ML19347A863
| ML19347A863 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 09/22/1980 |
| From: | Dale L MISSISSIPPI POWER & LIGHT CO. |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| References | |
| AECM-80-225, NUDOCS 8009300437 | |
| Download: ML19347A863 (102) | |
Text
,
O l MISSISSIPPI POWER & LIGHT COMPANY Helping Build Mississippi P. O. B O X 16 4 0, J A C K S O N, MISSISSIPPI 39205
)
NUCLEAA PRoouCTioN DEPARTMENT September 22, 1980 U.S. Nuclear Regulatory Commission Office of Nuclear Rer.etor Regulation Washington, D.C. 20555 Attention: Mr. Harold R. Denton, Director
Dear Sir:
SUBJECT:
Grand Gulf Nuclear Station Units I and 2 Docket Nos. 50-416 and 50-417 File 0260/0277/L-860.0/L-952.0 Transmittal of Responses to NRC Questions from ICSB AECM-80/225 As per the commitment in our letter to your Mr. A. Schwencer, AECM-80/161, dated July 25, 1980, we are providing advanced copies of our responses to NRC Questions 031.56 and 031.71. Also attached are revised responses to Questions 031.38, 031.54, 031.60, and 031.75.
These responses will be incorporated into the October,1980 amendment to the Grand Gulf Nuclear Station Final Safety Analysis Report (FSAR).
Please note that the revised response to Question 031.37, mentioned in the above referenced letter was submitted in the Amendment 42 to the FSAR.
Yours truly, i o
[ L. F. Dale Nuclear Project Manager JGC/JDR:Im Attachments: Responses to ICSB Questions
- 1. 031.38
- 2. 031.54
- 3. 031.56
- 4. 031.60 5.
6.
031.71 031.75
(
4, (
cc: (See Next Page) l i
I l
Member Middle South Utilities System
o- o Missis 5IPPI POWER & LIGHT COMPANY U.S. Nuclear Regulatory Commission AECM-80/225 Office of Nuclear Reactor Regulation Page 2 cc: Mr. N. L. Stampley Mr. R. B. McGehee Mr. T. B. Conner Mr. Victor Stello, Jr. , Director Division of Inspection & Enforcement U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Mr. G. W. McManaway E. I. Dupont DeNemou_a and Company Aiken Plant Aiken, South Carolina 29808
(7.3.2.1)
(7.3.1.2)
(7.3.2.4)
The discussion of how the GGNS instrumentation and controls satisfy IEEE Std 279-1971 Section 4.1 is incomplete. Quantify the bus voltage relay pick-up and drop-out values.
Relay voltages are as noted below.
Relay Voltages Rated Pick-up Drop-out Agastat GP 120VAC 102 12-48 Agastat GP 125VAC 100 12-50 Agastat TR 120VAC 102 12-48 Agastat TR 125VDC 107 13-50 GE HMA 115VAC 90 6-12 GE HMA 125VDC 75 6-12 GE HFA 115VAC 90 35-60 GE HFA 125VDC 75 3-13 GE CR2820 115VAC 98 70 GE CR2820 125VDC 100 50-75 QO31.038
sp -
cc
'. FSAR 031.54 Revise the tables and figures in Section 7.2 to remove the errors and inconsistencies noted below:
(1) The title of Table 7.2-1 is incorrect as the table does not specify anything but the trip setting and trip repeatability.
(2) Identify " Trip Setting" in Table 7.2-1 further.
Are these settings your expect to use or are they the span of the trip point adjustment? Does the
" Normal Range" refer to the " Instrument" or to the normal value during reactor operation? Is the
" Trip Setting" related to the transmitter output or to the actual sensed reactor vessel pressure (or level) at the time that trip is generated, with signal changing at the rate indicated under
" transient". (Does the setpoint include thc change in pressure during the response time of the I.PS?)
" Trip Setting" is an ambiguous term in relation to bypass functions, " Required Conditions" would be more meaningful. The accuracy figure for thc turbine stop and control valve trip bypass should be in % power for consistency.
+
(3) Resolve the discrepancy in Reactor Vessel High
- f. Pressure setpoint between tables 7.2-1 and 7.2-4.
(4) Provide justification for those trip functions in Table 7.2-4 that claim zero (or conservative direction only) instrument and setpoint drift.
(5) Resolve the discrepancies between the transient overshoot claimed in Table 7.2-4 and the values shown in various figures in Chapter 15.
(6) Justify the use of a '; Maximum overall" response time for the APRM that is less than the sum of the
" Design" values for the channel and the logic-actuator. Identify the meaning of " Design Response Times" in the context of whether these are maximum acceptable values, neininal values, etc. and how they are related to " transients" in Table 7.2-1.
Justify the exclusion of the flow weighted APRM neutron flux trip from the table, s
(7) Revise Figure 7.2-2 to show that the APRM trip is not only operable in other modes than Run but that the setpoint is lower if the mode switch is not in Run.
(8) Revise Figure 7.2-5 to correct the error in contact condition for contacts E and G (the contacts should be closed) in the turbine stop valve closure channel.
(This error has been noted in a number of other BWR FSAR's.) g 3/g (9) Resolve the discrepancy in the APRM trip functions
)
between Figure 7.2-6 and Figure 7.6-12.
(10) Steam line B, Outboard Valve is misidentified in )
the key to Figure 7.2-8. l l
- s s
Response 031.54
- 1. through The ' title of Table 7.2-1 is general and not misleading
- 6. and the data presented in the tables contain some hardware implementation information on the function performed.
Extensive hardware data beyond the function, equipment type and equipment range is not necessary. The Technical Specifications will develop the trip setpoint from the design basis information which takes into account the transient response of the total system. Also accounted for in the Technical Specifications is the margin which includes allowances for instrumentation accuracy, calibration error, sensor response times and sensor and setpoint drift. See revised Table 7.2-1 and text which are compatiable with the revised tables and text in response 031.60. Tables 7.2-4 & 6 will be deleted because they are not necessary. The necessary functional information is provided in Tables 7.2-1, 2 and 3 along with Figure 7.2-1. The table revisions will be coordinated with the development program for Grand Gulf Technical Specifications. See Attachment A of response 031.60 which provides supporting discussion as to technical specification development and the parameters utilized. The flow weighted APRM neutron flux trip has been added into Table 7.2-1.
- 7. Figure 7.2-2 has been revised to add the lower APRM setpoint for the non-Run mode condition.
- 8. Figure 7.2-5 is being revised in conjunction with Questior.031.56.
- 9. This error was corrected with the response to 031.48 by closing the APRM trip contacts. Figure 7.6-12 depicts the contacts in the tripped (open position). Figure 7.6-12 has a note at the base of the page which highlights the configuration.
- 10. Figure 7.2-8 has been revised.
TABLE 7.2-1 REACTOR PROTECTION SYSTEM INSTRUt1ENTATION SPECIFICATIONS Sensor Allowable Plant Variable Instrument Range (1) Channels Provided (2) Setpoint Range Reactor vessel high pressure Pressure Transmitter 0 to 1500 psig 4 channels, I per trip 150 to 1350ps.
logic Drywell high pressure Pressure Transmitter 0 to 5 psig 4 channels, 1 per trip 0.5 to 4.5 psi logic Reactor vessel low water Level transmitter -160/0/60"H 2O 4 channels, 1 per trip -138/0/38"H 2O level (3) logic Scram jischarge volume high Level transmitter 0 to 150" H 2O 4 channels, 1 per trip 15 to 135" H 20 water level logic (AE) Turbine stop valve closure Pressure Transmitter 0-200 psig 4 channels, 2 per trip 20 to 180 psig logic 16 to 144 psig Turbine control valve Pressure Transmitter 0-160 psig 4. channels, 1 per tr_ip (AE)
~~
fast closure logic Main stem line isolation Position Switch 99*/pOPcAto 4 channels, 2'per trip % % % To valve closure s k Opaw logic goo %q a APRM High Flux Trip Neutron' Monitor 0-125% Power 4 channels, 2 per trip 12.5 to 112.5' (Flow Biased) logic Power APRM liigh Flux Trip Neutron Monitor 0-125% Power 4 channels, 2 per trip 12.5 to 112.5T logic Power (Thermal Power)
Main Steam line high Gamma detector (4) (4) (4) radiation Reactor vessel high water Level transmitter -160/0/60"H 2O 4 channels, I per trip -138/0/38"If20 level (3) logic 4
5
. . o
- CONTINUED - ,
TA3LE 7.2-1 REACTOR PROTECTION SYSTEM TRIP BYPASS SPECIFICATIONS Sensor Allowable Instrument Range (1) Channels Provided (2) Setpoint Range Bypass Function Discharge volume high water Manual Switch N/A 4 channels,1 per trip N/A level trip bypass logic Trubine stop valve and Pressure Transmitter 0.to 100% Power 4 channels, 1 per trip 10 to 90%
logic Power control valve fast closure trip bypass Main steam line isolation Manual Switch N/A 4 channels, 1 per trip N/A valve trip bypass logic (1) See technical specifications for operational limits, levels requiring protective action, accuracy, trip settings, margin between operational limits, and response time requirements.
(2) See technical specifications for minimum number of channels required.
(3) A comon level transmitter is used for both high and low reactor vessel trips - separate trip units monitor the common level signal.
(4) See Containment and Reactor Vessel Isolation Ccntrol System Instrumentation Specification, Table 7.3-10.
k OCCC 0D ** *
(n %ie,h ( w c.keodcA\ saI% md ca% h Ed'f ad TD%# 's t
i%
e I'
NEUTRON MONITORING NEUTRON M AIN STE AM APHM TRIP MONITORING LINES ISOLATE 0 H5% SETPOINT) IRM TRIP 1 l l l I TURBINE MODE SWITCH MODE SWITCH CONTROL VALVE FAST gg IN OTHER THAN IN RUN RUN MODE CLOSURE I -3.
g=
TUR8tNE STOP VALVE VOLUME th CLOSURE tis NUCtEAR SCR AM N
UTH
/ f5 re OISCH ARGE MON: ING POWER SYST E M MANUAL VOLUME W AT E R MT > 30% R ATED PHESSURE HIGH LEVEL HIGH SC AL E. INO
/
M AIN ST E AM REACTOR REACTOR OBSCH VOL VESSEL HIGH ORYWELL L8NE MODE SWlTCH VESSE L W ATE R HIGH LEVEL -
TION W ATE R LEVEL sN SHUTOOWN PRESSURE HIGH NOT OYPASS HAD,8 g
LEVE L LOW I g 8
MOOE SWITCH MODE MODE SW CHIN IN RUN SWlTCH IN RUN SWITCH IN RUN STARTup I I l \1
_1 \
AkutNn /> ten /Wthy SCRAM M Y CTb** mal AMr, Vr*<*/e, /n&
MISSISSIPPI POWER & LIGHT COMPANY REACTOR PROTECTION SYSTEM GRAND GULF NUCLEAR STATION SCRAM FUNCTIONS UNITS 1 & 2 FIGURE 7.2-2 FIN AL SAFETY ANALYSIS REPORT AMEND.39 5/B0
- /
t y . \* qvntsow 05/, &
e 5
Q NEUTRON MONITORING SYSTEM SENSOR TRIP CH ANNELS I' b/ sR M LPRM LPRM DET ECTOR (OTHER DETECTOR DETECTOR DETECTORS)
AMPLIFIER AMPLIFIER AMPLIFIER (LPRM) (LPRM)
S E I MONITORING SYST EM f' IIf l '1 ' f
, p, ,,
'/fi',., 7 0 f,@ O INOP TRIP
%x u OA'"
,A>
d ' %YPASS 87pas @ (^) @ ilt=
h3 I' f %
) '> 'S M INOp UPSCALE TRIP //
-l (ONE OF EIGHil *
(ONE OF EIGwit l
_l. e l e py
- ~ IRM 4e
I _l, r -
-- h yyp4gg INOP IN RUN IR M
< a "I y,
- UPSCALE g 1 i
e i e -ee
" ^Jc","
l APRM I I A APRM UPSCALE TRIP NEUTRON
~V M
W l
REACTOR SYPASS l PROTECTION SYSTEM APRM Q v
l l
UPSCALE TRIP l THERMAL I O w ee n m e 4er y se sto. k les hO h c.w ,, e@+)
NOTE: CONTACTS SHOWN IN Y NORMAL CONDITION l
I I a
l MISSISSIPPI POWER & LIGHT COMPANY AI H BEMEEN NEUM
' ^ ^
O' GRAND GULF NUCLEAR STATION PROTECTION SYSTEM 4
FINAL SAFE ANALYSIS REPORT D.
1
. a *-
.r[hcrocrofoursensortripchannelsforecchvariablo, although
" ors than one sensor per variable may provide inputs to each trip Logic. The sensor trip channels are designated as A, B, C, or -
D. Each sensor trip channel is associated with one trip logic.
Thgro are four trip logics, which are designated as A, B, C, or $
D.
The output signals from the actuator output logics associated with trip logics A and C are connected to one pilot scram valve solenoid in red grdups 1, 2, 3, and 4 The output signals from the actuator
- output logics associated with trip logics B and D are connected to
- ho second pilot scram valve solenoid in rod groups 1, 2, 3, and 4 F
+
During normal operation, all sensor trip and logic trip contacts f essential to safety are closed; channels, logics, and actuators are energized. In contrast, however, trip contact bypass channels consist af normally' open contact networks. "f ",j Table 7.2-1 hsra were im pl em ea+atio,n in{cemsha,n on % e Sac 46
'f-__...- L. . . . _ _ _ -
.x : ;:
a P4
-weessowsmterlists the g - igure 7.2-2 summarizes the reactor protection
% system. F system signals that cause a scram.
The functional arrangement of sensor trip chtanels is shown in Figures v 7 .' 2 - 3 , 7.2-6, 7.2-7, and 7.2-8. Trip logics are shown in Figure ,-
7.2-5. Actuator output logics are shown in Figure 7.2-0 When a 3ensor trip channel operates, its relay de-energizes its associated trip logic and actuator output logic de-energi:es the scram pilot alve solenoids associated with that actuator output logic. However, the other scram pilot valve solenoid for each rod must also be de-energized before the rods will be scrammed.
There is one pilot scram valve with two solenoids and two scram .
valves for each control rod, arranged as shown in Figure 7.2-1.
Cach pilot scram valve is solenoid operated, with the solenoids nornally energized. The pilot scram valve controls the air _
supply to the scram valves for each control rod. With either 5
.ilot
, scram valve solenoid energized, air pressure holds the a scram valves closed. The scram valves control the supply and j iischarge paths for control rod drive water. Figure 7.1-1 i shows how the scram pilot valve solenoids for each control rod are controlled by the actuator output logics.
=
Nhnn the necessary actuator logics are tripped for one group of 5 scrtm valves, air is vented from the scram valves and allows control ,
rod drive water to act on the control rod drive piston. Thus, all m control rods are scrammed. The water displaced by the movement of ecch rod piston is vented into a scram discharge volume, h9* D 3D) h bdhdbddb M-J 7.2-2 Amend. 38 4/S0 OMG
..s'.-
GG FSAR 7.2.1.2.2 Variables The generating station variables which require monitoring to _p provide protective actions are identified in Table N '
7.2.1.2.3 Sensors A minimum number of 14 LPRMs per APRM are required to provide o adequate protective action. This is the only variable which has dL spatial dependence as discussed in IEEE 279, paragraph 3.3. 'cj 7.2.1.2.4 Operational Limits Prudent operational limits for each safety-related variable trip setting are selected to be far enough above or belowItnormal is then oper-ating levels so that a spurious scram is avoided.
verified by analysis that the release of radioactive material, following postulated gross failures of the fuel or the nuclear system process barrier, is kept within acceptable bounds. are @
Design basis operational limits ~
based on operating experience and constrained by the safety C design basis and the safety analyses. y *s-7.2.1.2.5 Margin Between Operational Limits
- s The margin between operational limits and the limiting conditions ,
' *Y*' E'* Y " 'Y' '" . "
[?chphtS 555$$h5Abi?r? -
The margin includes the maximum Annunciators are allowable provided, accubacy at error and s,ensorthe set
, . set point drift.
'"F'__...._.m ~.: L to alert the reactor operator of the onset 7 -- s y4CL .
of unsafe conditions.
7.2.1.2.6 Levels Requiring Protective Action Levels requiring protective action are Yh4 - ' --
' " f
~ ' '
design basis setpointh and are at least as i limitingasthelimitingsafetysystemsettingsprovidedinIkl W Technical Specification. o Yb 7.2.1.2.7 Ranges of Energy Supply and Environmental conditions M
' d The reactor protection system (RPS) 120 V ac power is provided by high inertia MG sets. Voltage regulation is designed to respond to a. step load change of 50 percent of rated load with an output voltage change of not more than 15 percent. The flywheel on each MG set provides stored energy to maintain voltage and. frequency within
+5 percent, for one second, preventing momentary switchyard tran-sients from causing a scram. RPS relays and contactors will oper-ate without failure within the range of -15 percent.to +10 percent r
7.2-29 C 3/. 57 1
. og
. FSAR area of one of the panels, the RPS functions would not be prevented by the fire. The use of separation and fire barriers ensures that, even though some por-tion of the system may be affected, the RPS will con-tinue to provide the required protective action. .
Refer to subsection 9.5.1 for additional information on plant fire protection.
- e. LOCA The following RPS subsystem components are located inside the drywell and would be subjected to the effects of a design basis loss-of-coolant accident (LOCA) :
- 1. Neutron monitoring system (NMS) cabling from the detectors to the control rocm i
- 2. Reactor ve'ssel pressure and reactor vessel water )
level instrument taps and sensing lines and drywell pressure sensing lines, which terminate outside the i drywell These items have been environmentally qualified to remain functional during and following a LOCA as discussed in Section 3.11 and indicated in Table 3.11-3.
l
- f. Pipe Break l Protection against dynamic effects associated with the postulated rupture of piping is discussed in Section 3.6.
- g. Missiles Missile protection is described in Section 3.5.
7.2.1.2.9 Performance Requirements The minimum performance requirements are shown N [n +ke Technical P v
~
S A logic combination (one-out-o f- two- twice ) of trip logic division =
trips, actuated by abnormal or accident conditions, will initiate l i a scram, and produces independent logic seal-ins within each of the four trip logics. The trip conditions will be annunci-l1 2p[j/
=
ated and recorded on the process computer. The trip seal-in will maintain a scram signal condition at the control rod drive system e
{[i terminals until the sensor trip channels have returned within their r normal operating range and the trip logic seal-in is manually reset g by operator action. Thus, once a trip signal is present long enough to initiate a scram and the seal-ins, the protective action will go to completion.
Amend. 38 4/80 7.2-31
. ,; *. T -
GG TSAR To ensure that the reactor protection system remains functional, ore the number of operable sensor channels f or t. essenti T 4 := Da h..
in . ..maigAh 1ek Aj h"ari- .
cbles is maintained at or above the minimums iven tripped actuator output b" jdEE
- .___.-..-7 The minimums apply to any g logics; a tripped logic may have any number of inoperative sensor channels. Because reactor protection requirements vary with the mode in which the reactor operates, the tables show different functional requirements for the RUN and STARTUP modes. These are o the only modes where more than one control rod can be withdrawn Qh}g N
from the fully inserted position.
In case of a loss-of-coolant accident, reactor shutdown occurs immediately following the accident as process variables exceed their specified set point. Operator verification that shutdown has occurred may be made by observing one or more of the fol-lowing indications:
- a. Control rod status lamps indicating each rod fully inserted
- b. Control rod scram pilot valve status lamps indicating open valves s
- c. Neutron monitoring power range channels and recorders downscale,
- d. Annunciators for RpS variables and trip logic in the tripped state _
- e. Process computer logging of trips and control rod position log Following generator load rejection, a number of events occur in the following chronological order:
- a. The pressure in the EHC lines to the control valves ;
drops, signaling the reactor protection system and pressure /antroller to open the turbine bypass valves to maintn.in reactor pressure.
- b. The reactor protection system will scram the reactor concurrently upon receipt of the turbine control valve fast closure signal.
The reactor scram will be averted if at the time of load rejection the unit load is equal to or less than a given value. This load value is 30 percent of rated power output.
- c. The trip setting of the APRM channels will be auto- i matically reduced from 120 percent to 87 percent of l neutron flux as recirculation flow is run back from l
7.2-38 Amend. 38 4/80 ,
0 3/< Jf
- GRAND GULF QUESTION 031.56 The following discrepancies between the actual plant drawings and the FSAR discussion and figures were noted in the review of Section 7.2.
- 1. The channel Test Switch shown in Figure 7.2-5 does not appear on the Reactor Protection System Elementary Diagram C71-1050 (Revision 7).
This test switch is mentioned a number of times in Section 7.2.2 and is offered as a " backup to the manual scram". The switch is also identified as the first contact in the trip channel logic.
- 2. Section 7.2 and Figures 7.2-5, 8 indicate that there are two isolation valves in each steam line and that they are connected into the scram logic so that valves in at least three systems must be closing to generate a scram. The trip is key bypassable in all operating modes but "Run". Drawing C71-1050 (sheets 5 through 9) confirms this trip circuit but also shows a separate unbypassable trip (not mentioned in Section 7.2) connected in 1 out of 2 twice logic that is derived from a third isolation valve in each steam line. The presence of a third valve in each steam line is verified by the P&I Diagrams in Section 5.2.
- 3. Section 7.2.1.2.8 indicates that there are no RPS pressure transmitters inside the drywell; however, Drawing C71-1050 (sheet 17) locates the transmitters for reactor pressure; drywell pressure, reactor level and scram discharge volume level inside the drywell. Drawing C71-1070 (Revision 1) agrees with Section 7.2.1.2.8.
- 4. The FSAR states that both the turbine stop valve and the turbine control valve protective system trips utilize pressure transmitters that are sensing hydraulic pressure for the valve operating mechanism.
The trip point for the two systems is indicated to be approximately 40 psig with normal system pressures of 42-70 psig (control valve) and 165 psig (stop valve). The system drawings and specifications you provided indicate that the trip signal for the stop valve is generated by position switches mounted on the valve (some of the FSAR discussion appears to corroborate this design). The drawings indicate that the control valve trip is initiated by a pressure switch. The design specification data sheet indicates that normal hydraulic pressure is 1100-1500 psig and that the trip point is 850 psig.
- 5. The FSAR states that identification of the specific channels that tripped is obtained from computer typeout or by visual observation of the relay contacts (7.2.2.1.2.3.1.19). The contact positions could not be observed on the relays in the trip unit cabinets that we were shown. Verify that the contact status of relays associated with RPS trip units can be readily observed.
1 0793 l
1
- GRAND GULF QUESTION 031.56 (Continued)
- 6. Drawing C71-1050 indicates that arming of the manual scram is an alarm condition and implies, therefore, that the manual scram is normally disanned. The FSAR, Section 7.2.1.1.4.2, indicates that the manual scram switches in each group are " located close enough to permit motion of one hand to initiate a scram", implying that switches are normally armed.
! Resolve the discrepancies noted above and correct the appropriate-document. Verify that the instruments and controls described in all of Chapter 7 are the systems that are being installed. In the case of the manual scram pushbuttons, justify the use of armed pushbuttons and the logic of operating with a disarmed system- Include in Segtion 7.2.1 a complete description of the steps in the actuation of a manual scram, in each reactor mode, if any differences exist between modes.
0793
.~
GRAND GULF RESPONSE TO QUESTION 031.56 Resolution of the discrepancies noted (between plant drawings and FSAR discussion and figures) is as follows:
- 1. The RPS Elementary Diagram C71-1050 is correct in not showing the channel test switch. The errors in the FSAR pages 7.2-44, 51, 67, and Figure 7.2-5 will be corrected to remove the contacts from the text and the figure.
- 2. The RPS Elementary Diagram C71-1050 is in error. The third MSIV trip has been deleted from Grand Gulf. The drawing will be revised
-% A b h b daAe. h .
- 3. The RPS Elementary Diagram C71-1050 is in error. The drywell penetrations will be deleted and the drawing revised,
- 4. The system drawings and specifications are being revised to reflect.
the unique features of the turbine in Grand Gulf, as described in the FSAR discussion and figures.
- 5. The relay contact observation is no longer used because the trip units show an indication of trip status. Additionally, the control room RPS annunciators also indicate the circuit status. The dis-cussion in Section 7.2.2.1.2.3.1.19 has been appropriately revised (attached).
- 6. uYes four armed pushbuttons to prevent inadvertent actuation especially during testing when a half-scram (one trip logic tripped) condition ey.ists. The manual scram switches are normally disarmed. The switches are armed by rotating a collar device on the switch; the aming of the switch and depressing the pushbutton can be performed nearly simultaneously and with one hand. When the collar device is rotated, an alarm on the panel is sounded to indicate the switch in the armed condition. The pushbutton .
cannot be depressed in the unarmed condition.
There are no differences in the steps required for the actuation of a manual scram in the various reactor modes.
-la-0793
,- Qp % ~ 3\e S~L.
- oc
- FSAR steam high radiation, trip initiation and protective action will have been initiated from these other independent variables.
The suitability of main steam line radiation detection locations can be determined from the instrument location drawings provided by reference in Section 1.7, and the environmental condition of the RPS described in sub-section 3.11.2.
- j. Reactor Vessel High Water Level High level indicates an increase in feedwater flow and impending power increase. The high-water-level trip causes a scram prior to significant power increase, limiting neutron flux, and thermal transients so that the design basis is satisfied.
- k. Manual Scram gh f05Q)an .$
A scram can be initidtea manually. There are four scram buttons, onedfor each trip logic (A, B, C, D).
g,gggg g initiate a manual scram, at least two buttons must The manual scram logic is the same as egdepressed.
the automatic scram logic. The manual scram buttons are arranged in two groups of two switches. One group o contains the A and C switches and B and D are in located the other group. Th g g g g a g o nup are o initiate a I.'
close enough to permi -
7 _
_____3 ,
m scram. By operating the manual scram button for one trip logic at a time and then resetting that logic, each actuator output logic can be tested for manual scram capability. The reactor operator also can scram the reactor by interrupting power to the reactor protection system or by placing the modo switch in its shutdown position.
- 1. Mode Switch in SHUTDOWN o
The reactor mode switch initiates a scram when the keylocked switch is placed in the SHUTDOWN position. t The four channels on the modo switch (A, B, C and D) -
are niparated by nicol barriers within a utect can, &
an dencribid in nubnection 7.2.1.1.4.7 The m<>do switch logic is the same as the manual scram (de-energizing the same logic device). A short time delay logic device ,
automatically removes the scram signal (i.o., re-energizes the circuit to bypass the shutdown scram) on the fail-safe logic, as described in subsection 7.2.1.1.4.4.5.
The " modo switch in SIIUTDOWN" scram is not considered a protective function, as discussed in subsection 7.2.1.1.6.3 paragraph 1. Therefore diversity and redundancy of trip function are not required (5ut may be considered a diverse backup to manual scram).
- 7.2-12 tsr9. '" "/**
J b
. FSAR Bypasses of other scram initiations are mediated by the i mode switch (as deceribed in subsection 7.2.1.1.4.4), l namely the neutron monitoring system trips, main steamline ]
isolation trip, reactor high water level, and scram discharge volume. The mode switch contacts energize logic devices, which bypass the instrument channel trips connected to RPS trip logics. The circuits are designed to be normally energized (fail-safe on loss of power) and single failure tolerant.
Interlocks between the reactor mode switch and the o other systems are discussed in subsections 7.2.1.1.4.4.7 %
and 7.2.1.1.6.2.1. b e
The APRM upscale trip for low power operation versus that for high power operation is selected by the mode switch being out of or in the "RUN" position, respectively.
Refer to Technical Specifications, Chapter 16 for the ;
APRM setpoints. l The main steamline isolation trip on low' turbine inlet pressure is bypassed when in "STARTUP & HOT STANDBY", j
" REFUEL" or "GIIUTDOWN" modes. Refer to subsection 7.3.1.1.2.4.1.5, " Containment and Reactor Vessel Isolation System."
Mode switch functions are summarized on Table 7.2-7. l 7.2.1.1 3 oi The basicjlogic arrangement of the reactor protection system is illustrated in Figure 7.2-1. Each actuator output logic r'eceives w signals from trip logics as shown in Figures 7.2-4 and 7.2-5. -
Each trip logic receives input signals from at least one sensor b4 u trip channel for each monitored variable. At least four channels
- for each monitored variable are required, one for each of its four sensor trip channels.
Sensor trip channel and trip logic relays are fast-response, high-reliability relays. Power relays for interrupting the scram pilot valve solenoids have high current carrying capabilities and are highly reliable. All reactor protection system relays are selected so that the continuous load will not s exceed 50 percent of the continuous duty rating. The system j response time, from the opening of a l
l 7.2-12a Amend. 38 4/80 l 19
GG FSAR O solenoids per control rod. Both solenoids must de-energize to bleed the instrument air from and open the inlet and outlet scram valves to allow drive water to scram a control rod. One solenoid a receives its signal from two actuator output logics and the other %
from the other two actuator output logics. The failure of several b control rods to scram will not prevent a complete shutdown. The instrument air system provides support to the RPS by maintaining the air-operated scram valve closed until a scram is required.
1 The individual control rods and their controls are not part of the reactor protection system. For further information on the scram valves and control rods see Section 4.6.
s olenoid.s Theu3 rom
, pilot cricn;id valver are g supplied from the 120 V ac RPS MG 37 Sets A and B.
In addition to the two scram valves for each control rod drive, there are two backup scram valves which are used to vent the common header for all control rods. Both backup scram valves are
- energized to initiate venting and are individually supplied with 125 V de power from the plant batteries. Any use of plant instru-
.mont air system for auxiliary use is so designed that a f ailure of the air system will cause a safe direction actuation of the safety device.
O -
7.2.1.1.4.7 Separation Four independent sensor channels monitor the various process variables listed in subsection 7.2.1.1.4.2. The sensor devices are separated such that no single f ailure can prevent a scram.
All protection system wiring outside the control system cabinets is run in rigid metal wireway. Physically separated cabinets or o cabinet bays are provided for the four scram trip logics. The elec- l$
trically separate arrangement of RPS sensors mounted in local .
racks is shown in Figure 7.2-3. In situ locations for local $ l RPS racks and panels are shown on the instrument location drawings provided by reference in Section 1.7. Cable routing from sensor to control room panel is shown in raceway plans, provided by !
reference in Section 1.7. The criteria for separation of sensing *
)
lines and sensors is discussed in subsection 7.1.2.2. l The mode switch, scram discharge volume high water level trip bypass switches, scram reset switches, and manual scram switches l41 are all mounted on one control console. Each device is mounted in a metal enclosure and has a sufficient number of barrier devices'to maintain adequate separation. Conduit is provided from the metal enclosures to the point where adequate physical separation can be maintained without barriers.
8 The outputs from the actuator output loaic to the scram valves are -
run in four wireways. hO Amend. 41 7/80 7.2-18
~'
. GG FFAR 7.2.2.1.2.3 Conformance with Industry Codes and Standards c4 ,
.sk 39 7.2.2.1.2.3.1 IEEE Standard 279-1971 The reactor protection (trip) system confonns to the require- 8 ments of this standard. The following is a detailed discussion .
of this conformance. g 7.2.2.1.2.3.1.1 General Functional Requirement (IEEE Std. 279-1971, paragraph 4.1)
The following RPS trip variables provide automatic initiation of protective action in compliance with this requirement:
1
- a. Scram discharge volume high-water-level ip
- b. . vain steam line isolation valve closure trip
- c. Turbine stop valve closure trip
- e. Reacter vc ssel low- and high-water-level trip M-ir.
- f. tear line high-radiation trip g,
- g. Neut?.on monitoring (APRM) system trip 6> 4/
- h. Neutron Mcnitoring (IRM) system trip p
- i. Drywell high pressure trip ye.
- j. Reactor vessel high-pressure trip -
The reactor system mode switch selects appropriate. operating by-passes for various RPS variables in the shutdown, refuel, startup, and run modes of operation. Other manual controls, such as the ' '
ia _ ,- L., . . __-..i-~...., the manual scram pushbutton switches, and the RPS reset switch are arranged so as to assure that the process variables providing automatic initiation of protective action will continue to remain in compliance with this require-ment.
The RPS reset switch is under the administrative control of the operator. Since the reset switch, through auxiliary relay contacts, is introduced in parallel ~with the trip actuator seal-in contact, failure of the reset switch cannot prevent initiation of protective action when a sufficient number of trip channels assume the tripped condition. Hence, the automatic initation requirement
,,, for protective action is not invalidated by this reset switch.
- The hPS trip lc ;ic, actuator output logic, and trip actuators are .
^ '
inad to corr'y with this requirement through automatic removal m e
7 ?-44 Arrnd. 41 7/60
RPS manual controls also comply with the single f ailure criterion. *a"*
'" ::; rrt: icip 2:;1: t::t critr5 12 pre-!?r d i- ?--k ~*+k-r - i..la.. TJ" ::ip 1;gic:. Four manual scram pushbuttons are arranged into two groups on the operator's control console, and are separated by approximately 6 inches within each group to permit the operator to initiate manual scram with one motion of one hand.
The two groups of manual scram punhhuttons are separated by approximately 3 feet, and the switch contact blocks are enclosed bm6cc sqmE4d within tuetal barriers. g @ J-% d#
The mode switch consists of a single manual actuator /e:. ::ted te fcur distinct ;ritch banks. Each bank in housed within a fire retardant cover. Contacts from each bank are wired in conduit to individual metallic terminal boxes.
Since the scram discharge volume high-water-level trip operating bypans requires manual operation of a bypass switch and the mode switch to establish four bypass channels, the design ofFor thetheby-by-pass function complies with this design requirement.
pans switch, a single operator connect 3 to four physically and electrically separated blocks of switch contacts within the nwitch body. Wiring from the contacts is routed in conduit to separate metallic terminal boxes. One set of switch contacts in conjunction with mode switch contacts is used to energize each trip channel bypass relay when the bypass condition is desired.
There is no single failure of this bypass function that will satisfy the condition necessary to establish the bypass condi-tion. Hence, this function complies with the single-failure criterion.
The main steam line valve closure trip operating bypass is imple-reented with redundant mode switch contacts in a similar manner.
The turbine stop valve closure trip and control valve f ast clo-sure trip operating bypass complies with the single-failure cri-terion. Two pressure transmitters are mounted on each of two turbine first stage pressure taps. Wiring from the pressure transmitters is routed in conduit to the RPS cabinets in the control room.
The logic configuration for the bypass is the standard one-out-of- o two twice arrangement such that a single bypass is associated with h a singic trip logic for stop valve closure and a single trip logic ;
for control valve fast closure. m No single failure of this bypass circuitry will interfere with the normal protective action of the RPS trip channels.
The RPS reset switch and associated logic comply with this design requirement. The reset switch is constructed with a single oper-ator and two physically and electrically separated contact blocks.
- 'n wires from the contact blocks go through conduit to metallic te.minal boxes.
3 l
7 T-16 Amend. 38 4/80 g
8 g
Each sensor trip channel output relay uses two contacts (in series)
O within the RPS trip logic. One additional contact on each relay is wired to a common annunciator in the control room and another l$
g contact on each relay is wired to the process computer cabinets, both through electronic isolation devices, to provide a written log of the channel trips. There is no single failure that will prevent proper functioning of any protective function when it is required.
The main steam line isolation valve limit switch contacts for RPS use are routed through separate conduit connections relative to the other limit switches used for indicator lights in the control room. Af ter the cabling emerges f rom the limit switch j unction box associated with each main steam line isolation valve, it is routed separately from any other cabling in the plant to the RPS panels in the control room.
Turbine stop valve closure and turbine control valve fast closure pressure sensor outputs are routed in Class IE conduit or wireways to the logic cabinets in the control room.
Within the IRM and APRM modules (i .e. , prior to their output trip unit driving the RPS) analog outputs are derived for use with control room meters, recorders, and the process computer.
Electrical isolation has been incorporated into the design at this interface to prevent any single failure from influencing the O protective output from the trip unit. The trip unit outputs are physically separated and electrically isolated from other plant equipment in their routing to the RPS panels.
I); .? #$El.. f.d..f .Ei. f-c t 5".._b if ' b.f.__ f fi_$ _ !",..___~_2..
IEmff2 35i_S"E_f"_-_bf__
JE The manual scram pushbutton has no control interaction.
The reactor system mode switch is used for protective functions and restrictive interlocks on control rod withdrawal and refueling equipment movement. Additional contacts of the mode switch are used to disable certain computer inputs when the alarms would represent incorrect information for the operator.
No control functions are associated with the mode switch. Hence, the switch complies with this design requirement. The 3:ystem interlocka to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system.
The RPS scram discharge volume high-water-level trip bypass cir- l37 cuitry complies with this design requirement. For each trip channel bypass relay, four contacts are used in the bypass logic.
One contact of each relay is also wired to a common annunciator in the control room and one contact is wired to the control O rod block circuitry to prevent rod withdrawal whenever the trip channel bypass is in effect. There are no control sys-d 7.2-51
During plant operation, the operator can confirm that the main steam line isolation valve limit switches and turbine stop valve trip fluid nressure transmitters and associated trip units operate during valve motion, from full open to full closed and vice versa, by comparing the time that the RPS trip occurs with the time that the valve position indicator lights in the control room signal that the valve is fully open and fully closed. These tests do -
not confirm the exact set points, but do provide the operator with an indication that the RPS sensors operate between the limiting positions of the valve. During reactor shutdown, calibration of the main steam line isolation valve limit switch set point at a valve position of 10 percent cPasure is possible by physical observation of the valve stem.
8 a
l Testing of the aain steam line high-radiation monitors can be performed during full power operation. Calibration can be per-formed during shutdown. gag The APRMs are calibrated to reactor power by using a reactor heat I balance and the TIP system to establish the relative local flux I profile. LPRM gain settings are determined from the local flux 1 profiles measured by the TIP system once the total renctor heat !
balance has been determined. l The gain-adjustment-factors for the LPRMs are produced as a result l of the process computer nuclear calculations involving the reactor heat balance and the TIP flux distributions. These adjustments ,
when incorporated into the LpRMs permit the nuclear calculations to be completed for the next operating interval and establish the APRM calibration relative to reactor power.
During reactor operation, one manual scram pushbutton may be armed and depressed to test the proper operation of the switch..and once the RPS has been reset, the other switches may.6. a,, J ./ Jepress.J to test their operation one at a time. For each such operation, a control room annunication will be initiated and the process com-puter will print the identification of the pertinent trip.
1 Operation of the reactor system mode switch from one position to I another may be employed to confirm certain aspects of the RPS o trip logics during periodic test and calibration. During tests j of the trip logics, proper operation of the mode switch contacts -
may be easily verified by noting that certain trip relays are con- : $
nected into the RPS logic and that any other trip relays are discon- 141 nected from the RPS logic in an appropriate manner of the given position of the mode switch.
Amend. 41 7/80 7.2-58
GG FSAR In the startup and run modes of plant operation, procedures are o w
used to confirm that scram discharge volume high-water-level sensor trip channels are not bypassed as a result of the operating by-l." ,
pass switch. In the shutdown and refuel modes of plant operation, a si.milar procedure is used to bypass all four trip channels. Due )
to the discrete ON-OFF nature of the bypass function, calibration l is not meaningful. l Administrative control must be exercised to place one turbine first stage pressure trip unit in the calibration made for the periodic test. During this test, a variable calibration signal may be introduced to operate the trip unit at the set point value.
When the condition for bypass has been achieved on an individual sensor under test, the control room annunciator for this bypass o function will be initiated. If the RPS trip logic associated lw-*
with this sensor had been in its tripped state, the process computer When will log the return to normal state for the RPS trip logic.
the plant is operating above 30 percent of rated power, testing of the turbine stop valve and control valve fast closure trip channels will confirm that the bypass function is not in effect.
Operation of the reset switch following a trip of one RPS actuator output logic will confirm that the switch is performing y
its intended function. Operation of the reset switch following m
scram will confirm that all portions of the switch and ,
O- relay logic are functioning properly since half of the control rods are returned to a normal state for one actuation of the switch.
vanwo\ Scatr-t 1:;;- amswitch permits each individual trip logic, trip o A 4.
actuator 1
output logic, and trip actuator to be tested on a periodic l$
basis. Testing of each process sensor of the protection system ,
also affords an opportunity to verify proper operation of these m components.
7.2.2.1.2.3.1.11 Channel Bypass or Removal from Operation (IEEE Std. 279-1971, paragraph 4.11)
The following RPS trip variable has no provision for channel bypass or removal from service because of the use of valve ponition limit switches as the channel sensor:
Main steam line isolation valve closure trip c
- a. P During periodic test of any one sensor trip channel, a transmitter may be.-I valved out of service Since and returned only onetotransmitter service under administrative is valved out of control procedures.
service -at any given time during the test interval, protective i
capability for the following RPS trip variables is maintained through the remaining instrument channels:
O 7.2-59 Amend. 38 4/80 l
l
- a. Scram discharge volume high-water-level trip
- b. Main steam line isolation valve closure . trip
- c. Turbine stop valve closure trip
- e. Reactor vessel low- and high-water-level trip
- f. Main steam line high-radiation trip
- h. Neutron monitoring (IRM) system trip
- i. Drywell high-pressure trip
- j. Reactor vessel high-pressure trip It is only necessary that the process sensors remain in a tripped condition for a sufficient length of time to de-energize the scram contactors and open the seal-in contact of the trip logi'c asso-ciated with :he scram contactors. Once this action is accom- o plished, the actuator output logic proceeds to initiate reactor u
~
scram regardless of the state of the process sensors that ini-O tiated the sequence of events.
g imilarly, it is only necessary that the RPS# p logic test switch 1 be opuumted-for _a_ sufficient length of 6 to de-energize the scram contactors and open the7erl-in-cpn c Q n the trip logic asso- [M l h2 ciated with the scram contactors. Since oNIy one trip logic test switch will be operate any given time, complete reacto am ill not be initi .
Once the manual scram pushbuttons are depressed, it is only nec-essary to maintain them in that condition until the manual scram contactors have de-energized and open the seal-in contact of the trip logic associated with the scram concactors. At this o point, the actaator output logic proceeds to initiate reactor scram regardless of the state of the manual scram pushbuttons. ',
The function of the mode switch is' to provide appropriate RPS i trip channels for the RPS trip logic on a steady-state basis for each of four given reactor operating states: shutdown, refuel, startup, and run. Protective action, in terms of the needed transient response, is derived from the other portions of the trip channels independent of the mode switch. Hence, the mode switch does not influence the completion of protective action in any manner.
l /
(ID) x/
v e
7.2-65 Amend. 38 4/80 l l
- GG FSAR Additional back-up to these manual controls is provided by the shutdcwn position of the reactor system mode switch and by the electrical power controls associated with the RPS MG sets.
O 5
No single failure in the manual or automatic portions of the sys-tem can prevent either a manual or automatic scram.
7.2.2.1.2.3.1.18 Access to Set Point Adjustments , Calibration, and Test Points (IEEE Std. 279-1971, paragraph 4.18)
During reactor operation, access to set point or calibration controls is not possible for main steam line isolation valve closure trip.
Access to set point adjustments , calibration controls , and test points for the following hPS trip variables is under the admini-strative control of plant personnel:
- a. Scram discharge volume high-water-level trip
- b. Turbine stop valve closure trip
- d. Reactor vessel low- and high-water-level trip
- e. Main steam line high-radiation trip
- g. Neutron monitoring (IRM) system trip
- h. Drywell high-pressure trip
- i. Reactor vessel high-pressure trip 7.2.2.1.2.3.1.19 Identification of Protective Actions (IEEE Std. 279-1971 paragraph 4.19)
When any one of the redundant sensors exceeds its set point value for the following RPS trip variables, a control room annunciator is initiated to identify the particular variable:
- a. Scram discharge volume high-water-level trip
- b. Turbine control valve fast closure trip 7.2-67 Amend. 38 4/80
- c. Reactor vessel low- and high-water-level trip
- d. Main steam line high-radiation trip
- e. Neutron monitoring (APRM) system trip
- f. Neutron monitoring (IRM) system trip
- g. Drywell high-pressure trip
- h. Reactor vessel high-pressure trip {
Identification of the particular sensor trip channel exceeding its set c point is accomplished as a typed record from the 'process " " " "
computer or visual observation of the'8: 12- re m r'r s' QMd.lbb th*Mk %dfM M R When any manual scram pushbutton is depressed, a control room v .
annunciation is initiated and a process computer record is pro-duced to identify the tripped RPS trip logic.
Identification of the mode switch in shutdown position scram trip is provided by the manual scram and the process computer trip logic identification printout, and the mode switch in shutdown posit. ion annunciator.
Partial or full closure of any main steam line isolation or tur-bine stop valve causes a change in the status of position indi-cator lights in the control room. These indications are not a I part of the reactor protection system but they do provide the operator with valid information pertinent to the valve status.
Partial or full closure of one or both valves in a particular set of two main steam lines will initiate a control room annunciator when the trip set point has been exceeded. Closure of two or ,
more turbine stop valves will initiate a control room annunciator w when the trip point has been exceeded. This same condition will permit identification of the tripped sensor trip channels in the {4' form of a typed record from the process computer or by visual "PC e bne rva%t$ion y & e,, cao W fMt hets...Sem
'/a L@.sa _.. _ 9.m i - . WT anoc.lkla..he== % FJF
. 'dte Neutron monitoring system annunciators provided in the control room indicate the source of the RPS trip. The process computer 1rovides a typed record of the tripped neutron monitoring system channel as well as identification of individual IRM and APRM ,
channel trips. Each instrument channel, whether IRM or APRM, has I
control room panel lights indicating the status of the channel for operator convenience.
l A omA +Q %ge.@ cab @ !
M control room annunciator /Aare provided to identify the tripped portions of the RPS in addition to the previously described trip channel annunciators:
- a. 1 or 3 actuator trip logics tripped
- b. 2 or 4 accuator trip logics trJpped g 7.2-68 Amend. 38 4/80
O .
SENSORS TRIP CHANNELS 0
A TRIP UNIT C TRIP UNIT O TRIP UNIT A TRIP UNIT 8 pdA pd C "ds gdO O }e e e e RPS BUS S RPS BUS A NOTE-CONT ACTS SHOWN IN NORMAL CONOtTION MAIN STEAM LINE HIGH RAOIATION/ORYWELL CONFIGURATION FOR HIGH PRESSURE -
SCRAM OISCHARGE VOLUME -HIGH WATER ~ - - - HIGH PRESSURE LEVEL / TURBINE CONTROL VALVE F AST RE ACTOR VCSSEL HIGH W ATER LEVEL CLOSURE /RE ACTOR VESSEL LOW WATER LEVEL
RPS MISSISSIPPI POWER & LIGHT COMPANY ARRANGEMF,NT Op::HANNELS AND LOGIC
/h GRAND GULF NUCLEAR STATION C UNITS 1 & 2 FINAL SAFETY' ANALYSIS REPORT FIGU RE 7.2-3
^' '
O >
l l
ACTUATOR OUTPUT LOGICS ASSOCIATED ACTUATOR OUTPUT LOGICS ASSOCIATED WITH TRIP LOGICS +sh*me= M $
WITH TRIP LOGICSp % A
^
^
e s s
f d -
H Iy-A E
1-e E
$d A
d D
?$ H 7$ H $d D
l
id G QI G C l
8 F E 8 l
o o o o o o o o !
P 1 ' 'P i
< 1r 1r 1r IP r
GROUP 2 GROUP 3 GRO'JP 4 GROUP 3 GROUP 4 GROUP 1 G R OBJP 1 GROUP 2 SOLENOIDS SOLENOIOS SOLE NOBOS SOLENOIDS SO LE NOIDS SOLE NOlOS . SOLENOIDS SOLENOLOS l
O nyuk '
NOTE. CONTACTS SHOWN IN NORMAL CONOITION MISSISSIPPI POWER & LIGHT COMPANY $ ACTUATORS AND ACTUATOR LOGICS GRAND GULF NUCLEAR STATION (SCHEMATIC)
O UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT FIGURE 7.2-4 AMEND.38 4/80
i
. I j l
l l
2 2
r 696 M\I - Wb stL \c. A U G v: d.
A A UR BI 3dA E Stop -dC -
G VAL e
/
C' SURE
(
dA : A BYPASS
- fC T CONTROL ,,
_C VALVE F AST CLOSURE OISCHARGE 3tA VOLUME HIGH A BYPASS ;iC yC WATER LEVEL MAINSTEAM A CLINE ISO 7E
- A BYPASS ;fC -sg ;C VALVE f
'f A ORYWELL ~'C HIGH PRESSURE q* NUCLEAR SYSTEM -*C
- HIGH PRESSURE *-
-/A REACTOR LOW - '- 1 T WATER LEVEL L- RE ACTOR HIGH
- c 4 c j
~
A WATER LEVEL T BYPASS T 7.A MAIN STEAM LINE HIGH RAOIATION h
- ~C pia ;$C NEUTRON I
> MONITORING l l
e SYSTEM _ 4
_y-E, ,G
.4 MANUAL -4 ^ ^
,,,,,wu~n j l
l l
- d
- ; : ;d :: Z :: )
A RESET E RESET CRESET G RESET
/^ / /C f NOTE: CONTACT 3 SHOWN IN NORMAL CONDITION MISSISSIPPI POWER & LIGHT COMPANY TRIP LOGICS A AND C (TYPICAL OF TRIP LOGICS B AND D)
GRAND GULF NUCLEAR STATION (SCHEMATIC)
UNITS'1 & 2 FIGU RE 7.2-5 i FINALSAFETY ANALYSIS REPORT AMEND.38 4/80 l l
l ,
O O O : .
RPS sus A I
Rr5 aus e
-p 4 -p -4 -f
-4 -4 -
-/p r p /p r p
/p 1p 1 p /p r -
SVOS-3 SVOS4 SVOS-1 SVOS-2 A 5 E D
[C [F G
[H TURBINE STOP VALVE CLOSURE SENSOR TRIP CHANNELS NOTE: CONTACTS SHOWN IN NORPAAL CONDITION NOTE. THREE OUT OF FOUR STOP VALVES MUST CLOSE TO CAUSE A SCRAM MISSISSIPPI POWER & LIGHT COMPANY CONFIGURATION FOR TURBINE STOP GRAND GULF NUCLEAR STATION VALVE CLOSURE REACTOR TRIP FIGURE 7.2-7 UNITS 1 & 2 AMEND. 38 4/80 FINAL SAFETY ANALYSIS REPORT
O O O'
,,sv C3 STE AM LINE STE AM LINE STEAM LINE STE AM LINE
{ ]' A B C D a "m a
, a
, a ,
4_;; I I I
= ,
CO=
g tF022 A 3 b F022 A 7 _ F022 8 } iF0228 F022C , F022C F 0220 "# F0220 m&
, y b F028 A ; I F028 A } iF 0288 gIF0288 _ F 028C 7 _ F028C y _ F 028 D , F028D W,
r e <c <" <' ("
M AIN STE AM LINE ISOL ATION SENSOR TRIP CHANNELS
. SWITCH CONT ACTS SHOWN IN POSITIONS WHEN ISOL ATION V ALVES LESS TH AN 10% CLOSEDI KEY-F022A . STE AM LINE A INBOARD VALVE F002C . STE AM LINE C.INBO ARD VALVE F028A . STE Au LINE A OUTBOARD VALVE F028C . STE AM LINE C.OUT80ARD V ALVE F0228 ' STE AM LINE 8 aNBO ARD V ALVE F0220 . STE AM LINE D. aN0 0ARD VALVE F0288 . STE Au LINE 8. OUTBOARD VALVE F028D . STE AM LINE D.OUTHOARD VALVE NOTE 1 WIRING F OR THE TWO SWITCHES ON THE SAME V ALVE IS PHYSICALLY SEPAR ATED,
- 2. ISOLATION OF THREE OR MORE STE AM LINES WILL CAUSE A SCRAM MISSISSIPPI POWER & LIGHT COMPANY CONFIGURATION FOR M AIN STEAM LINE GRAND GULF NUCLEAR STATION ISOLATION REACTOR TRIP UNITS 1 & 2 FIGURE 72-8 AMEND,39 5/B0 FINAL SAFETY ANALYSIS REPORT
~
. . GG FSAR 031.60 Section 7.3.1.2 identifies and defines " Operational Limits" (7.3.1.2) and implies that they are the level at which the trip unit i initiates the bF function. " Levels Requiring Protective Action" is not defined but is identified as one of the para-meters tabulated in the 7.3 tables. " Margin" 1s defined as the difference between the " Operational Limit" and undefined
" limiting conditions." Both " Operational Limits" and " Levels Requiring Protective Action" are said to be tabulated in some tables and none are identified by either of the two defined titles . Amend your FSAR to fully define the terms used in specifying the design basis and to utilize consistent terminol-ogy throughout the discussion and tabulations. Indicate the method used to include the effect of the rate of change of the variable initiating the trip and the transient overshoot as a result of the incident. For reactor water level transmitters confirm that the setpoints, limits and margins include worst case effects of drywell and/or containment temperature on the sensed reactor level. For each case in which the trip setpoint is 10% or less from end of scale, provide the actual margin between the trip point and the worst case response limits of the measuring circuit (For example, what would be the highest signal level that could exist with the water level below the measuring side pressure tap for a low water level trip circuit).
RESPONSE
The tables in FSAR Sections 7.2, 7.3, and 7.6 which provide the information addressed in this question have been revised to provide the following information:
- a. Variable. "P1 ant Variable"
- b. Sensor Type " Instrument"
- c. Number of Sensors " Sensor Channels Provided"
- d. Instrument Range " Range"
- e. Allowable Setpoint Range (Based on Instrument Capabilities) -
" Allowable Setpoint Range" The actual setpoints, margins, and minimum channels required to be operational, will be provided in the Technical Specifications which will be submitted separately.
The revised Tables for Section 7.2 are provided in response 31.54.
w, i 3,16.11,2 5* W %-t t, Tables 7.3-2, -3, -4, -5,y have been revised to contain " Plant Variable," " Instrument," " Range," " Sensor Channels Provided," and " Allowable Setpoint Range." Deleted from these tables are " Trip Setting," " Margin,"
and " Accuracy."
9/1919o o st. 4 o
.. - GG
.l FSAR M % #6 Tables 7.3-6, -7, -8, -9, 12 have 3 been deleted. The " Channels Provided" information has been incTuded as noted above in the revised tables.
The information contained in Table-7.3-11 has been incorporated into Table 7.3-10. The " Minimum Operable Channels" will be included as a part of the Tachnical Specifications.
The data presented in the tables contain some hardware implementation
. information on the function performed. Extensive hardware data beyond the function, equipment type and equipment range is not necessary. The Technical Specifications will develop the trip setpoint from the design basis infonnation which takes into account the transient response of the total system. Also accounted for in the Technical Specifications is the margin which includes allowancer for instrumentation accuracy, calibration error, sensor response times and sensor and setpoint drift.
Attachment A (Instrument Setpoint Margin Bcses - Hardware) provides supporting discussion as to technical specification development and the parameters utilized.
Subsection 7.3.1.2, Items (4) thru (6), has been revised to use terminology discussed in IEEE 279-1971 and to be consistent with the information supplied above and in the Technical Specification.
The transient overshoot and the rate of change of the variable initiating the trip for the NSSS ame. mMeewa.d i See. oho krMchwh ex- on ofWh\n Chapter 15, " Accident Analysis."MuusMm t%
The setpoint for any variable will be established and substantiated in the Technical Specifications regardless of its location in the instrument range.
The effect of the rate of change on variables provided in Tables 7.3-13,
- %, -2.s", omd - 2.6, initiating an action and the transient overshoot as a result of the incident are not significant for the parameters specified in these tables. In no case is the actuation setpoint within 10% from the end of the scale & wd\e.s. pce.wh.A M tok\e_s, fi.s-G-W-2.$ 1 omA - 2.9. l The sensing lines for the reactor water level transmitters are routed out of the drywell. Instruments with such routing are not affected by varying dry-well temperature, since the vertical langth of the sensing lines within the drywell are approximately equal. The 1ccuracy of the reactor water level transmitters is given in the Technical Specifications. This accuracy is yalid over the entire range of the instrument.
N, 1
9/a/ro 0 31* (n o l
nrru.samr n
- . Page 1 of 3 Instrument Setooint Margin Bases (Hardware)
Introduction The following bases relate to the establishment of instrument setpoint
. margins for the instrumentation employed in the Reactor Protection System, Isolation Actuation Systems, Emergency Core Cooling Systems and Neutronic Rod Block Systems as delineated in the BWR Standard Technical Specifications.
More specifically, these bases are concerned with the accuracy, cali-bration capability and potential for drift of the established setpoints as applied to the various functions, and describe the correspondint; allowances made to compensate for these factors. With reference to the overall plant safety analysis, the choice of actual setpoint for each parameter relative to its designated safety function is discussed in the technical specification bases. When the technical specification bases undergo revision as proposed by the NRC, the bases described herein will be incorporated to provide a complete basis for tne choice and application of the individual instrument setpoints.
Method The method employed to establish adequate margins for instrument setpoint drift, inaccuracy and calibration uncertainty as discussed in NRC Regulatory Guide 1.105 is explained by reference to Figure I. Because of the generic nature of this figure it is not drawn to any scale and is used solely to illustrate the qualitative relationships of the various margins.
Starting with a Safety Limit as indicated at the extreme right hand of the figure, the first margin extends to the point marked Analytic Limit.
This margin is there to account for uncertainties in the calculational model used but excludes allowances for instrumentation. Thus the calcu-lational model can assume ideal or perfect instruments. The next margin is between the Analytical Limit and the Allowable Value of the parametic setpoint, and accounts for instrument errors and calibration capability for the specific instrumentation. The remaining margin which is interest from a safety standpoint is that shown between the Allowable Value and the Instrument Setpoint. This margin is that which is deemed adequate to cover instrument drift which might occur during the established surveillance period. It follows that if during the surveillance period an instrument has drifted from its setpoint in a non-conservative direction but not beyond the allowable value, then the instrument performance is still within the requirements of the plant safety analysis.
For completeness Figure I shows further acron between the Instrument Setpoint and the Maximum (Licensed) Operating Point for the plant.
During plant operation transient overshoots may occur for certain parameters and instrument " noise" may be present. The instrument set-point may also drift in a conservative manner. There must be sufficient margin between the instrument setpoint and the maximum operating point to avoid spurious ractor scrams or unwarranted system initiations, o 3 /. G o
Page 2 of 3 Not all parameters (functional units) have an associated analytical limit, and a Design Basis (DB) limit is indicated. In general, the analytic limit is employed in those cases where a functional unit setpoint is directly associated with an analyzed abnormal plant transient or accident as described in the FSAR, Section.15. Where a design basis limit is used it is not always possible to provide simple quantification of the limit, e.g., IRMs are only required to overlap in range with portions of the SRM and APRM ranges. A similar situation occurs with the main steam line radiation sensors which have a setpoint bases essentially on previous operating experience.
9 l
I
- i e bl.6 0
s . ; .
. *\
6$ '
Lv) -
ri sure I---- -----_
g==s) .
E3 ) .
b M
c- -
INSTRUMENT SETPOINT SPECIFICATION BASf3
{T
~
u .. .
- 3 I
SETPOINT/ LIMIT 3 NOP T5 AV AL SL MA X OPE R ATING A L LOWASLE AN ALv TICAL SAFETY POINT THerSETPOINT VALUE - LIMIT LweitCRITE RIA 4T E CH SPE CS ITECH SPECl
. OPERA. PROCESS SAFETY M ARGIN5 FOR + TSON AL -? O AV AIL ABILITY C WONIER RANGE ++ RE ADOUT AN A L YSI5 +
TR ANSIE NTS ,, ,
ACCURACY TRAN54ENTS
, s F ACTOR 5 DETE RMINING M A R GIN $ A. PERTURBATIONS A. SENSOR AND SIGN AL A SENSOR AND SIGNAL A. SENSOR AND A. LIMITING
. OURING PLANT CONDe isONING DelF T5 CONDITIONING DRIF T5 CouPONE NT T1 AN53ENT MANEUVERS. BE TWEIN SuHvtILLANCE 88 Twit N 5URVEILL ANCE ACCUH ACV- 3 CCNSIDER S PROCf 55 NOtSE. ICALsH4 A tlONI TESTS. ICALIBR A TIONI T EST S. B. 5E NSOH r.ND IN5f auvf NT C. CONSIDE n IN5f nu. CovPONENT TavE s t $PONSE.
UE NT TivE RE SPONSE. Catinn A TeON C. A L LCt.1 *.CE C AP ABILITV. 5 0-1 C a t CUL A.
TsO*. A L 900EL UNCE R T A6N TIES f%
D 28 Am .
D o 4
c o w O
GG .
FSAR TABLE 7.3-2 -
HIGH PRESSURE CORE SPRAY SYSTEM-INSTRUMENT SPECIFICATIONS Sensor Allowable Plant Variable Instrument Range (1) Channels provided (2) Setpoint Range Reactor vessel low water Level transmitter -160/0/+60" 4 per trip system -138/0/38" level (energize HPCS)
Drywell high pressure Pressure transmitter 0-5 psig 4 per trip system 0.5-4.5 psig Reactor vessel high Level transmitter -160/0/+60" 4 per trip system -138/0/38" water level trip Pump discharge pressure Pressure transmitter 0-200 psig 1 system 20-180 psig Pump discharge flow Flow transmitter 0-30% 1 system 3-27%
(minimum flow)
Spray sparger integrity Differential -10.0 to I system -8 to +8 psid pressure +10.0 psid transmitter Suppression pool high Level transmitter -20/0/20" 2 systems -16/0/16" water level ,
Condensate storage tank Level transmitter -10/0/10" 2 systems -8/0/8" low level Turbine overspeed Centrifugal (3) 0-6000 rpm 1 device 600-5400 rpm device (1) See technical specifications for operational limits, levels requiring protective action, accuracy, trip settings, margin between operational limits, and response time requirements.
(2) See technical specifications for minimum number of channels required.
(3) See Section 6.3 for description of the turbine. The over speed trip forms an integral part of the turbine.
3 GD:Im/1471 h
GG .,-
FSAR TABLE 7.3-3 AUTOMATIC DEPRESSURIZATION SYSTEM-INSTRUMENT SPECIFICATIONS Sensor Allowable Plant Variable Instrument Range (1) Channels provided (2) Setpoint Range Reactor vessel low water Differential pressure -160/0/60" 2 per trip system -138/0/38" level (L1) transmitter Reactor vessel low water Differential pressure 0-60" I per trip system 6-54" level (L3) transmitter Drywell high pressure Pressure transmitter 0-5 psig 2 per trip system 0.5-4.5 psig LPCI permissive Pressure transmitter 0-250 psig 6 Total 25-225 psig LPCS permissive Pressure transmitter 0-250 psig 2 Total 25-225 psig Automatic depressurization Timer 12-120 sec 1 per trip system 23-109 sec time delay RHR pump discharge pressure Pressure transmitter 0-500 psig 2 per pump 50-450 psig Reactor Pressure (Pressure Pressure transmitter 0-1200 psig 2 per trip system 120-1080 psig relief)
(1) See technical specifications for operational limits levels requiring protective action, accuracy, trip settings, margin between operational limits and response time requirements.
(2) See technical specifications for minimum number of channels required.
GD:1m/1472 8/12/80 i
e
! O
TABLE 7.3-4 .
LOW PRESSURE CORE SPRAY-INSTRUMENT SPECIFICAfl0NS LPCS and LPCI "A" Loop Sensor Allowable Range (1) Channels provided (2) Setpoint Range Plant Variable Instrument
-160/0/+60" 2 per trip system -138/0/+38" Reactor vessel low water Level transmitter Level 1, level 3; (LPCS &
LPCI initiation) 0-5 psig 2 per trip system 0.5-4.5 psig Dyrwell high pressure Pressure transmitter (LPCS initiation)
Flow transmitter 0-30% 2 (1 per valve) 3-27%
Pump discharge flow (minimum flow) 0-7d0psig 2 (1 per valve)70-630 psig Valve differential pressure Differential pressure (LPCS & LPCI "A" injection transmitter valves, test mode only) 0-7.5 sec 1 (RHR "A" only) 0.75-6.75 sec LPCI pump delay (on loss Timer of normal auxillary power) 0-500psig 1 system 50-450 psig LPCS pump discharge pressure Pressure transmitter (1) See technical specifications for operational limits, levels requiring protective action, accuracy, trip settings, margin between operational limits and response time requirements.
(2) See technical specifications for minimum number of channels regttired.
GD:Im/1473 8/12/80 O
U 6
0
GG FSAR TABLE 7.3-5 LOW PRESSURE COOLANT INJECTION-INSTRUMENT SPECIFICATIONS Loops "B" and "C" Sensor Allowable Plant Variable Instrument Range (1) Channels provided (2) Setpoint Range Reactor vessel low water Level transmitter -160/0/+60" 2 per trip system -138/0/+38" level (LPCI initiation)
Drywell high pressure Pressure transmitter 0-5 psig 2 per trip system 0.5-4.5 psig (LPCI initiation)
LPCIpumpdeiay Timer 0-7.5 sec 1 (Loop B only) 0.75-6.75 sec (on loss of normal auxiliary power)
LPCI pump discharge low flow Flow switch 0-30% 2 (1 per pump) 3-27%
(minimum flow bypass)
LPCI injection valve Differential pressure 0-700 psig 2 (1 per valve)70-630 psid (pressure differential) transmitter Injection line integrity Differential pressure -10/0/10 psid I system -8/0/+8 psid transmitter (1) See technical specifications for operational limits, level requiring protective action, accuracy, trip settings, margin between operational limits and response time requirements.
(2) See tt(Snical specifications for minimum number of channels required.
GD:lm/1470 8/12/80
GG -
FSAR ' -
TABLE 7.3-10 CONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM INSTRUMENTATION SPECIFICATIONS Sensor Allowablo Plant Variable Instrument Range (1) Channels provided (2) Setpoint Range Reactor vessel Level Differential pressure -160/0/60" 4 per trip system -138/0/38" 3 trip transmitter Reactor vessel level Differential pressure -160/0/60" 4 per. trip system -138/0/38" 2 trip transmitter Reactor vessel leve! Differential pressure -160/0/60" 4 per trip system -138/0/38" I trip transmitter ,
6 5 Main steam line high Radiation (3) I to 10 mR/hr 4 per trip systen 10 to 90 X 10 radiation monitor (6 decade log) mR/hr U
Main steam line space Thermocouples: 50-350*F 4 temp per trip 80-320 F high temperature temperature system Main steam line space Differential 0-150 F 4 diff temp per trip 15-135"F high differential temp temperature system Main steam line high Differential -15/0/150 psid 4 per trip system 1.5 to 133.5 flow pressure transmitter psid Main steam line low Pressure transmitter 50-1200 psig 4 per trip system 165-1085 psig pressure Dyrwell high pressure Pressure transmitter 0-5 psig 4 per trip system 0.5-4.5 psig Containment and drywell Radiation (3) 0.01-100 mR/hr 4 per trip system 0.02-90 mR/hr ventilation exhaust monitor (4 decade log) high radiation Sheet 1 of 2 GD.im/1474 8/12/80
GG ' -
FSAR '
TABLE 7.3-10 (Cont.)
Sensor Allowable Plant Variable Instrument Range (1) Channels provided (2) Setpoint Range Main condenser low Pressure transmitter 0-30' Hg (abs) 4 per trip system 3-27" Hg (abs) vacuum RCIC turbine steam Thermocouple: 50-350 F 2 per trip system 80-320 F U
line space high temperature temperature RCIC turbine steam line Differential 0-150 F 2 per trip system 15-135'F space high differential temperature temperature RCIC turbine steam line Differential -300/0/+300" 2 per trip system -240/0/+240" high flow pressure transmitter Reactor shutdown Thermocouple: 50-350 F 2 per trip system 80-320 F cooling system temperature space high temperature and high diff temp Differential 0-150 F 2 per trip system 15-135'F temperature Reactor water cleanup Thermocouple: 50-350 F 2 per trip system 80-320 F system space high temperature temperature and high differential temp Differential 0-150"F 2 per trip system 15-135 F temperature Reactor water cleanup Differential 0-100 gpm 2 per trip system 10-90 gpm high differential flow pressure transmitter (1) See technical specifications for operational limits, accuracy, levels requiring protective action, Trip settings, margin between operational limits and response time requirements.
(2) See technical specifications for minimum number of channels required.
(3) Range of measurements depends o.1 items such as source geometry, background radiation, shielding, energy levels, and method of sampling.
GD:lm/1475 8/12/80
TA B L E 7. 3 -/ 3
- CGCS S YSTEM _
ACTUATION INST RUM EWTAT/ON
SUMMARY
NUh\BER 3ENSOR INSTR VMENT A LL 0%/ABLE VARIABLE TYPE SE SORS RANG E SETPolNT RANGE CTMT t DitvWELL hlFFERENTIAL 8 pegg5vgg ~3 to + 3 Josid ~ l* 0 **
- I' ' f
- M DIFFERENTIA L TRMSMl1TER a PRE 5suRE 8 7
o O
O
TA B L E 7. 3 '16 .
F WL C S S YSTEh\ -
ACTVATION INSTRUA1ENTATloN SUAtAsARY
~
NUh%ER INSTR VMENT A LL O%/ABLE
~ SENSOR '
VARI A BL ryes sengoRg nanas sereo,araaaag FEEDWATER L EAKAGE O - 3 00 psig PRESS VR E 1 3 0 ~ 2 7 0 p s ,'y CONTROL S YSTEM L INE TRANSMime PR ESS UR E O
o
?
e O
m
TABLE 7 3-22 '
56 TS S YSTEh\ '
ACTUATION INSTRUATENTAT/oN
SUMMARY
SENSOR ^* INSTR VMENT A LL O% FABLE VARIABLE TYPE *0 sonsRANG E sE SETPolNT RANGE AUXILIARY BLDG FUEL ca -M 4 0.01 - 100 MR/HR C2 E HANDL ING AREA VENT DETECTOR R A DI A TION FUEL HANDLING POOL G-M $ D o.01 - 100 M R fH R GE o SWEEP R ADIA_ TION DE TEC TOR Y
ENCLOSUR B LDG PRESSVRE DIFFERENTIAL 4 -2. 5 to fl .S in . w.c. - 3. 0 to + Q.0 in. W. L. $
PRES 5URE
, r8 ANss:TTER
. REClRcvLATIod FAN Flow DIFF ERENTnAL ~L O - 20,000 c 4:n G,933.gg,937cg,,
PRE $
, gq ( O- S. 8 in. W. c.) ( O. 6 - 5. 2 In. w- c.)
(PILOT TUBE)
FIL TE TRA1^1 FLOW 1 O-5,000 c(rn OlffERENTinL 1o W - A sMI c4sn PRES.sURE ( D - 6. l .*n . w,c.) ( o. 6 - 5. 5 in. w.c.)
TRAWcMITf5 R (Pit.cT TUSE)
TA B L E 7.3 - a s -
S PM V S YSTEA\ ,
% ACTU ATION INST RUAT ENTATioN
SUMMARY
y CS w
W w
SENSOR NUh ER INSTR UMENT A LL O%/ABLE VAR.I ABL =- TYPE SE SORS RANG E SETPOINT RANGE pg SUPPAESS10# POOL L EVE L diner ENTIAL 4 0 - # 44 inches w.c.,
g F it'Re 15 - 129 :ne.hes w.c.
(wlDE RA NG E) N I"5 "4* to I17' 4) ( 10b'- [*' to llf'.g")
b o
SUPPRESS DON Pool L.EvEL DIFFERENTtAL 1 D-13 nne % w.f. 2 (NARROW RANGG) SURE l. 5 ~ 1 0 E *'n c h es **RL. ?
T4ANsM ITTER { g g g *- o k p, g ja '.o**) *
(sss'. D W't. Iso'-10& q e
Th B L E 3 - 3 8 cRAcus S YSTEM .'
@ ACTUATION INSTRUMENTAT10N SUA\ MARY EEM) c=n NMER INSTR VMENT A LL O%/ABLE 5 SENSOR 15 v
VARI ABL E Tyg E sefs'oas RANG E scTroiar RAnas M
W b
OUTSIDE. AIR IMTA KE G-M D E TECTOR 4 0. 01 ~ to o M R/NR Cn E RADI A TJON OUTsiDE A DR INTAKE AM PE PoM E tag Q O tc. l} (ggyy g ')
C.HLORENE C HL O RlNE O DETEC TOR O
STANOBy FRES H AIR Q',F',A
,,,gE"^ L 2 0 - 5,000 c. b t,c 2 9 - 4,750 c N $
( o - f.7 in. w.c.) e FLOW raauseinaa ( o, 4 - r, ; ;n.w.c.) D (rstor ruse)
C O N TRCL ROOM Alc. OsFFE RENilAL 3. O. 4g,999 y , g, _3 g UNIT AlR FLOW PRE 55URE rugsm arren (0-80 n. W.c.) (o, g 12 ;n w e )
(!ILOTTUBE)
NOT E I : ( S a *&
a5 I " *b -
Th BLE 7. 6-It S.P. TEM P. mon.S YSTEM ACTU ATION INS T RUM ENT AT10N
SUMMARY
NWBER yygypyygNT A LL O\JABLE SENSOR VARIABLE TYPE sESs'ons RANG E SETPOINT RANGE G UPPREsssoM Pool TYPE T I3 O - 2 00 F g o. Igo y TEMPERAT VR E (NORM A L) THEg m cuPLE' O
SurpRessiod POOL TYPE T I 3. O o - 200 F 2 0- Igo F w rEMPERATURELPosT LOCA) M 8 M Coo!LE ~
n D
./ GG FSAR the other from the suppression pool. The control arrangement is chown in the HPCS FCD (see Section 1.7). Reactor grade water in the condensate storage tank is the preferred source. On receipt of an HPCS initiation signal, the condensate storage tank suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from suppression pool valve is open. If the water level in the condensate storage tank falls below a preselected level, first the suppression pool suction valve automatically opens and then the condensate storage tank suction valve automatically closes. Two level transmitters are used to detect low water level in the condensate storage tank.
Either transmitter and associated trip unit can cause the sup-pression pool suction valve to open and the condensate storage valve to close. The supprecsion pool suction valve also automatically opens if high water level is detected in the sup-pression pool. To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other closes.
1 7.3.1.1.1.3.4 Logic and Sequencing '
Either reactor vessel low water level or high drywell pressure cutomatically starts the HPCS as indicated in Figure 7.3-3.
Two reactor vessel low water level trip settings are used to initiate the ECCS. The first low water level setting initiates the HPCS. The second low water level setting initiates the LPCI, LPCS, and ADS. This setting also closes the main steam line isoJation valves (see subsection 7.3.1.1.2) . 'sg The HPCS controls and instrumentation settings are listed in fb& CNO88!' -
N- The reactor vessel low water level setting for ,
- Ar, HPCS initiation is selected high enough to prevent excessive fuel cladding temperature and fuel failure, but low enough to g cvoid spurious HPCS startups. The drywell high-pressure setting is selected to be as low as possible without inducing spurious EPCS startup.
7.3.1.1.1.3.5 Bypasses and Interlocks O gg ,
The HPCS pump motor and injection valve are provided with manual h override controls which permit the operator manual control of the cystem following a LOCA.
During test operation, the HPCS pump discharge can be routed to the condensate storage tank or suppression pool. Motor-operated valves are installed in the test lines. The piping arrangement is shown in Figure 6.3-1. The control scheme for the valves is shown in the HPCS FCD (see Section 1.7) . On receipt of an HPCS initiation signal, the two valves close and remain closed. The l
7.3-4 1
l 03/.6 o l l
GG 1
~
FSAR can use the reset push buttons to delay or prevent automatic opening of the relief valves if such delay or prevention is prudent.
Two control switches are available in the control room for each .
cafety/ relief valve associated with the ADS. Lach switch is cssociated with one of the two solenoid pilot valves and mnin-tains the maximum electrical separation consistent with the rcquired operability. The switch on the division 1 (ESF Battery 1 A) circuits is a two-position type OPEN-AUTO. The OPEN position is l for manual safety / relief valve operation. The division 2 (ESF Battery B) switch may also be used for manual operation and has two positions, OPEN-AUTO. Manual opening of the relief valves provides a controlled nuclear system cool-down under conditions i where the normal heat sink is not available. I 7.3.1.1.1.4.5 Bypasses and Interlocks l
It is possible for the operator to manually delay the depressuri:-
ing action by the trip system reset switches. This wo ld reset the timers to zero seconds and prevent depressurization for cnother 120 seconds. The operator would make this decision based on an assessment of other plant conditions. ADS is interlocked with the LPCS and RHR by means of trip units sensing pressure on the discharge of these pumps. These are the ac interlock.
Although the ac interlocks are common to automatic and manual ADS i initiation circuits, the independence of manual and automatic 1 initiation is not compromised because each of the logics is dupil- <
ested (ADS A and ADS B), and for a failure of the ADS to occur l both the ac interlocks would have to fail. At least one of the l three LPCI pumps or the LPCS pump must be capable of delivering water into the vessel, l
7.3.1.1.1.4.6 Redundancy and Diversity l The ADS is initiated by high drywell pressure and low reactor vassel water level. The initiating circuits for each of these parameters are redundant as verified by the circuit description of this section. .
[
7.3.1.1.1.4.7 Actuated Devices cy db All relief valves in the ADS are actuated by four methods. 'q-
- s. Automatic action in 120 seconds resulting from the logic chains in either division 1 or division 2 trip system actuating 7.3-10 0 3/. G 0
GG FSAR 7.3.1.1.1.4.11 Operational Considerations 7.3.1.1.1.4.11.1 General Information The instrumentation and controls of the ADS are not reguired for norma-1 plant operations. When automatic depressurization is required, it will be initiated automatically by the circuits described in this section. No operator action is required for at ;
least 10 minutes following initiation of the system. '
7.3.1.1.1.4.11.2 Operator Information A temperature element is installed on the safety / relief valve dis-charge piping several feet from the valve body. The temperature element is connected to a multipoint recorder in the control room to provide a means of detecting safety / relief valve leakage during plant operation. When the temperature in any safety / relief 1 valve discharge pipeline exceeds a preset value, an alarm is l sounded in the control room. The alarm setting is enough above j normal rated power drywell ambient temperatures to avoid spurious '
alarms, yet low enough to give early indication of safety / relief valve leakage.
l 7.3.1.1.1.4.11.3
% Tedm.SelEPoiny%.
u en Re f er to deistunts*=9-f gocsafetytier set points. --
. 2 7.3.1.1.1.5 Low-Pressure Core Spray (LPCS) - Instrumentation and Controls O
7.3.1.1.1.5.1 System Identification NL
~ ?o The low pressure core spray (LPCS) system will supply sufficient ,
cooling water to the reactor vessel to adequately cool the core '
following a design basis loss-of-coolant accident.
7.3.1.1.1.5.2 Equipment Design The LPCS includes one ac pump, appropriate valves, and piping to route water from the suppression pool to the reactor vessel (see Figure 6.3-u, LPCS P&ID). Except for the testable check valve, ;
which is inside the drywell, the transmitters and valve closing mechanisms for the LPCS system are located in the containment and i auxiliary building. Cables from the sensors are routed to relay )
logic cabinets where the control circuitry is assembled. The )
LPCS pump and automatic valves are powered from the division 1 ESF ac bus that is capable of receiving standby power. Control power for the LPCS ccmes from ESF battery A. Control and motive power for the LPCS is from the same source as for LPCI Loop A.
7.3-12
()31 600
GG FSAR 7.3.1.1.1.5.3 Initiating Circuits Two reactor vessel low water level transmitters and trip units and two drywell high-pressure transmitters and trip units are electrically connected in a one-out-of-two twice arrangement so that no single event can prevent initiation of LPCS.
Reactor vessel low water level is monitored by two level trans-mitters that sense the difference between the pressure due to a constant reference leg of water and the pressure due to the actual height of water in the vessel. Each level transmitter provides an input to a trip unit (electronic switch) located in the control room.
Drywell pressure is monitored by two pressure transmitters mounted on instrument racks in the containment. Sensing lines that ter-minate in the containment allow the transmitters to communicate with the drywell interior. Each drywell high-pressure transmitter provides an input to a trip unit (electronic switch) located in the control room,
- w. -
The LPCS initiation signal also initiates the division 1 diesel g generator. qh
'4"d 7.3.1.1.1.5.4 Logic and Sequencing The LPCS initiation logic is depicted in Figure 7.3-2 in a one- ,
out-of-two twice network using level and pressure trip units.
The initiation signal will be generated when:
- a. Both level trip units are tripped
- b. Both pressure trip units are tripped
- c. Either of two other combinationc of one level trip unit and one pressure trip unit is tripped once an initiation signal is received by the LPCS control cir-cuitry, the signal is sealed in until manually reset. The seal-in feature is shown in the LPCS FCD (see Section 1.7).
7.3.1.1.1.5.5 Bypasses and Interlocks l l
The LPCS pump motor and injection valve are provided with manual override controls which permit the operator manual control of the system following automatic initiation.
7.3-13 0 31, G o
GG FSAR tor vessel. A differential pressure transmitter measures the pressure difference between the two injection lines. If the LPCS and RHR A piping is sound, the pressure dif ference will be very small between these lines. If integrity is lost, an increase in differential pressure will initiate an alarm in the control room.
11.3 Set P int 7.3.1'.1.1.5.Teek the ninst $pse dp ,ucatu.
r _
,-c Refer to s for safety set points.
7.3.1.1.1.6 Low Pressure Coolant Injection (LPCI) System -
Instrumentation and Controls \ C 7.3.1.1.1.6.1 System Identification kN.g
-Q Low pressure coolant injection (LPCI) is an operating mode of the residual heat removal system (RHR). The RHR system and its opera-ting modes are discussed in Chapter 5. Because the LPCI system is designed to provide water tc4 the reactor vessel following the design basis loss-of-coolant accident, the controls and instru-mentation for it are discussed here.
7.3.1.1.1.6.2 Equipment Design Figures 5.4-16 and 5.4-17 (RHR PCID) show the entire RHR system, including the equipment used for LPCI operation. Control and instrumentation for the following equipment is essential:
- a. Three RHR main system pumps
- b. Pump suction valves
- c. LPCI injection valves
- d. Vessel level transmitters
- e. Drywell pressure transmitters
- f. Vessel pressure transmitters The instrumentation for LPCI operation controls other valves in the RHR. This ensures that the water pumped from the suppression pool by the main system pumps is routed directly to the reactor.
These interlocking features are described in this subsection.
LPCI operation uses three pump loops, each loop with its own separate vessel injection nozzle. Figures 5.4-16 and 5.4-17 (RHR P&ID) show the location of instruments, control equipment, and LPCI components. Except for the LPCI testable check valves, the components pertinent to LPCI operation are located outside the drywell.
7.3-16 0 31, Gx>
~
- GG FSAR Power for the LPCI system pumps is supplied from ac buses that
< can receive standby ac power. Two pumps are powered from the division 2 ESF bus and the third pump from the division 1 ESF bus, which also powers the LPCS. Motive power for the automatic valves comes from the bus that powers the pumps for that loop.
Control power for the LPCI components comes from the ESF de buses.
Trip channels for LPCI A are shown in the RHR FCD (see Section 1.7). Trip channels for LPCI B and LPCI C are shown in the RER i FCD.
LPCI is arranged for automatic and remote-manual operation from the control room.
7.3.1.1.1.6.3 Initiating Circuits LPCI A LPCI A is initiated from the LPCS logic circuits, described in subsection 7.3.1.1.1.5.3, Initiating Circuits.
LPCI B and C LPCI B and C reactor vessel low water level is monitored by two level transmitters mounted on instrument racks in the containment that sense the difference between the pressure due to a constant reference leg of water and the pressure due to the actual height of water in the vessel. Each level transmitter provides an input to a trip unit (an electronic switch) located in the control room.
Drywell pressure is monitored by two pressure transmitters mounted on instrument racks in the containment. Each drywell transmitter provides an input to a trip unit (an electronic switch) located in the control room.
The signals from the two leve3 trip units and the two pressure trip units are electrically connected in a one-out-of-two twice arrangement so that no single event can prevent initiation of LPCI B and C. The initiation logic for LPCI B and C is shown in Figure 7.3-3.
h O
- N l 0
The LPCI B and C initiation logic also initiates the division 2 9-diesel / generator. 'ar 1 0 7.3.1.1.1.6.4 Logic and Sequencing The overall LPCI operating sequence following the receipt of an initiation signal is as follows:
7.3-17 l
03hGo
Set Points 7'.3.1.1.1.6.11.3 fine Tachic4 SpMsAcafinvs.r %
Refer to,siaWemiumihmme fo'r safety set points. \g o -
7.3.1.1.1.7 Non-essential Components a Mb All non-essential components have been isolated from essential "f o
components so that a failure in a non-essential component will not prevent proper ECCS operation.
7.3.1.1.2 Containment and Reactor Vessel Isolation Control System - Instrumentation and Controls 7.3.1.1.2.1 System Identification The containment and reactor vessel isolation control system includes the sensors, channels, transmitters, and remotely activated valve closing mechanisms associated with the valves which, when closed, effect isolation of the containment or reactor vessel, or both.
The containment and reactor vessel isolation control system (CRVICS) embraces all those systems that are required for reactor vessel and containment isolation during the various modes of operation. CRVICS consists principally of the following instru-mentation and control subsystems:
- a. MSIV Subsystem:
- 1. Reactor vessel - low water level
- 2. Main steam line tunnel - high temperature and differ-ential temperature
- 3. Main steam line - high flow $
- 4. Main turbine inlet - low steam pressure
- 5. Main steam line - high radiation
- 6. Main condenser - vacuum trip
- b. Other Valves Subsystems:
- 1. Reactor water cleanup system - high differential flow.
- 2. Reactor water cleanup system area - high temperature l and differential temperature.
Amend. 41 7/80 7.3-21 03/4 0
GG FSAR 7.3.1.1.2.4 System Initiating Circuits During normal plant operation, the isolation control system sen-sors and trip controls that are essential to safety are energized.
When abnormal conditions are sensed, trip channel trip unit relay contacts open, which cause contacts in the trip logic to open and thereby initiate isolation. Loss of both logic power supplies also initiates isolation.
For the main steam line isolation valve control, four channels _
are provided for each measured variable. One channel of each variable is ::onnected to a particular logic in order to maintain -[
channel inde pendence and separation. The outputs of logic =
Actuators A and C are used to control Solenoid A of the inboard and outboard valves of all four main steam lines, and the outputs of Actuators B and D are used to control Solenoid B of both inboard and outboard valves for all four main steam lines as shown in Figure 7.3-5.
Each main steam line isolation valve is fitted with two control solenoids. For each valve to close automatically, both of its solenoids must be deenergized. Each solenoid receives inputs from two logics; and a signal from either can cause deenergiza-tion of the solenoid.
The main steam line drain valves and reactor water sample valves also operate in pairs. The inboard valves close if two of the o main steam line isolation logics, B and C, are tripped and the E outboard valves close if the other two logics, A and D are tripped, g as shown in Figure 7.3-6.
The reactor water cleanup system and residual heat removal system isolation valves are each controlled by two logic circuits, one for the inboard valve and a second for the outboard valve. l The control system for the automatic isolation valves is designed i to provide closure of valves in time to minimize the loss of coolant from the reactor and prevent the release of radioactive )
material from the containment. A secondary design function is to :
prevent uncovering tt2 fuel as a result of a break in thos pipe-lines that the valves isolate and to thereby restrict the release of radioactive material.
7.3.1.1.2.4.1 Isolation Functions and Settings -
y .
7 The isolation trip settings of the re r vessel isolation con-trol system are listed in . The safety design bases - I? C.
of these isolation signals are alscussed in the following para-graphs, and the functional control diagram (see Section 1.7) /
illustrates how these signals initiate closure of isolation o
(
valves.
d "tr o
Amend. 41 7/80 7.3-23 0 31 G b l
/ GG
. FSAR
- a. All main steam lines
- b. Main steam line drain
- c. Reactor water sample line The high-radiation trip setting is selected high enough above background radiation levels to avoid spurious isolation, yet ,owl enough to promptly detect a gross release of fission products from the fuel.
The objective of the main steam line radiation monitoring sub-system is to monitor for the gross release of fission products from the fuel and, upon indication of such release, to initiate appropriate action to limit fuel damage and contain the released fission products.
This subsystem clasrification is provided in Table 3.2-1 7.3.1.1.2.4.1.2.2 Subsystem Power Sources The 120 V ac RPS buses A and B are the power sources for the main steam line radiation monitoring subsystem and main steam isolation valves. Two channels are powered from one RPS bus and the other two channels are powered from the other RPS bus. Power for the outboard and inboard main steam line drain valves, reactor water sample lines valves, and reactor water cleanup valves are powered from the ESF division 1 and 2 buses, respectively.
7.3.1.1.2.4.1.2.3 Subsystem Initiating Circuits Four gamma-sensitive instrumentation channels monitor the gross gamma radiation from the main steam lines. The detectors are physically located near the main steam lines just downstream of the outboard main steam line isolation valves. The detectors are geometrically arranged to detect significant increases in radia-tion level with any number of main steam lines in operation.
Their location along the main steam lines allows the earliest practical detection of a gross fuel failure.
Each monitoring channel consists of a gamma-sensitive ion chamber and a log radiation monitor, as shown in Figure 7.6-1 (PRM IED) .
l Each log radiation monitor has three trip circuits. One upscale trip circuit is used to initiate scram, isolation, and alarm.
The second circuit is used for an alarm and is set at a level cr below'that of the upscale trip circuit used for scram and isola- 51 tion. The third circuit is a downscale trip that actuates an 'tr instrument trouble alarm in the control room and produces an C isolation and scram trip signal. The output from each log radia-tion monitor is displayed on a six-decade meter in the control room.
7.3-27 l
l ost so
l GG FSAR amounts of radioactive gases or materials exist in the contain-ment or drywell exhaust and to effect appropriate action so that the release of radioactive gases to the environs is controlled.
The containment and drywell ventilation exhaust radiation moni-toring subsystem is shown in Figure 7.6-1, .'
The subsystem consists of four agg, independent channels.
7.3.1.1.2.4.1.7.2 Subsystem Power Sources C The 120 V ac RPS buses A and B are the power sources for this subsystem. Two channels receive power from one RPS bus, and the ih other two channels receive power from the other RPS bus.
7.3.1.1.2.4.1.7.3 Subsystem Initiating Circuits Each channel includes a Geiger-Muller type detector and an indica-tor and trip unit. The four channels share a two-pen strip chart recorder. All equipment except the detectors are located in the control room. The detectors are located in the exhaust ductwork.
7.3.1.1.2.4.1.7.4 Subsystem Logic and Sequencing I Each channel has two trips. The upscale trip indicates high j radiation, and the downscale trip indicates instrument trouble. 1 When the instrument is switched to calibrate it is considered to )
be inoperative. Any one trip sounds an alarm in the control !
room. Two upscale trips, two inoperative trips, or one upscale l trip and one inoperative trip on either set of channels will provide a trip signal for isolation of all containment and dry-well ventilation penetrations. There are no sequencing require-ments or provisions.
7.3.1.1.2.4.1.7.5 Subsystem Bypasses and Interlocks No operational bypasses are provided, but the trip units for each sensor channel may be bypassed for maintenance or testing. By-passing the trip unit will cause a single trip system trip, which does not cause an isolation. If any additional trips (upscale or inoperative) occur from other trip units, the isolation function will be initiated.
7.3.1.1.2.4.1.7.6 Subsystem Redundancy and Diversity As discussed in subsection 7.3.1.1.2.4.1.7.1, the containment and drywell ventilation exhaust radiation monitoring subsystem con- l sists of four independent sensor and trip units, sensing a com- l mon variable. This independence provides sufficient redundancy l to ensure that a high-radiation condition will be detected and l protective action initiated. !
No diversity of trip variables is provided for the containment and drywell ventilation exhaust radiation monitors.
7.3-37 0 3 1 . (a 0
.. FSAR 7.3.1.1.2.4.1.7.7 Subsystem Testability The monitors are readily accessible for inspection, calibration, and testing. The containment and drywell ventilation exhaust radiation monitoring subsystem and the response of the contain-ment ventilation systems are routinely tested. Operation of the detegtors can be verified through use of a portable gamma source.
7.3.1.1.2.4.1.7.8 Subsystem Environmental Considerations The environmental considerations are given in Tables 3.11-1, -2, and -3. In addition, this subsystem has been qualified for con-ditions of an SSE.
7.3.1.1.2.4.1.7.9 Operational Considerations 7.3.1.1.2.4.1.7.9.1 General Information The containment and drywell ventilation exhaust radiation moni- l toring subsystem is required to prevent release of radioactive materials to the environs through the containment exhaust. The isolation function is performed automatically and provides annun-ciation in the control room to alert operating personnel of the condition.
7.3.1.1.2.4.1.7.9.2 Operator Information ,, ,
Refer to Table,M for subsystem characteristics and display M ranges.
~
M--/O N I Ad50 7.3.1.1.2.4.1.7.9.3 Set Poings
+ke Tesisduea.I Spseirkations Refer to N for safety set points. M A
7.3.1.1.2.4.1.8 Reactor Water Cleanup (RWCU) System - High - 'Ns Differential Flow Og 7.3.1.1.2.4,1.8.1 Subsystem Identification O High differential flow in the reactor water cleanup system could indicate a breach of the nuclear system process barrier in the cleanup system. The cleanup system flow at the inlet to the heat l exchanger is compared with the flow at the outlet of the filter / l dominerali:er. High differential flow initiates isolation of I the cleanup system.
7.3.1.1.2.4.1.8.2 Subsystem Power Supplies Divisions 1 and 2 logics are supplied from reactor protection system bus A and B 120 V ac, respectively.
7.3-38 03160
' ~
0 ,
GG FSAR 7.3.1.1.2.4.1.12.7 Subsystem Testability Testability is discussed in subsection 7.3.2.2.2.3.1.10.
7.3.1.1.2.4.2 System Instrumentation sensors providing inputs to the containment and reactor vessel isolation control system are not used for the automatic control of the process system, thereby achieving separation of the pro-tection and process systems. Channels are physically and elec-trically separated to reduce the probability that a single physical event will prevent isolation. Redundant channels for one monitored variable provide inputs to different isolation trip systems. The functions of the sensors in the isolation control .
system are shown in Figures 7.3-5 and 7.3-6. Gehhmmenemmeneemmer m@t*'
\N Q
7.3.1.1.2.5 System Logic d4 O
The basic logic arrangement is one in which an automatic isola-tion valve is controlled by two trip systems. Each trip system has two trip logics, each of which receives input signals from at least one trip channel for each monitored variable. Thus, two trip channels are required for each essential monitored v riable to provide independent inputs to the trip logics of one trip system. A total of four trip channels for each essential moni-tored variable is required for the trip logics of both trip systems.
The trip actuators associated with one trip logic provide inputs into each of the trip actuator logics for that trip system. Thus, either of the two automatic trip logics associated with one trip system can produce a trip. The logic is a one-out-of-two-twice arrangement. To initiate valve closure, the trip actuator logics of both trip systems must be tripped. The overall logic of the system could thus be termed one-out-of-two taken twice.
The one-out-of-two taken twice logic is used to control each main steam line isolation valve (MSIV). The four logic strings for this control are shown in the NBS FCD (see Section 1.7). The logic actuator outputs used to control the main steam line drain valves could be termed two-out-of-two, applied to each valve. The logic strings for this control are shown in the NBS FCD. The variables that initiate automatic clorure of the MSIVs are:
- a. Low reactor water level
- b. .High main steam line radiation
- c. High main steam line flow
- d. High main steam line tunnel temperature i
I 7.3-46 03/.60
~
FSAR These isolation components are required to be functional in a loss-of-coolant accident environment. (See Tables 3.11-1, -2, and -3.) Electrical cables are selectea with insulat' ion designed for this service. Closing mechanisms and valve operators are considered satisfactory for use in the isolation control syster only ,after completion of environmental testing under loss-of-coolant accident conditions or submission of evidence from the manufacturer describing the results of suitable prior tests.
7.3.1.1.2.13 System Operational Considerations 7.3.1.1.2.13.1 General Information The containment and reactor vessel isolation control system is not required for normal operation. This system is initiated automatically when one of the 7.onitored variables exceeds preset limits. No operator action is required for at least 10 minutes following initiation.
All automatic isolation valves can be closed by manipulating switches in the control room, thus providing the operator with control which is independent of the automatic isolation functions.
7.3.1.1.2.13.2 Operator Information In general, once isolation is initiated, the valve continues to close even if the condition that caused isolation is restored to normal. The reactor operator must manually operate switches in the control room to reopen a valve that has been automatically closed. Unless manual override features are provided in the manual control circuitry, the operator cannot reopen the valve until the conditions that initiated isolation have cleared.
A trip of an isolation control system channel is annunciated in the control room so that the reactor operator is immediately informed of the condition. The response of isolation valves is indicated by OPEN/ CLOSED lights. All motor-operated and air-operated isolation valves have OPEN/ CLOSED lights.
Inputs to annunciators, indicators, and the process computer are arranged so that no malfunction of the annunciating, indicating, -
or computing equipment can functionally disable the system.
Direct signals from the isolation control system sensors are not used as inputs to annunciating or data logging equipment. Isola-tion is provided between the primary signal and the information output.
7.3.1.1.2.13.3 Set Po k Tschnical ts e<if.es b a. r Refer to N a r th' safety set point information.
A s O@s C
/cC 7.3-50 0 3 lda. O
l
.. ca FSAR 7.3.1.1.11 Standby Power System The standby power system is described in subsection 8.3.1.1.4 7.3.1.1.12 Heating, Ventilating and Air Conditioning (HVAC)
Systems for Engineered Safety Feature (EST) Areas The VAC systems for ESF areas are described in subsection 9.4.5.
7.3.1.1.13 Diesel Generator A2xiliary Systems The diesel generator auxiliary systems are described in sub-sections 9'.5.4, 9.5.5, 9.5.6, 9. 5. 7, and 9. 5. 8.
7.3.1.2 Design Basis Information The design of each engineered safety feature and auxiliary sup-porting system, including design bases and evaluation, is dis-cussed in Chapter 6 or 9, respectively.
IEEE Standard 279-1971 establishes specific protection system design bases. The following information demonstrates how the design bases listed in section 3 of IEEE Standard 279-1971 are implemented:
(Note: Numbers correspond to those in the IEEE Standard)
(1) Conditions The plant conditions which require protective action involving the systems of this section and other sections are examined and presented in Chapter 15 and Appendix 15A.
(2) Variables The plant variables which require monitoring to provide protective actions are identified in Tables 7.3-2, 7.3-3, 7.3-4, 7.3-5 for ECCS and Table 7.3-10 for con-tainment isolation function. For other ESF descriptions, ,
refer to the individual system ~ discussions, Tables 7.3-13, 7.3-16, 7.3-22, 7.3-25, and 7.3-28, or to Chapter 15 where safety analysis parameters for each event are cited.
-(3) Numbers of Sensors and Location he C
.f '#Mf.
The minimum number of sensors required to ..onitor safety-related variables are provided in Y. There are no sensors in the CRVICS, O
0 or ECCS,which have a spatial dependence, and therefore, C4 c.s, Fcate 5, SG TS , 3 Pm u or CC.Acis ' o l
i 7.3-74 03/.60
. GC
. FSLR D
location information is not relevant. Lc c .ti .. ;f- g
- .;;
- f
- r oth:: EE.' cy=ta= d::::ihad ;:: 2 : a ^, . d e f --
ir. Tables 7.2 12, 7.2 1C, 7.2 22, 7.0 25, 2.. J. 7 . 0 - 2 0 ,
- 4) Opera anal Limits 4
4 Y Prudent erational limits for each safety- elated Q riable t ip setting are selected to be r eno 4 v ab ve or be w normal operating levels o that pur-g v
iou ESF'syst initiation is avoided erif. d by ana sis that the relea It is then of ra Icactive teria , follo ng postulated g ss fai res of
- e
(
fu or t e nuclea. system proc s barri r, is k t O with'n acc table bo ds. De gn bas operat' nal
- limit as l' ted in A bles .3-2, -
, -4, an -5 for the ECCS, nd Table 7 -10 for the CRVI , Table tu 7.3-13 f the CS, Ta 7.3-1 for the WLC system, Table 7.3- 2 for e e TS, m ab 7.3-25 or the SPMU la system, and able -28 for he CPAC7 , are based on D operating exp rie e nd c s aine y'the safety design basis a he s f y ana "s s.
h (5) Margin Betwe Op at' na Lim
- s tu T The marg
- betwee o rati limits 7d the limiting conditi ns of o rati F r th ESF sys ms are those h parar ters as 1sted ir ables 3-2, -3, -4, -5, -10,
{
Q -1 , -16, -2 , -25, a 8. The argin i. ludes the y r ximum al' wable a uracy rror an sensor - t point g drift. nuncia s are pr ided, at the set toints, to aler the re tor operator f the o. et of u. afe s condi lons.
(6) L 1s Rea iring Protective Action Levels equ3 ring protective action a shown in trip leve setting Tables 7.3-2, -3, -4, 10, -13, -16,
-2 , -25, and -28.
(7) Range of Energy Supply and Environmental Conditions of Safety Systems .
The range of transient and steady-state conditions of 1 both the energy supply and the environment (for example, i I
voltage, frequency, temperature, humidity, pressure, vibration, etc.) during normal, abnormal, and accident circumstances throughout which the system must per-form are discussed as follows:
- a. Voltage and frequency The Class IE 120 V ac vital instrumentation and h control power scpplies are described in subsection 8.3.,.,.
7.3-75 1 \
I Inserts
- 4. Operational Limits Opera..onal limits for each safety-related plant variables are selected with sufficient margin so that spurious initiations are prevented. Design basis operational limits, as listed in Technical Specifications are based on operating experience and constrained by the safety design basis and the safety analyses.
- 5. Margin Between Operational Limits The margin between operational limits and levels requiring protective action for safety-related plant variables are listed in Technical Specifications.
- 6. Levels Requiring Protective Action Levels requiring protective action are provided in Technical Specifications.
er ,
~.
.(9) Minimum Performance Ppquirements fblT*echnice/[pt<ItitAY$nst /" ggj,f" D See N gfor CRVICS performance requirements.
Within ECCS, performance requirements refer only to a system as a whole and not specifically to individual *E0E' (See YA C N g 'g g gf Q . components p ,_ , s_y except , ._. ---
in the- area
- n) of accuracy. og V5*0 allowdis. s e}poM W3 t-3 f o f fi'*
- k 3* p System seemooseseAand rangeseare given for other ESF o 7.3-16, 7.3-22, 7.3-25, and
- systems
- 28. Sin y sTables k r p f e7.3-13,%.c n a. W. -g%u. appNes jfe Gsf $
7.
$3S3 &s osL lWlU l'n & 'T-e.chn icd Sp e. co f,'ca.fre% r ,
7.3.1.3 Final System Drawings Electrical schematic diagrams, functional control diagrams (FCD's),
final logic diagrams, and instrument location drawings are listed and provided by reference in Section 1.7. Piping and instrumenta-tion diagrams are provided as figures in the appropriate sections of Chapters 5, 6, and 9.
A comparison between final logic diagrams and the logic diagrams submitted in the PSAR is provided ir Table 7.3-31.
There are no safety, functional, or architectural design basis differences on the NSSS-designed ESF systems between the PSAR and the FSAR. Direct comparison between the PSAR and FSAR will verify this.
7.3.2 Analysis Appendix A of 10 CFR 50, General Design Criteria for Nuclear Power P1 arts, establishes requirements for the principal design criteria for water cooled nuclear power plants. Section 3.1 provides a detailed discussion of all general design criteria. This section describes how the criteria that are applicable to all engineered safety feature and auxiliary supporting systems are satisfied.
Criteria which are applicable only to specific systems are discussed in the following subsections for each system.
- a. Criterion 19 - Control Room The control room layout is described in Section 7.5.
Control room isolation is described in subsection 7.3.1.1.10. Plant shutdown from outside the control room is described in subsection 7.4.1.4 For further l
discussion of criterion 19, see subsections 7.3.2.10
! and 7.4.2.4 7.3-78 0 3 le GL C
1 GG FSAR An evaluation of emergency core cooling systems controls show that no operator action is required to initiate theHowever, correct the responses of the emergency core cooling systems.
control room operator can manually initiate every essential operation of the emergency core cooling systems. Alarms and indic'ations in the control room allow the operator to interpret any situation that requires the emergency This core cooling system arrangement limits and ,
verify the responses of each system. !
safety dependence on operator judgment, and design of the emergency core cooling systems control equipment has appropriately limited response.
The redundanca of the control equipment for the emergency core cooling systems is consistent with the redundancy of the cooling systems themselves. The arrangement of the initiating signals for the emergency core cooling systems, as shown in Figures 7.3-2 and 7.3-3 is also consistent with the arrangement of the systems themselves. Each system, including its initiating sensors, is separated from the other systems within the network of emergency core cooling systems.
No failure of a single initiating trip channel can prevent the start of the cooling systems when required or inadvertently initi-ate these same systems.
An evaluation of the control schemes for each emergency core cooling system component shows that no single control failure can prevent the combined cooling systems from providing the core with adequate cooling. In performing this evaluation the redundancy ofcomponentsandcoolingsystemswasconsid(red.3pec % +c,u. 031.60 the Tecknia The minimum number of trip hannels required to maintain function- .
al performance is given in Determinations of these minimums considered the use and re undancy of sensors in control circuitry and the relative reliability of s t;te controlled equipment in any individual cooling system.
/
,,43.6C .
L,
--__--^_
The ADS 2EEME '
The conditions relief valves are controlled by two trip systems.
indicated by the table result in both trip systems always remaining If an inoperable
(
capable of initiating automatic depressurization.
sensor is in the tripped state or if a synthetic trip signal is inserted in the control circuitry, automatic depressurization can The be initiated when the other initiating signals are received.
prohibition against simultaneously inoperative reactor vessel low water level and drywell high pressure trip channels in any one 7.3-80 03/,6o
GG FSAR trip logic is necessary to prevent situations where a trip logic ' 0 31. C.o is continuously in the tripped condition. The trip channel con-M' ditions indicated invenduhumummer avoid ,thes9' undesirable situa-tions. kk TechniedEtteduksh eet s fr.eaba.ne In e Tsehnied '
Mg o31.4 0 The conditions represented .
Jbm>9P are a result of a fuketional analysis of each indivicual f emergency core cooling system. Because of the redundant methods of supplying cooling water to the fuel in a loss-of-coolant acci-dent situation and because fuel cooling must be assured in such a situation, thc minimum trip channel conditions in the refer-enced tables exceed those required operationally to assure core cooling capability.
The only equipment protective devices that can interrupt planned emergency core cooling system operation are those that must act to prevent complete failure of the component or system. In no case can the action of a protective device prevent other redun-dant cooling systems from providing adequate cooling to the core.
The locations of controls that adjust or interrupt operation of emergency core cooling systems components have been specified.
Controls are located in the control room and are under super-vision of the control room operator.
The environmental capabilities of instrumentation for the emer-gency core cooling systems are discussed in the descriptions of the individual systems. Components that are located inside the containment and are essential to emergency cooling system per-formance are designed to operate in the containment environment resulting from a loss-of-coolant accident. Essential instru-ments located outside the drywell are also qualified for the environment in which they must perform their essential function.
Special consideration has been given to the performance of reactor vessel water level sensors, pressure sensors, and con-densing chambers during rapid depressurization of the nuclear system. This consideration is discussed in Section 7.5.
Capability for emergency core cooling following a postulated accident may be verified by observing the following indications:
- a. Annunciators for HPCS, LPCS, LPCI, and ADS sensor initiation logic trips
- b. Flow and pressure indications for each emergency core cooling system
- c. Isolation valve position lights indicating open valves 7.3-81 0 3 /~ G 0
- k. Criterion 64 PRM Subsystem:
Continuous radiation monitoring is provided for this
^*
discharge path under all reactor conditions.
7.3.2.2.2.3 Industry Codes and Standards 7.3.2.2.2.3.1 IEEE 279-1971 7.3.2.2.2.3.1.1 General Functional Requirement (IEEE 279-1971, paragraph 4.1) ,
- c. CRVICS The CRVICS initiates automatic closure of specific isolation valves from trip signals generated by specified process vari-ables and maintains the valves in a closed position without further application of power until such time as 3 manual reset is permissible.
The control system f r om each sensor to final control signal to the valve actuator, is capable of initiating appropriate action and of doing it in a time commensurate with the need for valve closure. Total time, from the point where a pro-cess out-of-limits condition causes a channel trip to the energizing or deenergizing of appropriate valve actuators, is less than 200 milliseconds. The closure time of valves ranges upward from a minimum of 3 seconds for the main steamline isolation valves, depending upon the urgency for isolation considering possible release of radioactivity.
Thus it can be seen that the control initiation time is at least an order of magnitude lower than the minimum required valve closure time. Speed of the sensors and valve actuators are chosen to be compatible with the isolation function con-sidered.
Accuracies of each of the sensing elements is sufficient to accomplish the isolation initiation within required limits without interfering with normal plant operation. Accuracies #, 03I00 of each of the types of sensing instruments used for isola- ,gggggg
- " ^"*
peciffeafb.,
The reliability of the isolation contro stem is compat-ible with and higher than the reliabilit f the actuated equipment (valves).
(
7.3-116 031 Go O l
~
- a. Criterion 13: Instrumentation and Control Instrumentation is provided with the SGTS to monitor the appropriate variables and signals required to .
. initiate the system and to maintain these variables witnin their prescribed ranges. The variables moni-tored are listed in Table 7.3-22. The ranges provided assure continuous monitoring over the full range of .
AD antAcigated operatiopal and accident conditions cu s(tArb'cl 55 t% th J t-c k d cal W N Lk U C M - %
- b. Criterion 20: Protection System Functions The SGTS control system includes sensors to respond to accident conditions in order to automatically initiate system operation when required. The plant conditions under which the SGTS is required to operate are shown ir. Chapter 15. Initiation circuits are discussed in subsection 7.3.1.1.8.1. No operator action is required to initiate the SGTS during accident conditions.
- c. Criterion 21: Protection System Reliability and Testability Functional reliability of the SGTS is assured by compliance with the requirements of IEEE Standard 279-1971 as described in subsections 7.3.1.2.6 and 7.3.2.8.2. Testing is in compliance with IEEE Stand-ard 338-1971 as discussed in subsection 7.3.2.8.3.
- d. Criterion 22: Protection System Independence Independence of the SGTS is assured by design which includes redundancy and diversity as discussed in ,
subsections 7.3.1.1.8.6 and 7.3.1.1.8.7.
- e. Criterion 23: Protection System Failure Moder TMe SGTS logic circuits are designed to fail in a safe position. Rclays deenergize to initiate protective action. Motor operated dampers fail as-is on a loss of power. Failure modes of the SGTS are discussed in subsection 7.3.2.8.4 08
- f. Criterion 24: Separation of Protection and Control Ey.atems The SGTS components are physically and electrically separated from nonessential plant control circuits.
Failure of nonessential equipment will have no effect on the SGTS.
7.3-168 Amend. 38 4/80 ;
l 03/ Goo !
i
GG FSAR e.' Criterion 23: Protection System Failure Modes The suppression pool logicThe system is designed to fail motor operated valves into the preferred state.
fail as-is on loss of power. The icgic relays are energized to initiate protective functions in order to minimize the possibility of inadvertent dumping of the upper containment pool during normal operation.
Refer to subsection 7.3.2.9.4 and Section 6.8 for a discussion of failure modes of the suppression pool makeup system.
- f. Criterion 24: Separation of Protection and Control Systems The suppression pool makeup system compor.ents are physically and electricallyFailure separated from nonessential of nonessential equip-plant control circuits.
n.ent will have no effect on the system.
- g. Criterion 35: Emergency Core Cooling The suppression pool makeup system ensures that the suppression pool provides an adequate long term heat The rate of dump is sink for the five ECCC pumps.
sufficient to prevent the five ECCS pumps from lowering the suppression pool level below the minimum required.
- h. Criterion 37: Testing of Emergency Core Cooling System Provisions are included in the suppression pool makeup j system to allow periodic testing of each component in i the system without initiating protective action during reactor operation. Refer to subsection 7.3.2.9.3 for J
a discussion of system testing. l l
7.3.2.9.2 Conformance to IEEE Standard 279-1971 ,
The suppression pool makeup system is designed to conform with the rcquirements of Section 4 of IEEE Standard 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, as dsscribed below:
- a. Requirement 4.1: General Functional Requirement The suppression pool makeup system is automatically initiated whenever the conditions it monitors require protective action. The level at which protective O
. action is required is shown in .
g, e ,
io j 7.3-174 03/ 60
- c. Criterion 20: Protection System Functions The plant conditions under which the CRACIS is required to operate are shown in Chapter 15. Initiation cir-cuits are automatic as described in subsection 7.3.1.1.10.1
- No operator action is required to initiate the CRACIS~during accident conditions.
- d. Criterion 21: Protection System Reliability and Testability Functional reliability of the CRACIS is assured by compliance with the requirements of IEEE standard 279-1971 as described in subsections 7.3.1.2 and 7.3.2.10.2. Testing is in compliance with IEEE Standard 338-1971 as described in subsection 7.3.2.10.3
- e. Criterion 22: Protection System Independence
- Independence of the CRACIS is assured by design which includes redundancy and diversity as described in subsections 7.3.1.1.10.6 and 7.3.1.1.10.7.
- f. Criterion 23: Protection System Failure Modes The CRACIS logic circuits are designed to fail in a safe position. Relays de-energize to initiate protective functions. Motor operated dampers fail as-is on a loss of power. Failure modes of the CRACIS are discussed in subsection 7.3.2.10.4.
- g. Criterion 24: Separation of Protection and Control Systems The control roem atmospheric control and isolation system is not used for both control and protection. See subsec-tion 7.3.2.10.2, Requirement 4.7.
7.3.2.10.2 Conformance to TEEE Standard 279-1971 The CRACIS is designed to conform with the requirements of Section 4 of IEEE Standard 279-1971, " Criteria for Protection System for Nuclear Power Generating Stations," as described in this section.
- a. Requirement 4.1: General Funes.'nal Requirement Actuation of the CRACIS is automatic whenever the variables lj3 o
' ' " - - ' 'spe reach their a set point as de-E scribed in subsection 7.3.1.1.10.1. 1 o
"Nchnical @cbb 7.3-180 03660
- a. RCIC turbine inlet pressure
- b. RCIC turbine outlet pressure
- c. RCIC pump suction pressure
- d. RCIC pump discharge pressure
- e. RCIC pump discharge flow
- f. RCIC turbine speed
- g. RCIC turbine exhaust line pressure
- h. RCIC turbine suction pressure Indicating Lamps
- a. Position of all motor-operated valves
- b. Position of all solenoid-operated valves
- c. Turbine trip solenoid energized or deenergized
- d. Turbine test selector in test position
- e. All. sealed-in circuits
- f. Pump status Annunciators Annunciators are provided as shown in the RCIC system FCD (See Section 1.7) and the RCIC system P&ID per Figures 5.4-10 and 5.4-11.
7.4.1.1.5.3 Set Points Instrument settings for the RCIC system controls and instrumenta-
' '
- E tion arey' i -_1_- "_**
shown in Tat i sen dical dp 848 b.o d..*f. 031.(so The reactor vessel low water level setting for RCIC system ini-tiation is selected high enough above the activc fuel to start the RCIC system in time to prevent the need for the use of the engineering safeguards. The water level setting is far enough below normal levels that spurious RCIC system startups are avoided.
7.4-9 8 3 /, la o.
l i b. Ventilation Systems - radiation monitoring subsysta=s 1
- 1. Cont inment/drywell ventilation exhaust radiation monitoring subsystem
, 2. Auxiliary building - fuel handling area ventilation exhaust - radiation monitoring subsystem
- 3. Auxiliary building fuel handling area pool sweep exhaust - radiation monitoring subsystem 4 Control room intake - radiation monitoring subsystem Area and airborne radiation monitors are discussed in section 12.3.4 The following non-safety-related process radiation monitors ,
are discussed in Section 11.5:
- a. For gaseous effluent streams
- 1. Containment ventilation exhaust RMS
- 2. Radwaste building ventilation RMS
- 3. Fuel handing area ventilation FWG 4 Turbine building ventilation RMS
- b. For liquid effluent streams
- 1. Radwaste effluent RMS
- c. For gaseous process streams
- 1. Offgas pretrea' ment t RMS
- 2. Offgas post-treatment RMS
- d. For liquid process streams
- 1. Service water system RMS (loops A and B)
- 2. Component cooling water RMS The process radiation monitoring system is shown in Figure 7.6-1.
\
03I.6 o 7.6.1.2.1 Main Steam Line Radiation Monitoring Subsystem The main steam line radiation subsystem is discussed in subsec-tiens 7.2.1, 7.3.1, and 11.5.1.1.1.
7.6-7 0 3 4 (a o
og FSAR tioning equipment, the detector produces a reading of full scale on the most sensitive range with a neutron flux of 4 x 10 8 nv. The detector cable is connected underneath the reactor vessel to a triple-shielded cable that carries the pulses generated in the fission i chamber to the preamplifier. I
~~
The detector and cable are located in the drywell.
They are movable in the same manner as the SRM detec-tors and use the san.e type of mechanical arrangment (see Figures 7.6-7, 7.6-8, and Ref. 1).
- c. Signal Conditioning 1
A voltage amplifier unit located outside the drywell serves as a preamplifier. This unit converts the current pulses to voltage pulses, modifies the voltage signal, and provides impedance matching. The pre-amplifier output signal is coupled by a cable to the IRM signal conditioning electronics (see Figure 7.6-10).
Each IRM channel receives its input signal from the preamplifier and operates on it with various combina-tions of preamplification gain and amplifier attenua-tion ratios. . The amplification and attenuation ratios of the IRM and preamplifier are selected by a remote range switch that provides 10 ranges of increasing attenuation (the first 6 called low range and the last 4 called high range) acting on the signal from i the fission chamber. As the neutron flux of the l reactor core increases from 1 x 108 nv to 1.5 x 10 13 !
ny, the signal from the fission chamber is attenuated to keep the input signal to the inverter in the same range. The output signal, which is proportional to i neutron flux at the detector, is amplified and sup- 1 plied to a locally mounted meter. Outputs are also provided for a remote meter and recorder. ,
- d. Trip Functions flocTsch, deal Ep8e$8dde l The IRM Scram Trip Functions are iscussed in Section 7.2. The IRM trips are shown in achiassautumm The IRM M rod block trip functions are discussed in subsection
}t\
7.6.1.6.2. 03l4g) '
7.6.1.5.4.1.1.1 Bypasses and Interlocks The arrangement of IRM channels allows one IRM channel in each group to be bypassed without compromising intermediate range neutron monitoring.
7.6-30 631sb O
/
I
. GG FSAR The LPRM amplifier signals are indicated on the operator's control console. When a central control rod is selected for movement, the output signals from the amplifiers associated with the nearest 16 LPRM detectors are dis-played on operator's control console meters. The fo'r
~
.. LPRM detector signals from each of the four LPRM assemblies are displayed on 16 separate meters. The operator can readily obtain readings of all the LPRM amplifiers by selecting the control rods in order.
Subsection 7.6.1.6, Rod Control and Information System, describes in greater detail the indications on the operator's control console.
- d. Trip Functions a
The trip circuits for the LPRM provide trip signals to activate lights, instrument inoperative signals, and annunciators. These trip circuits use the de power supply and are set to trip on loss of power. They also trip when power is not available for the LPRM -
.: , . . . , _ _ the t M amplifiers. [V i Eh t.Tthnied g eci&,nt sh* drips.
The trip levels can be adjusted to within + 0.5 percent of oyI.64 full-scale deflection and are accurate to 1 percent of full-scale deflection in the normal operating environment.
7.6.1.5.5.1.2 Bypasses and Interlocks Each LPRM channel may be individually bypassed. When the maximum number of bypassed LPRMs associated with any APRM channel has been exceeded, an inoperative trip is generated by that APRM.
7.6.1.5.5.1.3 Redundancy The LPRM channels meet the redundancy criterion because of the multiplicity of sensing channels. The minimum number of LPRMs that must be in service is shown in Figure 7.2-2.
7.6.1.5.5.1.4 Testability LPRM channels are calibrated using data from previous full power runs and TIP data and are tested with arocedures in the applic-able instruction manual.
7.6.1.5.5.2 Environmental Considerations Each individual chamber of the assembly is a moisture-proof, pressure-sealed unit. The chambers are designed to operate up to 600 F and 1250 psig. The wiring, cables, and connectors located within the drywell are designed for continuous duty up to 270 F; 7.6-34 0 3/. 6 0
. FSAR Each APRM channel receives two flow signals represen-tative of recirculation driving loop flow. The flow signals (Figure 5.4-3) are sensed from two pairs of elbow taps, one in each recirculation loop.
- g 02/.40
- c. Trip Function ; gg- y ,
APRM system trips are --- '
_l _ -'1 -
The 'M APRM scram trip funct on is discussed in Section 7.2.
The APRM circuit arrangment for RPS trip input is shown in Figure 7.6-12. The APRM rod block trip function is discussed in subsection 7.6.1.6.2.
7.6.1.5.6.1.2 Bypasses and Interlocks I j
The operator can bypass the trips from one APRM in each trip sys- l tem of the RPS.
7.6.1.5.6.1.3 Redundancy Eight independent channels of APRMs monitor neutron flux. The eight channels are separated into two groups of four, one group per RPS trip system. Any one of the four APRMs indicating an abnormal condition will initiate its associated trip system.
Initiation of both trip systems causes a reactor scram.
7.6.1.5.6.1.4 Testability APRM channels are calibrated using data from previous full power runs and are tested by procedures in the applicable instruction manual. Each APRM channel can be tested individually for the operability of the APRM scram and rod blocking functions by introducing test signals.
7.6.1.5.6.2 Environmental Considerations All APRM equipment is installed and operated in a contrcl room environment as described in Table 3.11-1. The APRM system is capable of functioning during and af ter certain design basis events such as earthquakes and anticipated operaticnal occurrences.
7.6.1.5.6.3 Operational Considerations -
The APRM system i- a monitoring system which has no special oper-
~
ational considerations.
The method used for identifying power and signal cables and cable trays as safety-related equipment, and the identification scheme used to distinguish between redundant cables, cable trays, and instrument panels is in accordance with the requirements of 7.6-36 0 3). G o
- GG rSAR 03/,(.o func+[an
- c. Documentation of m.inimal number and seenenen, of sensors required to monitor adequately _ _ _ . . .-- ; ! __ ' _
_ .: 2.
l 6N.3l1eun in hL Teeknoc4gail lGaf51 *
- d. Operational Limits - not appliable for RPT.
- e. Margin between Operational Limit and Unsafe Conditi.on
- - not applicable to RPT.
.f. Levels that when reached will require protective action - not 6pplicable for RPT.
- g. Document the Range of Transient and Steady State Con-ditions Throughout Which the System Must Perform -
see subsections 8.3.1 and 8.3.2.
- h. Document the Malfunctions, Accidents and other Unusual Events which could cause Damage - see subsection 7.2.1.2.8.
N E ck m [.a/ Ie
- 1. Document minimum performance requiren ents - see animaas T.: ., ... ,, _; . : : . Sp e uWca.Mnf . g 7.6.1.9 Spent Fuel Pool Cooling and Cleanup System - Instrumen-tation and Controls 7.6.1.9.1 System Identification The fuel pool cooling portion of the fuel pool cooling and cleanup system is classified as Safety Class 3. Instrumentation is sup-plied to maintain the fuel pool temperature within safe limits.
The filter /demineralizer portion is not safety related. The instrumentation is for plant equipment protection and for the operator only.
The fuel pcsl cooling and cleanup system is an independent system during normal operations. Evaporative losses in the system are replaced by the condensate storage system. If the heat load should become excessive, the shutdown cooling portion of the residual heat removal system is operated in parallel with this system to remove the excess heat load.
7.6.1.9.2 Power Sources I
The fuel pool cooling portion operates off Division I and II 120 V ac ESF power bus. The filter /deminerali=er portion receives its power from a reliable 120 V ac bus.
7.6.1.9.3 Equiprent Design The essential components of the fuel pool cooling system have been designed to seismic category I requirements.
7.6-49 03/.J O
4 "
. FSAR (NOTE: Numbers correspond to those in the IEEE Standard.)
- 1. The suppression pool temperature monitoring system is in operation under all generating station conditions.
It does not initiate any protective actions.
- 2. The generating station variable (suppression pool temperature) monitored by the system is given in Table 7.6-_11.
[
- 3. The cuantity 2M '--2 tion of tAe- temperature jsensors are also.civen in Table 7. 6-11. 74 c /oca,h on or fWe, sprJ&f are s Fig va c.
4 ukeYa#ge.ceFed tional limits foronthis dnuso,.<3 variableno-woa for each eahicL modenof sinom sis operation are given in M.-the TecAdcs/ Spec:Wceh6, /.
- 5. The margin between operational limits and the level p considered to mark the onset of unsafe conditions is o given in suedumulmenten-flte 7ukndat Spe d 6'caML t-c-
O
- 6. The level at which an alarm is registered is given in Eugenussemak Side- IM Ticinica/ Sgu0 fica /rcu.r.
- 7. See subsection 7. 3.1.2 (7) . .
- 8. See subsection 7.3.1.2(8). 3 '*' 8 "'
gilem(,le aebe'nf YMc. r!C
- 9. System augueumpgand rangerare given in Table 7.6-11, 7.6.1.12 Auxiliary Building Isolation System The auxiliary building isolation system serves to close all pene-trations through the secondary containment boundary upon detection of a LOCA. Refer to subsection 6.2.3 for a discussion of the secondary containment.
Final system drawings for the auxiliary building isolation system
.are provided by reference in Section 1.7. The logic diagram is Drawing J-1260. The electrical schematic is Drawing E-1219.
7.6.1.12.1 Initiating Circuits
- The auxiliary building isolation system is automatically initiated by a LOCA signal from the containment and reactor vessel isolation control system (CRVICS) . Manual initiation is also possible on a system level by manually initiating the CRVICS, which initiates both the NSSS and non-NSSS portions of the CRVICS as well as the auxiliary building isolation system, or on a device level from control room handswitches.
~
7.6.1.12.2 Logic The signals which initiate the auxiliary building isolation ~ system are arranged in a one-out-of-two-taken-twice logic and are part of 7.6-55 03/.40
GRAND GULF e
OVESTION 031.71 Apparent inconsistencies and omissions ure noted in the analysis for con-pliance with the following criteria. Amend the FSAR as required, A. RCIC
- 1) Regulatory Guide 1.6. Justify your statement that because the single failure criteria is not applicable, RG-1.6.is not applicable to RCIC.
- 2) Cencral Design Criteria 2.1. The analysis addresses testability but does not address reliability.
- 3) General De:,ign Criteria 29. The analysis merely states the function of RCIC; it does not address the probability of the system functioning when needed.
- 4) General Design Criteria 34. The analysis consists of a reference to a non-existent subsection. ,
N 5) IEEE 279. The discussion presented under paragraph 4.12 is pertinent to paragraph 4.13 and is unrelated to paragraph 4.12.
p The discussion should be modified as needed and relocated to paragraph 4.13. It appears that there are no operating bypasses as defined in IEEE 279 associated with RCIC.
B. SLCS
- 1) General Design Criteria 20 and IEEE 279 paragraph 4.1. The analysis describes instruinentation that is not a part of the SLCS. Justify the non-canpliance of the SLCS with the autanatic actuation requirement.
- 2) General 'Desigr. Criteria 28. The analysis presented does not address GOC 28. Does the SLCS meet GDC 28 assuming that the maximum amount of the SLCS piping that could contain cold water does so at the time the system is activated with the reactor at full power?
- 3) IEEE 279, paragraph 4.8 and 4.9. The analysis presented describes instruments that are neither system inputs nor system input sensors.
C. RHR
- 1) Regulatory Guide 1.22. The analysis refers to the " analysis for Regulatory Guide 1.47" for clarification and amplification. What specific Regulatory Guide 1.47 analysis provides this clarification?
- 2) Regulatory Guide 1.32. The analysis consists of a reference to conformance statements for GDC 17 and IEEE 308, neither of which
. is discussed for RHR.
~
- 3) Regulatory Guide 1.75. What Class- IE RHR circuits are redundant to non-Class IE RHR circuits-(paragraph e).
Question 031.71
. l
\
l
= .
I RESPONSE 031.71 A. RCIC
- 1. Regulatory Guide 1.6 is concerned with independence between redundant standby pcwer sources. RCIC does not have redundant power sources. It should be noted that two divisions of 125 VDC power are used to power inboard and outboard isolation valves that are defined as RCIC system valves.
These power supplies meet Regulatory Position 3 of Reg. Guide 1.6.
Subsection /.4.2.1.2.1.1 will be revised to read as follows:
" 7.4.2.1.2.1.1. Although it is not required that RCIC alone meet single failure criterion, redundant DC power sources are required for inboard and outboard RCIC isolation valves. These power sources are consistent with the guide-11.nes of Reg. Guide 1.6 for DC power supplies under Position 3.*
2,3, and 4. RCIC is not a protection or reactivity control system, hence GDC's 20 through 29 do not apply. GDC's 34 and 37 likewise do not apply.
GDC 33 does apply. Subsection 7.4.2.1.2.2 will be revised to delete references to CDC's 20 through 29, 34, and 37. This subsection will also be revised to include a conformance statement on GDC 33. That statement will read as follows:
"The RCIC system conforms to General Design Criterion 33 by performing the functions described in Subsection 7.4.1.1.1.1.D
- 5. The present text of Subsection 7.4.2.1.2.3.1.12 is applicable to Subsection 7.4.2.1.2.3.1.13. These subsections will be revised.
Subsection 7.4.2.1.2.1.1.12 will read as follows:
5 RCIC operating bypasses are not automatically defeated by initiating signals. This is not a violation of IEEE 279-1971, paragraph 4.12, because RCIC and HPCS cannot be simultaneously bypassed."
Subsection 7.4.2.1.2.3.1.13 will be revised to include the discussion provided currently under 7.4.2.1.2.3.1.12. ;
l Table 7.1-3 will be revised to reflect the above responses 2, 3, and 4.
[
l
~
i
, l RESPONSE 031.71, continued.
B. SLCS 1 and 2. As discussed in Section 3.1, the GDC's pertaining to Protection and Reactivity Control Systems (GDC's 20 through 25, 27, and 28) are fully satisfied without the inclusion of the SLCS. This system provides additional (backup) reactivity control. Subsection 7.4.2.2.2.2. will be revised to delete the references to the above GDC's.
- 3. It is correct that the display instruments described
.. in 7.4.2.2.3.1.8 do not directly provide system inputs
- or system sensors to the SLCS. However, these
', instruments display to the operator the status of functions of other systems upon which the operator decides whether or not to manually initiate the SLCS. Therefore, to the extent feasible and practical, system inputs to the SLCS are derived from the operator, based on his judgement from observing displays which are direct measures of desired variables. The SLCS, as an independent system governed by intent and design definition described elsewhere, of necessity requires a man / machine interface as described above. It is in this sense also, that the annunciated status of sodium pentaborate tank temperature, level, discharge pressure and explosive valves control circuit continuity, does in fact provide a means of checking, with a high degree of confidence, the operational status of the SLCS system.
The FSAR will be amended as follows:
Subparagraph 7.4.2.2.2.3.1.8 will add the following ahead of the first sentence:
"Since SLCS is a manually initiated system, inputs are derived directly from the operator."
The last sentence will be revised to delete the words:
"may manually" and substitute: " decides whether or not to."
Subsection 7.4.2.2.2.3.1.9 will be revised to read as follows:
"The operational availability is checked for by the operator. The sensor checks are made by operator observation of analog indicators, indicating lamps, annunciators and status lights located in the control room and locally at the equipment. Refer to subparagraphs 7.4.1.2.5.2 and 7.4.1.2.5.3 for further clarification."
RESPONSE 031.71, continued.
2 C. RHR
- 1. The FSAR will be amended so that subsection 7.4.2.3.2.1.2 will read as follows:
I "7.4.2.3.2.1'.2 Regulatory Guide 1.22.
Conformance to this regulatory guide is achieved by providing periodic system and component > i testing, including actuation devices, either during l reactor power operation or shutdown."
- 2. The FSAR will be amended so that subsection 7.4.2.3.2.1.5
- will read as follows
"Conformance to Regulatory Guide 1.32 is discussed in FSAR sections 8.2 and 8.3."
- 3. There are no Class IE RHR circuits that are redundant to non-Class IE RHR circuits. Subsection 7.4.2.3.1.9.e will
, be revised to read as follows:
"e. Separation between Class IE and non-Class IE circuits will meet the same minimum requirements for redundant Class IE circuits or they will be treated as associated circuits."
GRAND GULF Below Inserts A - F are replacements or new material for FSAR, see attached FSAR pages.
j[ng ef t A "Although it is not required that RCIC alone meet single failure criterion, redundant DC power sources are required for inborad and outbcard RCIC isolation valves. These power sources are consistent with the guidelines of RG 1.6 for DC power supplies under Position 3."
In ger9r j) "RCIC operation bypasses are not automatically defeated by initiating signals. This is not a violation of IEEE 279-1971 para. 4.12 because RCIC and HPCS cannot be simultaneously bypassed."
- C n ser-r D "The operational availability is checked for by the operator.
The sensor checks are made by operator observation of analog indicators, indicating lamps, annunciators and status lights
-located in the control room and locally at the equipment.
Refer to subparagraphs 7.4.1.2.5.2 and 7.4.1.2.5.3 for further clarification."
T. ng ge-t- g "Conformance to this regulatory guide is achieved by providing periodic system and component testing, including actuation devices, either during reactor power operation or shutdown."
I~'n s ie v-t F "e. Separation between Class IE and non-Class IE circuits will meet the same minimum requirements for redundant Class IE circuits or they will be treated as associated circuits."
l I
l
u a There are oeveral meann by which the RCIC system could be delib-s erately rendered inoperative by plant operating personnel:
- a. Manually opening feeder breakers to the notor starter for valven, etc., that are required to function during '
- RCIC operation. Manually opening a breaker for a
. specific moter will deenergize the control power to the motor starter activating an RCIC out of service annunciator. Tagging procedures are also used to indicate out-of-service equipment and are considered an adequato indication of equipment status. Marual opening of breakets is a requirement for safe main-tenance of equipment.
- b. Manually opening de control power feeder breakerc.
Tril ping or openino a de control power . feeder becakcr will give a loss-of-power alarm.
Manually shutting off instrument line valves in c'.
various specific combination.
'I d. Placing of the flow controller from Auto to Manual operation in the control room or adjusting Auto set point into the incorrect position. Manual opera-tion of the flow controller is provided to allow opera-i tor intervention should the auto portion of the controller fail. The availability of an auto set point
(~s control on the controller is desirable so that the operator can rcqulate the flow to maintain water level rather than cycling the turbine between the auto trip and start level set. points and without going to the Manual mode of operation. The controller is in the ;
control room and therefore under the direct super- "
vision of tho, control room operator. l t
All of these items are under supervisory contr.o1 and are not .
automatically defeated by RCIC initiation signals.
The following is a list of automatic bypasses.which can render l the RCIC system inoperative:
- a. RCIC steam line isolation signal
- b. RCIC turbine trip caused by:
- 1. RCIC isolation signal
- 2. RCIC pump suction pressure low i
I 3. RCIC turbine exhaust pressure high
'8' 4. Reactor vessel high water level
.I' 5. RCIC turbine overspeed These' functions are discussed in subsection 7.4.1.1.3.2.
Q uerflon 031.~11
FSAP,
- To provide a high degree of assurance that the RCIC system shall operate.when necessary and in time to provide adequate inventory makeup, the power supply for the system is taken from energy sources of high reliability which are immediately available. ;
Evaluation of instrumentation reliability for the RCIC system shows that no failure of a single initiating sensor either pre-vents or falsely starts the system.
A design flow functional test of the RCIC system can be performed during plant operation by taking suction from the demineralized water in the condensate storage tank and discharging through the full flow test return line back to the condensate storage tank.
During the test, the discharge valve to the reactor vessel remains closed and reactor operation is not disturbed. Control system design provides automatic return from the test mode to the operating mode if system initiation is required during testing except for the conditions described in subsection 7.4.1.1.3.1. ;
Chapter 15 and Appendix 15A examine the system-level qualitative FMEA aspects of this system in plant operation and consider its function under various plant transient events.
7.4.2.1.2 Con *ormance to Specific Regulatory Requirements 7.4.2.1.2.1 Conformance to NRC Regulatory Guides 7
i s~ General exceptions and positions taken on the Regulatory Guides, and the Revision of the guide that is'followed, are discussed i in Appendix 3A. Specific applications of selected guides to the RCIC system are discussed in this subsection. 1 7.4.2.1.2.1.1 Regulatory Guide 1.6 - Independence Between Redundant Standby Power Sources and Between Their Distribution Systems InSer t A I
7.4.2.1.2.1.2 Regulatory Guide 1.11 - Instrument Penetrating Primary Reactor Containment All RCIC instrument lines penetrating or connected to (primary) reactor containment meet the requirements of Regulatory Position C.1 of Regulatory Guide 1.11.
~7.4.2.1.2.1.3 Re gulatory Guide 1.22 - Periodic Testing of Protection System Actuation Functions RCIC is fully testable from initiating sensors to actuated devices during full power operation.
/
- %/
l 7.4-21 r
GG ,
FSAR 7.4.2.1.2.1.11 Regulatory Guide 1.75 - Physical Independence of Electrical Systems Conformance to Regulatory Guide 1.75 is discussed in subsections 7.1.2.2 and 8.3.1.4.
7.4.2.1.2.1.12 Regulatory Guide 1.89 - Qualification of Class IE Equipment for Nuclear Power Plants Conformance to Regulatory Guide 1.89 is discussed in Section 3.11.
7.4.2.1.2.2 Conformance to NRC Regulations - 10 CFR 50 Appendix ,
A Requirements '
7.4.2.1.2.2.1 General Design Criterion 13 The reactor vessel water level, RCIC pump discharge pressure, and RCIC flow rate are monitored and displayed in the control room.
- 7 . , . 2 .1.-2 72 ; 2 Crn;zul ;;;i- _;ic:rirn l-
}
t Th "C!C cycter renet ntly reniter: the U2ter ic"el in tha-seae ,
tcr v;;;el e..' io ....-a-ic lly initict:d ch:n th: 1 d-- --
L lsw the pre ;;t:bli:hed ::t peint. -- ~
'_"_2_'_2.2.2 cencral De icn crit--4^" 91 -
_.C!C 1: fully t::t:ble fr r rencer te retrrtre d:ri:: durin; j n;;;.cl Op ::ti:n. ] ,
I r
7." J.1.2.2." C;ncr:1 C;;ign, Crit:ri:n 22.-- .
_ g g ,_ n_ -s.s
. . _ _a._ _s.-_ _ _ - _,-_ - _ ,_
s __ _- - ,3.2 u. . ..a...a..u n.a....a... c
- in
- ;;t ;f tus t;i;; 1;;ic.--
- C
'." 2.' 2.2.5 C n;;;l C;;ign . Crit;;i n 2^ ----
,jl v
1
- rter :::=1 zz cr le--, - r-ieir- th: - r _ _, s,
-"-'^- i- the 2._nt th-_ ::::t:: ' ---- 2 1-t:f f_: th: r in- 3 r--'-- er durir; rrr:1 :perrtirr. Q.l 33 7.4.2.1.2.2.6 General Design Criterion r .
gN TQ RCIC sy s+f n rosn Noems 'f o Ge nt r% I b e r A (H W'#'t 3I peg mig & ck%g % cbvnb,A in subsection 7.4.1.1.1.1.
'a .2.'_2.2_'
. Cen:: 1 C::ign Crit;_ ic. 27 "C20 i: .;t p;;t ;f th; CCCC.
7.4.2.1.2.3 Conformance to Tndustry Codes and Standards
- 7. 4 . 2.1. 2. 3 .1 IEEE Std. 279-1971
{ .
7.4-23 gesfran o T/.7p/// t /Po
us FSAR system, whether active or passive, is capable'of performing its intended function. Sensors can be exercised by applying test pressures. Pumps can be started and pumped against the system check valves (or return to condensate storage tank through test valves) while the reactor is at pressure. Motor-operated valves can be exercised by the appropriate control relays and starters, and all indications and annunciations can be observed as the system is tested.
7.4.2.1.2.3.1.11 Ct.annel Bypass or Removal from Operation (IEEE Std. 279-1971 Paragraph 4.11)
Calibration of a sensor which introduces a single instrument channel trip will not cause a protective function without the coincident trip of a second channel. There are no instrument channel bypasses. Removal of a sensor from operation during calibration does not prevent the redundant i.strument channel from functioning. Removal of an instrument channel from se.;vice during calibration will.be brief. .
7.4.2.1.2.3.1.12 Operating Bypasses (IEEE Std. 279-1971, Paragraph 4.12)
INS ERT e -
. (7, 0
- Mo
7.4.2.1.2.3.1.13 Indication of Bypasset (IEEE Std. 279-1971, Paragraph 4.13)
Automatic indication of bypasses is provided by individual annunciators to indicate what function of the system is out cf service, bypassed or otherwise inoperative. In addition, each of the indicated bypasses also activates a system out of service annunciator. Manual system out of service switches are provided for operator use for items that are only under supervisory control.
INSER T &
7.4.2.1.2.3.1.14 Access to Means for Bypassing (IEEE Std. 279-1971, Paragraph 4.14)
Access to motor control centers and instrument valves is con-trolled as discussed in subsection 7.3.2.1.2.3.1.12. Access to other means of bypassing is located in the control rocm and therefore under the administrative control of the operators.
I~
7.4-27
o n .3o o n ._s j 03:.33 811. 83 ,,
a .....,
......s.
.....,.,., m. ...
. !. ,o,,,,,,,,,,,,,
- am.o,-
o,,,,,,,,,,,,
- . . . . . . . . .. ... .. . . .8 . .
,a , a so. ar tv h !a u
j g i
!i sig iL l nn!lil is isil i l! ! .I 1 tal i I is I
- i i i
- ;
- - aau s bf]8 s .!;S
. 5 I:o .: is l =
5
! s !
!!i!
s ei s ;: ps v,i:
m iis: i!!!:P 5.!. l!!
1
~9 ii,"
l i
.i iM!
l'!'3
!h_
't !s...!
I it b gi.. h i'i
, i i !,!.s1 -
r:
- e !g 1
y:
P
- 1. -
5 x
- M:-: g. .] i _<1!j:o I':! ja u*! .i. 82l13-'!*
t 2 s*
e> a .;!l; -
0 5 sbc g_ 82 s s :: : 2 v .p; ::* :g[E!' -: g ),$E-g : . lns'le . : 1* 3fsg:3%[:' r r. , :m I9 2 1 gi3g: [ ,u ugg !js l:82 :i::
!v s flug' !!v
" o
'd ag i Se j - *es
- 8: 5! : : s. jI';' sy; in g q{ f,,,. h Mg =i 2f ls1* a ]i:s !=gigj Sg 8 s !2.:2 s ;
- j o,'!
i
- '3
- I is :J 3 z>2 . 5 7' . .,, w! .
. 3
"':lE
. 5 I!Iw 3I : : 2 I E 'l! O y s I 5v a .h ;vh y t; ,
ee ces se m x mixl ix!xlxixfxlx xl1 Mix xi x x x.x .
lx mi se cea se m a mini jalx1xixl mix x!llx,x si .i i
___xi l z.x x l 32 x m:xlnIx!xixla1alx x1 gx A x >O se CFe u es. mix x x x xlx x x x xix x x x x xix x x x'x x1 W x Klutzixixixialula xt*: mix x ,,, I ooc e xix x.x x:x x x x.x xtx n'aix I z Ilmixtxtxlxlxjylx mi- l lll aus a x;u_xix x xix x x.x,at x,x x xix 4 i i es
. ; . . : : .4-_ J.ix!x zo sus x xlululain,ulaixix xl,Ixlx! x;xex: M M x;x x-u.utsix xix'xix , =
l o$
- x x exe x i x l x l x t. z l. u i x t. x j a m i l. l u l x xtu,x!x xtx x Mex'n,xtx:x'xix .
l I
,g
- =,
.oc e x mixtujmixix xtmix x!ltxix xix' mix x xix x.x x:x; m x x,x x r t
.ac e. x xi ; 'i i !x i i ;;i , x- ' . i 238 sii i
.cu a i i l II l l i ii; I -
I i
! , it 3!$
-6x x xi ,. xix x x
.oe n xi st u s m ixi x! xim ix xtx xl x.x x.x. x m'x u x- : l 33 ooc a x I i i I i j j - t. i i
! i Li I ;3-ow n x xixixlx!x;xixixix mil ixix x xixl ! lxfx}xjxlx xjlixix x
-x x v ,
i {
lxl x.x x x-
.x ix x xix
.x.x '
.x 'x l
[
jq
$3 sac as x alrixixixixix! Mix xljixix x i xl x-x- ix- .xix.x '
l b 5_
occ u x xlElN(xIxlxl3}xlx xtl{Xyx x Ix- x x ;x x,x3 x ! l x xixlutxjxixixtxlx xlj!xix x y ,x oce n x 'n,x, ix; .u x,x l l l ",g" o one se x utx :wix'xix xlx!x x .s txix xi i e s !x x.zixtx xtxtx x.x: ,x i ex) l .gg acc a eee n x l { l j
]l t i , , i * ' i i i
i
! l l 1 ; 'It i lo xi i x, ,si 525 sac ar i ' l ! l ll' e I iM '
x > +
il $43 D
- t acc re ooe n coc s u
1 I ! I xtxt lxtx xlx!xlx xlltzlx l ! I I ' i ! !
I I I 'li
- a i
l x [ xix E
x) 4x x
.x.
x
.x: x: :x i i t l l ;".
s 3y l l l 4 2 eac ts jxI i ! l xI i l 2i i yI i i xe l I It 5 acc = z' Ii I fxt i xill I x g7) ix x x -
j -g acc a lXl I I l l tx1 IGI l h! I I
r .
- x. l
.w-occ sr I xI i !I i lxI iNi l x i i *
. - : - . .. =_o su m i il I I xl $ l xl*, ! I i i 1 e * "tj coc ae ! I I !A l 1 l l x I ' 2' 3 I lxl l l
- r-
, . i l
'3. .i
.m . . I I x! ! l .i r
' i i i . i - r ow n lxl i '
II' -I ' ' g"o9 i I i i t , I i . ;
acces i I 6 I i x!lj i ! I i 'x ' i l $
om a i i l i i .x'j-4
! l
. . - , _ . . _ _ . _ :x.
i i 1 i n' ~ ~
-ge am u '
l l l l - -
l I'l
- l!
6 l
y-t , j , , i 3oI eva su u ! l l 6xI l
xl*
.._pg' ,
l
' i x- ' '
. zE"oc en ts em u i
1 !
9 l j inj r I -
t i i t
i 1
> p' i
i i
_.e- - - - + . _ - .
l t
,,, ' I .
5,;g as.
- - - - e 1 - -.-4. _ . . . .
.g;,
_ : .l x am ar l t j j t
l -p
! l-
_. . 6 6
gf3i o
em u } 9 ! I i j ll; l #
- 1 'n, mes2
., - _ _ . _ - a-.
soc es i j i ! . !
- g, i , l x
_ l
. + - - -
, ]ggl o
g =5 ,,
. hj *
~
om u i '
I ,
...z. -__n_.___.t .
8 (
l l
~ l ._ 4-- .. __. _ _ ._i. o._- .
vf g
- p, coc e* ui ! I i i i aa*' i
- x '
x
< =3
.see ave ten x x(xix'aixaalsim:n m ' .i . x ' s x x mi x u t z x xrx.x x .x.asm l 2 f, or isse misiere xixixin4xisixixtx - - -x 1, .- -!x'xx ' x- I. xi _ .
x x .x. . 1 .
33,sE se s e s,, ,,n x ximi i iximi ix!- m .i .l .
1 r .- -..x a n x
x
<x ;x x x>x.
E
.a x '. _ x, I
_%g Ejy l .ses an an u x!xjx xlziminimIn z.l xx x x x*x i x n>x x xi .x,xix I e3;"
T. > mr esse mie P ji 'x! l _l, , , , _ , , , , _ , , _ ,_ , _ , , . , _ l Ejag a xlxixix!xix!x x* x: x!x x "
ises smwn u?x x;u l x_6x- .x .- _ _ . _x j .x . x . ..x. i .x.ex.x. ,
. . . . . .. . . . ~
c= o =y x x n'n a gn D u s mistp _x;u i - .x -.g. man x x
- u. x 1,3 sees saien .
.x. ' min.x ::
.4 . . . .
esse n eisse u utuju u!wtalm'ufx x ..E x x x'u'n x x x'u x.x: ;xsxlx . l hf ;
x x x ;u rees smers xixlu :
ulutusm;uix
. l ..x x_ .x s ' _x u
. - . . _._ x.M..x.uiu
,xix:x >
l2 _
.__[ u_ ,l inu ms sa u u!xl x t ulzi n. xi x x 1:xix x.x win x la .
._i%{x_[xlal l l I i i i @
si s se 0Sl 41 r[llo {D c] ,~@..l@ DF W Meh
(# 7.4.2.2.2.2.2 General Design Criterion 20 Reac vessel water level, pressure, neutron flux el, and
. control ositions are continuously monitore nd displayed in the contro com to provide reactivity in# mation to the operator. SLCS m be manually initiate f necessary. ,
7.4.2.2.2.2.3 General D n Cri ion 21 SLCS is testable from sens to tuated device during normal operation. The explos valve ini tion circuit continuity is constantly monit d and annunciate . The explosive valves may be tested d g shutdown.
7.4.2.2.2 .4 General Design Criterion 22 SLc ay be manually initiated and operated by one of tw v undant circuits which include redundant explosive valves, pumps, and pump motors.
7.4.2.2.2.2.5 General Design Criterion 26 Two reactivity control systems are employed in accordance with GDC 26. The first is the control rod drive system; the second e is the reactor coolant recirculation system. The design also w takes credit for the standby liquid control system to provide F additional margin for malfunctions which may occur in the
- D control rod drive system such as stuck rods, which would l
hinder the capability of the control rod drive to render the I core subcritical, or keep it subcritical during cool down.
General Design Criterion n g l The SLC d with the capanila - ring the reactor d tu 1 power to cold shutdown.
7.4.2.2.2.2.7 General Design Criterion 29 hgrce SLC S ha11, re.dwwd,a;v8*
mm4-eninc *wo -n eidbdich,GYd KCMbEStah -
-ter cubcritical by ;me.vduciug pois n it int: th; rccctcr in th; :ccnt thc ccatr:1 redc fail tc achicve cubcriticality in thc rccctor.
7.4.2.2.2.3 Conformance to Industry Codes and Standards 7.4.2.2.2.3.1 IEEE Std. 279-1971 7.4.2.2.2.3.1.1 General Functional Requirement (IEEE Std. 279-1971, Paragraph 4.1)
SLCS is manually initiated by operator action. Display instru-mentations in the control room provide the operator with information on reactor vessel water level, pressure, neutron flux level, control rod position, and scram valve status.
Amend. 41 7/80 7.4-33 c?3 /,9 /
failure criterion. However, the discharge pumps and pump o motors, the explosive valves, and the storage tank outlet r valves are redundant so that no single failure in these components will cause or prevent initiation of SLCS. o 7.4.2.2.2.3.1.3 Quality of Components and Modules (IEEE Std. 279-1971, Paragraph 4.3)
The control instrumentations of SLCS are qualified Class IE in accordance with IEEE Std. 323-1971.
7.4.2.2.2.3.1.4 Equipment Qualification (IEEE Std. 279-1971, Paragraph 4.4)
No components of SLCS are required to operate in the drywell environment. A maintenance valve is the only component located inside the drywell and it is normally locked open. Other SLCS equipment is located in the control building or containment and is capable of operation following an SSE.
7.4.2.2.2.3.1.5 Channel Integrity (IEEE Std. 279-1971, Paragraph 4.5)
SLCS is not required to operate during a design basis accident.
It is designed to remain functional following an SSE.
7.4.2.2.2.3.1.6 Channel Independence (IEEE Std. 279-1971, Paragraph 4. 6)
There are two channels of control circuits, discharge pumps and motors, explosive valves, and storage tank discharge valves. -
These two channels are independent of each other, so that failure b in one channel will not prevent the other from operation.
7.4.2.2.2.3.1.7 Control and Protection Interaction SLCS has no interaction with plant control systems. It has no function during normal plant operation and it is completely independent of control systems and other safety systems.
7.4.2.2.2.3.1.8 Derivation of System Inputs (IEEE Std. 279-1971, Paragraph 4.8) 5l,m e. tLe t is a men u ell y i nlH* ted sVs t-sm ,I Puts a re. dse:nd AI'+1y from r ne em Display instrumentation in the control room provides the operator with information on reactor vessel water level, pressure, neutron flux level, control rod position and scram valve status. Based on this info.rmation, the operator seas,c when e<3 initiate SLCS.
or ne to 7.4.2.2.2.3.1.9 Capability of Sensor Checks (IEEE Std.. 279-1971, Paragraph 4. 9)
INSERT D 7.4-34 Amend. 41 7/80
'- FSAR 7.4.2.2.2.3.1.10 Capability for Test and Calibration (IEEE Std. 279-1971, Paragraph 4.10)
The explosive valves may be tested during plant shutdown. The explosive valve control circuits are continuously monitored, and loss of continuity is annunciated in the centrol room. The remainder of the SLCS may be tested during normal plant operation to verify each element, passive or active is capable of perform-ing.its intended function. In the test mode, demineralized water instead of sodium pentaborate solution is circulated from and back to the test tank.
7.3.2.2.2.3.1.11 Channel Bypass or Removal from Operation (IEEE Std. 279-1971, Paragraph 4.11)
The discharge pumps and pump motors are redundant, so that one pump may be removed from service during normal plant operation.
7.4.2.2.2.3.1.12 Operating Bypass (IEEE Std. 279-1971, Paragraph 4.12)
SLCS has nc function during normal plant operation.
7.c.2.2.2.3.1.13 Indication of Bypass (IEEE Std. 279-1971, Paragraph 4.13)
Removal of components from service is annunciated in the control room.
7.4.2.2.2.3.1.14 Access to Means for Bypass (IEEE Std. 279-1971, Paragraph 4.14)
Removal of components from service during normal plant cperation is under administrative control.
7.4.2.2.2.3.1.15 Multiple set Points (IEEE Std. 279-1971, Paragraph The operation of SLCS is not dependent on or affected by set points.
- 7.4.2.2.2.3.1.16 Completion of Protective Action Once it is
' Initiated (IEEE Std. 279-1971, Paragraph 4.16) i l The explosive valves remain open once fired, and the injection valves and discharge pump motors once initiated will not close or l
,- stop running unless terminated by operator action.
I \
~_-
1 l
- 7.4-35 l
j F R d
p d.- Pumps Manual controls and stop and start indicators are provided in the control. room. Interlocks are provided to trip the pumps if the shutdown cooling valves are not properly lined up. .
Appendix 15A examines the protective sequences relative to the above event and equipment. Chapter 15 considers the operation and the system level qualitativo and FMEA aspects.of this system.
7,.4.2.3.2 Conformance to specific Regulatory Requirements 7.4.2.3.2.1 Conformance with.NRC Regul'atory Guides Cencral exceptions and positions taken on the regulatory guides, and t.ho re vicion: of the guiden that are followed, are diucus::ed in Appendix 3A. S i n cific applications of selected guiden t.o the Bl!R .hutdown cooling nyctem are discussed in this subnection.
7.4.2.3.2.1.1 Regulatory Guide 1.6 In accordance with Regulatory Guide 1.6, RHR electric power loads are rigorously dividad into Division 1 and Division 2 so that locs of any one group will not prevent the minimum safety function:. from f ng performed. No interconnections exist which can compromise r.aundant power sources. }
'~
7.4.2.3 2.1.2 . Regulatiory Guide 1.22' , ,. s r~
ul -
Cc-ferr?nce to
- hic *ng"1, tory gnian ic ,chinvaa by p-nviain" A
y o uc. level indics ticn when this ayatem-i-s-r+nde+WootesM c f c. Lwt c; raantenenwc, m..c ep t for positicn-D.2. bcf ...c goldc, h ),
tu . g
. .. m clarif!.d nd 2aplified 4a "a -c plinnen n-,1ycic 'nr w.ulu - y cuicu i . c. Q s
7.4.2.3.2.1.3 Regulatory Guide 1.29 Instrumentation is classified as scismic Category I and is covered under Section 3.10.
7.4.2.3.2.1.4 Regulatory Guide 1.30 s?
The post operation quality assurance program is discussed in <
Chapter 17. 'd e
7.4.2.3.2.1.5 Regulatory Guide 1.32 ',
ccs%w.et +o tyv ta4ocy Golde. I.34 Is diwssed ;, FSM SuMr V A *d h 3. :
rwfm.usncm la -: ; c r ! '- 4-i-n-t4mn fo r-' a c e + ^ Onn n e , ' n"cign 6
- i. u i e n U snd :::::F E L d . 300-'9
7.4.2.3.2.1.6 Regulatory Guide 1.47 .
Dypassed and inoperable status indication is discussed in sub-section 7.5.1.3.
7.4-38 .
-. , v A u sd sa n Al lO ln-.-
.- CG
,. FSAR g c. The separation of redundant Class IE circuits and equipment within the shutdown cooling system is cuch that no physical connections are made between divisions.
Thin neparation criterion assures that the failure of equipment of one redundant nyutem cannot dinable circuits or equipment essential to the operation of the o,ther redundant system.
- d. Annociated circuits are in accordance with Class IE circuit requirements up to and including the isolation devices. Ancociated circuits beyond the inolation devices do not again become associated with Clann IE
. circuits. Associated circuits within the shutdown cooling system are segregated into the three nalety related divisions and n ect all separation requirements imposed upon redundant safety related circuits.
rs
%; Pertinent documents ar.d drawings identify the ascociated q {? circuits in a distinctive manner.
A f e. H .n . mu Lm - .. c ' m .- . : :' and-nca Cl v :: r-
nt sh* wa.s u...,. .;11 u, s. 1.6 .m. . .ca n i s-- n v, , ncs .a- f=
w _. -.
--- '_1
- - . m_ _. a
..,_-1.._.
k - ....- ..w.-
... _ ~.
(~7.4.2.3.2.1.10 Regulatory Guide 1.89 Conformance to Regulatory Guide 1.89 is discussed in subsection 3.11.2. ,
7.4.2.3.2.1.11 Regulatory Guide 1.106 _
Conformance to Regulatory Guide 1.106 is discussed in subsection 7.1.2.6.2.1 7.4.2.3.2.2 Conformance with NRC Regulations - 10 CFR 50 Appendix A Requirements 7.4.2.3.2.2.1 General Design Critorion 19 The capability to manually operate the shutdown cooling system is provided both in and outside the control room.
7.4.2.J.2.2.2 General Design Critorion 20 The RHR shutdown cooling is a manually actuated mode of the RHR system. It is a safe shutdown function only and is not required to operate automatically.
- 7.4.2.3.2.2.3 General Design Critorion 21 D The RHR shutdown cooling design includes highly reliable
, components and is testable during reactor operation.
J j [I a 7 "-"O A,Wb m > /
Resolve the inconsistencies in qualification of SRDI'in the various analysis subsections. The (7.5.2.4.2) analysis makes the following statements on '
(7.5.2.4.4) qualification:
(7.5.2.5.1)
(7.5.2.5.6) 1) Section 7.5.2.1 states that " Insofar as practical, the subject section instruments are selected from those types wnich are
.qualifiable."
- 2) Section 7.5.1.4.2 appears to state that all the SRDI, except for safe shutdown instru-ments, is qualified for operability following a seismic event. (In most cases the wording is "will function", and in only one para-graph is the wording " qualified to be operable".)
- 3) Section 7.5.2.4.4 states that for NSSS-engi- I neered safety features, only the isolation ,
valve status is qualified. l
- 4) Section 7.5.2.5.1 states that safe shutdown instruments are not fully qualified in the first two paragraphs while paragraph (d) states that all SRDI is qualified, including .
post-seismic performance. I
[~S
- 5) Section 7.5.2.5.6 states that the SRDI are the same type and subject to the same qualifications and quality control as the safety systems instruments Amend your FSAR to correctly identify the SRDI that is qualified, and whether it is qualified seismically as well as environr.;entally. In addition, unless the safe shutdown instrumentation is the only SRDI that is not seismically qualified, amend your FSAR to:
- 1) Identify the seismic qualification status of each SRDI device when it is presented in an analysis of SRDI compliance to satisfy post-seismic accident monitoring requirements.
- 2) Describe the methods used to identify the qualified SRDI to the operator and the restric-tions imposed on the use of information from unqualified SRDI.
Amend. 41 7/80 Q&R 7.5-10
- GG FSAll
RESPONSE
- 1) The SRDI that is part of a safety-related system and is necessary for safety-related operator actions or is pro-vided for post-accident tracking capability,i.e., reactor water level (7.5.1.2.2.la), reactor pressure (7.5.1.2.2),
suppression pool temperature (7.5.1.2.3.4), etc., instrumen-tation are in compliance with the requirements applicable to safety related systems and receive power from ESF power sources.
h"ahla 2 7 5-1 S been recised te indicat: Welch C"O! ha -
been uolified au Clu== IE, that is, seisaically and_
% s cr"irca=eatr_11y q=lified to he e,:::ble af ter 2r ac-ider* _
k
- 2) The qualified SRDI has no unique method of identification, such as specially colored bezels. Plant operating pro-cedures direct the operator as to what instrumentation should be observed in the case of an accident, and what actions should be taken, if any based on those indica-
. tions.
INSERT A The information regarding the seismic and environmental qualification p, of the SRDI will be deleted from Table 7.5-1 and will be provided,
\ when finalized, in Chapters 3.10 and 3.11. These chapters pertain to the Seismic Qualification Review Team (SQRT) program and environmental equipment qualification.
l 1
Amend. 41 7/80 Q&R 7.5-11
}
w
. ' N.4 i
CC +
) ..+
k ) ,
TABLE 7.5-1 -g.
Y.
SAFETY-RELATED DISPLAY INSTAUNENTATION .
?
Post- j sp Type of Number of Readout Accident Class 1E .i Tracking. Power 7 System. Channels Range Accuracy Location Parameter . Readout $
b Ch Rod control Control rod postston Lights- 2/ Rod inA NA CR No No hI ['
and infor- .m Lights 1/ Valve ~ NA NA CR No No A, nation Control rod scram system valves .>.
CR No (1) *,
Bypass or anoperable Lights (1) NA vs.
status ;f b
No
- a. -
Neutron Power range neutron Recorder 4 0-125; 25*; Fs CR No fe l
.Monttoring flux ,,
sypass or ancperable Lights (1) NA NA CR No (1) {
. . _ , _ _ _ - i-12* FS Yes Yes CR
(
Nuclear Reactor vessel Recorder 2 0-1500 psag botter prsssure *
,t Reactor vessel water Recorder 2 -150*i0/+60" t2*. FS CR Yes Yes level E. .
12* FS Yes Yes $
+ '-'
Contaar. ment Drywell pressure Recorder 2 0-30 psag CR and drywell'
- Yes Yes Contatn:nent pressure Reconder 2 0-15 psag 12*; FS CR o g y ,.
Drpell & CRD cavtty Recorder 4 0-400 F 12*. TS CR Yes Yes y ,
ter.perature . . . . .
)
Contatnment & d1y- Multt- 2 (8 ctat. 0-400 F 12*,FS CR No No ,
well tes.peratute point & 4 drwn.
Recorder locations g ,.
each) ,e S appresston pool . Recorder 2 14-26 ft 12*, FS CR Yes Yes .
level-t.
Suppresston pool Recorder 2 18-19 ft 12*. FS CR No Yes =a
- level Surpresatan pool Recordet 4 46 0-200 F 13*. FS CR Yes Yes %V temperatn e locations ..
eachl [ '.
$~
Isolatton valve Ltghts 1 per NA NA LR No No g posat1on valve ,,
typass or anc;erable 2 NA NA Ck No Yes status: ancludes: .y CRVICS Aux. blJg. nsolation ,
j.
l'aLCS 52;presst3n pool' ,
te?;etiture Pont-
- torang s e
- s'
TABLE 7.5-1 (Cont.)
C]'
@
- Post-r-)) Type of Number of Readout Accident Class IE Power System Parameter Readout Channels Range Accuracy Location Tracking Gus, g), Yes RCIC RCIC flow Meter 1 0-J.Getr gpa 21% FS CR Wo 0-1500 psig 12% FS CR No Yes
.RCIC discharge
- Meter 1 Z_2_s pressure (G") Bypass or inoperable status Lights 1 NA NA NA No Yes V
0-10.000 gpa 22% FS CR Wo Yes Emergency HPCS flow Meter 1 f_. core cooling.
HPCS discharge pres- Meter 1 500-1500 22% FS CR No Yes PJ systems -
t sure pstg 0-10.000 gpa 12% FS CR Wo . Yes LPCS flow Meter 1 1 per loop 0-10.000 gpa 12% FS CR No Yes RHR flow (LPCI and - Me te r shutdown coolang Meter 1 per loop 0-10.000 gym s2% FS CR Wo Yes RHR HX servtce water flow E'CCS pueps'on/off Lights 1 per pump NA NA CR No Yes Lights 1 per NA NA CR No Yes ECCS valve posttsons valve NA NA CR No Yes ADS / relief valve Lights 2 per S
posttions valve Bypass or inoperable status HPCS Ltqhts 1 F% NA CR No Yes S LPCS Lights ! NA NA CR No Yes ."
1 per loop NA NA CR No Yes j RHR (includes con- Lights tatnment spray and shutdown coolang)
ADS Lights ! per loop NA NA CR No Yes
$5W loops A & B flow Recorder 1 pe'r loop 0-15.000 gym 12% FS CR No Yes Standty servtce Yes SSW loops A & B das- Recorder 1 per loop 0-153 psag $2% FS CR No water charge pressure Metet 0-1000 gpa 13*4 FS CR No Yes HPCS servtce dis- 1 charge water flow 13% FS CR No Yes HPCS service dis- Meter 1 0-150 pstg charge ptessure Recorder 2 0-10 ft 13% FS C' No Yes Standby serrace water basan level SSW pumps on/off IA CR No Yes LtJnts 1 per pump NA NA NA CR No Yes SSW coolang tower Lt3nts 1 per fan fans on/off
-i- * - .* .n- 73 4g ifeo
e 9 .
- Post-O Type of Number of Readout .Acctdent Class IE System Paraagter Readout Channels Range Accuracy Locatson Tracking' Power Standby _SSW valve posittons Lights. 1 per NA NA CR No Yes service valve vag,e
~Q water
'h]) - . , (cont.) Bypass' or inoperable status Lights 1 per loop NA LA CR No Yes I 3 M51VLCS Steam line pressure Meter 6 33* Hg 22% F5 CR No Yes (low) vacuum 10 psig Steam line pressure Meter 6 0-100 psig 22% FS CR No Yes (high)
{
2 Bypass or inoperable Lights 2 NA CR No Yes status EvLC fvt.C valve positions Lights 1 per NA CR No Yes valve Costustable Dryuell/ containment Pecorder 2 0/+20 12% FS CR Yes Yes o gas control dif ferential pres- J g system sure .
Drywall hydrogen Recorder 2 0-10% 14% F5 CR Yes Yes .
Contatnment hydrogen Recorder 2 0-10% 14% FS CR Yes Yes %
Hydrogen recombiner Meter 1 per 0-2000 F 14% F5 CR No Yes temperature reconDaner Hydrogen recombiner Meter 1 per 0-100 kW 13% FS CR No Yes recombnner l28 Enaer Dryvell purge com- Ltghts 1 per NA NA CR No Yes pressor on/off compressor Drywell purge valve Lights 1 per NA NA CR No Yes position valve "tydrogen i recombiner Lights ! per NA NA CR No Tes onfoff recoetaner Bypass or anoperable Lights 2 NA NA CR No Yes status Standcy las Enclosure b!dg/ Recorder 4 -1/0/*1 23*,FS CR No Yes treat ent outsade atmosphere anches water dif ferenttal pres-sure Char:Dal falter Recorder 1 per 0-5010 cfm 22% F5 CR No Yes train flow train Charcoat (siter dif- Recorder a per 0-10 i nct.e s 2 2*, F5 CR No Yes ferential pressure falter water g
.. e e b
."W TALLE 7.5-1 (Cont.)
Post-NJaber of Readout Accident Class 1E
'OI Systes Parameter Type of
. Readout Channels Range Accuracy Location Tracking Power Standby gas NEPA filter differ. Recorder 1 per 0-5 inches 12% Ft (R No Yes trea tment ential pressure falter water (cont.) No Yes SCTS fans on/off Lights 1 per fan MA NA CR SCTS deeper and Laghts 1 per NA NA CR No Yes l C5~h valve positions damper NA NA CR No Yes 7g Bypass or knoperable status Lights 2 Stantty Diesel generator Meter 1 per DG 0-5.25 kV 23% FS CR No NA g power voltage system Diesel generator Meter 1 per DG 0-1500 A 13% FS CR No NA current Onesel generator Meter 1 per DG 0-10 MW 14% FS ,CR No NA power Daesel generator Meter 1 per DG 0-10 set FS CR No NA rea::tive power MVAR Diesel generator Meter 1 per DG 55-65 Hz 13% FS CR No NA frequency Diesel generator Meter 1 per DG 0-300 v 12% FS CR No NA 7 field voltage Diesel generator Meter 1 per DG 0-400 A 22% FS CR No NA o itend current g Fuel ont storage Meter 1 per DG 0-12 ft 15% FS CR No Yet h tank level Fuel ott day tank Meter 1 per DG 0-60'an. 34% FS CR No Yes level ,
Diesel generator Light 1 per DG HA NA CR No Yes running / stopped 4.36 kV ESF bus Meter 1 per bus 0-5.25 kV 15% FS CR No NA volta ge 4.16 kV ESF bus nn- Meter I per 0-1500 A 15% FS CR No NA comang breaker ctacult
' current breaker 4.16 kV circutt Lights 1 pet NA NA CR No Yes breaker position calcult breaker 4
440 V bus voltage Meter 1 per bus 0-600 V 25% FS CR No h4 4to V bus current Mete: I pet bus 0-1200 A 15% FS CR _ No NA 460 V load center Lights 1 per NA NA CR No Yes feeder caucutt cticutt breaker posttacn breaker u
e C
o e N I\
l CC 1 j
TSAR
{
I i
TABLE ?.$.1 (Cont.) I Post.
Type of Number of Deadout Accadent Class it Range Accuracy Location Tsacking Power System Parameter Readout Channels No NA Standby 12% V de ESF bus Noter i per bus 0 150 V 12% F5 CR power system voltage .
(cont.) .
NA NA CR No Yes a Srpass or snoperable Laghts I rer DC ,
i status tanciedes DC aestiseries) 0 5000 cfm 12% F5 CR No Yes Control room Stanby fresh air unit pocos eer I pes
- atmosthessa flow fresh als control and unit teoletton CM NJ Yes Chaicnal (siter secorder a pes 0 5 inchet 12% FS dafferential fattes water i
pressure 0.% enCPet $2% F$ CR No Des
- NEPA falter becosder I pet 4tiferenttet pres. faites water sure NA NA CR ho Yr*
Control room fans Leghts I pes tan on/off '
NA NA CR No Yes g Control room ans. Laghee 4 ges *
+ condatsonang com. compte s sor pressor on/off 3 ,
MA NA (R No Yes .
Contsol room deepet Lights I ses j and valve position daepen NA CR No Tr*
Bypass er tecpesable Laghts ; NA d status NA NA CR No Yes NVAC for ESF Egr WVAC lens on/off L4ghts & n.e s aan areas NA Ch No Yes ESF HVAC desper Laghts I per NA posstions
~
dampet peactor typass or anoperapie Lights (t) NA NA CN No (3) protection status 4
NA (N f 4=. ee n Suppress &on Bypass or anoperable La ghts. (t) NA pool makeup status A
NA CR No Yes j StandDy Bypass os anoperette L&qhth {ll NA ltquad status control _ _ _
\
Ch No Vem Component Brpass or inoposable L$ghts (1) NA NA Coo!&ng status water (tuel pool cooling) g, Noter (1) To be subnatted in a lates am subwnt ShrEt % of i Ames ki . 5/ M Pp 1
- *A ' ** - . + = ne. _.___me ,,,
b
..m:. - m - - -- , , -r p._ , e vme-.i