump Suction Header Check Valve, CH-190 b) fails open Mech. failure, No impact on normal operation None Isolation valve, CH-141 seat leakage 170) Boric Acid Filter a) fails open Mech. binding No impact on normal operation. Operator None (BAF) Isolation Unable to isolate BAF for PVNGS UPDATED FSAR Valves; CH-161, element replacement CH-166 b) fails closed Mech binding Unable to place BAF back in Operator Boric acid makeup can service after maint. continue through diversion valve CH-164 171) BAF Diversion a) fails closed Mechanical No impact on normal operation. Operator None 9.3-204 Valve, CH-164 binding, Unable to divert boric acid blockage makeup flow past BAF when BAF element replacement needed b) seat Contamina- Minor diversion of boric acid Possibly low diff. pres. None leakage tion, mech. makeup flow past BAF. indic. from PDI-260 damage Possible buildup of contaminants in RCS and VCT 172) BAF Differential a) spurious Elect. or No impact on normal operation. Hi Delta P alarm from None Pressure Hi Delta P mech. Possible early replacement of PDI-260, with normal PROCESS AUXILIARIES Indicator, alarms malfunction, BAF element indic. from PDI-260 setpoint drift FQRC-210Y, PI-206, or PI-207 b) false Lo or Elect. or No impact on normal operation. Periodic test FQRC-210Y and BAMP normal mech. Possible failure to detect discharge pres. indic Delta P malfunction plugged BAF element should indicate plugged indications element 173) Boric Acid Filter a) plugged Normal Reduced boric acid makeup Hi Delta P alarm from Boric acid makeup flow contaminant flow PDI-260, Lo flow can be diverted past BAF Revision 14 buildup alarm from and element replaced FQRC-210Y b) does not Element Contaminant buildup in RCS Possibly Lo Delta P Boric acid makeup flow filter "punch and VCT indication from can be diverted past BAF through", PDI-260 and element replaced wrong element 174) BAF Drain a) fails closed Mech. failure, No impact on normal operation. Operator None Valve; CH-134 blockage Unable to drain BAF for element replacement

Table 9.3.4-3 (Sheet 37 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) seat Contamina- Minor diversion of boric acid EDT level indic., None leakage tion, mech. makeup flow to recycle drain possibly Lo flow indic.

damage header from FQRC-210Y, or Lo Delta P indic. from PDI-260 175) BAF Vent Valve; a) fails closed Mech. failure No impact on normal operation. Operator None CH-132 Unable to vent BAF for element replacement b) seat Contamination Loss of boric acid solution, slight Local leak detectors None leakage mech. reduction in boric acid makeup possibly Lo flow indic.

damage flow from FQRC-210Y PVNGS UPDATED FSAR 176) RWT Recircula- a) fails closed Mech. binding, No impact on normal operation. Valve position indic. in None tion Valve; valve operator Unable to recirculate RWT control room, Hi pres CH-510 malfunction, contents through BAF for clean indic from PI-207 or loss of air or up PI-206 power 9.3-205 b) fails open Mech. binding Boric acid makeup flow diverted Low flow alarm from Gravity feed boric acid A low flow alarm from valve operator back to RWT during makeup FQRC-210Y, PZR makeup can be instituted FQRC-210Y will malfunct. operations. Insufficient makeup LVL alarms, valve terminate automatic flow to maintain RCS inventory position indic. in makeup to prevent also, possible deboration control room dilution.

177) RWT a) fails closed Mech. failure Same as 176 a) Hi pres. indic from None Recirculation blockage PI-207 or PI-206 Line Check Valve: CH-647 b) fails open Mech. binding No impact on normal operation Operator None 178) Isolation Valve a) fails closed Mech. binding No impact on normal operation. Operator None Transfer would be made PROCESS AUXILIARIES Boric Acid Unable to transfer RWT only when reactor Make-up to contents to hold up tank for shutdown Holdup Tank; processing or during maint.

CH-330 operation b) seat Contamination Minor diversion of boric acid Possible PZR or VCT None Same as 176) b) leakage mech. makeup flow to holdup tank level indic., Lo flow damage during makeup operations. indic. from Possible deboration, PZR LVL FQRC-210Y holdup Revision 14 decrease or VCT level decrease tank level indic 179) Boric Acid a) fails closed Mech. failure, Unable to provide direct boric Valve posit. indic. in Gravity feed boric acid A low-low VCT level Makeup Bypass loss of power, acid makeup to RCS on Lo-Lo control room, Lo flow makeup can be instituted condition is an Control Valve, valve operator VCT level. Decrease in PZR indic. from F-212, Lo by opening manual valve, uncommon situation CH-514 failure levels. Possible reactor trip on PZR level alarms CH-141 during normal operation Lo PZR level charging pump trips

Table 9.3.4-3 (Sheet 38 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails open Mech. fail, Boric acid makeup flow to VCT Lo flow indic. from None A low flow alarm from spurious diverted to charging pump FQRC-210Y, Lo VCT FQRC-210Y will signal, loss of suction. Decrease in VCT level. level indic., valve terminate automatic power when Possible overboration of RCS position indic. in makeup to prevent open control room. Reactor overboration power decrease 180) Boric Acid a) fails open Mech. binding No impact on normal operation. Operator None Makeup Flow Unable to isolate FQRC-210Y Controller for maint.

Isolation Valves; PVNGS UPDATED FSAR CH-653, CH-172 b) fails closed Mech. failure Unable to restore FQRC-210Y Operator Other boric acid makeup Valves normally open.

to service. Loss of controlled paths available boric acid makeup capability 181) Boric Acid a) false Elect. or FQRC-210Y will drive CH-210Y, Hi flow alarms from No other controlled boric Makeup Flow indication mech. closed trying to establish proper FQRC-210Y, valve acid makeup paths Controller, of high malfunction, flow rate. Possible deboration CH-210Y position available, but can provide 9.3-206 FQRC-210Y flow setpoint drift of RCS indic., VCT level boric acid makeup via indic., reactor power direct flow to charging increase pump suction.

b) false Elect or mech. FQRC-210Y will drive CH-210Y Lo flow alarm from Same as above indication malfunction, open to maintain flow. FQRC-210Y, valve, of low flow setpoint drift Overboration of RCS CH-210Y posit. indic.

VCT level indic reactor power decrease PROCESS AUXILIARIES 182) Boric Acid Flow a) fails closed Mech. binding No impact on system operation. Operator Normal direct boration path Controller Outlet Unable to use FQRC-210Y as or bypass of VCT via to Direct flow indicator for one direct CH-527 Boration Line boration flow path.

Isolation Valve, CH-174 b) seat Contamina- Minor diversion of boric acid None None leakage tion, mech. makeup flow to VCT to charging damage pump suction. No change in Revision 14 overall boric acid concentration in RCS, but possible decrease in VCT boric acid concentration 183) Direct Boration a) fails closed Mech. binding, Same as 179 a) Lo flow indic. from Same as 179 a) Same as 179 a)

Line Check blockage FI-212, Lo PZR level Valve, CH-177 alarms, charging pump trips b) fails open Mech. binding Diversion of charging flow to None Line isolated by valve direct boration line CH-514

Table 9.3.4-3 (Sheet 39 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 184) Boric Acid a) fails closed Mech. binding, Unable to provide controlled Valve position Same as 181 a) Same as 176 b)

Makeup Flow valve operator boric acid makeup flow to VCT indicator, Lo flow Control Valve, failure, loss of or to charging pump suction, alarms from CH-210Y air or power possible deboration of RCS FQRC-210Y reactor power increase b) fails open Valve operator Excess boric acid makeup flow Hi flow alarms from Same as 181 a) A high flow alarm from malfunction, rate to VCT or charging pump FQRC-210Y, valve FQRC-210Y will spurious suction. Possible overboration position indicator, terminate automatic signal, mech. of RCS VCT level indic. makeup to prevent PVNGS UPDATED FSAR failure reactor power overboration.

decrease c) does not Mech. binding, Results similar to but less respond to valve operator dramatic than a) or b) above control signal properly 9.3-207 185) Boric Acid a) fails closed Mech. failure, Same as 184 a) Lo flow alarms from Same as 181 a)

Makeup Line blockage FQRC-210Y, reactor Check Valve, power increase CH-668 b) fails open Mech. binding No impact on normal operation. None Valve CH-210Y provides Diversion of reactor makeup isolation water to boric acid makeup line 186) Reactor Makeup a) fails open Mech. binding No impact on normal operation. Operator None Water Flow Unable to isolate reactor PROCESS AUXILIARIES Controller makeup water flow controller for Isolation Valves; maint.

CH-195, CH-183 b) fails closed Mech. binding Unable to restore reactor Operator None No reactor makeup makeup water flow controller to could take place until service. Unable to provide valve repaired reactor makeup water for controlled makeup to RCS or VCT 187) Reactor Makeup a) senses Elect or mech. FQRC-210X would drive valve Hi flow alarms from None Makeup would have to Revision 14 Water (RMW) flow rate malfunction CH-210X closed, reducing FQRC-210X, posit. be terminated until Flow Controller, high RMW flow. Possible indic., decrease in controller repaired. A FQRC-210X overboration of RCS due to VCT level, decrease high flow alarm from improper mix of RMW and boric in reactor power. FQRC-210X will acid in makeup flow terminate automatic makeup to prevent over-boration.

Table 9.3.4-3 (Sheet 40 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) senses Elect. or FQRC-210X will drive valve Lo flow alarms from None Same as above for over-flow rate mech. CH-210X open, increasing FQRC-210X, valve, dilution low malfunction RMW flow rate. Deboration of CH-210X position RCS due to excess RMW in indic., increase in makeup flow reactor power.

188) RMW Flow a) fails to Elect. or No impact on normal operation. Periodic test None Flow sensor activated Sensor FSL-250 sense flow mech. Failure to detect RMW flow only when reactor is malfunction, during reactor cold shutdown. shut down operator error Possible undetected deboration PVNGS UPDATED FSAR of RCS during shutdown b) spurious Elect. or No impact on normal operation. Periodic test None flow mech. False indication of RMW flow indications malfunction during reactor shutdown 189) RMW Makeup a) fails closed Loss of air or Loss of RMW makeup flow to Lo flow alarm from None Makeup would have to Flow Control power, valve VCT or charging pump suction, FQRC-210X, valve be terminated until valve Valve; CH-210X operator possible over boration of RCS position indic. in repaired. A low flow failure, control room, reactor from FQRC-210X will 9.3-208 spurious power decrease terminate automatic signal makeup to prevent overboration.

b) fails open Valve operator Excess RMW makeup flow to Hi or Hi-Hi flow alarm None Same as above malfunction, VCT or charging pump suction, from FQRC-210X, spurious possible deboration of RCS valve position signal, mech. indicator in control binding when room, reactor power PROCESS AUXILIARIES open increase c) fails to Valve operator Results similar to but less respond malfunction dramatic than a) and b) above properly to control signal 190) RMW Makeup a) fails closed Mech. binding, Unable to supply RMW makeup Lo flow alarm from None Same as 189) a)

Line Check blockage flow to VCT or charging pump FQRC-210X, VCT Valve, CH-184 suction. Possible over boration level decrease, of RCS reactor power Revision 14 decrease.

b) fails open Mech. binding No impact on normal operation. None Valve CH-210X provides Possible diversion of boric acid line isolation solution to RMW lines

Table 9.3.4-3 (Sheet 41 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 191) Makeup Valve; a) fails closed Mech. binding, Unable to provide makeup to Lo flow alarms from Makeup can be supplied CH-512 loss of air or VCT. Unable to compensate for FQRC-210X and directly to charging pump power, valve minor RCS losses, unable to FQRC-210Y, VCT suction via valve CH-527 operator conduct feed and bleed level indications malfunction operations using normal makeup flow path.

b) fails open Spurious Possible draining of VCT Valve Position indic. CH-210X and CH-210Y signal, valve contents to makeup lines. in control level close automatically when operator Possible over filling and or indicators makeup is completed malfunction dilution of VCT except when manual" is PVNGS UPDATED FSAR mech. binding selected on the makeup when open controllers. Then CH-210X and CH-210Y provide isolation when manually closed 192) Makeup Line a) fails closed Mech. binding Same as 191 a)

Check Valve; blockage 9.3-209 CH-188 b) fails open Mech. binding No impact on normal operation. VCT level detectors Makeup line isolated by Possible draining of VCT to valve CH-512 makeup lines 193) Direct Makeup a) fails closed Mech. binding, Unable to supply blended Valve position indic. in Normal makeup path is to Valve; CH-527 valve operator makeup directly to charging control room, Lo flow VCT. None if VCT is malfunction, pump suction. Loss of blended alarms from isolated loss of air or makeup capability if VCT FQRC-210X.

power isolated FQRC-210Y. Lo PZR PROCESS AUXILIARIES level alarms Lo flow indic. from FI-212 b) fails open Valve operator Makeup flow to VCT diverted to None None CH-527 can be closed malfunction, charging pump suction with a handwheel for spurious operator failures signal, mech.

binding when open 194) Direct Makeup a) fails closed Mech. binding Same as 193 a) Lo flow alarms from Same as 193 a)

Revision 14 Line Check blockage FQRC-210X, and Valve, CH-179 FQRC-210Y b) fails open Mech. binding No impact on normal operation. None Direct makeup line isolated Minor diversion of charging by CH-527 suction flow to makeup lines 195) BAMP to Boric a) fails closed Mech. binding No impact on normal operation. Operator None Acid Eductor Unable to initiate flow of RWT Isolation Valve, water through eductor to draw CH-649 batched concentrated boric acid solution into RWT

Table 9.3.4-3 (Sheet 42 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) seat Contamina- Minor diversion of makeup flow None Isolation valves CH-124 or leakage tion, mech. into the boric acid batching lines CH-126 damage 196) Boric Acid a) eductor nozzle Concentrated boric acid drawn Lo flow indic. from Valve CH-122 can be Final boric acid Batching Eductor doesn't plugged, from boric acid batching tank at FI-213 opened to get desired flow concentration in RWT draw wrong nozzle too slow a rate. Flow to RWT depends on total amount sufficient has too slow a rate. Flow to of boric acid added, not vacuum on RWT has too low a addition rate boric acid concentration batching PVNGS UPDATED FSAR tank b) draws too Nozzle too Concentrated boric acid drawn Hi flow indic. from Valve CH-122 can be Same as above much large into recirculation flow at too high FI-213 closed to get desired flow vacuum on a rate. Flow to RWT has rate BABT greater than desired boron concentration. Possible precip of boric acid 9.3-210 197) Boric Acid a) fails closed Mech. binding, Same as 195 a)

Batching Line blockage Isolation Valve, CH-126 b) seat Contamina- No impact on normal operation. None Valves CH-122, and leakage tion, mech. Minor diversion of flow from CH-649 provide isolation damage boric acid concentrator (BAC) or PHIX to boric acid batching tank or makeup lines PROCESS AUXILIARIES 198) Isolation Valve a) fails closed Mech. binding Same as 195 a)

CH-124 b) seat Contamina- No impact on normal operation. RWT level indicators Redundant isolation valves leakage tion, mech. Possible unwanted flow from for BAC and PHIX damage BAC or PHIX to RWT 199) BAC to RWT a) fails closed Mech. binding, Unable to deliver concentrated Lo flow rate indic. None Check Valve, blockage boric acid bottoms from BAC to from FR-295 CH-127 RWT. No impact on normal operation Revision 14 b) fails open Mech. binding No impact on normal operation. None Check valves in BAC Possible diversion of boric acid package prevent backflow batching flow to BAC into BAC 200) Makeup Supply a) fails closed Mech. binding No impact on normal operation. Operator None Header Isolation Unable to supply makeup water Valve to the for a batch of concentrated boric BABT CH-119 acid solution b) seat Mech. Possible overfilling of BABT Local leak detectors None Causes no problem leakage damage during makeup, RMW spill other than minor loss of contamination RMW

Table 9.3.4-3 (Sheet 43 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 201) Boric Acid a) leak Manufacturing No impact on normal operation. Operator, local leak None BABT is empty during Batching Tank defect, mech. Loss of RMW when preparing a detectors normal operation. Leak BABT damage batch of concentrated boric acid would be detected during batching operation 202) Boric Acid Mixer a) does not Motor failure, Unable to properly mix Operator Manual mixing mix mech. failure concentrated boric acid batch.

Possible precip. of boric acid 203) BABT Heater a) fails full on Elect Concentrated boric acid solution High temp. indic. from Heater can be turned off Operator is present for malfunction overheated. Possible boiling TIC-213, operator manually batching evolution.

with increase in boric acid PVNGS UPDATED FSAR concentration b) fails off Elect or mech. Concentrated boric acid solution Lo temp. indic. from None BABT fluid is heated malfunction not heated properly. Possible TIC-213, operator prior to adding boric acid precipitation of boric acid to the tank 204) BABT a) spurious Elect or mech. TIC-213 will turn off the BABT Operator Heater can be controlled Temperature Hi temp. malfunction heater. Insuff. heat to boric acid manually 9.3-211 Indicator/ readings solution, possible precipitation Controller, TIC-213 b) spurious Elect. or TIC-213 will turn on the BABT Operator Heater can be manually Lo temp. mech. heater. Boric acid solution will turned off readings malfunction be overheated. Possible boiling 205) Boric Acid a) fails closed Mech. failure, Unable to flush and drain BABT Operator None Batching Drain blockage or BAB lines after making up a Valves, CH-767, batch or concentrated boric PROCESS AUXILIARIES CH-121 acid. No impact on normal operation b) seat Contamina- No impact on normal operation. Operator None leakage tion, mech. Minor diversion of concentrated damage boric acid solution to recycle drain header during batching operations 206) Boric Acid a) fails closed Mech. failure, No impact on normal operation. Operator None Batching Valve; blockage Unable to add concentrated Revision 14 CH-122 boric acid solution to RWT b) seat Contamina- No impact on normal operation. Flow indic. from Isolation valves CH-126 leakage tion, mech. Diversion of RMW or boric acid FI-213 CH-649 damage solution to RWT while preparing batch of concentrated boric acid 207) Relief Valve a) fails closed Mech. binding, No impact on normal operation. Periodic test None CH-123 blockage Loss of overpres. protection for potentially closed line section b) fails open Spring failure, No impact on operations None None setpoint drift

Table 9.3.4-3 (Sheet 44 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 208) Flow Indicator, a) false Hi Elect. or CH-122 will be set too low, Periodic test None Same as 196) a)

FI-213 flow mech. resulting in reduced boric acid indicator malfunction mixing in RWT recirculation flow b) false Lo Elec. or mech. CH-122 will be set too Hi, Period test None Same as 196) a) flow malfunction resulting in Hi boric acid indicator concentration in recirculation/

educting flow. Possible boric acid precipitation 209) Boric Acid a) plugged Normal No impact on normal operation. Lo flow indic. from Element can be removed Strainer contaminant Unable to establish desired FI-213 and replaced before buildup concentrated boric acid flow rate continuing boric acid PVNGS UPDATED FSAR addition.

b) doesn't Element No impact on normal operation. None Makeup filters should strain out "punch Possible contamination of RWT remove contaminants particles through," during boric acid addition before RWT inventory wrong reaches RCS 9.3-212 element 210) BABT Local a) fails closed Mech. failure, Unable to obtain sample of Operator Sample can be obtained Sample Valve, blockage BABT contents for boron from top of tank CH-120 analysis b) seat Contamina- No impact on normal operation. Operator, local leak None leakage tion, mech. Local spill of boric acid solution detectors damage during batch operations 211) Boric Acid Lines a) fails off Elect No impact on normal operation. Heat tracing status Concentrated Boric Acid Heat Tracing malfunction Insufficient (no) heating for lines indicator solution is generally not carrying concentrated boric allowed to stagnate, even PROCESS AUXILIARIES acid. Possible boric acid in the heat traced lines.

precipitation Fluid movement should prevent precip.

212) Makeup Supply a) fails closed Mech. failure No impact on normal operation. Operator Makeup water could be Normal RCS O2 control Header to Unable to supply RMW to CAT. carried to tank from is via H2 blanket in VCT.

Chemical Unable to batch chemicals for another source.

Addition Tank RCS 02 concentration and pH (CAT) Isolation control.

Valve, CH-312 Revision 14 b) seat Contamina- No impact on normal Local leak detectors None leakage tion, mech. operations. Possible overfilling damage of CAT with RMW during makeup operations 213) Chemical leak Mfg. defect, No impact on normal operation. Operator, local leak None Addition Tank mech. Loss of chemical solution when detector damage preparing a batch for addition to RCS 214) CAT Isolation a) fails closed Mech. binding No impact on normal operation. Operator None Valve, CH-171 Unable to add chemical solution to RCS

Table 9.3.4-3 (Sheet 45 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS June 2009 No. Name Failure Mode Cause Symptoms and Local Effects Including Dependent Failures Method of Detection Inherent Compensating Provision Remarks and Other Effects b) seat Contamina- No impact None CAT normally empty, other leakage tion, mech. isolation valves damage downstream 215) Chemical a) plugged Normal No impact on normal operation. CAT not empty Isolate strainer and replace Addition Strainer contaminant Unable to add chemical solution element buildup to RCS b) fails to Element No impact on normal operation. None Contaminants removed remove "punch thru", Potential addition of from primary coolant by impurities wrong contaminants to RCS letdown filters PVNGS UPDATED FSAR element 216) CAT and a) fails closed Mech. failure No impact on normal operation. Operator None Strainer Drain Unable to flush & drain CAT Valve, CH-309 after adding chemical solution to RCS. Unable to drain strainer for maint.

b) seat Contamina- No impact on normal operation. None None leakage tion, mech. Chemical solution diverted to damage waste management system.

9.3-213 Possible increase in RCS 02 concentration 217) Chemical a) fails to Loss of Power No impact on normal operation. Pump run indicator None Metering Pump start mech. failure Unable to add chemical solution to RCS b) spurious Elect. Pump damaged Pump run indicator None Pump can only turned start up Malfunc. operator on by operator via hand PROCESS AUXILIARIES spurious sig. switch, therefore this is a operator error highly improbable incident.

218) Chemical a) fails closed Mech. failure Same as 214 a)

Addition Valve; CH-768 b) seat Mech. No impact None Isolation valve CH-171, leakage damage and CH-863.

contamination 219) 220) Makeup Line a) fails closed Mech. failure, No impact on normal operation. Operator None Revision 15 Local Sample blockage Unable to obtain local sample at Valves; CH-648, approp. locations in boric acid CH-176, CH-185 make up system b) seat Contamination Loss of boric acid solution Local leak detectors None leakage mech. outside containment damage

Table 9.3.4-3 (Sheet 46 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 221) Resin Sluice a) fails closed Mech. binding, No impact on normal operation. Valve posit. indic. in Alternate path via valve Supply Header loss of air or Unable to provide RMW to fill control room, low flow CH-862 to Reactor Drain power, valve RDT indic. (F-249)

Tank Isolation operator Valve; CH-580 malfunction b) fails open Spurious Loss of redundant containment Valve posit. indic. in Check valve, CH-494 signal, mech. ISOL capability for line on CIAS, control room, RDT provides containment binding or possible unwanted RMW flow to level indic. isolation. None for valve operator RDT unwanted RMW flow.

malfunc. when PVNGS UPDATED FSAR open 222) Resin Sluice a) fails closed Mech. binding, Same as 221 a) Lo flow indic. from Same as 221 a)

Supply Header blockage FI-249 Check Valve, CH-494 b) fails open Mech. binding Loss of redundant containment None Isolation valve CH-580 9.3-214 isolation capability for line.

Possible drain flow to resin sluice supply header 223) Resin Sluice a) fails open Mech. binding No impact on normal operation, Operator None Supply Header unable to isolate line for maint.

to RDT Manual Isolation Valve, CH-857 b) fails closed Mech. failure Same as 221 a) Operator Same as 221 a) Valve is normally open PROCESS AUXILIARIES 224) PCPS to RDT a) fails closed Mech. failure No impact on normal operation Operator None Isolation Valve, CH-456 b) seat Contamina- No impact on normal operation. None None leakage tion, mech. Possible diversion of drain flow damage to PCPS 225) Reactor Drain leakage Mfg. defect, Loss of primary coolant inside Local leak detectors None Tank; RDT corrosion, containment and radiation mech. monitors, RDT level Revision 14 damage indicator LIC-268 226) RDT Level a) spurious Elect. or No direct impact on operation. Hi level alarms from None Indicator/ high level mech. Operator may drain tank, losing LIC-268 with normal Controller, alarms malfunction, steam quenching capability for pres. indic. from LIC-268 setpoint drift PZR reliefs PIC-268 b) spurious Same as No direct impact on operation. Lo level indic. from None Lo level above Reactor drain pumps (RDP) will LIC-268 with Hi or alarms be stopped. Possible level and normal indic from pres. increase in RDT PIC-268

Table 9.3.4-3 (Sheet 47 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 227) RDT Pressure a) spurious Same as PIC-268 will close valves Hi pres. alarm from None Indicator/ high pres. above CH-560 and CH-540, isolating PIC-268 Controller; alarms the RDT outlet lines. Possible PIC-268 overfilling of RDT with a pres.

increase b) false Lo Elect or mech. No impact on normal operation. Periodic test None pres. malfunction Failure to detect pres. increase indications in RDT. Possible overpres. of gaseous waste management system (GRS) or RDPs PVNGS UPDATED FSAR 228) RDT Temp. Erroneous Elect. or No impact on operation. TI-268 Periodic test or None Indicator, TI-268 temp. indic. or mech. has no control function alarms alarms malfunct.

setpoint drift 229) N2 Supply Line a) fails open Mech. binding No impact on normal operation. Operator None Isolation Valve, Unable to isolate N2 line for CH-483 maint.

9.3-215 b) fails closed Mech. failure Unable to reestablish N2 blanket Operator None in RDT. Possible combustible gas buildup in RDT 230) N2 Control a) fails closed Mech. Loss of N2 blanket for RDT. N2 usage drops, RDT can be vented to Valve; CH-484 malfunct. Possible buildup of combustible possible Lo pres indic. GRS gas in RDT from PIC-268 b) fails open Mech. Over pressurization of RDT with HI pres alarm from None Rupture disc on RDT malfunct. N2 PIC-268 prevents rupture of tank.

PROCESS AUXILIARIES 231) RDT to GRS a) fails closed Mech. failure, No impact on normal operation. Valve position indic. in None Vent Valve, loss of air or Unable to vent RDT to GRS control room CH-540 power valve operator malfunct.

b) fails open Spurious Unwanted venting of RDT to Valve posit indic. in None CH-484 is set to signal mech. GRS. Possible over pres. of control room. Lo pres maintain 3 psig in RDT, binding or GRS. indic. from PIC-268, therefore GRS should Revision 15 valve operator excess N2 usage not be overpressurized.

malfunct.

when open 232) RDT Outlet Line a) fails open Mech. binding, No impact on normal operation. Valve posit. indic. in Redundant valve for CIAS, Containment valve operator Loss of redundant line isolation control room None for Hi RDT pres.

Isolation Valves; malfunct. on CIAS. For CH-560, possible except high pressure alarm CH-560, CH-561 overpres. to RDP suction on Hi from PIC-268 RDT pres

Table 9.3.4-3 (Sheet 48 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mech. failure, No impact on normal operation. Valve posit. indic. in None Loss of air or Unable to drain RDT control room power, valve operator malfunct.

233) RCP Leakoff a) fails closed Mech. binding, Loss of flow path for leakoff Containment sump None Flow rate is approx.

Line Check blockage from RCP vapor seals. Buildup level alarms 1.2 GPM total Valve, CH-487 of primary coolant on "Top" of vapor seals. Coolant may spill out over the RCP into containment.

PVNGS UPDATED FSAR b) fails open Mech. binding Possible diversion of RDT None None contents to RCP seal leakoff lines. Coolant may spill out over the RCP into containment.

234) RMWT Supply to a) fails closed Mech. failure No impact on normal operation. Operator Alternate path via valve RDT, Isolation Unable to supply RMW to RDT CH-580 9.3-216 Valve; CH-862 or to RDP suction to aid in pump down of RDT after high temp.

relief valve discharge.

b) seat Contamina- Unwanted RWM flow to RDT or Hi level indic. from None leakage tion, mechan- RDP suction. RDT level LIC-268 for flow to ical damage increase. Possible flow of RDT RDT. Lo level indic.

contents to resin supply header for flow from RDT 235) Reactor Drain a) fails open Mech. binding No impact on normal operation. Operator None Pump (RDP) Unable to isolate affected RDP Isolation Valves; for maint.

PROCESS AUXILIARIES CH-465, CH-472, CH-466, CH-473 Revision 14 b) fails closed Mech. failure Unable to put affected RDP Operator Redundant RDPs back in service after maint.

236) RDP Discharge Erroneous Electrical or No direct impact on operation. Periodic test None Pressure pressure indic. mech. PI-256 and PI-255 have no Indicators; malfunction control function. Possible early PI-256, PI-255 maint. on RDP 237) Reactor Drain a) fails to Electrical Unable to drain RDT or EDT. to RDT or EDT level Redundant pump Pumps; RDP 1 start malfunct., PHIX, gas stripper and holdup indic. pump "run" RDP 2 mech. binding tank indic. pump discharge or failure pres. indic.

b) Running same as pump above stops

Table 9.3.4-3 (Sheet 49 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects c) Pump Electrical Unwanted draining of RDT or RDT or EDT level EDT or RDT isolation Pumps are only started starts malfunct., EDT indic. pump "run" valves can be closed; manually, therefore this spurious indic. pump discharge pump power can be is a highly improbable signal pres. indic manually interrupted event.

238) RDT Discharge a) fails closed Mech. failure Unable to drain EDT or RDT. Hi discharge pres. Redundant RDP Check Valves; blockage Possible damage to RDP due to indic. for RDP CH-470, CH-471 dead heading b) fails open Mech. binding No impact on operation Pressure indicator None P-255 (P-256) when other RDP is running.

PVNGS UPDATED FSAR 239) Reactor Drain a) fails open Mech. binding No impact on normal operation. Operator None Filter Isolation Unable to isolate filter for maint.

Valves: CH-477, CH-478 b) fails closed Mech. failure Unable to return reactor drain Operator Reactor drain filter can be filter to operation after maint. bypassed via valve, 9.3-217 CH-474 240) Reactor Drain a) plugged Normal Unable to drain EDT or RDT Hi Delta P alarm from Drain flow can be diverted Filter, RDF contaminant through filter. PDI-258 by the filter while the buildup element is replaced b) doesn't Element Contaminants not removed from Low pressure Same as 240 a) filter "punch thru", drain flow. Contam. buildup in indication from wrong PHIX, gas stripper or holdup PDI-258.

element tank 241) RDF Differential a) spurious Elect. or No direct impact on operation. Hi Delta P alarms None Pressure Hi Delta mech. Possible early replacement of from PDI-258 with PROCESS AUXILIARIES Indicator; pressure malfunction, filter element normal indic. from PDI-258 alarm setpoint drift PI-255 or PI-256 b) erroneous Elect or mech. No impact on normal operation. Periodic test None Lo or malfunct. Unable to detect plugged filter normal element Revision 14 Delta P indic.

242) RDF Bypass a) fails closed Mech. failure No impact on normal operation. Operator None Valve; CH-474 Unable to bypass RDF for element replacement b) seat Contamina- Diversion of drain flow past Same as 240 b) None leakage tion, mech. RDF. Contaminant buildup in damage PHIX, gas stripper, or holdup tank 243) RDF Drain a) fails closed Mech. failure No impact on normal operation. Operator None Valve; CH-475 Unable to drain RDF for element replacement

Table 9.3.4-3 (Sheet 50 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) seat Contamina- No impact on normal operation. EDT level indic. None leakage tion, mech. Portion of drain flow from RDT damage or EDT diverted back to EDT 244) RDF Vent Valve, a) fails closed Mech. failure No impact on normal operation. Operator None CH-663 Unable to vent RDF when replacing element b) seat Contamina- Minor loss of primary coolant Local leak detectors None leakage tion, mech. outside containment local radiation monitor damage 245) Letdown a) fails open Mech. binding No impact on normal operation. Operator None Diversion Line Unable to isolate letdown PVNGS UPDATED FSAR Isolation Valve; diversion valve for maint.

CH-721 b) fails closed Mech. failure Unable to return letdown Operator None diversion line to service after maint., loss of letdown diversion 9.3-218 capability for feed and bleed or gas stripping operations 246) Letdown a) fails closed Mech. binding Loss of letdown diversion Lo flow indic. from Normal letdown flow path Diversion Line capability for feed and bleed or FI-202 can be maintained until Check Valve, gas stripping operations valve is repaired CH-722 b) fails open Mech. binding RDT and EDT drain flow None Letdown diversion line is diverted to letdown diversion closed by valve CH-500 line 247) Temperature a) spurious Elect. or EDT/RDT drain flow, or letdown Hi temp. alarm from None PROCESS AUXILIARIES Indicator/ Hi temp. mech. diversion flow diverted from TIC-264 with normal Controller; indic. and malfunction PHIX to gas stripper and/or indic. from TI-268, TIC-264 alarm setpoint drift holdup tank TI-269, and TIC-223 b) erroneous Elect. or No impact on normal operation. Periodic test None Lo or mech. Failure to detect Hi temp flow to Revision 14 normal malfunction PHIX. Possible damage to temp. PHIX indic.

248) PHIX Flow a) fails to gas Loss of air or RDT/EDT drain flow or letdown Valve posit. indic. in None, except that flow will Diversion Valve stripper power, flow diverted from PHIX to gas control room, Lo Delta be diverted to EDT on CH-565 spurious stripper. Contaminant buildup in P indic. from PDI-265 trouble conditions in gas signal valve gas stripper stripper operator malfunct.,

mech. failure

Table 9.3.4-3 (Sheet 51 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails to Spurious Unable to divert Hi temp. flow Periodic test, valve None PHIX signal, mech. past PHIX. Possible damage to not change posit. on binding, valve PHIX. Unable to route letdown demand operator flow directly to gas stripper for malfunct. continuous gas stripping 249) PHIX Isolation a) fails open Mech. failure No impact on normal operation. Operator None Valves; CH-724, Unable to isolate PHIX for CH-490 maint. or resin change b) fails closed Mech. failure Unable to restore PHIX to Operator Flow can be diverted past service after maint., possible PHIX until valve repaired PVNGS UPDATED FSAR contaminant buildup in gas stripper, holdup tank and/or VCT 250) PHIX Inlet Check a) fails closed Mech. binding, Unable to establish flow through Lo Delta P indic. from Same as 249 b)

Valve: CH-725 blockage PHIX. Possible contaminant PDI-265, Lo flow buildup in gas stripper, holdup indic. from FI-202 or tank and/or VCT High pres. indic. from 9.3-219 PI-255, or PI-256 b) fails open Mech. binding No impact on operation None None 251) PHIX Resin Fill a) fails closed Mech. failure No impact on operation. Unable Operator None Valve, CH-726 to add new resin to PHIX b) seat Contamina- Possible release of radioactive Radiation monitors Flow can be diverted past leakage tion, mech gas outside containment PHIX until valve is repaired damage.

252) PHIX Differential a) spurious Elect. or No direct impact on operation. Hi Delta P alarm not None Pressure Hi Delta P mech. Possible early change out of clear when flow PROCESS AUXILIARIES Indicator; indic. and malfunction PHIX resin diverted to gas PDI-265 alarm setpoint drift stripper b) false Lo or Elect. or Unable to detect degradation of Periodic test None normal mech. PHIX resin Delta P malfunction Revision 14 indic.

253) PDI-265 a) fails open Mech. binding No impact on normal operation. Operator None Isolation Valves; Unable to isolate PDI-265 for CH-727, CH-492 maint.

b) fails closed Mech. failure Unable to place PDI-265 back in Operator For CH-727 - None for service after maint. CH-492, valve CH-488 can be opened to take pres.

diff. across just the PHIX 254) PDI-265 a) fails closed Mech. failure No impact on system operation. Operator None Isolation Valve, Unable to place PDI-265 across CH-488 just the PHIX rather than across PHIX and strainer

Table 9.3.4-3 (Sheet 52 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) seat Mech. PDI-265 will be measuring Delta None None leakage damage P across just the PHIX when it contamination should be measuring Delta P across PHIX and strainer.

Possible failure to detect PHIX degradation or strainer degradation 255) 256) PHIX Vent a) fails closed Mechanical No impact on normal operation. Operator None Valve; CH-728 failure, Unable to vent PHIX during blockage drain and flush operations PVNGS UPDATED FSAR b) seat Contamina- Diversion of radioactive gases None None leakage tion, mech. to GRS. No impact on damage operation 257) PHIX and PHIX a) fails closed Mech. binding, No impact on normal operation. Operator None Strainer Flush blockage Spent resin in PHIX or resin in 9.3-220 Valves to SRS; PHIX or resin trapped in CH-730, CH-489 strainer, cannot be flushed to the SRS b) seat Mech. Part of flow through PHIX will be Level indicators in Isolation valves in SRS leakage damage, diverted to SRS SRS contamination 258) PHIX Sluice a) fails closed Mech. binding, No impact on normal operation. Operator None Valve; CH-485 blockage Unable to flush PHIX with RMW during resin replacement b) seat Contamina- Part of flow through PHIX will be None Check valve and isolation PROCESS AUXILIARIES leakage tion, mech. diverted to the sluice supply valve on RMW supply line damage header. Possible contamination to sluice supply header of RMW supply 259) PHIX Drain a) fails closed Mech. binding, No impact on normal operation. Operator None Valve; CH-486 blockage Unable to drain PHIX after flushing spent resin b) seat Contamina- Portion of flow through PHIX Level indications, or Isolation valve CH-457 on leakage tion, mech. diverted to EDT high level alarms from DIDH Revision 15 damage LIC-251 260) Pre-Holdup Ion a) fails to Spent resin Buildup of activity in holdup tank High P alarm from Bypass PHIX and replace Exchanger; remove PDI-265 resin PHIX contami-nation b) restricts Plugged Unable to divert letdown flow High Delta P alarm Bypass PHIX and replace flow during feed and bleed from PDI-265 resin operations

Table 9.3.4-3 (Sheet 53 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects c) external Corrosion, Local spill of primary coolant Local leak detectors PHIX can be bypassed and leakage mfg. defect, outside containment isolated for repair mech.

damage 261) PHIX Strainer a) fails to Element Buildup of contamination in Local sample PHIX and strainer can be remove "punch holdup tank, gas stripper, or analysis. bypassed and isolated for particulate through" VCT strainer repair matter wrong element b) plugged Normal Reduced flow through PHIX. Hi Delta P alarm from Same as above PVNGS UPDATED FSAR buildup of Reduced letdown flow during PDI-265, Low flow contaminants feed and bleed operations. indic. F-202 if diverting letdown 262) PHIX Strainer a) fails open Mech. binding No impact on normal operation. Operator None Isolation Valve; Unable to isolate strainer for CH-491 maint.

9.3-221 b) fails closed Mech. failure, Unable to restore PHIX to Operator PHIX can remain bypassed blockage service after maint. on strainer. until valve repaired, or Possible buildup of activity in operations can be holdup tank if feed and bleed or interrupted for valve repair other operations requiring PHIX are in progress 263) PHIX to Holdup a) fails closed Mech failures; Unable to route letdown or RCS Operator Flow can be routed to HT Tank Isolation blockage drain flow through PHIX directly thru gas stripper, or flow Valve; CH-655 to holdup tank. Possible forced can be routed to RWT termination of feed and bleed PROCESS AUXILIARIES b) fails open Mech. binding Portion of flow to the gas Operator (for stuck HT is vented to GRS when open, or stripper (GS) will be diverted to open). None for seat seat leakage HT. Possible buildup of gases leakage in HT 264) PHIX to RWT a) fails closed Mech. failure, No impact on normal operation. Operator Flow can be routed to HT, Isolation Valve; blockage Unable to route letdown or RCS and from there to the RWT CH-495 drain flow to RWT after it passes through PHIX Revision 15 b) fails open Mech. binding Portion of flow to GS will be Operator, RWT level Series redundant isolation when open, or diverted to RWT. Possible indicator valve, CH-124 seat leakage buildup of gasses in RWT 265) PHIX to Gas a) fails open Mech. binding No impact on normal operation. Operator Series redundant isolation Stripper Isolation Portion flow from PHIX to RWT valve, CH-660, can be Valve; CH-496 or holdup tank will be diverted to closed GS

Table 9.3.4-3 (Sheet 54 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mech. binding Unable to establish continuous Operator HT and RWT are degasification of letdown flow. continuously vented to Unable to degassify PHIX GRS VCT already has H2 discharge flow. Possible gas blanket.

buildup in RWT, HT, or VCT 266) Diversion Valve, a) fails to gas Mech. binding No impact on normal operation. Periodic test None CH-566 stripper valve operator Unable to divert flow to EDT on malfunction GS trouble condition. GS efficiency reduced. Possible damage to GS b) fails to Loss of air or Flow to GS diverted to EDT. EDT level alarms, Flow to gas stripper can be PVNGS UPDATED FSAR EDT power, Loss of degasification capability. valve position interrupted until valve spurious Possible overfilling of EDT indication in control repaired signal, valve room operator failure 9.3-222 267) Makeup supply a) fails closed Mech. binding, No impact on normal operation. Operator None Header to Gas blockage Unable to flush GS with RMW Stripper, prior to maint.

Isolation Valve; CH-654 b) seat Contamina- Primary coolant flow to gas None Isolation and check valves leakage tion, mech. stripper (during degasification) on makeup supply header damage diverted to makeup supply header. Possible contamination of RMW supply RMW diverted to gas stripper None except None Dilution would be very PROCESS AUXILIARIES during makeup operations. boronmeter if dilution minor unless continuous Possible subsequent dilution of is significant letdown degasification is boric acid concentration in HT or in process, seat leakage VCT is significant and makeup pumps are in operation 268) Gas Stripper a) fails open Mech. binding No impact on normal operation. Operator Isolation valve CH-496 can Revision 15 Isolation Valve, Unable to isolate gas stripper for be closed CH-660 maintenance.

b) fails closed Mech. failure Same as 265 b) 269) Gas Stripper to a) fails open Mech. binding No impact on normal operation. Operator None EDT Drain Unable to isolate GS for maint.

Valve, CH-662 b) fails closed Mech. failure No direct impact on normal Operator, local leak None operation. Possible minor spill detectors and of primary coolant if gas stripper radiation monitors components have excess leakage

Table 9.3.4-3 (Sheet 55 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 270) Gas Stripper a) fails open Mech. binding No impact on normal operation. Operator None Sample Valve to Unable to isolate GS for maint Gas Analyzer; CH-467 b) fails closed Mech. failure Unable to sample GS with Gas Operator None Analyzer 271) Gas Stripper, GS a) fails to Loss of aux Buildup of gasses in primary Local sample HT is vented to GRS. VCT remove steam, loss of coolant, HT or VCT. analysis, gas analysis already has H2 blanket.

gases cooling water, PVNGS UPDATED FSAR mech.

malfunction 272) Diversion Valve a) fails to Mech. failure, Unable to divert letdown flow to Hi VCT level alarms. None CH-567 VCT valve operator holdup tank during feed and Valve position position failure bleed or on Hi VCT level. indicator in control Possible overfilling of VCT room 9.3-223 b) fails to Loss of air or Letdown flow diverted to hold-up VCT level alarms. Hi Makeup system will holdup power, tank during degasification of level alarms, valve maintain VCT inventory tank spurious primary coolant. Decrease in position indicator in position signal, mech. VCT inventory control room failure, valve operator fail 273) Isolation Valves; a) fails open Mechanical No impact on normal operation. Operator None CH-656, CH-651 binding Unable to isolate radiation monitor, or HT for maintenance b) fails closed Mech. failure Unable to reestablish flow path Operator None PROCESS AUXILIARIES to HT after maint. Unable to empty drain tanks to HT.

Unable to conduct feed and bleed operations 274) Deleted 275) Hold Up Tank a) spurious Elect. or Transfer of holdup tank contents Low level alarm from None Level Indicator low level mech. to BAC will be terminated. LIC-208, and Revision 15 Controller, alarms or malfunct., Possible overfilling of HT due to inspection LIC-208 indications setpoint drift undetected HI level in HT

Table 9.3.4-3 (Sheet 56 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) spurious Same as No direct impact on normal Hi level alarm from None Hi level above operation. Possible undetected LIC-208, and test indications low level conditions in HT.

or alarms Possible damage to holdup pumps if HT is drained 276) Holdup Tank a) spurious Elect No impact on system operation Lo temp. alarm from None Temperature low temp malfunct., TI-208 and test Indicator, TI-208 alarm setpoint drift b) false Hi or Elect. No impact on normal operation. Periodic test None normal malfunct. Unable to detect decreasing PVNGS UPDATED FSAR temp temp. in HT. Possible boron indications precipitation if temp. drops 277) Holdup Pump to a) fails open Mech. binding No impact on normal operation. Operator None Holdup Tank Unable to isolate HT for maint Isolation Valves CH-650 9.3-224 b) fails closed Mech. failure Unable to transfer HT contents Operator None to BAC for processing 278) Holdup Tank HT leaks mfg defect, Loss of primary coolant quality HT level indicator None mech. water outside containment local leak detectors damage, corrosion 279) Ion Exchanger a) fails open Mech. binding No impact on normal operation. Operator None Drain Header Unable to isolate DIDH strainer (DIDH) Strainer for maint Isolation Valves, PROCESS AUXILIARIES CH-451, CH-454 b) fails closed Mech. failure Unable to return DIDH strainer Operator None to service after maint. Unable to drain ion exchangers during resin replacement operations 280) DIDH Strainer a) fails to Element Buildup of contaminants in EDT Local sample None remove "punch analysis, possibly low contam- through", differential pressure Revision 14 inants wrong indication from element PDI-250 b) plugged Normal Unable to drain ion exchangers High Delta P alarm Isolate and clean strainer contaminant during resin replacement from PDI-250 buildup operations 281) DIDH Strainer a) fails closed Mech. failure, No impact on normal operation. Operator None Drain Valve, blockage Unable to drain and clean CH-455 strainer

Table 9.3.4-3 (Sheet 57 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2007 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) seat Contamina- Minor diversion of ion None None leakage tion, mech. exchanger drain flow to solid damage waste management system 282) DIDH Strainer a) spurious Elect. or No adverse impact on Hi Delta P alarm from None Differential Hi Delta P mech. operation. Early maint. on PDI-250 and test Pressure alarm malfunction, strainer Indicator, setpoint drift PDI-250 b) false low Elect. or No impact on normal operation. Periodic test None PVNGS UPDATED FSAR or normal mech. Failure to detect plugged Delta P malfunction strainer readings 283) DIDH Flow Erroneous Elect. or No impact on normal operation. Periodic test None Sensor, F-251 flow mech. Flow sensor has only local indications malfunction readout and has no control function 284) DIDH Isolation a) fails closed Mech. failure, No impact on normal operation. Operator None 9.3-225 Valve; CH-457 blockage Unable to drain ion exchangers during resin replacement b) fails open Mech. binding Possible diversion of primary Operator for mech. Isolation Valves for the ion when open, coolant from ion exchangers to binding when open, exchangers seat leakage EDT otherwise none 285) DIDH Check a) fails closed Mech. failure, Same as 284 a) No flow indic. from None Valve, CH-480 blockage F-250 when CH-457 opened PROCESS AUXILIARIES b) fails open Mech. binding, No impact operation None Isolation valve, CH-457 seat leakage 286) Equipment Drain a) spurious Elect. or mech No impact on normal operation. Hi level alarm LIC-251 None Tank (EDT) high level malfunct., Failure to detect Lo EDT level and test Level Indicator/ indications setpoint drift and stop drain pumps during Controller; EDT draining. Possible damage LIC-251 to drain pumps b) spurious Elect. or Unable to detect Hi level in Lo level alarm from None Lo level mech. EDT. Possible overfilling of LIC-251 and test Revision 14 indication malfunction EDT. Possible trip of RDP's or alarm when pumping down EDT 287) EDT a) spurious Elect. or No impact on operation. TI-269 Hi temp. alarm from None Temperature Hi temp. mech. has no control funct. TI-269 and test.

Indicator, TI-269 indications malfunct., Normal pres indic.

or alarms setpoint drift from PIC-251 b) erroneous Elect. or No impact on normal operation. Periodic test PIC-251 may indic. Hi pres Lo or mech. Unable to detect Hi temp if EDT temp went up normal malfunct. condition in EDT temp indic.

Table 9.3.4-3 (Sheet 58 of 71)

CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

June 2009 FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 288) EDT Pressure a) spurious Elect. or mech PIC-251 will close valves Hi pres alarm from None Indicator/ Hi press malfunct. CH-563, CH-564, CH-562, test PIC-251, and test Controller, indic. or effectively isolating EDT. Loss PIC-251 alarm of recycle drain capability.

Unable to drain EDT b) erroneous Elect. or No impact on normal operation. Periodic test None Lo or mech. Failure to isolate EDT on high normal malfunct pres. condition. Possible over-pres. indic. pressurization of GRS line and/or reactor drain pumps PVNGS UPDATED FSAR 289) EDT to GRS a) fails open Mech. binding, No impact on normal operation. Valve posit. indic. in None Isolation Valve; valve operator Unable to isolate lines to GRS control room CH-564 failure on Hi. pres. in EDT. Possible overpres. of GRS lines b) fails closed Loss of air or Loss of ability to vent EDT to Valve posit. indic. in None power, mech. GRS. Possible pres increase in control room. Pres failure, valve EDT. indic. from PIC-251 9.3-226 operator failure, spurious signal 290) Gas Analyzer a) fails open Mech. binding No impact on normal operation. Operator CH-564 can be closed Manual Isolation Unable to isolate Gas Analyzer Valve, CH-458 for maint b) fails closed Mech. failure Unable to restore one line to Operator Alternate data via CH-568 Gas Analyzer to service after PROCESS AUXILIARIES maint 291) EDT to GRS a) controls Mech. Possible overpressurization of Lo pres. indic. from N2 regulator will adjust to Valve can be isolated Line Pressure back- malfunct., GRS lines. Decrease in EDT PIC-251. Increase in maintain proper EDT pres. and repaired Control Valve; pressure setpoint drift pres. Increased N2 use N2 usage CH-568 too low b) controls Mech. Decreased venting of gases in Hi press. indic from N2 Regulator will adjust to back- malfunction, EDT. Possible pres. increase in PIC-251. Decrease in maintain proper EDT pres.

pressure setpoint drift EDT. Decreased N2 use N2 in N2 usage too high Revision 15 292) Recycle Drain a) fails open Mech. binding No impact on normal operation. Valve position Check valve CH-450 will Header Isolation valve operator Failure to isolate drain header indicator in control provide some protection Valve CH-562 failure from EDT on Hi pressure in room EDT. Possible overpressure in drain header

Table 9.3.4-3 (Sheet 59 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) fails closed Mech. failure, Loss of drain capability for Valve position None valve operator various leakoff lines indication in control failure, loss of room air, or power, spurious signal 293) Recycle Drain a) fails closed Mech. failure, Same as 292 b) None None Header Check blockage Valve, CH-450 PVNGS UPDATED FSAR b) fails open Mech. binding No impact on normal operation. None Valve CH-562, will provide Partial loss of isolation capability isolation for drain header 294) N2 Supply Line a) fails open Mech. binding No impact on normal operation. Operator None Isolation Valve; Unable to isolate N2 pres.

CH-830 control valve for maint.

b) fails closed Mech. failure Unable to restore N2 supply Operator None 9.3-227 after maint. Loss of proper pres. control and vent/purge capability for EDT 295) EDT N2 a) controls Mech. failure, Decrease in EDT Vent/Purge Lo pres. indic from Vent pres. control valve will Pressure Control pressure setpoint drift rate. Decreased EDT pressure PIC-251 close to maintain EDT Valve; CH-831 too low press b) controls Mech. failure, Possible overpressurization of Hi pres. indic. from Vent pres. control valve will pressure setpoint drift EDT, excess N2 usage PIC-251 attempt to maintain EDT PROCESS AUXILIARIES too high press. Relief valve CH-657 296) EDT Relief a) fails closed Mech. binding, No impact on normal operation. Periodic test None Valve, CH-657 blockage, Loss of overpres. protection for setpoint drift EDT b) fails open Spring failure, Primary coolant diverted from EDT level indic. sump None setpoint drift EDT to misc radioactive sump level indic. Local radiation monitor 297) RSSH to EDT a) fails closed Mech. binding, No impact on normal operation. EDT level indic, Lo Alternate flow path via, Revision 14 Check Valve; blockage Unable to cooldown EDT with RMW flow indic. from valve CH-562 CH-858 this line and pump down EDT F-249 after high temperature relief discharge due to flashing in RDP suction 298) Equipment Drain Leakage Mfg. defect, Loss of primary coolant outside Lo level alarm from Isolate and drain EDT for Tank, EDT mech. containment LIC-251, local leak maint.

damage, detector, radiation corrosion monitor

Table 9.3.4-3 (Sheet 60 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 299) EDT Drain Line a) fails open Mech. binding Possible unwanted draining of Valve position indic. in For emptying EDT, Isolation Valve, valve operator EDT during draining of RDT. control level LIC-251 will stop drain CH-563 failure Possible overpressization of indic./controller pumps. Otherwise, none drain pump suction lines on high LIC-251, pres.

pressure in EDT indic./controller, PIC-251 b) fails closed Mech. failure, No impact on normal operation. Valve position None valve operator Unable to drain EDT indicator in control malfunct. loss room PVNGS UPDATED FSAR of air or power spurious signal 300) EDT Drain Line a) fails closed Mech. failure, Same as 299 b) EDT level not None Check Valve, blockage decrease when CH-464 attempt to pump out EDT 9.3-228 b) fails open Mech. binding No impact on normal operation. None unless EDT Valve CH-563 will be Possible flow diversion to EDT level increases closed when draining RDT 301) Local Sample a) fails closed Mech. failure, No impact on normal operation. Operator None Valves: CH-665, blockage Unable to obtain local sample CH-723, CH-493, CH-652 b) seat Contamination Local spill of primary coolant Local leak detectors, None PROCESS AUXILIARIES leakage mech. or radiation detectors damage 302) EDT Local Drain a) fails closed Mech. binding No impact on operations. Operator None Valve; CH-462 Unable to drain EDT for maintenance b) seat Contamination Possible leakage of primary Local leak detectors Drain line is blind flanged leakage mech. coolant outside containment or radiation monitors damage 303) Holdup Pump a) fails open Mech. binding No impact on normal operation. Operator None Revision 14 Suction Isolation Unable to isolate one holdup Valves, CH-720, pump for maint.

CH-734 b) fails closed Mech. failure Unable to restore one holdup Operator Redundant holdup pump pump (HP) to service after maint 304) Holdup Pump; a) won't start Elec. failure Unable to transfer contents of Operator, discharge Redundant holdup pump HP 1, HP 2 mech. failure HT to BAC for processing. pressure indicator Unable to recycle contents of HT for additional cleanup

Table 9.3.4-3 (Sheet 61 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) spurious Elect. High transfer rate if pumping HT HT level indicators Power can be manually Since pumps can only startup malfunction, contents to BAC. Possible BAC instrumentation interrupted be started via a local spurious unwanted transfer of HT pump run indicators HS, this is a highly signal contents to BAC, pump damage improbable incident if isolated 305) Holdup Pump a) spurious Elect. or No impact on normal operation. Periodic test Redundant holdup pump Discharge High or mech. Pressure indicators have no Pressure Low pres. malfunction control function. Possible Indicators; indic. unneeded maintenance on PI-270, holdup pump PI-271 PVNGS UPDATED FSAR 306) Holdup Pump a) fails closed Mech. failure, Unable to transfer contents of High pres. indic. from Redundant holdup pump Discharge Check blockage HT to BAC, or to recirculate HT HP discharge pres.

Valves; CH-759, contents indicator CH-735 b) fails open Mech. binding No impact on normal operation. None Suction isolation valve for Possible reverse flow thru standby HP is closed 9.3-229 standby HP 307) Holdup Pump a) fails open Mech. binding No impact on normal operation. Operator None for maint.

Discharge Unable to isolate line to BAC for Redundant HP for HT Isolation Valve; maint. or recirculation of HT recirc.

CH-658, CH-737 contents b) fails closed Mech. failure Unable to transfer HT contents Operator Redundant HP can be to BAC for processing after used maintenance 308) Holdup Pump a) fails open Mech. binding No impact on normal operation. Operator Redundant HP can be Recirculation Unable to isolate holdup pump used PROCESS AUXILIARIES Valves; CH-430, for maint.

CH-446 b) fails closed Mech. failure Unable to restore HP Operator Redundant HP can be recirculation line after pump used maint. Possible damage to pump due to dead heading 309) HT to Reactor a) fails closed Mech. binding, No impact on normal operation. High pres. indic. from None Drain Filter Line blockage Unable to recycle HT contents HP discharge pres.

Revision 14 Check Valve, through reactor drain filter, PHIX indic.

CH-685 or GS for additional clean up b) fails open Mech. binding No impact on normal operation. None Valve CH-686 is normally Possible diversion of reactor closed drain tank flow directly to BAC 310) HT to Reactor a) fails closed Mech. binding, Same as 309 a) Operator None Drain Filter blockage (RDF) Isolation Valve, CH-686 b) fails open Mech. binding Same as 309 b) Operator Check Valve CH-685

Table 9.3.4-3 (Sheet 62 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 311) HT to Liquid a) fails closed Mech. failure No impact on operations. Operator None Radwaste blockage Unable to transfer fluid to LRS System Isolation Valve, CH-684 b) seat Contamina- Possible spill of primary coolant Local leak detectors Line is blank flanged leakage tion, mech grade water damage 312) BAC Bypass a) fails closed Mech. failure, No impact on normal operation. Operator None if BAC in service Line to BACIX, blockage Unable to divert HP flow to PVNGS UPDATED FSAR Isolation Valve, BACIX if reactor makeup water CH-683 is needed when BAC out of service b) seat Contamina- Portion of HP flow diverted past None None leakage tion, mech. BAC. Increased depletion of damage BACIX resin. Possibly eventual boron carry over to reactor 9.3-230 makeup water tank (RMWT) 313) BAC Bypass a) fails closed Mech. failure Same as 312 a) Hi pres. reading from None if BAC in service Line to BACIX, blockage HP discharge pres.

Check Valve; indic. when CH-683 CH-682 open b) fails open Mech. binding Possible diversion of BAC None Isolation Valve CH-683 purified water output back to HP discharge line 314) BAC Bypass to a) fails closed Mech. failure, No impact on normal operation. Operator Operator can make up a PROCESS AUXILIARIES RWT, Isolation blockage Unable to divert HP flow to RWT batch of concentrated boric Valve, CH-752 if RWT inventory must be acid solution in BABT and increased when BAC out of add to RWT service b) seat Contamina- Portion of HP flow diverted past None unless RWT is RWT concentration can be leakage tion, mech. BAC to RWT or LRS. Possible diluted, then, local increased by adding damage dilution of RWT sample analysis concentrated boric acid solution from BABT 315) BAC Bypass a) fails closed Mech. binding, Same as 314 a) Hi pres. indication on None Revision 15 Line to RWT, blockage HP discharge pres.

Check Valve, indic. when CH-752 CH-718 open b) fails open Mech. binding Possible diversion of None Isolation valve CH-752 concentrated boric acid bottoms from BAC output back to HP discharge line

Table 9.3.4-3 (Sheet 63 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 316) Boric Acid a) fails to Electrical or Concentration of boric acid Various BAC indic. BACIX for boron carryover.

Concentrator concen- mech. bottoms released to RWT too and alarms, local Boric acid batching for low BAC trate boric malfunction low. Dilution of RWT. Possible sampling of RWT and boron concentrate in RWT acid control boron carryover to RMWT RMWT enough malfunct.

insufficient steam supply b) concen- Same as Concentration of boric acid Local sampling of No safety problem trates boric above bottoms released to RWT too RWT, reactor power PVNGS UPDATED FSAR acid too high. RWT boron concentration decrease much increase, possible over boration of RCS c) leakage Mfg defect, Release of primary coolant Local leak detectors None corrosion, quality water, or concentrated or radiation monitors mech. boric acid solution outside damage containment 9.3-231 317) BAC Isolation a) fails open Mech. failure No impact on normal operation. Operator Isolation valves on. BAC Valves; CH-708, Unable to isolate BAC for maint skid, and downstream CH-611, CH-732 b) fails closed Mech. failure, For CH-708, CH-611, unable to Operator None blockage return BAC to service after maint. For CH-732, unable to provide RMW to flush BAC 318) BAC to RWT a) fails open Mech. binding No impact on normal operation. Operator Series redundant isolation Isolation Valve; Unable to isolate line to RWT valve downstream PROCESS AUXILIARIES CH-709 when transferring highly concentrated, activated bottoms to LRS b) fails closed Mech. failure, Unable to transfer concentrated Operator Alternate sources for RWT blockage boric acid bottoms from BAC to inventory, including boric RWT. Unable to make up RWT acid batching and spent inventory losses fuel pool 319) BAC to LRS a) fails closed Mech. failure, No impact on normal operation. Operator None Isolation Valve; blockage Unable to transfer highly Revision 15 CH-499 concentrated activated boric acid bottoms from BAC to LRS for processing b) fails open Mech. binding Diversion of refueling shutdown Operator for binding, None when open, concentration boric acid bottoms none for seat leakage seat leakage being transferred to RWT.

Excess waste generation.

Reduced RWT inventory makeup ability

Table 9.3.4-3 (Sheet 64 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 320) Relief Valve a) fails closed Mech. binding, No impact on normal operation. Periodic test None CH-689 blockage, Loss of overpressure protection setpoint drift for potentially closed line section b) fails open Spring failure, Same as 319 b) Periodic test None setpoint drift 321) BAC Concen- fails off Electo failure Possible precipitation of boric Heat tracing status Redundant heat tracing trator Concen- acid in lines, causing blockage indicator circuit trate Line Heat Tracing 322) BACIX Bypass a) fails closed Mech. failure, No impact on normal operation. Operator None Line Isolation blockage Unable to bypass BACIX when PVNGS UPDATED FSAR Valve; CH-619 BACIX needs maint.

b) seat Contamina- Portion of BAC distillate Local sample of None leakage tion, mech. bypasses BACIX. Possible RMWT damage boron carryover to RMWT 323) BACIX Isolation a) fails open Mech. binding No impact on normal operation. Operator Redundant isolation valves 9.3-232 Valves; CH-699 Unable to isolate BACIX for upstream and downstream CH-670 maint. or resin replacement b) fails closed Mech. failure, Unable to restore BACIX to Operator BACIX can be bypassed blockage service after maint. while valve is repaired 324) BACIX Inlet a) fails closed Mech. binding Unable to pass BAC distillate Lo flow indic. from BACIX can be bypassed Check Valve; blockage thru BACIX to remove carryover BAC distillate flow while valve is repaired CH-696 boron indicator b) fails open Mech. binding No impact on operation None None 325) BMWT recirc to a) fails closed Mech. failure, No impact on normal operation. Operator None Infrequent operation BACIX Line blockage Unable to recirc the RMWT PROCESS AUXILIARIES Isolation Valve, through the BACIX CH-690 b) seat Mech. defect Minor diversion of BAC distillate None Redundant isolation valves leakage or damage, to RMW header. Possible minor downstream contamination contamination of resin sluice supply water 326) BACIX Resin Fill a) fails closed Mech. failure, No impact on normal operation. Operator None Valve, CH-679 blockage Unable to add new resin to BACIX b) seat Contamina- No impact on operation None Resin fill line is blind leakage tion, mech. flanged Revision 14 damage 327) BACIX a) spurious Elect. or Early replacement of BACIX High P, P-274 alarm None Differential Hi Delta mech. failure, resin Pressure pres. setpoint drift Indicator, alarm PDI-274

Table 9.3.4-3 (Sheet 65 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) false low Elect. or No impact on normal operation. Periodic test None or normal mech. Failure to detect plugged BACIX Delta P malfunct.

indic.

328) BACIX a) fails open Mech. binding No impact on normal operation. Operator None Differential Unable to isolate PDI-274 for Pressure maint Indicator Isolation Valves; CH-693, CH-677 PVNGS UPDATED FSAR b) fails closed Mech. failure Unable to restore PDI-274 to Operator None for CH-693, for service after maint CH-677, valve CH-678 can be opened to obtain Delta P indic. across just the BACIX 329) BACIX a) fails closed Mech. failure No impact on normal operation. Operator None 9.3-233 Differential Unable to set PDI-274 to indic.

Pressure Delta P across just the BACIX Indicator Isolation Valve, CH-678 b) seat Contamina- PDI-274 will read Delta P across None None leakage tion, mech. just the BACIX. Possible failure damage to detect plugged BACIX strainer 330) BACIX Vent a) fails closed Mech. binding No impact on normal operation. Operator None PROCESS AUXILIARIES Isolation Valve, Unable to vent BACIX during CH-680 resin replacement operations b) seat Contamination Minor releases of gases to GRS None None leakage mech. during normal operation damage 331) BACIX/BACIX a) fails closed Mech. binding, No impact on normal operation. Operator None Strainer Sluice blockage Unable to sluice resin and Valves; CH-676, contaminants out of BACIX or Revision 15 CH-675 the BACIX strainer b) seat Contamina- Minor diversion of BAC distillate None None leakage tion mech. flow (and resin for CH-676) to damage LRS 332) BACIX Flush a) fails closed Mech. binding No impact on normal operation. Operator None Valve; CH-687 Unable to provide RMW to flush BACIX during resin replacement

Table 9.3.4-3 (Sheet 66 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects b) seat Contamina- Minor diversion of BAC distillate None Normally closed upstream leakage tion, mech. to resin sluice supply header or valves damage diversion of RMW from resin sluice supply header back to RMWT 333) BACIX Drain a) fails closed Mech. binding No impact on normal operation. Operator None Valve, CH-688 Unable to drain BACIX for resin sluicing b) seat Contamina- Minor diversion of BAC distillate None Normally closed leakage tion, mech flow to EDT downstream valve PVNGS UPDATED FSAR damage 334) Boric Acid a) fails to Resin Possible boron carryover from Local sample analysis Bypass BACIX and replace Condensate Ion remove depleted BAC to RMWT resin Exchanger, boron BACIX 9.3-234 b) plugged Buildup of Loss of BAC distillate flow to Hi Delta P indic from Same as above contaminants RMWT PDI-274 c) external Mfg. defect. Local spill of BAC distillate and Local leak detectors Bypass BACIX and repair leakage corrosion, resin and radiation monitors mech.

damage 335) BACIX Strainer a) fails to Element Possible buildup of Local sample analysis Bypass BACIX and repair remove "punch thru", contaminants in RMWT strainer contami- wrong nants element PROCESS AUXILIARIES b) plugged Normal Same as 334 b) Same as 334 b) Bypass BACIX and clean contaminant strainer buildup 336) BACIX Strainer a) fails open Mech. binding No impact on normal operation. Operator Redundant isolation valve Downstream Unable to isolate BACIX strainer downstream Isolation Valve: for maint.

CH-671 b) fails closed Mech. failure Unable to restore BACIX to Operator BACIX remains bypassed Revision 15 service after maint. on strainer until valve repaired 337) BACIX to LRS a) fails closed Mech. failure No impact on normal operation. Operator None Isolation Valve; Unable to dump BAC distillate to CH-673 LRS when BACIX is out of service b) seat Mech. Minor diversions of BAC None None leakage damage distillate to LRS

Table 9.3.4-3 (Sheet 67 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 338) Isolation Valves a) fails open Mech. binding No impact on normal operation. Operator None CH-672, CH-729 Unable to isolate RMWT and BACIX when dumping BAC distillate to LRS. Possible contamination of RMWT b) fails closed Mech. failure Unable to restore BAC distillate Operator None flow thru BACIX to RMWT 339) RMWT Level a) spurious Elect or mech. LIC-210 will stop reactor Lo-Lo level alarms None Makeup operations to Indicator/ Low-Low malfunct., makeup water pumps (RMWP), from LIC-210, periodic the VCT or charging Controller level setpoint drift thereby terminating RMW flow. test pumps will be seemed PVNGS UPDATED FSAR LIC-210 indication Possible over boration of RCS. on loss of RMW pumps.

or alarms Failure to detect overfilling of RMWT b) spurious Elect. or No impact on normal operation. Hi level alarms from None Hi level mech. Possible early termination of LIC-210, periodic test 9.3-235 indications malfunction holdup tank processing through or alarms setpoint drift BAC. Failure to detect Lo-Lo level in RMWT and stop RMWPs. Possible cavitation damage to pumps 340) RMWT a) spurious Elect. or No direct impact on operation. Lo temp. alarms from None Temperature Low temp. mech. TI-210 and test Indicator TI-210 indic. or malfunction, alarm setpoint drift b) spurious Elect. or No direct impact on operation. Periodic test None Hi or mech. Unable to detect Low temp.

PROCESS AUXILIARIES normal malfunction condition in RMWT. Possible temp. undetected freezing of RMWT indic.

341) Reactor Makeup a) external Mfg. defect, Loss of RMW inventory loss of Lo-Lo level alarms Isolate RMWT and repair Reactor shutdown might Water Tank, leakage mech. makeup capability from LIC-210 be required RMWT damage 342) RMWT Isolation a) fails open Mech. binding No impact on normal operation. Operator RMWP isolation valves can Valve; CH-771 Unable to isolate RMWT for be closed Revision 15 maint.

b) fails closed Mech. failure Unable to provide RMWT flow Operator None after maintenance 343) RMWP Isolation a) fails open Mech. failure No impact on normal operation. Operator Check valves CH-775 for Two sets of isolation Valves; CH-772, Unable to isolate RMWP for valve CH-776, and check valves, suction and CH-776, maint. valve CH-777 for valve discharge, for the two CH-773, CH-778 RMWPs CH-778 b) fails closed Mech. failure Unable to restore RMWP to Operator Redundant RMWP service after maint

Table 9.3.4-3 (Sheet 68 of 71)

June 2009 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 344) Reactor Makeup a) fails to Loss of power, Unable to provide makeup water Low pres. alarms from Redundant RMWP A low flow downstream Water Pumps; start elect. failure, to VCT or to makeup water pump discharge pres. FQRC-210X will stop RMWP 1, mech. failure headers indic. automatic makeup RMWP 2 operations.

b) operating Same as Loss of RMW flow to VCT or Same as above Redundant RMWP pump above makeup water headers stops c) standby Spurious Sudden increase (or start) of Hi pres indic. from FQRC-210X will modulate Normally this failure in pump signal, elect. RMW flow. Excess usage of pump discharge pres. valve CH-210X to maintain the makeup controller PVNGS UPDATED FSAR starts up malfunct. RMW, possible deboration of indic Hi flow indic. proper flow to VCT or would cause both RCS from RMW flow indic. RCS, operator can RMWP & BAMP's to Possible high VCT manually stop pump start which would level alarm. maintain proper boron concentration in VCT 345) RMWP a) spurious Elect. or RMWP will be stopped on Lo pres alarm from Redundant RMWP Same as 339 a) 9.3-236 Discharge Lo pres. mech. spurious Lo discharge pres. loss pres. indic.

Pressure indic. or malfunct. of RMW flow. Possible over Indicators; alarm setpoint drift boration of RCS PI-208, PI-209 b) false Elect. or No impact on normal operation. Periodic test. Lo flow Operator can manually trip normal mech. Failure to detect pump indic. from pump and start redundant pres indic. degradation and trip pump FQRC-210X pump 346) RMWP a) fails closed Mech. failure Unable to initiate RMW flow. High press. indic. Redundant RMWP Discharge Check blockage Possible damage to RMWP from discharge pres.

valves CH-775, indic.

CH-777 PROCESS AUXILIARIES b) fails open Mech. binding No direct impact on normal Possible low pressure None operation. Possible reverse indication/alarm from flow thru standby pump running pump 347) RMWP a) fails open Mech. binding No impact on normal operation. Operator None Recirculation Unable to isolate RMWP for Valves; CH-794, maint.

CH-140 Revision 15 b) fails closed Mech. failure Loss of RMWP recirculation Operator None path. Possible pump damage if pump is deadheaded 348) Reactor Makeup a) doesn't Wrong Possible buildup of Local sampling, Isolate and bypass filter for Filter, RMWF filter element, contaminants in VCT, or possible Lo Delta P repair "punch thru" makeup headers, or RCS indic. from PDI-261 b) plugged Normal Loss of RMW flow. Possible High Delta P indic. Isolate and bypass filter for Automatic makeup contaminant over boration of RCS from PDI-261. Low maint operations will be buildup flow alarm secured on low flow FQRC-210X. from FQRC-210X

Table 9.3.4-3 (Sheet 69 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects c) external Cracked Local spill of RMW Local leak detectors Isolate and bypass filter for leakage casing, seat maint.

leak on vent valve CH-783 349) RMWF Isolation a) fails open Mech. binding No impact on normal operation. Operator None Valves; CH-780, Unable to isolate filter for maint.

CH-792 b) fails closed Mech. failure Unable to restore filter to service Operator Filter can remain bypassed after maint until valves repaired 350) RMWF Bypass a) fails closed Mech. failure, No impact on normal operation. Operator None PVNGS UPDATED FSAR Valve, CH-779 blockage Unable to bypass filter for maint.

b) fails open Mech. binding Portion of RMW flow bypasses Operator for mech. None when open, filter. Possible buildup of binding, otherwise seat leakage contaminants in VCT or RCS none 351) RMWF Differen- a) spurious Elect. or Early maint. on RMW filter Hi Delta P alarm not None tial Pressure Hi Delta P mech. clear when bypass 9.3-237 Indicator; alarms malfunction filter PDI-261 setpoint drift b) false Elect. or No impact on normal operation. Periodic test Filter degradation can be normal mech. Failure to detect filter detected by grad increase Delta P malfunction degradation in RMWP discharge pres.

indications indic.

352) RMWF Drain a) fails closed Mech. binding, No impact on normal operation. Operator None Valve, CH-791 blockage Unable to drain filter for maint.

b) seat Contamina- Minor diversion of RMW to EDT EDT level increases None PROCESS AUXILIARIES leakage tion, mech.

damage 353) RMWT a) fails closed Mech. binding, No impact on normal operation. Valve position indic. in RMWP recirculation lines Recirculation loss of air or Unable to recirculate RMWT control room can be used Valve, CH-511 power, valve contents operator failure b) fails open Mech. binding, Major diversion of RMW flow Valve position indic. in None Automatic makeup Revision 14 valve operator while providing makeup to VCT. control room. Lo flow operations will be failure Possible overboration of RCS alarms from secured or low flow from FQRC-210X FQRC-210X 354) Makeup Supply a) fails closed Mech. binding Unable to provide RMW to Hi pres. indic. from None Header Check blockage makeup supply or resin sluice RMWP discharge Valve; CH-795 supply headers pres. indic., no flow in headers b) fails open Mech. binding No impact on operation None None

Table 9.3.4-3 (Sheet 70 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 355) Resin Sluice a) fails closed Mech. binding, Unable to provide RMW to resin Operator None Supply Header blockage sluice supply header Isolation Valves; CH-790, CH-799 b) seat Contamina- Minor diversion of RMW from None Resin sluice Isol. valves at leakage tion, mech. makeup supply header to resin individ. equip. will prevent damage sluice supply header flow 356) Resin Sluice a) indicates Elect. or Operator will set resin sluice Periodic test None Supply Header flow too mech. supply throttle valve too low, Flow Indicator, high malfunction resulting in reduced RMW to air FI-249 mix ratio in resin sluice supply.

PVNGS UPDATED FSAR Possible difficulties in flushing ion exchangers b) indicates Elect or Operator will increase throttle Periodic test None flow too mech. valve setting increasing RMW to low malfunction air mix ratio in resin sluice 9.3-238 supply. Excess use of RMW, excess waste generation 357) Resin Sluice a) fails closed Mech. failure Loss of RMW supply to resin Lo flow indic from None Supply Isolation sluice supply header FI-249 Valve, CH-691 358) Resin Sluice a) fails closed Mech. binding, Same as 357 a)

Supply Check blockage Valve, CH-692 b) fails open Mech. binding Possible air bubble formation in None Isolation valves CH-790, RMW supply header or lines CH-799 359) Resin Sluice a) fails closed Mech. failure, Unable to supply RMW to EDT Operator Redundant valve and PROCESS AUXILIARIES Supply to EDT blockage for flushing or initial inventory or flushing line Isolation Valve pump down EDT after high CH-762, CH-861 temperature relief dischg. to tank with this line.

b) seat Contamination Diversion of resin sluice supply EDT level and pres. CH-790 & 799 normally leakage mech. water to EDT. EDT level indicators closed.

damage increase. Possible EDT pres Revision 14 increase 360) Resin Sluice Air a) fails closed Mech. binding Unable to supply air to mix with No flow indic. from None Supply Check blockage RMW for resin sluice supply. FI-248 Valve CH-695 Excessive use of RMW when flushing ion exchangers.

Excess waste generation b) fails open Mech. binding No impact on normal operation. None Isolation/throttle valve, Possible leakage of RMW to air CH-694 supply lines

Table 9.3.4-3 (Sheet 71 of 71)

June 2007 CHEMICAL AND VOLUME CONTROL SYSTEM (CVCS)

FAILURE MODE AND EFFECTS ANALYSIS Symptoms and Local Effects Inherent Remarks and No. Name Failure Mode Cause Method of Detection Including Dependent Failures Compensating Provision Other Effects 361) Resin Sluice Air a) fails closed Mech. failure Same as 360 a)

Supply Isolation/

Throttle Valve; CH-694 b) fails to Mech. binding Unable to obtain desired air Operator RMW throttle valve can be throttle supply to resin sluice supply adjusted to get proper mix properly header. Improper water to air ratio mix ratio 362) Resin Sluice Air a) indicates Elect. or Air supply valve will be closed Periodic test None PVNGS UPDATED FSAR Supply Flow flow too mech. resulting in too little air in resin Indicator; FI-248 high malfunct. sluice supply. Excess RMW usage. Excess waste generation b) indicates Elect. or Air supply valve will be opened, Periodic test None flow too mech. resulting in high air content in low malfunct resin sluice supply. Possible 9.3-239 difficulties in flushing ion exchangers 363) Charging Line a) fails open Mech. binding No impact on normal operation. None Charging pump discharge Check Valve Possible diversion of High check valves will prevent (CH-639) press. chemical addition flow signif. diversion of HI pres.

chem addition flow.

b) fails closed Mech. binding, Same as 120 b) Same as 120 b) Same as 120 b) blockage 364) High Pressure a) fails open Mech. binding, Possible diversion of part of None Series redundant isolation PROCESS AUXILIARIES Chemical Line seat leakage charging flow to High pres. valves Isolation Valves; chemical addition system CH-659, CH-863 b) fails closed Mech. binding, No impact on normal operation. Operator None blockage Unable to establish HI pres chemical addition flow to RCS Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.4.5 CESSAR Interface Requirements Provided below are interface requirements, repeated from CESSAR Section 9.3.4.6, with the exception of the emergency power supply requirement for valve CHA-HV-524, as described in Section 9.3.4.1.A.2.c.

Below are the interface requirements that the CVCS places on certain aspects of the BOP, listed by categories. In addition, applicable General Design Criteria (GDC) and Regulatory Guides which C-E utilizes in its design of the CVCS are presented.

These GDC and Regulatory Guides are listed only to show what C-E considers to be relevant, and are not imposed as interface requirements, unless specifically called out as such in a particular interface requirement.

Relevant GDC - 1, 2, 3, 4, 26, 27, 28, 29, 30, 31, 32, 33, 54 Relevant - 1.26, 1.28, 1.29, 1.31, 1.36, 1.37, 1.44, Reg. Guides 1.48, 1.51, 1.64, 1.68 A. Power

1. Normal Power Requirements

a. Two independent power sources shall be available to provide electric power to the Chemical and Volume Control System equipment.

Power shall be capable of being supplied from the main generator. During startup or shut-down, power shall be available from offsite.

b. Within the plant distribution system, redund-ant chemical and volume control system equip-ment loads shall be supplied by separate buses or motor control centers to minimize the effect of outages.

June 2007 9.3-240 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES

c. In the event of a failure of a bus, standby equipment connected to other buses shall be capable of being placed in operation.

2. Emergency Power Requirements

a. Charging Pumps - Each emergency power bus shall supply one pump. Additionally, the third charging pump shall be capable of receiving power from either emergency power bus. The charging pumps shall not be automatically sequenced on the emergency power buses.

b. The following are emergency power supply requirements for CVCS instrumentation:

(1)

Control Instrument Location Emergency Bus L-200 (RWT level) A/C A L-201 (RWT level) A/C B F-212 (Charging A/C B flow)

P-212 (Charging A/C A pressure)

L-203A (RWT RAS A A level)

L-203B (RWT RAS A B level)

L-203C (RWT RAS A C level)

L-203D (RWT RAS A D level)

c. The following are emergency power supply requirements for CVCS valves:

Control(1)

Valve Emergency Bus Location CH-515 (receives B A/C SIAS)

CH-516 (receives A A/C SIAS & CIAS)

June 2011 9.3-241 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES CH-560 (receives A A CIAS)

CH-561 (receives B A CIAS)

CH-580 (receives A A CIAS)

CH-506 (receives A A/C CSAS)

CH-505 (receives B A/C CSAS)

CH-523 (receives B A CIAS)

CH-507 A A/C CH-530 B A CH-531 A A CH-203 B A/Ct CH-205 A A/C CH-255 B A (2)

CH-501 A A (3)

CH-524 A A (2)

CH-536 A A Notes (1) Location code is as follows; A-Control Room, B-Local, C-Remote Shutdown Panel, D-Location outside Control Room.

(2) Receives emergency power under LOP condition (3) The power supply for valve CHA-HV-524 is removed by locking open its breaker at MCC PHA-M3520.

Restoration of the power supply requires local operator action at the MCC before control from the main control room can be restored for the valve.

June 2011 9.3-242 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES B. Protection from Natural Phenomena

1. The location, arrangement, and installation of the RWT, charging pump gravity feed piping, charging pumps, charging pump discharge piping, the letdown line between the RCS and letdown containment isolation valves, and Safety Injection Systems (SIS) trains suction piping shall be such that floods (and tsunami and seiches for applicable sites) or the effects thereof will not prevent them from performing their functions. The severity of the above natural phenomena to be considered, as well as the combination of the effects of these natural phenomena with the design conditions of ANSI N18.2-1973, shall meet the requirements of Criterion 2 of 10CFR50, Appendix A.

2. The location, arrangement and installation of the RWT, charging pump gravity feed piping, charging pumps, charging pump discharge piping, and letdown line between the RCS and letdown containment isolation valves, and SIS trains suction piping shall be such that winds and tornadoes or the effects thereof will not prevent them from performing their functions. The severity of the winds and tornadoes to be considered, as well as the combination of the effects of these natural phenomena with the design conditions of ANSI N18.2-1973, shall meet the requirements of Criterion 2 of 10CFR50, Appendix A.

3. The location, arrangement, and installation of the RWT, charging pump gravity feed piping, charging pumps, charging pump discharge piping, and letdown line between the RCS and letdown containment June 2011 9.3-243 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES isolation valves, and SIS trains suction piping shall be such that they will withstand the effects of earthquakes without loss of the capability to perform their functions. The severity of the earthquakes considered, as well as the combination of these natural phenomena with the design conditions of ANSI N18.2-1973, shall meet the requirements of Appendix A of 10CRF50, Appendix A of 10CFR100, and NRC Regulatory Guide 1.48. Failure of non-seismic systems and structures shall not cause loss of either SIS train.

C. Protection from Pipe Failure The letdown subsystem (from the RCS coolant system),

charging system (from valve CH-118 through the charging pumps to RCS to CH523), auxiliary spray, high pressure safety injection header, and drain header isolation valves (CH-329, 332, 3367) and boric acid addition system (including both of the Refueling Water Tank gravity feed connections to the charging pump suction header) the connections from the refueling water tank to the suction of the safety injection system pumps, and the Refueling Water Tank and spent fuel pool connections to the charging pump suction header via the Boric Acid Makeup Pumps and valve CH-514 shall be protected from loss of function from the effects of pipe rupture, such as pipe whip, jet impingement, jet reaction, pressurization, or flooding.

D. Missiles The portion of the CVCS protected from pipe failure (see 9.3.4.6.C) shall also be protected from loss of function from the effects of missiles in accordance with June 2011 9.3-244 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES the missile barrier design interface requirement of Section 3.5.3.1.

E. Separation

1. Adequate physical separation shall be maintained:

(1) between the normal charging line and the alternate charging line through the safety injection header; (2) between the two alternate gravity feed suction lines from the RWT to the charging pump suction header; (3) between the RWT via the boric acid makeup pumps supply direct to the charging pump suction header and the gravity feed lines from the RWT to the charging pump suction header; (4) between the charging pump control circuits, and (5) between the power circuitry to the charging pumps. A single failure due to a missile, structural damage, pipe failure, or fire shall not result in functional impairment of more than one of these independent paths or channels.

2. The CVCS circuits which are associated with the redundant channels pertaining to boron addition, charging and letdown functions shall be physically separated to preserve redundancy and prevent interactions between channels. Associated circuit cabling from redundant channels shall either be separated, provided with isolation devices, or analyzed or tested to demonstrate that no credible single failure could adversely affect redundant channels of these circuits.

June 2011 9.3-245 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES F. Independence See electric power independence requirements in A.1.

above.

G. Thermal Limitations The ventilation system shall provide suitable ambient conditions for equipment and instrumentation: Temperature and relative humidity ranges for equipment and instrumentation shall be limited to those in Section 3.11.

H. Monitoring Not Applicable I. Operational/Controls Not Applicable J. Inspection and Testing

1. Refer to CESSAR Section 9.3.4.4 for inspection and testing requirements for the CVCS with the exception of the boric acid concentrator pumps, as noted in section 1.9.2.4.20.

K. Chemistry/Sampling Not Applicable L. Materials

1. Controls shall be exercised to assure that contaminants do not significantly contribute to stress corrosion of the stainless steel and welds, including welds at the CVCS boundaries.

2. Piping and components in contact with the CVCS fluid shall be fabricated of austenitic stainless steel, with the exception that the charging pump June 2011 9.3-246 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES cylinder block assembly may be fabricated of martensitic stainless steel.

3. Care shall be taken to prevent sensitization and to control the delta ferrite content of (a) welds which join any system fabricated of austenitic stainless steel to the CVCS, and (b) the field welds on the CVCS.

M. System/Component Arrangement

1. The Reactor Drain Tank rupture disc shall be located beneath a concrete ceiling or foundation to help shield other components from rupture disc fragments which may result from disc rupture.

2. The CVCS shall be installed to permit access for inservice inspection in accordance with Section XI of the ASME code and testing of ASME Class 2 and 3 components.

3. Charging pump suction and discharge lines shall be designed to accommodate the pulsating flow from the reciprocating pump. Pulsations from each charging pump will occur at approximately 600 and 1200 pulses per minute. Pump suction pressure can vary by as much as 40 psi peak to peak with approximately half the pressure pulse occurring above and below the main pressure line. The pump discharge pressure can vary as much as 850 psi peak to peak; approximately 350 psi will occur above the normal operating pressure of 2485 psig and 500 psi below.

a. The discharge piping shall be provided with restraints to minimize vibrations resulting from these pressure surges. Provisions shall be made June 2011 9.3-247 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES for the installation of pump inlet and outlet pulsation dampeners in the event they are required. Suction and discharge pulsation dampeners should be directly coupled to the charging pump, no further than 5 feet away. Any piping between the pump and dampener shall be straight.

b. Suction and discharge piping should be as straight as possible with at least 10 feet of straight pipe directly connected to the suction and discharge of the charging pump. When bends are necessary, 45 degree elbows or long radius elbows shall be used. A bend shall not be installed directly adjacent to the pump.

c. The suction and discharge piping shall be arranged to preclude the collection of vapor or gas and inleakage of air must be prevented.

4. The location, arrangement and installation of the charging pump gravity feed piping, charging pumps, charging pump discharge piping, the letdown line between the RCS and letdown containment isolation valves, and SIS trains suction piping shall be such that internal floods or the effects thereof will not prevent them from performing their safety functions.

N. Radiological Waste

1. Tables 11.1.1-1, 11.1.1-2 and 11.1.1-3 shall be utilized in determining waste management system input from the CVCS.

June 2011 9.3-248 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES O. Overpressure Protection

1. The RWT vent shall be sized to prevent pressurization of the RWT during maximum filling rate operations and to prevent vacuum formation during maximum pumpdown rate operations.

P. Related Service

1. The Refueling Water Tank shall be sized to:

a. Accommodate maximum safety injection flow (see table 6.3.3.3-1) and maintain it for at least 20 minutes before switchover to recirculation mode, which shall occur at the 10%

level in the RWT.

b. Provide sufficient volume for boric acid recycle for back to back shutdown (to 5 per-cent subcritical) and startup at 90 percent core life without boric acid concentrator processing.

c. Provide sufficient volume to fill the refueling pool.

d. Provisions shall be made so that particles larger than 0.09 inch diameter do not enter the Engineered Safety Feature pump suction lines.

2. The spent fuel pool shall provide an alternate source of borated water to the CVCS.

a. A volume of 33,500 gallons shall be available to achieve cold shutdown at the end of core life (5 percent subcriticality with rods) assuming 4000 ppm boron within the fuel pool. Draining 33,500 gallons from the spent fuel pool shall June 2011 9.3-249 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES not reduce the pool water level below the volume needed for minimum shielding requirements.

b. The boric acid makeup pumps shall be able to take suction from the spent fuel pool.

3. A fire protection system shall be provided to protect the CVCS. It shall include, as a minimum, the following features:

a. Facilities for fire detection and alarming.

b. Facilities or methods to minimize the probability of fire and its associated effects.

c. Facilities for fire extinguishment.

d. Methods of fire prevention such as use of fire resistant and non-combustible materials whenever practical, and minimizing exposure of combustible materials to fire hazards.

e. Assurance that fire protection systems do not adversely affect the functional and structural integrity of safety related structures, systems, and components.

f. Care should be exercised to ensure fire protection systems are designed to assure that their rupture or inadvertent operation does not significantly impair the capability of safety related structures, systems, and components.

g. Assurance that a fire will not cause failure in systems, structures, and components to the extent that radioactive releases to the environment will exceed the guidelines values of 10CFR100.

June 2011 9.3-250 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES

4. Redundant means shall be provided to maintain the RWT contents, interconnecting piping to the safety injection pump trains, instrumentation lines, and loop seal above the minimum operating temperature of 60F and below the maximum operating temperature of 120F. Ensuring that the Auxiliary Building, Annulus Building, and Containment Building ambient temperatures remain between 60F and 120F during all normal reactor operations may be done to meet this requirement. All other RWT interconnecting piping, including the vent line, which is located outside of the auxiliary building shall be maintained at a minimum temperature of 40F to prevent freezing.

Electric heaters installed in the RWT for tank heating will be used to meet this requirement.

5. Air for all CVCS pneumatic valve operators shall be clean, dry, and oil-free.

Q. Environmental

1. The CVCS shall be provided with an environmental control system such that the safety related equipment operates within the environmental design limits specified in Section 3.11.

R. Mechanical Interaction Between Components

1. Those portions of the CVCS that are part of the reactor coolant pressure boundary shall be designed to tolerate the events described in CESSAR Table 9.3-2.

S. The reactor makeup water tank (RMWT) overflow is routed to the holdup tank sump and on to the liquid radwaste system. As noted in response to NRC Question 11A.4, no June 2011 9.3-251 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES provision has been made to contain the tank's contents in case of RMWT failure. The failure of RMWT is considered a low probability occurrence, which, when taken into consideration with the low radioactive contamination of the tank's contents, the existing design is acceptable.

9.3.4.6 CESSAR Interface Evaluation The interface requirements listed in paragraph 9.3.4.1 are met by the PVNGS design as follows:

A. Power

1. Normal Power Requirements

a. During normal operation, power is supplied either from offsite or from the main genera-tors; during startup or shutdown, power is available from offsite. In the event of failure of the normal power supply, the charging pumps can be manually connected to the diesel generator (refer to section 8.3).

b. Within the plant distribution system, the CVCS equipment loads are supplied by separate buses or motor control centers to minimize the effect of outages with the exception of the two RWT heaters.

The RWT heaters are powered through separate circuit breakers in a single motor control center fed from a single 480V load center.

The tank contents are normally above 60F and redundant low temperature annunciation is provided in the main control room. The June 2011 9.3-252 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES thick concrete tank wall construction, relatively mild Palo Verde climate, and large tank inventory combine to allow only very slow tank content temperature changes. Adequate time is available to restore heater power following distribution equipment malfunction without concern for precipitation of tank contents.

c. In the event of a failure of a bus, standby equipment connected to other buses is placed in operation.

2. Emergency Power Requirements

a. Charging pumps - Each emergency power bus supplies one pump. Additionally, the third charging pump can receive power from either emergency power bus. The charging pumps are not automatically sequenced on the emergency power buses. However, should a pressurizer low level signal exist upon restoration of power, the standby charging pump whose breaker is set in the Auto After Stop position (designated standby charging pump) only will automatically start. If an SIAS should exist upon restoration of power, however, the automatic start will be delayed 40 seconds by a sequencer permissive signal. The requirement to preclude potential pump damage due to inadequate NPSH is met by a pressure switch which trips the pump on low suction pressure.

June 2011 9.3-253 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES

b. The following are emergency power supply arrangements for the CVCS instrumentation:

Emer-Control gency (a)

Instrument Location Bus CHA-LI-200 (RWT level) A/C A CHA-LI-200-1 (RWT level) A/C A CHB-LI-201 (RWT level) A/C B CHB-LI-201-1 (RWT level) A/C B CHB-FI-212 (Charging A/C B flow)

CHB-FI-212-1 (Charging A/C B flow)

CHA-PI-212 (Charging A/C A pressure)

CHA-PI-212-1 (Charging A/C A pressure)

CHA-LI-203A (RWT RAS A A level)

CHB-LI-203B (RWT RAS A B level)

CHC-LI-203C (RWT RAS A C level)

CHD-LI-203D (RWT RAS A D level)

a. Location code is as follows: A-control room, B-local, C-remote shutdown panel, D-location outside control room.

June 2011 9.3-254 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES

c. The following are emergency power supply requirements for CVCS valves:

(a)

Emergency Control Valve Bus Location CHB-UV515 (receives B A/C SIAS)

CHA-UV516 (receives A A/C SIAS and CIAS)

CHA-UV560 (receives A A CIAS)

CHB-UV561 (receives B A CIAS)

CHA-UV580 (receives A A CIAS)

CHA-UV506 (receives A A/C CSAS)

CHB-UV505 (receives B A/C CSAS)

CHB-UV523 (receives B A CIAS)

(a)

Emergency Control Valve Bus Location CHA-HV507 A A/C CHB-HV530 B A CHA-HV531 A A CHB-HV203 B A/C CHA-HV205 A A/C CH-255 B A CH-501 A A (b)

CH-524 A A CH-536 A A

a. Location code is as follows: A-control room, B-local, C-remote shutdown panel, D-location outside control room.

b. The power supply for valve CHA-HV-524 is removed by locking open its breaker at MCC PHA-M3520. Restoration at the power supply requires local operator action at the MCC before control from the main control room can be restored for the valve.

June 2007 9.3-255 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES B. Protection from Natural Phenomena

1. Design provisions for maintaining functional capability of the RWT, the boron addition, charging, and letdown portions of the CVCS during the maximum probable flood or phenomena defined by GDC 2 are discussed in subsection 3.1.2. All of the boron addition, charging, and letdown portions are located in Seismic Category I structures. The RWT is also a Seismic Category I structure. The protection of Seismic Category I structures against natural phenomena is presented in sections 3.3, 3.4, 3.5, and 3.8.

2. The RWT is a concrete structure, seismically qualified for the PVNGS. In addition, the tank is designed to withstand the design wind and tornado forces. The rest of the CVCS system piping, valves, and equipment is located inside the auxiliary and containment buildings which are designed to withstand the wind and tornado forces as required.

3. The RWT is a Seismic Category I concrete structure, lined with an austenitic stainless steel liner.

The charging, letdown, and SIS suction piping, as well as associated valves and charging pumps, are Seismic Category I pressure vessels constructed in accordance with ASME Section III, Class 2, requirements.

C. Protection from Pipe Failure The letdown subsystem (from the RCS coolant system to CHB-UV523), charging system (from valve CHN-V118 through the charging pumps to RCS), auxiliary spray, high-pressure June 2011 9.3-256 Revision 16

PVNGS UPDATED FSAR PROCESS AUXILIARIES safety injection headers, and charging pumps drain header isolation valves (CHA-V329, CHB-V332, CHE-V336), the RWT gravity feed connections to the charging pump suction header, the connections from the RWT to the suction of the safety injection system pumps, and the RWT and spent fuel pool connections to the charging pump suction header via the boric acid makeup pumps and valve CHN-UV514 are protected from loss of function from the effects of pipe rupture, such as pipe whip, jet impingement, jet reaction, pressurization and flooding. Refer to section 3.6.

D. Missiles The portion of the CVCS protected from pipe failure (see paragraph 9.3.4.2, listing C) is also protected from loss of function from the effects of missiles in accordance with the missile barrier design interface requirement of paragraph 3.5.4.1.

E. Separation

1. Adequate physical separation is provided and maintained between the normal charging line and the alternate charging line through the safety injection header, between the alternate gravity fed suction lines from the RWT to the charging pumps (suction lines from the RWT via the boric acid makeup pump and the gravity fed lines from the RWT to the charging pump suction), between the charging pump control circuits, and between the power channels provided to the charging pumps. A single failure due to a missile, structural damage, pipe failure, or fire will not impair the function of more than one of these independent paths or channels. See paragraph 8.3.1.4 for a discussion on channel separation.

June 2007 9.3-257 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES

2. The CVCS circuits that are associated with redundant channels pertaining to boron addition, charging, and letdown functions are physically separated to preserve redundancy and to prevent a single event from causing multiple channel malfunctions or interactions between channels.

Associated circuit cabling from redundant channels is either separated, provided with isolation devices, or analyzed and/or tested to demonstrate that no credible single failure could adversely affect redundant channels of these circuits as discussed in paragraph 8.3.1.4.

F. Independence Two independent power sources are available to provide electric power to CVCS equipment (see sublisting A.1 above).

G. Thermal Limitations

1. The ventilation systems are designed in accordance with CESSAR Section 3.11 to maintain the ambient conditions in the auxiliary building between 50 and 104F, and in the containment building between 50 and 120F, under normal operating conditions (refer to section 9.4).

2. Following a loss-of-coolant accident, including the subsequent recirculation mode of operation, the ambient air conditions of the CVCS equipment located in the auxiliary building are controlled in accordance with the requirements of section 3.11.

H. Monitoring Not applicable June 2007 9.3-258 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES I. Operational controls Not applicable J. Inspection and Testing

1. Inspection and testing requirements for the CVCS are given in the Technical Requirements Manual (TRM) and comply with CESSAR Chapter 16.

K. Chemistry/Sampling Not applicable L. Materials

1. The insulation used on austenitic stainless steel is discussed in subsection 5.2.3. Cleaning and contamination procedures are also discussed in subsection 5.2.3. Conformance to Regulatory Guides 1.36 and 1.37 is discussed in sections 6.1 and 1.8, respectively.

2. Piping and components in contact with the CVCS fluid are fabricated of austenitic stainless steel, with the exception that the charging pump cylinder block assembly may be fabricated of martensitic stainless steel.

3. Using the guidance of Regulatory Guides 1.44 and 1.31 as discussed in section 1.8, care is taken in preventing sensitization and in controlling the delta ferrite content of: (a) welds that join any system fabricated of austenitic stainless steel in the CVCS, and (b) field welds on the CVCS (refer to subsection 5.2.3).

June 2007 9.3-259 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES M. System/Component Arrangement

1. The reactor drain tank rupture disc is located about 3.5 feet underneath a concrete ceiling. This location helps to shield other components from rupture disc fragments, which may result from disc rupture.

2. The CVCS is installed to permit access for inservice inspection in accordance with Section XI of the ASME Code and testing of ASME Class 2 and 3 components.

3. Charging pump suction and discharge lines are designed to accommodate the pulsating flow from the reciprocating positive displacement pumps, with pulsations occurring at 600 and 1200 pulses per minute.

a. The discharge piping is provided with restraints to minimize vibrations from the pump pulsation, and from pressure surges +/-50 psi, which are the resultant pressure surges with installed pulsation dampeners. The suction and discharge pulsation dampeners are installed in the immediate vicinity of the charging pumps, with only short, straight pieces of pipes enabling inservice inspection of the welds and facilitating pipe supports.

b. The suction and discharge piping is installed as straight as possible. The plant layout does not allow installation of 10 straight feet of suction and discharge pipes. To compensate for this, pipe bends in the suction June 2007 9.3-260 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES piping are 5d bends and elbows in the discharge piping are long radius elbows.

c. Charging pump suction and discharge piping is arranged to preclude collection of vapor or gas in the piping. Should any air be present in the pump suction piping, it would collect in the suction pulsation dampener, from whence it can be periodically purged. In addition, all piping is provided with high-point vents to facilitate purging the system after prolonged shutdowns.

4. Protection is provided from internally generated flooding that could prevent performance of safety-related functions. Refer also to section 3.6 and subsection 9.3.3.

N. Radiological Waste

1. CESSAR Tables 11.1.1-1, 11.1.1-2, and 11.1.1-3 are utilized in determining waste management system input from the CVCS.

O. Overpressure Protection

1. The RWT vent is sized to prevent pressurization of the tank during maximum filling rate operations and to prevent vacuum formation during maximum pumpdown rate operations.

P. Related Services

1. The RWT is sized to:

a. Ensure that a sufficient volume of borated water will be available to sustain two trains of ECCS and CSS pump flow for the duration of the June 2007 9.3-261 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES injection period as assumed in the safety analyses.

b. Provide sufficient volume for boric acid recycle for back-to-back shutdown (to 5%

subcritical) and subsequent startup at 90%

core life without boric acid concentrator processing.

c. The RWT provides sufficient volume to fill the refueling pool.

d. The engineered safety feature pump suction lines are provided with strainers that prevent particles larger than 0.09-inch diameter from entering the engineered safety feature pumps.

e. The RWT suction is designed to prevent vortexing by the use of an appropriately designed suction strainer.

2. The spent fuel pool provides an alternate source of borated water to the CVCS.

a. A minimum of 33,500 gallons is available. The associated reduction in spent fuel pool water level (less than 4 feet) will not appreciably reduce shielding of stored fuel.

b. The boric acid makeup pump can be realigned to take suction from the spent fuel pool.

3. The fire protection system for the CVCS is discussed in subsection 9.5.1.

June 2007 9.3-262 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES

a. Facilities for fire detection and alarming are provided in the auxiliary building where CVCS components are located.

b. The probability of a disabling fire is minimized by compartmentation, which confines the fire and its associated effect to a limited area.

c. The plant is equipped with multiple facilities for fire extinguishment. For details, refer to subsection 9.5.1.

d. The probability of fire is minimized by selection of fire-resistant materials and by minimizing the quantities of combustibles.

e. The fire protection system and piping have been designed to assure adequate separation from the safety-related components. The building/room draining capability assures that the flood water level, due to a single active failure of the fire protection lines, would not impair the functioning of the safety-related components.

f. In addition to design features explained in sublisting P.3.e above, the drain systems are designed to mitigate the consequences of inadvertent activation of the fire protection systems.

g. A fire will not cause failure in systems, structures, and components to the extent that radioactive releases to the environment would exceed the guideline values of 10CFR100.

June 2007 9.3-263 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES

4. The RWT interconnecting piping to the safety injection pump trains, the gravity feed line to the charging pumps, instrumentation lines, and loop seal will be maintained at a minimum temperature of 60F by redundant heat tracing, powered from two redundant power sources. Redundant electric heaters installed inside the tank, powered from a common MCC, assure the minimum tank water temperature of 60F. As noted in the response to Question 6A.51, vent lines from the RWT are not heat-traced since the vent is located in the uppermost portion of the tank. The vent pipes are routed without piping pockets that could cause the accumulation of moisture. As the design winter ambient temperature at PVNGS is 25F for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, plugging of the RWT vent is considered very improbable.

Q. Environmental

1. The CVCS is provided with an environmental control system such that the safety-related equipment operates within the environmental qualification parameters specified in Appendix A of the Equipment Qualification Program Manual, as discussed in section 9.4.

R. Mechanical Interaction Between Components.

1. The portions of the CVCS that are part of the reactor coolant pressure boundary are designed to tolerate the events described in CESSAR Table 9.3-2.

June 2007 9.3-264 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.5 STANDBY LIQUID CONTROL SYSTEM (BWRs)

This section is not applicable to PVNGS.

9.3.6 COMPRESSED GAS STORAGE SYSTEMS Compressed gas storage is provided for nitrogen (N2), hydrogen (H2), carbon dioxide (CO2), air, and Halon 1301. Refer to subsection 9.5.1 for the description, safety design bases, and safety evaluation of the CO2 and Halon 1301 storage subsystems.

Subsection 10.3.2 provides a description of the N2 accumulators for the atmospheric dump valves and safety design bases and evaluations. Compressed air system descriptions, safety design basis, and safety evaluations are provided in subsections 9.3.1 and 9.5.6. Also refer to the PVNGS response to NRC Question 15A.55 contained within appendix 15A.

9.3.6.1 Safety Design Bases The following safety design bases are applicable to the N2 and H2 storage:

A. Safety Design Basis One The N2 and H2 storage subsystems shall be designed and located such that a tank rupture will not adversely affect any system, component, or structure required for safe shutdown.

9.3.6.2 Compressed Gas Storage System Description 9.3.6.2.1 Nitrogen Storage Subsystem The nitrogen storage subsystem provides nitrogen for use as a pressurized gas blanket in various plant components and systems, as shown in the system P&IDs 01, 02, 03-M-GAP-001, June 2007 9.3-265 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES

-002 and 02, 03-M-GHP-001. Design parameters of the subsystem are provided in table 9.3-11.

9.3.6.2.2 Hydrogen Storage Subsystem The hydrogen storage subsystem provides hydrogen for use as part of an oxygen-free gas blanket in various plant components and systems, as shown in engineering drawings 01, 02, 03-M-GAP-001, -002 and 02, 03-M-GHP-001. Design parameters of the subsystem are provided in table 9.3-11.

The following protective measures are considered in the design to prevent fires and explosion during operation:

• The bulk storage system is located outdoors, away from any ignition sources. The distribution piping is of all-welded construction, and verified leaktight.

• To avoid producing an explosive mixture in the turbine-generator casing during the hydrogen fill or removal evaluation, carbon dioxide is used to purge air or hydrogen, respectively.

9.3.6.3 Safety Evaluation The following safety evaluation is applicable to N2 and H2 storage:

A. Safety Evaluation One The N2 and H2 storage subsystems are located north of the turbine building, outside of any plant structure.

Due to their location, the tank rupture energy release, noted in table 9.3-11, is not sufficient to adversely affect any system, component, or structure required for safe shutdown.

June 2007 9.3-266 Revision 14

PVNGS UPDATED FSAR PROCESS AUXILIARIES 9.3.6.4 Tests and Inspections No regularly scheduled periodic testing is done on this system.

Containment penetration piping and isolation valves are examined for inservice inspection as described in section 6.6.

June 2007 9.3-267 Revision 14

June 2011 Table 9.3-11 COMPRESSED GAS STORAGE Deviation Pressures (psig) From Codes Quantity Applicable Location Energy Release (Max)

Gas of Vessels Codes in Plant Design Operating Maximum per vessel ft lbf N2 8 cylinders ASME, OSHA, Outside 2450 2400 2400 4.84 x 107 None per unit, DOT tan k each 8350 std N2 ft - lbf 1 liquid N2 ASME OSHA, Outside 245 245 245 3.77 x 107 None DOT tank tank, PVNGS UPDATED FSAR 3200 gal, per unit 9.3-268 ft - lbf N2 6 cylinders ASME, OSHA, Outside 2450 2400 2400 1.13 x 106 None per unit, DOT tank each 3

1.7std ft H2 14 ASME, OSHA, Outside 2450 2400 2400 ft - lbf None vessels DOT, 4.72 x 107 tank per unit 8932 std ft3 vessels PROCESS AUXILIARIES Plant design can accommodate the failure of any of the above vessels or parts of vessels without jeopardizing nuclear safety.

Revision 16