ML13310A243

Failure Modes & Effects Analysis for San Onofre Nuclear Generating Station Unit 1 Rod Control Sys

ML13310A243
Person / Time
Site:	San Onofre
Issue date:	04/30/1982
From:	Southern California Edison Co
To:
Shared Package
ML13310A244	List: ML13310A243 ML13317B131
References
NUDOCS 8205040383
Download: ML13310A243 (78)

Text

FAILURE MODES ANO.EFFECTS-ANALYSIS FOR THE SAN ONOFRE NUCLEAR GENERATING STATION UNIT-1 ROB*-CONTROL SYSTEM April 1982 8205040383 820430 PDR ADOCK o PDR0 REUATR DOCKET FILE CopY

TABLE OF CONTENTS SECTION TITLE

1.0 INTRODUCTION

,_.0 SYSTEM FUNCTIONS AND DESCRIPTION 3.0 FAILURE MODE AND EFFECTS ANALYSIS

5.0 REFERENCES

APPENDIX A FMEA WORKSHEETS

1.0 INTRODUCTION

The analysis in this report was performed to prepare the following information for SEP Topic IV-2, Reactivity Control Systems:

1) Single failures within the systems used for reactivity control which can:

a) Cause an inadvertant reactivity insertion.

b) Cause a single or combination of rods to be positioned in other than the design sequence. This included consideration of single rod withdrawal/insertions which can result from a single equipment component failure.

2) Design features which limit reactivity insertion rates and rod malpositions resulting from a single failure.

The results of the analysis show how, and to what extent, the San Onofre Rod Control System will perform its intended reactivity control function accounting for failure of single components.

The type of analysis used to evaluate the Rod Control System is a Failure Mode and Effects Analysis (FMEA). This analysis goes to the replaceable component level (i.e., control rod drive mechanism, contactor, relay, logic gate, etc.)

The method used to perform the FMEA is consistent with that described in IEEE Standard 352-1975.

The FMEA considered the essential elements of the Rod Control System and its interface with other plant systems.

References to design information used in the analysis are.provided in Section 5.0. Results of the FMEA are presented in Appendix A in tabular form for specific component failures. A discussion of the results for functional blocks of components (i.e., sequencing circuitry, master cycler, command circuitry, etc.) is presented in Section 3.0.

2.0 SYSTEM FUNCTIONS AND DESCRIPTION 2.1 General Description The reactor of a PWR nuclear power plant such as San Onofre Unit 1 is controlled by temperature coefficients of reactivity; by motion of control rods, which is required for load follow transients and for stdrtup and shutdown; and by boron in the form of boric acid which is adjusted in concentration during core lifetime to compensate for such effects as fuel consumption and accumulation of fission products. A description of the control system used for movement and control of the full length control rods is presented in the paragraphs that follow.

-2 2.1.1 System Functions The Rod Control System (RCS) controls the motion of the drive mechanisms of the full length control rods for rod motion in or out of the reactor core in response to signals initiated by the reactor operator and the Reactor Control System. The control rods are grouped and identified as being used for either shutdown or control.

The RCS programs rod motion for reactor control and also provides the operator with information regarding rod motion and rod position.

Figure 1 presents a simplified block diagram of the RCS.

2.1.2 Arrangement of Banks and Groups of Control Rods The drive mechanisms for the full length control rods are divided into symmetrical banks which are further divided into groups as shown in Figure 2.

The figure shows that for San Onofre Unit 1 there are two Control banks each consisting of four groups of mechanisms and one Shutdown Bank consisting of two groups of mechanisms. The mechanisms within a group are paralleled electrically to step simultaneously and the groups within a designated bank are moved sequentially such that the groups in a bank are always within one step of each other.

2.1.3 Control Rod Movement - Plant Operation Use of the full length control rods for reactivity control varies during plant operation. An example of their use is that of reactivity control during plant startup. Briefly stated, the plant startup sequence for full length control rods consists of the following steps:

1.

Shutdown Banks are individually withdrawn to their "FULL-UUT" position under manual operator control.

2.

Control Bank 1 is manually withdrawn until the Automatic Rod Control Defeated annunciator window goes off.

3.

At this point, the sytem is placed in the automatic mode of operation; rod motion is then controlled by the RCS in response to the analog demand signal from the Reactor Control System.

It should be noted that in the automatic control mode, the control rods are moved in a predetermined, programmed sequence which is controlled by the master cycler and bank overlap circuitry.

2.1.4 Control Rod Speed of Operation The stepping rate of control rods assigned to Shutdown Banks is fixed at 40 steps per minute (S/M). This corresponds to a bank speed of 15 inches per minute. In the manual mode, the stepping rate of control rods assigned to Control Banks is preset at 40 S/M. In the automatic mode, the Control Bank stepping rate is varied in response to speed signals generated by the Reactor Control System. The rate varies over a range of 1 to 40 S/M depending on demanded speed.

-3 The maximum stepping rate is a function of the maxiumum speed of the motor driven cam limit switches. The output of the motor and associated speed reducer that drives that cam limit switch is 40 RPM. Since the Control Rod Drive Mechanism provides a 3/8 inch step of rod movement, the effective maximum stepping rate is 15 inches per minute.

2.1.5 Sequencing of Groups within Banks'of Control Rods Control rod group movement assigned to a bank assuming four groups for each bank, is sequentially stepped to obtain incremental reactivity changes.

When the master cycler receives the first shift pulse from the pulser the first group starts its step.

Upon receipt of the second, third, and fourth shift pulses,the master cycler then sequences the second, third, and fourth rod groups for the bank. When a change in direction is called for, the last group that was sequenced is the first group to be moved in the new direction.

The rod groups are then sequenced in a reverse order. In this way all of the rod groups of one bank are kept within one step of each other.

2.1.6 Bank Overlap of Control Rods During the automatic mode, movement of Control Banks is performed in accordance with a predetermined programmed sequence. Control Bank 1 is withdrawn until it reaches the full out position. At this point, Control Bank 2 is moved out as required for reactor control.

There also exists the capability to overlap these 2 control banks using thumbwheel switches designed into the RCS equipment. However, this is not normally used at San Onofre Unit 1.

2.2 Description of Equipment The RCS interfaces with other plant systems (i.e., Reactor Protection System and Reactor Control System) as shown by Figure 1. A brief decription of the essential sub-systems of the RCS is presented in the paragraphs that follow.

2.2.1 Operator Controls and Indicators All controls used for normal operation of the RCS are located on the main control board. Descriptions of the various indicators, controls, and alarms are provided below.

2.2.1.1 In-Hold-Out Lever The In-Hold-Out lever is used for manual operation of individual banks of control rods. It is a three-position lever switch which is spring-returned to the "Hold" position. For rod motion, the lever actuates pushbutton contacts to energize control relays in the "In" and "Out" positions.

-4 2.2.1.2 Bank Selector Switch The Bank Selector switch mounted on the main control board permits selection of either manual control or automatic control from the RCS.

In conjunction with the Bank Overlap Cutout switch it also permits selection of individual bank operation.

The bank selector switch is interlock wired to protect against simultaneous automatic and manual mode of operation. Four switch positions are provided as follows:

1. Automatic - In this position, the In-Hold-Uut lever circuit is disconnected and control rod motion is determined by demand signals from the Reactor Control System.

Speed of movement is controlled by a variable stepping-rate control signal generated by the Reactor Control System.

2.

Manual - In this position, control banks are moved manually using the In-Hold-Out lever.

Rod speed is preset at the maximum stepping rate.

Individual control bank motion can be obtained by rotating the Bank Overlap Cutout switch to the desired position.

3. Shutdown Group 1 - Shutdown Group 1 rods are moved manually using the In-Hold-Out lever. Rod speed is preset at the maximum stepping rate.

4. Shutdown Group 2 - Shutdown Group 2 rods are moved as described for Shutdown Group 1 rods.

2.2.1.3 Step Counters The demand signal for each group of Full Length Control Rods is displayed on the Control Board by a three digit and-subtract Step Counter. The number of step counters required for monitoring demand signal to control rods is as follows:

SHUTDOWN CONTROL GROUPS GROUPS TOTAL 2

8 10 2.2.1.4 Rod Position Indication Reset Switch This pushbutton switch, mounted on the control board, is used to reset the equipment as indicated by the following chart:

EQUIPMENT LOCATION

1. Full Length Rod Step Counters Control Board

2. Master Cycler Reversible Counter Logic Cabinet - LA

3. Bank.Overlap Counter Logic Cabinet - LA

4. Pulse to Analog Converters Rod Position Indication System

2.2.1.5 Lift-Coil-Disconnect Switches A lift-coil-disconnect switch is furnished for each control and shutdown control rod drive mechanism. The switches are used in retrieving a dropped rod. By disconnecting the lift coils of all drive mechanisms in the affected bank, except the lift coil of the dropped rod, the dropped rod can be returned to its original position.

All lift-coil-disconnect switches are located at the Rod Disconnect Switch panel in the control room and are under administrative control of the reactor operator.

2.2.1.6 Rod Motion In-Out Lights Rod motion "IN" and "OUT" lamps on the control board indicate that rod motion has been initiated by either the manual In-Hold-Out control lever switch or, the Reactor Control System signals when the Bank Selector switch is in the "AUTO" position.

2.2.1.7 1/2 Power Indicator Lights For each group of rods, one lamp on the control board indiates that 1/2 power resistors have been inserted in series with the movable gripper coils of the Control Rod Drive Mechanism. This is done during a period of no rod motion.

2.2.1.8 Plant Annunciator The following RCS alarms are displayed on the plant annunciator.

1.

Start-up Rate Rod Stop -

Indicates that rod motion has been inhibited by the Reactor Control System.

2.

Start-up Rate Scram - Indicates that the trip breakers have been opened.

3. Failure Alarm - From master cycler; indicates failure in slave cycler cam switches.

2.2.2 Interlocks and Rod Stops The RCS interfaces with the Reactor Control System as shown by Figure 1.

Commands for both manual and automatic control rod motion must pass through various permissive circuits in the Reactor Control System prior to generating the actual call for rod motion. The following interlocks between the RCS and the Reactor Control System are provided:

1. Stop Manual Rod Withdrawal - Blocks manual rod withdrawal on plant conditons of:

a.

Power Range (Hign Range) Nuclear Overpower

b.

Intermediate Range Nuclear Overpower

c.

Source Range Nuclear Overpower

d.

Overtemperature AT

-6

2. Stop Automatic Rod Withdrawal - Blocks automatic rod withdrawal on plant conditions of:

a.

Power Range (High Range) Nuclear Overpower

b.

Overpower C.

Overtemperature A T

d.

Rod Drop - Nuclear

e.

Rod Drop -

Rod Position

f.

Turbine First Stage Pressure 2.2.3 Control Rod Driven Mechanism (CRUM)

The control rod drive mechanism is a three-coil, electromagnetic jack which raises and lowers a drive rod to which are attached the rod control cluster, assemblies.

The three coils, mounted outside the guide tube, which forms a pressure boundary with the reactor coolant system, actuate armatures continued within a housing attached to the guide tube. The movable and stationary gripper armatures operate latches which grip a grooved drive rod. The movable gripper latches are used to hold the drive rod at a command position. The movable gripper latches, which are raised and lowered by the lift coil armature, are used to raise and lower the drive rod. Each complete sequence step of the drive mechanism moves the drive rod 3/8 inch. The mechanical sequence of operation for one "IN" and "OUT" step is as follows:

1. Mechanical "OUT" Sequence

a.

Hold on movable gripper.

b.

Stationary gripper off.

c.

Pull up the lift armature, raising the drive rod 3/8 inch.

d.

Latch the stationary gripper.

e.

Unlatch the movable gripper.

f.

Drop the lift armature.

g.

Latch the movable gripper.

h.

Unlatch the stationary gripper.

i.

Repeat steps "c" through "h" for the next 3/8 inch "OUT" step.

2. Mechanical "IN" Sequence

a.

Hold on movable gripper.

b.

Latch the stationary gripper.

c.

Unlatch the movable gripper.

d.

Pull up lift armature.

e.

Latch the movable gripper.

f.

Unlatch the stationary gripper.

g.

Drop the lift armature, lowering the drive rod 3/8 inch.

h.

Repeat step "b" through "g" for the next 3/8 inch "IN" step.

While at a fixed command position, reduced power is applied to the movable armuature.

Inadvertent or tripped loss of power to the armature will release the movable latch and the drive rod will drop due to the force of gravity acting upon it.

-7 2.2.4 Sequencing Circuitry The sequencing circuitry provides the interface between the RCS and the Control Rod Drive Mechanism (CRDM) coils. The circuitry consists of power contactors, 1/2 power resistors and associated relays, arc suppression devices, isolation diodes and fuses. There are three contactors per group of rods, one each for the movable grippers, stationary grippers and lift coils of the CRDMs.

Upon receipt of a rod motion signal the 1/2 power resistor relays are de-energized and the normally closed contacts of the relay shuni 1/2 power ressistor connected in series with the movable gripper coils.

The coils of the power contactors are then energized by the cam switches in the proper sequence and the rod group completes a step. Voltrap type suppression devices are connected across the CRDM coils to limit voltage transients and reduce arcing on the contactor contacts.

2.2.5 Slave Cycler Circuitry The slave cycler circuitry processes rod motion signals from the master cycler and sequences the power contactors in the sequencing circuitry through cam limit switches. The circuitry consists of a cam limit switch, clutch, motor, and speed reducer for each group of rods.

The output RPM of the motor is reduced to 40 RPM by the speed reducer. The speed reducer is coupled to the cam limit switch through the clutch. When rod motion is called for, an output relay in the master cycler is energized. When a set of contacts in the relay closes, power is provided to the coil of the clutch. The cam limit switch is then rotated by the motor/speed reducer. At a cam switch speed of 40 RPM, the maximum possible stepping rate is 15 inches per minute (based on 3/8 inch per step).

2.2.6 Programming Circuitry The programming circuitry consists of the Master Cycler assembly, Bank Overlap assembly, and Pulser assembly. Brief descriptions of these assemblies are presented in the paragraphs that follow. Note that these assemblies are related to control rods only and the material that follows does not apply to shutdown rods.

2.2.6.1 Master Cycler Assembly The master cycler interprets signals from the Pulser assembly, Bank Overlap assembly, and command control circuitry and energizes the slave cycler clutches in the proper sequence to provide control rod bank motion. Another function of the master cycler is to provide fault detection for failures in the slave cycler circuitry.

The master cycler is composed basically of three subsystems consisting of an in-and -out counter, a decoder, and an error detector. The in-and-out counter logic card circuitry is composed of NAND gates formed by discrete components.

The counter counts pulses received from the pulser assembly. The direction of the count is determined by the "IN" and "OUT" direction signals from the command control circuitry. The NAND gates in the in-and-out counter circuit are connected to form flip-flop logic. The outputs of the combination logic determine which control rod group is to be actuated by providing signals to the decoder circuit.

-8 The decoder circuit consists of four OR gates, each of which is comprised of three NAND gates. Discrete components are used to form these gates. One OR gate makes up the logic for selecting control rod groups 1 and 5. The other three OR gates make up the logic for control rod groups 2 and 6, 3 and 7, and 4 and 8. To maintain a one step difference between rod groups in the same bank it is necessary to apply the first pulse after a reverse command to the same rod group that was pulsed prior to the command. Via the OR gates,the decoder selects the same rod group after a change in direction command. The output of the OR circuit drives relay drivers.

The relay drivers control the master cycler output relays which control the slave cycler clutches and 1/2 power relays in the sequencing circuitry.

The error detection circuitry in the master cycler detects two types of errors; 1) failure of a slave cycler to respond to a move signal, and 2) a failure of a slave cycler to complete a cycle and return to the home position. The error detector uses index contacts on the cam limit switch to energize an alarm relay if an error condition exists. This alarm relay then energizes an ammunciator on the control board. Rod motion in the "OUT" direction is inhibited if the system is in the Auto mode.

2.2.6.2 Bank Overlap Assembly The bank overlap assemblies process "IN" or "OUT" direction signals from the comimand control circuitry and engage control rod Bank 1 and/or Bank 2 according to a predetermined overlap program. Normally the Control Banks are not overlapped. However, the banks can be overlapped as described in the next paragraph.

There is one assembly for each control bank. The overlap assemblies are comprised of relays,thumbwheel switches, a digital counter and an AC-DC convertor. The thumbwheel switch is used to select the step desired for overlap initiation and cutoff. A set of normally open contacts in the output relay in the Bank 1 overlap assembly controls the bank motion signal to the master cycler for control Bank 2. Therefore, rod motion for control Bank 2 will be inhibited as long as the output relay in the Bank 1 overlap asembly is de-energized. A set of normally closed contacts in the output relay in the Bank 2 overlap assembly controls the bank motion signal to the master cycler for control Bank 1. Therefore, rod motion for control Bank 1 will be allowed as long as the output relay in the Bank 2 overlap assembly is de-energized.

When the count in control Bank 1 has reached the overlap initiation setpoint, the output relay in the bank 1 overlap assembly is energized and the relay contacts close. This action provides a bank motion signal to the master cycler for control Bank 2. Now both control banks are stepped out in unison.

When the count in the Bank 2 overlap assembly reaches the overlap cutoff setpoint, the output relay in the Bank 2 overlap assembly is energized and the relay contact open. This action removes the Bank 1 motion signal to the master cycler for control Bank 1. Now only control Bank 2 moves in the out direction. Movement in the "IN" direction is similar to the "OUT" direction except that where Bank 1 was turned off, Bank 2 will be turned on.

Also, where Bank 2 was turned on Bank 2 will be turned off.

-9 If motion of an individual control bandk is desired, the overlap cutout switch can be used to select the desired bank.

2.2.6.3 Pulser Assembly The function of the pulser assembly is to transform a rod speed signal from the Reactor Control System to a pulse rate that is linearly related to the input signal.

The pulser assembly consists of power supplies, relays, integrated circuits,and other discrete components such as transistors, resistors, and capacitors. When rod motion is called for, a shift pulse is sent to the master cycler through a set of normally closed contacts from a relay in the pulser assembly. The master cycler then sends a signal back to the pulser assembly that energizes the relay. This action terminates the shift pulse. At the same time an integrator network in the pulser assembly.

begins to process the rod speed signal from the Reactor Control System. When the integrator reaches a setpoint value the relay is de-energized and a new shift pulse is sent to the master cycler through the normally closed contacts. This operation repeats itself as long as rod motion is called for.

2.2.7 Command Control Circuitry The command control circuitry provides the interface between the plant operator or Reactor Control System and either the programming circuitry for control bank rods or the shutdown bank slave cycler for shutdown bank rods.

The command control circuitry is mostly comprised of relays.

The relays are divided into two functional groups, "OUT" directional relays nd "IN" directional relays. When rod motion is called for in either the "OUT" or "IN" direction the appropriate group of relays performs the following functions for the control bank rods.

1. Provides power to the contactor coils in the sequencing circuitry through the cam limit switches.

2. Provides rod direction signal to the master cycler assembly. and bank overlap assemblies.

3. Initiates shift pulse to pulser assembly.

4. Provides a circuit path to the neutral bus for the step counters.

This allows the step counters to be pulsed when rods are stepped.

Since shutdown bank rods are not affected by the programming circuitry, the shutdown directional relays only perform Items 1 and 4 listed above.

Other functions of the directional relays are to prevent any attempt to move rods in the opposite direction when rods are being stepped and, when control bank rods are being stepped, shutdown bank rods are inhibited from moving and vice versa.

-10 2.2.8 Scram Breaker Circuitry The purpose of the scram breaker circuitry is to remove power from the Control Rod Drive Mechanism coils when a reactor trip signal is received from the Reactor, Protection System. There are two independent and redundant sets of scram breaker circuitry. If one set of circuitry should fail, the reactor trip would be accomplished by the other set of scram breaker circuitry. When the Reactor Protection System sends a trip signal to the scram breaker circuitry, the breakers remove power from the stationary and movable gripper coils of the CRDM. This action causes the gripper latches to fall out permitting the control and shutdown bank rods to fall into the core. The scram breakers can also be opened manually by a switch on the main control board.

3.0 FAILURE MODE AND EFFECTS ANALYSIS 3.1 Scope and Level of Analysis The breadth and depth to which one performs a failure analysis is a function of the following elements:

a. The complexity of the equipment being studied,

b. The equipment's intended mission and objectives to be met,

c. The system component level selected so as to verify that a mission has been completed and that all stated objectives have been accomplished.

The basic approach to failure analysis in this study is to determine the failure characteristics of the RCS under plant conditions of providing near or full reactor power output. For the shutdown bank rod control circuitry it was assumed that failures occured while shutdown banks were being operated under manual control.

The basic failure modes of the RCS are identified; the failure mechanisms attributed to identified failure modes are postulated; the methods used for failure detection upon occurrence of a failure are determined; and the effects of a failure on RCS operation are analyzed. In the paragraphs to follow, the boundaries of the plant control systems that constitute the RCS are defined and the level of analysis is established. The subsystems of the RCS having a failure impact on the uncontrolled withdrawal or misalignment of a bank of control rods are defined, the failure modes of each subsystem are determined, and their effects on system operation are analyzed.

System functions and descriptions of equipment in the RCS were presented in detail in Section 2.0 of this report. With reference to the material presented, functional systems of the RCS may be defined to include:

1. An ac and dc power distribution system consisting of transformers, redundant circuit breakers, and distribution buses.

2. A control board switch arrangement (bank selection switch, IN-HOLU-OUT rod movement switch, etc.) for operator control of rod movement.

3. A visual display system (step counters) for indication of demand rod movement.

4. A control module (logic cabinet) that receives various demand signals, either manual from the operator or automatic from the reactor rod speed control system, and provides the command signals needed to operate the shutdown and control rod groups in a prearranged program.

5. Power modules (cycler cabinets arid shutdown/control cabinets) that provide dc currents to the operating coils of the CRDMs.

6. A surge suppression module (suppressor cabinets) which limits voltage transients caused by turning off power to CRDM coils.

7. A Control Board switch arrangement (lift coil disconnect switch panel) used for retrieving dropped rods.

With reference to this study, only four of the above defined systems were considered for analysis. System faults attributable to operator error and anomalies of the visual display system were outside the study. In addition, only functional systems having a potential for a fault that could cause inadvertant withdrawal or misalignment of a control bank were analyzed.

The single failure analysis was conducted for the logic cabinet, cycler cabinets, shutdown/control cabinets, and suppressor cabinet. Consideration was given in the study to failure of a control rod drive mechanism and the results of a brief analysis conducted are included in the report. The FMEA worksheets prepared for the systems analyzed are included in Appendix A.

For each system analyzed, the failure modes and mechanisms postulated are presented, the effects of failure on system operation are identified and methods for failure detection are identified. System effects on potential rod movement tend to fall into three basic categories:

(a) dropping of rods, (b) blocking of rod movement which results in rod misalignment and (c) erroneous rod insertion or withdrawal.

Diverse means are provided in the design of a Westinghouse NSSS such as San Onofre Unit 1 to detect and/or mitigate the effects of malfunctions within the Rod Control System that include the dropping of rods, rod misalignment and blocked rod movement. A reactor trip or turbine run back by the Reactor Control and Protection System is provided if dropped rods, blocked rod movement, or erroneous rod movement results in established process setpoints being reached.

The Rod Position Indication System provides a visual display at the Control Board of the actual position of all full length rods both in and out of the reactor core. It also provides an alarm with annunciation if a rod is at the bottom of the reactor core during power operation and provides information to a rod insertion monitor which sounds an alarm if rod insertion limits are exceeded.

This system is also programmed to sound an alarm in the event of misalignment of rods assigned to control and shutdown banks used for reactivity control.

The RCS provides visual display at the Control Board for reactor operator surveillance of demand group position of rod banks. Certain faults within the RCS leading to erroneous rod movement are announced at the plant annunciator.

The methods of detection listed on the FMEA worksheets were selected first.as being initiated by an alarm condition within the RCS and second by one or more of the other diverse methods stated. It should be noted that because of such a selection technique some of the entries do not include all methods of detection available. The method of detection further assumed that minimum compensating factors were available (i.e., moderator temperature, coolant density, maneuvering band, etc.) for reactor trip and for rod insertion limit alarms.

Administrative procedures for the operation of the reactor at power conditions specify frequent surveillance of the operation of all systems of the RCS. As an example of the surveillance required, rod bank position as indicated by the bank demand step counters of the RCS and the position of rods indicated by the rod position indicators of the Rod Position Indication System shall be verified as being within +12 steps of indication once every shift.

The surveillance required for reactor power operation was considered in the establishment of analysis bounds and also as a possible method of detection for failure modes postulated for the RCS.

3.2 Control Rod Drive Mechanism Only a brief analysis was conducted in regards to the control rod drive mechanism (Appendix A, Sheet 1).

Since the analysis conducted was oriented towards the electrical and electronic control aspects of the RCS and not to its mechanical operational characteristics, an "in-depth" analysis of the rod drive mechanism was not performed.

The analysis conducted on the drive mechanism treats component failures to the extent necessary to show failure.

The FMEA conducted for the control rod drive mechanism revealed no failure modes that could cause inadvertent rod withdrawal.

The design of the mechanism makes such an event incredible. As shown by the analysis conducted, the effect of failure of a control rod drive mechanism would be to either drop an individual rod into the reactor core or block movement of a rod.

Neither of these events would have much effect on the actual operation of the reactor as the Reactor Control System can compensate for the reactivity deviation.

Both events would produce alarms and annunciation at the Control Board that require corrective action to be taken.

-13 3.3 Sequencing Circuitry Sheets 2 through 16 and 46 through 50 of Appendix A describe the FMEA peformed for the sequencing circuitry. The analysis identified no single component failures that would cause uncontrolled insertions or withdrawals of shutdown or control rods. The analysis substantiates that the design of the sequencing circuitry is "fail-safe" in regards to a rod withdrawal transient, in that if a component fails, the end result of failure is either that of blocking rod movement or that of dropping an individual rod or group of rods.

The analysis also revealed that within the sequencing circuitry, no single failure which could cause erroneous rod movement would remain undetected.

3.4 Slave Cycler Circuitry Sheets 20 through 25 of Appendix A describe the FMEA performed for the slave cycler circuitry. As with the sequencing circuitry the analysis revealed no single component failure that would result in uncontrolled rod bank withdrawals. Again, failures that result in blocking rod movement or dropping of rods will not remain undetected.

3.5 Programming Circuitry The programming circuitry consists of the bank overlap, pulser, and master cyler assemblies. The FMEA for the bank overlap assemblies is described on sheets 26 through 32 of Appendix A, while the FMEA for the pulser and master cycler assemblies is on Sheets 17, 18, 33, and 51 through 58 of Appendix A.

The analysis revealed several component failure modes that could result in erroneous rod insertion or withdrawal if operating in the automatic bank overlap control mode. For most of these failures the rod withdrawal or insertion rate would be limited to the stepping rate called for by the Reactor Control System.

However, there are failures in the pulser assembly thdt could cause the RCS to step rods at a rate that exceeds what is called for by the Reactor Control System. For these failures, the maximum credible stepping rate would be limited to 40 steps per minute by,the motion/speed reducer in the slave cycler circuitry. In the unlikely event of such a failure, the reactor would eventually trip and mitigate the consequences of the postulated component failure. The results of the analysis indicate that all failure modes are detectable or are terminated by a diverse means (e.g., reactor trip).

3.6 Command Control Circuitry The FMEA for the command control circuitry is described on Sheets 34 through 45 of Appendix A. The analysis revealed no failures that would cause uncontrolled insertions or withdrawals of shutdown or control rods.

The end result of failures in the command control circuitry is either blocking of rod movement or dropping of a group of rods. The analysis also revealed that within the command control circuitry, no single failure will remain undetected.

-14 3.7 Other Circuitry A FMEA was not performed for the scram breaker circuitry or the indication circuitry described in Section 2.2. Since the scram breaker circuitry is redundant, a single failure would not prevent the breakers from performing their intended function, which is to trip the plant upon receipt of a manual trip signal or a signal from the Reactor Protection System. Also, since indication circuitry does not effect rod motion it was excluded from the FMEA.

4.0 CONCLUSION

S The FMEA shows the single component failures for the RCS result in one of three possible events 1) dropping of rods, 2) blocking of rod movement which results in rod misalignment and 3) erroneous rod insertion or withdrawal each of which affects reactor operation.

Dropped rods are detected by the Rod Position Indication System which will energize the "Rod Bottom - Rod Drop" annunciator on the control board. If the RCS is in the automatic mode, rod bottom relays in the permissive circuitry will de-energize which prevents further rod motion. Failures which cause rod misalignment are detected by the operator via step counters and the Rod Position Indication System which compares demanded position and actual rod position and initiates a "Rod Deviation" alarm if the difference between demanded and actual rod position exceeds a specified limit.

For failures leading to erroneous rod insertion or withdrawal, detection can be made via the Rod Position Indication System or the step counters. The stepping rate for most of the failures analyzed will be defined by the Reactor Control System. Certain failures in the pulser assembly will lead to stepping rates in excess of the rate called for by the Reactor Control System. The maximum credible stepping rate is 40 steps per minute which is defined by the maximum RPM for the motors/speed reducers in the slave cycler circuitry. The reactor would eventually trip and mitigate the consequences of component failures leading to erroneous rod insertions or withdrawals.

In summary, the FMEA performed for the San Onofre Unit 1 RCS shows that most single failures are in the safe direction (i.e., rod movement is blocked or rods are dropped) and that either an alarm is actuated to detect the failure or the reactor is tripped to insure that the reactor core is maintained within safe design limits.

-15

5.0 REFERENCES

1. SCE Rod Control System Technical Manual

2. NOK Rod Control System Technical Manual*

3. CY Rod Control System Technical Manual*

4. SCE Dwg. 1542 Sheets 102-118 (W Owy. 915E637 Sheets 1-17)

Master System Schematic

5. W Dwg. 942HO61 Master Cycler Schematic Diagram

6. W Owg. 939FU55 Pulser Assembly Schematic

7. W Dwg. 992D217 Bank Overlap Control Assembly Schematic References were made to technical manuals from similar plants for clarification purposes only.

TO ol ol REMOTE 120 VAC

.J z

2 CONSOLE e n.

z

<1 D

GR 1r BANK a

I 4 O

z o

SLAVE (TYPICAL)

O IOCYCLER COMMAND SAFET INDICATION FAULT C

ICIRCUITRY INTERLOCKS CIRCUITRY INDICATION COMM

00-C L U TC H r-a I

D1ANK 1 MOVE PULSER "LKt-DOWN CONTROL (ICONTROL OP ERAT N G O PERA SNG ASSEMBLY CY R

COTNTRCOL

-FAULT ALARM F

1/2 PWR 120 V SLAVE (TO CONSOLE) 4-MASTE R DELAY AC CYCLER IN DIRECTION CYCLER OTDRECTION y y SHTDWN SUTOWT ONOL CS ROCONTRO ROD ROD OVERLAP CONTROL 0

~

SEQUENCE SEOUENCE SWITCH SW CAM ROO ROD CIRCUITRY CIRCUITRY I--

SWITCHES SEOUENCE COI2LS I

IT BANK21 BANK 1CLUTCH a

OVERLAP SHUTDOWN It SHUTDOWN1 I ASSEMBLY BANK 1 ROD If ROD IENGAGE COILS I I COILS GR 3 BANK 2 3.JBANK 2

SLAVE (TYPICAL)

BANKI BAK 2OVERLAP CYCLE BANKI BANK 2ASSEMBLY B3ANK 2 CCE ENGAGE TO 120 VAC CONSOLE ROD-BOTTOMOVRA ROD-STOP MEOR4~

PROGRAMMING

'ASSEMBLY CIRCUITRY

CONTROL BANK 1-GROUP 1 -2 Rods Group 2 -

2 Rods Group 3 - 4 Rods Group 4 - 4 Rods CONTROL BANK 2 -

Group 5 -

4 Rods Group 6 -

4 Rods Group 7 - 5 Rods Group 8 - 4 Rods SHUTDOWN BANK 1 -

Group 1 -

8 Rods Group 2 - 8 Rods FIGURE 2 A

ARRANGEMENT OF CONTROL AND SHUTDOWN BANKS

APPENDIX A FMEA WORKSHEETS

REFERENCb DRAWING CIRCUIT FUNCTION CRDM November 30'81 METHOD OF COMPONENT FJNCTION FAILURE DODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Control Rod Drive Moves Control or A. Dropped Rod, Mechanical fail-Tilt in core Rod Position Indi-Rod Position Mechanism.

shutdown rod into ure in stationary power due to cation Sys.(RPIS) Indication Sys or out of the or movable latch dropped rod.

will activate monitors rod reactor core for mechanism.

"Rod Bottom-Rod position in or negative reactivity Drop" annunciator out of the control of reactor Winding insula-at the Cqntrol reactor core.

power.

tion breakdown Board.

causes shorted movable coil.

Movable coil open B. Immovable Rod. Mechanical fail-Tilt in core powei RPIS initiates ure in-stationary due to misaligned "Rod deviation" RPIS is pro latch mechanism. rod.

alarm.

grammed to de tect error be Winding insulatioi tween rod po breakdown causes sition-and shorted lift coil.

demanded posi-,

Lift coil open I

tion. A de due to poor con-viation alarm nection to coil is sounded if or material fail-a specified ure of winding error exists wire.

between posi-tion indicated and demanded bank position.

Sheet 1

REFERENCL DRAWING CIRCUIT FUNCTION W Dwg. 915E637, Sheet 14, 15, 17 Control Rod Sequencing Ckt. V, VI; Shutdown Rod Sequencing Ckt. II November 3081 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Stationaty Grippe Provides power Opens prematurel Material Failure Failure results The Rod Position There are two Fuses 30A overload protec-of fuse element. in an open cir-Indication Sys.

30A fuses for CA-FU-25,26 tion to the sta-cuit that blocks monitors position each stationar CA-FU-21,16 tionary Gripper Poor connection flow of current of all full len-Gripper coil.

CA-FU-55,56 coil connected in to fuse element. to the stationary gth rodsin or One up-stream CA-FU-46,47 series with each coil of a single out of the react-and one down CB-FU-25,26,27,22 particular fuse.

Material failure rod drive mechan-or core. The stream of the CB-FU-21,16,17,18 of fuse contact, ism causing system activates coil.

CB-FU-55,56,57,52 (clip or holder) erroneous steppinj an annunciator CB-FU-46,47,48,43 during rod move-

"Rod Bottom Rod Cabinets CC,CD,SA ment allowing re-Drop" and energ SB contain fuses lease of a rod to izes a "Rod Bot in similar con-drop into reactor tom" indicator figuration as core.

light at the con cabinets CA and trol board:- to CB alert the reactor operator of a dropped rod.

Stationary coil Provides power Opens Prematurely Material Failure Failure results it Same as stationarr Each rod groul power-line fuse overload pro-of fuse element. an open circuit Gripper 30A fuse consists of 1OOA tection for sta-Poor connection that blocks flow failure.

four rods r4-FU3,FU30 tionary coil-.

to fuse element. of current to a with the ex 3-FU3,FU30 power circuitry Material failure group of station-ception of Cabinets CC;CD, for single group of fuse contact. ary coils. This groups in the SA,SB contain of rods.

(clip or holder) will cause CA cabinet fuses in similar erroneous stepping which consistU configuration as during rod move-of two rods cabinets CA and ment allowing the and one group CB.

release of the in the CD rod group to drop cabinet which into reactor core.

consists of five rods.

Sheet 2

REFERENCL JRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 14,15,17 Control Rod Sequencing Ckt. V, VI; Shutdown Rod Sequencing Ckt. II November 30'81 MEIRO)D OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Movable Gripper Provides power Opens Material failure Failure results The rod position There are two fuses 30A overload protec-Prematurely.

of fuse element.

in a open circuit indication system 30A fuses for CA-FU-23,24 tion to the mov-Poor connection that blocks flow monitors position each movable CA-l'U-13,14 able Gripper coil to fuse element.

of current to the of all full length Gripper coil.

CA-FU-53,54 connected in Material failure movable coil of a rods in or out of One up-stream CA-FU-44,45 series with each of fuse contact rod drive mechan-the reactor core. and one down CB-FU-23,24,19,20 particular fuse.

(clip or holder).

ism causing erron-The system activa-stream of the CB-FU-13,14,15,51 eous stepping tes an annunciator coil.

Cabinets.CC,CD, during rod move- "Rod Bottom Rod SA, SB contain ment and loss of Drop" and ener fuses in a holding current gizes a "Rod Bot similar configura-to the rod mechan-tom" indicator tion as cabinets ism during time light at the con CA and CB period of no de-trol board to aler:

mand for rod the operator.

movement allowing release of a rod to drop into reactor core.

Movable coil Provides power Opens 4aterial failure Failure results Same as movable Each rod group power-line fuse overload protec-Prematurely, of fuse element.

in an open circuitGripper 30A fuse consists of 100A tion formovable Poor connection to that blocks flow failure.

four rods with CA-FU-4,31 zoilpower cir-fuse element.

of current to the exception CB-FU-4,31 cuitry for single aterial failure group of movable of the groups, Cabinets CC,CD, group of rods.

of fuse contact coils. This will in Cabinet CA SA, SB contain (clip or holder).

cause erroneous which have two; fuses in similar stepping during rods and one configuration as rod movement or group in cab cabinets CA and loss of holding inet CD which CB.

current during has five rods.

period of no demard for rod movement allowing release of the rod group to drop into reactor core.

Sheet 3

REFERENCE vRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sht. 14,15,17 Control Rod Sequencing Ckt. V. VI: Shutdown Rod Sequencing Ckt. II November 30'81 METHOD OF COMONENr FUNCTION FAILURE NODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Lift Coil fuses Provides power Opens Material failure Failure results A misaligned 60A overload protec-Prematurely, of fuse element.

in an open cir-rod initiates RPIS is pro CA-FU-10,11 tion to lift coil Poor connection tc cuit that blocks sounding of a grammed to de CA-FU-37,-38

-connected in fuse element.

flow of current rod deviation fect error be CB-FU-10,11,7,8 series with each Material failure to lift coil of alarm by.the tween rod CB-F4-37,38,34,35 particular fuse.

of fuse contact a rod drive mech-- RPIS to alert position and Cabinets CC,CD,SA, (clip or holder).

anism causing operator of demanded posis SB contain fuses erroneous stepping failure.

tion. A de in similar con-during rod move-viation alarm figuration as cab-ment which re-is sounded if inets CA and CB sults in misalign-a specified ment of affected error exists rod with other between actual rods assigned to and demanded same group.

bank position.

Lift coil power-Provides power Opens Material failure Failure results Same as lift Each rod group line fuse 150A overload protec-Prematurely, of fuse element.

in an open cir-coil 60A fuse consists of CA-FU-1,28 tion for lift Poor connection cuit that blocks failure.,

four rods with CB-FU-1,2,28,29 coil circuitry to fuse element.

flow of current the exception Cabinets CC, CD, for of a single Material failure to lift coils of of the groups SA, SB contain group of rods.

of fuse contact two rods causing in cabinet CA fu :s in similar (clip or holder),

erroneous steppin; which consist coifiguration as during rod move-of two rods Cabinets CA and CB ment which re-and cabinet CD sults in misalign-which has one ment of affected five rod group.I rods assigned to same bank.

Sheet 4

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg.

915E637 Sheet 14,15,17 pontrol Rod Sequencing Ckt. V, VI; Shutdown Rod Sequencing Ckt.

II November 30'81, METHOD OF COMPONEN'T FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS De-lon Disconnect Provides for man-Opens Mechanical failure Same as failure Same as failure There is one switches ual disconnect of Prematurely.

of contacts.

of 60A lift coil of 60A lift coil disconnect CA-1CLD1,1CLD2 lift coil from fuse.

fuse.

switch per rod.

CA-2CLD5,2CLD6 power circuitry (See Sheet 4)

(See Sheet 4)

CB-3CLD1,3CLD2, during main 3CLD3,3CLD4 tenance or rod CB-4CLD5,4CLD6, adjustment opera 4CLD7,4CLD8 tion.

Cabinets CC,CD, SA,SB contain switches in sim ilar configuration as Cabinet:@ CA and CB Isolation Diodes-Provides circuit a. Fails Open.

Poor bonding of Same as failure Same as failure tationary Coils isolation that die or electrode of 30A station-of 30A stationary A-D3-CR-1,2,3,4 prevents cir-contact causes ary coil fuse.

coil fuse.

JA-D14-CR-1,2,3,4 culating currents open junction.

(See Sheet 2)

(See Sheet 2),

JB-D19-Cr-1,2,3,4 between station-Interconnect wire JA-D8-CR-1,2,3,4 ary coils of a to diode open.

JA-D13-CR-1,2,3,4 given group.

JB-D30-CR-1 B-D26-CR-1,2,3,4

b.

Fails Short.

Surface defect Failure could re-A misaligned rod JB-D32-CR-1,2,3,4 causes junction sult in improper initiates sounding JA-D1-CR-1,2,3,4 short. Bulk de-current levels to of a rod deviation JA-D6-CR-1,2,3,4 fect in silicon a stationary coil alarm by the RPIS B-D20-CR-1,2,3,4 base material for a single rod to alert operator JB-D25-CR-1,2,3,4 causes short.

causing erroneous of failure.

Junction break-stepping during down due to re-rod movement verse voltage or which results in forward current misalignment of transient.

affected rod with other rods assign ed to same bank.

Sheet 5

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 14,15,17

,Control Rod Sequencing Ckt. V,VI; Shutdown Rod Sequencing Ckt. II November 30'8L METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE NECHANISM EFFECT ON SYSTEM DETECTION REMARKS Isolation Diodes-Provides circuit Fails Open.

Poor bonding of Same as failure Same as failure movable coils isolation during die or electrode of 30A Movable of 30A movable UA-D4-CR-1,2,3,4 rod stopping contact causes coil fuse.

coil fuse.

UA-D15-CR-1,2,3,4 -and rod holding open junction.

(See Sheet 3)

(See Sheet 3)

UB-D22-CR-1.2.3.4 that prevents UA-Dll-CR-1,2,3,4 interaction be UA-D16-CR-1,2,3,4 tween movable Fails Short.

Surface defect Same as failure Same as failure UB-D30-CR coils of rod driv causes junction of stationary of stationary UB-D27-CR-l,2,3,4 mechanisms for short.

Bulk coil isolation coil isolation UB-D33-CR-1,2,3,4 rod in same group defect in silicon diode.

diode.

UA-D2-CR-1,2,3,4 base material (See Sheet 5)

(See Sheet 5)

UA-D9-CR-1,2,3,4 causes short.

UB-D21-CR-1,2,3,4 Junction Break UB-D28-CR-1,2,3,4 down due to rever e voltage or for.

ward current tran sient.

Isolation Diodes-Provides circuit Fails Open.

Poor bonding of Same as failure Same as failure Lift Coils isolation during die or electrode of 60A lift coil of 60A lift coil UA-D7-CR-1,2,3.4 rod stepping that contact causes fuse.

fuse.

UB-D18-CR-l,2,3,4 prevents inter-open junction.

(See Sheet 4)

(See Sheet 4) t-D23-CR-1,2,3,4 action between JA-D12-CR-l,2,3,4 lift coils of rod Fails Short.

Surface defect Same as failure Same as failure A-D17-CR-1,2,3,4 drive mechanisms causes junction of stationary of stationary JB-D30-CR-3 for rods in same short. Bulk defectcoil isolation coil isolation JB-D31-CR-1,2,3,4 group.

in silicon base diode.

diode.

JB-D34-CR-1,2,3,4 material causes (See Sheet 5)

(See Sheet 5)

JA-D5-CR-1,2,3,4 short.

JA-DlO-CR-1,2,3,4 Junction break JA-D29-CR-1,2,3,4 down due to re JA-D29-CR-1,2,3,4 verse voltage or forward current transient.

Sheet 6

REFERENCE ORAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 14,15 Control Rod Sequencing Ckt. V, VI; Shutdown Rod Sequencing Ckt. II November 30'81 METH-OD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Voltrap Limit transient Fails Open.

Poor counter elec-Degraded circuit Detection possible High peak Stationary Coils voltages during trode spring con-protection. No during routine voltage trans UA-VR-4,10,23,15, rod stepping and tact Interconnect immediate effect maintenance of ients due to 19

• reactor trip.

wire to voltrap on system oper-cabinet.

turning off UB-VR-35,45,51 terminals open.

ation. Possible current to UA-VR-1,9 degradation of I

stationary UB-VR-36,43 contactor con-coil will tacts.

accelerate wear on con tactor con tacts.

Fails Short.

Bulk defect in Voltrap failing Same as 100A sta selenium layer short and result-tionary coil line causes device ant line to neu-fuse.

short. Surface tral current path (See Sheet 2) defect in barrier will lead to pro (blocking) layer tection fuse be causes device ing blown.

short.

Effect on system Interconnect wire operation is sim to voltrap ter-ilar to that minals shorted to stated for 100A ground.

stationary coil line fuse.

Voltrap movable Limit transient Fails Open.

Poor counter elec-Degraded circuit Detection possiblE High peak vol coils.

voltages during rode spring con-protection. No. during routine tage transient UA-VR-6,10,24,39,.rod stepping and tact.

Intercon-immediate effect maintenance of due to turning 16 reactor trip.

nect wire to vol-on system opera-cabinet.

off current UA-VR-20,2,9 trap terminals tion. Possible tomovable UB-VR-46,52,37,44 open.

degradation of coil will contactor con-accelerate weat tacts.

on contactor contacts.

Sheet 7

REFERENCt DRAWING CIRCUIT FUNCTION November 30'81 ME 01D OF COMPONEWF FUNCTION FAILURE MDE FAILURE MECHANISM EFFECT ON SYSTIM DETECTION REMARKS Voltrap movable Fails Short Bulk defect in Voltrap failing Same as 100A coils (cont.)

selenium layer short and re-movable coil line causes device shor.sultant line fuse.

Surface defect in to neutral cur-(See Sheet 3) barrier (blocking) rent path will layer causes de-lead to protec vice short.

tion fuse being Interconnect wire blown.

to voltrap ter-Effect on system ninals shorted to operation is ground.

similar to that stated for 100A movable coil line fuse Sheet 8

REFERENCL DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 14,15 Control Rod Sequencing Ckt. V,VI; Shutdown Rod SeguencingCkt. II November 30'81 MET1OD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Voltrap Lift Coil. Limit transient Fails Open Poor counter elec-Degraded circuit Detection possible High peak vol UA-VR-11,12,17,18 voltages during trode spring con-protection. No during routine tage transient UB-VR-33,34,40,41 rod stepping and tact.

immediate effect maintenance of due to turning UA-VR-21,22,3,7 reactor trip.

Interconnect wire on system oper-cabinet.

off current to UB-VR-47,48,53,54 to voltrap ter-ation. Possible lift coil will UA-VR-13,14 minals open.

degradation of accelerate wea UB-VR-32,42,45,50 contactor con-on contactor tacts.

contacts.

Fails Short Bulk defect in Voltrap failing Same as 150A lift selenium layer short and result-coil fuse.

causes device ing line to neu-(See Sheet 4) short. Surface de-tral current path fect in barrier will lead to (blocking) layer protection fuse causes device being blown.

short. Inter-Effect on system connect wire to is similar to that voltrap shorted stated for 150A to ground.

lift coil fuse.

(See Sheet 4)

Power Resistor Reduces power con-Fails Open Interconnect wire Failure results ir The Rod Position Bank sumed by movable to resistor bank an open circuit Indication System CA-1RES1,2RES2 Gripper coil dbr-open.

that blocks flow monitors position CB-3RES1,4RES2 ing period of no qaterial failure of current to of all full lengti CC-5RES1,6RES2 rod motion.

of resistance a group of.movablE rods in or out of CD-7RES1,8RES element.

coils. This will the reactor core.

SA-1RES1,1RES2 cause loss of hold The system act SB-2RES1,2RES2 ing current allow-ivates an annunci ing release of the ator "Rod Bottom rod group to drop Rod Drop" and into reactor core. energizes a "Rod Bottom" indicatioi light at the con trol board to alert operator.

Sheet 9

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 14,15 Control Rod Seque cing Ckt. VIV; Shutdown Rod Sequencing Ckt. II November 30 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS 2 Power Resistor Fails Short Interconnect wire Degraded circuit Detection possiblE Bank (cont.)

shorted.

protection. No during routine Insulation break-immediate effect maintenance.

down between on system opera windings of resis-tion. Possible tance element.

failure of movabl coil due to over heating.

Sheet 10

REFERENCE IJRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 12,14,15,16,17 dControl Rod Sequencing Ckt. III,V,VI; Shutdown Rod Sequencing Ckt. I TT November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Movable Coil !

Inserts resistor Coil fails open.

Coil.winding open Degraded circuit For coil failure Aux contact on Power Resistor bank in movable Contact M fails due to insulation protection. No

! power indicator contactor powe Contactor coil power circuit closed.

breakdown.

immediate effect light will turn

! power indica during period of Open interconnect on system oper-off.

tor lights.

CA-lCK1,2CK2 no rod motion.

wire to coil.

ation.

For contact failurThere is pos CB-3CK1,4CK2 Provides indica-Contacts fused.

Possible failure detection~possible sibility of CC-5CKl,6CK2 tion via light in of movable coil during routine only this con CD-7CK1,8CK2 control room for due to overhear-maintenance.

tact failing, SA-lSKl,1SK2 status of circuit.

ing.

which results SB-2SKl,2SK2 in inaccurate information being displayed Coil fails closed.Coil winding Failure results irThe Rod Position by indicator Contact M fails shorted due to reduced current Indication System lights.

open.

insulation break-to the movable monitors position For shutdown down. Contacts.

coils of a group of all full length rods, Aux.

worn or corroded.

of rods during rods in or out of contacts from Aechanical failure rod stepping.

reactor core.

both contactorE in armature swit-This will cause The system activa-in either the ching mechanism..

erroneous steppingtes an annunciator SA or SB cabinet 3pen interconnect allowing the re-

"Rod Bottom Rod are connected 4ire to coil or lease of the rod Drop" and energize in series.

zontact terminal. group to drop in-a rod bottom in to reactor core.

icator light at If failure is re-he control board sult of coil fail o alert the oper ing closed, Con-tor.

tact B of contact-7or coil failure or will prevent I power indicator Master cycler light will remain from sequencing an.

group of rods.

Therefore no erroneous stepping will occur..

Sheet 11

REFR ING CIRCUIT FUNCTION

'E W Dwg. 915E637 Sheet 12,14,15 Control Rod Sequencing Ckt. III November 30?81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMRKS Movable coil Contact B fails Contact worn or Failure will pre-Master cycler Rod motion in Power Resistor open.

corroded.

vent master cycle-failure detector out direction Contactor.

from engaging will produce will be stop (Cont.)

clutch for sequ-alarm.

ped if system encing group of is.in auto rods. This re-mode.

sults in misa lignment of affec ted rods with other rods assign ed to same bank.

Sheet 12

ITFERENCE DRAWING 16,17 CIRCUIT FUNCTION W Dwg. 915E637 Sheet 10,11,14,15, 1Control Rod Sequencing Ckt. I,IIVVI; Shutdown Rod Sequencing Ckt. II November 30'8L METHDD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTB4 DETECTION REMARKS Stationary Coil Receives current Fails Open.

Contacts worn Same as failure Same as failure Contactors orders from or corroded.

of 1OOA stationar of 100A station CA-1C1,2SC2 slaye cycler cam Mechanical failure coil line fuse.

ary coil line CB-3SCl,4SC2 switches and in armature swit-(See Sheet 2) fuse.

CC-5SCl,6SC2 applies 125VDC ching mechanism.

(See Sheet 2)

CD-73C1,8SC2 power Coil winding open SA-lSSl,1sS2 across a group of due to insulation SB-2SS1,2SS2 stationary coils.

breakdown.

Contact M Open interconnect wire to coil or contact terminal.

Fails Closed.

Contacts fused.

Failure results A misaligned rod Possible fail Coil winding in stationary initiates sounding ure of stat shorted due to Gripper latches of a rod deviation ionary coil du insulation break-being constantly alarm by the RPIS to overheating down.

engaged with rod to alert operator if current is driveline pre-of failure.

continuously venting movement applied to of group of rods.

coil.

This results in misalignment of affected rods with other rods assigned to same bank.

Sheet 13

REFERENCE DRAWING CIRCUIT FUNCTION Contiol Rod Sequencing Ckt. I, II, V, VI; Shutdown E

W Dwg.

915E637 Sh. 10,11,14,15,16,17 Rod Sequencing Ckt. I, II November 30'81 MET1IOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSIT DETECTION REMARKS Movable Coil Receives current Fails open.

Contacts worn or Same as failure Same as failure Aux. contact Contactors orders from slave corroded.

of 100A movable of 100A movable on contactor CA-lMC1,2MC2 cycler cam Mechanical failure coil fuse.

coil fuse.

powers cycler CB-3MC1,4MC2 switches and in armature (See Sheet 3)

(See Sheet 3) removal indi CC-5MC1,6MC2 applies 125VDC switching mecha-cation relay.

CD-7MC1,8MC2 across movable nism.

There is a SA-lMS1,2MS2 coil.

Coil winding open possibility of SB-2MS1,2MS2 due to insulation only this Contact M breakdown.

contact fail Open interconnect ing open, wire to coil or which would contact terminal.

result in inaccurate information being displayed by indicator lights if cycler removal switches are closed.

Fails closed.

Contacts fused.

Failure results A misaligned rod Coil winding in movable initiates soundin shorted due to gripper latches of a rod deviatio insulation break-being constantly alarm by the RPISI down.

engaged with rod to alert operator driveline, pre-of failure.

venting movement of group of rods.

This results in misalignment of affected rods with other rods assigned to same bank.

REFERENCE URAWING CIRCUIT FUNCTION Control Rod Sequencing Ckt. I, II, V, VI; Shutdown W Dwg. 915E637 Sh. 10,11,14.15,16,17 Rod Sequencing Ckt. I, II November 3018'_

.o MET-OD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTM DETECTION REMARKS Lift Coil Receive current Fails open.

Contacts worn or Same as failure Same as failure Aux. contact Contactors orders from slave corroded.

of 150A lift of 150A lift on contactor cycler cam Mechanical failure coil line fuse.

coil line fuse.

powers step switches and in armature (See Sheet 4)

(See Sheet 4) counter.

CA-1LC1, 2LC2 applies 125VDC switching mecha-There is a CB-3LCl, 4LC2 across a group nism.

possibility of CC-5LCl, 6LC2 of lift coils.

Coil winding open only this CD-7LCl, 8LC2 due to insulation contact fail SA-1LS1, 1LS2 breakdown.

ing and SB-2LS1, 2LS2 Open interconnect resulting in wire to coil or a loss of rod contact terminal.

motion indi Contacts A & B cation via the step counter.

Fails closed.

Contacts fused.

Failure results A misaligned rod Possible fail Coil winding in lift coil initiates sounding ure of lift shorted due to being constantly of a rod devia-coil due to insulation break-energized, pre-tion alarm b* the overheating if down.

venting lift RPIS to alert current is coil assembly operator of failur continuously from stepping applied to rods. This coil.

results in mis alignment of Aux. contact affected rods on contactor with other rods powers step assigned to counter.

same bank.

There is a possibility of only this contact fail ing and re sulting in a loss of rod motion indica Sheet95

REFERENCE DRAWING CIRCUIT FUNCTION Contru1 Rod Sequencing Ckt. I, II, V, VI; shutdown W Dwg. 915E637 Sh. 10,11,14,15,16,17 Rod Sequencing Ckt. I, II November 30'81 METOD OF COMPONENT FUNCTION FAILURE MDDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REAARKS Lift Coil tion via the Contactors step counter.

For shutdown, step counters contacts from both contact ors in SA and SB cabinet must fail closeito lose step counter indication.

Sheet 16

REFERENCE DRAWING CIRCUIT FUNCTION

.or

'WE W Dwg. 915E637 Sh. 7,12 Control Rod Sequencing Ckt. III, Programming Ckt. II November 181 ME1IKIOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS

! Power Resistor Allows insertion Fails open.

Contacts worn or Failure results power indicator Time Delay Relays *of ! power resis-corroded.

in a loss of light for affected ter banks in Mechanical failure power to power rod group will CA-lTR1, 2TR2

'movable coil in armature resistor contact-turn off.

CB-3TRl, 4TR2 power circuitry switching mecha-ors 1CK1, etc.

CC-5TRl, 6TR2 during a period nism. Coil winding This will result CD-7TR1, 8TR2 of no rod motion.

open due to insu-in 1 power Five second lation breakdown. resistor bank time delay Open interconnect being bypassed allows completion wire to coil or during period of of rod step.

contact terminal. rod holding. No immediate effect on system opera tion. Possible failure,of movable coil 4ue to overheating.

Fails closed.

Contacts fused.

Failure results The rod position Coil winding in power re-indication system shorted due to sistor contactor monitors position insulation break-being unable to of all full length down.

shunt power rods in or out of resistor bank reactor core. The resulting in system activates reduced current an annunciator to movable coil "Rod Bottom Rod during rod step-Drop" and ener ping.

gizes a rod bottom This will cause indicator light at erroneous step-control board to ping allowing alert the operator.

the release of the rod group to power indicator drop into light for affected reactor core.

rod group will remain on.

Sheet 17

unlE REERENCEi DRAWING CIRCUIT FUCyOE W Dwg.

915E637 Sheet 7 Programming ikt. II November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Power Resistor Limits transient Fails Open.

Poor bonding of Degraded circuit Detection possi time delay relay voltages across die or electrode protection. No ble during rou snubber network.

master cycler contact causes immediate effect tine maintainence CA-lREC-1,2REC-2 output relays open junction.

on system opera-of cabinet.

3REC-1,4REC-2, K101 through tion. Possible 5REC-1,6REC-2, K108 Contact 10 -

degradation of 7REC-1,8REC-2

11.

relay contacts.

3A fuses-Provides power Opens prematurely.Material failure Same as ; power Same as power power resistor overload protec-of fuse element.

time delay relay time delay fail time delay relays tion for time Poor connection failing open.

ing open.

CA-FU-32,33 delay relay to fuse element.

(See Sheet 17).

(See Sheet 17).

CB-FU-32,33 coils.

Material failure CC-FU-32,33 of fuse contact CD-FU-32,33 (Clip or holder).

Sheet 18

REFERENCE uRAWING CIRCUIT FUNCTION W Dwg.

915E637 Control Rod Sequencing Ckt. III November 30'8l METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Step Counter Provides pulses Fails open or Contacts worn or Loss of step Step counter in-No effect on Relay Coil to step counters closed.

corroded.

counter informa-formation for rod motion.

for rod group Mechanical failure tion for a group other group lLCXl contact CA-lLCXl, 2LCX2 position infor-of armature of rods.

of rods in same B and 5LCX1 CB-3LCX1, 4LCX2 mation.

switching mecha-bank will indicate contact B pro CC-5LCXl, 6LCX2 nism. Coil winding correct position vide control CD-7bCX1, 8LCX2 open or shorted for bank.

rod position due to insulation information to breakdown.

P/A convertor.

Open interconnect P/A convertor wire to coil or provides rod contact terminal.

position infor Contacts fused.

mation to bank insertion monitor.

Sheet 19

REFERENCE 'AWING CIRCUIT FUNCTION Conti Rod Sequencing Ckt. I, II, IV; Shutdown W Dwg. 915E637 Sh. 10,11,13,16,17 Rod Sequencing Ckt. I, II Nomber 30'Ji METHOD OF COMPONET FUNCTION FAILURE MDDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Cycler Removal Energizes mova-Fails closed.

Contacts fused.

Failure results A misaligned rod Local indica Switches ble coil to Mechanical fail-in movable grip-initiates sounding tor lights prevent rod ure of switching per latches being of a rod deviatior turn on when YA-Sl,S2,S4,S5 drop if cam mechanism.

constantly alarm by the cycler removal YB-S6,S7,S8,S9 shaft on slave engaged with rod R P I S to alert switch is YA-S3 cycler switches driveline pre-operator Of closed.

It is has stalled.

venting movement failure.

likely that of group of rods.

failure would This results in be detected misalignment of before any affected rods attempt at rod with other rods motion is made assigned to same since switches bank.

are only used in maintenance, mode.

Cycler Removal Provides power Fails open.

Contacts worn or Loss of indica-Since this is a Relays to local indi-corroded.

tion that maintenance mode, cator light cycler has been detection can be Mechanical fail-rmvd aedrn YA-BE,BG,BI when cycler removed.

made during YB-BE,BG,BH,BI, removal switching maintenance BJ switches are period.

YA-BA,BB closed.

YB-BA,BB Coil winding open due to insulation breakdown.

Open interconnect wire to coil or contact terminal.

Shpes- ?n

REFERENCE uiRAWING CIRCUIT FUNCTION W Dwg.

915E637, Sht. 10,11,17 Control Rod Sequencing Ckt. I, I; Shutdown Rod Sequencing Ckt. I November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Command Control Prevents motion Fails open Contacts worn or Failure results i A misaligned rod These are N.C.

'Relay in control group corroded.

an open circuit initiates sound-contacts. If SLB-So Contact H if shutdown group Coil winding that blocks flow ing of a rod the contacts LB2-So Contacts

-is in motion and shorted due to of current to deviation alarm fail closed, F,G,H vice versa.

insulation break-lift coil contac-by the RPIS to then a simul LB2-SOXl Contacts down.

tor for group of alert the oper- -

taneous failure EL2, G rods. This ator of failure. in other LB2-COX2 Contacts results in erron-command contro.

EF eous stepping relays would during rod move-have to occur ment which before Control results in mis-and Shutdown alignment of rods are step affected rods ped together.

with other rods assigned to same bank.

Shee 72L.

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637, Sht. 10,11,16 Control Rod Sequencing Ckt. 1,11; Shutdown Rod Sequencing Ckt. I November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Cam Limit Switch Provides sequen-Contacts fail Contacts worn or Failure results See movable, YA-TM1,2,3,4 cing for rod open.

corroded.

in an open cir-stationary or YB-TM5,6,7,8 stepping via

)pen interconnect cuit that blocks lift contactor YA-SGC contactors.

wire to contact flow of current open circuit Contacts SO, SI, terminal.

to either the failure.

MO, MI, LO, LI Broken return stationarymovablE spring.

or lift contactor coils.

Contacts fail ontacts fused.

Failure results ir See movable, closed.

echanical failure either the statior-stationary or of cam element.

ary, movable or lift contactor lift contactor closed circuit coil being con-failure.

stantly energized.

Cam Shaft Assem-Assembly binds.

Failure results Failure of Cam Rod motion is bly failure.

Cam shaft breaks. in loss of switch to make stopped if sequencing in-full revolution system is in structions to con-results in Naster automode.

trol rod drive Cycler failure mechanisms for a detector opening group of rods.

contacts for This results in alarm interlock misalignment of on Control Board.

affected rods with other rods assigned to same bank.

Sheet 22

REFERENCL DRAWING CIRCUIT FUNCTION W Dwg. 915E637, Sht. 10,11,16

,Control Rod Sequencing Ckt. I, II; Shutdown Rod Sequencing Ckt. I November 30'81 M ETOD OF COMPONENT FUNCTION FAILURE VODE FAILURE MECHANISM EFFECT ON SYSTM DETECTION REMARKS Cam Limit Switch Snubber network Material failure Degraded circuit Detection possiblE High peak (Cont.)

failure.

of resistance protection. No. during routine voltage tran element. Poor immediate effect maintenance of sients due to connection to on system cabinet.

turning off resistance element.operation.

contactor Dielectric break-I coils will down. Poor accelerate connection to

• wear on Cam capacitor.

switch con tacts.

Sheet 23

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637, Sht. 10,11,16 Control Rod Sequencing Ckt. I, II; Shutdown Rod Sequencing Ckt. I November 30'81 METRIOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Command Control-Provides current Contact fails Contacts.worn or Failure results See movable, Relays path for Cam open.

corroded.

in an open cir-stationary, or LBl-CO Contacts switches for lift Open interconnect cuit that blocks lift contactor C,D,F,G,H

'movable, and wire to contact flow of current open circuit LBl-CI Contacts stationary con-terminal.

to either the failure.

C,D,F,G,H tactors.

stationary, (See Sheqt 13,14 LBl-COXl Contacts movable or lift 15).

A,B,E,F,G,B contactors.

LBl-CIXl Contacts A,B,E,F,G,B ABEFG Contact fails Contacts fused.

Failure results See movable, LBl-CIX3 Contact E

closed, in either the lift or station LB2-CO Contacts stationary, ary contactor CDEFG movable or lift closed circuit LB2-CI Contacts contactor being failure.

CDEFG energized out (See Sheet 13,14 LB2-COX,Contacts of sequence 15).

LB2-COX1 Contacts AB EFG, ping during rod LBl-SO Contact movement.

I 13, F, G LP!.-SI Contact Provides power Opens prematurely Material failure Failure results The Rod Position B,F,G overload pro-of fuse element.

in an open cir-Indication System tection to the Poor connection cuit that blocks monitors position stationary mova-to fuse element.

flow of current of all full Cam Switch Fuses-ble and lift Material failure to the movable length rods in FA contactor coils.

of fuse contact contactors for or out of the YA-FU-5,6 (clip or holder).

1/2 of the con-reactor core.

YB-FU-5,6 trol rods or all The system acti YA-FU-3,4 of the shutdown vates an annun rods. This will ciator "Rod cause loss of Bottom Rod Drop" holding current and energizes a during a period "Rod Bottom" of no demand for indicator light rod movement at the control allowing release board to alert of the rods to the operator.

• drop into the Sheet 24

REFERENCE DRAWING CIRCUIT FUNCTION SvE Dwg. 915E637 Sh.

8, 9Slave Cycler Motor Circuitry, Nvme 08 W Dwg. 915E637 Sh. 8, 9

!Programming Ckt. 111 November 30'81.

METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Intermittent Drive Connects motor to Motor does not lutch circuit See cam shaft See cam shaft Unit (clutch) cam switch to engage cam switch.Euse blown.

assembly failure, assembly failure.

sequence.rod lutch coil open (See Sheet 22).

(See Sheet 22).

YA-TM1,TM2,TM3,

-group i

TM4 zircuited.

TM4, YB-TM1,TM2,TM3, Snubber network ielectric break-Degraded circuit Detection possible TM4 failure.

lown.

Poor protection. No luring routine YA-FU9,10,12,13 zonnection to immediate effect naintenance.

YB-FU14,15,16,17 2apacitor.

on system opera tion.

Motor/Motor Start-Rotates cam Motor stops run-4otor starter See cam shaft See cam shaft er/Speed Reducer switch.

ning.

>verload trip.

assembly failure. assembly failure.

Speed reducer 4otor starter (See Sheet 22).

(See Sheet 22).

MTR-1,2,4,5,6 stops.

ieater element 7,8,9

aulty.

YA-MSlMS3 7aulty lubrication MS4,MS5

auses speed YB-MS7,MS7,MS8,

educer seizure.

MS9 Speed reducer Gear tooth Group of rods 3tep counter will slows down.

breaks.

sequenced by iot be pulsed at affected speed required rate.

reducer does not step at required rate.

Sheet 25

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sh.6 Programming Ckt. I November 30181 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Bank Overlap Provides for Contact All-B11 Contacts worn or Either DB or DC The Rod Position Cutout Switch selection of Bank fails open or oxidized.

relay will fail Indication System LA-O.C.

Overlap mode or contact A5-B5 Mechanical failure to energize at monitors the po single bank mode fails open when of switching proper time.

sition of all full of operation.

switch is in mechanism.

As a result of length rods in or overlap mode.

this there will out of reactor be no bank core. Affected operation signal bank will not to master cycler show rod motion and the affected in overlap bank will not region.

step when re quired.

Contact A6-B6 or Contacts fused.

Either DB or DC The Rod Position Al-B1 fails Aechanical failure relay will con-Indication System closed when of switching stantly be ener-nonitors the switch is in nechanism.

gized. As a position of all overlap mode.

result of this full length rods there will be a in or out of constant bank reactor core.

operation signal kffected bank will to the master show rod motion cycler and the when out of affected bank iverlap region.

will step when no motion is required.

Sheet 26

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sh. 6 Programming Ckt. I November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Bank 1 Operation Provides bank Coil fails open Coil winding open Same as failure Same as failure Relays operation signal when system is due to insulation of overlap cut-of overlap cut to master cycler in overlap mode. breakdown.

out switch con-out switch con LA-DB, DC Open interconnect tacts A5-B5 or tacts A5-B5 or wire to coil.

All-Bll failing All-B11 failing open.

open.

(See Sheet 26)

(See Sheet 26)

Coil fails Coil winding Same as failure Same as failure closed when sys-shorted due to of overlap cut-of overlap cut tem is in over-insulation break-out switch con-out switch con lap mode.

down.

tacts Al-Bl or tacts Al-B1 or A6-B6 failing A6-B6 failing closed.

closed.

(See Sheet 26)

(See Sheet 26)

Reset Relay Resets bank Fails open.

Contacts worn or Bank overlap Same as failure This relay LA-DR overlap counters corroded.

counters and of overlap cut-is energized and master Coil winding open master cycler out switch con-by a remote cycler.

due to insulation output relays tacts Al-Bl or switch on breakdown.

K101 thru K108 A6-B6 failing control board Open interconnect cannot be reset.

closed.

wire to coil or This could lead (See Sheet 26) contact terminal.

to erroneous bank stepping in the bank overlap mode during system startup.

Fails closed.

Contacts fused.

Master cycler A misaligned rod Coil winding counter circuit initiates sound shorted due to is constantly be-ing of a rod insulation break-ing reset. As a deviation alarm down.

result of this a by the RPIS to Reset switch on rod group will alert operator of control board step out of sequ-failure.

shorted.

ence with other rods in same bank resulting in rod Sheet 27

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sh. 6 Programming Circuitry I November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MDDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION R3MARKS Bank Overlap Provides in or Fails open.

Contacts worn or Counter BI coil The Rod Position If failure is Memory and Count out count signal corroded.

in bank overlap Indication System due to cam Circuit Relays to bank overlap Coil winding open control assembly monitors the switch fail assemblies, due to insulation will not receive position of all ure then LA-LRl,2,5,8 breakdown.

"add" or "sub-full length rods failure detect LA-LM1,2,3,4 Open interconnect tract" signals.

in or out 'of or in master LA-LE1,2 wire to coil or This will result reactor core.

cycler will contact terminal. in control banks The affected bank stop rod mo Cam switch TM1-4, not following will show rod tion in out 5, 8 contact LRA bank overlap motion when out of direction if fails open.

program.

overlap region.

system is in auto mode.

Fails closed.

Contacts fused.

Possibility of Same as above.

Same as above.

Coil winding erroneous "add" shorted due to or "subtract" insulation break-signal to counter down of cam Bl in bank over switch TM1-4, 5, lap control 8 contact LRA assembly. This failing closed.

will result in control banks not following bank overlap program.

Sheet 28

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sht. 6 Programming Circuitry I November 30'81 992D217 ght 1

METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Bank 1 (or 2)

Overiap Control Assembly Relay RE1

'Provides circuit Fails open or Contacts worn or Bank 2 Operation The Rod Position path for ADD coil closed when sys-corroded. Coil Relay DC (or Bank Indication System of counter Bl.

tem is in bank winding open due 1 Operation Relay monitors the po (contact 1-3) overlap mode.

to insulation DE) will not be sition of all full Provide circuit breakdown. Open energized at length rods in or path to energize interconnect proper time which out of reactor memory relay RE3X wire to coil or will result in core. The affectel when counter set-contact terminal. control bank 1 bank will show no point is reached.

Contacts fused.

(or 2) not rod motion in the (contact 6-7)

Coil winding following bank overlap region.

shorted due to.

overlap program.

insulation break down.

Relay RE2 Provides circuit Fails open or Same as above.

Same as above.

Same as above.

path for subtract closed when sys coil of counter tem is in bank B1 (contact 1-3). overlap mode.

Provides circuit path to energize memory relay RE3X when counter is above setpoin.

Relay RE3 Provides circuit Fails open when ontacts worn or Same as above.

Same as above.

RE3X path to energize system is in bank orroded.

memory relay RE3X overlap mode.

oil winding open ue to insulation reakdown.

pen interconnect wire to coil.

Sheet 29

REFERENCL.AWING CIRCUIT FUNCTION W Dwg. 9 3

6Programming Circuitry I November 30'1 METHOD OF COMPNENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTBM DETECTION REMARKS Relay RE3, RE3X Fails closed Contacts fused.

Bank 2 (or 1)

The affected (cont.)

when system is Coil winding operation relay bank will show in bank overlap shorted due to DC (or D8) will rod motion when mode.

Insulation break-be constantly out of the over down.

energized. This lap region.

will result in control bank 2 (or 1) not fol lowing overlap program.

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sht.6; 992D217 Sht.1 Programming Circuitry I November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Bank 1 (or 2)

Overlap Control Assembly Thumbwheel Switch Provides overlap ontact fails open Mechanical failure Failure results The Rod Position Sl-(1),(l0),(l0O) set-points for 3r closed when sys of switch.

in wrong set-poinTIndication System overlap Assembly. is in bank overlap being used which monitors the node.

will result in position of all control bank 2 full length rods (or 1) not, in or out of following bank.

reactor core.

Overlap program. The affected bank will either show rod motion when out of overlap region or show no rod motion when in the over lap region.

AC-DC Convertor Provides 96VDC Loss of power 3pen circuit in Failure results ir Same as abohe.

PS1 power source for supply voltage NC transformer.

"ADD" or "SUBTRACT" counter Bl.

when system is in Failure in regu-signals not being bank overlap mode.lation circuit.

recorded which will result in control bank 2 (or 1) not follow ing overlap program.

Fuse Fl-3A rovides power Opens prematurely 4aterial failure o:Failure results inthe Rod Position verload protectioiwhen system is in 7use element. Poolloss of power to Endication System o relays RE1,RE2, bank overlap mode. onnection to fuse relay RE3X which nonitors the pos

[E3,

.lement.

Material will-prevent con-Ltion of All full ailure of fuse trol Bank 2.(or 1)Length rods in or

ontact (clip or from stepping when ut of reactor core.

iolder).

he affected bank Sheet 31

REFERENL WIRAWING Sheet 2 CIRCUIT FUNCTION W Dwg. 915E637 Sheet 6 992D217 Programming Ckt. I Novembcr 30'81 METHOD OF COMPONFETr FUNCTION FAILURE M)DE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Fuse Fi-3A called for.

will show no rod (Cont.)

motion in the overlap region.

S 3I Sheet 32

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 8 Programming Ckt. III Novemb30r 0

METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Cycler Fault Provides fault Contact fails Contacts worn or Master cycler Rod group associat Rod motion in Detection Switche *indication for open or closed.

corroded.

will produce fals ed with faulty out direction TM1 thru TM8 Master Cycler.

Open interconnect alarm signal, switch will step will stop if Switch MRCL wire to contact.

normally when system is in Terminal contacts system isin auto mode.

fused.

manual mode.

Carry Over Cam Interupts power Fails open.

Contacts worn or Failure results Failure of cam Same as above.

TM1 thru TM7 to clutch in be-corroded.

in clutch failing switch to leave Switch COC tween sequencing Open interconnect to engage motor to home position re periods.

wire to contact cam switch which sults in master terminal.

results in the cycler failure loss of sequencing detector opening instructions to a contacts for alarm group of rods.

interlock on This will cause a control board.

misalignment of affected rods with other rods assign ed to same bank.

Sheet 33

REIERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet. 2 Command Control Ckt. I November 30'81 METHOD OF COMPONEW FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Directional Time Energizes direc-Fails Open.

Contacts worn or Directional relayE Total loss of rod Delay Relays tional relays corroded.

(either Out or In,.motion in either LBl-TDO LBl-CO or LBl-CI.

Coil winding open will fail to the in or out LB2-TDI

'Time delay on de-due to insulation energize resultinf direction.

energization to reakdown.

in no rod motion ensure that Open interconnect when it is called directional re-wire to coil or for.

lays are held contact terminal.

in long enough for slave cycler to initiate Fails Closed.

Contacts fused.

Directional relays Same as above.

rotation.

"oil winding (for either Out or shorted due to In motion) will insulation break-only permit rod lown.

motion in one direction.

Timer failure.

echanical failure Possibility of The Rod Position f timer directional relays Indication System nechanism.

being de-energized will activade before slave cycle:"Rod Bottom initiates rotation Rod Drop" alarm This could result annunciator at in a group of rods the control board dropping into Reactor Core.

Sheet 34

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 2 Command Control Ckt. I November 30'81 METHOD OF COMPONEW FUNCTION FAILURE MDDE FAILURE MECH1ANISM EFFECT ON SYSTEM DETECTION REMARKS Directional Provides power for Coil fails open Coil winding open Failure results.

Total loss of rod Failures relate Relays Aux. Directional contact B fails due to insulation in loss of power motion in one to contacts LBl-CO relays and to open.

breakdown.

to Aux. Direction direction.

associated with (or LBl-CI) various cam switch Open interconnect al Relays. This "AM switches es wire to coil or will prevent rod are covered on.

contact terminal. motion in the Sheet 21.

Contact worn or out direction.

corroded.

(or in direction)

Coil fails closed.Contacts fused.

Failure results i Same as above.

Contact B fails Coil winding short-one set of Aux.

closed.

ed due to in-Directional Re sulation break-lays being con down.

stantly energized which results in rod motion being permitted in one direction only.

Contact A fails ontact worn or Failure results in A misaligned rod open.

corroded.

Memory Path from initiates sound pen interconnect cam switch Index ing of the Rod wire to contact.

"A" opening. This deviation alarm will result in by the R P I S Directional Relays For being.de-energized dropped rods the before cam sequenceRod Position is completed. This Indication System could lead to rods will activate misstepping or to "Rod Bottom dropped rods.

Rod Drop" alarm annunciator at the control board Sheet 35

REFERENCE uRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 2 6Command Control Ckt. 1 November 0

METHOD01 OF COMPONENT FUNCTION FAILURE NDDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Aux. Directional Contacts for these Relays Aux. Directional LBl-COX1,CIX1 Relay provide pow LB2-CO,CI er to various CAM LB2-COX1,CIX1 switches.

Failures related to these relays are covered on Sheet 21.

Aux. Directional Removes shutdown Coil fails shorte& Coil winding Failure results Total loss of Relay cam switch when Contacts fail oper shorted due to in open circuit movement for shut LB-COX2 control rods are insulation break-path to shutdown down rods.

being sequenced to down.

rod lift contact prevent inadver-Contacts worn or. This will tent movement of or corroded.

prevent shutdown shutdown rods.

rod motion.

Aux. Directional rovides direction R, ay ignal to step LA-COX1,CIX1 ounters on contro board. No effect Dn rod motion.

Sheet 36

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 2 Command Control Ckt. 1 November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Aux. Directional Provides circuit Fails open.

Contacts worn or

)A relay failing t Total loss of or failures re Relay path for Pulser corroded.

anergize results rod motion in one ated to con LA-COX2,CIX2 Control Relay DA.

Open interconnect in no shift Pulse direction.

acts connected Provide circuit wire to coil or to master cycler.

o RE1 and RE2 path for relays contact terminal. Fhis will prevent n bank overlap RE1 and RE2 in Coil winding open cod motion.

ontrol assem bank overlap due to insulation lies see fail control assemblies breakdown.

res for RE1 r RE2 on heet 29.

Fails Closed.

Contacts fused.

)A relay constantl) Rods will be Coil winding nergized resulting stepping in dir shorted due to

[n constant shift ection oppositetc insulation break- 'ulse to master what is shown by down.

ycler. This will direction indica esult in system tor light.

tepping rods in Irong direction.for a few steps when a change of direc tion is called for.

Aux. Directional Irovides circuit Relay

>ath for Relays in LA-COX3,CIX3

,ank memory and 3verlap count ircuit. Failures would produce 2ffects similar to

[ailures for re Lays A-LR1,2,5,8 A-LM1,2,3,4 (See Sheet 28)

Sheet 37

RFERENCE DRAWING CIRCUIT FUNCTION ATE W Dwg. 915E637 Sheet 2 Command Contrb1 Ckt. 1 November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTIM DETECTION REMARKS Aux. Direction Provides out dir- "oil fails open Open interconnect Failure results Step counters Relay ection or in Contact Al fails wire to coil or in master cycler located on control LA-COX4 direction signal closed.

contact A2 ter-constantly re-board will dis to Master Cycler. "ontact A2 fails minal.

ceiving In signal play two'step

pen.

Coil winding open This would result differende for due to insulation in Group 1 and affected rod group breakdown.

Group 5 rods (or and other rod Contact Al fused. Group 2-6, 3-7, groups in same 4-8) becoming bank.

separated from other rod groups in same bank by two steps when a change in direc tion is called foi.

Coil fails shorted Coil winding

.-Failure results Same as above.

Contact Al fails shorted due to in master cycler open.

insulation break-constantly re Contact A2 fails down. Contact Al ceiving out signal.

closed.

orn or corroded. This would result 3pen interconnect in Group 1 and wire to contact Group 5 rods (or 41 terminal.

Group 2-6, 3-7, Contact A2 fused. 4-8) becoming separated from other rod groups in same bank by two steps when a change in direc tion is called for.

REFERENCE DRAWING CIRCUIT FUNCTION

,T W Dwg. 915E637 Programming p t. II

_November 308 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSEB DETECTION REMARKS Pulser Control Provides circuit Fails Open.

Open interconnect Failure results There will be a Relays path to relay K2 wire to coil or in Pulser not loss of rod move LA-DA, DAX in Pulser Assembly contact terminal. sending shift ment with the In which initiates Contact worn or pulse to master Directiod or Out shift pulse to corroded.

cycler when rod Direction lights master cycler.

Coil winding open motion is called on control board due to insulation for. This will turned on.

breakdown.

result in system not stepping rods when requir ed.

Fails Closed.

Coil winding Failure results i Power Indication shorted due to Pulser continuous-lights on control insulation break-ly sending shift board will turn down. Contacts pulse to master off during period fused.

cycler when no of no rod movement.

rod motion is called for. Mas ter cycler will engage clutch for slave cyclers.

Rods will not step since circuit patt to lift contactors thru Aux. Relay contact will not be closed.

Sheet 39

REFERENCE DRAWING CIRCUIT FUNCTON uATE November 30'81 W Dwg. 915E637 Sheet 7 Programmine Ckt. II November_3081 MEH11OD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION IUMARKS 28 VDC Power Provides power for Loss of power.

Transformer fail-Relay K2 will failThe In direction Supply relay K2 in pulser ure.

to energize on or Out direction

.assembly.

Failure in signal from DAX lights on control Rectifier circuit. relay.

Shift board will be pulse will not bE turned od. How sent to master ever, there will cycler when rod be no rod motion.

motion is called for. This will result in system not stepping rods when required.

LA-REC 10 rovides feedback Fails Open.

?oor bonding of Failure could re-od position as path to +28 VDC ie or electrode sult in Master isplayed by step side of DAX relay.

zontact causes Cycle:output re-ounters will be This ensures that

pen junction.

lays not being out of sequence AX relay is held Interconnect wire given enough time by one step for on for full pulse to diode open.

to energize. Upon affected rod group width.

receipt of next shift pulse the Master Cycler will change state to pick up next rod group without slave cycler engagement of the previous subgroup ever having occurred.

Sheet 40

.2auATE REFERENCE DRAWING CIRCUIT FJNCTON W Dwg. 915E637 Sheet 2 Command Conto1 Ckt. I METHOD OF COMPONENT FUNCTION FAILURE MDDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Cam Switch Index Provides memory Contact fails oper Contact worn or Failure will re-(See Sheets 34-38)

A path to relay corroded sult in Direction TM1 thru TM8 LBl-TDO (or LBl-Open interconnect al relays de-ener Contact 7 TDI) if Direction-wire.to contact. gizing prematurel3 al signal is re-if rod motion moved to assure signal (Rods In that last cycle or Rods Out) is has completed its removed during required shaft cycle period.

rotation.

This could result in symptoms simil ar to failures for directional re lays.

(See Sheets 34-38 Contact fails ontact fused.

Failure will pre-Rods will only closed.

4echanical failure vent Directional step in one dir 3f cam element.

Relays from drop-ection despite ing out when direction of rod Directional signal motion signal.

is removed. This If failure is Rod motion in will then cause due to cam shaft out direction rods to move in assembly failure will stop if one direction the master cycler system is in whether Rods failure detector automode.

In signal or Rods will open con Out signal is tacts for alarm applied to system. interlock on control board.

Sheet 41

REFERENCE DRAWING CIRCUIT FUNCT ON TE W Dwg. 915E637 Sheet 2 Command Contirpl Ckt. 1.

November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMRKS 480V/120V Trans-Provides AC power Loss of Power.

Material failure Failure results Total loss of rod former to control Buss.

of winding wire.

in loss of rod motion. ! power UA-T1 Poor connection movement when indicator lights to primary-or required.

will turd off.

secondary winding.

termination.

Voltrap Provides over-Fails short.

Bulk defect in Failure will re-Same as above.

UA-VR-25 power protection selenium layer sult in UA-T1 to control buss.

causes device shor:.transformer Surface defect in failure.

barrier layer causes device short.

Directional Relay Provides power ove7-Opens Pre-aterial failure Failure results. Same as above.

Fuses -

10A load protection

maturely, f fuse element.

in loss of rod YA-FU-1,2 to Directional oor connection to movement when Relays and other fuse element.

required.

control circuitry.

laterial failure af fuse contact (clip or holder)

IATE REFERENCE DRAWING CIRCUIT FUNCION W Dwg. 915E637 Sheet 3 Command Contrbl Ckt. II November 30'8L METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Shutdown Rod Provides circuit Fails Open.

Coil winding open Failure results.

Total loss of shut Directional Relay path to shutdown due to insulation in open circuit down rod movement.

LBl-SO cycler cam switch, breakdown. Open path to SGC cam (or LBl-SI) memory path for interconnect wire switch. This wil Index A, blocks to coil or contact prevent motion of lift circuit for terminal.

shutdown rods.

control cam switch TM1 when shutdown Fails Closed.

oil winding shor-No effect on rod Direction Indica rods are in motion.

ted due to insu-motion.

tion light on lation breakdown.

control board will be turned on durin period of no rod motion.

Shutdown Rod Provides circuit Fails open.

Coil winding-open Failure results irDirection Indica Directional Relay path to carry over (contact D) ue to insulatior; open circuit path tion light on LB-2-SO cam relay CC, ireakdown. Open to relay LBl-CC.

control board will (or LB2-SI) blocks lift cir-interconnect wire This will prevent turn on but there cuit for control to coil or contact motion of shut-ill be no rod cam switch TM2 thr terminal. Contact down rods.

otion.

rM5.

orn or corroded.

Fails Closed.

ontacts fused.

Failure results ir power indicates (contact D)

Coil winding in cycler clutch light will turn horted due to being energized tff during period nsulation break-when no rod motio f no rod motion.

.own.

is required.

The lift circuit for the SGC cam switch will remain open. Therefore, there will be no rod motion.

ukTE REFERENCE DRAWING CIRCUIT FUNCT~rON W Dwg.

915E637 Sheet 3

!Command Conttol Ckt. II November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Shutdown Direc-Blocks lift cir-Contact fails Contact worn or tional Relay cuit for control

Open, corroded.

LB2-SOX1 cam Switch TM-6 Open interconnect thru TM-8 when wire to contact.

shutdown rods are in motion.

Failure of this relay would not affect rod motion since a simultaneo s failure would have to occur in the Group Selec tion switch for control rods to move.

Shutdown cam Provides memory Contact fails oper. Contact worn or Failure will resull (See Sheet 43)

Switch Index A path to relay corroded.

in shutdown rod X: contact 7 LBl-SO (or LBl Open interconnec: Directional Rela3 SI) if direc-wire to contact.

de-energizing tional prematurely if signal is removed rod motion signal to assure that is removed dur cycler has com-ing cycle period.

pleted its re-This could result quired shaft ro-in symptons tation.

similar to fail ures for shut down directional relays.

(See Sheet 43)

Shppt 44

REFERENCE DRAWING CIRCUIT FUN ON W Dwg. 915E637 Sheet 3 Command Contr 1 Ckt. II November 30'81 MERID OF COMPONET FUNCTION FAILURE NO)DE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Shutdown CAM Contact fails Contact fused.

Failure will pre-Rods will con switch Index A closed.

Mechanical fail-vent shutdown tinue to move SGC Contact 7 ure of. cam element. Directional re-when no motion (Continued.)

lays from drop-is called for.

ping out when directional signal is re moved. The shut down rods will continue to step Carry Over Cam Provides circuit Fails Open.

Coil winding open This will result There will be a Relay CC path for cycler due to insulation in open circuit loss of shutdown clutch circuit.

breakdown.

to shutdown cycle Rod movement with Contact worn clutch. This wil the In direction or corroded.

result in system or Out direction Open interconnect not stepping light on control wire to coil or shutdown rods board turned on.

contact terminal. when required.

Fails closed.

Coil winding Failure will re- ! power indication shorted due to sult in cycler light will blink insulation break-clutch being en-on and off during down.

ergized when no period of no rod Contacts fused.

rod motion is re-motion.

quired. The lift circuit for the SGC CAM switch will remain open.

Therefore, there will be no rod motion.

REFERENCE DRAWING.

CIRCUIT FUNCTrON uATE W Dwg.

915E637 Sheet 16 Shutdown Rod!'Sequencing Ckt. I November 30'81 METIOD OF COMPONENT FUNCTION FAILURE MDDE FAILURE MEGIANISM EFFECT ON SYSTEM DETECTION REMARKS Intermittent Driv Connects motor Motor does not Clutch circuit Failure results Shutdown Bank Unit (Clutch) to SGC cam engage cam switch fuse blown.

in loss of sequ-does not step YA-SGC switch to sequ-Clutch coil open encing instruc-when required.

ence shutdown circuited.

tions to shutdown rod bank.

contact This will result in loss of rod motior for shutdown bank Snubber network Dielectric break-Degraded circuit Detection possible failure.

down. Poor con-protection. No during routine nection to immediate effect maintenance.

capacitor.

on system oper ation.

Motor/Motor Start-Rotates SGC Motor stops Motor starter Same as failure Same as failure er/Speed reducer cam switch.

running.

overload trip.

of intermittent of intermitent MTR-3 Speed reducer Motor starter drive unit above. drive unit above.

^1-MSS stops.

heater element faulty.

Faulty lubrica tion causes speed reducer seizure.

Speed reducer Gear tooth Shutdown bank Step counter will slows down.

breaks, does not step at not be pulsed at required rate.

required rate..

Shppt 46

REFERENCE DRAWING CIRCUIT FUNCTION W Dwg. 915E637 Sheet 16 Shutdown Rod'Sequencing Ckt. I November 30' METHOD OF COMPONENI' FUNCTION FAILURE MNDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Shutdown Group Provides for sel-Coil fails open. Coil winding open Failure results.

Total loss of rod selection relays action of shut-Contact B fails due to insulation in loss of rod motion for select SA-lGl, 2G1 down banks 1 or 2. open.

breakdown.

motion for selec-ed bank.

Fuses -

10A Fuse opens Open interconnect ted shutdown Opposite bank will YA-FU7,FU8 prematurely.

wire to coil or bank.

operate normally.

contact.

Contact worn or corroded.

,oil shorted

. Coil winding short Failure results irn Power Indicator

'ontact B fails ed due to insula-open circuit path light for bank in

osed.

tion breakdown.

to opposite shut-which failure Contact fused.

down bank selec-ocurred will re tion relay. This main off when no will result in shutdown rod mo loss of rod motiortion is called for opposite shut-for.

down bank when required.

Contact C or Contact worn or Failure results i The Rod Position D fails open, corroded.

open circuit to Indication System

)pen interconnect movable or sta-notiors position wire to contact.

tionary gripper of all full length contactor during rods in or out of period of rod reactor core. The motion resulting system activates in shutdown bank an annunciator released and drop- "Rod Bottom, Rod ped into reactor

)rop" and activate; core.

a "Rod Bottom" indicator light at zontrol board to alert operatoT.

-LwTE REFERENCE DRAWING CIRCUIT FUNCTIION W Dwg. 915E637 Sheet 16 Shutdown Rod;equencing Ckt. I

____---------O-F_

November 30'82 METTI!OD OF COMPONENT FUNCTION FAILURE WDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Contact A fails Contact worn or Failure results in Total loss of

open, corroded.

open circuit to

.rod motion for Open interconnect lift coil.contact-selected,shutdown wire to contact.

or during period bank.

of rod motion resulting in a loss of rod motion for selected shutdown bank.

Shutdown Group Provides for sel-Contact H fails Contact worn or Failure results in Same as contact C Selection Relays ection of shutdown open.

corroded.

open circuit to or D failing open.

SA-IGi, 2G1 banks 1 or 2.

Open interconnect movable gripper (See above).

wire to contact. contactor which results in loss of holding power to selected shut down bank during Period of no rod motion. This will cause the shutdown rod bank to fall into reactor core.

Contact G fails Contact worn or Failure results in Same as contact A open.

corroded.

open circuit to failing open.

Open interconnect shutdown selection (See above).

wire to contact. relay which re sults in loss of rod motion for selected shutdown bank.

Sheet 48

uATE REFERENCE DRAWING CIRCUIT FUNCTON W Dwg.

915E637 Sheet 16 Shutdown Rod Sequencing Ckt. I November 30'.1 MEITOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Shutdown Group Opens lift circuit Coil fails open. Coil winding open o effect on rod Detection possible Selection Relays to opposite shut-Contact fails due to insulation otion. A simul-during routine SA-lGX1, 1GX2 down bank to pre-closed.

breakdown.

aneous failure in maintenance.

vent inadvertant Open interconnect elays SA-lG1 or rod motion.

wire to coil.

Gl would have to Contact fused.

accur to affect rod motion.

Coil fails closed.Coil winding 7ailure results in Total loss of Contact fails shorted due to

)pen circuit to.

motion for select open.

insulation break-Lift contactor of ed shutdown bank.

down.

>pposite shutdown Direction indica ontact worn or ank resulting in tion light on con corroded.

oss of rod move-trol board will 3pen interconnect tent for affected remain on, aire to contact. ' bank.

Cam Switch Provides memory Contact fails open Contact worn or Failure will re-(See Sheets 47-48 Index A path to selection corroded.

sult in selection SGG contact 8 relays Open interconnect relays de-energiz SA-1G1, 2G1. if wire to contact.

ing prematurely

. irectional signal if rod motion is removed to signal is removed assure that cycler during cycle ias completed its period.

This equired shaft could result in otation.

symptons similar to failures for selection relays.

(See Sheets 47-78)

Shpot 49

dATE REFERENCE DRAWING CIRCUIT FUNCTON A

W Dwg.

915E637 Sheet 16 Shutdown Rod;$equencing Ckt. I November 30'81 METH-OD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Cam Switch Index Contact fails Contact fused Failure will pre-1 Power Indicator A

closed.

mechanical Fail-vent selection re-light for affectel SGC contact 8 ure of cam lays from droppinE bank will remain (continued) element.

out when direc-off during period tional signal is of rod holding.

removed. Relay will remain locke up until bank selector switch iE rotated. No effect on rod mot ion unless a simultaneous fail ure occurs in bank selector switch.

Sheet 50

REFERENC

)RAWING CIRCUIT FUNCTION

'WE SDwg.915E637 Sheet 7 Programming Ckt.

II November 30'81 METHOD OF COMPONE' FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Pulser Assembly Converts signal Fails Open Coil winding open Failure results it Error detection Rod motion in Relay Kl from Pulser con-due to insulation shift pulse not circuitry in out direction trol relays DA, breakdown.

terminating.

master cycler will be in DAX to pulse trai Contacts worn or will provide hibited if by using feedback corroded.

This will prevent alarm for an un-system is in signal from mas-Open interconnect master cycler trminatyd shift auto mode.

ter cycler to wire to coil or counter circuit pulse.

control integrato contact.

from sequencing circuit in pulser Transistor Q2 rod group in assembly.

collector Emitter proper order.

junction fails open.Transistor Ql collector Emitter junction fails jcsetiode CR7s Failure results Total loss of closed.Diode CR7 in loss of shift rod motion with osis o n

volpulse to master the in direction fomsPs or vo e

cycler. This or out direction from PS1 or PS2. will prevent sys-indicator light tem from stepping on control board Fails closed.

Coil winding rods. Failure turned on.

shorted due to results in pulser continuously insulation break-coninuosly down.sending shift dont fpulse to master Contact fused.

cce hnn ransisor Q2 cycler when no Transistor Q2 romtins rod motion is collector Emitter called fo. Master junction fails closed.

cycler will engage clutch for slave Transitor Ql cyclers..Rods collector Emitter cylers. Rods will not step junction fails since circuit open.

path to lift con tactor thru aux.

control relay contact will not be closed.

Sheet 51

REFERENC

'RAWING CIRCUIT FUNCTION E

W Dwg. 915E637 Sheet 7 Programming Ckt.

I3 939F055 Sheet 1 Novemberg30tI1 METHOD OF COMPONE'r7 FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Pulser Assembly Energizes relay Fails open.

Coil winding open Failure results There will be a Relay K2 Kl via contacts due to insulation in Pulser not loss of rod mo from relay K109 breakdown. Contact sending shift tion with the in

,in Master cycler.

worn or corroded. pulses to master direction or out Open interconnect cycler when rod direction indic wire to coil or motion is called ator light on contact.

for. This will control board result in system turned on.

not stepping rods when required.

Fails closed.

Coil winding Failure results Power indicator

.shorted due to in Pulser con-lights on con insulation break-tinuously sending trol board will down. Contacts shift pulses to turn off during fused.

master cycler period of no rod when no rod mo-movement.

tion is called for. Master cycler will en gage clutch for slave cyclers.

Rods will not step since circui path to lift con tactors thru Aux.

Control relay contact will.not be closed.

Sheet 52

REFERENPC

)RAWING CIRCUIT FUNCTION E

W Dwg.*91E637 Sheet 7 Programming Ckt. II 939FO55 Sheet 1 November 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION RM1ARKS Pulser Assembly Transforms cur-Pulse rate exceeds Failure of refer-Failure results it Step counters on Integrator/Ampli-rent level from input required by ence diodes CR1 pulse rate to control board fier circuit Foxboro signal reactor control or CR2 master cycler will not be Gl, G2 in Reactor Con-system.

Resistor R3 that exceeds rate stepped at re trol system to or R8 shorts required by reac-quired rate.

pulse rate that tor control sys is linearly tem. Maximum related to the stepping rate wil.

input current.

be limited to 40 steps per minute which is the maximum speed of motors in slave cycler circuits.

Sheet 53

REFEREN DRAWING CIR CUIT FUNCION 07E W Dwg. 9i5E637 Sheet 7,8 Programming Ckt. 11, 111 942NO61 Sheet 1

November 30'811 MEITHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Master cycler Provides circuit 'Fails open.

Coil winding open Failure result in A misaligned rod Assembly paths to slave due to insulation open circuit path initiates sound Output Relays cycler clutch breakdown.

to slave cycler ing of a rod de K101 thru K108 circuit, fault Open interconnect clutch for group viation liarm detection circuit wire to coil or of rods energized by the -RPIS to and ! power time contact terminal. by affected relay alert operator of delay relays.

Contact worn or This will cause failure.

corroded.

loss of rod Diode CR127-CR130, motion for one CR133-CR136, CR group of rods 139-CR142, CR145-resulting in CR148 misalignment of fails open, affected rod wit.

Relay Driver other rods CD111 or CD112 assigned to same fails open.

bank.

Fails closed.

Coil winding shor-Failure results Same as above.

ted due to insul-in slave cycler ation breakdown.

clutch for Contacts fused.

affected relay Diode CR126, CR131,being constantly CR132,,CR137, energized. This CR138, CR143, will cause rod CR144, or CR149 group to step out fails short.

of sequence re sulting in mis alignment of.

affected rods with other rods assigned to same bank.

Sheet 54

REFERENC RAWING CIRCUIT FUNCTION E

W Dwg. 91E637 Sheet 7,8 Q421061 Sheet 1 Programming Ckt. IIIv3 METHOD OF COMPONENT FUNCTION FAILURE DJDE FAILURE MECHANISM EFFECT ON SYSTE DETECTION RBRARKS Master cycler Provides signals Gate fails high o Transistor collec Failure results A misaligned rod Assembly to energize low.

tor emitter junc-in wrong signals initiates sound Counter circuit Master cycler tion fails open being sent to ing of a rod de CD101-1 output relays or closed.

decoder circuit viation alarm CD102-3,4,5,6,7,8 in proper sequ-Diode fails open resulting in by the RPIS to CD103-1,2,3,4 ence or closed.

master cycler alert operator of CD104-1,2,3,4 Open interconnect output relays be failure.

CD104-5,6,7,8 wire to logic ing energized CD105-1,2,3,4 card.

out of sequence.

Loss of supply This will cause and bias voltages. rod group to step out of sequence result ing in misalign ment of affected rods with other rods assigned to same bank.

Sheet 55

REFERENC

)RAWING CIRCUIT FUNTIO W Dwg. 915E637 Sheet 7,8 Programming Ckt. II, III 9421061 Sheet 1 PNovember 30'81 METHOD OF COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSITE DETECTION RBARKS Master cycler Decodes signals Nand gate fails Diffusion defect Failure results Loss of rod assembly from master cycle high.

in element in master cycler motion in one Decoder Circuit.

in and out counte junction.

Ele-output relay fail direction for a CD-106-3,7 and energizes ment junction ing to turn on fo group of rods.

CD-107-3,7 appropriate mas-breakdown due to rod motion if the Rod group will CD-106-4,8 ter cycler output switching transi-failure is in gat 1become misaligned CD-107-4,8 relay.

ent.

3 or 7, or fail-with other rods ing to turn on fo in same bank.

rod motion in the in direction if the failure is. in gate 4 or 8. Thi; results in loss of rod motion in either the in or out direction for a group of rods.

Nand gate fails Loss of supply Failure results See Sheet 57.

low.

and bias voltages. in gates CD-106 Poor lead bonding 5, 106-6, 107-5, to metallization or 107-6 remain pad of junction ing high.

See element or to failure of CD106 package terminal 5,6 -

CD107-5,6 post. Bulk defect on sheet 57.

in silicon substr ate material.

Sheet 56

REFEREN DRAWING CIRCUIT FUNCTION TE W D 2g 915E637 Sht. 7,8 Programming Ckt. II, III November 30'811 942Hp#

h-1 METH-OD OF COMPONENT FUNCT ION FAILRE MDDE FAILURE MECHANISM EFFECT ON SYSTEM DETECTION REMARKS Master Cycler Decodes signals Nand gate fails Diffusion defect Failure results A misaligned rod assembly decoder from master high.

in element junc-in slave cycler initiates sound circuit cycler in and out tion.Element jun-clutch being ing of a rod de CD106-5,6 counter circuit ction breakdown constantly ener-viation alarm by CD107-5,6 and energizes due to switching gized thru master the R P I S appropriate master transient.

cycler output re-tqalert perator cycler output re-lay powered by of failure.

lay.

affected gate.

This will cause rod group to step out of sequenc.e resulting in mis alignment of affected rods with other rods assigned to same bank.

Nand gate fails Loss of supply Failure results Same as above.

low.

and bias voltages. in open circuit Poor lead bond-path to slave ing to metalliaa-cycler clutch tion pad of junc- 'for group of rods tion element or energized thru to package ter-master cycler out minal post.

put relay powered Bulk defect in by affected gate.

silicon substrate This will cause material.

loss of rod motioi for one group of rods resulting in misalignment of affected rods with other rods assigned to same bank.

Sheet 57

REFER I

Ieet 7,C8 IRCUIT FUNCTION lATE W Dwg. 9424061 Sheet 1 Programming Ckt. II, III

'9' 42401 Shet 1November 30'8 COMPONENT FUNCTION FAILURE MODE FAILURE MECHANISM EFFECT ON SYSTEM DMETCDION REMARKS Master cycler Interfaces with Fails open.

Coil winding open Failure results Error detection assembly relay Kl in due to insulation in unterminated circuitry in relay K109 pulser assembly breakdown.

shift pulse.

master cycler to terminate Contact worn or This will prevent will provide ala shift pulse.

corroded.

Inter-system from step-for an unterminat Provides +28 VDC connect wire to ping rods.

ecLshiftpulse.

to output relays coil or contact K101 thru K108.

open. Ground path thru relay driver CD111-5 open.

Diode CR153 fails open.

Fails Closed.

Coil winding Failure results A misaligned rod shorted due to in master cycler initiates sound insulation break-output relays ing of a rod down. Contact K101 thru K108 deviation alarm fused.

not dropping out by RPIS when direction to alert operator signal is re-of failure.t moved and slave cycler has com pleted its rotation. This will cause rod group.to step out of sequence re sulting in mis alignment of affect rods with other rods assign ed to same bank.

Sheet 58