ML20041D825
| ML20041D825 | |
| Person / Time | |
|---|---|
| Site: | Summer  |
| Issue date: | 02/26/1982 |
| From: | Nichols T SOUTH CAROLINA ELECTRIC & GAS CO. |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| References | |
| IEIN-79-22, NUDOCS 8203090293 | |
| Download: ML20041D825 (44) | |
Text
...
e g
SOUTH CAROLINA ELECTRIC a gas COMPANY A
f
,os, or nce.o.
CotuMei A, SOUTH CAROLINA 29219 T. C. NicHoLs, JR.
vu e.n m. o - ". ~ ~'
Bebruary 26, 1982 j2 NAR 081982* S
-...o~....
e
& n amm muse==en Mr. Harold R. Denton, Director E "g
/
g Office of Nuclear Reactor Regulations
'b
/
4 U. S. Nuclear Regulatory Cmmission Washington, D. C.
20555
Subject:
V. C. Sunmer Nuclear Station Docket No. 50/395 Control System Pailures SER Cbnfirmatory Issue 1.7.23
Dear Mr. Denton:
In a letter frm R. L. Tedesco to T. C. Nichols, Jr. dated April 30, 1981, the staff requestal that South Carolina Electric and Gas Cmpany (SCE&G) identify any p]wer sources or sensors which provide pwer or signals to two or nore control systems, and demonstrate that failures or malfunctions of the power sources or sensors will not result in consequences outside the bounds of the analyses of Chapter 15 of the FSAR or beyond the capability of operators or safety systas. The staff also requested a review by SCE&G to determine whether the harsh environments associatal with high-energy line breaks might cause control systs malfunction and result in consequences more severe than those of the analyses in Chapter 15 of the FSAR or Myond the capability of operators or safety systems. In a letter dated December 16, 1981, SCE&G provided a preliminary response to discuss the status of review at that time. As indicated in our May 18, 1981 letter, SCE&G is forwarding the final reports on control systs failures.
The first report (Enclosure I) is entitled "Enviromental Interaction for the Virgil C. Sumer Nuclear Station" and addresses IE Information Notice 79-22. The second report (Enclosure II) " Control Systems Pailures for the Virgil C. Sumer Nuclear Station" addresses control systems whose failure could seriously impct safety (i.e. major NSSS control systems).
These reports show that the FSAR adequately bounds the consequences of these failures.
An evaluation of other control systems was performed. As a result of this additional review, the low suction pressure starting interlock on auto start of the service water booster pmps will be renoved, and the FSAR will bourxi the consequences of the analyzed failures. It is anticipated that this change will be cmpleted by full pwer operation.
Licensing Documents will be changed as required to be consistent with our analyses.
If you have any questions, please contact us.
Very truly yours, ge\\
["
[
Sd li 8203090293 820226 PDR ADOCK 05000395 T. C. Nichols, Jr.
PDR E
Mr. Harold Denton Page two Nbruary 26, 1982 JL:1CN:tdh:rlb cc:
V. C. Sunene T. C. Nichols, Jr.
G. H. Fisher H. N. Cyrus (w/att. )
H. T. Babb D. A. Nauman (w/att. )
M. B. Whitaker, Jr.
W. A. Williams, Jr.
J. P. O'Reilly (w/att.)
O. S. Bradham (w/att. )
R. B. Clary M. N. Browna A. R. Koon (w/att. )
G. J. Braddick J. L. Skolds (w/att. )
J. B. Knotts, Jr.
(w/att. )
C. L. Ligon (NSRC)
(w/att. )
B. A. Bursey (w/att. )
J. C. Ruoff (w/att.)
NPCF File (w/att. )
4 i
l t
i I
i k
a Enclosure I Nichols to Denton February 26, 1982 ENVIROtMENTAL INTERACTIONS EDR TIIE VIRGIL C. SU!EER NUCLEAR STATIQ1 Scope On 9/18/79 Westinghouse resented to the Staff a sumary of the investigation that had been conductcd which led to the identification of four (4) potential interaction scenarios where the affect of adverse environments, resulting frcm high energy line breaks, on control systes could lead to consequences more limiting than the results presented in the Safety Analysis Report. Table 1 sunmarizes the scope of the Westinghouse investigation.
We seven (7) control systems selectal for the investigation by Westinghouse include all control systems directly addressed in the current Westinghouse functional requireents. We seven (7) accidents considered enempass all postulated High Energy Line Break (IIELB) envirorments, including all treak locations and a range of break sizes. Of the forty-nine (49) combinations of control systs and accident environment investigated, fifteen (15) interaction scenarios, denoted by an X in Table 1, were identified which resulted in consequences nore severe than reported in the Safety Analysis Reports. he fifteen interactions identified are bounded by consideration of the four (4) interactions discussed in the attachments. Attachment I through IV discuss the applicability of these postulated scenarios with respect to the Virgil C.
Summer Nuclear Station.
Probability of Postulated Interactions Implicit in the four (4) potential interaction scenarios identified by Westinghouse are worst case assumptions concernirvJ the break size and location, and the type and extent of consequential failures in controld systms induced by the adverse environment. These assumptions are therefore in addition to the already conservative set of assumptions ascribed to the analysis of the Design Basis Events reported in the Safety Analysis Report. It follows that these scenarios represent a significantly less probable subset of the Design Basis Events that are dependent on the occurrence of a3ditional e/ents, each having an associated uncertainty of occurring.
1-1
a Consequences of Postulated Interactions In lieu of performing a plant specific analysis in an effort to aldress each of the potential postulatal involving a feedline break, Westinghouse has referred to bounding accident analyses that have been subnitted to the NRC in WCAP-9600, Report on Small Break Accidents for Westinghouse NSSS.
Section 4.2 of the report govides transient results following a total loss of main armi emergency feedwater. Sensitivity studies as a function of time of emergency feedwater initiation and opening of the gessurizer power operated relief valves are presented following the initial transient. Calculations have been performed to show that the consequences following the control interaction scenarios for the steam generator PORV control systan, main feedwater control systan and gessurizer PORV control systen are in fact bounded by the analyses in HCAP-9600.
Ebr all accident scenarios, the calculations indicated that the operator need not take corrective action to mitigate the consequences for at least 30 minutes following initiation of the event.
A typical analysis has been performal to address the rod control system interaction scenario. The results of the analysis indicate that no fuel damage occurs and the consequences are within the assumptions male in the Safety Analysis Reports.
i I-2
PRESSURIZER CONTROL STEAM GENERATOR STEAM SYSTEM REACTOR PRESSURE LEVEL FEEDWATER PRESSURE DUMP TURBINE CONTROL CONTROL CONTROL CONTROL CONTROL SYSTEM CONTROL ACClDENT Small Steamline Rupture X
X X
Large Steamline Rupture X
X Small Feedline Rupture X
X X
X Large Feedline Rupture X
X X
Small LOCA X
X X
Large LOCA Rod Ejection TABLE 1 PROTECTION SYSTEM CONTROL SYSTEM POTENTIAL ENVIRONMENTAL INTERACTION x - POTENTIAL INTERACTION IDENTIFIED THAT COULD DEGRADE ACCIDENT ANALYSIS N0 SUCH INTERACTION MECHANISM IDENTIFIED I-3
Attachment I RCD CORNult SYSTEM 1.
Sumary of Postulated Scenario Eb11owing an intermediate steamline rupture inside mntainment, the autmatic rod control systs exhibits a consequential failure due to an adverse environment which causes the control rods to begin stepping out pr3ar to receipt of a reactor trip signal on overpower delta-T.
This scenario results in a lower DNB ratio than Iresently Iresented in Safety Analysis reports.
2.
Probability Assumptions Affecting Event Probability and Consequences a.
Standard Safety Analysis Report Assumptions Concerning Steamline Break
- Conservative initial assumptions Nominal rated power plus calorimetric error Programed RCS temperature plus control deadband and instrument errors conservative end of life core I ysics h
- (bnservative accident assumptions Break (all sizes) in Safety Class 2 steamline piping Maximm adverse environmental errors for protective instrumentation Ibrst single active failure (loss of any one Safety Injection
! mP)
Operator action time b.
Additional Assumptions Required for this Scenario Break must occur inside the contairment between the steam generator nozzle and the mntainment penetration or outside containment in close proximity to the first stage turbine pressure transmitters. A break at other locations invalidates this scenario.
I-4
l 2
Intermediate steamline breaks (0.1 to 0.25 sq. ft per loop) at power levels fran 70 to 100 percent. Other break sizes and pwer levels invalidate the scenario.
Adverse envirorrnent from the break can impact the nuclear instrumentation systan (NIS) equipnent (i.e excore neutron detectors, cabling connectors, etc.) or the first stage turbine pressure transmitters prior to reactor trip (i.e. within 2 minutes).
Should the NIS equipnent or the first stage turbine tressure transmitters not be affected until after reactor trip (i.e. later than 2 minutes) the scenario is invalidated.
Due to the adverse environment the NIS systen initiates a spurious low power signal without causing a reactor trip on negative flux rate. Should the NIS continue to operate within specification, initiate a spurious high power signal or cause a reactor trip on negative pwer rate the scenario is invalidated.
3.
Accident Consequences A typical bounding analysis of the intermediate steamline rupture was performed to calculate the extent of fuel damage due to rod control systen withdrewal pcior to reactor trip. Based upon the reduction in radial peaking factor with burn-up and conservative end-of-life physics prameters, no fuel damage was calculated to occur following the intermediate steamline rupture with a consequential rod control system failure.
4.
Resolution of Concern The bounding analysis shows that the reactor core is adequately protected by the overpower delta-T trip function for an environmentally induced rod control systan failure from a HELB for the spectrum of steam line breaks postulated.
I-5
Attachment II MAIN EEEDWATER CONTROL SYSTEM 1.
Sunmary of Postulated Scenario Eb11owing a small feedline rupture the main feedwater control systs malfunctions in such a manner that the liquid mass in the intact steam generators is less than for the worst case presented in Safety Analysis Reports. The reduced secondary liquid mass at time of autmatic reactor trip results in a nore severe reactor coolant system heatup following reactor trip.
2.
Probability a.
Standard Safety Analysis Report Assumptions (bncerning Ebedline Break
- Conservative initial assumptions Appendix K decay heat model Engineered safeguards Irwer plus calorimetric error Programed RCS temperature plus control deadband and instrument error Initial conservative S/G inventory conservative core physics
- conservative accident assumptions Break (all sizes) in Safety Class 2 feedline piping Maximum adverse enviromental errors for grotective instrumentation Worst single active failure (loss of any one emergency feed pump)
Operator action time 20 minutes b.
Additional Assumptions Required for this Scenario Break mst occur between S/G nozzle and feedline check valve. A break at any other location invalidates the scenario.
1-6
a small breaks less than 0.2 sq ft.
Larger breaks invalidate the scenario Adverse environment resulting from the break can impact both the main feedwater control systems associated with the broken loop and the intact loops.
Due to the adverse environment the main feedwater control system initiates a sEurious signal to close the feedwater control valves (ECV) in the intact loops. Should the control systs continue to operate within specification the scenario is invalidated.
3.
Accident Consequences Section 4.2 of NCAP-9600, Report on Small Break Accidents for Westinghouse NSSS System, describes transient analyses for a postulated loss of all main and mergency feedwater (no pipe rupture).
Following a loss of all main and emergency feedwater, the operator is not required to take action for at least 4,000 seconds followiry the loss of all feedwater to prevent the core frm uncovering. With a feedline rupture assumed coincident with the assumptions made in WCAP-9600, the operator continues to have at least 2800 seconds before corrective action nust be taken to inject emergency feedwater into the intact steam generators to prevent core uncovering. The Safety Analysis Reports assumes 20 minute operator action following a feedline rupture.
4.
Resolution of Concern The postulated scenario is not credible at the Virgil C. - Sumer Nuclear Station based on the type and location of hardware used in the feedwater control systs.
Ebedwater control valve positioning signals are generated frm pressure compensated stean flow, feedwater flow, actual, steam generator level and power range nuclear instrumentation which detemines required level. The steam pressure transmitters (used for compensating steamflow), steam flow transmitters and level transmitters are gaalified to withstand high energy linebreaks and therefore are not assumal to t' ail. '1he feedwater flow transmitters and the feedwater control valves are located such that the scenario is invalidated. A break in A feedline may affect the A feedwater flow transmitter, however, the B and C feedwater flow transmitters and the feedwater control valves are in the intermediate Inilding and not subject to environmental effects frm breaks downstream of the fealwater check valves. Ecwer range nuclear instrumentation, which programs level, is presently being tested by Westinghouse to verify it will not fall in an adverse enviroment.
I-7
Attactuaent III PRESSURIZER PORV COMPROL SYSTD4 2
1.
Stamary of Postulated Scenario Ebilowing a feedline rupture inside contaiment, the gessurizer PORV control system malfunctions in such a manner that the power operated relief valves fail in the open position. Thus in addition to a feedline rupture between the steam generator nozzle and the containment penetration, a treach of the reactor coolant systs boundary has occurred in the pressurizer vapor space.
2.
Probabi.11ty Assumptions Affecting Event Probability and Consequences a.
Standary Safety Analysis Report Assumptions concerning Ebedline Break
- Conservative initial assumptions Appendix K decay heat model-Engineered safeguards power plus calorimetric error PLOP.cmied RCS temperature plus control dearlhand and instrument errors Initial conservative S/G inventory Conservative core physics
- Conservative accident assumptions Break (all sizes) in Safety Class 2 feedline piping Maximum adverse enviromental errors for gotective instrumentation Worst single active failure (loss of any one emergency feed pump)
Operator action time 20 minutes I-8
a b.
Additional Assumptions Required for this scenario Break must occur inside the contaiment between the steam generator nozzle and the contaiment penetration. A break at other locations invalidate this scenario.
Double ended break leads to limiting consequences. Smaller breaks permit longer operator action times.
Adverse environment resulting frm the break can impact the pressurizer power operated relief valve control systs.
Due to the adverse environment the pressurizer PORV control system initiates a spurious signal to open the PORV(s). Should the control systs continue tn operate within specification or initiate a spirious signal to close the PORV's the scenario is invalidated.
Should the FORV's fail to the preset safe position (i.e closed) the scenario is invalidated.
3.
Accident Consequences Sectio 4.d of hCAP-9600, Report on Small Break Accidents for Westinghouse NSSS Systms, describes transient analyses for a postulated loss of all main and emergency feedwater (no pipe rupture). The results indicate that, in the event that the operator cannot restore auxiliary feedwater to the steam generators, the operator is requiral to open the pressurizer NRV's within 2,500 seconds to maintain adequate core coolant inventory.
The interaction scenario postulated above is similar to that presented in Section 4.2 of WCAP-9600. 'Ihe additional assumptions made are the following:
a.
A feedline rupture is assumed to occur between the steam generator nozzle and the containment penetration b.
Emergency feedwater is injected into the intact steam generator followirs the feedline rupture.
Cbnservatively assuming that all liquid inventory in tN steam generator associated with the ruptured feedline is lost via the rupture without rmoving any heat (i.e., liquid blowdown), the loss of heat sink due to the liquid. inventory blowdown;of the ruptured steam generator is nore than counterbalanced by the' emergency feedwater being injectal into the intact steam generators following reactor trip. Therefore, the results of the analyses tresent in NCAP-9600, Section 4.2, which illustrates that the operator is not required to take corrective action for at least 2,500 seconds following the loss of feedwater also applies to this scenario. The Safety Analysis Reports assumes 20 minute operator action following a feedline rupture.
I-9
4.
Resolution of Concern The Virgil C. Sunmer Nuclear Station SSPS includes a block of control action to open the pressurizer PORV's on low pressurizer pressure (P-11 at 1985 PSIG). 'Ihis block is designed to prevent excessive depressurization of the reactor coolant systen if the PORV control t,ystan were to fail in the "open" node. The block is implemented on each fail closed PORV with a qualified solenoid and IE circuits and pmr supply.
l l
j I-10
Attachnent IV i
STEAM GENERA'IOR POW CONTROL SYSTEN 1.
Sumary of Postulated Scenario Eb11owing a feedline rupture outsido containment in the penetration area, the steam generator PORV's are assuned to exhibit a consequential failure due to an a1 verse environment. Pailure of the 00RV's in the open position results in the depressurization of nultiple steam generators which are the source of steam supply for the turbine driven emergency feedwater pump. Eventually, the turbine driven emergency feedwater punp will not be capable of delivering emergency feedwater to the intact steam generators. With same systm designs, not Sumer's, a potential exists that no emergency feedwater will be injected into the intact steam generators until the operator takes corrective action to isolate the energency flow spilling out the rupture.
2.
Probability Assumptions Affecting Event Probability and Consequences a.
Standard Safety Analysis Report Assunptions Concerning Feedline i
Break J
- Conservative initial assumptions l
Appendix K decay heat model Engineered safeguards power plus calorimetric errer Progransned RCS tmperature plus control deadband and instrument errors Initial conservative S/G inventory 4
Cbnservative core physics
- conservative accident assumptions Break (all sizes) in Safety Class 2 feedline piping Maximum adverse environnental errors for protective l
instrumentation I-11
Worst single active failure (loss of one motor driven energency feed pump)
Operator action time of 20 minutes b.
Mditional Assumptions Requiral for this Scenario Break must occur outside containment between the penetration and feedline check valve.
Adverse envirorynent resulting fran the rupture can impact the steam generator PORV control systens associated with the ruptured loop and the intact loops.
he single active failure is a notor driven emergency feed pump. The loss of a turbine driven emergency feed plunp as the single active failure or no active failure would invalidate the postulated scenario.
Due to the alverse environment, the steam generator PORV control systan initiates a spurious signal to open the PORV(s). Should the control systen continue to operate within specification or initiate a spurious signal to close the PORV(s) the scenario is invalidated.
10RV on steain generators supplying steam to turbine driven emergency feed panp is assumed to open as a result of spirious signal. If this PORV is not affected or fails closed, the scenario is invalidated.
3.
Accident Consequences Section 4.2 of WCAP-9600, Reprt on Small Break Accidents for Westinghouse NSSS Systans, describes transient analyses for pstulated loss of all main and emergency feedwater (no pipe rupture). We results indicate that the operator has at least 4,000 seconds following the loss of all feedwater to reinitiate energency feedwater flow to the steam generators before the core begins uno,vering.
The interaction scenario postulated above is similar to that presented in Section 4.2 of NCAP-9600. The only additional assumption made is that a feedline rupture occurs outside containment between the containment penetration and the feedline check valve. Conservatively assuming that all liquid inventory in the steam generator associated with the ruptured feedline is lost via the rupture without removing any heat (i.e., liquid blowdown), calculations have shown that the heat removal capability of the liquid inventory blowdown requires operator action 1200 sections earlier than reinrted in NCAP-9600.
Thus, if a feedline rupture is assumed coincident with the analyses performed in NCAP-9600, 2800 seconds is still available for corrective action to inject energency feedwater into the intact steam I-12
1 I
=
i generators. We Safety Analysis Reports assumes 20 minutes operator j
action following a feedline rupture.
4.
Resolution of Concern The Virgil C. Sumer Nuclear Station Solid State Protection System (SSPS) includes a block of control action to open the steam generator Power Operated Relief Valves (PORV's) on LoLo Tavg (P-12 at 553*F).
Wis block is designed to prevent excessive cooldown if the control system were to fail in the "open" mode. The block is implemented on each fail closed PORV with qualified A&B train solenoids aM IE power supplies. We block signal is unaffected by the Instulated linebreak and can be manually bypassed by the operator when peceeding to cold shutdown.
i l
4 t
i i
i I
i
.i 1-13
Enclosure II Nichols to Denton February 26, 1982 GNfROL SYSTD1S FAILURES VIRGIL C. SUbEZR NUCLEAR STATION INTRODUCTION The evaluation required to answer a letter from R. L. Tedesco to T. C. Nichols, Jr. dated April 30, 1981 consists of postulating i
failures which affect the major NSSS control systems and denonstrating that for each failure the resulting event is within the bounds of existing accident analyses. The events which are consideral are:
(a) Loss of any single instrument.
(b) Break of any single instrument line.
(c) Loss of power to all systms pwered by a single power supply systm (i.e., single inverter).
The analysis is conducted for all five major NSSS control systms:
- 1) Reactor control systs.
- 2) Steam dump systm.
- 3) Pressurizer gessure control system.
- 4) Pressurizer level control systs.
- 5) Feedwater control systs.
We initial conditions are assumed to be anywhere within the full operatirg pwer range of the plant (i.e., 0-100%) where applicable.
We results of the analysis indicate that, for any of the postulated events considered in a) through c) above, the condition II accident analyses given in Chapter 15 of-the Virgil C. Sumer FSAR are bounding.
LOSS OF ANY SINGLE INSTRUMENT Table 1, Ioss Of Any Single Instrument, is a sensor-by-sensor evaluation of the effect on the control systms itmized above causal by a sensor failing either high or low. We particular sensor consideral is given, along with the nmber of channels which exist, the failed channel, the control systes impacted by the sensor, the effects on the control systems for failures in 11-1
f both directions, and the bounding EAR accident. Where no control action occurs or where control action is in a safe direction, no bounding accident is given.
'Ihe table clearly shows that for any single instrument failure, either high or low, the Condition II events itmized in the EAR Chapter 15 are bounding.
l IGS OF 00WER 'IO A ENTROL GROUP Table 2, Ioss Of Power To a Control Group, examines the effects on the control systems caused by the loss of power to a control group. Ioss of power tn control groups 1 through 4 are considered. The mntrol systems affected, the equipnent or signals affected, the failure direction, the effects of the failure, and the bounding accident are given.
The table shows that, for a loss of power to any one of the control groups, the resulting failure is bounded by a loss of normal feedwater flow, which is a Condition II event analyzed in the E AR.
IES OF POWER 'IO A PROIECTION SET Table 3, Ioss Of Power To a Protection Set, analyzes the effects on the control systms caused by the loss of pwer to a protection set. Ioss of power to pcotection sets I through IV are considered. The control systms affected, the sensors affected, the failure direction, the effect on the control systms, and the bounding EAR accident are given. Where no control action occurs or where control action is a safe direction, no bounding accident is given.
Desides the loss of power to a cmplete control group or protection set, there is the chance of having an electrical fault on one of the control systm circuit cards. The control systems are designal so that each card is used in only one control system. A circuit card failure cannot directly impact more than one control systs. A failure on a control card would cause the controller to generate either an "off" or a " full on" output, depending on the ty p of failure. This result would be similar to having a fault in a sensor feeding the control system.
Therefore, the failure of or loss of power in any control systs circuit cart 1 would be bounded by the Loss of Any Single Instrument analysis described in Table 1.
The analysis is conservative in the sense that, in cases where switches enable the operator to choose frm which protection set a given signal is desired, it is assumed that the switch is in the position of the failal protection set.
The table shows that for a loss of power to any Irotection set, the Condition II events analyzed in the EAR Chapter 15 are bounding.
11-2
LOSS OF IDER 'IO AN INVERTER MIIGI FEEDS A PPUTECTION SET AND A CO!TrROL GROUP The Virgil C. Surmer power supply is cmposed of 6 inverters.
Two inverters individually power two protection sets (I&III) while two different inverters individually power two control groups (1&3). The rmaining two inverters individually power a protection set simultaneously with a control group. Inverter 2 pywers protection set II and control group 2 while inverter 4 powers protection set IV aM control group 4.
Table 4, Ioss of Power to an Inverter, analizes the effects on the control systms caused by the loss of pywer to an inverter which simultaneously feeds a protection set aM a control group.
The control systms affected, the sensors affected, the failure direction, the effect on the control systms, aM the bounding ESAR accident are given. Where no control action occurs or where control action is in a safe direction, no bounding accident is given.
The table shows that, for a loss of power to an inverter which simultaneously feeds a protection set and a control group, the resulting failure is bounded by a loss of normal feedwater flow, which is a condition II event analyzed in the ESAR.
LOSS OF CONON INSTRUMENT LINES TABLE 5, Ioss of Camon Instrument Lines, considers the scenario whereby an instrument line which supplies more than one signal ruptures, causing faulty sensor readings.
Two sets of sensors usM for control are located in comon lines:
- 1) Loop steam flow (protection sets III and IV, any steam s
generator) and narrow range steam generator level (protection set III, any steam generator) 2)
Pressurizer level (protection sets I, II, or III) and pressurizer pressure (control groups 3 or 4)
Not shown on the table since they are not part of the plant control system but are used just for protection are the loop flow transmitters. There are three flow transmitters in each loop with each transmitter having a comon high pressure tap but separate and unique low pressure taps. Therefore, a break at the high pressure flow transmitters tap would result in diabling all three flow transmitters in one loop, resulting in a low flow reading for all three transmitters. This would result in a reactor trip if the plant is above the P-8 setpoint, or an annunciation if it is below P-8.
11-3
The only malfunction mode explicitly analyzed was a break in the ccanon instrtunent line at the tap. Another Inssibility is to have a ecznplete blockage in the sensor tap, causing the sensor to read a constant (before blockage) value. However, this failure modo is not analyzed since it is really not a credible event.
'Ihere is no anticipatal agent available that would cause a tap blockage. The Reactor Coolant Systen piping and fittings, and the instrument impulse line tubing are all stainless steel, so no products of corrosion are expected. Also, the water chenistry is of high quality which, along with high tanperature operation, precludes the presence of solids in the water and assures the maintenance of the solubility of chenicals in the eter. In addition, prior to startup, and during any shutdown as well, it is routine maintenance and servicing gactice for instrument lines to be blown down to a canister. Since the buildup of sludge is a slow gocess, any hiildup would be detected during response tine testing done during shutdown. Therefore, the
]
hypothesis of the gesence of a ccmplete blockage of the sensor tap is not sufficiently credible to warrant its consideration as a design basis.
In the extremely unlikely event that a ccrnplete instrument line blockage were to occur, the condition is detectable because the reading would beccine static (no variations over time). In an unblocked channel, a reading would always vary sanewhat due to noise (i.e. flow induced noise in flow channels) or slight controller action (i.e. cycling operation of spray and heaters in gessurizer). By a canparison of the static channel to the redundant unblocked channels, the operator would be infonned that a blockage in one channel has occurred.
Table 5, indicates that, even in the event of an instrument line break which supplies more than one control signal, the resulting failures are bounded by the FSAR Chapter 15 analyses.
QNCLUSIONS The tables illustrate that failures of individual sensors, losses of power to inverters feeding protection sets and/or control groups, or breaks in ocmnon instrument lines all result in events which are bounded by ESAR Gapter 15 analyses.
Therefore, the ESAR adequately bounds the consequences of these fundamental failures.
II-4
,a s
IAnti 1 LOSS Of ANY SINGLE I14SIRUMt NI NUMBER ASSUMt0 Of FAILED F Alt 0RE BOUNDING SE VmR CHAf.NE L S CHANNEL SYSlEM DIRffi10N EtfECT k Vf 41 f eeapwnp 1 per o feedwater i o.
FW ptsap speed increases it in if FW pisap in manual -
Di scharge plant Control auto mode. (f W control valves no event, i t I W p tsup Pre ssure close due to increased f low and FCV in aato - new if in auto exle.)
steady st.ste w/higiser pump speed an l decr.
FCV litt. If I W pisup in auto and FCV is inanual - bounsting event is Encewive iW flow (fSAR 15.2.10)
Hi FW pump spee.1.lecreases if in i f FW ptano in minu.nl-aJto thale, li'W control valves no event. Other m>has open due to decreased flow if
-result in a decrease,t in auto moJe).
FW flow over tiae, hence bourktirig t vent is loss of Armal IW flow (fSAR 15.2.3)
Stean 1 per o feedwater lo FW pump speed decreases if in i f I W ptsip in m inu s t -
lleader plant Control auto mode. (fW control valves no event. Other mules Pressure o Steam Dump open dae to dnressed flow it
-result in a decreased (IAVG Hode) in auto mwie).
FW flow over t iae, hence bounding event is loss of Normal TW f tw (f SAR 15.2.H) e ISun:1 II-5
O NUMBE14 ASSttfD OF FAILED FAILURE BOUNDING SFN W CHANNELS CitANNEL SYSTEM DIRECTION EFFECT EVENT ill FW pump speed increases if in if FW ptana in minual auto mode. (FW control valves
- no event. If FW pump close due to decreased flow if and FCV in auto - new in auto mode).
steady state w/ higher pump speed and decr.
FCV lift. If FW ptsus in auto arwl FCV in manual - bounding event is Excessive FW Flow (FSAR 15.2.10)
S teain 1 per o feedwater lo FW pump speed decreases if in If FW pump in manual -
HeaJer plant Control auto mode. (FW control valves no event. Other modes Pressure o Steam Dump open due to decreased flow if
-result in a decreased (Pressure Mode) auto mode).
FW flow over tie.
hence bounding event is loss of Normal TW Flow (FSAR 15.2.0) v Hi FW pump speed increases if in Steam dump in pressure auto mode. (FW control valve male at hut standby close due to decreased flow or very low power only.
If in auto mode). Dump valves Hence, dump valves open (Steam dump blocked on will open for only a Lo-lo TAVG (P-12).)
very short tie until lo-lo TAVG (P-12) is reached. If fW pump speed is in m.uiual or FW pump and FCV in a
auto, then this event is bounded by i
II-6 l'e 1411 1 r
NUMilER ASStitE D Of fAlltD FAILURE flotNOING SEfr,0R CilArciEL5 CilANNEL SYSIEM DIRECI10N EFFECI EVENT Accidental Depressuri-tation of the M.=in Steam System (FSAR 15.2.13).
I' 'W pump In auto and fCV in 1
1 manual, get inc rease l
l In FW flow causinj l
excess ive coolina.
l Bounding Event is l
Excessive iW flow (fSAR 15.2.10) l Loop 2 per I selected o feedwater to FW pump speed decreases if in If FW pump and FCV in Steam loop for cmtrol Control auto mode, fw valves close manual - no event.
F low if in auto maie.
Other males result in decreased IW f low, 1
bounding event is Loss of Nornal f W f Iow (fSAR 15.?.3) til FW pump speed increases if in If TW pump and FCV in auto mode. FW valves open if manu s) - no event.
in auto mode.
Other modes - result in in:reased FW flow, bourkling event is lucessive FW flow (fSAR 15.2.10) loop f W 2 per i selected o feedwater L t>
fW valve opens if in auto mode.
If ICV is minuil - no flow loop for control Control event. If ICV in auto, result is Excessive t W flow (ISAR 15.2.10)
II-7 r"
n un.i
NUMBER ASSOME D Of i AllID f AllliRE 80:JN31 NG SEN'30R CilANNEL S DIANN[t SYSTEM DIREC T !iaN EffECT EVENT ifi FW valve closes if in aato mote.
If FCV in manual - no event.
If FCV is auto, result is decreased FW flow.
Bounding event is 1.oss of Normal fW flow (fSAR 1% 2.8)
Narrow 3 per Steam I select <>d o feedwater to -
FW valve opens if in auto mmle.
If FCV in manu.nl - no Range Generator for control Control event. If FCV in auto, level (one available (III) result in Fuce sive for control)
FW f low (FSAR 15.2.10) 11 6 FW valve closes if in auto mode.
If FCV in manu al - no event. If FCV is auto, result is decreased IW flow. Bounding event is loss of Normal fW flow (fSAR 15.2.8)
Pr essur i zer 3 per I or III o Prz. Level to Charging flow increases.
Bounding event is Level plant Control lleaters turn off (except for Uncontrolled Baron (Control) local control).
Dilution Letdown isolated (VCT empties.
(FSAR 15.2.4) charging pumps take suction and Spurious Opera-from RWST.)
tion of the ECCS during Power Opera-tion (FSAR 15./.11) ifi Charging flow decreases.
While heaters ar.
on, l
Backup heaters on (later, let-no net depressur itat ion down isolation fron interlock of RCS. lleaters are l
l l
l II-8 l
15 f t): !
Pa H
N1 TIBER AsstrlD OF FAILID FAILURE 80Ut431NG SLNSOR CHArc4ELS DIAY4EL SYSilM DIRECTION EFFECT EVENT channel, heaters blocked blocked and letdown from interlock charnel.)
isolated by low level in terloc k. Na ev en t.
Pressurizer 3 per 11 or 111 o Prz. Level to Letdown isolated. Prz. heaters Steady-state reached Level plant Control blocked (except for locri con-at slightly high (In terlock )
trol). (Charging flow reduced level. Na event.
to maintain level).
Hi No control action, get Hi level annunciation.
Not applicable Pressurizer 5 per Compensated o Prz. Pressure to Turn on Backup Htrs.
Heaters being on causes Pre ssu re plant Signal Control PORV 4448 blocked from opening, increase in Pri. pres-(2 used for PORV 445A and/or PORV 4458 sure to PORV 445A/445B control) open if required, closes when actuation. No event.
pressure falls below deadband.
Spray remains off.
Hi PORV 4448 Opens, closes Result is bounded by when pressure falls below Accidental Depressuri-P-ll interlock. Spray turned ration of tije RCS on.
(ISAR 15.2.12)
Pressurlier 5 per Uncompensated o Prz. Pressure lo No control action.
P40t applicable Pre ssu re plant Signal Control PORV 445A and 4458 blocked (2 used for from opening. PORV 4448 control)
Opens if required, closes when pressure falls below deadband.
Hi PURV 445A and 445B Opens, Result is t>wnded by closes when pressure falls Accidental Depressuri-below P-li interlock.
ration of the RCS (FSAR 15.2.l?)
II-9 1514tp l
NUMBER ASSUMED Of -
IAllED FA!LUPE SOUNDING SE NSUR CHANNELS LHANNEL SYSTEM DIRE CTION EFFECT E VE NT I A /G one per Any o Stean Damp to Na control action.
N)t applicab!e loop (TAVG Mode)
Auct.
o Reactor Control 11 6 o Prz. Level Control Ili Rods in (safe direction).
No event unless reac-Charging f low increases until tor trips, then itamp full power Prz. level is reached valves open an't bound-(if at reduced power). If ing event is Accidental reactor trips, steam dump Depressurization of the enabled and dump valves open Msin Steam Systen i
until steam etump stops when (FSAR 15.2.13) 10-10 TAVG is reached.
TAVG one per Any o Steam Dump to No control action.
Na upplicable loop (Pressure Mode)
Auct.
o Reactor Control lli o Prz. Level Control lli Rods in (safe direction).
Steady state reached Charging flow increases at full power pres-until full power Prr. level surizer level.
is reached (if at reduced No event.
power).
Steanline 3 per loop Control o Stean Duno Lo No control action.
Nat applicable Pressure for protection, Channel 1 per loop for control (different from lit S. GEN. relief valve Result is bounded those used fo'r opens. Closes on P-12 by Accidental Depress orotection) interlock.
suritation of the Main Stea.n System (FSAR 15.7.13) 11-10 iswn s g
rex
NUMBER ASS 9MED OF FAltED FAILURE But:NDING
$[N9M CHANNELS CHANNtl SYST[M DIRECTIDN EFFECT EVENT Intermediate 2 per plant I or II o Reactor Control to No control action.
N,)t applicable Range Flus Hi Reactor trips if below P-10 Not applicable Interlock.
Turbine 2 per III o Steam Dump to Rods in (safe direction), a sto Not applicable Impulse turbine (TAVG Mode) rod withdrawal blocked (C-5).
Chamber o Reactor Control (If reactor trip occurs.
Pressure steam dump unblocked (Controlj and dump valves modulate until no load TAVG is reached).
Hi Rods out until blocked by Hi Result is bounded by flux, overpower, or overtem-Uncontrolled Rod perature rod stop, or until Cluster Control programmed TREF limit is Assembly Bank With-reached. (If reactor trip drawal at Power occurs, stean dump unblocked and (FSAR 15.2.2) dump valves open until no load TAVG is reached).
Turbine 2 per III o Stean Dump to Rods in. (safe direction)
Not applicable impulse turbine (Pressure Mode) auto rod withdrawal uiocked Chamber o Reactor Control (C-5).
Pressure (Control)
Hi Rods out until blocked by Hi Result is bounded by flux, overpower, or overton-Uncontrolled Rod perature rod stop. (if reactor Cluster Control trip occurs, dmg) valves open Assed>ly Bank With-to keep stean header pressure drawil at Power at or below setpoint).
(ISAR 15.2.2)
II-11 15149:1
NLf1BER ASStilf D OF F A1L LI) fAlLtIRE 800N31NG SE NiOH OIANNE_L5 L_IIAjf4E L SfSTEM DIREC1I0]!
E f I_I C.I.
_E_VENI.
Turbine inpulse 2 per IV o Steam Disnp to Unblock stema dump Mt applic ab le Chrnber Turbine (Tavg Mode)
Pressure (Interlock)
Hi B lock s t earn it+np Not applicable Turbine Inpulse 2 per IV o Stearn Dump to or No control action.
Not applicable Chamber Turbine (Pressure Mode)
Hi Pressur..
(Interlock)
Power 4 per IV o Reactor Control to Rods out until blocked by lli Result is bounfal by Range plant o FW Bypass Control flux, overpower or overtem-Uncontrolled Rod flus perature rod stop. (If Cluster Control reactor trip occurs, dump Assembly Bank With-valves open until no load drawil at Power Tavg is reached)
(fSAR 15.2.2)
Hi Auto and manual rod withdrawal Steady-state reachei blocked (C-2), rods in (in with higher S.G.
safe direction). FW bypass level. No event.
valve opens if in auto (If reactor trip occurs, dump valves open until no load TAVG is reached).
Rising 5.G. level causes valve to close till steam and feed flows match.
II-12 l'i l-10 : 1
NLHBER ASSit1ED OF IAILED F AILURE BOUNDING SE Ns0R CHANNELS CilANNEL SYSTEM DIRECTION EFFECT EVENI Power 4 per plant II, III or o FW Control to FW valve closes if in auto mode Steady-state reached Range IV until no load S.G. level is with lower S.G. level.
Flut reached (for the af fected No event.
S.G.)
(If reactor trip occurs, dump valves open until no load Tavq is reached).
Hi FW valve opens if in auto skxte Steady-state reached until full power S.G. level is with higher S.G. I ? vel.
reached (for the af fected S.G.).
No event.
(if reactor trip occurs, dump valves modulate until no load Tavg is reached).
Condenser 2 per Any o Steam Dump to No control action-steam dump Not applicable Available c onden ser unblocked, condenser available.
Hi No control action-steam dump N)t applicable block ed, condenser unavailable.
.VG 1 per o Steam Dump Lo Steam dump blocked (TAVG mode).
Result is bounded by liigh plant o R. ctor Control Charging f low decreased until Uncontrolled Rod Auctioneer o Prz. Level Control no-load level reached. Rods out, Cluster Control power increases until blocked Assembly Bank With-by high flux, overpower, or drawil at Power overtemperature rod stop.
(FSAR 15.4.2)
Hi Indentical to IAVG channel See above failing high, see analysis above.
II-13 e
Isiaq:1
Nt HillIR AS5LHC0 OF I Altf D FAILURE B00N3]NG Sf N'i,OR CHANNtLS CHANNTL SYSTfM DIRLCTIO'l EfftCT EvtNI Stean F low 2 per loop Control o Stean rlow to identical to Loop Stemn Flow See above Pressure Channel channel f ailing low.
See Convens a tor analysis above.
Hi identical to Lo(p Stesa F low See above channel failing high. See analysis above.
Condenser 2 per Any o Steam Dump Lo No control action - steam Nat applicable Pr essure condenser dump onblocked to 2 conden-ser dump valves.
Hi No control action - steam Nat applicable dump blocked to 2 condenser dump valves.
No Loss of 1
o Stean Dump to No control action - steam Not applicable Stator dump unblocked to 2 conden-Coolant ser dump valves Hi No control action - steam Not applicable dump blocked to 2 condenser duinp valves.
11-14 1 *> f S): t P
TABLE 2 LOSS OF POWER TO CONTROL GROUP 1 1
Control System Failure Affected Signal Affected Direction Itemized Effect Bounding Event
.t Steam Dump o
Steam Line-
. Low No control action.
Charging flow decreases Pressure Steam dump available.
until shut off.
Steady (loops 1 and 3)
Steam relief valves in state reached at new loops 1 and 3 not avail-pressurizer water level.
able in relief mode.
No event.
Rod Control o
None th) signal affected, no control action.
FW Control o
None No signal affected, no control action.
Pressurizer o
Prz. Level Off/ Closed Letdown isolated, backup Level (interlock) heaters blocked.
Pressurizer o
None No signal affected, no Pressure control action.
11-15 1534Q: 1
LOSS OF POWER TO C0ff30L GROUP 2 Control System Failure Affected Signal Affected Direction Itemized Effect Bound _ing Event Steam Dump o
Turbine Pressure Low No initiating event, atnospheric steam dump unavailable.
(If reactor trip occurs, condenser
~
dump valves available).
Reactor Control o
None fio signals affected, no control action.
FW Control o
All (System FW Valve loss of main FW in S.G. 1.
Bounding event is loss (S.G. 1)
Deenergized)
Closes (Plant trips on low level of Normal FW (FSAR in S.G. 1).
15.2.8).
(Plant trips on low level in S.G. 1.)
Pressurizer o
None No signals affected, Level no control action.
Pressurizer o
None fio signals affected, Pre ssure no control action.
1534Q: 1 b
LOSS OF POWER TO CONTROL GROUP 3
~
Control System Failure Affec ted Signal Affected Direction Itemized Effect Bounding Event Steam Dump o
Steam Line Low No control action.
Bounding event is loss Pressure (loop Steam dump available.
of Normal Feedwater 2)
Steam relief valve in (FSAR 15.2.8).
loop 2 not available in relief mode.
Rod Control o
None No signal affected, no control action.
FW Control o
All (System FW valves Loss of_ main.FW-to (loop 2)
Deenergized) close S.G. 2.
(Reactor trip on low level in S.G. 2).
Pressurizer o
None No signal affected.
Level No control action.
Pressurizer o
Prz. Pressure Low No control action.
Pressure (uncompensated)
PORV-455A and 445B stay closed (PORV-4448 available for control) l s
l l
1534Q:1 I-17 a
_.g m.-
u-,
~a s,---
LOSS OF POWER TO CONTROL GROUP 4 Control System Failure Affected Sig.ial Affected Direction Itemized Effect Bounding Event Steam Dump o
All (System Off/ Closed No initiating event, Deenergized) steam dump system unavailable.
(If reactor trip occurs, S.G. atmos. relief valves'available.)
Reactor Control o
All (System Off Rods stay stationary Deenergized)
FW Control o
All (System FW Valve Loss of main FW in S.G.
Bounding event in loss (S.G. 3) and Deenergized)
- Closes, 3.
If FW pump in auto of Normal FW (FSAR FW Pump Speed Pump Speed mode, pump speed decreases 15.2.8).
(Plant trips Control Decreases causing FCV to open in on-low level in S.G. 3.)
(Auto mode S.G.'I and 2.
(Plant The pressurizer ' transient only) trips on low level in is small in comparison.
S.G. 3) 1534Q:1 II-18
=
LOSS OF. POWER TO CONTROL GROUP 4 (Continued)
Control System Failure Aff ec ted Signal Affected Direction Itemized Effect Bounding Event Pressurizer o
Prz. Level On Charging flow increases, Level (control) letdown isolated, backup.
heaters blocked.
Pressurizer o
Pressurizer Closed No initiating event, PORV Pre ssure Pressure (PORV 4448 remains closed, 4448 Control).
heaters and spray remain o
Spray and Heater Off off.
(PORVs 445A and Actuation 445B available if needed.)
1 E
d 153'4Q: 1
~
TABLE 3 LOST OF POWER TO PROIECTION SET I Control System Failure Af f ec ted Signal Affected Direction Itemized Effect Bounding Event Steam Dump o
None No signals affected, Bounding evant is no control action.
Uncontrolled Boron Dilution (FSAR 15.2.4).
Reactor Control o
None No signals affected, no control action.
FW Control o
None No signals affected, no control action.
Pressurizer o
Prz. Level Low If affected signal used Level (control) for control, charging flow increases, letdown isolated and backup heaters blocked.
If signal not used, no control action.
Pressurizer o
None No signals affected, Pre ssure no control action.
IS34Q: 1 11-20 t
\\
=
LOSS OF POWER TO PROTECTION SET II Control System Failure Aff ec ted Signal Affected Direction Itemized Effect Bounding Event Steam Dump o
None No signals affected, Charging flow decreases, no control action.
steady state reached at higher pressurizer water Rod Control o
None No signals affected, level.
No event.
no control action.
FW Control o
None
.No signals affected, no control action.
Pressurizer o
Prz. Level Low If affected signal used Level (interlock) for interlock, letdown isolated, backup heaters blocked., If signal not used, no control action.
Pressurizer o
None No signal affected, Pre ssure no control action.
II-21 1534Q: 1
LOSS OF POWER TO PROTECTION SET III Control System Failure Af f ec ted Signal Affected Direction Itemized Effect Bounding Eyent Steam Dump o
Turbine Pressure Low Steam dump demanded Bounding event is either (con trol) but blocked from inter-Excessive lleat Removal lock.
If turbine trips, Due to Feedwater System steam Jump valves open Malfunctions (FSAR until closed on Lo-Lo 15.2.10) or loss of Tavg (P-12).
Pressurizer transient is Rod Control o
Turbine Pressure Low If affected signal used small in comparison.
(con trol) for control, rod move in (safe direction).
If signal not used, no con-trol action.
FW Control o
Loop Steam Flow Low Feedwater flow increases (Any Loop) in all loops (Independent o
Loop Feedwater Flow Low.
of switch position, level (Any Loop) signal overrides the steam o
S.G. Water Level Low-flow / feed flow mismatch (All Loops) signal).
If affected steam signals used for control, 1534Q:1
LOSS OF POWER TO PROTECTION SET iI'I (Continued)
Control System Failure Affec ted Signal Affected Direction Itemized Effect Bounding Event o
Nuclear power pump speed decreases (loop 2) possibly decreasing feedwater flow (over-riding above effect).
Pressurizer o
Prz. Level Low If affected signal used Level (control or for control, charging interlock) flow increases, letdown isolated and backup heaters blocked.
If used for interlock, letdewn isolated and backup heater blocked.
If not used, no control action.
Pressurizer o
None No signals r.(fected, Pressure no contrei action.
i i
1534Q: 1 11-23 l
LOSS OF POWER TO PROTECTION SET IV Control System Failure Aff ec ted
' Signal Affected Direction Itemized Effect Bounding Event Steam Dump o
Turbine Pressure Low No initiating event, Bounding event is either (interlock) atm. steam dump unavail-Loss of Normal Feedwater able.
(If reactor trip (FSAR 15.2.8) or Exces-occurs, condenser dump sive lleat Renoval Due to
\\
valves available.)
Feedwater System Malfunc-tion (FSAR 15.2.10).
Reactor Control o
Turbine Pressure Low If affected signal used (con trol) for control, rods move in a
(safe direction).
If signal not used, no con-trol action.
FW Control o
Loop Steam Flow Low Feedwater flow may
^
(AnyLoop 5 increase, decrease, or -
o Loop Feedwater Flow Low remain constant in any (Any Loop) loop depending on the position of the feed-r water flow and steam flow selector switches.
1534Q:1 11-24
LOSS OF POWER TO PROTECTI0f1 SET IV (Continued)
^
Control System Failure Af f ec ted Signal Affected Direction Itemized Effect Bounding Event Pressurizer o
.Mone flo signals affected, Level no control action.
Pressurizer o
flone fio signals affected,.
Pre ssure no control action.
e IS34Q: 1 11 25
TABLE 4 LOSS OF POWER T0 INVERTER 2 (PS II & CG 2)
Control System Failure Affected Signal Affected Direction Itemized Effect Bounding Event Steam Dump o
Turbine Pressure Low No initiating event, Bounding event is (interlocked) atmospheric steam dump Loss of Nonnal Feedwater blocked. ~ (Relief valves (FSAR 15.2.8).
available and if a reactor trip occurs, condenser dump valves 1
available).
Rod Control o
None No signals affected, no control action.
FW Control o
All FW valves Loss of main FW to (S.G.1 System) close S.G. 1.
(Plant trips on low level in S.G. 1).
o Neutron Flux S.G.2 FCV closes in response (S.G.2) to low level demanded by level program Pressurizer o
Prz. Level Low
- Letdown isolated, back-Level (interlock) up heaters blocked.
Pressurizer o
None No signals affected, Pressure no control action.
II-26
LOSS OF POWER TO INVERTER 4 (PS IV & CG 4)
Control System Failure Affected Signal Affected Direction Itanized Ef fect Bounding Event Steam Dump o
All (System Off/ Closed No initiating event, Bounding event is Deenergized) steam dump system un-Loss of Normal Feedwater available.
(If reac-(FSAR 15.2.8).
The pres-tor trip occurs, SG atm.
surizer transient is relief valves available).
small in comparison.
Reactor Control o
All (System Off Rods stay stationary.
Deenergized)
FW Control o
FW Control Off/ Closed Loss of main FW in (S.G. 3)
S.G. 3 (Reactor trip o
Loop Steam Flow on low level in S.G.
-(any loop).
3).
Pump speed o
Loop Feedwater decreases to minimum.
~
Flow (any loop)
Feedwater may increase o
Power Range or decrease in the Flux (all loops) remaining ~1 oops depend-ing on the position of the feedwater flow and steam flow selector switches.
If on automatic low power feedwater control, bypass valves in all loops will close, then open again in response to level signal.
Ib34Q: 1 II-27
LOSS OF POWER TO INVERTER 4 (PS IV & CG 4) (Continued)
Control System Failure Aff ec ted Signal Affected Direction Itemized Effect Bounding 'Even t Pressurizer o
Prz. Level Open Charging flow increases, Level (control) letdown isolated, backup heaters blocked.
1 Pressurizer o *Prz. Pressure Closed No initiating event, l
Pre ssure (PORV-444B Con-PORV 4448 remains closed, trol) o Spray and lleater '
heaters and ' spray remain Off off (PORV-445A and 445B Actuatioa available if needed).
1534Q:1
~
II-28.
a TABLE 5 LOSS Of C0ft10N INSIRUMENT LINES
( ASSUMED BRt AK IN LINE)
FAILED FAlLURE BOUNDING.
SE NTORS CliANNEL S SYSTEM DIRECTION EFFECT ACCI DE N T tonp 5te.im flow o f eed wa ter to FW valve closas Bomaling event is and Control in affected S.G.,
loss of Norm.it f W Narrow Range Level ili ptsnp speed decreases (fSAR 15.2.6)
Pressurizer level
!!! (Level o Prz. Level Control lli PORV 455A, 455B and 4448 Depending on switch (Control or Interlock) stay closed, heaters on, positions, event is and spray valves closed.
at most a depressuri-Pressuriier Pressure Control (Pressure) o Pri. Pressure Control to Charging flow decreases ration event which is (All PURV) and backup heaters on if bomkled by Accidental on con trol channel. No Depressurization of the control action from level RCS (FSAR 15.2.17).
interlock. (On low level, letdown isolated and heaters blocked from non-failed channel, either control o'r Interlock.
F~~
Lua i', we i 11-29 1
a