ML18093A278
| ML18093A278 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 07/31/1987 |
| From: | Corbin McNeil Public Service Enterprise Group |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| NLR-N87136, NUDOCS 8708060208 | |
| Download: ML18093A278 (51) | |
Text
'~,
Public Service Electric and Gas Company I
Corbin A. McNeill, Jr.
Senior Vice President -
Nuclear Public Service Electric and Gas Company P.O. Box236, Han cocks Bridge, NJ 08038 609 339-4800 July 31, 1987 NLR-N87136 United States Nuclear Regulatory Commission Document Control Desk Washington, DC 20555 Gentlemen:
ATWS MITIGATION SYSTEM ACTUATION CIRCUITRY (AMSAC)
SALEM GENERATING STATION UNIT NOS. 1 AND 2 DOCKET NOS. 50-272/50-311 The purpose of this letter is to provide the plant specific design information for the AMSAC system being installed in the Salem Generating Station.
This is as committed to in our letter of December 31, 1986.
The submittal includes responses to the fourteen (14) plant specific items discussed in the NRC's Safety Analysis Report for WCAP-10858 "AMSAC Generic Design Package."
As stated in our letter of December 31, 1986, PSE&G is installing the Westinghouse standard AMSAC option based on Steam Generator Low-Low Water Level logic as described in WCAP-10858.
Installation of the AMSAC system is scheduled for the seventh refueling outage for Unit 1 (October 1987) and the fourth refueling outage for Unit 2 (April 1988).
Attachments to this letter include:
- 1.
Response to the 14 plant specific items required by the NRC SAR on WCAP-10858 (Attachment 1).
- 2.
Safety Evaluation for installation of AMSAC (Attachment 2).
- 3.
Markups of the updated FSAR Sections 1.6, 7.8 and 15.5.
(Attachment 3).
- 4.
Logic Diagrams for the selected AMSAC Section (Attachment 4).
Information regarding the generic portions of the AMSAC system nas been previously provided by Westinghouse or the Westinghouse Owners Group and include:
0 WCAP-10858 "AMSAC Generic Design Package" approved by the NRC staff July 7, 1986.
( Bio806020s 870731 -----,
I
~DR ADOCK 05000272 PDR
(
- 1.
\\
Document Control Desk.
2 July 31, 1987 0
Addendum 1 to WCAP-10858 - via letter OG-87-10 dated February 26, 1987 -
Owners Group letter addressing the basis for the C-20 setpoint.
0 0
Letter OG-172 dated February 10, 1986 -
Owners Group letter addressing AMSAC technical specifications.
Letter OG-181 dated April 11, 1986 -
Owners Group letter forwarding comments on Guidance Regarding System and Equipment Specifications for ATWS Equipment (AMSAC).
If you should have any questions, please do not hesitate to contact us.
Sincerely, Attachments C
Mr. D. C. Fischer USNRC Licensing Project Manager Mr. T. J. Kenny USNRC Senior Resident Inspector Mr. w. T. Russell, Administrator USNRC Region I Mr. D. M. Scott, Chief Bureau of Nuclear Engineering Department of Environmental Protection 380 Scotch Road Trenton, NJ 08628
e e
ATTACHMENT l RESPONSE-TO.PLANT SPECIFIC AMSAC ITEMS FOR SALEM l
& 2 Public Service Electric and Gas (PSE&G) has selected and will implement an AMSAC actuation logic which detects a loss of heatsink by monitoring the level in each of the steam generators. This actuation logic incorporates an automatic arming and block circuitry based upon turbine load by monitoring the first-stage turbine impulse chamber pressure. This signal, referred to as the C-20 signal, blocks AMSAC actuation at low power levels to prevent spurious trips during plant startups. This actuation logic is depicted in Figure 1 and is detailed on drawings referenced on Table 1.
The following is the r.esponse to the fourteen (14) items requested in the NRC SER of the AMSAC Generic Design Package for the plant specific submittal.
Diversity The basis for diversity of the ATWS mitigation system from the existing Reactor Trip System is to minimize the potential of conman mode failures.
This diversity 1s required from sensor output to, but not including, the final actuation device.
An example of the final actuation device is existing circuit breakers may be used for the auxiliary feedwater initiation, For Salem, the existing transmitter, transmitter power supplies, and isolators associated with the turbine impulse chamber pressure and the narrow range steam generator level from the 7100 process protection system provide the input for AMSAC.
This in in accordance with the NRC rule; mitigating system instrument channel components (excluding sensors and isolation devices) must be diverse from the existing RTS.
The Westinghouse AMSAC design is a 2929n:l7/BLG/487
m1croprocessor-bas~system w1th the capability to 1!!Porporate three different actuation logic schemes; the Salem Units employ actuation on low steam generator level. The reactor trip system utilizes an analog-based process protection system and discrete component logic system and therefore, the Salem Units fulfill the requirement of diversity through the types of technology (analog vs. digital). Additionally, diversity is accomplished through the hardware utilized. Where similar components are utilized for the same function in both AMSAC and the reactor trip system, the components used in AMSAC are provided from a different manufacturer.
For example, relays are utilized in both systems for interfacing with the final actuation circuits.
At the Salem Units Westinghouse AR relays are utilized within the reactor trip system while Struthers-Dunn relays are used within AMSAC for this function.
Logic Power Supplies According to the NRC final rule, the AHSAC logic power supply is not required to be safety related. However, the logic power supply should be from an instrument power supply that is independent from the reactor protection system power supplies.
The Salem AHSAC logic power supply is provided by an independent inverter which is backed by a battery that is totally independent from the existing battery supply for the*reactor trip system.
This power supply is connected to a motor control center which is backed by diesel generators.
Safety-Related Interface The AMSAC inputs for measuring turbine impulse chamber pressure and narrow
- range steam generator water level are derived from existing transmitters and 2929n:l8/BLG/487
\\ '
l channels within the process protection system.
Connections to these channels are made downstream of class lE isolation devices which are located within the process protection cabinets. These isolation devices ensure that the existing protection system continues to meet all applicable safety criteria by providing isolation as demonstrated by tests described in Appendix A of this submittal. Buffering of the AMSAC outputs from the safety related-final actuation device circuits is achieved through qualified relays. The relays selected for this application are widely used throughout the industry in both safety and non-safety applications.
To demonstrate the capability of these isolation devices, the devices will be qualified in a manner consistent with the requirments of Appendix A of the NRC SER and details of this can be found 1n Appendix A of this document.
These output buffering relays are normally de-energized and as a result will not initiate actuations upon a loss of power to the relays or upon a relay coil failing open.
Challenges to the existing safety systems are minimized through this approach and the use of redundant hardware with a majority vote to energize the relay coils.
In the unlikely event of a random failure where a relay contact would operate spuriously, starting of an auxiliary feedwater pump or tripping of the turbine could occur.
Quality Assurance Generic letter (GL) 85-06 provided the explicit QA guidance for non-safety related ATWS equipment as required by 10CFRS0.62.
The GL specifically states that the QA program for the non-safety related ATWS equipment does not need to meet 10CFRSO Appendix B requirements nor would compliance be judged in terms of the Appendix.
Detailed QA guidance is provided in the enclosure to the
.2929n:l9/BLG/487
e e
GL.
For manufacturing, the Westinghouse program exceeds the above requirement.
The AMSAC design verification, installation, and testing is being performed in accoraance with QA procedures for non-safety related equipment at Salem Generating Station as required by the NRC generic letter.
Maintenance Bypasses.
Maintenance at power is accomplished through bypassing by way of a permanently installed bypass switch. This method complies with the NRC SER by not involving lifting leads, pulli~g fuses, tripping breakers or physically blocking relays.
Placement of the AMSAC bypass switch to the bypass position inhibits operation of the system's output relays which operate the final actuation devices. Status outputs to the plant computer and main control board, indicating that a general warning condition exists with AMSAC, are initiated when the bypass switch is placed in the bypass position.
Operating Bypasses The Salem AMSAC design includes an operating bypass which is continuously indicated in the control room via and annunciator on the main control board.
Letter OG-87-10 dated February 26, 1987 has been submitted to the NRC by the WOG providing the basis for the C-20 setpoint. The basis is as follows:
short term protection against high reactor coolant system pressures is not required until 70% of nominal power.
However, in order to minimize the amount of reactor coolant system voiding during an ATWS, AMSAC will operate at and above 40% of nominal power.
Furthermore, the potential exists for spurious AMSAC actuations during start-up at the lower power levels.
To assure the above requirements are met, AMSAC will be automatically blocked at turbine 2929n:20/BLG/487 l
loads less than 40% by the C-20 permissive. The C-20 permissive signal uses the existing turbine impulse chamber pressure sensors.
The indication of the bypass status is consistent with existing control room design philosophy; an annunciator window in the control room is provided.
For guidance on dive~sity and independence for the process equipment and logic power supplies see those specific sections.
Means for Bypass The means for bypassing AMSAC is accomplished with a permanently installed, human factored bypass switch. It does not involve lifting leads, pulling fuses, tripping breakers or physically blocking relays.
Manual Initiation Manual initiation of the auxiliary feedwater pumps and tripping of the turbine are achieved through existing plant contols and circuits for the Salem units.
The addition of AMSAC to the Salem units will not result in changes to the existing emergency operating procedures.
Each of the auxiliary feedwater pumps, both motor driven pumps and the turbine driven pump, has a manual start control on the main control board for use in starting the individual pumps.
The starting of either motor driven pump will result in the isolation of all steam generator blowdown and sample lines.
Likewise, a manual control exists on the main control board for tripping the turbine through the auto stop trip solenoid valves and emergency trip fluid solenoid valves.
2929n:21/BLG/487
I e
Electrical Independence Electrical independence from the existing reactor trip system is required from the sensor output to, but not including, the final actuation device. This is to separate safety related circuits from non-safety related circuits. The Salem AMSAC fulfills this requirement.
For the turbine impulse chamber pressure inputs, Public Service Electric and Gas has elected to use the existing pressure transmitters, loop power supplies and isolation devices within the 7100 system process protection cabinets.
In a like manner, existing narrow range level transmitters, loop power supplies and isolation devices (existing and new) within the process protection cabinets are utilized for measuring level in each steam generator. Electrical independence between the non-lE AMSAC logic circuitry and the lE process protection cabinet circuits is provided through isolation devices which have been tested as described in Appendix A of this document.
Moreover, the non-lE logic circuitry and outputs of AMSAC are isolated from the lE turbine trip circuits and the lE auxiliary feedwater start circuits.
Physical Separation The ATWS equipment needs to be physically separated from the existing protection system hardware.
This requires that the cable routing be independent of protection system cable routing and the location of the ATWS equipment cabinets in such a place that there is no interaction with the protection set cabinets.
The basis of this requirement is IEEE 279-1971 (IEEE Criteria for Protection Systems for Nuclear Power Generting Stations),
requirements and criteria applicable to Class lE instrumentation.
The AMSAC actuation outputs to the redundant turbine trip and auxiliary 2929n:22/BLG/487
feedwater pump circuits are provided from separate relay panels within the AMSAC cabin~ts. Separation of the train A and B circuits within the AMSAC cabinet is achieved through a combination of metal barriers, conduit, and distance. Additionally the isolation fault tests mentioned in Appendix A, (to be conducted) w111 demonstrate that credible faults will not disable channels associated with other protection sets. Figure 2 depicts the system block diagram along with the cable separation groups.
Environmental Qualification The SER requires that only the isolation devices comply with environmental qualification (10CFRS0.49) and with seismic qualification. which is discussed in Appendix A.
The remaining portion of the hardware environmental qualification will be addressed here.
T~e ATWS mitigation system is not required to be safety related and therefore, is not required to meet IEEE-279-1971, acriteria for Protection Systems for Nuclear Power Generating Stations". and not ~quired to be qualified as safety related equipment.
The portion of the ATWS mitigation equipment located outside containment in a mild environment follows the same design standard that currently exists for non-lE control grade equipment.
For this modification there is no additional equipment inside containment; the existing equipment inside containment is qualified.
Testability at Power The non-safety related ATWS circuitry is testable with the plant on-line.
Testing of the AMSAC outputs to the final actuation devices may be perfornied with the plant shutdown.
2929n:23/BLG/487
c I
I The AMSAC system for the Salem Generating Station provide for periodic testing through a series of overlapping tests. These tests are performed with the AMSAC outputs bypassed. *This bypass is accomplished through a permanently installed bypass switch*which negates the need to lift leads, pull fuses, trip breakers or physically block relays. Status outputs to the plant computer and main control board, indicating that a general warning condition exists with AMSAC, are initiated when the system's outputs are bypassed.
Once the system bypass is established, a series of overlapping tests are performed to verify analog channel accuracy. setpoint (bistable trip) accuracy, coincidence logic operation including operation and accuracy of all timers, and continuity through the output relay coils. Switches are provided for each output relay to perform testing of AMSAC outputs through to the final actuation devices with the plant shutdown.
A simplified block diagram is shown in figure 3 reflecting the test overlaps for the periodic on-line tests. A sunrnary of each of the overlapping tests follows.
Analog Input Channel Testing The field input to each analog input channel is replaced with a variable test reference which is used to confirm accuracy of the channel gain and offset. The test reference is then ramped up and down throughout a portion of the channel range to verify accuracy of the channel setpoint and associated deadband.
This test confirms operation of the input channel signal conditioning circuitry, analog-to-digital converters and processor operation.
2929n:24/BLG/487
e Processor Logic Testing The second sequence of testing verifies that each Actuation Logic Processor performs the proper coincidence logic, including timing functions, and generates the proper outputs.
In this test, the field input to each input channel for the processor under test is replaced with test references. These test references simulate the channel values as either above or below the setpoint to verify all combinations of coincidence logic and generation of the proper processor outputs to the majority voting modules is performed.
This test confirms operation of the input channel signal conditioning circuitry, analog-to-digital converters, processor operation and output c1 rcuits *to the majority voters.
Majority Voter and Output Relay Tests Each majority voting.module and associated output relays are tested to verify operation of the majority vote (2 out of 3) and that continuity exists for each of the output relay coils. Integrity of the relay coils along with associated wiring is verified which exercising the voting logic.
Completion of Mitigative Action Completion of mitigative actions in reponse to AMSAC actuation is performed through existing plant circuits for all auxiliary feedwater pumps and for the turbine trip circuits. The circuit breakers for the motor driven auxiliary feedwater pumps are provided with seal in circuitry which requires manual 2929n:25/BLG/487
action at the main~ntrol board to stop the pumps.4'tor each of these pumps
- only the pump protective relays and safeguards emergency unloading signals will serve to automatically stop the pumps.
The turbine driven auxiliary feedwater pump is provided with seal in circuitry such that main control room controls must be utilized to stop the pump.
The AMSAC actuation signal is also input to the turbine trip logic. Specifically, the AMSAC output is connected with the P-4 reactor trip signal and various turbine protection trips in a hardwired OR fashion. With one of the inputs present. the turbine stop valves close, thus a turbine trip. For both the auxiliary feedwater and turbine trip actions the circuit logic can be found in the Salem Functional Diagrams (see Table 1). In the unlikely event that AMSAC calls for initiation of auxiliary feedwater flow and turbine trip. these existing circuits will ensure completion of mitigative actions.
Technical Specifications The WOG is on record (cf. OG-171, dated February 10, 1986) that Technical Specifications for AMSAC are unnecessary.
PSE&G feels that Technical Specifications for AMSAC do not enhance the overall safety of nuclear power plants, and consitute a backfit.
PSE&G also believes that normal nuclear plant administrative controls are sufficient to control AMSAC.
As of May 30, 1987, the NRC has not responded to the WOG letter.
2929n:26/BLG/487
APPENDIX A - AMSAC ISOLATION DEVICE Electrical independence of AMSAC from the existing reactor protection system (RPS) 1s provided through several means for the Salem Generating Station. A block diagram showing the relationship of AMSAC to the existing reactor protection system is provided in Figure 4 which details the AMSAC/RPS connections and points of isolation.
The steam generator narrow range level inputs to AMSAC are derived from existing isolated signals from the process protection system.
These signals are provided from differential pressure transmitters to the process prot~ction cabinet and then from the protection cabinet to the control cabinets and finally to AMSAC.
This arrangement does not require the use of new isolators to provide electrical independence of these instrument channels from the existing reactor protection system.
However, to prevent overloading of the existing current loops, several isolators of the existing type were added.
For measuring turbine load at the first stage, Public Service Electric & Gas has elected to utilize the existing pressure transmitters.
As with the narrow range steam generator inputs, the isolated signals are from the RPS which have been routed through the control cabinets.
Isolation is provided in the process protection cabinet for the signals used as input for AMSAC.
As reported in the Westinghouse Protection System Noise Tests (Rev. 2, 1975), these isolation devices, which are powered by a class lE source, have been tested to demonstrate that the device is acceptable for its application. The purpose of the tests was to determine whether or not 2929n:27/BLG/487
protect1on c1rcu1try could be perturbated to the extent that protective action would be prevented by the pick-up or presence of credible interference on control wiring in close proximity to protection wiring within the process control racks.
Isolation devices are used in the Process Control Systems 7100 Series equipment to electrically isolate the protection circuits inside the process control racks from control circuits outside the cabinets. The system was subjected to tests that included noise susceptibility, output cable voltage faults (maximum credible voltages: 118 VAC, 250 VDC), magnetic interferences and light emitting diode verification test. The acceptance criteria for these tests were a) noise would not degrade the ability of the protection systems to provide the necessary action and b) noise which causes initiation of protective actions would be reported and evaluated on a case basis. Since the protection system operation was not degraded, no evaluation had to be made.
As mentioned, the subject of interferences that could negate protective actions was covered in various tests carried out for Diablo Canyon, for the Westinghouse 7100 Series Process Control System Noise Tests. This report includes a series of tests that were performed before any faults or circuitry abnormalities were applied. These tests were carried out to demonstrate that a credible perturbation in the* control wiring would not degrade protection action or be reflected back into the protection wiring.
Any of these interferences (i.e. noise, crosstalk, etc.) that would be generated by AMSAC falls under the same category as those tested for in the test report. Since AMSAC is separate from the reactor protection system and the cable is not routed in an area that exceeds the 118 VAC 250 voe test limits, any interference from AMSAC would not affect the reactor protection system.
2929n:28/BlG/487
J Under all tested conditions the protection circuitry operated as intended.
The test showed conclusively that electrical interference imposed onto the isolator output wiring (control wiring) is not a consideration as to the proper operation of the perturbated channel nor any adjacent channels.
The recordings verified that the interference imposed onto the control wiring was not induced into the protection wiring.
The magnitude of the electrical interference introduced into the system and the stringent test procedures far exceeded any conditions that would be present in actual plant operations.
Relays are provided at the output of AMSAC for isolating the non-class lE AMSAC circuits from the class lE final actuator circuits. For the Salem Units, the AMSAC outputs are provided from separate relay panels within the AMSAC cabinet. Separation of the Train A and B circuits within the AMSAC cabinet is achieved through a combination of metal barriers, conduit, and distance. These relays will be tested with the maximum credible faults applied to the relay coil in the transverse mode.
Tests will be performed with the relay coil operating contact in both the open and closed position.
Figure 4 depicts the simplified diagram of this output isolation circuit, and point of application for the maximum credible faults. Details of the actual tests, fault levels and their origin, test data, and the pass/fail acceptance criteria will be submitted upon completion of the test.
Additionally, the SER requires that the isolation devices comply with the environmental qualifications (10CFRS0.49) and with the seismic qualifications which were the basis for plant licensing.
The isolation device at the output of AMSAC is the boundary between safety related and non-safety related circuits and therefore must be qualified.
For the Salem configuration, the AMSAC output isolation device will be qualified in accordance with the current 2929n:29/BLG/487
West1nghouse se1sm1c qua11f1cat1on program.
Th1s program has developed and 1mplemented the requ1rements of IEEE-344-1975, *IEEE Standard for Seismic Qualification of Class lE Electrical Equipment for Nuclear Power Generating Stations* for Westinghouse supplied instrumentation and control systems.
The isolation provided at the protection system have been seismically qualified.
Environmental Qualification Reports, however, are not applicable to the AMSAC output relays since these are located in a mild environment.
The methodology for qualification is contained in WCAP 8587 Rev. 6-A, *Methodology for Qualifying Westinghouse WRD Supplied NSSS Safety Related Electrical Equipment".
The Class lE loads operated by the isolation relay contacts are powered from a Class lE source.
The plant specific details ~f the wiring configuration can be found on the Public Service Electric and Gas elementary drawing if needed.
2929n:30/BLG/487
Salem Functional Diagrams Interim Drawing Numbers 221056-8-9545-IR-lEC-2137-1148 221065-8-9545-IR-lEC-2137-1149 221064-8-9545-IR-lEC-2137-1150 231446-8-9646-IR-lEC-2137-1151 231447-8-9646-IR-lEC-2137-1152 231448-8-9646-IR-lEC-2137-1153 2929n:31/8LG/487 Table 1 Description Steam Generator Trip Signals Turbine Trip Signals Auxiliary Feedwater Pump Signals Auxiliary Feedwater Pump 11 Auxiliary Feedwater Pump 12 Auxiliary Feedwater Pump 13
LOW-LOW STEAM GENERATOR LEVEL LOOP 1 o-eo SI!:<::
TIME OEIJ\\Y ON ENERGIZING LOOP 2 l_
l_
C-20 TRIP TURBINE INITIATE AFW ISOLATE S/G SAMPLE AND SLOWDOWN LINES FIGURE 1:
AMSAC ACTUATION LOGIC CH. 1 HIGH TURBINE LOAD s
2/2 CH. Z s
0-240 SEC TIM~ DELAY ON DE-ENERGIZING
. I
. l.
- l
)
lURBINE PRE$URE TRANSMITTERS a:
NARROW* RANGE S/G LEVEL TRANSMITTERS PROCESS PROTECTION CABINETS ISOLATION PROCESS CONTROL CABIN ITS FROM SPDSA2 NON-IE SPDS INVERTER NON-IE AMSAC ELECTRONICS CABINET TRAIN A IE PLANT COMPUTER
- AMS/C ACTUATED
- AMS>C GENERAL WARNING
- S/G A. B & C LOW LEVEL
- CN.1 &:2 TURBINE PRESSURE LOW MAIN CONTROL BOARD
- 1\\JRBINE TRIP FIRST OUT ANN. - AMSAC
- NI.SAC GENERAL WARNING ANN.
~NJ.SAC BYPASSED (C-20)
TRAJN B IE STARTS IDAFWP - TRIPS TURBINE - STARTS MDAFWP SIMILAR TO TRAIN A
- CLOSES STM. BLOWDOWN LINES
- CLOSES STM. SLOWDOWN SAMPLES LINES FIGURE 2:
AMSAC BLOCK DIAGRAM
~aloa Channel Teat Proceaaor Logic Teat i
Voter &
Output Relay Test t Input Module AID Conver91on Dlgtlal Oulpal Malodl' Voter Output Relay*
ON-LINE TESTING COMPOSITION FIGURE 3:
TESTING OVERLAPS
- e.
I I
e e
J SAFETY RElATED TURBINE IMPULSE PRESSURE TRANSMITIERS FlELD SENSORS S/G N.R.LEVEL TRANSMITTERS u
ISOL.
PROCESS I
PROTECTION /,.....' -----------41' CABINETS PROCESS CONTROL CABINErS
/
, I SSPS TRAIN A REACTOR TRIP FINAL ACTUATION DEVICES TRAIN A I
l AM SAC LOGIC 1R.A lR.B ISOL ISOL RElAYS RELAYS I
I w
SSPS TRAIN 8 REACTOR.
TRIP
~
FINAL ACTUATION DEVICES TRAIN 8
. FIGURE 4:
RPS - AMSAC BLOCK DIAGRAM CONTROL OUTPUTS
CIRCUIT COIL BREA I< ER OPERATE CONTACT
~*
r--
I
~
0 0
/1L FINAL e
ACTUATOR CIRCUIT 120 VAC BO Hz INPUT I
\\.
\\ *. \\ \\.
nNAL ACTUATOft CIRCUIT
\\
APPLICATloN OF MAXIMUM CREDIBLE e
FAULTS ISOLATION RELAY FIGURE 5:
ISOLATION RELAY
I ATTACHMENT 2 AMS AC SAFETY EVALUATION SECir-87-282 Page 1 of 6 Anticipated transients witha.It scram (MWS) were first raised as a safety
~in the late 1960s in an NRC AC.RS technical paper that dealt with CXJllDWn nDd.e fail.me.
'llle 'W'Orst ccmron mode failure considered was failure to scram the reactor after an anticipated transient. In 1973, the NRC cut.lined the original AlWS requirements (Referen=e 1)
- Generic A1WS analyses were perfonned by West.injloose 'Which showed acceptable consequences assnmj~ the nanina1 conditions permitted by the NRC am that the turbine trips an:i auxiliaey feedwater are initiated in a tinel.y manner.
M::>re conservative analyses were then made am again the results were acceptable.
Two of the transients analyzed (carplete loss of no:cnal feedwater an:i loss of load) resulted in high reactor ooolant system (RCS) p~, yet stayed urxier 3200 psig which cxmse?:Vatively meets the ASME Boiler an:i Pressure Vessel o:xie Level c Lllni.t.
Both transients assume auxiliary feedwater actuation 60 Secxl?lds after the initia~ event for long term reactor protection, am loss of no:cnal feedwater assl'mes a turbine trip after 30 seoarx:Is for short tenn pressure to remain umer 3200 psig.
Both of these actions would be initiated by the reactor protection system.
However, if a mmwn mxle failure in the RPS prevents this as we.11 as a reactor trip, an alternative method for the t\\lr'O functions is needed: thus the need for AMSAC.
'Ihe NRC final rule, ~
in 1983, required ~
plants to have A1WS mitigation equipnent m:Ieperrlent of the RFS that would.initiate. tm:bine trip am auxiliary feedwater fla..r.
'!he AM.SAC Generic Design Package issued by ~
in Oct:dJer, 1986
~10858P-A) presented three generic AMSAC designs, aey of which will
- iJti>lement the turbine trip am auxiliaey feedwater start functions consister!t 'Wi.~ i:he ~
-ar 1tdRSo. 62. Weldam 1 to t:he 'WO\\'.P, issued by West.in;hcuse in Februaey, 1987, di sa1ssecJ the opera~
bypasss. '!he NRC responied to this WCAP with a safety Evaluation by ai:prov~ the generic designs submitted. Ha.NeVer, a plant specific sul::mittal is necessaey to COi/er items of particular interest to the NRC (e.g., electrical separation, logic power SUWlies).
'!he NRC Generic Ietter (GL) 85-06 dated April 15, 1985 provided the explicit QA guidance for non-safety related AlWS equiprent as required by 10CFRSO. 62. 'llle GL specifically stat.es that the QA prcxJtam for the non-safety related MWS does not need to meet the 10CFRSO ~
B requirements nor 'Wall.d CCl!lpl~ be j\\D;;Jed in tellDS of~
B. Public Service Electric am Gas CClllpany has selected an:i will inplement an AMSAC actuation logic tmich detects a loss of heatsink by m:mitorinJ the level in each of the steam generators.
'!he actuation logic irool:porat.es autanatic arminJ am bloc::kin;J circuitl:y based up:m t:urbine load by mnitorirr;J the first stage tumine inp1lse chamber pressure.
REFERENCES
- 1. "Tedmical Report an Anticipated Transients Without Scram for Water-cooled Power Reactors," NRC, WA.SH-1270, September 1973.
I
SEX:'!!t-87-282 Page 2 of 6
- 2.
~10858P-A, AM.SAC Generic Design Packaqe, M. R. Adler, October 1986.
- 3.
nAcceptanoe for Referenci.rg of Lioensin:J 'lq>ical Report - Safety Evaluation of Topical Report (WCAP-10858)," c. E. Rossi, NRC letter to L. D. aitte.rfield, July 1986.
- 4. MWS Final Rule - Code of Federal Regulations, 10CFR so. 62 and SUpple:mentazy Infonnation Package, Redut:tion of Risk fran Anticipated Transients Without SCram (MWS) Events for Light-Water-cooled Nuclear Power Plants."
- s.
"~ity Assurarce Guidarce for MWS F.quipnent 'lllat is Not safety-Related," Generic letter 85-06, April 16, 1985
'lllere were many criterion taken into consideration when designi.rg AMSAC.
F.ach of the criterion will be discussed in this evaluation.
AM.SAC utilizes one narrc111 ran;e steam generator water level signal fran each loop to detect a lass of main feedwater. If aey three of the fcm-channels irxlicate that the main. feedwater has been lost (as dete:rmined by the signals drqpi.rg below a predete:rmined setpoint) AMSAC will initiate auxil.iazy feedwater flCM and tw:bine trip. 'lhe low steam generator level is a corrlition irxlicative of a lass of heatsink. '!be isolated outpits of AMSAC are to be routed to the final actuation devices for the anxj J i arv
'reeawate:r ~
~ie tdp initiation. ~
votiig 100dlil.e1 s outpits are to be utilized to drive relays for actuati.rg catpJnellts in the ex:istllg tm:bine trip and auxiliary feedwater flow circuitey. Consideration to human factors principles were given to the develq:ment of test features,
- inlications, and procedures such that testirg avoids the generation of sp.Jriais trips.
As stated in the NRC final %Ule, the AlWS equipnent is not required to be safety related, bit the illpleiel'l1:.ation of AM.SAC 1lllSt be such that the ex:ist.i.rg protection system continues to meet all aQ;>licable safety related criteria.
AMSAC uses either isolated llpit:s fran the reactor protection system (RPS) or inputs irx:Jeperdent of the RPS, ani provides isolated outprt:s to the safety related final actuatin:J devices.
'lhese isolation devices ensure that the ex:ist.i.rg protection system continues to meet all awlicable safety criteria am that the circuitey for the necessaey
- actions is protected. 'lhe isolation devices will be qualified devices in accordance with the requllements of*~
A of the NRC SER.
'lhe basis for diversity of the Ans mitigation system fran the readt:or protection system (RFS) is to minimize the potential of o>rn*Oll m:ide failures. EKistin;J sensors may be used as well as the sensor power supplies and isolators. 'lhe diversity is required fran sensor output, to, I
~..,
SECtr87-282 Page 3 of 6 blt not irx:luill'xJ, the final actuation device: for exanple ex.istin:J circuit breakers may be used for the auxiliaey feedwater initiatiC!'l.
'lhe AMSAC design is a microprocessor based system. '!he reactor protection system utilizes an analog-based process protection system an::l a diScrete cc:mponent logic system.
'lllrough the different types of technologies (analog vs. digital) diversity is fulfilled. ~
similiar cx:mponents are used for the two systems, the caoponents will be fran differin;J manufacturers. For exanple, AR am Potter-Brumfield relays are utilized within the RPS, 'lrwilereas
- struthers-nmn relays are used within >>tSAC.
Sin=e >>EA<= is a baclmp J'Dl-Safety related system to the redurx:lant RPS, red1.1rmncy is not. required.
Electrical in:iepen:lence fran the existin;J RPS is required fran the sensor outp.It, to, blt not llx::llXlirg the final actuation device. 'lhis is to separate the safety related circuits fran the non-safety related circuits. 'Ihe inp.rt:s am a.rt:p.rt:s of AMSAC are isolated trrilen.interfacin;J with the lE circuitry with qualified devices.
AM.SAC needs to be Jilysical.ly separated fran the existirg protection system hardware. 'Ibis requires that the cable raiti.n;J be in:lependent of protection system cable raiti.n;J am the location of the MWS
- equipnent cabinets in such a place that there is no :interaction with the protection set cabinets. 'lhe AM.SAC actuation a.rt:p.rt:s to the redurx:lant tumine trip am auxiliazy feedwater pmp
- circuits are separated by each beirg' provided fran separate wall :nomted boxes.
Separation of the train A am B circuits within the AMSAC cabinet is achieved throogh a oanbination of metal barriers, oorxhrl.t, an::l distance.
AM.SAC is not required to be safety related am t.hemfore is not required to neet IEEE-279-1971, "Criteria for Protection Systems for Nuclear Power Generatin;J stations", am not required to be qualified as safety related equipient.
Acc:ordiJ'g to the NRC rule, AMSAC is not required to be seismically qualifed. 'lhe portion of the A1WS mitigation equipnent located c:utside containment in a mild environment follows the same design stamard that currently exists for non-lE control grade eguipnent.
'lhe AMSAC structure and relay assent>lies therein are seismically qualified am detemined to be acceptable. 'lhe SER requires that only the isolation devices oaiply with enviJ:amrental qualification (10CFRS0.49) and with seismic qualification, which is disnJSsed in.Awendix A.
Generic Ietter (GL) 85-06 provided the e>cplicit QA guidance for rxm-safety related A'IWS equipnent as required by 10CFR50. 62. 'lhe GL specifically states that the QA program for the non-safety related A1WS equipnent does not need to meet 10CFRSO.Awendix B requirements nor wwld catpli.ance be j'!Jd:3ed in tenis of ~
B.
Detailed QA guidame is provided ~ the enclosure to the GL.
For manufact:urin;J, the Westin]hOJSe IJXO:JLam ~s the aboVe requirements.
'lhe non-safety related A1WS circuitcy is testable with the plant C!'l-line.
Testin; of the AMSAC a.rt:p.rt:s to the final actuation devices may be perfo:r:m=d with the plant shutdown. 'lhe AMSAC systems for the salem
l SEX::L-87-282 Page 4 of 6 Units provide for periodic testirq thrcu:Jh a series of overlcq:pirg tests.
'Ihese tests are perfonned with the AMSAC outp.rt:s bypassed. 'lhis bypass is acxxauplished through a pennanently installed bypass switch lrrhlch negates the need to lift leads, p.il.l fuses, trip breakers or :P'lysically blOck relays.
status outputs to the plant oarp.rt:.er am main a::mtrol board, in:lica~ that a general wam.in; canditian exists with AMSAC, are initiated 'When the system's outp.rt:s are bypassed.
Once the system bypass is established, a series of overlappirg tests are perfonned to verify analog channel acx::uracy, setpoint (bistable trip) accuracy, coinciderx::e logic q>eration incluW.DJ operation am accuracy of all timers, am cxmtinuity through the cutplt relay coils. SWitches are provided for eadl artp.It relay to perform testin:J of AMSAC outputs thra.lgh to the final actuation devices with the plant shutdcMn. A sunmmy of eadl of the averlcq:pin:J tests is provided below.
'lbe field irpit of each analog ~channel is :replaced with a variable test referera! lrrhlc:h is used to confim aocuracy of the chahne1 gain am offset. 'lhe test reference is then ranped up am dCMl'l thrc:ughait a portion of the charinel ra?XJe. to verify ao:uracy of the dlannel. setpoint am associated deadhand. '!his test confirms operation of the inp.It channel signal con:litioninJ circuitry, analog-to-digital ~
am processor c.peration.
'lbe secorrl segueme of test.il'9 verifies that each Acblaticn.Lcqi c
'Processor perfoJ:IIS the proper col.nc~ logic, ioolud.in;J timirq
- furci:.ions, arrl generates the proper outputs. In this test, the field inp.It to each inp.it channel for the processor urxier test is replaced with test references. 'lhese test refererx:es sim.ll.ate the c::hannel values as either above or below the setpoint to verify all cxxnbinations of coincidence logic an:i confinnatian of the processor outputs to the majority votirg nrxhlles is perfonned. '!his test confirms operation of the inpit channel signal canditianin:1 circuitry, analog-to-digital CXl'Nert:ers, piooessor c.peratiCll am cutplt circuits to the majority voters.
Majority Voter arrl outpJt Relay Tests.
F.ach majority vctirg ncdule am associated cutp.it relays are tested to verify operation of the majority vote (2 cut of 3) an:i that cxmtinuity exists for each of the cutplt relay coils. Integrity of the relay coils alorq with assoeiated wi.rirq is verified while exercisin:.;J the vctirg logic.
Irxx>rporated in the AMSAC design are a rrumber of processes, lrrhlch include
~ison of inp.rt:s to setpoints, coinci.deroa logic based Cll cniparisons, arrl majority vctirg of outputs, that minimize inadvertent actuation.
. I SECir87-282 Page 5 of 6 AMSAC Serves as a backup to the RPS by WtiatinJ auxiliaey feedwater an::l a t:url:>ine trip with an adjustable delay. 'lhi.s delay is to allow the RPS to actuate the ai:prcpriate acticns befom AMSAC.
AMSAC has a nnrber of features that minimize the possibility of sp.irioos actuations of the system.
One sudl feature is the 3 a.it-of 4 actuation logic for narrow steam generator level iipzt:s. Also, AMSAC inoozporates an actuation t:ilne delay at energization to pemit -rec.avery fran a partial or total loss of feedwater flew. Additionally the setpoint values of AMSAC are lower than the setpoints values of the RPS, caus.in;;J the RPS to actuate sooner. Finally, the actuation signals are blocked below a predetennined low polo.1er level based upon tuli>ine load by monitorin] the first-stage t:url:>ine bpJlse chamber pressure. 'lhese turbine inp.rt:s are isolated signals fran the RPS.
'!his block is to ensure that splrioos AMSAC actuations do not occur at lCM ~operations arxi durin] startup.
'lhis block is called the C-20 pemissive an::l will block AMS.AC actuation
.below 40% tm:bine load
~
at :pcMer is accatplished t:hrcu;Jh bypassin] by way of a pennanently installed bypass switch. '.Ibis method ccrrplies with the NRC SER by not invol vin] liftin; leads, p.lll.i.rg fuses, trii;:pin] breakers, or piysically blcx:k:iig relays.
Plaoexrent of the AMSAC bypass switch to the bypass position inhibits q>eratjon of the system's o..rtplt relays. status cut:pits in::licatin] that a general wamin:J cxntition exists with AMSAC are available for the plant carp.Iter an::l main control board.
'lhe AMSAC design incl\\Xies an q>eratirg bypass 'tttl.dl can be contirnlously
'lldica'=ed 1n ~
CUJft:toi '%mn Via an annunciator on the main control board. 'lhe basis for the C-20 setpoint is as follows: short tezm protection against high reactor coolant system pressures is not required until 70% of nani.nal :pc:Mer.
Hat.1ever, in order to minililize the annmt of reactor coolant system void:inl durin] an MWS, AMSAC will operate at an::l above 40% of naninal. :pc:Mer.
F\\lrthez:m:)re, the potential exists for.
spurious AMSAC actuations durin;J start-up at the lov.'er power levels. To assure the above requirements are met, AMSAC will be autanatically blocked at tm:bine loads less than 40% by the C-20 pemissive. 'lhe C-20 pez:missive signal uses the existirg tumine llp.U.se cha:mber pressure sensors.
Because AMSAC is designed for anticipated transients, only the ANS Qlrxlition n: events need to be considered for inpact. 'lhe cuu:ent Salem FSAR analyses assinne that protection is provided by the reactor trip an::l erg:ineered safeguards systems am ccnsequently, do not take credit for an AMSAC system. Generic analyses were perfonned 'ttlidl assumed the reactor trip system failed an::l AM.SAC actuated.
'lhese analyses, Wich denalstrated acx:eptable results, are djso1ssed in Reference 2. 'lhe previQJS dj soJSSions of the AMSAC design denr:>nstrate that ~
this system to the plant will not adversely affect the FSAR accidents arxl results, or create a new acx:ident.
I
- l
\\
SECir87-282 Page 6 of 6 Revisions to the FSAR due to the irxxnporaticn of AM.SAC incl.me ~
followin;:
- 1. Olapter 7
- 2. Olapter 15
- 3. Table 7.2-2 CXNCWSICN It has been d~ted that AM.SAC has been designed to meet an:i fulfill the requirements of the NRC Final Rule. 'lhis system will provide a backup to the existin;J :RPS to initiate auxil.iaey feedwater an:i a tumine trip in the event that an anticipated transient results in the cxmplete loss of main feedwater Wile the power level is above a specified value
- M::>reover, this system will operate as interrled an:i will nJt negatively affect the safety of the plant if in.stalled prcperly.
'1.
ATTACHMENT 3 UFSAR MARKUPS SECTION 1.6 LIST OF ACRONYMS The fol lowing is an alphabetica.l listing of the most frequently used acronyms in this report.
AEC Atomic Energy Commission AFST Auxiliary Feedwater Storage Tank AFW Auxiliary Feedwater AIF Atomic Industrial Forum ALAR A As Low as is Reasonably Achievable ALP Actuation Logic Processor (AMSAC)
ALS Actuation Logic System (AMSAC)
AM SAC -
Actuation Mitigation System Actuation Circuitry.
ANS American Nuclear Society ANSI American National Standards Institute AO Axial Offset ASTM American Society for Testing and Material_s ATWS Anticipated Transient Without SCRAM BIT Boron Injection Tank
- SGS-UFSAR D633v:1 D/062687 Revision 6 February 15, 1987
~
e e
~
High Pressure
- HP I&C Instrumentation and Control ICE Instrumentation Controls and Electrical IEEE Institute of Electrical and Electronic Engineers I/O
- Input/Output-LCR License Change Request LOP Lighting Distribution Panel LP-Low Pressure LPG Liquified Petroleum Gas LPM Loose Parts Monito;ing LNG Liquified Natural Gas
. LOCA Loss-of-Coolant Accide~
LOFT Loss of Fluid Test LSP Liquid Sampling Panel LWS Liquid Waste System MCD Minor Civil Division MEL Master Equipment List (Section 17.2)
SGS~UFSAR 0833v:1 D/062687 Revision 6 February 15, 1987
I 1
'TMI Three Mile Island TIMS Test/Maintenance System (AMSAC)
TSC Technical Support.Center UE&C United Engineers & Constructors UFSAR -
Updated Final Safety Analysis Report UPS Uninterruptible Power System USE Upper Shelf Energy
- UTG United Engineers and Constructors Test Group UTS Ultimate Tensile Stress VCT Volume Control Tank WDS Waste Disposal System w.g.
water gage WILMAPCO - Wilmington Metropolitan Area Planning Council WMID Wisconsin-Michigan Inspection Device WOL Wedge Opening Loading SGS-UFSAR D633v:1 D/062987 Revision 6 February 15, 1987
-1
1.8 ATWS MITIGATION SYSTEM ACTUATION CIRCUITRY (AMSAC) 7.8.1 Description 7.8.1.1
System Description
7.8.1.2 7.8.1.3 7.8.1.4 7.8.1.5 7.8.1.6 7.8.1.7 7.8.1.8 7.8.1.9 Equipment.Description Functional Performance Requirements AMSAC Interlocks Steam Generator Level Sensor Arrangement Trip System Isolation Devices AMSAC Diversity From the Reactor Protection System Power Supply 7.8.1.10 Environmental Variations 7.8.1.11 Setpoints 7.8.2 Analysis 7.8.2.1 Safety Classification/Safety-Related Interface 7.8.2.2 Redundancy 7.8.2.3 Diversity From Existing Trip System 7.8.2.4 Electrical Independence 7.8.2.5 Physical Separation From the RTS and ESFAS 7.8.2.6 Environmental Qualification 7.8.2.7 Seismic Qualification 7.8.2.8 Test. Maintenance, and Surveillance Quality Assurance 7.8.2.9 Power Supply 7.8.2.10 Testability at Power 7.8.2.11 Inadvertent Actuation 7.8.2.12 Mainte.nance Bypasses 7.8.2.13 Operating Bypasses 7.8.2.14 Indication of Bypasses 7.8.2.15 Means for Bypassing 7.8.2.16 Completion of Mitigative Actions Once Initiated 7.8.2.17 Manual Initiation 7.8.2.18 Information Readout 7.8.3 Compliance With Standards and Design Criteria 0633v:1 D/063087
7.8 ATWS MITIGATION SYSTEM ACTUATION CIRCUITRY (AMSAC) 7.8.1 Description 7.8.1.1 System Description The ATWS (Anticipated Transient Without Scram) Mitigation System Actuation Circuitry (AMSAC) provide.s a backup to the Reactor Trip System (RTS) and ESF Actuation System (ESFAS) for initiating turbine trip and auxiliary feedwater flow in the event an anticipated transient results [e.g., in the complete loss of main feedwater].
The AMSAC is independent of and diverse from the Reactor Trip System and the ESF Actuation System with the exception of the final actuation devices and is classified as control-grade equipment. It is a highly-reliable, microprocessor-based, single train system powered by a non-Class lE source.
The AMSAC continuously monitors level in the steam generators, which is an anticipatory indication of a loss of heat sink, and initiates certain functions when the level drops below a predetermined setpoint for at least a preselected time and for three of the four steam generator levels. These initiated functions are the tripping of the turbine, the initiation of auxiliary feedwater, and isolation of the steam generator blowdown. and sample lines.
The AMSAC is designed to be highly reliable, resistant to inadvertent actuation, and easily maintained.
Reliability is assured through the use of internal redundancy and continual self-testing by the system.
Inadvertent actuations are minimized through the use of internal redundancy and majority voting at the output stage of the system.
The time delay on low steam generator level and the coincidence logic used also minimize inadvertent actuations.
The AMSAC automatically performs its actuations when above a preselected power level, determined using turbine impulse chamber pressure, and remai_ns armed sufficiently long after that pressure drops below the setpoint to ensure that its function will be performed in the event of a turbine trip.
0633v:10/063087
. 7.8.1.1.2 Equipment Description - The AMSAC consists of a single train of equipment located in a seismically qualified cabinet.
The design of the AMSAC is based on the industry standard Intel multibus format, which permits the use of various readily available, widely used microprocessor cards on a common data bus for various functions.
The AMSAC consists of the following:
- 1. Steam Generator Level Sensing SG level is measured with four existing differential pressure-type level transmitters, for each of the main steam generators.
- 2. Turbine Impulse Pressure Turbine Impulse Pressure is measured with two existing pressure transmitters located in the steam supply line near the turbine.
- 3. System Hardware The system hardware consists of two primary systems:
the Actuation Logic System (ALS) and the Test/Maintenance System (TIMS).
Actuation Logic System The ALS monitors the analog and digital inputs, performs the functional logic required, provides actuation outputs to trip the turbine and initiate auxiliary feedwater flow, and provides status information to the Test/Maintenance System.
The ALS consists of three groups of input/output (1/0) modules, three actuation logic processors (ALPs), two majority voting modules, and two output relay panels.
The 1/0 modules provide signal conditioning, isolation, and test features for interfacing the ALS and TIMS.
Conditioned signals are sent to three identical ALPs for analog-to-digital conversion, setpoint comparison, and coincidence logic performance.
Each of the ALPs perform identical logic calculations using 0633v:10/062687
-1
the same inputs and derive component actuation demands, which are then sent to the majority voting modules.
The majority voting modules perform a two-out-of-three vote on the ALP demand signals. These modules drive the relays providing outputs to the existing turbine trip and auxiliary feedwater initiation circuits. A simplified block diagram of the AMSAC ALS architecture is presented in Figure 7.8-1.
Test/Maintenance System The Test/Maintenance System provides the AMSAC with automated and manual testing as well as a maintenance mode.
Automated testing is the continuously performed self-checking done by the system during normal op~ration. ALS status is monitored by the T/MS and sent to the plant computer and the main control board. Manual testing of the system by the maintenance staff can be performed on-line to provide assurance that the ALS system is fully operational. The maintenance mode permits the maintenance staff, under administrative control, to modify channel setpoints, channel status and timer values, and initiate channel calibration.
The TIMS consists of a test/maintenance processor, a digital-to-analog conversion board, a memory board, expansion boards, a self-health board, digital output modules, a test/maintenance panel, and a portable terminal/printer *
. 4.
Equipment Actuation The output relay panels provide component actuation signals through isolation relays, which then drive the final actuation circuitry for initiation of auxiliary feedwater and for turbine trip. Existing actuation devices of the component are used.
0633v:1 D/062687
' 1.8.1.3 Functional Performance Requirements - The AMSAC automatically initiates auxiliary feedwater, trips the turbine, and isolates steam generator blowdown and sampling lines. Analyses have shown that the most limiting ATWS event is a loss of feedwater event without a reactor trip. Therefore, the AMSAC performs its mitigative actuations:
- 1. In order to ensure a secondary heat sink following an anticipated transient (ANS Condition II) without a reactor trip.
- 2.
In. order to limit core damage following an anticipated transient without a reactor trip, and
- 3.
To ensure that the energy generated in the core is compatible with the design limits to protect the reactor coolant pressure boundary by maintaining the reactor coolant pressure to within ASME Stress Level C.
7.8.1.4 AMSAC Interlocks - A single interlock, designated as C-20, is provided to allow for the automatic arming and blocking of the AMSAC.
The system is blocked at sufficiently low reactor power levels when the actions taken by the AMSAC following an ATWS need not be automatically initiated.
Turbine impulse chamber pressure in a two-out-of-two logic scheme is used for this permissive. Turbine impulse chamber pressure above the setpoint will automatically defeat any block, i.e., will arm the AMSAC.
Dropping.below this setpoint will automatically block the AMSAC.
Removal of the C-20 permissive is automatically delayed for a predetermined time.
The operating status of the AMSAC is displayed on the main control board.
7.8.1~5 Steam Generate~ Level Sensor Arrangement - SG level is determined by a differential pressure transmitter, measuring the level drop in the steam generator. These SG level signals are used as input to the AMSAC and are isolated signals from the Process Protection Cabinets routed through the Control Cabinets.
7.8.1.6 Turbine Impulse Chamber Pressure Arrangement - Turbine impulse chamber pressure is determined by a differential pressure transmitter, measuring the presure rise in the turbine. These pressure signals are used as input into AMSAC and are isolated signals from the Process Protectfon Cabinets routed through the Control Cabinets.
0633v:10/063087
\\
7.8.1.7 Trip System - The differential pressure that is measured in the steam generator is used by the AMSAC to determine trip demand.
Signal conditioning is performed on the transmitter output and used by each of the ALPs to derive a component actuation demand.
If three of the four steam generators have a low level at a power level greater than the C-20 permissive, then a trip demand signal is generated. This signal driv~s output relays for performing the necessary mitigative actions.
7.8.1.8 Isolation Devices - AMSAC is independent of the Reactor Trip and Engineered Safety Features Actuation Systems.
The AMSAC inputs for measuring turbine impulse chamber pressure and narrow range steam generator water level are derived from existing transmitters and channels within the process protection system.
Connections to these channels are made downstream of class lE isolation devices which are located within the process protection cabinets. These isolation devices ensure that the existing protection system continues to meet all applicable safety criteria by providing isolation.
Buffering of the AMSAC outputs from the safety related final actuation device -
circuits is achieved through qualified relays. A credible fault occurring in the. non-safety-related AMSAC will not propagate through and degrade the RTS and ESFAS.
7.8.1.9 AMSAC Diversity from the Reactor Protection Systems - Equipment diverse from the RTS and ESFAS is used in the AMSAC to prevent common mode failures that might affect the AMSAC and the RTS or ESFAS.
The AMSAC is a digital, microprocessor-based system with the exception of the analog SG level*
. and turbine impulse pressure. transmitter inputs, whereas the reactor trip system utilizes an analog based protection system. Also where similiar components are utilized for the same function in both AMSAC and the reactor trip system, the components used in AMSAC are provided from a different manufacturer.
Common mode failure of identical components in the analog portion of the RTS that results in the inability to generate a reactor trip signal will not impact the ability of the digital AMSAC to generate the necessary mitigative actuations. Similarly, a postulated common mode failure affecting similar components in ESFAS, affecting its ability to initiate auxiliary feedwater, 0633v:10/063087
'\\
' and the same components in the AMSAC would impac~ the ability to automatically initiate auxiliary feedwater but not the ability of the RTS to generate a reactor trip signal.
7.8.1.10 Power Supply - The AMSAC power supply is a non-Class lE vital bus, which is independent from the RTS power supplies, and is backed by batteries which are independent from the existing batteries which supply the RTS.
7.8.Lll Environmental Variations - The AMSAC equipment is located in a controlled environment such that variations in the ambient conditions are minimized.
No AMSAC equipment is located inside containment.
The transmitters (steam generator level and turbine impulse chamber pressure) that supply the input into AMSAC are located inside containment and the turbine building, respectively.
The existing equipment inside containment is qualified.
7.8.1.12 Setpoints - The AMSAC makes use of two setpoints in the coincidence logic in order to determine if mitigative functions are required. Water level in each steam generator is sensed to determine if a loss of secondary heat sink is imminent.
The low level setpoint is selected in such a manner that a true lowering of the level will be detected by the system.
The normal small variations in steam generator level will not result in a spurious AMSAC signal.
The C-20 permissive setpoint is selected in order to be consistent with ATWS investigations showing that the mitigative actions performed by the AMSAC need not be automatically actuated below a certain power level.
The maximum allowable value of the C-20 permissive setpoint is defined by these investigations.
To avoid inadvertent AMSAC actuation on the loss of one main feedwater pump, AMSAC actuation is delayed by a defined amount of time. This will ensure the reactor protection system will provide the first trip signal.
To ensure that the AMSAC remains armed sufficiently long to permit *its function in the event of a turbine trip, the C-20 permissive is maintained for 0633v:10/063087
~ preset time delay after the turbine impulse chamber pressure drops below the setpoint.
The setpoints and the capability for their modification in the AMSAC are under administrative control.
7.8.2 Analysis 7.8.2.1 Safety Classification/Safety-Related Interface The AMSAC is not safety related and therefore need.not meet the requirements of IEEE 279-1971.
The AMSAC has been implemented such that the Reactor Trip System and the ESF Actuation System continue to meet all applicable safety-related criteria. The AMSAC is independent of the RTS and ESFAS.
The isolation provided between the RTS and the AMSAC and between the ESFAS and the AMSAC by the isolator modules and the isolation relays ensures that the applicable safety-related criteria are met for the RTS and the ESFAS.
7.8.2.2 Redundancy System redundancy has not been provided. Since AMSAC is a backup non-safety related system to the redundant RPS, redundancy is not required.
To ensure high system reliability., portions of the AMSAC have been implemented as internally redundant, such that a single failure of an input channel or ALP will neither actuate nor prevent actuation of the AMSAC.
7.8.2.3 Diversity from the Existing Trip System
.Diverse equipment has been selected in order that common cause failures affecting both the RTS and the AMSAC or both the ESFAS and the AMSAC will not render these systems inoperable simultaneously. A more detailed discussion of the diversity between the RTS and the AMSAC and between the ESFAS and the AMSAC is presented in Section 7.8.1.1.7.
0633v:10/063087
/.8.2.4 Electrical Independence The AMSAC is electrically independent of the RTS and ESFAS from the* sensor output up to the final actuation devices.
Isolation devices are provided to isolate the non-safety AMSAC circuitry from the safety-related actuation circuits of the auxiliary feedwater system.
7.8.2.5 Physical Separation from the RTS and ESFAS AMSAC needs to be and is physically separated from the existing protection system hardware.
The AMSAC outputs are provided from separate relay panels within the cabinets. The two trains are separated within the AMSAC cabinet by a combination of metal barriers, conduit and distance.
7.8.2.6 Environmental Qualification Equipment related to the AMSAC is qualified to operate under conditions resulting from anticipated operational occurrences for the respective equipment location.
The AMSAC equipment located outside containment in a mild environment follows the same design standard that currently exists for non-lE control grade equipment.
7.8.2.7 Seismic Qualification - It is required that only the isolation devices comply with seismic qualification. The AMSAC output isolation device is qualified in accordance with a program that was developed to implement the requirements of IEEE Standard 344-1975, "IEEE Standard for Seismic Qualification of Class lE Electrical Equipment for Nuclear Power Generating Stations....
7.8.2.8 Test, Maintenance, and Surveillance Quality Assurance NRC Generic Letter 85-06, "Quality Assurance Guidance for ATWS Equipment that is not Safety Related, 11 requires quality assurance procedures commensurate with the non-safety-related classification of the AMSAC.
The quali.ty controls for the AMSAC are. at a minimum, consistent with existing plant procedures or practices for non-safety-related equipment.
0633v:10/063087.
- nesign of the AMSAC followed procedures relating to equipment procurement, document control, and specification of system components, materials and services.* In addition, specifications also define quality assurance practices for inspections, examinations, storage, s~ipping and tests as appropriate to a specific item or service.
A computer software verification program and a firmware validation program have been implemented conimensurate with the non-safety-related classification of the AMSAC to ensure that the system design requirements implemented with the use of software have been properly implemented and to ensure compliance with the system functional, performance and interface requirements.
System.testing is completed prior to their installation and operation of the AMSAC, as part of the normal factory acceptance testing and the validation program.
Periodic testing is performed both automatically through use of the system automatic self-checking capability, and manually, under administrative control via the AMSAC test/maintenance panel.
7.8.2.9 Power Supply Power to the AMSAC is from a,battery-backed, non-Class lE vital bus independent of the power supplies for the RTS and ESFAS.
The station battery supplying power to the AMSAC is independent of those used for the RTS and
The AMSAC is an energize-to-actuate system capable of performing its mitigative functions with a loss of offsite power.
7.8.2.10 Testability at Power The AMSAC is testable at power.
This testing is done via the system test/maintenance panel.
The capability of the AMSAC to perform its mitigative actuations is bypassed at a system level while in the test mode. - Total system testing is pe'.formed as a set of three sequential, partial, overlapping tests. The first of the tests checks the analog input portions of the AMSAC in order to verify accuracy.
Each of the analog input modules is checked separately.
The second test checks each of the ALPs to verify that the 0633v:1D/062987
'I appropriate coincidence logic is sent to the majority voter.
Each ALP *is tested separately. Tile 1-ast test exercises the majority voter and ~he integrity of the associated output relays. The majority voter and associated output relays are tested by exercising all possible input combinations to the majority voter.
The integrity of each of the output relays is checked by confirming continuity of the relay coils witho.ut operating the relays. The capability to individually operate the output relays, confirm integrity of the associated field wiring, and operate the corresponding isolation relays and final actuation devices at plant shutdown is provided.
7.8.2.11 Inadvertent Actuation The AMSAC has been designed such that the frequency of inadvertent actuations is minimized. This high reliability is ensured through use of three redundant ALPs and a majority voting module.
A single failure in any of these modules will not result in a spurious AMSAC actuation.
In addition, a three-out-of-four low steam generator level coincidence logic and a time delay -
have been selected to further minimize the potential for inadvertent actuations.
7.8.2.12 Maintenance ByPasses The ~SAC is blocked at the system level during maintenance, repair, calibration or test. While the system is blocked, the bypass condition is continuously indicated in the main control room.
7.8.2.13 Operating ByPasses The AMSAC has been designed to allow for operational bypasses with the inclusion of the C-20 permissive. Above the C-20 setpoint, the AMSAC is automatically unblocked (i.e., armed); below the setpoint, the system is automatically blocked.
The opera~ing status of the AMSAC is continuously indicated in the main control room via an annunciator window.
0633v:10/062987
'\\
7.8.2.14 Indication of ByPasses Whenever the mitigative capabilities of the AMSAC are bypassed or deliberately rendered inoperable, this condition is continuously indicated in the main control room.
In addition t'o the operating bypass, any manual maintenance bypass is indicated via the AMSAC general warning sent to the main control room.
7.8.2.15 Means for ByPassing A permanently installed system bypass selector switch is provided to bypass the system. This is a two-position selector switch with 11NORMAL 11 and 11BYPASS 11 positions. At no time is it necessary to use any temporary means, such as installing jumpers or pulling fuses, to bypass the system.
7.8.2.16 Completion of Mitigative Actions Once Initiated The AMSAC mitigative actions go to completion as long as the coincidence logic is satisfied and the time delay requirements are met.
If the flow in the feedwater lines is re-initiated before the timer expire~ and the SG water level increases to above the low low setpoint, then the coincidence logic will no longer be satisfied and the actuation signal disappears.
If the coincidence logic conditions are maintained for the duration of the time delay, then the mitigative actions go to completion.
The auxiliary feedwater initiation signal is latched in at the component actuating devices and the turbine trip is latched at the turbine electro-hydraulic control system.
Deliberate operator action is then necessary to terminate auxiliary feedwater flow, clear the turbine.trip signal using the main control board turbine trip reset switch, and proceed with the reopening of the turbine stop valves.
7.8.2.17 Manual Initiation Manual initiation of the AMSAC is not provided.
The capability to initiate the AMSAC mitigative functions manually, i.e., initiate auxiliary feedwater, trip the turbine, and isolate steam generator blowdown and sampling lines, exists at the main control board.
0633v:10/062987
~.8.2.18 Information Readout The AMSAC has been designed such that the operating and maintenance.staffs have accurate, complete and timely information pertinent to the status of the AMSAC.
A system level general warning alarm is indicated in the control ro~m. Diagnostic capability exists from the t~st/maintenance panel to determine the cause of any unanticipated inoperability or deviation.
7.8.3 Compliance with Standards and Design Criteria The AMSAC meets the applicable requirements of Part 50.62 of Title 10 of the Code of Federal Regulations and the quality assurance requirements of NRC Generic Letter 85-06. *No other standards currently apply to the AMSAC.
0633v:1D/062987
SGS-UFSAR
_0633v:1 D/062687 4 of 4 Revision 6 February 15, 1987
' (
INSERT 7.1.2.8 Conformance to 10CFRS0.62*- The AMSAC conforms to the requirements of 10CFRS0.62 as discussed in Section 7.8.
0633v:1 D/062987
'J Section 15.4.5.3 15.4.5.4
- 15. 4. 6 15.4.6.1 15.4.6.2 15.4.6.3
- 15. 4. 7 15.4.7.1 15.4.7.2 15.4.7.3 15.4.7.4
. 15.4. 8 15.4.8.1 15.4.8.1.1 TABLE OF CONTENTS (Cont)
Title Locked Rotor Results Conclusions Fuel Handling Accident Identification of Causes and Accident Description Analysis of Effects and Consequences Conclusions Rupture of a Control Rod Drive Mechanism Housing (Rod Cluster Control Assembly Ejection)
Identification of Causes and Accident Description Analysis of Effects and Consequences Results Conclusions Containment Pressure Analysis Reactor Coolant System Breaks Method of Analysis 15.4.8.1.2 Mass and Energy Releases from the Reactor
- Coolant System
. 15. 4. 8.1. 3 15.4.8.1.4 15.4.8.2 Heat Sinks Containment Pressure Response Results Steam Line Breaks 15.4.8.2.1 Analytical Methods 15.4.8.2.2 _Mass and Energy Releases 15.4.8.2.3 Heat Sinks 15.4.8.2.4 Results 15.4.8.3 Subcompartment Pressure Analysis 15.4.8.4 Miscellaneous Analysis 15.4.8.4.1 Minor Reactor Coolant Leakage 15.4.8.4.2 Loss of Normal Containment Cooling 15.4.9 References for 'section 15.4 15.* _5 Anticipated 'fransients Uithout Scran 15.5.1 References for Section i5.5 15-viii 15.4-60 15.4-60 15.4-61 15.4-61 15.4-61 15.4-64 f5.4-64 15.4-64 15.4-69 15.4-74 15.4-77 15.4-77 15.4-77
- 15. 4-77 15.4-79 15.4-96 15.4-109 15.4-110 15.4-110 15.4-112 15.4-118 15.4-119 15.4-122 15.4-122 15.4-122 15.4-123 15.4-123 15.5-1 15.5-1 SGS-UFSAR Revision 6 February 15, 1987
15.5 ANTICIPATED TRANSIENTS WITHOUT SCRAM The worst common mode failure which is postul_ated to occur is the failure to scram the reactor after an anticipated transient has occurred.
A series of generic studies (1,2) on Anticipated Transients Without Scram (ATWS) showed acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow is initiated in a timely manner.
The final NRC ATWS rule (3) requires that Westinghouse designed plants install an ATWS Mitigation System Actuation Circuitry (AMSAC) to initiate a turbine trip and actuate Auxiliary Feedwater flow independent of the Reactor Protection System.
The Salem AMSAC design is described in Section 7.8 15.5.1 References for Section 15.5
- 1.
"Westinghouse Anticipated Transients Without Trip Analysis,"
WCAP-8330, August 1974.
- 2.
Anderson, T. M. "ATWS Submittal", Westinghouse Letter NS-TMA-2182 to s. H. Hanauer of the NRC, December 1979.
- 3.
ATWS Final Rule -
Code of Federal Regulations 10CFR50.62 and Supplementary Information Package,.._Reduction of Risk from Anticipat~d Transients Without Scram (ATWS1 Events for Light-Water-Cooled Nuclear Power Plants."
15.5-1 an244/4
STM.Gf.~. I j'
r I
D
- ..i..=-ar-r NJ'ii::.'7-.:"1 (5'-<li.E':"' a)
STEAM GEN. LOW-LOW WATER LEVEL 10 e
f
- A LOOP I 7
HI STE AM LI NE FLOW LOW STEAM LI NE PRESSURE LOOP 2.
lltl>.C.TOlt TllP (5HIECT ol.)
-.,..~,.,cc.u*-u--,_,,,,_
Ol'..... Cll-f\\..l~C-*-O*IC:.OC
--~*-fTnl**~o..*c-..
C..:oott~.. *-
.. ~....._.-...
LOOP '
S.-.F"[.TY l,..J'EC.T10"I (s... c.u ll)
LOOP.C oust<' '"C°"..... "_'" __ "'8C&.,,.0*-.1 O:.**M"TfODT.......
0.... 01... f.... r..
..._.aoo~.. -nn. *.,_,,,.. _
,, !l~
111/I~. !* !l-m~~~-1-cc-i-==---1 ii 3
--*-**-**. --I-.*--
l I
F
I D
RILJICT~R TRIP I
rR.:OIOJ B (s.. u:ri; I TvR6W'r""*""r
- t~M'ri /f"A/,/VKI
- ,. :.r
... A*I Jiii.. fUADla.JIE TlllJP p.4 REACTOR TRIP TRAIN oo\\ (~1<[fT &)
r
,.. DC. "°""' rAJLU...
CuNUli.N::M.A V*CCUUM L ~'>"-----~
AJJTOJT'o~
G'l....,£,S.3tJ~E'
'NT£1LOCK II TUABl~C. PROT'[C.TtON TUR*la.Jlf SAG. 011.
L~'F---~
(-"S A£9u1R[O BY' llfH~S)
TRIP*
lOVC.RSPl.t:O G[N'l:RATOR EIAOTl:CTION TllJllUSY' *JlllQ. ll'olllLUAlt MU.IU*L TRI~ (AT TUR&11UE)
OTH(.A !!llGNlllL&
SIONALS ----
,9T OTHE... ~)
AU-'ILIA"Y TR.. NSF"lt..
{NOTE 7) 10 TO I TO 01:"'11."-""0R I,.._,.cro,. TRIP TRI~
I
(~HU.Te_)
lllUTO STOP I
A 7
T,1'1811\\Jlf POWE.A
- fUH~*ll,I[. 1~PULSC. C.HAMBIE.P't P<;!E.S~URE)
~OUND*NT
' ' ' I ll:
,ii(:
- oe sos
~~
Is-s-
~
,-.IJ TO...,
(~H!.E.T 4)
I I
~---- - --,---,-J
~-/
___A _____________
r:::---------
1 *~
I l_
I~
I I
I lecoC* AUTOMATOC TO n£FtAT R[MOT!.
c.- ~o
?E:IM1'T
)r,!.,4$~C.,AC,"tVAT'I0~1
(~\\-\\ec:r i)
~
WITHDRAWAL.
tll.l.T 1)
--- - - ---~--------"'~-
VIA 1.01110 ql:FCR&;~CE
-- ---- '-------- *------~
NOfPl.CUllJOAl\\IT l ~~e A""'to.4' L.061c*1S t..IOT "iDU"IQA.. T.
IT~ 51."'Lft.\\e '" :l\\,,IPl.ICATaO FOlil: '"°PUT TO liAC.~ T1,Jll&*'-lli. T,.~ c111.c.u1T.
l~OL.A"T10M OE\\f1C;S. A..~OI ~*QU*~ID
!i.l!~EaN 1'"totli "60l,l*lliit AM~
c..1.ilCUl'T ANO ~-~--r~~~:~~-~:-~:_~1T~J 5
I OvCA~ET~~~:JTURf:
ovc;;t;;:,1*m;"'"EO'"OANT
- s"En 51 (SMIEETSJ L
Tut.~ ~
...... ~-s.~ci...1:t1.rHC.. LO'.ilNGCfTM6.
I
!~~~~~~:~:;~,J~~~l~;r~~~ ~~CP
\\IAl\\IE,CONV. FOM EA.l..M T'"t.... ltot.
Z.
R(DUNOANC'f' IS l~DtCJ..IED 11'4 li:lCnRD~ JO
~-~l.il!/Rl.MENJSCNLY.
3 l
I 1 T"** ~1.1.T,~ *OitMTICA\\. ~o" u""n*
I
- ,., 1. !.*C.!.PT ll'O~ Tl<t. na. kl.IM!!.I"-~,
"'"IC.H ""V. PREC.llD!!.D 8't' I 0.... ~ 11"0" IJNIT IOPl Z.
"-"°P~C.T1Vli.\\.'t("f.it.S: 1NDICATCD F'OPl UP*llT I 01'41.'f),
- 4.
GlKAl.TIJll ICITOllllG ""7TUTIC>I SKl1.D KIT CULlf JH[fHIAnSCCOCJOll..Ar.
'* ~~r~~~*~s~c.i==-~'"~~
ISCOttECTmmntr:ntA1lil*ClJTPUTOf"1H[
PllOTECflc.I UlGIC SYS"IDI AMI n<< ono TllEJI rs CDN:Ctm 1'0 TH[ T1'41N I llJTPUT.
1H[ 11111 W17'U1l.till[ llllJI SO "nt.lf [l"n1[1t *ILL Al:ru*n: 4 OEKllA.TIJllTJtlP.
I. 1'1 *NC)" UlGIC.tfCl f}£ f.SSXl.ltm P<![SSl.ff SlllJCKS l~TI IMJ6l/4Sfl MJST!E T[STID l'OllOOIC.IU.Y, *uLE 0. LO Af ~
- 1 nQJl l'\\....lflf TWIP.
n:sr Vil.KS.INJ TUTL10trs lilll:
Rl:QJ1flfD m l'RNIM ~
TtsTllG "3 m WR1FY N[SSUQ: STllTOt COoi'TACT surus.
- r.
THE llCAC1'0lt ca&...IH1' ~
lllS rnwut 90.l.o ac ttM'\\.£tm *ITHIN s1* CYQ...[S IN (JIO[R ro INSUI(
IXM'.lflSILln *rnt ~
LM"LJIJllCO..OI 1"1t1P OF hi: AUCTtll !'.XXl.NIT F'Uif' CIRUJrf 111£.1.KEAS.
JH[
TlUH5FUI roe L1111r lllAr l!lC EllOltm ~TlQ t CTCUS m.l IDTAI. OF Nlf f.11£.UOI THAN 10 CYO.ES lf'ntr:SYSTOfor.wuCS.U.:!llOl!kA.... llCP fRIP
~
'W.,=o..~ 10 :ra..E: LIMIT 1S *Cll' P\\.M' 2
I f
- t r D
llQI<;'.)£ ST~(i.llCJIUrt.Taitl U* LO. LOIJll ~"°lL.
(5MUT~J
~Ii.TY 1"'4~111.C'P'*ON
&*Go-1..-----'-~
(&... *&T 0)
TA.IP Qil.N\\llJMIJ:Lli.C:. ?ut<w..Pa PP*1 FP*l S&Fl.GUUI.
LOCIC*OWT
~.C..O\\.IT *t:Q~&NC.* G*-a.o.., -------~
~*G.w""'-'O SIC.MAL(J14. I}
MANUAL STOP, CONT,.OL ROOM(NGTa 1),----~
MANUAL liTOP 1 LOCAL(NGTH It eJ II 10.. 1i-t-
"'=-.*
8 1:,
I~:
~-~
- ~
At*
- ~*;~:*
- l.Tl-.M G~MTO" I.
(SHUT7)
ITIAM 6Ut6.*#ITO'l J' afl LOW L011f Ll:vlt..
(~Mil('T,)
TUABl~& DRIVIUI AllLFUO PUMPI S'f~TCM VALVCA (NOTf. J)
C:l..Q** au>Ncaow,..
l~'T*Or..1.....,..0~......
u......,............
l=01" ""-L 11.T~ Gl:Nl.'llUo,,TO~
6 5T1:*M G.l.NIJUo.TOfl 1 2/t LON \\.CW Ll~IL (5~HT 11 AM~C. A.C::.1U.... TIO...
!llG....... L
($1-tl!.ll 1)
NOTI~,Q(.11 LO 5.S OF' PQwl;ll' ~LC,MA.L Cl/I. J"'CBQvQLTA"'E
&.>T,... awi.~._5)
(.liH!?aT Ii) 3*1S He..
~----
WUU.JUAL (ONTll,OL
('llNTAOL Aou..
""111..UAL Cll*'1'1l0L LOCAL(..OU I) 1IJTIS:
I, TMINACDnlO.SWPI: ~
TillAIM I CDfTIU.S 1WP I: ~
,. Ul:llL coma. 0. N l\\NIJll llUIO P\\W CMRll1DU auono SllNl..5 J. uaL START MCI ITW' coma. Ill nc ICITTll Cll l\\'Dt l"lWS CMM1ms ALL CJM:* SlllW..S Dttl'I' FUI K W'COJilllDS Sl:Q.l)CllG SlllW..
- UXAL IMlltlm M:tualll """"' IN mma. lllJCM.
- 1. ~
1N11e.tru11 **coma.. '""*
- a.
MlTtJli Cl'IAAJU& LlllfTI Ill comQ. 11111.
- l. llCllYID.lllL.fCllPOIV.tt.YC **
I.
UGIVICUtll. fat UOt l'\\W.
~:1'
~'"
- . nc Tl.Ill:: sn:m camo..** f'l'PIClll..
ACTUl.L llft.DHJATUll MAT Nl
- ~
,., AM A£. LQIOo1C..... o, ~1.ou... o....... T. IT.$ S1G..........
I~ OuPL1CA.TliO ~01( *"-Pu't 'T'Q iAC~ A""AILIA~y i:ee,o...,,....,.ll ?Ul,4~ A.C.TIJATIC)t..& C:.11ilC.u1T. ISOL""T*O""
Oi;.,,1C.a~ Allt. ~liOV*RlO ~'C\\We,li~ 7HE ~OIJ*j£AMSA(
CJRCUITS AJJD THI! I~ AUlC.Fl!:DWATlR.5TARTCIRCU/J5.
lt.,r,?ul 70 TrtE A..........,A.51."I" =~tOWAlell: AC.lU4T*O""
C.:.1'<C.1J1T I~.A.T Tl'iii i::.1""""'- AC:TVATIO"" "::>'1\\f1C.I!
FOil l:AC'1 AU*1L..Uty j:°i!IOWA.Tllil: i'U*..,.
. Ll