ML20056D311
| ML20056D311 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 01/29/1993 |
| From: | Jonathan Brown, Mason T, Webster S ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY |
| To: | |
| Shared Package | |
| ML20056D308 | List: |
| References | |
| 6370-ICE-3316, 6370-ICE-3316-R, 6370-ICE-3316-R00, NUDOCS 9308110396 | |
| Download: ML20056D311 (600) | |
Text
{{#Wiki_filter:93:R:2003:01 o b ANALYSIS ALLOWING EXTENDED OPERATION WITH ONE PPS CHANNEL IN BYPASS FOR ENTERGY OPERATIONS ARKANSAS NUCLEAR ONE - UNIT 2 Document No. 6370-ICE-3316 Revision 00 Allll COMBUSTION ENGINEERING, INC. NUCLEAR SERVICES INSTRUMENTATION AND CONTROL WINDSOR, CONNECTICUT
!3 Prepared by M Date //Edd5 T.L Mason Prepared by 7b d 8e Date //2r/93 J.W. Ilrown Prepared by Date h7!O
/ S.A. Webster Approved by % "
Date / F4 3 W.M."Sumple This document is the property of ABB Combustion Engineering, Inc. (Alill C.E), Windsor, Connecticut, and is to be used only for the purposes of the agreement with AllB C-E pursuant to which it is furnished. i fM i V issue Date /~29-T3 9308110396 930722 h Qb? # PDR ADOCK 05000368 f P PDR
93-R-2003-01 RECORD OF REVISIONS-NO. DATE PAGES INVOLVED PREPARED BY APPROVALS 00 All T. L. Mason W. M. Sumple J. W. Brown S. A. Webster i O O Document No. 6370-ICE-3316 Revision 00 Page 2 of 257
93-R-2003-01 For purposes of Quality Assurance the following matrix identifies preparer and reviewer by section no. of the analysis. TABLE OF PREPARER AND REVIEWER SECTION PREPARER REVIEWER 1.1 J.W. Brown J. M. Reynolds 1.2 D.N. Menard S. A. Webster 1.3 S. A. Webster D.N. Menard 1.4 3.W. Brown J. M. Reynolds 2.1 J.W. Brown J. M. Reynolds 2.2 T.L. Mason A.C. Denyer 2.3 T.L. Mason A.C. Denyer 2.4 J.W. Brown J. M. Reynolds 3.1 S. A. Webster D.N. Menard 3.2 D.N. Menard S. A. Webster 3.2.1 D.N. Menard S.A. Webster 3.2.2 P.L. Hung T.L. Mason 3.2.3 P.L. Hung T.L. Mason O 3.2.4 P.L. Hung T.L. Mason d 3.2.5 S. A. Webster D.N. Menard 3.3 J.W. Brown J. M. Reynolds 3.4 J.W. Brown J. M. Reynolds 3.5 J.W. Brown J. M. Reynolds 3.6 S. A. Webster D.N. Menard 3.7 T.L. Mason A.C. Denyer 3.8 ).W. Brown J. M. Reynolds 4.1 S. A. Webster D.N. Menard 4.2 S. A. Webster D.N. Menard 4.3 J.L. Rupp D.J. Finnicum 4.4 S.A. Webster D.N. Menard 5.1 J.W. Brow n J. M. Reynolds 5.2 W.T. Abrams D.J. Finnicum 6.0 S.A. Webster D.N. Menard APPENDIX A J.L. Rupp D.J. Finnicum APPENDIX B S. A. Webster D.N. Menard OA Document No. 6370-ICE-3316 Revision 00 Page 3 of 257
93-R-2003-01 TABLE OF CONTENTS y i Section Title Page
1.0 INTRODUCTION
............. .......... .......... 7 1.1 Backgrou nd . . . . . . . . . . . . . . . . . . . . . . . . . . . . ........... 7 1.2 H i st o ry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.3 Proposed Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 1.4 Separation Criteria . . . . . . . . . . . . . . . . . . . . . . . .... . . . . . . 16 2.0 D ES CRIPTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 2.1 Overview of the Plant Protection System (PPS) .................18 ,
2.2 Description of the Bypass Circuit . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.3 Description of PPS Power Circuits . . . . . . . . . . . . . . . . . . . . . . . . . 31 2.4 Overview of the Vital Power Distributius System . . . . . ..........34 3.0 ANALYS IS . . . . . . . . . . . . . . . . ......... ....... . . . 37 3.1 Overview ..... ......... .... ...................37 j 3.2 PPS Functional Redundancy . . . . . . . . . . . . . . . . . . . . . . ... . . 40 3.3 PPS Process Measurement Channel Physical Separation - Inside Containm ent . . . . . . . . . . . . . . . . . . . . . . ................85 3.4 PPS Process Measurement Channel Physical Separation - Outside Containment . . . . . . . . . . . . . . . . ................. ... 118
' 3.5 High Energy Line Break Analysis ......................... 148 3.6 Impact of 2-out-of-3 on Accident Analysis .................... 159 3.7 Electrical Fault Isolation Between the 120 VAC Vital Buses and the PPS Power S upply Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 3.8 Independence of 120 VAC Vital Buses ...................... 192 4.0 DOCUMENTATION CIIANGES . . . . ......... ......... 212 4.i Summary of Document Revisions . ........................ 212 4.2 SAR Section Revisions ..............................213 4.3 FMEA for 2-out-of-3 logic . . . .................... .... 219 4.4 Technical Specification Amendments . . . . . . . ...............220 5.0 SUPPORTING INFORMATION . . . . . . . ............... 252 5.1 Comparison to San Onofre Nuclear Generating Station Units 2 and 3 Plant Protection System . . . . . . . . . . . . . . . . ......... .... 252
6.0 CONCLUSION
. . . . . . . . . . . ..... ............. .. 254
7.0 REFERENCES
.................. ............. .. 255 i
1 i ,/' I ( l
)
Document No. 6370-ICE-3316 - Revision 00 Page 4 of 257 1
93-R-2003-01 TABLE OF CONTENTS Section Title Page FIGURFE 2.2 PPS Trip Channel Bypass Wiring Schematic, Figure 8-31, Sheet 1 . . . . . 23 2.2 PPS Trip Channel Bypass Wiring Schematic, Figure 8-31, Sheet 2 . . . . . 24 2.2 PPS Trip Channel Bypass Wiring Schematic, Figure 8-31, Sheet 3 . . . . . 25 g 2.2 Trip Bypassed Annunciator Auxiliary Cards (And Spares) Wiring Schematic, Figum 8-34 . . . . . . . . . . . ....................26 2.2 PPS Trip Channel Bypass Functional Schematic, Figure 3-16, Sheet 127 2.2 PPS Trip Channel Bypass Functional Schematic, Figure 3-16, Sheet 2 . . . 28 2.2 CPC Channel A/D Test Panel, Test Initiate Wiring, Figure 4-11. . . . . . . 29 2.2 CPC Channel B/C Test Panel, Test Initiate Wiring, Figure 4-12 . . . . . . . 30 3.2 Location of Power Range Excore Nuclear Instrumentation, Figum 3.2-1. . 50 3.2.3 Core Protection Calculator System - CEA Calculators, SAR Figure 7.2-32 ..........................................72 g 3.2.3 System Configuration, SAR Figure 7.2-27 ....................73 3.2.3 Channel B CEAC #1 Block Diagram, CPC T/M Figure No. 6-5 . . . . . . . 74 3.2.3 Channel C CEAC #2 Block Diagram, CPC T/M Figure No. 6-6. . . . . . . 75 3.7 PPS Functional Diagram, 6600-M2001-M1-139, Sh.1. . . . . . . . . . . . . 188 iBLF4 2.2 Trip Channel Bypass Switch, Table 2.2-1 . . . . . . . . . . . . . . . . . . . . . 21 3.2.1 Reactor Pmtection System - Usages & Relationships, Table 3.2-1. . . . . . 42 3.2.1 Engineered Safety Features Actuation System - Usages & Relationships, Table 3. 2 -2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 3.2.4 Emergency Feedwater Actuation Trip Signals, Table 3.2-3 . . . . . . . . . . 78 3.2.4 Plant Protection System Process Signal Trip Function Matrix, Table 3.2-4 . ...... ..............................82 3.6 RPS Trip Relied on for Each SAR Event, Table 3.6-1. . . . . . . . . ... 169 3.6 ESFAS Trip Actuated for Each SAR Event, Table 3.6-2 . . . . . . . . . . . 173 3.7 Qualified Isolation Devices, Table 3.7-1. . . . . . . . . . . . . . . . . . . . . . 177 , 3.7 Initial - Qualification Test Program, Table 3.7-2 ................ 177 ; i 3.7 Replacement - Qualification Test Program, Table 3.7-3 . . . . . . . . . . . 178 ; 3.7 Power Supply Fault & Surge Test Summary, Table 3.7-4 . . . . . . . . . . . 189 l 3.7 Relay Utilization Summary, Table 3.7-5 . . . . . . . . . . . . . . . . . . . .. 191 ) 4.2 Potentially Affected SAR Sections, Table 4-1 213 O Document No. 6370-ICE-3316 Revision 00 Page 5 of 257 j
93-R-2003-01 TABLE OF CONTENTS I Section V APPENDICES Pages 1 A-1 Failure Modes and Effects Analysis, Rev. 01 ......... Al-1 thru Al-112 A-2 Failure Modes and Effects Analysis, Rev. 02 . . . . . . . . . . . A2-1 thm A2-7 A-3 FMEA Diagram No.1 (Revised) . . . . . . . . . . . . . . . . . . . . . . . . . A3-1 FMEA Diagram No. 9 (Revised) . . . . . . . . . . . . . . . . . . . . . . . . . A3-2 FMEA Diagram No.10 (Revised) ........................ A3-3 l FMEA Diagram No.17 (Revised) ........................ A3-4 FMEA Diagram No.19 (Revised) ........................ A3-5 B S AR Revision s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-1 thm B-32 C-1 PPS/ESFAS Power Supply Distribution . . . . . . . . . . . . . . Cl-1 thru Cl-5 C-2 PPS Power Supply Input Fault and Surge Test Procedure 10551-7, Fig.1, 2, 3, 4, 5 . . . . . . . . . ... ........ C2-1 thm C2-5 C-3 PPS Power Supply Output Fault Isolation Test Procedure d C-4 10551-6, Fig. 3.1, 3.2 ........................... PPS Technical Manual, C490.0850 Fig. 3-23, Sh.1, 2, 3, 4 . C3-1, C3 2 C4-1 thru C4-4 C-5 ESFAS A.R.C. Power Supply Input Fault and Surge Test 6370- ICE-3536, Fig. l a, 2a, 3a . . . . . . . . . . . . . . . . . . . C5-1 thm C5-3 O Q C-6 C-7 ESFAS A.R.C. Technical Manual, C490.0730 Fig.1-2 . . . . . . . . . . . C6-1 FPS /ESFAS RAS Circuit Surge Test 6370-ICE-3565, Fi g . 1, 2 , 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C7-1 thru C7-3 D List of Referenced Drawings . . . . . . . . . . . . . . . . . . . . . . . D-1 thm D-4 E NRC Letter Dated March 31, 1982, Roben A. Clark to William Cavanaugh III ......................... E-1 thm E-11 F Entergy Report No.92-R-2029-01, Regulatory Guide 1.75 Electrical Separation Analysis for PPS Channel Bypass Technical Specification Amendment .............. .. F-1 thm F-54 A Document No. 6370-ICE-3316 Revision 00 Page 6 of 257
93-R-2003-01 ANALYSIS ALLOWING EXTENDED OPERATION WITII ONE PPS CIIANNEL IN BYPASS
1.0 INTRODUCTION
1,1 Background This analysis will justify a change to the Technical SpeciDcations which will allow an RPS or ESFAS channel to remain in bypass for an extended period of time. At present Action Statement 2 of Technical Specification Table 3.3-1, and Action Statement 9 of Table 3.3-3 require placing an inoperable RPS or ESFAS channel in the tripped condition (1/3 logic) or bypassed condition (2/3 logic) within one hour. If placed in bypass, the inoperable channel must then be restored to operable or placed in the tripped condition within 48 hours. Compliance with either of these action statements leaves the associated protection system in a one-out-of-three trip logic, and thus susceptible to inadvertent actuation due to a single failure. We believe the risk associated with inadvenent actuation more than negates any risk reduction due to differences in PPS reliability between the two-out-of-three and one-out-of-three con 6gurations. The issue of extended channel bypass was discussed on several occasions during NRC review of the Final Safety Analysis Report. These discussions were curtailed when it became clear that further activity would jeopardize the timely issuance of the operating license. At that time the NRC established detailed criteria against which all extended bypass Technical Speci5 cation change requests would be evaluated. All criteria delineated in the NRC letter N dated March 31, 1982 Roben A. Clark to William Cavanaugh III, is addressed in this s analysis (see Appendix E for letter). More specifically, this analysis will demonstrate the following:
- A high energy line break in coincidence with the bypass of a channel will not negate the minimum acceptable redundancy required by IEEE Standard 279-1971.
e Physical sepamtion between redundant measurement channels meets the requirements of Regulatory Guide 1.75 Rev. 2 and the endorsed IEEE Standard 384-1974.
- For those protection system process parameters where absolute functional redundance does not exist (e.g., excore detectors) the associated accident analyses assume the worse case combination of two sensors are inoperable (one single failure and one in bypass).
- Independence of the 120 volt AC vital buses is not compromised by the l protection system power supply arrangement. The independence of these buses is maintained through the use of qualined isolators as necessary.
e The logic matrix circuits are sufficiently isolated from the electrical
- distribution system such that no credible surge or fault could prevent the i protection system from performing its protective function even with one j channel in bypass.
l - l Document No. 6370-ICE-3316 Revision 00 Page 7 of 257
93-R-2003-01 1.2 IIistory CE plants can be divided into two groups from an instrumentation perspective: Digital and Analog. Analog Plants Analog plants include all plants with separate RPS and ESFAS Cabinets. The RPS is a CE design. The ESFAS typically supplied by Architect, and varies from plant to plant. All analog plants use analog Core Protection Calculators for Thermal Margin and Local Power Density protection. Analog plants generally predate digital plants, and include the following: Palisades Fort Calhoun Maine Yankee Millstone Unit 2 Calvert Cliffs Units 1 and 2 St. Lucie Units 1 and 2* St. Lucie Unit 2 was the last of the analog plants and was contemporaneous with the digital plants. Digital Plants Digital Plants include all plants with a PPS Cabinet, encompassing both the RPS and ESFAS functions. The PPS is a CE design, including RPS and ESFAS logic. ESFAS Logic almost identical to RPS. All digital plants use digital Core Protection Calculators for DNBR and LPD protection. Digital plants generally postdate analog plants, and include the following: ANO-2 SONGS Units 2 and 3 Waterford Unit 3 [,) l Palo Verde Units 1,2, and 3 v Document No. 6370-ICE-3316 Revision 00 Page 8 of 257
l 93-R-2003-01 I ALL CE PLANTS EMPLOY RANDOM 2/4 COINCIDENCE LOGIC. All CE plants were designed with four separate RPS sensor channels, feeding bistable trip units whose outputs are conGgured into a random two-out-of-four coincidence logic. This philosophy was carried over into the digital plants, where both the RPS and ESFAS employ random two-out-of-four logic for all PPS trip functions. In both - the analog and digital plants, there are pmvisions to " trip channel bypass" one channel for each trip pammeter so as to allow one channel to be out of service, while still providing a minimum two-out-of-three coincidence protection in the bypassed parameters. This ensures that no single PPS failure will either prevent a valid trip, or cause an inadvertent trip. The original intent was to allow one channel to be out of service indefinitely if required, while still providing 2/3 protection, meeting the single failure criteria. In the original design, the fourth channel wac never fully credited as an " installed spare" by the NRC because of common mode failure concerns. Many of these concerns were based on the adequacy of four channel separation of channelized cabling, and that a single failure might affect more than one channel. Indeed, walkdowns at some earlier plants demonstrated that separation between channels was not adequate to fully credit the fourth channel as an installed spare. However, in recognition of the remoteness of the possibility of a common mode fault affecting more than one channel, the NRC agreed to the current Technical Specifications, while allowing an " indefinite bypass" option for those plants who could demonstrate adequate four channel separation. These Technical SpeciGcations were adopted by the plants which were then operational or in late constmetion, and are summarized below: With one channel inoperable, the failed channel may be trip channel bypassed for up to 48 hours, (2/3 logic), then placed in the trip condition (1/3 logic). With two channels inoperable, one channel must be placed in bypass and the other in trip (1/2 logic). One of these failed channels must be restored to operable within 48 hours, and the remaining channel tripped (1/3 logic). The Technical Specifications cited above are now used in all CE plants which do not have indeGnite bypass capability. They are typical of all analog plants except St. Lucie 2. ANO-2, which is a digital plant, also currently has these Technical Specifications. Initially, ANO-2, which was then under construction, intended to apply for the indeGnite bypass option. However, review of ANO-2 as a three channel design with an installed spare would have resulted in licensing delays. As a result, San Onofre Units 2 and 3 became the Grst CE plants to license with indefinite bypass. All subsequent plants (Waterford 3, St. Lucie 2, Palo Verde Units 1, 2, and 3) are similarly licensed. Document No. 6370-ICE-3316 Revision 00 Page 9 of 257
93-R-2003-01 The indefinite bypass Technical Specifications thus apply to those plants whose PPS is licensed as a three channel system with an installed spare. The Technical Specifications may be summarized as follows: With one channel inoperable, the failed channel may be trip channel bypassed i until the next cold shutdown (2/3 Logic). The failed channel must be restored ! to OPERABLE prior to return to MODE 2. I 1 l With two channels inoperable, one channel must be placed in bypass and the j other in trip (1/2 logic). One of these failed channels must be restored to 1 operable prior to completion of the next CHANNEL FUNCTIONAL TEST. The indef mite bypass option is subject to administrative review, ensuring it is used only for those cases where channel repair cannot be effected while at power. l 1 Thus, all analog plants, with the exception of St. Lucie 2, are licensed without indefinite bypass. All digital plants, with the exception of ANO-2, are licensed with indefinite bypass. l O O Document No. 6370-ICE-3316 Revision 00 Page 10 of 257
93-R-2003-01 1.3 Proposed Use O %-) Use of the Bypass Function The trip channel bypass is provided to remove an RPS or ESFAS trip channel from service for up to 48 hours for maintenance or testing, effectively placing the RPS/ESFAS in a random two-out-of-three logic in the bypassed parameter (s). In addition, the bypass can be used to remove a channel from service for up to 48 hours, and under some circumstances, the bypass can be used to remove a channel from service for more than 48 hours. The proposed Technical Specifications state that for cases of channel component failure where the component cannot readily be repaired or replaced within 48 hours, a channel may remain in bypass until the next cold shutdown. The four channel RPS and ESFAS systems will be allowed to operate during full power conditions with one channel in bypass longer than 48 hours per the following conditions: A. When a protection channel of a given process variable becomes inoperable for more than 48 hours, the defective channel may remain in the bypassed condition until the next regularly scheduled Plant Safety Committee (PSC) meeting. B. The PSC will review the situation and document their judgement concerning prolonged operation in trip channel bypass. The goal will be to repair the inoperable channel and return it to service as quickly as practicable. C. Any inoperable protection channel must be repaired and restored to an operable state prior to startup from the first cold shutdown operational mode following channel malfunction. Types of Failures That Could Involve Extended Operation with a Channel in Bypass The following are examples of failures that could involve extended operation with a channel ! in bypass: A. Failure of an excore neutron detector. l B. Failure of a Tso, RTD. C. Failure of a T, RTD. D. Failure of a pressurizer pressure sensor. E. Failure of a steam generator level sensor. l I Document No. 6370-ICE-3316 Revision 00 Page 11 of 257
93-R-2003-01 I F. Failure of a steam generator pressure sensor. G. Failure of an RCP speed sensor. H. Failure of a containment pressure sensor. I. Other channel failures where the component cannot be readily repaired or replaced. Requirements"3 I A. Interdependence of the Plant Protection System Trip Parameters (or functional units). The trip channel bypass is accomplished at the output contact of the bistable trip relays where the 2 out of 4 logic (through the six matrices) is performed. Bypass of more than one channel of the same parameter is prevented by interchannel electrical interlocks. Trip channel bypassing at the bistable contacts in this fashion in effect bypasses the automatic trip " Functional Units" listed in technical specification Tables 3.3-1 (RPS) and 3.3-3 (ESFAS). In some cases, the same failed parameter (e.g., SG level) may be used in more than one bistable (Hi, Low Level), each requiring separate Functional Unit bypassing. Since some parameters are independent from "other" parameters or functional units within the same system channel, it is possible that an operator might not be totally aware of all such interactions. O Therefore, the proposed Technical Specifications identify cases where such interdependence exists within a channel's functional units. In the proposed Technical Specifications, it is required that when bypassing a parameter or functional unit in a channel, the operator shall bypass all the "other" interdependent parameters or trip units in the same channel. B. Design and installation of the protection system has been reviewed to ensure that the system meets the criteria below:
- 1. High Energy Line Break The protection system will be reviewed for the effects of high energy line breaks. The protection system will be analyzed to verify that high energy line hazards in coincidence with the bypass of a channel will not negate the minimum acceptable redundancy required by IEEE Std. 279-1971. It should be noted that credit is not to be taken for the " fail-safe" mode of the channels affected by high energy line breaks.
O Document No. 6370-ICE-3316 Revision 00 Page 12 of 257
93:R:2003-01
- 2. Single Failure in Combination with Prolonged Bypass
,r 3 U There may be cases where the prolonged bypass of a specific protection channel in combination with a single failure might jeopardize plant protection (e.g., channels remaining will not sufficiently detect associated transients and accidents without causing unacceptable consequences such as core damage, etc.). Accident analyses (e.g., rod drop accident, md ejection, etc.) will be reviewed to verify that the bypass of a specific protection channel in coincidence with a single failure of a redundant channel will not prevent required protection for any transient or accident.
- 3. Channel Independence The four protection channels will be reviewed for physical independence. It will be confirmed that the four protection channels as installed meet the physical independence criteria of Regulatory Guide 1.75, Rev. 2. It will also be confirmed that the instrument sensing lines from the process to the transmitter are field-routed using separation criteria consistent with the analyzed hazards in the areas.
- 4. Independence of the Vital Buses ANO2 will be reviewed for independence of the vital buses. The Combustion t Engineering (CE) reactor protection system (RPS) is made up of four (4) protection channels for each trip parameter. Each parameter channel consists of bistable relays and associated contacts which am arranged into six logical ANDS (AB, AC, AD, BC, BD, CD matrices) which represent all possible coincidences of two combinations (i.e., combinations of two-out-of-four logic).
In order to use the Technical Specifications of Enclosure 1 of the submittal I letter to the NRC contained in . Appendix E, ANO2 will confirm that tests and analyses have been performed to demonstrate independence of the redundant vital buses. The tests and supponing analysis include: a) The use of a plant-specific mock-up representing one protection logic matrix system (i.e., two matrix power supplies, each with its own simulated 120 Vac vital bus supply, matrix relays, bistable power supplies, bistable trip units, and isolation circuitry), b) The application of surges (internal and external transient voltages) and faults (including continuous phase-to-phase short-circuits, phase-to-ground short circuits and the application of continuous external high voltages) to the simulated 120 Vac vital bus supplying power to an associated matrix power supply, Document No. 6370-ICE-3316 Revision 00 Page 13 of 257
93-R-2003-01 c) Application of the surges and faults between each matrix power supply O input conductor and ground (common mode) and across (line-to-line) the matrix power supply input conductors (transverse mode), d) Monitoring the redundant simulated 120 Vac vital bus supplying power to its matrix power supply to measure any effect as a result of application of the faults or surges on the other bus, e) Acceptance criteria for perturbations which would be allowed within the redundant vital bus without interfering with any protection system actions, f) Justification that the faults and surges used during the testing exceed the maximum worst-case failures which could occur within the protection systems circuits.
- 5. Logic Matrix Circuitry Failure Due to a Vital Bus Single Failure ANO2 will be reviewed to assure that, with a channel in bypass, a single failure of a vital bus will not prevent the protection system from performing its protective function.
In order to use the Technical Specifications of Enclosure 1 to the letter in I Appendix E, ANO2 will confirm that sufficient tests and analyses have been performed to assure that with a channel bypassed, a vital bus single failure will , not negate the required protective function. The tests and supporting analysis include: ! 1 a) The use of a plant-specinc mock-up representing one protection logic 1 matrix system (i.e., two matrix power supplies, each with its own j simulated 120 Vac vital bus supply, matrix relays, bistable power supplies, bistable trip units, and isolation circuitry), b) The application of surges (internal and external transient voltages) and faults (including continuous phase-to-phase short circuits, phase-to-ground short-circuits and the application of continuous external high voltages) to the simulated 120 Vac vital bus supplying power to an associated matrix power supply, c) The application of surges and faults between each matrix power supply input conductor and ground (common mode) and across (line-to-line) the matrix power supply input conductors (transverse mode), d) Monitoring the auctioneered matrix power supply output to measure any effect on the logic matrix circuitry as a result of application of the i faults or surges, Document No. 6370-ICE-3316 Revision 00 Page 14 of 257
93-R-2003-01 e) Verification that during and after the application of the surges and (~}
%/
faults, the protection circuits will perform their protective actions, f) Justification that the faults and surges used during the testing exceed the maximum worst-case failures which could occur within the protection systems circuits.
.O U
Document No. 6370-ICE-3316 Revision 00 Page 15 of 257 l l
93-R-2003-01 1.4 Separation Criteria Although much of the plant electrical design predates the Febmary 1974 initial issuance of Regulatory Guide 1.75, the separation criteria applicable to this analysis is taken from Regulatory Guide 1.75, revision 2 which endorses IEEE Standard 384-1974. The sepamtion criteria applicable to each specific area of the plant is dependent upon the extent to which potential hazards are present. All areas containing raceways associated with PPS will be classined in accordance with the following: t
- 1) Non-hazard Area - These areas do not contain high energy equipment such as switchgear, transformers and rotating equipment. Combustible Guids and high energy lines are also excluded. In addition, non-hazard areas must be isolated from other adjacent areas by fire barriers with appropriate ratings. The cable spreading room is one example of a non-hazard area.
- 2) Limited IIazard Area - The principal difference between non-hazard and limited hazard areas is that power circuits and equipment are not excluded in the limited hazard area. These areas do not contain missile hazards, significant quantities of combustible fluids (gallons) or high energy lines.
- 3) IIazard Area - Any area containing one or more of the following potential hazards -
missiles, exposure fires, pipe whip and jet impingement. Separation between redundant raceways within Non-hazard Areas will be evaluated against the following criteria: O a) For ventilated cable trays containing redundant circuits a minimum horizontal separation of one foot should exist. b) For ventilated cable trays containing redundant circuits a minimum venical separation of three feet should exist, c) A minimum sepamtion of one inch should exist between enclosed raceways containing redundant circuits. NOTE: In addition to conduit, cable trays with flush fitting solid top and/or bottom (as applicable depending on the relative location of the redundant raceway) tray covers constitute enclosed raceways. d) Where physical limitations preclude maintaining the separation distances described above barriers can be used to isolate redundant raceways. Acceptable barrier arrangements are shown in Figures 2 through 5 of IEEE Standard 384-1974. e) Additionally, in accordance with Reg. Guide 1.75, it is acceptable to have lesser separation distances than those speciDed in a, b and c as long as documented justification exists. For raceways containing redundant circuits located within Limited Hazards Areas, criteria 'a' n through 'e' above are applicable with the following exceptions: The minimum horizontal and Q vertical separation distances are three and five feet respectively. Document No. 6370-ICE-3316 Revision 00 Page 16 of 257
93-R-2003-01 For raceways containing redundant circuits located within Hazard Areas a minimum A separation distance of twenty feet should exist,20 feet horizontal separation distance for fire U hazards only. This distance is based on SAR Section 8.3.1.4.2.2.1 and 10CFR50 Appendix R Section III G. The 20 foot distance is justifiable for pipe failure and missile hazards since: a) Seismically designed raceways offer some measure of protection against low energy fluid streams and objects. b) Safety related cables are environmentally qualified. Therefore, where high energy lines are present, secondary environmental effects from a line break will not disable safety related circuits. c) Whip restmints on high energy lines ensure any direct effects of pipe whip would be localized. d) The probability of a single hazard compromising two raceways separated by twenty feet is low. Containment electrical penetrations associated with redundant PPS process measurement channels should have minimum horizontal and venical separation distances of 3 feet and 5 feet, respectively. The minimum separation distance between redundant circuits within a switchboard should be 6 inches. Barriers may also be used to achieve separation within switchboards. Instruments associated with redundant PPS process measurement channels should be located in separate compartments of the PPS, Process Protective and CPC cabinets. Redundant cables - entering / exiting these cabinets should meet the separation criteria applicable to Non-Hazard Areas. Redundant PPS sensors and their connections to the process system should be sufficiently separated that functional capability of the protection system will be maintained for all design basis events. Class IE and non-class lE circuits should be separated in accordance with the criteria applicable to the area through which the circuits are muted. In accordance with the March 31,1982 NRC letter contained in Appendix E, one of the five fundamental objectives of this analysis is to verify that the "four protection channels as installed meet the physical independence criteria of Regulatory Guide 1.75." An additional objective of this analysis is to verify the independence of the four 120 volt AC vital buses. Other issues (e.g., class IE to non-class lE isolation, and appendix R) have been previously analyzed and approved by NRC. In addition, since extended bypass of a channel is completely transparent to the operation of PPS actuation logic circuits downstream of the bistable relays, separation between these output circuits will not be reanalyzed. Therefore, this part of the analysis will be focused exclusively on sepamtion between the four PPS process measurement input channels, and between the four vital power input channels. Document No. 6370-ICE-3316 Revision 00 Page 17 of 257
93-R-2003-01
2.0 DESCRIPTION
S 2.1 Overview of the Plant Protection System (PPS) The PPS combines the RPS and ESFAS protective functions in a single system. This system was designed and built by Combustion Engineering in the mid-1970s. Virtually identical systems were subsequently provided to Waterford-3, and San Onofre Units 2 and 3. The PPS design meets the requirements of IEEE Standard 279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations," and IEEE Standard 338-1971, " Trial Use Criteria for the Periodic Testing of Nuclear Power Generating Station Protection Systems." As shown on ANO drawing number 6600-M2001-M1-139 Sheets 1,2,3,4, the actuation logic circuit for each protective function (e.g., reactor trip, SIAS, etc.) consists of the following basic parts: a) parameter measurement channels b) bistables c) bistable relay cards d) matrix relay cards e) trip path relays f) actuation relays Typically, process measurement sensors (e.g., pressure transmitters) feed signal conditioning modules located in the process protective cabinet, which in turn provide analog input signals to the bistables located in the PPS cabinet. When a setpoint is exceeded on a given channel three associated bistable relays will be deenergized. Each bistable relay controls a contact in one of the six matrix relay ladder logic circuits. The six matrices correspond with all possible two-out-of-four coincidence logic combinations. When a bistable trips, one side of the ladder logic circuit is opened in each of the three matrices associated with that channel. Each ladder logic circuit controls four normally energized matrix relays. When two simultaneous trip signals from the same pammeter are present, all four relays from one of the six matrices would deenergize. Each matrix relay controls a contact in one of the four trip paths. Each ESF trip path includes one contact from each of the six matrices connected in series and trip path solid state relays for both train A and B which are physically separated and connected in parallel. Within the train A and B auxiliary relay cabinets, contacts from the trip path relays control the normally energized actuation (also called subgroup) relays. The actuation relays are arranged in two groups, trip leg 1-3 and trip leg 2-4. One trip path contact must be opened in each trip leg (i.e., selective two-out-of-four logic) to deenergize the subgroup relays. The auxiliary relay cabinets are not utilized for the RPS reactor trip function since the selective two-out-of-four logic is performed by the reactor trip switchgear breaker arrangement. Instead, the RPS trip path relays control rotary relays located in the PPS cabinet. Each rotary relay directly controls the undervoltage and shunt trip coils of two associated reactor trip breakers. A more detailed discussion of the PPS channel bypass and power distribution circuits is provided in subsequent sections. Document No. 6370-ICE-3316 Revision 00 Page 18 of 257
93 R 2003-01 2.2 Description of the Bypass Circuit PURPOSE The purpose of this description is to provide a functional description of the Plant Protection System Bypass circuitry and demonstrate that it satisfies the following requirementsm; [1] Bypass Switch interlock feature prevents bypassing the same trip channel parameter in more than one safety channel at a time. [2] Bypass Switch Relay contacts interface with the PPS two-out-of-four trip path actuation logic. [3] RPS & ESFAS bypass relays am simultaneously energized from a single Bypass Switch actuation. [4] All bypassed conditions are indicated and annunciated in accordance with NRC Reg. Guide 1.47. [5] A loss of a vital bus power source to the PPS Bypass circuitry will not adversely affect the protective function of the logic matrices. O O DESCRIPTION Bvnass Switch Actuation Trip channel bypasses are provided to isolate and remove an individual trip channel from service for maintenance, testing, or continued operation in a two-out-of-three logic configuration. Each bypass must be manually initiated and removed. Within a single channel any number of PPS trip channel parameters may be bypassed. The PPS bypass circuitry design prohibits bypassing the same trip channel parameter in more than one PPS safety channel at a time. I Reference the PPS drawings on pages 23-28I3W which detail the single channel bypass function for the single trip channel parameter, High Linear Power Level, trip channel parameter #1. This bypass switch arrangement is identical for all PPS trip channel parameters in all four PPS safety channels. A two-position, latching, alternate action Bypass Switch is pmvided for each trip channel parameter in each PPS safety channel. The Bypass Switches are mounted on the Bistable Control Panel assembly in PPS safety channels A, B, C, and D. O l Document No. 6370-ICE-3316 Revision 00 Page 19 of 257 l
93-R-2003-01 There are four Bypass Switches for each trip channel parameter. All four switches are connected in series across the four safety channels with one switch located in each safety channel. The series wiring armngement of the contacts for each group of four Bypass Switches incorporates a mutually exclusive contact path that interrupts the initial bypass path when any of the three remaining Bypass Switches are actuated. The Bypass Switch implementation provides an interlock that is an inherent design feature of the PPS bypass circuitry. It is this mutually exclusive switch contact arrangement that prevents multiple bypass actuation of the ! same trip channel parameter in more than one safety channel at a time. The Channel-A High l Linear Power Level Bypass Switch is interlocked with the three High Linear Power I_cVel l Bypass Switches in safety channels B, C, and D. Therefore, if one of the three remaining l Bypass Switches should be actuated, all High Linear Power Level bypasses will be removed. l This action disallows bypassing the same trip channel parameter in more than one safety , H channel at a time. When any system trip channel parameter is bypassed within any selected PPS safety channel, that bypass is applied to all twwout-of-four (2/4) coincidence logic matrices associated with the , bypassed trip channel. The bypass is actually accomplished in the 2/4 coincidence logic matrices which are extemal to the Bistable Relay Card trip relay output contacts, where the two-out-of-four trip logic is perfomiedW. When any trip channel bypass is actuated, in any PPS safety channel, the PPS transitions from a two-out-of-four (2/4) to a two-out-of-three (2/3) trip logic, for the bypassed trip channel parameter only. A trip input for the same parameter in any two of the three remaining PPS trip channels will actuate a reactor trip. Once a bypass is actuated, it is removed by depressing the Bypass Switch, which resets the switch and removes the bypass. With three exceptions, actuation of a RPS Bypass Switch energizes a single RPS Bypass Relay. The exceptions are trip channel parameters #6 - Low Pressurizer Pressure, #11 - Ixw Steam Generator #1 Pressure, and #12 - Low Steam Generator #2 Pressure, which are integral trip parameters to both the RPS and ESFAS systems. These Bypass Switches actuate two Bypass Relays, one in each system. O Document No. 6370-ICE-3316 Revision 00 Page 20 of 257
93-R-2003-01 Byoass Switch Indication and Annunciation O Trip channel Bypass Switch actuation is indicated locally on the respective channel's PPS Bistable Control Panel and the Remote Control Modules 2JC-9050-1,2, 3, and 4 located on the Main Control Board 2CO3. Each Bypass Relay contains six contacts which implement the trip channel bypass as well as provide local and remote indication, as shown on pages 23-28 and Table 2.2-1 below. The numbering of the Bypass Relay contacts in Table 2.2-1 is arbitrary for the purpose of clarifying the description of the bypass circuitry. Table 2.2-1 Trip Channel Bypass Switch CONTACT NORMAL BYPASS CONTACT FUNCTION 1 Open Closed AB-2/4 Trip Logic Matrix Bypass 2 Open Closed AC-2/4 Trip Logic Matrix Bypass 3 Open Closed AD-2/4 Trip Logic Matrix Bypass 4 Open Closed Bistable Control Panel Bypass Indication and Remote ; Control Module Bypass Indication 5 Closed Open Auxiliary Relay Card-Remote Bypass Annunciation 6 Open Closed LPD & DNBR CPC Bypass Interlock (Test Enable)*
- Trip Channels 3 and 4 only, remaining trip channel contacts are spare.
Bypass Relay actuation closes contacts-1,2, and 3 which implement the trip channel bypass in the three respective 2/4 coincidence logic matrices as indicated in Table 2.2-1. When the trip channel bypass is actuated, Bypass Relay contact-4 closes, completing the path between the Indicator Power Supply and the indicator logic transistor, which is in series with an Indicator Power Supply and an auxiliary Bistable Indicator Logic driver providing bypass l indication; see page 25. The transistor illuminates two bypass indicators, one located on the ; Bistable Control Panel and one on the Remote Control Module. The bypas., indicators are not latched on and extinguish when the bypass is removed. Bypass Relay actuation opens contact-5, which removes a 12 VDC bias from the base of a transistor driver in an associated Auxiliary Relay card providing remc e bypass annunciation. All Auxiliary Relay Card contacts form a series circuit, which includes all bypassed trip channel parameters in that safety channel. Removal of the 12 VDC bias interrupts the series circuit and enables a " TRIP BYPASS IN CHANNEL-A" annunciation on the Main Control Board; see page 26 and ANO Annunciator Drawings W. The Bypass Relay actuation also closes contact-6, providing a LPD & DNBR CPC Bypass Interlock test enable signal to the Core Protection Calculator, but only from PPS Trip Channels #3 and #4. This Bypass Interlock test enable signal prevents the CPC system from placing the Hi LPD & Low DNBR functions in a test mode without bypassing the associated I PPS trip functions. See pages 29 and 30m, i Document No. 6370-ICE-3316 Revision 00 Page 21 of 257
93-R-2003-01 Byoass Circuitry Loss of Power Effects O The PPS trip channel bypass circuitry in each safety channel is powered from redundant diode-auctioneered power supplies, see page 23. Each Trip Channel Bypass Power Supply is located in a separate safety channel and is powered from the vital bus associated with the safety channel the power supply resides in. This arrangement conforms to the physical and electrical separation requirements contained in IEEE Std. 279-1971, Criteria for Protection Systems for Nuclear Generating Stations. The PPS trip channel Bypass Switch circuitry is unaffected by the loss of an individual Vital Bus because of the power supply redundancy. Therefore, all trip channel bypasses remain in effect upon loss of an individual Vital Bus or PPS Trip Channel Bypass Power Supply. The Trip Channel Bypass Power Supplies are qualified as Class lE isolators and prevent and protect a Vital Bus fault from propagating to another Vital Bus. The PPS Trip Channel Bypass power supplies were qualified in accordance with ANSI /IEEE Std. 323-1984, IEEE Standard for Qualifying Class lE Equipment for Nuclear Power Genemting Stations and IEEE Std. 472-1974, IEEE Guide for Surge Withstand Capability (SWC) Tests. The power supply qualification testing is documented in the Qualification Summary Report for the Replacement Plant Protection System Power Supply Door Assembly.W The Bypass Relay contact-to-coil isolation provides adequate isolation and protection between the individual Trip Channel Bypass power supplies and the 2/4 trip path coincidence logic matrices. The Bypass Relay contact-to-coil isolation satisfies the physical and electrical separation requirements contained in IEEE Std. 279-1971, Criteria for Pmtection Systems for Nuclear Power Generating Stations identified in Section 4.7.2, Isolation Devices.M The PPS Trip Channel Bypass local and remote indication is fully compliant with the requirements contained in NRC Regulatory Guide 1.47 and IEEE Std. 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations. l l l i i l l O Document No. 6370-ICE-3316 Revision 00 Page 22 of 257 l l
e m O J i O C 9 (D CPU CABINET ggpag g y g g gy N Ya Q TEST PANEL G W 4 9 b m
- da Wa s.. t l U. A #
O
- l CPC J2 CCOTB1-3 CCotst.t i TCOT9S-9 g g g '
o p, - - 79i.t I 3 +s voc (4t.r2/Te3-1)
- p. ,
> i2: , ,, d' ,,"l res.3 g ccotei-s cCoTei.4 rcotes-a 3 N @
) 937 g- @ @ @. +S VDC Met (eftR7) -
T9i 2 t y C []; - . ih j ,,
! '"f' ** j' 2 7 ~? 1._
.- , TEST $NtTMTC TCOTB7 2 .
-3 1 TEST CMtf CNT CASLE T two P/M O-0258S-423-033-1 m S -
$UPPUED
[ DM 4LF1-% @
< N >(f) C^a0 l' urs.: (A) e.
*t CD fe +s voc p.t (4mm7)
N O XI g $- CHANNEL A/D TEST PANEL TEST INITIATE WIRING.
- O e e FIOtJRE 4-11 ~
1 o
% \ O~
w k g i __r,--- +pM
+ w- A e
- 4 774 w M- -- C
- W- 1 'W "
- - - = - I--'- - -
L--- - - - - - - - - - - - - - - -
4 O O O o TERMINATION CABINET U CPU CABINET 5 o t TEST PANEt. 7 CCOTB1 1 TCOTBS-9 CCOT G 1 -2 CEAC J2 3 3 3 +S VDC (6LF2/T93-1)
~ ~
y T91 1 :
') 123 1 g 2 13 14, 01-3 j CCOTO1 4 TCOT95 8 3, M h g @ g +S VDC Ret (6MR19)
O s 4 > >
~
!4 3 T91-6 CCOT82 1 TCOTB7 3 [b c act5 y ww d 6 h @ @ $ 4 **
L)2S'- - PDt i & TCOTB7-4 m TEST INITIATE T VD
. i pro TEST CART CRT CABLE !
P/N 0 92S85-423 033-1 l t CUSTOnACM i 6Rrt-1 SUPPUED y j D/t ! o CARO BRrt-2
< 3,
@ +5 VDC Ret (6RM19)
M I h. g r CCOTD 1 -3 CCOTel.1 TCOT85-9 ~ O CPC .J4 g g g +S vDC (6tJ2/Ts3-1) g ~ ~ *
- 782-1
' CCOTB1-5 CCOT91-4 TCOT85-8 12 2 13 14 l792-3 3 d G G G @ +5 vDC Ret (6RM19)
E h' ,3 < 0 i 4" j- TB2-6 CCOTD2-2 TCOTB7 1 gm. syy, ass /ftst twaut cowres 4 24) TB[2-2 G G G 13
-k [>>25 -
- 4
-g - -
- PB2 TEST imriATC TCOTe7-2 f }g ,
[ pas f , O TEST CART CRT CABLC g P/N D 92585-423-033-1 3 % . str1., CuSTOvER E M F D/t SUPPLIED 3 E ( 1 CARD 6LF1-2 2 +5 VDC Ret (6RR19)
% N >M '.%. i u
M __ to ' i (n CHANNEL B/C TEST PANEL TEST INITIATE WIRING o o p ~ O
% 3o FIGURE 4-12 03 to i1 in -e o-w 6-'
\
b b'\
-5 w9 s- p- + m sm a aywe
93.-R-2003-01 L 2.3 Description of PPS Power Circuits PURPOSE The purpose of this description is to provide a functional description of the Plant Protection System 120 VAC power distribution that satisfies the following requirementsm, [1] Physical separation of PPS Cabinet and ESFAS Auxiliary Relay Cabinet 120 VAC circuits. [2] Fault isolation between Vital Buses. [3] Fault interruption devices. DESCRIPTION ; Plant Protection System The design of PPS cabinet 2C23 isolates each safety channel circuitry in one of four separate and independent cabinet bays. Each PPS safety channel is physically and electrically isolated from each other within the PPS cabinet assembly.001 Each PPS ' safety channel is powered
. from a separate, independent, and ungrounded 120 VAC Vital Bus source.UU The vital I
AC power system feeding the PPS is designed such that a single bus failure or fault will not prevent proper protective system action of the Plant Protection System.n21 All redundant and diode-coupled PPS power supplies are qualified Class IE isolation devices - that will prevent a Vital Bus fault from propagating to another Vital Bus. PPS power j supplies were qualified in accordance with ANSI /IEEE Std. 323-1984, IEEE Standard for Qualifying Class IE Equipment for Nuclear Power Generating Stations and IEEE 472-1974, IEEE Guide for Surge Withstand Capability (SWC) Tests and documented in the Qualification Summary Report for the Replacement Plant Protection System Power Supply Door AssemblyW. The PPS incorporates redundant power supplies to prevent unintended actuation of protective functions in conjunction with the loss of a Vital Bus or PPS power I supply. The redundant power supplies include the bistable logic, channel bypass, and the PPS/ESFAS trip logic matrix circuits. Reference the PPS Power Distribution Wiring : Schematics"U. l The outputs of the redundant power supplies are diode-auctioneered to assure continued ! operation in the event of a PPS power supply failure. Each PPS power supply output is l monitored hr output failures, which are indicated locally at the PPS and the Plant l Annunciator; see Reference 15. l Document No. 6370-ICE-3316 Revision 00 Page 31 of 257 i
93-R-2003-01 O V Each PPS channel has two cabinet cooling fans, each powered from a separate Vital Bus. The primary cooling fan in each channel is powered from the 120 VAC Vital Bus supplying that channel while the redundant fan is powered from an adjacent channel via a qualified isolation transformerD 'i. All PPS inter-cabinet penetrations are routed in separate rigid metal conduit to maintain physical and electrical sepamtion requirements. All cabinet barrier penetrations are sealed with Greproof material; see Reference 10. Each PPS safety channel incorporates ground detection devices to monitor for a ground fault between power supply positive or negative outputs and chassis ground to detect a dielectric breakdown. The occurrence of a ground fault is detected and indicated on a Plant Annunciator in the Control Room and the PPS cabinet. All PPS power supplies are protected from excessive surge currents by an individual circuit breaker within each channel's AC Power Distribution Panel. Additionally, each power supply 120 VAC neutral and return lines are fused. All PPS power supply outputs are monitored for failure and provide indication and alarm annunciation of output failuresDH. ESFAS Auxiljary Relay Cabinets ESFAS Auxiliary Relay Cabinets 2C39 and 2C40 (A&B, respectively) are powered from separate, independent, and ungrounded 120 VAC Vital Buses; see Reference 11. The ESFAS Auxiliary Relay Cabinet adheres to the physical and electrical separation requirements and channel independence criteria necessary to conform with IEEE-279-1971, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations. ESFAS power supplies are protected from excessive surge currents by an individual circuit breaker within each AC Distribution Panel for each cabinet bay, see Reference 11, Drawing E2022. The cabinet bays are physically sepamted from each other. The front bays (1,2,3, and 4) are sepamted from the rear bays (5, 6,7, and 8) by a fire-proof mechanical barrier, and rear bays 5 and 6 are also separated from bays 7 and 8 by a fireproof mechanical barrierU 104 Inter-cabinet connecting penetrations between bays are routed within separate rigid metal conduit to maintain Class IE physical and electrical sepamtion requirements. Inter-bay wiring between bays 5&6 and 7&8 is routed within separate flexible metal conduit. All cabinet barrier penetrations are sealed with fireproof material. The ESFAS cabinets incorporate redundant power supplies to prevent unintended ESFAS actuation in conjunction with the loss of a Vital Bus or power supply. The outputs of the redundant power supplies are diode-auctioneered to assure continued operation in the event of an ESFAS power supply failure. ESFAS power supplies are qualiGed Class IE isolation devices that will prevent a Vital Bus fault from propagating to another Vital Bus. ESFAS power supplies were qualified in accordance with ANSI /IEEE Std. 323-1971, IEEE Standard for Qualifying Class lE Equipment for Nuclear Power Generating Stations; and IEEE 472-1974, IEEE Guide for Surge Withstand Capability (SWC) Tests; and documented in the Qualification Test Report for Input Fault and Surge Testing of Power Supplies for Arkansas Power and Light,6370-ICE-3736,7/22/77973 ESFAS cabinet bays 5 and 8 incorporate a Document No. 6370-ICE-3316 Revision 00 Page 32 of 257
l 93-R-2003-01 l l ground detector to monitor for a ground fault between power supply positive or negative l outputs and chassis ground to detect a dielectric breakdown. The occurrence of a ground l [} L fault is detected and indicated on a Plant Annunciator in the Control Room and the ESFAS l cabinet.U'l U'l O Document No. 6370-ICE-3316 Revision 00 Page 33 of 257
)
93-R-2003-01 ( 2.4 Overview of the Vital Power Distribution System The vital power distribution system is shown on drawings E-2001, E-2004, E-2005, E-2006, E-2008, E-2017 and E-2022. Ieoking first at the 4160 volt system, there are four buses designated 2Al,2A2,2A3 and
- 2A4. The two main buses 2Al and 2A2 can be fed from the following three sources:
- 1) 4160 volt winding of the Unit Auxiliary Transformer (UAT) - This is the normal source of power for both main buses during plant operation.
- 2) 4160 volt winding of Startup Transformer No. 3 - This is the normal source of power for both buses during a plant outage. Either main bus will automatically fast transfer to this source if the UAT supply breaker is tripped.
- 3) 4160 volt viinding of Startup Tmnsformer No. 2 - This transformer is common to both Units 1 and 2. It is not normally designated as the preferred backup source; however, fast transfer to this source could be used if Startup Transformer No. 3 was unavailable.
The two ESF 4160 von buses can be fed from the following two sources: O 1) Main 4160 volt buses 2Al and 2A2 - Normally ESF bus 2A3 is supplied from 2A1 and ESF bus 2A4 is supplied from 2A2. A class IE breaker and 600 Amp current limiting reactor provide isolation between the main and ESF buses.
- 2) Emergency Diesel Generators - The diesel generators will receive auto-start signals on SIAS, loss of voltage on the 4160 volt bus (relays set at 78% of 4KV with a one-second time delay) and loss of voltage on the 480 volt ESF load center (relays set at 92% of 460V with an eight-second time delay). The diesel generators will not be connected to the ESF buses unless the preferred source is unavailable.
The ESF buses 2A3 and 2A4 can be interconnected via the use of a Kirk-Key interlocking system. This cross-tie includes normally open, manually operated breakers on each bus. Use of this cross-tie is prohibited by Technical Specifications during modes 1 through 4.
'I The 480 volt ESF load centers 2B5 and 2B6 are powered from 2A3 and 2A4, respectively, via 1000 KVA step-down transformers. Breakers are provided on the 4160V switchgear and load center sides. These two load centers can be cross-tied via two normally open, manually operated Kirk-Key interlocked breakers. Use of this cross-tie is prohibited by Technical Specifications during modes 1 through 4. Each ESF load center feeds four ESF motor control centers. All eight Motor Control Centers are physically separated and ,
p interconnections are not provided. Document No 6370-ICE-3316 Revision 00 Page 34 of 257
93-R-2003-01 There are four 120 volt AC vital buses designated 2RS1,2RS2,2RS3 and 2RS4. Each vital bus is fed from a 15KVA invener. Each invener has three sources of power:
- 1) 480 volt AC from one of the ESF MCCs - This is the normal power source. This power input circuit includes a step-down transformer, rectifier and filter prior to the auctioneering diode. All of these components are an integral pan of each invener.
- 2) 125 volt DC from one of two safety-related DC buses - This is the alternate supply.
If the DC voltage derived from the normal 480 volt supply is lost, the auctioneering diode will instantaneously allow the alternate DC source to feed the inverter.
- 3) 480 volt AC from a different ESF MCC associated with the same load center - This is the backup source. A separate 480/120 step-down transformer is used within the invener cabinet. The static transfer switch will automatically select this source ifloss ,
of the ferroresonant tmnsformer AC output voltage is detected, or degradation of the inverter output square wave is detected. Due to the energy stored in the output ferroresonant transformer and the design of the static transfer switch, there would be no interruption of the inverter output voltage if the normal and/or alternate input power sources were lost. Each 120 Volt AC vital bus supplies power to the plant protection system through seven separate breakers as follows: O - One breaker from each bus feeds the PPS cabinet (2C23). One breaker from each bus feeds the Process Protective Cabinet (2C15). One breaker from each bus feeds the Auxiliary Equipment Cabinet (2C336). One breaker from each bus feeds a CPC Termination Cabinet (2C394,2C396, 2C399, & 2C401). One breaker from each bus feeds a CPC CPU Cabinet (2C395,2C397, 2C398, & 2C400). Two breakers each from vital buses 1 and 2 feed Auxiliary Relay Cabinet A (2C39). Two breakers each from vital buses 3 and 4 feed Auxiliary Relay Cabinet B (2C40). O Document No. 6370-ICE-3316 Revision 00 Page 35 of 257
93-R-2003-01 The safety-related 125 volt DC system consists of two independent, battery-backed buses (2D01 and 2D02) and their associated chargers (2D31 and 2D32). These chargers have a DC output rating of 400 amps. A third spare charger rated at 200 amps (2D34) is also provided. The rating of each charger is sufficient to supply all normal bus loads and maintain the battery in a fully charged condition. The input power for each charger is from an associated train 480 volt ESF MCC. ' When spare charger ."u a } is used to supply the red DC bus (2D01), the charger input must come from ESF MCC 2B54 to maintain train separation. Similarly, when the spare charger is used to supply the green DC bus (2D02), the charger input must come from MCC 2B64. Mechanical interlocks prevent closing both output breakers of the spare charger. The 125 volt DC system provides two independent sources of breaker control power to the i reactor trip switchgear via distribution panels 2RAl and 2RA2. The other two breaker } control power circuits are supplied from 120 Volt AC vital buses 3 and 4 via battery i climinators 2D35 and 2D36, respectively. A more detailed discussion of those portions of the emergency power system peninent to this evaluation is provided in Section 3.8. A detailed evaluation of power distribution within the various protection system cabinets is provided in Section 2.3. I J O 1 j O Document No. 6370-ICE-3316 Revision 00 Page 36 of 257
. . ~
- ,. w- -.
, r. v.e.u -- .
- ~ .. - - .. , ., 9,_. .,. . . ,
,c .,
a-. . . .~ ,m ,c ., %., ,
... . 2 ~ . .- .- c .
,, r . .
I i i - . - g i i .: , c9; - i r 9 , ,,-, .i
-i i .. . ..
- i i o i i.
. . I 8 i
. . e ,
~~
EE=__:,. . , - F: ',",*:-- m..-.,. . . .
,,,,, , t.__; ;
- i -, , - , -- . , ..,
c9, i , r 9, ' d'rE-m,w-
*. e'.:,
s. 8 8 e s . - . L__.J j s m. . .. g l ,,,,,,,j g i ,
. _ . . _t,. . . ,
.~ ,.
..._ .. ____..., i i
,......,i.,_____.__,,,.
.i,.. ..--..u,....,,..,. ,
____t__
,,._J::r ,-.e :,"e, _ _ c.) .
i__ _._ _ _ _ _ _ t.m,", . m_ e
*..^"
_ s
.o m.d m .. ,.- e rhm- r ., , . -
_. , . , , __ w -
.y
.,,.~.,.7,,. .__ . ,
, m a
. u..c.
, ..cs t
* * ^
,-.-._.._r-*4,.Pf,E . , - . . . .,-"4, . y33
~. . .n .
.n .
, . . , _ l l ; u l .;
. ,g . . .
.i.u..-... . , - , . , , . , ,
.. u ... . . i. .# . .. . ..
. . . u .,.
o
. . ,. ., ,,. , . .n.
n.
. u.
. ,. ,, o . =
a a
- u .o . ou ;; ;;; ;;;
a c ... . * ,
. u a.
- , .. = .. .,
m
, ,. , . , m.
. . .= . . .
. ou =. .. ..
. - = 4 .. .. . ,
. u.n.
.. . n. -. ,n, ;
. . , . m.. m. . .
4 -D . .t ,
. .b. ,
. 3,,.s,.
. .H 4 ,
u .,
. .m. a ., ,
. . .. m. .. .
l , i I
/
I J FIGURE 8-31, SHl. PPS TRIP w J o
raa 93-R-2003-01 .
.~ .m a e. o sans e.s. a .
~,i.T
.=. %. 7. ~-"
7 amu 7.w a.s _i. am es.r em e.m m. .g- . e .p. n r
- - ,_ *"" *" i '
-======q,. .
,g. . _ ..__>i.~_m . n = =-1 .; .
- _=w==:., g. 4.y. y, g._......_..n% . ,
w o g g . . . . . . =4=._., ip 9, . l 3 8 - ~ , g i as I g ..- e g, . I 1 1 l .rao ui1 8
- m. gq g ._ag i i I g I ,
, .r , s i ,
, s i .V ~~~
.w..'
f l I'
,g i ~ -- T" ==8._**"".
' 4 3
.i . .(
I U -- 'g f l '"'8 u_ i '-- J 4 wm. .
... su. > 3 I
r- , I r* *e i i
- es
._m.m.._,,
._a i
i ;._,.-
,_.+
.m.,, .
.m _
i . . - i-.._. !____J i 8.u ., . _L .-.;x ___ l I . % J.= ' 1 -.
,.l~, ,--" ~ ..7.,-.%,,~,*'-',*~'~~ *iiM I
. . . { ': == - c' .m.ar,~,
- ; ..,.,. .. . . ~
r ::-- .i. .
-w r..-----
p u.m 6.mmu r-.a ;. .m.m s
.-a .n.a.iq
. .u . qg-_.--._....--.
s
- e. +
*n..
,,l.tm,_
. ..o - i
._m.._u i
. .. .v F-*-,----,
"~a t.- _ _ ,A. ._ _
,y m.F __ . . -~.u=-~~'% .. :: d . .,5. rr.~re;~
__ :~ .. o , ,,_ m _ . ..~ m
. a ._
ci ,
..j ,7~
u . .
.....o t,.. .,.
...1_ r i.;
' }
. _ . . . r . --
i
.. ._. .. o_--. . . ,
APER'l,U,RE
<~.
.- : 9. ; F 1...,
~
- ~ -
CARD a , ,s . ., e
, y
. .. m -
v._.. i i e s . .. _. . _
.v_ A n Aya 3 0 - n
__ Aperture t,an f..- na As is
- '"":""~"""~
":~" ":":'"""::
,,c..Q)/b .- w .Gi M
~
1 9 3 08110 3 9 6- h ! [ANNEL IlYPASS, ' WIRING SCHEMTIC Document No. 6370-lG-3316 Revision 00 l' age 23 of 253
ee8' man am** 1 l .15 =4 9G = M*f. 1 .= iI . . . i . . . i . . . , I .-. N t 4 89"E # I I m t 9t PW. tee teet I tie F.e oef $ l gg pre d 19 Stee Sf t IA048 3 S JL en MsAW Came nags b dN N NN N ,*, NN f f **. N d h'" FJ5U" 4--A -NNkee, { 5b e-,s,4 t. .( 5'5 -,,,.a6Y
;4 8 4
g I.II." .
!!!.g
. .I.IIZ
-- I.II.
.;-v-f.$..
f:- -
.E..
E 5 j j E.. EE h jjIEE_ E. e EEba
.-_h h hhh.2 E_
_E~h jh IEE; ..ggtrr gg rEE 5 5 :.titt : ma -n : 1I a::- saae -sau.: t c ::
' - i
. .E.rrg: -e c .-
Ik EC,2h "E!~5-5. I g
.EC.Eb.- kkECE.$ 3
. a h. . . 3 ~ ~;.2 l( E *M. a
}g=
ki,d.. di,n uh i.t, . ,.
,.t, .
m . < ; - 41.le ;" 4%",
- = - t l
m.g... ;]
.gs ;g . .4 a4*g ame ggm,es gu
.s sa n seeees.n.euse Tempa$.wa.stmeses eaig g gg g y gg gp nug 3 gp agg4
) s g ogg g g 4
. . . w. Ms
*. >*L-* **'
e tgeu,gg wam gggggg.gge ,948, M8 0. . k . -l_ \.. N., Ns.lt9 8 A, F gn pg M " E4 va4 g g gg ' g)
.av8 A tisse .,
Wese6 ggJdesaftC ufth g 1 A .. A N. NM..e N .. f"" 8 . 4"o a' e e . g's
?' l .
w.. . %.. . w. .. %_. ,
% r-4' 5
" 4 5 4 9 4 9 0 0 e g I m*-G&t sett . Md eftB 3 /
[F 44
.M t 80fE 5 z=
.*.-GE. e,ft it
=
"g gM. gggg g g,
.i
.. .. ,I.. ,. 4,,f.. . ,4, ,4, -
. .yy -
,.3, I _
,p c d', .w._ ., pt .. ,i.
l n r.
, i g.u
, i
.r,eu .,. m ,
. i, . , .i. . .w.
' g .d ., 4,_
..:., .p.
.,3, ___e, i s ,,t. ,,s ,
1 s
.:;-rv ga i.rgb V
-:i-.;r V .sav . ,r
;.N 3;34'T i Xi i-g.
i 14, _. hrt. yt';r . yn,
.6i yi
. f., .*;r
, i j .
e , sa. ., s.,, . , . r r g-2.
-m_a2
.. Lnm2 m,,4s . ,._<3
=.. m, e ,6
,,8,,
r
%g_ _,, m,, , , , , n e
{ 9;$n $;;a- E;;$ :g D
.a th T,,r f a{: 4 rYI =r 5-J3 ,*,rf :, 3 53E. _us III F3h3 f_S
_m IlE ?EE,a In 'sSO iii III n, 5
, a Es3, III :55 _e-a EE.i .
, Iil ; _
_7"a1 jf.3 Eg :1 ;f:r:r2 H 1 E ;2 ~@:1 E-53 : 7p 2 2 -i:
- N E3 =EEE FEES NEE 3 ::: FEES -: W$ :[:1:
T:: f as ; an s 1:an :::t s tata --:-:
- Bib t :::: .
xu ..a 3 a
=,
%== u m um s p
--s ..
ase Y M5 [ I NI I a te ( u. . . .,
..L.,
- n. .
..h ]'
n... .A=..,
. =
.. Z.. .=.Y 7. .J$,uEL.'- . 1., ,
un ..."..Y ..
.. c ance
.40 takt 3 aus4pd EW14M al aul tW 45 SMa 4M AS SWe 4 W 45 g gget (W a8 (beg gyai l l l g lg psag [ psef l 9 444 y Pasq g su ss ly y a gg s y ge get y FIGURE 8-31, Sil2. PPS M
NM M
m,... 93-R_-2003:01 FILM AS IS Date: D nitmis: Bad;;o #:M
- m. .
. l ....~. l
. . . . . . l .... , I . . . . . . l . . . ,,,,, I
....~. l
. . . . - - I sI APERTURE
... . 6
&.s
.ARD C
y n- ennenn. neun enny vy.nynn n t.nn.. n n en-} tr sym,- rr
- .u=-
r: is iris ::: c-a-:
- -~::-:
m - u w- ..q r::-:2-errr; j 5;is iisas;;;;; rr:::::: ga55;;ias; r'-e
~- ---
r::::::
- =
=ii 6
r" 'r
-4 :
1 r: i; ii Also Available On Aperture L,ard i e if ai I Et am E-EEE RlE
= EU
*IEEE EEI:' *iEEE:IEE- *iEEE=*IEff :. a *$E I
- I E= $$
*
- 15 sn ! *IE su .$ ::: n*3 5 s :.a *!* :bst:}, '91 A.
2: 23
- a' i =.
. :=.-=
.. . ; n-m e..
. :.:=
. a g e- --:---= {p'- =;:== : ii* = =* ==
- :- g i ,
,1 . . , . .. W. .. 1f. : ..
- i. h. . ...
I i
.,t.
n*a ---m3 a -na - , g i - i- i - i .j,! [ ', P y. 2t83 IPN IFE
.J.
*t. , s.i. c- ,,- . J@s'.s
,,1 .
-l . --m -. .
M
.. u.
y,,' *f. -___._L. , . , =
. + . ______h.i .
. .-:, - ~* 1
; y .- >
un O. A. i
*i--a-a di 'ii 'y JJ rm ,i d4 1 5 d:
3,; . 1 .A. . 4',., b'i.
.~. . .,~.. ,
4 ..,. ~. .
.r. . . -,
=,.
r,---- [. . -
~ W.
\ i~
.i. -
.!. .l,-i I
I
- 1. - .i..-;
g.* .,
.g ty-- 7- ., 1 i . .
e s/ !/ .1 / ui. /? p- __.,g.,_ ,,. u f, r-' u p,
.j. uju ,
< i. .
=, ;Y. .".J. I./
.., ,.'_.i,V., ...
.L. -J i
i
-- 4,""c- --
k,-- V.L, ,, . V.*' ,_, Vt, ,, V' ,
.p Y.fr
_ _s b'" , m .l. wm w - l, A 4 m. su .. u m
..;_] 5
- s;g: e ( n-- . . .h' g.;:: f!f .t' i1 . iM
- =
.b t n-n i
,--w a a m
-~ : 2 :t:: .
- tas 2:n lui 3Eid f- : Eait j,sE="=g " tal r-i^ts ti! Ill til teisgi D.:<:::: lit i's:: :
n-aa 2 i
- a ;, -:, = .
saar:: a== lat s : = ::: : : -c-Es
-r,:h! ! ::
- : ::- imam ss ::: a t
- = := = =6' n::: : :
a= u n:- 9 P: - - - ~ ~ ~ - - - - ::::=
= - -*- . . u..
m,
.f
--- nr . f. ,w..:f. r , .f. .ff. --- -- - -- - --- -- - ~ ~ --'- ... ..._. ~fE...-j-L, l
..... l .,.
. . . - . l
. l .,.
.. . l .....,.,.
. . . . . . l .. . .. .,. ,. , . l IRIP OMNEL liYPASS, WIRitiG SCHEt% TIC q -
9308110396 Id Document No. 6370-ICE-3316 Revision 00 Pace 24 of 253 i L__._.________ _ _ _ _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
,m
- I (SEE FIG.S 8-50, 8-53, S H 5; f.
8-51,8-52,SH6. POWER DISTRIBUTION ( (OAYS A THRU D),WlHING SCHEMATIC) TO K50215 (SEE NOTE 6) 6.3V RET (SEE NOTE 7) BP IND RET j f PSIO 4 I J631 (SEE NOTE 7) 15 (SEE NOTE 8) g h K501 2 (SEE NOTE 7)] l (SEE fiOTE 8) 16 (SEE NOTE 7) BP IND 1 (A( C TYPICAL BYPASS INDICATOR CIRCUlT (SEE NOTE 9) T6 h BYPASS RELAY 2 SIGNAL NAME 3 BCP CONNECTOR 4 (NPUT IND13 g-K 501 16 BPIND1 P510 A J631 63 K 502 16 BP IND 2 P510 B J631 - 62 K 503 16 BP IND 3 P510 C J631 25 K 504 - 16 BP IND 4 P510 - D J631 -26 K 505 16 BPIND5 P510 E J631 - 27 K 506(2)- 7 BP IND 6 P510 F J631 -28 K 507 16 BP IND 7 P510 - H J634 63 K 508 16 BP IND 8 P510 J J634 - 62 K 503 16 BP IND 9 PS10 K J634 25 K 510 16 BP IND 10 P510 - L J634 26 K511(2)-7 BP IND 11 P510 M J634 27 K 512(2) - 7 BP IND 12 PS10 N J634 - 26 K 513 - 16 BP IND 13 PS10 P J637 - 63 K514-16 BP IND 14 PS10 8 J627 - 62 K 515 - 16 (SPARE)BS 15 P510 S J637 25 K $16 16 BP IND 16 PS10 T J637 26 K 517 - 16 BP IND 17 , P510 - U J637 27 K 518 16 BP IND 18 F510 - V J637 28 K 519 16 BP IND 19 P510 W J640 63 K 520 - 16 SP IND 20 P510 X J640 - 62 K 521 16 (SPARE)BS 21 PS10 Y J640 - 25 K 522 16 (SPARE)BS 22 PS10 - Z J640 - 26 K 523 - 16 (SPAR E)BS 23 P510 SA J640 - 27 K 524 - 16 (SPARE)BS 24 PS10 SB J640 - 28 l HGURE 8-3L Sil3. PPS TRIP OiMNE
- o. . -
93-R-2003-01 TO BP IND 1 (RCM) (SEE FIG.8 30,SH 1, REMOTE CONTROL MODULE, WIRING SCHEMATIC.) IISTABLE INDICATOR LOGIC 26401 (26403) 5 (SEE NOT E 7) J01
+ -6.3 V P401 P401 J x 631 8 (SEE NOTE 7) k h !I Also Available On k]l (SEE NOTE 7) Aperture Card 4 6.3 V -" O O C fV g 1 (SEE NOTE 7)
ISEE FIG.S 8-50, 05601 8-53, SH 5; 8-51,
\ /
8 52,SH6. POWER DIST RIBUTION (B AYS C O 2 A THRU D),WlHlf4G
' \
BYPASS (BS 1) SCHEMATIC) BLE 4 1708 LOGIC CARD CONNECTORS TO REMOTE TO BCP 5 DESIGNATION CONTROL MODULE INDICATO R IN0!CATOR J631 - 59 J631 23 DS601 J01 C J631 - 58 J631 - 22 05602 J01 F J631 57 J631 21 05603 J01 - K J631 56 J631 - 20 05604 J01 - N J631 55 J631 - 19 DS605 J01 5 J631 - 54 J631 - 18 05606' J01 V JG34 59 J634 - 23 05607 J01 - Y J634 58 J634 22 DS608 J01 SB J634 57 J634 21 05609 J01 - S F J634 - 56 J634 - 20 05610 J01 St J634 - 55 J634 0S611 J02 - C J634 54 J634 18 05612 J02 F J637 - 59 J637 23 0S613 JC2 K JG37 - 58 J637 - 22 05614 J02 - N J637 - 57 J637 21 0S615 J01 SM JG37 56 J637-20 05616 J02 - S J637 55 J637 19 0S617 J02 - V J63T- 54 J637 - 18 05618 JC2 Y J640.- 50 J640 - 23 0S619 JC2 - SB J640 58 J640 22 D5620 JC2 SF J640 - 57 J640 - 21 05621 J01 - SQ J640 - 56 J640 20 0562? JC2 SI J640 55 JG40 - 19 05623 JC2 - SM JG40 - 54 JG40 18 05624 JC2 50 BYfASS, WIRING SCllEMAllC FILM AS IS 9 3 08110 3 9 6 - h mMNA "~ Document No. 6370-ICE-3316 Revision 00 Page 25 of 253
. m Y%
4(... L.=4..f 4 4. .Af 59 s.
. Mas..iie5. E(.Ed .e
'aa r
; : ,, >nm .u .- c ., c' . .. '
.'s. dk p . ,J~-
- y. .
- .ra m. % .e
- .. , ; L-b a *4 rmrwr-*: < = *: -
. : : :' ""A
; . 6 . ,,,.,,.. -
..,<-u -" * *
,,,, r--j" l *"" .T _h .e 63 r--++' . h,;vw** ' "*S.-
u-u.___. .. um .._ i,.. .w. u ; 4, - au w,. "f" *U . D..L. I'9
---+ " l ^ .
.l.
l j
- . 1 L a* "i a j
[f a!
.C. E.er t.
- . . - a u n :, .;_ ".'.7
.gga p .E,5
- i . u, :,, y .M * : :. ,,w .s. *e
- 6. r--+ w+.
l l : M. re p *
.wa
- M -
l l
""'[
. * * - -u.,.
. . ,- 5".'.
- u a: ,
; .u_.__.
...n . . - .w , ,- 4,
_.4 -! * .
.u u.< n*:% .
' . , ' ' . ., L_.s.T. f~~ =>?.'*- .
i. l
. . . .L .
I : : :
. . [: r-'~f*c- Y,
.Le "'i~NT . .. , : +
-f. ' - .! iuu j '"' ;
.: < = .. .=- l **f
. .; m .++--
o ~. . ..u n. . l .
.a .
F.. ses t.,.s . = u.; ; i
. ice w w a y g
4 .. j e* ; u n.. c.- .
.t .
L F. a-
=c.tas.;a
. ,, - uu . . U* N wr#: .*i. -
I, ! iu w = 4.** . J "l '. i
>yl
.! 8
! l ".!
- , ! L- 4 = >4
. . s.
4 -
'a :1-
\
l l ' m. N. [:uu,oh *f~~''g"' . ..,..' d "- +- I ,,M*,, ,.,I "i~~- l ' l l
..,, ! .. d * *I me l +I-
-+
! i i d
! s '+a : i
. su o , - .,
. u,
-r r r--t..i' ".>t. , . - -) .
LrT ?
- 5.u....~ ;.-- .
=
l
- m___n nu, u= * +
' . ' ..u .e '. .
n : __.i , ! j ;
. . .a - a'%. Ab : y s2., 2'. ;
= >"r, "- .
i l .i
.d I i 4+- "t-me i =
i i j " f I. L_ a = a' ~ I,
-t.* l.io a.l* i.-** . ,,.. h:, ."' : .' - !", . ' '
- 1
- - ~
- l
. ma e.s ,: .
" +.
. . . :. f--l.-* . :
- T .
~N : -
T. ....e :
. u ..
g . .j .... a
">+- n.
r,-w,,,w . m - 8 s
- i. 7. f-t. " t.
""]
FIGURE 8-34. TRIP BYPASSED MNlR i
\
l i 1
\
J WW N _ - _ _ - _ -
93-R-2003-01 ! y l J. -. .. -
' s . u._._
D
,r e.r.r.r.r.r.r.r.r.r.q . . . . . . .
I r- ..,~ . .u. x ,,,,:-- u:;r. r. . r.rr,.,,- ;
;n
~' ,, ,,.o
! ~
l
-- pu., e.
- m. .?
- 9. ..? .
..m . .:.n - ,
u,.
.. .~
- , Q ...: , .
u~. ;. .,. . s
. .... .. - e s
-) 0.aan,
.. . .. i...._.........,:
m -. -
-~~ _ , , ,
y... . ..
- 3. , , .
.. . .p ,, y ,,,
1 - l
.t 2
....n..; ... ,
.t-+: : . .. .: .: .
.,=a ;.,, .
I
-t. - :
. e -t- .
SI G "'i
- i "
m : s .
-", .: .e APERTURE 7.. .
C., , .,. . 1
?
CARD
- i ,. . .:
tr r t'-~ : l i .-_...-...'. i l Aho Availabic On
"".~_..;::
.. . u.,.
.; ./ Aperture Can!
,. .. ... .C, . .. . . - . - . ..
- : : 1 i
- .. .wsra u ,, .L :
m....
. l:= ,o n., , ?. 71--aS . :s n g .= , r r7 rw e
- c. . .
,,,,,,y,, -
.~ : : . . .
s nc.
- . : : - :-- . .,. . :- e.
. .i
- i : - *
-t.+=
. i.
, in w., .
.8 +1.--*-
.N ,Q - g~l 3 j'u
.. .r 2, - - .
l l
* : . u, ; * * *+ m : .
- ..,,.-N **" - .
. . ; , 2 " *t.
7 .
, : : :. .. .,mit *:
-t. a .o ca.~a
+'-~'% (
.* -d a
.vv . .
a_.,-
-d L. a. . ~
a
- v. . :
- l .. .til.;7 iE l
)
. . lu . .
I. M . + . .
. ; y .., ., . :1- t* - .;
lt..m.n......... l j i l _ l f ,t* " j
". ~ aa =8 a' *.a .* .** waa..== ..a j I_
'T~ : '" "" ~ "
- D
. . . N .
- t
.- t.-a .,.c. := . :
. .. w m.ei=.
+=....aan'* *a
- w. . ... ...
- -.s.u . ,c. j 9 = . => r . r-* *we
. . u --
- : .a : i.....n........--
. . . 1 .
*t.-- .=,.a.=*,=*w==**'a.*
nw
- : s
=.m ;
=; <-
s -~ ' oo - g . , . , _ ,' i r.;.m.m.; -
.r-+
J. ... t. . 7 , q , pitys i ASIS Badge 'u. - Cate,] g hinit:#.' . CIATOR AUXILIARY CARDS (AND SPARESL VIRING SCHEPAflC Document No. 6370-ICE-3316 Revision 00 Page 26 of 253 h 9308110398-V ,
. _ _ . ~ - . - . . . - . . -. , .
I e- . y i
'l 1
tisTABtf CONfmL PMEL A BYPASS svl101 K! LN POER (TRIP NO.1) i
> c
, a n e '
I 3 e n e 2 1 31 Pass itELAY AK501 3 mp m A pyPm (SEE MTEyl) g,,
.- POWER SUPPLY, PAN (1 A. (sa HI (Ji POWER FIG. 3-3L PPS TRIP 04ANNEL gypg33 v1A l@lCATOR I 3YPA1 W! RING SUEMitC)
LOGIC I 6.3V IET FRDr! l@!CATOR POWER StrPLY, m h' ,r[ itI m T0.le!CAfDR y* i ' 'y' PMEL A 0'S-6) POWER StrPLY g Putt A (Ps-45) TO ROUTE CNTil0L A, H! LA POWER 4 !! AUXILIARY BtfAss Ic!CATOR
- D
,n,cy Mt . g n.W RET j
/ @ - h .)'t IO %
8YPASs M10lCIATOR r ran- n.w sanw io a mmX, MTRIX POWER .= m if g, P= +
,,;;m ;m m, A2 O(ANNU. A CE FIG. R ru KC n.0V TRIP 10.1 BISTABLE REIAY E AC MTRIX, M Fig. R 31stm mmX PAWER 'f ; OWpEl A, CARD C0KIACT 4stPPLY, PMll A g '- p 3EAY CAO CONTACT ASSIG0fl13) (PS-10) ** TRIP No. 2 Assigety!3)
FM AD n.0V MP 80* I - TO AB MTRIX, MTRIXPOWER Q; Y PMELA g
'l gg l 00NIO. A, TRIP 10. 2 ,
g OiANM1 A TRIP 10.1 TYPICAL MTRIX l
/ (A8 IPl OIANMil A A8 MTRIK PDWDt stRLY, PAlEL A -
O (P5 9)
- 1. All SYSTDI PAWETERS ARE PROVIDu! WITH A Stw2E 'P SvPA55 flu.AY 15 fADI O'AMEL EXCI7ilHG PARMETERS ,_
6,11 No n.11ESE PARNETERS ARE Pfl0VI!O VITH . IEA0 # " ACTS, 1. gg3* - TI
, 014NEl A T It (sa mwo @.
TRIP M. 2 MASS CDNTACTS L- 11 OIAMEL A y
, Ullarl BYPASS R!1AY
- 10. 2 - NOT SOfK) v i
$R!f be b' '
( SvPAss CmaACTs
*~
I OWtN(.L A T ' (TRort BYPASS liflAY m.Is-ersm > ,, ( , s , 70 h (TRIP
. c REL) i F*%. -samp .
4 L
. _ . . , . _ . . , , - r
93-R:2003:01 BISTMLE Ow19DL l'MEL 8 EWns Sv! Tot til LN POWLR (TRIP No.1) O L1 Y O ic h h aIc b# 2 h / EWASS RflAY BK501
' 5.w 10 TRIP OWmCL B BYPASS Pt*Et 53ftY, PMEL 8 (SEE g
@ FIG. 8-3L PPS TRIP OWmE BYPASS, WIRING SOfEMTIC)
NU " VIA Ic!UTOR 4.3Y flat ICICATOR MI SMI W LOGIC rr 9i l 6.3V RET TO IGICATOR Pow [g sgny PMEl B (PS-M) fM '#
'e' PMEL 8 (PS-%)
TO ADCTE CONTRDL mm, C=t a,4 ggg g ggygs i, i l APERrI,URE is AUXILIARY k b,l ) ICICATOR
- - ~ ~
8 DI M M ,, E^ ew '!4 Aho Ave,itable On
'd 12.w RrT 7 @ %W )
10 8mm MMilCIATOR Aperture Card (R'J1 AB MTRIX 12.W M BELDO NR N TO A8 MTRIX, I @ '- 8 g km} y,
- - OWM1 B, WP m. 2 OIMNEL B, ccR FIG. 3-3, B!STM r BC M X 1. P m.1 M FIG. 3-2, B! STABLE ggjyggg 97gy AZitMUITS)
( NR N @; j] TO BC MTRIL
> OWOIEL B, A PEIAY CAO CONTACT (pc BC MTRIX, MP m. 2 CIM)
OWKL B, FM RI) MTRIX 12.w : TRIP 10.1 TO BD MML h; jl $ OWM1 B, (PS 14) ED MTRIX, . TRIP M. 2
\ OWOR B, p TRIP N0.1 WASS CONIECT10lG
, MTRIX) ORWLB A8 MTRIX POER SWPLY, PA41 C
,r (PS-ID 181P m.1
- P -- 1 BYPASS CDKTETS,
-1 g Owen B @
M nwo IRIP 10. 2
- p __ 1 BWASS CONTACTS 2 DiAK118 (TRun EYPASS RruY
#10. ? - NCT SRM) 3P 1. _t mPyggets 7 ' T OWM1 B __ LM gg gg (flui BWASS RflAY ,
m.15 - mT SKm d' " " ' 9't.C} O ,rgiX dir.rW ~ i'ATH) 5 fig.5-ESKI.L l'PS TRIP OL/M1 BYTMS, fUNC1K$AL SO(MilC 3-45 Document No. 6370-ICE-3316 Revision 00 Page 27 of 253
~~~~
9 3 0 8110 3 9 6- Q
i
.I --*
1 1 I i l t . PASS '" BISTABLE C0ftTROL PA!El C (TRIP No.1) Ch
/ \
h n 3 c
" e
@ 7 c ~
FROM 4 SHT.1 3" D# TO TRIP OmHEL C BYPASS 01 >D POWER SUftLY, PAIEL C (SEE FIG. 8-31, PPS TRIP OnlEL
\ HI LN POWER I l 6.3V O N' N N FROM ICICATOR 6.3Y PCIER FMEL C StJTLY, \ p/ '
, .W
,L/s rr IC 111
'l '
;h 10121CATOR PcWLR SUPPLY (PS-47) _ ijg PANEL C(PS-47)
' agi 10 RDOTE CONTROL j
~
M, M C, 4 HI LN POWER BYPASS ll, 3 gggtgggy gy ggpg IEICATOR tgi j 8'
. 6
/
+12.W d k> 12*W U p- )3 yTO BvPm N0fJtCIATOR t
l / . N - FROM AC MTRIX 12.0V 10 AC MTRIX, 88 t- OWOG C POWER St#TLY g; PANEL C E MTRIX, TRIP NO. 2 (PS-15) OWOR C, ' FROM BC MTRIX 12.0y TRIP PATH NO.1 TO BC MTRIX, (SEE FIG. 3-8, BISTABLE (SCE FIG. 3-8, BIS' TABLE f' > Ol4MNEL C, POWER SilPPLY , ; > R11AY CARD CDNTACT Rf1AY CARD CONTACT < PANEL C TRIP NO. 2 AS$!GMENTS) BC MTRIX, ASSIG11NTS) (ps.15) 0%W1 C, FROM CD MTRIX 12,0y TRIP PAT){ NO.1 TO CD MTRIX, i POWER SLliflY m I' > OwmEL C, PANO. B TRIP M0. 2 CD MTRIX, / (PS-12) OWML C,
\ TRIP PATH NO. I b
l n -
...}
1 I
-._._ 1 93:R:2003-01 i
l l BISTA8l[ CONTROL PAKL D pypg3 gygggg l lil LN PMR { (TRIP NO.1) 5.0V RET l
- i
' FROM TRIP OWINEL A a c - POWUt SUPPtY, PANEL A rp TRIP OW9EL 5 (SEE FIG. 8-II, PPS TRIP OIANNEL n 8 c 4M PcWER SilPPLY, PMEL B , BYPASS, WIRING SODATIO <
' FR0ri TRIP OWIMf1 C n Ie ,-
pyg $gny, PMEL C , o c 1 T0/TROM TRIP , OwoEL D P0kTR
- StFPLY, PMEL D (SEE TIG. 8-31, PPS s.m mc5euYDou 5.0V tup oma meS, SI ja (p, - : y :G, vlRins SamnC)
APERTURE NI l . CARD VIA IGICATOR [ FM IMICATOR 6.3V N LOGIC !'
- T "5" 29 =O INDICATOR Also5", ,
am 1 G: M JJ lll Available Aperture Card On
,;F TO PDCTE CDMIR0L i - -
t00GE, OtAMEL D,4 ti8 HI U FWER BYPE: ijs 411XILIARY I REMY CAM 121CATOR Hi, -
/
.u.. n u. e Q3 TO BYPASS y > MMCIATOR
/ N y FRon AD MRIX 12.0V TD AD MTRIX,
> OUMfCL D, f9ER PMil D StFPtY, g ; ji TRIP m). 2 g 97,gg (PS-20) M D, TRIP 10.1 TO BD MTRIX, (SEE fl6. 3-8, BISTABLE FROM BD MTRIX 12.0V J FIG; 58; BISTABLE IWER SUTLY, A. -' I' > owe [L D, > RELAY CAM NM 4 U AS$1CMOTS)
J CMD CONTACT PME1 D TRIP NO. 2 BD PATRIX, BCH.TNTS (p3 333 OMIEL D, FROM CD MTRIX 12.0V TRIP NO.1 TO CD PATRIX, POWLR SURY p. Ii
> OWINil D, PAM1 D v ' yggp no, y (PS-19) CD MTRIX, j
\ OWmEL D, TRIP HQ.1 FILM AS IS
#9 cate:gg/O_in.tals. .
FIG.}-16,5KT.2. PPS TRIP CPMNEL BYPASS, FLvfCTIONAL SCHEMTIC Pau l Document No. 6370-ICE 3316 Itevision 00 Page 28 of 253 9308110396- [O - ,a
93-R-2003-01 3.0 ANALYSIS 3.1 Overview Arkansas Nuclear One, Unit 2 (ANO-2) received its Operating License in December 1978. ANO-2 was the first of the Combustion Engineering (C-E) units to apply a digital Plant Protection System (PPS). Due to its era, ANO-2 also was designed and constructed to more stringent standards than many earlier plants. These more stringent standards led ANO-2's parent company, Mid-South Services (now Entergy Operations, Inc.), to conduct further studies to justify treating C-E's four channel PPS as a three channel PPS with an installed spare channel. After numerous meetings with the NRC, it was detennined that the three channel review process could not be completed in a timely fashion to permit the NRC to issue ANO-2's Operating License. Subsequent to issuance of the ANO-2 operating license discussions led to the issuance of the Clark (NRC) to Cavanaugh (ANO-2) letter of March 31,-1982, contained as Appendix E. The Clark letter was based on an internal NRC staff memo, Speis to Novak dated January g 28,1982. The Clark letter established the criteria that must be met to justify 2-out-of-3 logic. These criteria are listed under requirement B of section 1.3. This analysis demonstrates that ANO-2 meets these criteria for operation of the Plant Protection System (PPS) in a 2-out-of-3 logic. Criterion 1 Ifigh Energy Line Break Section 3.5 presents the High Energy Line Break Analysis update perfonned for this effort. The ANO-2 Safety Analysis Report (SAR) Section 3.6 identifies the high energy lines and their credible break locations. Section 3.5 of this report is organized to coincide with the SAR discussion, and analyzes each break location for pipe whip and jet impingement effects on those protection system components credited in the accident analysis with mitigating the effects of a break at that location. This analysis demonstrates that a high energy line break in coincident with the bypass of a PPS channel will not negate the minimum acceptable redundancy required by IEEE Std. 279-1971. No credit is taken for the fail-safe mode of the affected channels. Criterion 2 Single Failure in Combination with Prolonged Bypass Sections 3.2 and 3.6, along with Appendix A, present a study of the effects of single failures on the PPS channels to ensure that the two channels remaining (assuming one channel is in bypass and a second channel is subject to a single failure) provide the protection assumed in the accident analysis. Section 3.2 presents a detailed quantitative evaluation of the PPS demonstrating that the degree of functional redundancy is one in all cases with one channel of any and O all PPS functions permanently trip channel bypassed. This includes an evaluation of the inputs to each functional unit (trip bistable), identifying where an input is Document No. 6370-lCE-3316 Revision 00 Page 37 of 257 w - -
93-R-2003-01 common to more than one trip function, including operating bypasses. Each input is then discussed, and the events relying on the associated functional unit (s) are discussed with panicular emphasis on the potential for geometric effects affecting the analysis assumptions. Section 3.6 presents a more qualitative discussion along similar lines. The RPS and ESFAS trips actuated for each event are identified, and potentially asymmetric events discussed. This section verifies that bypass of a specific protection channel in conjunction with a single failure in a redundant channel will not prevent the required protective action for any anticipated operational occurrence (AOO) or accident. Appendix A provides tne revised failure modes and effects analysis with one complete PPS channel in bypass. This appendix verifies that for three channel operation of the PPS, no single failure will prevent the required protective action for any AOO or accident. Criterion 3 Channel Independence Sections 3.3 and 3.4 present a study of the PPS process measurement channel physical separation, inside and outside containment, respectively. These sections conGrm that, as-built, the four protection channels meet the physical separation criteria of Regulatory Guide (RG) 1.75, Rev. 2. Section 3.2.2 justifies the separation of the CEA position cables as an appropriate exception to RG 1.75. Criterion 4 Independence of the Vital Buses Sections 3.7 and 3.8 address fault isolation between the Vital buses and the PPS . power supply, and the independence of the Vital buses, respectively. Section 3.7 discusses the fault and surge qualification test program for the PPS power supplies. These tests on a mockup of a typical C-E digital PPS demonstrate that the maximum credible faults of 140 Vdc and 508 Vac, and surges of 1500 Vac peak (2.5 to 3.0 kV for the ESFAS cabinet, and 400 Vac for the RAS), applied to the inputs of selected power supplies do not propagate through the redundant power supply to the second Vital bus. Section 3.8 demonstrates the adequacy of the independence of the four Vital buses given that there are only two batteries supplying their power source. This is done in sections 3.8.2 and 3.8.3, which demonstrate the acceptability of the separation between the Vital bus power feeds to the PPS, and of the separation between the inverter input and output power circuits, respectively. Section 3.8 also evaluates the maximum credible faults that could be applied to the PPS power supplies, and demonstrates their acceptability. This is done in sections 3.8.4 and 3.8.5, which evaluate the capability to withstand surges and faults, O respectively. Document No. 6370-ICE-3316 Revision 00 Page 38 of 257
93-R-2003-01 Criterion _5 Logic Matrix Circuitry Failere Due to a Vital Bus Single Failure Section 3.7 also assesses a postulated single failure on a vital bus to assure that, with a channel in bypass, the PPS will not be prevented from performing its protective function. This is done in a subsection specifically addressing Design Criteria - 5. The PPS power supply fault and surge tests conducted show that no credible single failure will affect the Trip Relays of the six matrices in such a manner that the actuation of the PPS is jeopardized. O O Document No. 6370-ICE-3316 Revision 00 Page 39 of 257
93-R-2003-01 3.2 PPS Functional Redundancy 3.2.1 Degree of Functional Redundancy
Background
All of the Plant Protection System (PPS) trips can be trip channel bypassed, effectively placing the PPS in a two-out-of-three logic for the bypassed trip (s). It must therefore be assured that with one PPS channel in bypass, there is no common mode failure of any of the remaining operable channels which might disable two or more PPS channels. Equally imponant, and the subject of this section, is an evaluation of the functional redundancy of the input parameters. In most cases there are four process measurement channels, each equally capable of detecting any change in the input parameter (e.g., pressurizer pressure). In these cases, the degree of functional redundancy is one, since with one channel trip channel bypassed, one additional channel can still exhibit a failure in a non-trip condition without disabling the PPS function. Summary The degree of functional redundancy is one in all cases with one channel of each trip permanently trip channel bypassed. O In only one case is sensor placement around the vessel such that all four channels are not equally responsive to design basis events exhibiting spatial asymmetries. Specifically, the ex-core Nuclear Instrumentation (NI) detectors do not exhibit equal spatial response to the Control Element Assembly (CEA) Ejection event. With one channel in bypass, and another j assumed to have failed in a non-trip condition, the two remaining sensors are adequate to ) detect the event, even if the remaining sensors are the least affected by the event. In order l to prove that a channel redundancy of one is maintained when one trip channel is bypassed, l it was necessary to quantify the maximum expected channel deviations during the event, and 1 to assure that the existing setpoint calculations included these uncertainties. For the CEA l Ejection event, a 10% power measurement uncertainty was included in the Accident l Analysis, which conservatively accounts for the power asymmetry effects on the Ex-core N1 l detectors for any ejected CEA. Since this uncertainty is included in the Accident Analysis, it j need not be repeated as a setpoint uncenainty. j A more qualitative discussion of the impact of 2-out-of-3 logic on the accident analysis is found in Section 3.6. Functional Redundancy Evaluation The parameters which must be evaluated from a functional redundancy viewpoint include all of the input parameters for both the RPS and NSSS ESFAS. These parameters, their relationships to one another, and their usage in one or more PPS trips are shown on ANO-2 drawing 6600-M-2001-M1-158 (ABB CE drawing E 6370 411503), which is also used as l Document No. 6370-ICE-3316 Revision 00 Page 40 of 257
93-R-2003-01 the reference drawing in the Failure Modes and Effects Analysis, Section 4.3, as SAR , FMEA diagram No.1 (see Appendix A). Input usages and relationships are summarized in b] Tables 3.2-1 and 3.2-2 for the RPS and ESFAS, respectively. l As used in Tables 3.2-1 and 3.2-2, the temi " functional unit" refers to a bistable or actuation l device in the RPS and ESFAS logic. The term " input" refers to the various sensor / signal paths upstream of the bistable, which actuate the panicular functional unit, or provide a l pennissive bypass to it. O O Document No. 6370-ICE-3316 Revision 00 Page 41 of 257
93-R-2003-01 Table 3.2-1 Reactor Protection System - Usages & Relationships FUNCTIONAL UNIT INPUTS-each channel /(other RPS/ESFAS)
- 1. Linear Power Level-High Excore Power Range Nuclear Instmmentation (NI)
(shares circuitry with Log NI, Linear Subchannels) Opemting Bypass Enables: None
- 2. Logarithmic Power Level-High Excore Wide Range (Log) NI (shares circuitry with Power Range NI, Linear Subchannels)
Operating Bypass Enables: > 1E-4 % Rated Thermal Power (RTP) bypass permissive from same NI channel. Bypass enable also permits bypass of CPC (DNBR-Low and LPD-High) channel when
< 1E-4 % RTP.
- 3. Pressurizer Pressure-High Narrow Range Pressurizer Pressure (Also input to CPC for DNBR/LPD)
Operating Bypass Enables: None
- 4. Pressurizer Pressure-Low Wide Range Pressurizer Pressure (also input to SIAS/CCAS/SIAS enable of CSAS)
Operating Bypass Enables: < 400 psia bypass permissive from same pressure channel. Allows bypass of Low Pressurizer Pressure RPS trip, SIAS/CCAS/SIAS enable of CSAS. Also allows bypassing of RWT Level-Low input to RAS.
- 5. Containment Pressure-High Containment Pressure (Also input to CIAS/SIAS/CCAS/SIAS enable of CSAS via a second bistable and CSAS via the Containment Pressure Hi-Hi bistable)
Operating Bypass Enables: None Document No. 6370-ICE-3316 Revision 00 Page 42 of 257
i I 93-R-2003-01 ! Table 3.2-1 (continued) Reactor Protection System - Usages & Relationships EUNCTIONAL UNIT INPUTS-each channel /(other RPS/ESFAS) 1 6a. Steam Generator A Pressure-Low Steam Generator A Pressure ! (Also input to MSIS, EFAS-1 via the same bistable) and to EFAS-1 and EFAS-2 AP logic via two separate bistables Operating Bypass Enables: None 6b. Steam Generator B Pressure-Low Steam Generator B Pressure l (Also input to MSIS, EFAS-2 via the same bistable) and to EFAS-1 and EFAS-2 AP logic via two separate bistables Operating Bypass Enables: None 7a. Steam Generator A Level-Low Narrow Range SG Level (Also input to EFAS-1 via the same bistable, and to SG Level A-High via a separate bistable) Operating Bypass Enables: T3<200 deg. Hi/ Low SG Level bypass permissive. 7b. Steam Generator B Izvel-Low Narrow Range SG Level (Also input to EFAS-2 via the same bistable, and to SG Level B-High via a separate bistable) Operating Bypass Enables: T3<200 deg. Hi/ Low SG Level bypass permissive. O Document No. 6370-ICE-3316 Revision 00 Page 43 of 257
93-R-2003-01 Table 3.2-1 (continued) Reactor Protection System - Usages & Relationships FUNCTIONAL UNIT INPUTS-each channel /(other RPS/ESFAS)
- 8. Local Power Density (LPD) -Target CEA Position
-High (CPC) -CEAC Penalty Factor based on non-target CEA Positions
-Hot Leg Temperature (2)
-Cold leg Temperature (2)
-Narrow Range Pressurizer Pressure (Also input to Pzr Press.-High)
-Ex-core Power Range Nuclear Instrumentation - 3 subchannels (Shares circuitry with Power Range and Img NI channels). .
--RCP Speed (one per RCP)
Operating Bypass Enables: < 1E-4 % Rated Thermal Power (RTP) bypass pennissive from Log NI channel. Bypass enable permits bypass of CPC (DNBR-Low and LPD-High) channel. Bypass enable bistable also pennits Log Power Level-High trip bypass when above setpoint.
- 9. DNBR-Low Same inputs as LPD-High Operating Bypass Enables: Shared with LPD-High 10a. Steam Generator A Level-High Narrow Range SG Level (Also input to SG Level A-Low, EFAS-1 via a separate bistable)
Operating Bypass Enables: Ta < 200 deg. Hi/ low SG Level bypass permissive. 10b. Steam Generator B Level-High Narrow Range SG Level (Also input to SG Level B-Low, EFAS-2 via a separate bistable) Operating Bypass Enables: T 3< 200 deg. Hi/ Low SG Level bypass permissive O Document No. 6370-ICE-3316 Revision 00 Page 44 of 257
93-R-2003-01 Table 3.2-2 Engineered Safety Features Actuation System
- Usages & Relationships FUNCTIONAL UNIT INPUTS-each channel /(other RPS/ESFAS)
- 1. SIAS/CCAS
- a. Containment Pressure-High Containment Pressure (Also input to CIAS and SIAS enable of CSAS via the same bistable, to Containment Pressure-High Reactor Trip via a second bistable and to CSAS via the Containment Pressure Hi-Hi bistable)
Opemting Bypass Enables: None
- b. Pressurizer Pressure-Low Wide Range Pressurizer Pressure (Also input to Pressurizer Pressure-Low Reactor Trip via the same bistable)
Operating Bypass Enables: <400 psia
~ bypass permissive from same pressure s channel. Allows bypass of RPS trip, SIAS/CCAS, and to the SIAS enable of CSAS. Also allows bypassing RWT Level-Low input to RAS.
- 2. CSAS
- a. Containment Pressure-High-High Containment Pressure (Also input to the two Containment Pressure - High bistables, one used in the RPS, and the other used in the SIAS, CIAS, CCAS, and the SIAS enable of CSAS.)
- b. SIAS CSAS requires SIAS AND Containment Pressure High-High for actuation.
Operating Bypass Enables: None (other than the SIAS bypass) Document No. 6370-ICE-3316 Revision 00 Page 45 of 257
4 Table 3.2-2 (continued) [ Engineered Safety Features Actuation System
- Usages & Relationships FUNCTIONAL UNIT INPUTS-each channel /(other RPS/ESFAS)
- 3. CIAS
- a. Containment Pressure-High Containment Pressure (Also input to SIAS/CCAS, and to the SIAS enable of CSAS via the same histable, to Contaimnent Pressure-High Reactor Trip via a second bistable and to the CSAS via the Containment Pressure Hi-Hi bistable.)
Operating Bypass Enables: None
- 4. hlS_Iji
- a. Steam Generator A Pressure-Low Steam Generator A Pressure (Also input to SG Pressure-Low Reactor l Trip and EFAS-1 via the same bistable, and to EFAS-1 and EFAS-2 AP logic via two separate bistables)
Operating Bypass Enables: None
- b. Steam Generator B Pressure-Low Steam Generator B Pressure (Also input to SG Pressure-Low Reactor l Trip and EFAS-2 via the same bistable, and to EFAS-1 and EFAS-2 AP logic via two separate bistables)
Operating Bypass Enables: None
- 5. _R_6ji
- a. Refueling Water Tank-Low Refueling Water Tank Level (Not used in any other RPS/ESFAS Function)
Operating Bypass Enables: <400 psia l bypass permissive from the wide range ! pressure channel. Allows bypass of RWT fm level-IAw input to RAS, also allows , Q) bypassing of RPS trip, SIAS/ CCAS, and the SIAS enable of CSAS. l i l l Document No. 6370-ICE-3316 Revision 00 Page 46 of 257 ; I r
l l s3 R 2003-01 l Table 3.2-2 (continued) Enginected Safety Features Actuation System
- Usages & Relationships FUNCTIONAL UNIT INPUTS-each channelhother RPS/ESFAS)
- 6. EFAS1 :
- a. Steam Generator A Ixvel-Low Steam Generator A Narrow Range Ixvel (Also input to SG A Level-Iow Reactor Trip via the same bistable, and SG A Level-High Reactor Trip via a separate bistable)
Operating Bypass Enables: T,< 200 deg. Hi/ Low SG Level bypass permissive.
- b. Steam Generator A Pressure-Low Steam Generator A Pressure (Also input to MSIS and SG A Pressure Low Reactor Trip via the same bistable, EFAS 1 and EFAS 2 AP logic via two separate bistables)
Operating Bypass Enables: None
- c. SG A Pressure > SG B Pmssure SG A Pressure and SG B Pressee.
(delta P logic) (SG A Pressure also input to SG A Pressure Low Reactor Trip, MSIS, EFAS 1 Low Pressure Logic Trip via a separate bistable. SG B Pressure also input to SG B Pressure low Reactor Trip, MSIS, EFAS 2 Low Pressure Logic Trip via a separate bistable) Operating Bypass Enables: None O Document No. 6370-ICE-3316 Revision 00 Page 47 of 257
93-R 2003-01 Table 3.2-2 (continued) Engineered Safety Features Actuation System
- Usages & Relationships FUNCTIONAL UNIT INPUTS-each channel /(other RPS/ESFAS)
- 7. EFAS 2
- a. Steam Generator B Level-Low Steam Generator B Narrow Range Level (Also input to SG B Level-Low Reactor Trip via the same bistabb, and SG B Level-Iligh Reactor Ti.p via a separate bistable)
Operating Bypass Enables: Ts < 200 deg. Hi/ Low SG Level bypass permissive. O. Steam Generator Pressure-Low Steam Generator B Pressure (Also input to MSIS and SG B Pressure Low Reactor Trip via the same bistable, EFAS 1 and EFAS 2 AP logic via two separate bistables) O Operating Bypass Enables: None
- c. SG B Pressure > SG A Pressure SG A Pressure and SG B Pressure. ,
(delta P logic) (SG A Pressure also input to SG A Pressure Low Reactor Trip, MSIS, EFAS 1 Low Pressure Logic Trip via a separate bistable. SG B Pressure also input to SG B Pressure Low Reactor Trip, MSIS, EFAS 2 Low Pressure Logic via a separate bistable) Operating Bypass Enables: None O Document No. 6370-ICE-3316 Revision 00 Page 48 of 257
93-R-2003-01 In order to pennit indefinite bypass, it must be proven that the fourth PPS channel is truly an installed spare. That is, there must be a functional redundancy of one in each bypassed parameter to meet the single failure criterion. Therefore, the following analysis assumes one channel of each trip function is trip channel bypassed, and demonstrates that there is still a functional redundancy of one. To perfonn this analysis, it was necessary to address the individual trips credited in each SAR Chapter 15 event, and assess whether the process inputs to those trips are susceptible to spatial asymmetries during each analyzed event for which their operation is credited. For those that do exhibit such asymmetries, appropriate uneenainties must be included in the setpoint analysis. The Chapter 15 review was augmented by a technical review and discussion with ABB-CE ANO-2 Nuclear Fuel Project Office and Nuclear Fuel Engineering personnel to provide updated information not necessarily reflected in the existing SAR chapter 15 analysis. Table 3.2-1 results from the augmented SAR chapter 15 review. This table, when combined with the preceding information defining process inputs to each trip, yields the following results for each input shown on ANO-2 drawing 6600-M-2001-M1-158 (FMEA diagram No. 1). The block number for each input in the following discussion refers to the appropriate FMEA block as shown on drawing 6600-M-2001-M1-158 (see Appendix A):
- 1. Excore Nuclear Flux Monitor (Block 68)
A. Description The Ex-core Safety Channel Nuclear instrumentation consists of detector assemblies (Block 68) and downstream signal processing electronics (Block 69), Each Ex-core NI channel can be subdivided into two types of instmmentation, sharing dmwer I electronics and detector assemblies, but differing in ranges covered and usage:
- 1. Power Range (Linear) NIs are used as inputs to the High Linear Power Trip (Block 72) and the CPCs (Block 89) for DNBR-Low and LPD-High protection. Each of the four Power Range Excore NIs uses three vertically stacked fission chambers as neutron flux leakage detectors, axially symmetric with respect to the core centerline. They are located surrounding the reactor vessel as shown in Figure 3.2-1, exhibiting 90 degree symmetry. Since each detector actually detects neutron flux leakage originating largely from the peripheral row of fuel bundles adjacent to the detectors, they are not as sensitive to flux perturbations originating in distant fuel assemblies as they are to pertuibations originating in adjacent assemblies. Therefore, asymmetries are of concern for these detectors.
O Document No. 6370-ICE-3316 Revision 00 Page 49 of 257 W -- v - wu 7 "'
93-R-2003-01
. ~. -l i s w w. . .,r ,m n sws e e< ,r i
U) s wery , .v. -
= werv n .6 3-3 werv a e s-6 SMETY ee
.o.g'
, umana.< e*. a-a u.a ma. n e .- .
, u.c . e . .- .g.
e u.e a a .--
.,p -t Ou RCP 28 g f's.
.s ! ..
f\ ... h
' ~~ , % ',
_ . _I.-- ', - '
/
% q_y
{ s, , -
' \
- i. =
- .4%:4A9%l -+
"D"
.N
' / l l
[ s:e.eiwgMacA%
,Jr%
it%46 l: . ~ M! 8- 'MMdh M ,22h 43I M: r M \
/ .
-- =#fMihi59ed.bE%3th ..-
- f ', -E.+ ^!9 Ji!9 J.9 #b aB n iiG I \, ,1
\ i '! -
-$K Ld!% Bc,?iME%E@ ;
-- $G A SG B ', s- :-d-fp- g .[j'a-yjjQ%}{h}h:7-- -
J uwtowwis%mmtmi%m I\.:d {* '..'- ( ic@ JE M.ii9 45nithitis c JhjB4!&*3Mi%ih
/ ~
x --:
- s JB 4% Mgi1%Me e i
/.
A;- -- 3 BsMhMS.Rbs?t!:vM ' N "A" l 4 : s ,F,M d.. S e.nen --
; 5 i. Jk:4b 4
/ y ,
.\. ..
l ll . \, / , <, .'
\
; / & *
.s
\
/ \
..- )
\ p ,
.- ~,
~ ~ .' ~ . . ,b'j s'
'y**,
_/ I R0P il
,7 3 e__
I "B" i i Figure 3.2-1 i LOCATION OF POWER RANGE EXCORE NUCLEAR INSTRUMENTATION J l
/T l V i 4
l Document No. 6370-ICE-3316 Revision 00 Page 50 of 253 l
93-R-2003-01
- 2. Wide Pange (Logarithmic) NIs are used in the High Logarithmic Power 7\
i Level Trip (Block 75). These channels use the middle detector of the three. Each channel also provides a block permissive using a NI drawer mounted bistable nominally set at IE-4% Rated Thermal Power (RTP), which permits bypassing of the CPC channel trip on DNBR-Low and LPD-High when below setpoint, and permits bypassing of the High Logarithmic Power channel trip when above setpoint. Upon failure of one ex-core detector, the High Linear Power, High Log Power, low DNBR, and High LPD trips must be trip channel bypassed. B. Analyzed Events
- 1. High Linear Power Trip This Trip is credited in the following events:
15.1.10.18 Excess Heat Removal from the Secondary System, Feedwater System Malfunction, Feedwater (FW) flow increase to 160% in both Steam Generators (SGs) due to FWCS Failure, as showe in Table 15.1.10-3A. p Since this increase is to both SGs, symmetry is not an Q issue, as the resulting power increase will be seen by all operable detectors. Primary protection provided by DNBR-Losv and LPD-High Trips, if required. Note: For the FW flow increase to one SG, which could cause symmetry concerm (Table 15.1.10-3B), power does not increase enough to generate a High Linear Power Trip. Nor da any of the other 15.1.10 events actuate this trip. Therefore, symmetry is not of concern, and the degree of redundancy is one with one High Linear Power trip channel permanently trip channel bypassed. 15.1.14.1.1 Steam Line Break Accident. The High Linear Power Level Trip is not credited in any of the Steam Line Break analyzed cases, except for the Full Load, Two Loop initial conditions, small break, without loss of AC power (Table 15.1.14-7, text in 15.1.14.2.2.5). 0 SAR section number. Document No. 6370-ICE-3316 Revision 00 Page 51 of 257
93-R-2003 This event is analyzed for post-trip return to power
/]
V concerns. The exact trip setpoint is irrelevant, as is precise trip timing. In fact, delaying the trip yields more conservative results, since delaying the trip causes more of the SG inventory to be removed prior to the trip. Hence post-trip cooldown is reduced, and it is the cooldown, when combined with the negative moderator j temperature coefficient, which yields the reactivity l excursion. Even if the setpoint were relevant, there is l only an insignificant power asymmetry for the analyzed small break case prior to the trip. Therefore, symmetry is not of concern, and the degree of redundancy is one l with one High Linear Power trip channel permanently trip channel bypassed. 15.1.20 CEA Ejection Event ! The CEA Ejection may credit the High Linear Power Level Trip. The Variable Over Power Trip (VOPT) feature of the Core Protection Calculators (CPCs) may also occur, but is not credited. Since the ejected CEA can be in any of several core locations, it must be assumed that with one NI channel bypassed and another failed, the two remaining operable channels are those with the worst case (least sensitive) response. This has been accounted for by adding a 10% power uncenainty on the assumed NI detector response in the accident analysis. This has been done for both the High Linear Power Trip, and for the CPC VOPT. To determine the magnitude of this uncenainty, several FLAIR test cases were performed using differing ejected CEA locations and initial conditions, while assuming only the " worst two" detectors are operable. The 10% bias conservatively accounts for all NI decalibrations encountered. Since the 10% uncenainty is included in the accident ) analysis, it need not be repeated in the trip setpoint analysis. By accounting for symmetry in this manner, the degree of redundancy is one with one High Linear i Power trip channel permanently trip channel bypassed. i O Document No. 6370-ICE-3316 Revision 00 Page 52 of 257
.. . . _ - _ _ _ _ - _ _ _ _ - _ _______x
93-R-2003:01
- 2. High Log Power Trip (M
This Trip is credited in the following event: 15.1.1 Uncontrolled CEA group withdrawal from subcritical ( < 1E-4 %) Symmetry is not an issue since each CEA group consists of CEAs symmetrically located with respect to the NI channels. Hence, all operable NI channels are capable of , responding equally. Note that the case of a single CEA withdrawal from suberitical is not specifically analyzed. However, the CPCs will provide trips on DNBR-Iow and LPD-High as soon as the CPC bypass is removed (power
> IE-4% RTP). These trips are the result of the Control Element Assembly Calculators (CEACs) generating very large penalty factors to the CPCs if an outward deviation of greater than 12 inches (analysis value) is detected.
Therefore, symmetry is not of concern for this event, Q and the degree of redundancy is one with one V Logarithmic Power Level-High trip channel permanently trip channel bypassed.
- 3. Local Power Density-High/DNBR-Iww The three vertically stacked detectors in each power range channel are processed by the Safety Channel signal processing drawer, and then sent to the CPCs as separate signals (upper, middle, and lower) for use in the DNBR-Low and LPD-High trips. The raw Ex-core signals are corrected for CEA shadowing, T, shadowing, and shape annealing in the CPCs, and then used to provide axial power distribution information to the DNBR and LPD calculations. They are also summed (averaged), corrected for CEA shadowing and T, Shadowing, and used as an input to the power select calculation, where the higher of the Thennal Power calculation or Ex-core power is used as the power input to the DNBR and LPD calculation.
The DNBR-Low and LPD-High trips are used as the primary protection for a variety of at power Anticipated Operational Occurrences (AOOs), as well as the SGTR. 'Ihey receive numerous inputs in addition to Ex-core power, as previously described. These trips are credited in the following events: Document No. 6370-ICE-3316 Revision 00 Page 53 of 257
93-R-2003-01 7,q 15.1.2 Single CEA Withdrawal from Critical The DNBR-Low and LPD-High trips provide protection for the single CEA withdmwal event. This event is not specifically analyzed in the SAR. In order to assure protection during this event, outward deviation penalty factors from the CEACs are large enough to assure a trip regardless of actual power level. The two redundant CEACs sense the position of al! 81 CEAs, and provide the outward deviation penalty factors - to all four CPC channels if any CEA in a subgroup deviates in an outward direction by greater than 9.7 inches. To account for uncertainties, the SAR analysis value is 12 inches. The magnitude of the penalty factor is large enough (8.0) to assure DNBR-Low and LPD-High trips actuate as soon as the deviation is detected without regard to power level. Therefore, symmetry is not of concern for this event, and the degree of mdundancy is one with one DNBR-Low or LPD-High trip channel permanently trip channel n bypassed. U 15.1.2.2 Uncontrolled Sequential Withdrawal from critical. During normal operation, the Shutdown CEAs must be fully withdrawn. Hence, Shutdown Group withdrawal is not of concern. Any insertion of these groups will produce a large radial peaking factor (8.0) from the target CEA position input to each CPC channel. Since the CPCs assume a minimum power level of 20% in both the DNBR-Low and LPD-High trips, a trip is assured, regardless of actual power level or distribution. The Shutdown CEAs must be fully withdrawn prior to exceeding IE-4% RTP, when the CPC Bypass is automatically removed. Regulating groups are sequentially withdrawn, and may, subject to Technical Specification (TS) insertion and sequencing constraints (LCO 3.1.3.6), be inserted to some extent. Hence it is possible for an uncontrolled sequential withdrawal of these groups to occur. The p) ( bounding cases in the SAR are the withdmwal from 1 % and 100% RTP. In the 100% power case, the DNBR-Iow or the Pressurizer Pressure-High trip provide Document No. 6370-ICE-3316 Revision 00 Page 54 of 257
93-R-2003-01 protection. For all events involving either groups or subgroups of CEAs, each CPC channel mceives separate ' " target" CEA position inputs from each subgroup. These target CEA positions are used to generate Radial Peaking Factors, group out of sequence, and subgroup deviation penalty factors in all four CPC channels, as well as Ex-core CEA shadowing correction factors. Since all four CPC channels are made aware of any group or subgroup related events, and any power distribution effects will be symmetrical with respect to all four Ex-core detectors, symmetry is not of concern in these events, and the degree of redundancy is one with - one DNBR-Low or LPD-High channel permanently trip channel bypassed. 15.1.3 CEA Misoperation-FLCEA Drop /Part Length CEA Drop For the CEA drop event, the CEAC inward deviation penalty factors which formerly provided DNBR-Low and LPD-High trips in the event of some dropped CEAs have been eliminated through software modifications, and trips on these events are no longer anticipated. To compensate, the COLSS DNBR Power Opemting Limit , (POL), TS 3.2.4, and the COLSS kW/ft POL (TS 3.2.1) maintain sufficient margin to assure that criteria will be met for single inward CEA deviations. These events now credit operator action to reduce power commencing within 15 minutes after the CEA drop, with a reduction by 20% within one hour, as required by Tecimical Specification, Reference Figure 3.1-1 A. Since no trip is required or anticipated, symmetry is not of concem for CEA drop events, and the degree of redundancy is one with one DNBR-Iow or LPD-High trip channel permanently trip channel bypassed. Document No. 6370-ICE-3316 Revision 00 Page 55 of 257
93-R-2003-01 k 15.1.4 Uncontrolled Boron Dilution (Critical Operation) The boron dilution event during critical operation (15.1.4.2.2.5) credits the DNBR-Low, LPD-High, and Pressurizer Pressure-High trips. When critical, all four RCPs must be operating, providing core-wide mixing. Hence, reactivity changes due to boron dilution do not pose symmetry concerns, and the degree of redundancy is one with one DNBR-Low or LPD-High trip channel permanently trip channel bypassed, i 15.1.5 Loss of Flow / Shaft Seizure. Both the loss of flow and the shaft seizure event rely on the DNBR-Low Trip. The RCP Speed input provides the trip whenever shaft speed decreases to 96.5% of nominal. Power is not a factor in this trip. Hence, symmetry is not of concern and the degree of redundancy is one with one DNBR-I.ow or LPD-High trip channel pennanently trip channel bypassed. O 15.1.9 Loss of Normal and Preferred Power to Station Auxiliaries The Low DNBR Trip b credited in this event, since a four pump loss of flow occurs. As in the loss of flow event, there are no symmetof concerns and the degree of redundancy is one with one DNBR-Low or LPD-High i trip channel permane9tly trip channel bypassed. 15.1.14 Major Secondary System Pipe Breaks 15.1.14.1.1 Main Steam Line Breaks Of the numerous Main Steam Line Breaks analyzed, the vast majority credit the Low Steam Generator Pressure Trip. In one case, the High Linear Power Trip is credited, as explained previously. In only two cases is the DNBR-low Trip credited. Both cases are for the full power, initial condition with loss of Offsite power. The first case (Table 15.1.14-12) is for the small break. The second case (Table 15.1.14-15) is for the SG nozzle break. It is the loss of power that forces an RCP coastdown, leading to the DNBR trip. Document No. 6370-ICE-3316 Revision 00 Page 56 of 257 L _ _ - - - - -- - - _ - _ - - - - - - - - _ _ ----__ - - - - _ - - _ - - - - - - - - _ _ _ _ _ - .
93-R-2003-02 The DNBR trip delay time (0.6 seconds) is consistent - with that of the other four pump loss of flow events (15.1.5). Since it is the loss of flow causing the trip, power distribution asymmetries are not a concern, and the degree of redundancy is one with one DNBR-Low or LPD-High trip channel pennanently trip channel bypassed. 15.1.1.18 Steam Generator Tube Rupture The DNBR-Iow Trip is credited in the SGTR with and without loss of power events. With power available, the pressure decrease is the major factor in the DNBR-Low Trip, as shown in Figure 15.1.18-2. There is only a negligible increase in reactor power, as shown in Figure ' 15.1.18-1. Power asymmetry is also negligible. The trip occurs at 342 seconds into the event. Even if there were a significant increase in Ex-Core power or power asymmetry associated with this event, the CPC primary calorimetric power input to the CPC power calculation,
, which is unaffected by asymmetries, would be adequate to detect such a slow transient.
In the case of a SGTR with a concurrent loss of offsite power, there will be a loss of flow, which results in a DNBR-Low trip at 0.75 seconds. Power increase is not a factor in this event, as shown in Figure 15.1.18-6. Thus, symmetry is not a concern in this event, and the degree of redundancy is one with one DNBR-Low or LPD-High trip channel permanently trip channel bypassed.
- 2. Narrow Range Pressurizer Pressure (Block 31)
A. Description The Narrow Range (1500-2500 psia) Pressurizer Pressure provides inputs to , the CPCs for DNER-Iow and LPD-High trips, and provides an input to the Pressurizer Pn:ssure-High Trip. Upon failure of a narrow range pressure transmitter, these trips must be trip channel bypassed. \ Document No. 6370-ICE-3316 Revision 00 Page 57 of 257
93-R-2003-01 There are four independent pressurizer pressure transmitters, one per PPS ( channel. There are no analyzed events which could cause asymmetric channel
'- response. Thus, symmetry is not of concern, and the degree of redundancy is one with one channel permanently trip channel bypassed.
B. Analyzed Events
- 1. Local Power Density-High/DNBR-Low Events crediting the DNBR-Low and LPD-High trips were listed above (Subsection 1.B.3 - the Ex-core Linear Power analysis).
- 2. Pressurizer Pressure-High The Pressurizer Pressure-High Trip was credited in the following events:
15.1.1 Uncontrolled CEA Withdrawal from Suberitical Condition 15.1.2 Uncontrolled CEA Withdrawal from Critical Conditions 15.1.4 Uncontrolled Baron Dilution 15.1.7 Loss of External Load / Turbine Trips 15.1.8 Loss of Normal Feedwater Flow 15.1.14.1.2 Feedwater Line Break
- 3. Core Outlet Temperature (TJ (Block 80)
A. Description Each CPC channel receives hot leg temperature from both hot legs, using separate transmitters on each leg. Thus, there are two tmnsmitters per CPC channel, or eight total. , 1 The CPCs provide DNBR-Low and LPD-High trips. Upcm4Atide of a hot leg transmitter, these trips must be trip channel bypassed. l I Since each CPC channel receives inputs from both hot legs, there are no I analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern, in these events, and the degree of redundancy is C one with one DNBR-Low or LPD-High trip channel pennanently trip channel bypassed. Document No. 6370-ICE-3316 Revision 00 Page 58 of 257 )
93-R-2003-01 B. Analyzed Events
- 1. Local Power Density-High/DNBR-Low Events crediting the DNBR-Low and LPD-High trips were listed above (Subsection 1.B.3 - the Ex-core Linear Power analysis).
- 4. Core Inlet Temperature (Tw u) (Block 82)
A. Description Each CPC channel receives cold leg temperature from diagonally opposite cold legs, using separate transmitters on each leg. Thus, there are two transmitters per CPC channel, or eight total. The CPCs provide DNBR-Low and LPD-High trips. Upon failure of a cold leg transmitter, these trips must be trip channel bypassed. Since each CPC channel receives inputs from both loops, there are no analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern, in these events, and the degree of redundancy it one with one DNBR-Low or LPD-High trip channel permanently trip channel ) bypassed. j O B. Analyzed Events l { l 1. Iecal Power Density-High/DNBR-Low l l Events crediting the DNBR-Low and LPD-High trips were listed above l (Subsection 1.B.3 - the Ex-core Linear Power analysis). l i
- 2. Asymmetric Steam Generator Protection l
The Asymmetric Steam Generator Transient (ASGT) Trip provides protection for the instantaneous closure of a MSIV. It is accomplished 1 l within the CPC channels by comparing compensated cold leg temperatures from the diagonally opposite transmitter sets to a power-dependent setpoint. An ASGT Trip condition is manifested by a CPC auxiliary trip, which opens the DNBR and LPD trip contacts. Closum j of a MSIV affects both cold legs associated with that loop. Hence, j symmetry is not of concern. l O l Document No. 6370-ICE-3316 Revision 00 Page 59 of 257
93-R-2003-01
- 5. Reactor Coolant Pump Speed (Block 84)
O A. Description Each CPC channel receives reactor coolant pump speed from all four RCPs, using one of four separate transmitters on each RCP. Thus, there are four tmnsmitters per CPC channel, or sixteen total. The CPCs provide DNBR-Low and LPD-High trips. Upon failure of an RCP - Speed Transmitter, these trips must be trip channel bypassed. Since each CPC channel receives inputs from all four RCPs, there are no analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern in these events, and the degree of redundancy is one with one DNBR-Low or LPD-High trip channel permanently trip channel bypassed. B. Anahved Events
- 1. Local Power Density-High/DNBR-Low Events crediting the DNBR-Low and LPD-High trips were listed above (Subsection 1.B.3 - the Ex-core Linear Power analysis).
- 6. Target CEA Position (Block 87)
A. Descriotion Each CPC channel receives CEA Position from all CEAs in one quarter of the core (20 total), one from each subgroup of CEAs. Each CPC channel monitors a different quadrant, hence each of the four CEAs in a CEA subgroup is " targeted" to a different CPC channel. The CPC interprets this-input as CEA subgroup position. Since the subgroups are arranged into groups, the CPCs use this target CEA position to generate: Radial Peaking Factors (RPF), using a lookup table based on CEA group insenion into the core. Group Out Of Sequence (OOS) penalty factors, if CEA groups are not sequenced in the proper order. These are large (8.0) and assure CPC trips for OOS conditions. l Subgroup Deviation Penalty Factors, if the subgroups making up a l group are not properly aligned. These are large (8.0), and assure a trip ! for subgroup deviation conditions. O Document No. 6370-ICE-3316 Revision 00 Page 60 of 257
93-R-2003-01 Note that the target CEA positions are not used to detect individual deviations within a subgroup, since each CPC cnannel does not receive the position of the other three CEAs in each subgroup. The CEACs, addressed in the next section, do receive CEA position input from all CEAs, and are responsible for providing individual CEA deviation protection, if required. Upon the failure of a target CEA Reed Switch Position Transmitter (RSN) to a CPC, the CPC may provide a High-Local Power Density (LPD) and low-Departure from Nucleate Boiling Ratio (DNBR) trip input signal to the respective PPS protective channel. The affected PPS trip pammeters must be placed in Trip Channel Bypass. Although each CPC channel receives only one CEA position from each subgroup, this is adequate to detect nonnal RPFs, groups OOS, and subgroup deviations. There are no analyzed events requiring target CEA position which could cause asymmetric channel response. Thus, symmetry is not of concem, and the degree of redundancy is one with one channel permanently trip channel bypassed. B. Analyzed Events
- 1. Local Power Density-High/DNBR-Low Events crediting the DNBR-Low and LPD-High trips were listed above (Subsection 1.B.3 - the Ex-core Linear Power analysis).
- 7. Non-target CEA Position (Blocks 88,149)
A. Description Each of the two CEACs receives CEA position indication from a sepamte Reed Switch Position Transmitter (RSM) on each CEA. The two CEACs thus redundantly monitor CEA position on all 81 CEAs. Each CEAC ensures that the CEAs in a subgroup are properly aligned. If a deviation is detected, each CEAC channel may transmit DNBR and LPD penalty factors to all four CPCs, if the deviation magnitude, direction, or type (e.g., multiple deviations in a subgroup) indicates the need for conservative adjustment to the CPC DNBR and LPD calculations. Each CPC channel selects the higher of the penalty factors from the CEACs, so that no . single CEAC failure will prevent the four CPC channels from receiving CEAC penalty factors. 1 O Document No. 6370-ICE-3316 Revision 00 Page 61 of 257
93-R-2003-01 Events crediting the DNBR-Low and LPD-High trips were listed previously (Subsection 1.B.3 - the Ex-core Linear Power analysis). They include outward CEA deviations in a subgroup (SAR 15.1.2). The CEACs were previously credited in the CEA misoperation,-FLCEA Drop /Part length CEA Drop event (SAR 15.1.3) Both of these events were described in the Subsection 1.B.3. The CEACs are not part of the indefinite bypass analysis, inasmuch as the CEAC actions specified in TS Table 3.3-1 are unrelated to and unaffected by the trip channel bypassing of any CPC channel. There are no provisions to trip channel bypass a CEAC, although a software addressable constant exists which permits the operator to declare failed CEAC(s) inoperable (CEANOP, Point ID 063). Use of the CEANOP addressable constant is not changed by this analysis, and is not considered trip channel bypassing. Since there am two redundant CEACs, each monitoring a different RSPT on each CEA, the degree of redundancy in the CEAC/CPC interface is one, and is unaffected by trip channel bypassing of any RPS channel. , Failure of more than three CEA position inputs (RSPT) to a CEAC will render the CEAC channel inoperable, and may also render one or more CPC channels inoperable, if the failed CEA RSPT is also targeted to a CPC. In this case, Actions for one CEAC inoperable (Technical Specification Table 3.3-1, Action 5), and for one CPC Channel inoperable (Technical Specification Table 3.3-1 Action 2) are entered independently. The CEAC Action (Action 2) permits continued operation for up to 7 days, subject to CEA alignment verification every 4 hours. This Action is not affected by this analysis, and is consistent with other indermite bypass plants. Action 2 permits operation for up to 48 hours with one CPC (DNBR-Low /LPD-High) channel in bypass or trip. Subsequent operation is allowed, providing the failed CPC channel is placed in trip. Modification of this Action to allow extended operation in bypass is the subject of this analysis. When in bypass per Action 2, and with one CEAC inoperable per Action 5, the PPS exhibits a degree of redundancy of one, r Document No. 6370-ICE-3316 Revision 00 Page 62 of 257
93-R-2003-01
- 8. Wide Range (0-3000 psia) Pressurizer Pressure (Block 61)
A. Description The Wide Range Pressurizer Pressure is used as an input to Pressurizer l Pressure-Low trip, the SIAS, the CCAS, and the SIAS enabled CSAS. The l SIAS, CCAS, CSAS via SIAS and Pressurizer Pressure-Low trip share the ! same bistable, hence they share the same setpoint and occur simultaneously. 1 One trip channel bypass pushbutton also bypasses these functions in the ; affected channel. There are four independent wide range pressurizer pressure transmitters, one per PPS channel. There are no analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern, and the degree of redundancy is one with one Pressurizer Pressure-Iow channel permanently trip channel bypassed. B. Analyzed Events The Wide Range Pressurizer Pressure trip is credited in the following events: 15.1.10.1.2 Excess Heat Removal Due to Main Steam System Valve Malfunction 15.1.13 Loss of Coolant Accident 15.1.14 Major Secondary System Pipe Breaks with or without a concurrent Loss of AC Power 15.1.18 Steam Generator Tube Rupture 15.1.20 CEA Ejection
- 9. Steam Generator A and B Levels (Narrow Range)
A. Description There are four separate Narrow Range Steam Generator level transmitters per SG (Blocks 51 and 55). They are used as inputs to the SG-A Level-Low trip, the SG-B I2 vel-Low trip, the SG-A Level-High trip and the SG-B Level-High Trip. The SG-A and SG-B Ievel Imw trip bistables are also used, respectively, as inputs to the EFAS 1 and EFAS 2 Logic. m Therefore, on failure of the SG-A Level transmitter or associated circuitry, the SG-A Ixvel-High, the SG-A level-Low, and the EFAS 1 trips must be trip channel bypassed. SG-B I2 vel transmitter failures similarly require trip Document No. 6370-ICE-3316 Revision 00 Page 63 of 257
channel bypassing of the SG-B Level- High, the SG-B Level-Low, and the EFAS 2 functions. There are no analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern, and the degree of redundancy is one with any one of the four channels of the above trip functions permanently trip channel bypassed. B. Analyzed Events
- 1. The SG Level-High Trips are not credited in any analyzed event. The SG Level-Low Trips and EFAS actuation are credited in the following events:
15.1.2 Uncontrolled CEA Withdrawal from Critical Conditions 15.1.8 Loss of Normal Feedwater Flow 15.1.9 Loss of Nonnal and Preferred Power to Station Auxiliaries 15.1.10.1.2 Excess Heat Removal Due to Main Steam System Valve Malfunction 15.1.14 Major Secondary System Pipe Breaks with or without a concurrent Loss of AC Power
- 10. Steam Generator A and B Pressures (Blocks 42 and 27)
A. Description There are four separate Narrow Range Steam Generator pressure transmitters per SG. They are used as inputs to the SG-A Pressure-Low trip and the SG-B Pressure-Low trip. The SG-A and SG-B Pressure signals are also used in the SG-delta P bistables to generate SG rupture signals as inhibits to the EFAS 1 and EFAS 2 logic. The SG Pressure-Low trip bistable trips the reactor and provide an MSIS, hence both the SG Pressure-Low Reactor Trip and the MSIS are trip channel bypassed by the same bypass pushbutton. Therefore, on failure of the SG-A Pressure transmitter or associated circuitry, the SG-A Pressure-Low trip bistable and the EFAS 1 and EFAS 2 SG AP ' bistables must be trip channel bypassed. SG-B Pressure transmitter failures similarly require trip channel bypassing of the SG-B Pressure-Low trip bistable
- and both SG AP bistables.
Document .No. 6370-ICE-3316 Revision 00 Page 64 of 257
93-R-2003-01 There are no analyzed events which could cause asymmetric channel response. O Thus, symmetry is not of concern, and the degree of redundancy is one with V any one of the four channels of the above trip channels permanently trip channel bypassed. B. Analyzed Events
- 1. SG Pressure-Low /MSIS The SG Pressure-Low Trip and MSIS are credited in the following events:
15.1.10.1.2 Excess Heat Removal Due to Main Steam System Valve Malfunction 15.1.14 Major Secondary System Pipe Breaks with or without a concurrent Loss of AC Power
- 2. EFAS Emergency Feedwater Actuation is credited in the following events:
15.1.2 Uncontrolled CEA Withdrawal from Critical Conditions 15.1.8 Loss of Normal Feedwater Flow 15.1.9 Loss of All Normal and Preferred Power to Station Auxiliaries 15.1.14 Major Secondary System Pipe Breaks with or without a concurrent Loss of AC Power
- 11. Containment Pressure Used in RPS, SIAS, CIAS, CCAS, SIAS Enable of CSAS, and Containment Pressure High-High input to CSAS (Block 6)
A. Descriptiom There are four separate Narrow Range Containment Pressure Transmitters used to trip the reactor and initiate the CCAS, SIAS, and CIAS. These are the same transmitters used in the Containment Pressure High-High input to the CSAS logic, which is addressed in the next section. These transmitters also serve to enable the CSAS, via the SIAS enable to CSAS logic. Although the same transmitter is used to trip the RPS and initiate SIAS, CCAS, CIAS, and in the SIAS enable of CSAS, separate bistables are used for the RPS and ESF functions. A third bistable, with a different serpoint, is used for the Containment Pressure Hi-Hi input to CSAS. Document No. 6370-ICE-3316 Revision 00 Page 65 of 257
93-R-2003-01 Therefore, on failure of the Containment Pressure Transmitter, the (Q V Containment Pressure-High (RPS), Containment Pressure-High (ESF), and Containment Pressure High-High (CSAS) functions must be trip channel bypassed. There are no analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern, and the degree of redundancy is one with any one of the four of the above channels permanently trip channel bypassed. B. Analyzed Events
- 1. The Containment Pressure-High reactor trip aids the ESFAS during the accidents for which the SIAS, CCAS, or CIAS are credited. Events crediting these ESFAS functions include:
15.1.13 LOCA 15.1.14 Major Secondary System Pipe Breaks with or without a concurrent Imss of AC Power
- 12. Containment Pressure High-High Used in CSAS (Block 6, (formerly 221))
A. Description The four Containment Pressure Transmitters used to generate the Containment Pressure High-High input to the CSAS logic are the same tmnsmitters used in the Containment Pressure High input to the RPS, SIAS, CIAS, CCAS and SIAS enable to the CSAS logic, described above. On failure of the Containment Pressure Tmnsmitter, the Containment Pressure High (RPS), Containment Pressure High (ESFAS), and the Containment Pressure High-High function must be trip channel bypassed. There are no analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern, and the degree of redundancy is one with any one of the four Containment Pressure High-High channels permanently trip channel bypassed. B. Analyzed Events
- 1. The CSAS is credited in the following events:
15.1.13 LOCA g 15.1.14 Major Secondary System Pipe Breaks with or without a t concurrent Loss of AC Power Document No. 6370-ICE-3316 Revision 00 Page 66 of 257
93-R.-2003-01
- 13. Refueling Water Tank Level (Block 1)
A. Description There are four separate Refueling Water Tank Level transmitters used to generate the RWT I.evel-Low input to the RAS Logic. The RAS is used only during LOCA events. On failure of the RWT Transmitter, only the RWT Level-Low function must be trip channel bypassed. There are no analyzed events which could cause asymmetric channel response. Thus, symmetry is not of concern, and the degree of mdundancy is one with any one of the four RWT level-Low trip channels permanently trip channel bypassed. B. Analyzed Events
- 1. The RAS is credited only in Section 15.1.13, LOCA.
O l l l O l i Document No. 6370-ICE-3316 Revision 00 Page 67 of 257 j
93-R-2003-01 3.2.2 CEA Position Cable Separation The position of each CEA is an input to the RPS. These positions are measured by means of two reed switch assemblies on each CEA. The two reed switch assemblies and the associated cables of each CEA are physically and electrically isolated from each other. Each reed switch position cable is enclosed in a flexible stainless steel sheath between the CEA and the connector bulkhead. The CEA Reed Switch Position Transmitter Assemblies (RSPT) contain circuits which provide analog CEA position infonnation to the Core Protection Calculators (CPCs) and the CEA Calculators (CEACs). The RSPTs also contain three discrete CEA position limit switches, which provide signals (contact closure) to the Control Element Drive Mechanism Contml System (CEDMCS). The discrete CEA position limit switches provide information that the CEA has reached its Upper Electrical Limit of Trave 1 (UEL), its Lower Electrical Limit of Travel (LEL), or is fully inserted to the Dropped Rod (DR) position. The three, non-Class IE, CEA reed switch contact position limit switches are- housed within the same RSPT assembly along with the Class 1E analog CEA position signals. However, the circuits are physically separated utilizing separate power supplies, reed switches, and wiring. Due to physical constraints in the reactor vessel head area, both the analog and contact closure signals are transmitted in separate conductors within the same cable assembly from the reactor vessel head to a point O outside of containment. The analog signal position information cable is then separated from the safety-related cable and routed to the CPCs. The CEA reed switch position limit switch signal cables are routed to the CEDMCS system. The cables which provide the discrete position information signals originate from either Channel C or D. A total of 61 cables originate from Channel C. The remaining 20 cables originate from Channel D. (These two groups of cables are maintained separated and are routed in separate raceways. Power and control cables are excluded from these raceways.) The cabling then enters the CEDMCS in an area which is separated from the power section of the CEDMCS cabinet. The concern for the non-Class lE cables running together with Class IE cables was formalized as Position 5 in the original CPC Licensing Safety Evaluation Report.r2aj The method of cabling of the RSPTs is considered acceptable due to three major design provisions: A. The CEDMCS is decoupled from the reed switch cabling by means of relay isolation of the limit contacts and physical separation of the power portion of the CEDMCS from the limit switch interface. B. The interconnecting cabling is routed separately from power and control cables. O Document No. 6370-ICE-3316 Revision 00 Page 68 of 257
93-R-2003-01 C. The CPC system data acquisition equipment is designed to reject noise that might be coupled into signal lines. A noise immunity qualification susceptibility test on the single channel CPC system was performed. This test determined the susceptibility of the system to EMI, A graph of susceptibility field strengths and corresponding frequencies was established as a baseline. The NRC staff reviewed the testi pmcedures, and test report and concluded that the noise immunity tests wem an acceptable subject to satisfy completion of EMI measurements. During startup, the actual EMI on-site levels and frequencies were measured and confirmed that these measurements fell within the acceptable range of the baseline graph. (G) i l i i Safety Evaluation Report, NUREG-0308, Supplement No. 2, Docket No. 50-368, ; September 1978, Core Protection Calculator System Positions. l 1 Document No. 6370-ICE-3316 Revision 00 Page 69 of 257 l
93 R-2003-01 3.2.3 CEA Position Signal Separation The following analysis describes the CPC/CEAC arrangement and how the channel separation within Control Element Assembly (CEA) position signals and circuits is maintained, and the effects of a single failure or a Control Element Assembly Calculator (CEAC) failure. There are 81 CEAs in the core. With the exception of the center CEA, the CEAs are assigned symmetrically into 4 quadrants and 20 subgroups. The center CEA is arbitrarily assigned to one of the subgroups. All the CEAs within a subgroup are controlled and moved together. There are two Reed Switch Position Transmitters associated with each CEA; see page 72r20 Each CPC only monitors one quadrant of the CEA positions (20 target CEAs) and assumes the CEAs in the other quadrants are at the same height as the target CEAs. All the CEA positions are monitored by each CEAC. The CEAC performs all the CEA position-related calculations and sends the results to all four CPCs as a 16-bit digital signal every 100 milliseconds. If any CEA deviation is greater than a deadband (9.7 inches), appropriate local power density penalty factor (PForn) and Departure from Nucleate Boiling Ratio penalty factor (PFona) are encoded in the 16-bit penalty factor word. The penalty factors are determined based on the magnitude of deviation, the type of deviation (withdrawn or inward) and the CEA configuration when the deviation is detected. The penalty factor values are determined by safety analysis to ensure the LPD and DNBR calculations in the CPC are conservative for the CEA misalignment situation. Two separate CEACs provide redundant monitoring of CEA subgroup deviations. Each O, CEAC provides separate CEA deviation alarm to the annunciator panel in the control room. CEAC #1 is physically located in CPC Channel B cabinet; see page 73r22j. The target CEA position signals to CPC Channel A cabinet, which are also distributed to CEAC #1, are electrically isolated by fiber optic devices to maintain the channel separation. Similarly, CEAC #2 is physically located in CPC Channel C cabinet. The target CEA position signals to CPC Channel D cabinet, which are also distributed to CEAC #2, are also electrically isolated by fiber optic devices to maintain the channel separation. The data links between the CEACs and the CPCs are fiber optic cables; see pages 74 & 75t231 No failure in one CPC channel can prevent another channel from tripping, when reqcired, via the CEAC. If both CEACs are operable and the penalty factors from both CEACs exceed a minimum value, the larger of two penalty factors is used by the CPCs. If both CEACs are operable and only one CEAC transmits penalty factors above a threshold (the least significant bit of the PF ten and PFana), a time delay of 20 seconds is introduced prior to applying a penalty factor. This time delay reduces inadvertent reactor trips due to a hardware failure in the CEAC or CEA position sensors. The duration for this time delay is determined by safety analysis. O Document No. 6370-ICE-3316 Revision 00 Page 70 of 257
93-R-2003-01 The plant can operate with one or both CEACs out-of-service (CEAmop). In either g case, the applicable addressable constant in the CPC's should be changed to declare which CEAC is out-of-service. The CPC's then invoke the inoperable penalty factor. Restrictions on operating with one or both CEACs out-of-service are covered by existing Technical Specifications Table 3.3-1 Action Statements as follows. ACTION 5 - a. With one CEAC inoperable, operation may continue for up to 7 days provided that at least once per 4 hours, each CEA is verified to be within 7 inches (indicated position) of all other CEAs in its group. After 7 days, operation may continue provided that ACTION 5.b is met. ACTION 5 - b. With both CEACs inoperable, operation may continue provided that:
- 1. Within I hour the margin required by Specification 3.2.4.b (COLSS in service) or 3.2.4.d (COLSS out of service) is satisfied.
- 2. Within 4 hours:
a) All full length and part length CEA groups are withdrawn to and subsequently maintained at the /^ " Full Out" position, except during surveillance \ testing pursuant to the requirements of 5pecification 4.1.3.1.2 or for control when CEA group 6 may be insened no further than 127.5 inches withdrawn. b) The "RSPT/CEAC Inoperable" addressable constant in the CPCs is set to both CEACs inoperable. c) The Control Element Drive Mechanism Control System (CEDMCS) is placed in and subsequently maintained in the "OFF" mode except during CEA motion permitted by a) above, when the CEDMCS may be operated in either the." Manual Group" or " Manual Individual" mode.
- 3. At least once per 4 hours, all full length and part length CEAs are verified fully withdrawn, except as permitted by 2. a) above, then verify at least once per 4 hours that the insened CEAs are aligned within 7 inches (indicated position) of all other CEAs in their group.
A V Document No. 6370-ICE-3316 Revision 00 Page 71 of 257
O O O C R c
~
n REED REED SWITCH SWITCH Z
.O 3 POSITION TR ANSMIT TER 81 CE AS POSITION TRANSMIT TER 3
p@K NO. 1 NO. 2 o m !
! 20 CEAS 20 CEAS a 3 20 CEAS 20 CEAS 41 CE AS 41 CEAS
() u y h*
'A
- l l' ' l ISOLATION ISOLATION AMPLIFIER CEA CEA AMPLIFIER n CALCULATOR (FIBER Q (FIDER CALCULATOR T-OPTICI NO. I NO. 2 OPTICI N DEvikTION DEvikTION 4 FIBER OPTIC 4 FIBER OPTIC Q
W Sgn ISOLATED ISOLATED DATA LINKS 5' Dd DAT A LINKS o S9 eg i I CORE CORE 3 CORE CORE PROTECTION - PROTECTION PROTECTION 9 PROTECTION CALCULATOR CALCULATOR ' CALCULATOR CALCULATOR CHANNEL B / CHANNEL C CHANNEL 0 CHANNEL A FIBER .
-* OPTIC 5 < [ FIBER OPTIC ISOLATED ISOLATED OATA rtBER OPTIC ISOLATED i to r=
LINK OATA LINA n
$ DAT A LINK E da-C 5 O m $ OPERATORS OPERATORS MODULE OPERATORS MODULE OPERATORS HOOULE o O T - Ni MODULE b
rj s .5
.I S 1
o, f n u .
O O O P s x i l I i I O 3 l CHANNEL A l CHANNEL B l CHANNEL C 1 CHANNEL 0 l R y i I PROCESS CEA I PROCESS CEA I PROCESS CEA I E g en l PROCESS CEA l l l l SENSORS SENSORS ; SENSORS SENSORS g SENSORS SENSORS l SENSORS SENSORS g 7 g i w 9 m E l I SIGNAL
, l I
SIGNAL l I SIGNAL l I SIGNAL
. l I
g PROCESSING l PROCES$1NG l PROCESSING PROCESSING @ l t 1 1 1 O i i - - i - - i i E I r y I I I p I i l i , , I I I I i i I l CEA l CEA l l l
; g CALCULATOR g CALCULATOR y ;
% N I i } l
}
l l S. -4 I i -
, 1 -
, i I y.
g
$ l l ISOLATED CEA OEv!ATION TO I
l ISOLATED CEA OEv!ATION TO i l i l n l l CPC'S CPC'S g g ; g g 7 i I I I I l CORE PROTEC TION l CORE PROTEtit0N l CORE PROTECTION l CORE PROTECTION l CALCULATOR g CALCULATOR ; CALCULATOR g CALCULATOR g l d i l ! l " ' l 3 I CHANNEL I l CHANNEL l l CHANNEL I l CHANNEL l l l TRIP TO TRIP TO TR{P TO TRIP TO g
; y g g RPS LOGIC RPS LOGIC RPS LOGIC RPS LOGIC g g g i I TO CPC OR CEAC I TO CPC OR CEAC I I e
d I. 1 -
^
1 I g hl I f f f f I f f f f I l [% l' 5 N I 2 m $l TEST OPERATOR N000LE OPERATOR TEST l OPERATOR N00utE TEST g OPERATOR N000LE TEST CART O y CART MODULE CART CART d YR , I i i i i a w E 6 $ 0 ls w
t L i A = CADtE P/N NEO 040 SS27 030 0 - CAOLE P/M NEO 040 S528-030 RSPTS Q ^ l DTSCA I BTSCA l OFSCA l BTSCA l BTSCA CPOsA O f d 6RR8 [68tft9 [6RRtI {S Rft_12 pgg, o l DTSCA l Jk JL Jk_1 JL A ([6RR13 J g k C l 6RRt l l 6RR2 DTSCA ]I 6RR3 l l BTSCA l1.6PR4 ll 6ftRSl lI BTSCA
] l OfSCA GRR6 lllllSRR7 OTSCA l l l OTSCA l 1
1 6RF5 FROM s, , . l ... . . . l- L- 1 --l . .. .. .... l [. . . . . . . . . . ._.. .. C,o,A D ! SC% SiO. COND SIGM SCHAL SCHAL 5BCNAa. $sGM SsCte&L Cono COND StCHAG. SONAL $3CNAL $$ Gnat. SOM - NEC. 4 l STSCA l CNAS$t$ COND COMO CMC Cono CONO Cote COMO CowO CONO CCreo 2 g '. LOT e6 MFI SLOT 19 SLOT 84 SLOT 83 SLOT 12 SLOT St SLOT to SLOT e SLOT S SLOT F Stot e SLOT S 6RFA
/ l 6RRI S l *O A
- =:: :===:: .. . . .::=: -
- . :=:: . ::=: :=:. .. . . :=::. =: : p. - :::=:.: p . .. . : :::- .. .,
B B D * ' e W _ _ _. _D _ _D _ _D_ l8 l0 0 0 0 i y o.mr= .,. - oo ==ac m ec I
- oa .- coa == .N=oc -= == .N=oa == CpC e Z s"iO'. ";~.N' sT3 aT'. =7. uT!, s%"h .Th sZ. .%"'s s%"h uTl, m7l. BTSCAS BLR2 5 w C,t stOT 2s 8 o
m i I I I I I I l I I i l I i t.eh. m .t .. .. y , I TEST CART CoNCuRRENr CouPuTER ffo aa'^ ou5 t s DATA LINES CPU CHAS$ts " Cas U161/O g CABLE - Cnr omx Sar30 - CONN. CHANNEL ADORESS CONTRO LLER . I 3
,U REST l }. ,
paa otvet e- -o C&MNNR UNES CHASSIS i o .
. CPU / ,jg aoonE5s LaGC - SELCCT CONTROL LINES 5RF1 IN4T TEST -
MEMORY CONN. StJ2A : e !. .. O i _ l TEST a on l- eC t h ENAOLE l l { l OfSCA l l OTSCA l STSCA l I I eRRt
- I l SMRIS I: l ORR e e i l 81SCA l r
TCOT9 I MPC/ Macno j I 6MRt ? I
- l. LSU LOADER
- TA.
2k ~ * * * * * * #
.. .. j._ . . . . - . . . . .
CC"*" l l l E PPS CEAC CONN. PANEL WOT Kf RELAY I " T. tor
'$[
ou O stof a O'LCAL SLOT 2 g
. a s 1 s i s > a i (D
SRRtA ' p- -I 3 ' ' 3, a g Q-l l
, reOn uomAE/ 2 i .
" ; M I/O -
n.r4 sus
=a 1s OATA LINES i O
.e up> *""' i O to we m .c caste CONN.
- l CtwHNEL soonEsS U161/O j w CEAC r/o UNES CONTROLLER ! t 4
M EM*"C' 3 TERum. Aioa
%os __*?oo',"c'" -
c,'177,' CONTROL uNES CHASSIS $. A CPC U' "h' E LL M $*i LL W U* 2 OOARD l g SRF2 O MODEM l* __s PANEL
]
vs CPC O CPL C CPC B CPC A CAPS CHANNEL B CEAC #1 BLOCK DIAGRAM FIGURE e-5 t>>
. . ~. . . .. - _ _ . - . , . . ~ ,
v O C A == CAOt.E P/N NEO 040-SS27-030 O O - CABLE P/M NEQ 040 SS28-030 RSPTs g OfSCA l DTSCA l OfSCA l l BTSCA l l OfSCA CPCsA 3 BRR2 [8RR3 {SRR4 p j Of SCA l OfSCA BTSCA A{ Ak Ak h1 al (A NeRR5J L(aa*8N I Y O ll BTSCA 8RR8 lll GRR9] l BTSCAl l l 8RR10 l OTSCA i a LORRt l g 6RR ]12 l ORRt3 g ll ll BTSCA ORR7 l l
^
l i BLFS FRou i 3 ri i i i i i r/o cPC D
.. [ .. _ _ . . -- 1 L _
1 l . . _. . . . . . . _ . .. . . . . cPotA
$80Haa. AL SIGNAL SICNAL AL $CNAL SICHAL O coNo 530. CO,ND S8oM,e co cONO co o SDCN,e co AL $CMAL $tGNat SIGheA& $sCNAL - REC. 4 I erscA l stof 16 cyAss 5 coNo coNo co
$4GNc co~o como co,e coNo 2 / I saR e s i gggg Stot e SLOT s SLOT F Stot e StoT S SLOT to SLOT 1$ SLOT se SLOT 83 SLOT 12 SLOT 11 ;
O BRFA w .::=.c==:::::===. . . . . . . . . . . . . . . :::= ==.: .=:: . ::::=.-: ..- -- ::=:: .. :=::::: - . ::= Q A B B B B B g - _ _ _B _ _B _ _B B B B * * ' worv4L MKcQ
'")
I n eut A/6 co waarre Me* leg suruv secur MEAS.oC eurut MMcC swrut ANatoG oaeur A06ht oC MutoC eepur BNat oC AHAt oC sanvr AseKoo ANatc0 Cpc C M CAL m stor e sun 7 stor a stor e stos so stos i n stos et a=Pur stor sa novse e.eut stor is not is w ur nos er s eut stor is f,TSCAS BLR2-5 stot 2 6 w I I T__ I T__ i I I I l l- l l l
& i
- i s .. .
g TEsi CART CoNCunRENT couPtiTER ! g/o - oAtA aus 15 DATA LINES cpu cNAssis E*.f. l
# 38 caste C0""-
U161/O : { cni otsx _ l . - cNANNel AconEss CONTROLLER
< l a
- I I
l- PAR OtW t CHAseeft UNEs CHASSIS
!c. TEST CPU / - constameco O MT l
MEu m
! y0 enug.
Acoatss toce - sn ECT CONTROL uMES 7RF1 p _
"ILf 2A e . . .
1 TEST ~ ENAFILE
! **'s sus F l l +
BISCA l l BTSCA l l BISCA l l BTSCA MPC/ nancno RR14 I l ERR 13 l l BRRIG l l SRR 9 7 l g reais tsu toAorR . Tae
+SVDC
..- . . .'g
.3 cowsotztit 1
-- l CEAC WOT ou d PPS CONN. Kt f *s*AT7
. tor e Sto' ' not a oat cat stot ze PANEL RELAY j ' .
g i : a i r i s a s (D 7RR1A + - * = -J 3 8 3 ' a g 'y l l
,,, Teos weput t/ 2 e
*t ***
ontA teus N gn nec. a 16 OATA LINES I O i I/O -
~' .O li tepJ C^ ELE -
U 16.1/O y - C ""- ~ l cnAnnEi. AcoREss w ecAc r/o LeNES CONTROLLER I i
- 0 ---
E "*$(("" TERum. ArOa M j$ *7o"o,T' - M,' ' CONTROL UNEs CHASSIS l $ Lt M t re Ei-il EM us tr M oOARo , 7RF2 w PANEL CPC 0 CPC C CF 0 59 CPC A CAPS . CHANNEL C CEAC ;#2 BLOCK DIAGRAM FIGURE e-a
93-R-2003:01 3.2.4 Process Signals Used in Multiple Protective Functions The following analysis describes those process signals that are associated with multiple PPS trip functions and the inter-dependent actions required when one of these parameters is placed in trip channel bypass. As shown in FMEA Diagram .No.1, some process inputs are used in multiple PPS functions. Each PPS function operates on a two-out-of-four coincidence of like initiating signals from four separate protective measurement channels. Some - Engineering Safety Features (ESP) actuate only when more than one of the initiating conditions are met (e.g., Containment Spray Actuation Signal (CSAS) will actuate when both (Low Pressurizer Pressure or High Containment Pressure), and High High Containment Pressure exceed their setpoints]. Discussion of these inputs and their design basis requirements are provided here:
- 1. Excore Flux Signals These three signals are inputs to:
- a. High Linear Power Level Trip
- b. High Logarithmic Power level Trip
- c. Core Protection Calculator (CPC) DNBR and LPD Trips The High Linear Power Level trip is provided to trip the reactor when the sum v of the three linear subchannel flux signals reaches a preset value. The design basis of the High Linear Power Level trip is to provide a reactor trip and assist the ESF system in the event of an injected CEA accident, Steam Line Break Accident, and to limit the maximum steady state power level in addition to the DNBR and high level power density trips.
The High Logarithmic Power trip is based on the excore signal from the middle fission chamber through the preamplifier and logarithmic circuit. The design basis of the High Logarithmic Power 12 vel trip is to ensure the integrity of the fuel cladding and reactor coolant pressure boundary in the event of unplanned criticality from a shutdown condition, resulting from either dilution of soluble boron concentration or withdrawal of CEAs. Automatic action will be initiated if CEAs are withdmwn. An alarm is provided to alert the operator to take appropriate action in the event of an unplanned criticality when all CEAs are inserted. The CPC calculates the normalized core average axial power distribution based on the three excore flux signals per channel and corrected for shape annealing, temperature shadowing and rod shadowing. The design basis of the CPC DNBR and LPD trips is to assure that the specified acceptable fuel design limits on departure from nucleate boiling and centerline fuel nesting are not exceeded during Anticipated Operational Occurrences (AOO) and to assist the ESF system in limiting the consequences of Reactor Coolant Pump Shaft O- Seizure and Steam Generator Tube Rupture events. Document No. 6370-ICE-3316 Revision 00 Page 76 of 257
93-R-2003-01
- 2. Narrow Range Pressurizer Pressure Signal The Narrow Range Pressurizer Pressure Signal is input to:
- a. High Pressurizer Pressure Trip
- b. CPC Auxiliary Trip The PPS High Pressurizer Pressure trip is provided to trip the reactor when the reactor coolant pressure exceeds the setpoint. The design basis for the High Pressurizer Pressure trip is to help ensure the integrity of the RCS boundary for the loss of Load event, CEA withdmwn event, Boron Dilution event, Loss of Condenser Vacuum event, Loss of Feedwater Flow event, Feedwater Line Break event, and Small Break LOCA event.
The CPC also mceives this signal and generates trips on high and low Pressurizer Pressure when pressure is outside the CPC analysis range.
- 3. Wide Range Pressurizer Pressure Signal The Wide Range Pressurizer Pressure signal is input to:
- a. Low Pressurizer Pressure Trip
- b. ESF Actuation System O The Low Pressurizer Pressure trip is provided to trip the reactor when the reactor coolant pressure falls below a preset value. The design basis events for this trip are LOCA, Steam Generator Tube Rupture, and Steam Line i Bicak l
When Pressurizer pressure is within 200 psia above the trip setpoint, the l operator may manually decrease the trip setpoint in 200 psia steps to 200 psia ! below the existing Pressurizer pressure to permit plant cooldown. l l The ESF functions actuated by the Low Pressurizer Pressure are Safety . Injection Actuation Signal (SIAS) and Containment Cooling Actuation Signal { (CCAS). The Containment Spray Actuation Signal (CSAS) function is also j actuated by Low Pressurizer Pressure when a High-High Containment Pressure : condition exists. l I
- 4. Steam Genemtor Water Level Signals The Steam Generator Water Level signal is input to:
- a. High Steam Generator Water Level Trip l
- b. Low Steam Generator Water I2 vel Trip v c. ESF Actuation System Document No. 6370-ICE-3316 Revision 00 Page 77 of 257 I
93-R-2003-01 The High Steam Generator Water Level trip prevents moisture carryover from the steam generators, which could damage the turbine generator. This trip is for equipment protection only and is not credited in any safety analysis. The Low Steam Generator Water Level trip ensures that there is sufficient time for actuating the emergency feedwater pumps to remove decay heat from the reactor, and maintain the specified acceptable fuel design limits in the event of a reduction of feedwater flow. The design basis ESF, Emergency Feedwater Actuation Signal (EFAS) provides the means of supplying emergency feedwater to the intact steam generator (s) to remove reactor decay heat in the event of a Main Steam Line rupture, Loss of Normal Feedwater, and Loss of Offsite Power. Separate EFAS actuation signals for each steam generator, see Table 3.2-3 below, are initiated when a two-out-of-four Low Steam Generator Water Level trip occurs coincident with a Low Steam Generator Pressure trip; or a Low Steam Generator Pressure trip is not present, but the Low Steam Generator Level trip occurs coincide t with this steam generator pressure exceeding the other steam generator's pressure by a pre-determined differential trip setpoint. Table 3.2-3 Emergency Feedwater Actuation Trip Signals PROCESS CONDITIONS ESF SIGNAL SG i SG i SGAP> SG 2 SG 2 LEVEL PRESS. SETPOINT LEVEL PRESS.
~ ~ ~
EFAS-1 -- ------ --------------------------- - - - - - - - - ' TRIP - SG, > SG, - -
~ ~
EFAS-2 - - - - - - - - - -- - - - - - - - - ---- l = - - - ----- - - - - - SG2 > SG i TRIP -
- 5. Steam Generator Pressure Signals The Steam Generator Pressure Signals are input to:
- a. Loo Steam Generator Pressure Trip
- b. ESF Actuation System The Low Steam Generator Pressure trip is provided to trip the reactor and assist the ESF system in the event of a steam line or feedwater line rupture accident. When Steam Genemtor pressures are within 200 psi above the trip setpoint, the operator may manually decrease the trip setpoint in 200 psia steps to 200 psia below the exis*ing Steam Generator pressure.
Document No. 6370-ICE-3316 Revision 00 Page 78 of 257
93-R-2003-01 The ESF actuation signals actuated by the Low Steam Generator Pressure are p the Main Steam Isolation Signal (MSIS) and the Emergency Feedwater Actuation System (EFAS). The MSIS is initiated in the unlikely event of a main steam line rupture to terminate feedwater flow to the affected steam generator and provide isolation of the intact steam generator. The difference between the two steam generator pressure signals in conjunction with the corresponding steam generator levels are used to determine which steam generator is intact and which steam generator has a pipe nipture. The MSIS closes both main steam block valves and the four main feedwater isolation valves, stops both main feedwater pumps and stops all four conden', ate pumps. The low steam generator pressure, together with the steam generator level in the intact steam genemtor, initiate EFAS. The EFAS starts the emergency feedwater pumps, determines whether a steam generator is intact, and opens the emergency feedwater valves to the intact steam generator.
- 6. .ConLainment Pressure Sienal The Containment Pressure Signals are input to:
+
- a. High Containment Pressure Trip
- b. ESF Actuation System O The Containment Pressure sensor signal is input to three separate PPS Bistable Comparator cards. The design basis for the High Containment Pressure trip is to assist the ESF system in the event of a LOCA, Steam Line Break, Feedwater Line Break, or a CEA Ejection by tripping the reactor coincident with the initiation of safety injection.
b The PPS utilizes a High and a High-High Containment Pressure setpoint. When the RPS bistable senses that the High setpoint is reached in two-out-of-four (2/4) protection channels a reactor trip occurs; at the same time the ESF h bistable also senses that the High Containment Pressure setpoint is reached, which results in the initiation of ESF actuation signals for Containment Isolation Actuation Signal (CIAS), Safety Injection Actuation Signal (SIAS), and Containment Cooling Actuation Signal (CCAS). This also msults in the [ SIAS enable of the Containment Spray Actuation Signal (CSAS). Upon reaching the High-High Containment Pressure setpoint, another ESF bistable will initiate CSAS (if the CSAS has been enabled via SIAS). The ESF acmation signals initiated from the High Containment Pressure setpoint are summarized as follows: v l l Document No. 6370-ICE-3316 Revision 00 Page 79 of 257 4 i
93-R-2003-01 Containment Isolation Actuation Signal (CIAS) O The CIAS initiates isolation of lines penetmting the containment to prevent the release of radioactive material during a Loss of Coolant Accident. The CIAS is initiated by two-out-of-four High Containment Pressure signals. Safety Iniection Actuation Siena! (SIAS) This signal actuates the components necessary to inject borated water into the reactor coolant system. This provides cooling to limit core damage and assures adequate shutdown margin regardless of temperature. The SIAS is initiated by two-out-of-four Low Pressurizer Pressure or two-out-of-four High Containment Pressure signals. Containment Cooline Actuation Signal (CCAS) The CCAS initiates emergency cooling to limit post accident containment pressure to design values. The CCAS is initiated by either two-out-of four Low Pressurizer Pressure or two-out-of-four High Containment Pressure signals. The ESF High Containment Pressure sensor signal also enables the Containment Spray Actuation Signal (CSAS). The CSAS is then initiated from j a separate bistable upon High-High Containment Pressure. Containment Sorav Actuation Signal (CSAS) The CS AS init:ates a system which removes heat and iodine by spraying cool, tyrated water through the containment atmosphere to limit the containment temperature and pressure below design values during and following a Loss of Coolant Accident or a Main Steam Line Break. The CSAS is initiated upon rec eiving two-out-of-four High-High Containment Pressure and two-out-of-four i STAS signals simultaneously. I l i O Document No. 6370-ICE-3316 Revision 00 Page 80 of 257 l I
93-R-2003-01 3.2.4.1 Multiple Protective Function Bypass The specific PPS trip functions that are dependent upon a common process measurement channel sensor signal are identified in Table 3.2-4, Plant Protection System Process Signal Trip Function Matrix. This table identifies the process signal relationship to multiple trip function dependency and the applicable sub-system within the PPS. [ The proposed revised Technical Specifications provide specific instmetions delineating the multiple trip functions that must be placed in a trip channel bypass status based upon a failed or inoperable common process sensor. For most of the design basis events, the're are multiple PPS functions that can trip the reactor to meet the safety requirements. Tables 3.6-1 and 3.6-2 identify r.ll trip functions for each design basis event. For conservatism, the safety analysis is based on the most limiting channel of the four channels. For example, in the CEA drop event, the safety analysis confirmed the margin set aside for the Loss of Flow event was more than adequate to offset the DNBR and LPD calculation by the least conservative CPC channel. , O O Document No. 6370-ICE-3316 Revision 00 Page 81 of 257
[ 0 l C 8 c: Table 3.2-4 9 a 3 Plant Protection System Process Signal Trip - Function Matrix j Z Process Signal Function Name Inter-dependent ESFAS Actuated Function Sub-System Encore rower-Range Nuclear Linear Power Level - High N/A RPS Ch Instrerentation Local Power Density - High N/A RPS d DNBR - Low N/A RPS Pressurizer Pressure NR' Pressurizer Pressure - High N/A RPS O Local Power Density - High N/A RPS [T] . DNBR - Low N/A RPS h Pressurizer Pressure WR' Pressurizer Pressure - Low N/A RPS Pressurizer Pressure - Low Safety injection Actuation Signal (SIAS) ESF Containment Cooling Actuation Signal (CCAS) ESF Contairvnent Spray Actuation Signal (CSAS) ESF' Containment Pressure NR' Contairunent Pressure - High N/A RPS Containment Pressure - High Containment Isolation Actuation Signal (CIAS) ESF M C'ntainment Cooling Actuation Signal (CCAS) ESF
$ Safety :.Jection Actuation Signal (SIAS) ESF T Containment Spray Actuation Signal (CSAS) enable ESF O'
D Containment Pressure - High-High Containment Spray Actuation Signal (CSAS) ESF h Steam Generator #1 Pressure Steam Generator #1 Pressure - Low Steam Generator #1 A Pressure - High Main Steam Isolation Signal (MSIS) Emergency Feedwater Actuation Signal (EFAS-1) RPS/ESF ESF Steam Generator #2 A Pressure - High Emergency Feedwater Actuation Signal (EFAS-2) ESF Steam Generator #2 Pressure Steam Generator #2 Pressure - Low Main Steam Isolation Signal (MSIS) RPS/ESF Steam Generator #2 A Pressure - High Emergency Feedwater Actuation Signal (EFAS-2) ESF Steam Generator #1 A Pressure - High Emergency Feedwater Actuation Signal (EFAS-1) ESF Steam Generator #1 Level NR' Steam Generator #1 Level - High N/A RPS Steam Generator #1 Level - Low Emergency Feedwater Actuation Signal (EFAS-1) RPS/ESF Steam Generator #1 A Pressure - High Emergency Feedwater Actuation Signal (EFAS-2) ESF Steam Generator #2 Level NR' Steam Generator #2 Level - High N/A RPS Steam Generator #2 Level - Low Emergency Feedwater Actuation Signal (EFAS-2) RPS/ESF Steam Generator #2 A Pressure - High Emergency Feedwater Actuation Signal (EFAS-1) ESF Core Protection Calculator Local Power Density - High N/A RPS DNBR - Low N/A , m fr3 O 00 t,J
' Wide-Range Instrument Signal O
m ' Containment Spray Actuation Signal (CSAS) function is also actuated by Low Pressurizer Pressure when a High-High Containment Pressure N condition exists. Narrow-Range Instrtsnent Signal t
,- - r - - . , _
93-R-2003-01 3.2.5 JustiGcation for Functional Redundancy If the plant is to be operated as a two-out-of-three protection system, as proposed, instead of a two-out-of-four system, as presently required by the Technical Specifications, it is , necessary to show that each individual channel will genemte a trip signal at or before the time required by the accident analysis, assuming the channel is subject to the greatest instrumentation inaccumcy allowed by the Technical Specifications. This will assure that at least the required two channels will sense a process perturbation in time to generate the required trip signal. The PPS process input signals are genemted from four separate channels. The preceding sections (3.2.1 through 3.2.4) have examined these inputs and shown them to be either:
- 1. Physically independent; i.e., there are no steady-state or transient effects that would result in any signi5 cant difference between the value of the pammeter sensed by the four transmitters, or
- 2. Compensated for in the accident analysis; i.e, where local effects can result in signincant differences in the process parameter, appropriate allowances are applied either directly in the accident analysis, or in the setpoint analysis to ensure acceptable accident analysis results.
Thus there is sufficinr. functional redundancy in the four process input channels to ensure that at least two of the channels will generate a trip signal when required, assuming one channel is bypassed and a second channel is subject to a random failure (single failure). Section 3.2.1, " Degree of Functional Redundancy", has verified that, with one PPS channel in bypass, there is no common mode failure of any of the remaining channels that might disable two or more channels. Section 3.2.2, "CEA Position Cable Separation", discusses the justi5 cation for the physical separation of the CEA cables. This section describes the demonstration that the Class IE signal cables transmitting CEA position information are sufficiently immune to susceptibility from the non-Class IE conductors within their same cable to provide discrete position information to the Core Protection Calculators (CPCs). Section 3.2.3, "CEA Position Signal Separation", verifies that no single failure will prevent the Control Element Assembly calculators (CEACs) from genenting an appropriate penalty . factor, PFossa or PFt po to the CPCs. Nor will any single failure prevent the target CEA positions from affecting more than one CPC channel. While the CEA position and the CEACs themselves cannot be trip channel bypassed, it is necessary to verify that bypassing a CPC channel will not affect the other CPC channels. This veriGcation is accomplished through the discussion of the CPCs and their inputs in the ( three above sections. Table 3.2-1 (Section 3.2.1) lists the inputs to the CPCs under Functional Unit 8, Local Power Density - High, and Functional Unit 9 DNBR - Low. Document No 6370-ICE-3316 Revision 00 Page 83 of 257
93-R-2003-01 Channel separation for each input to the CPCs (other than target CEA position and CEAC O inputs) is subsequently discussed in detail in Section 3.3.2. Channel separation for the target CEA position and CEAC inputs am justified in Sections 3.2.2 and 3.2.3. Section 3.2.4, " Process Signals Used in Multiple Protective Functions", discusses which process signals are input to more than one PPS function. It is necessary to ensure that when a channel of one function of such a parameter is bypassed, the corresponding channels of the other affected functions are similarly bypassed. In some cases, e.g., low pressurizer pressure, the signal is input to a bistable which generates multiple trip signals, and the bistable is the " function" bypassed rather than the individual functional channels. In most cases, the signal is input to different functional units and the affected channel of each of these functional units must be bypassed. Refer to technical specification LCOs 3.3.1 and 3.3.2, Actions 2 and 3, for the explicit implementation of these multiple function bypasses. The new technical specifications are discussed in Section 4.4. The above analysis shows that for prolonged bypass of any specific PPS channel, in combination with a single failure, the remaining channels will detect the occurrence of transients and accidents without causing unacceptable consequences; e.g., violation of a Specified Acceptable Fuel Design Limit (SAFDL) for an Anticipated Operational Occurrence (AOO). The plant protection is not jeopardized by the prolonged bypassing of one channel of one or more protection functions, as they are related to the functional redundancy of the PPS. O O Document No. 6370-ICE-3316 Revision 00 Page 84 of 257
93-R-2003-01 3.3 PPS Process Measurement Channel Physical Separation - Inside Contaimnent 3.3.1 Pressurizer Pressure a) Transmitter Locations - As shown on dmwings E-2875 and M-2508, sheet 3, all pressurizer pressure transmitters are located along the outer periphery of the south steam generator cavity wall at floor elevation 376'6". Spacing between transmitters associated with each of the four protection channels has been maximized. b) Transmitter Sensing Lines - Channel 1 - As shown on drawings M-2508 SH.3,2PT-4601-001 SH.1 and SH.2 and M-2230 SH.2 the routing of the transmitter sensing lines for pressurizer pressure transmitters 2FT-4624-1 and 2PT-4601-1 is as follows: From valve 2RC-4624A located at elev. 407'-4 3/8" on the southeast side of pressurizer 2T1 the line runs vertically down on the inside of the south steam generator cavity wall to penetration "C" located at elev. 381'-9". The line is then routed through penetration "C" to the outside of south steam generator cavity wall and then drops down into a horizontal instmment tubing tmy. O - The line is then routed in the instrument tubing tray where it then stubs up to the respective transmitter. c) Transmitter Sensing Lines - Channel 2 - As shown on drawings M-2508 SH.3,2LT-4627-001 SH1 and SHI A and M-2230 SH.2 the routing of the transmitter sensing lines for pressurizer pressure transmitters 2PT-4624-2 and 2PT-4601-2 is as follows: From valve 2RC-4627E located at elev. 407'-4 3/8" on the southeast side of pressurizer 2T1 the line mns vertically down on the inside cf the south steam generator cavity wall to penetration "D" located at elev. 381'-7". The line is then routed through penetration "D" to the outside of south steam generator cavity wall and then drops down into a horizontal instmment tubing tray. The line is then routed in the instmment tubing tmy where it then stubs up to the respective tansmitter. O Document No. 6370-ICE-3316 Revision 00 Page 85 of 257
33-R-2003-01 d) Transmitter Sensing Lines - Channel 3 - As shown on drawings M-2508 SH.3,2FT-4601-003 SH1 and SH2A and M-2230 SH.2 the routing of the O transmitter sensing lines for pressurizer pressure transmitters 2FT-4624-3 and 2PT-4601-3 is as follows: From valve 2RC-4623A located at elev. 407'-4 3/8" on the northwest side of pressurizer 2TI the line mns vertically down on the inside of the south steam generator cavity wall to penetration "B" located at elev. 3 81 '-9 " . 1 The line is then routed through penetration "B" to the outside of south steam generator cavity wall and then drops down into a horizontal instmment tubing tray. The line is then routed in the instmment tubing tray where it then stubs up to the respective transmitter. e) Transmitter Sensing Lines - Channel 4 - As shown on drawings M-2508 SH.3,2LT-4625-1 and M-2230 SH.2 the routing of the transmitter sensing lines for pressurizer pressure transmitters 2PT-4624-4 and 2PT-4601-4 is as follows: From valve 2RC-4627A located at elev. 407'-4 3/8" on the northwest side of pressurizer 2T1 the line mns vertically down on the inside of the south steam generator cavity wall to penetration "A" located at elev. 381'-9". The line is then routed through penetration "A" to the outside of south steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instmment tubing tray where it then stubs up to the respective transmitter. f) In Containment Cable Routing - Channel 1 - As shown on drawings E-2875, E-2876 and E-2879 the routing of the signal cables for transmitters 2PT-4601-1 and 2PT-4624-1 is as follows: The channel 1 transmitter cables are first routed to 2JB527 which is immediately below these transmitters. From 2JB527 the cables are routed up to 2JB552 on floor elevation 386' in embedded conduit SJ10ll. These signal cables are then routed to the south penetration area via emtxxided conduit SJ1012. Document No. 6370-ICE-3316 Revision 00 Page 86 of 257
93-R-2003-01 Tray SJ104 completes the routing to penetration 2WR42-1 which is located at radial coordinate 174 30' and elevation 398'. g) In Containment Cable Routing - Channel 2 - As shown on drawings E-2875, E-2876 and E-2879 the routing of the signal cables for transmitters 2PT-4601-2 and 2FT-4624-2 is as follows: The channel 2 transmitter cables are first routed to the east end of embedded conduit SJ2008 which is immediately below these transmitters. qp SJ2008 ends at junction box 2JB528. From 2JB528 the cables are routed up to 2JB551 on floor elevation 386' via embedded conduit SJ2010. These cables are then routed to the nonh penetration area in embedded conduit SJ2016. The transition to penetration 2WR42-2 is via conduit SJ2028. This penetration is located at radial coordinate 41 30' and elevation 398'. h) In Containment Cable Routing - Channel 3 - As shown on drawings E-2875 and E-2879 the routing of the signal cables for transmitters 2PT-4601-3 and 2PT-4624-3 is as follows: The channel 3 transmitter cables are first routed to 2JB529 which is immediately below these transmitters. From 2JB529 these cables are routed to the south penetration area via embedded conduit SJ3012. The transition to penetration 2WR42-3 is via trays SJ303 and SJ318. This penetration is located at radial coordinate 160 30' and elevation , 376'. i) In Containment Cable Routing - Channel 4 - As shown on drawings E-2875 and E-2879 the routing of signal cables for transmitters 2PT-4601-4 and 2PT-4624-4 is as follows-The channel 4 transmitter cables are first routed to junction box 2JB530 l located immediately below the transmitters. l From 2JB530 these cables are routed to 23B562 via embedded conduit SJ4011. Routing to the nonh penetration area is via embedded conduit SJ4017. I Document No. 6370-ICE-3316 Revision 00 Page 87 of 257
93-R.-2003-01 The transition to penetration 2WR42-4 is via tray SJ404 and SJ403. This penetration is located at radial coordinate 55' 30' and elevation O' 376'. j) Separation Between Pressurizer Pressure Channels A separate instmment tap and root valve has been provided for the transmitters of each channel. As discussed in Section 3.5.21, stmetural steel frames built around these instrument nozzles and root valves provide protection for postulated high energy line breaks. Four sepaste penetrations through the south steam generator cavity wall exist for the sensing lines of the four channels. The transmitters are widely dispersed along the outer periphery of the steam generator cavity wall. The signal cables of each channel are routed in embedded conduit to the respective penetration area. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Four containment penetmtions are used exclusively for the PPS channels. Two of these penetrations are located on the north . side of containment and two on the south side. In each area one penetration is loccted at elevation 376' and the other at elevation 398'. The wide mdial dispersion and intervening floor structure at elevation 386' ensure channel separation is maintained in the penetration area. In conclusion, the routing of the pressurizer pressure sensing lines and cables is consistent with the separation criteria presented in Section 1.4. 3.3.2 Steam Generator 2E24A Water Level and Pressure a) Transmitter Locations - As shown on drawings E-2876, E-2880, and M-2508 sheet I all of the steam generator 2E24A water level and pressure transmitters associated with the plant protection system are located along the outer periphery of the south steam generator cavity wall at floor elevation 386' Spacing between transmitters associated with each of the four protection channels has been maximized. b) Transmitter Sensing Lines - Channel 1 - As shown on drawings M-2508 SH.1, M-2511-J-L105-8, 2LT-1031-1-1 and 2 and M-2206 SH.1, the routing of the transmitter sensing lines for steam generator transmitters 2PT-1041-1 and 2LT-1031-1 is as follows: From valve 2SGS-1031-1 A located at elev. 416'-11.5" on the southeast side of steam generator 2E24A the line runs vertically down on the-inside of south steam generator cavity wall to penetration located at elev. 387'-6". (Detail #1 on drawing M-2508 SH.1) The line is then routed through the penetration to the outside of the south steam genemtor cavity wall and then drops down into a horizontal instrurnent tubing tray. The line is then routed in the instrument tubing tray to transmitters 2PT-1041-1 and 2LT-1031-1. Document No. 6370-ICE-3316 Revision 00 Page 88 of 257
93:R.-2003-01 From valve 2SGS-1031-1B located at elev. 402'-10.3" on the southeast side of steam generator 2E24A the line nms vertically down on the b inside of south steam generator cavity wall to penetration located at elev. 387'-6" (Detail #1 on drawing M-2508 SH.1) The line is then routed through the penetration to the outside of the south steam generator cavity wall and then drops down into a horizontal instmment tubing tray. The line is then routed in the instrument tubing tray to transmitter 2LT-1031-1. c) Transmitter Sensing Lines - Channel 2 - As shown on drawings M-2508 SH.1, M-2511-J-L105-9,2LT-1031-2 and M-2206 SH.1, the routing of the transmitter sensing lines for steam generator transmitters 2PT-1041-2 and 2LT-1031-2 is as follows: . From valve 2SGS-1031-2A located at elev. 416'-11.5" on the southwest side of steam generator 2E24A the line mns vertically down on the inside of south steam generator cavity wall to penetration located at elev. 387'-6" (Detail #3 on drawing M-2508 SH.1) The line is then routed through the penetration to the outside of the south steam generator cavity wall and then drops down into a horizontal instmment tubing tray. The line is then routed in the instrument tubing tray to transmitters 2PT-1041-2 and 2LT-1031-2. From valve 2SGS-1031-2B located at elev. 402'-10.3" on the southwest side of steam generator 2E24A the line runs vertically down on the inside of south steam generator cavity wall to penetration located at elev. 387'-6" (Detail #3 on drawing M-2508 SH.1) The line is then routed through the penetration to the outside of the south steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instrument tubing tray to transmitter 2LT-1031-2. d) Transmitter Sensing Lines - Channel 3 - As shown on drawings M-2508 SH.1, M-2511-J-L105-10,2LT-1031-3 and M-2206 SH.1, the routing of the i transmitter sensing lines for steam generator transmitters 2PT-1041-3 and 2LT-1031-3 is as follows: l l 1 Document No. 6370-ICE-3316 , Revision 00 Page 89 of 257 l l
d 93-R-2003-01 0 - From valve 2SGS-1031-3A located at elev. 416'-11.5" on the southeast side of steam generator 2E24A the line runs vertically down on the inside of south steam genemtor cavity wall to penetration located at elev. 387'-6". (Detail #2 on drawing M-2508 SH.1) The line is then routed through the penetration to the outside of the south steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instmment tubing tray to transmitters 2PT-1041-3 and 2LT-1031-3. From valve 2SGS-1031-3B located at elev. 402'-10.3" on the southeast side of steam generator 2E24A the line runs venically down on the inside of south steam generator cavity wall to penetration located at elev. 387'-6" (Detail #2 on drawing M-2508 SH.1) The line is then routed through the penetration to the outside of the south steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instmment tubing tray to tmnsmitter 2LT-1031-3. e) Transmitter Sensing Lines - Channel 4 - As shown on drawings M-2508 SH.1, M-2511-J-L105-11,2LT-1031-4-1 and 2 and M-2206 SH.1, the routing of the transmitter sensing lines for steam generator transmitters 2PT-1041-4 and 2LT-1031-4 is as follows: From valve 2SGS-1031-4A located at elev. 416'-l1.5" on the southwest side of steam generator 2E24A the line runs venically down on the inside of south steam generator cavity wall to penetration located at elev. 387'-6". (Detail #4 on drawing M-2508 SH.1) The line is then routed through the penetration to the outside of the south steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instrument tubing tray to tansmitters 2PT-1041-4 and 2LT-1031-4. From valve 2SGS-1031-4B located at elev. 402'-10.3" on the southwest side of steam generator 2E24A the line runs vertically down on the inside of south steam genemtor cavity wall to penetration located at elev. 387'-6" (Detail #4 on drawing M-2508 SH.1) O Document No. 6370-ICE-3316 Revision 00 Page 90 of 257
93-R.-2003-03 The line is then routed through the penetration to the outside of the O' south steam generator cavity wall and then drops down into a horizontal instrument tubing tray. l The line is then muted in the instrument tubing tray to transmitter 2LT-1031-4. ; f) In Containment Cable Routing - Channel 1 - As shown on drawings E-2876, E-2879 and E-2880 the routing of the signal cables for transmitters 2PT-1041-1 and 2LT-1031-1 is as follows: The channel 1 transmitter cables are first routed via conduit SJ1024 to tray SJ106 which is located several feet above the transmitters. These cables are then routed through tmy sections SJ106, SJ105 and SJ104 to the south penetration area. These tray sections follow the outer periphery of the steam generator cavity wall. Tray SJ104 completes the routing to penetration 2WR42-1 which is located at radial coordinate 174* 30' and elevation 398'. g) In Containment Cable Routing - Channel 2 - As shown on drawings E-2875, E-2876, E-2879 and E-2880 the routing of the signal cables for O- transmitters 2PT-1041-2 and 2LT-1031-2 is as follows: The channel 2 transmitter cables are first routed to junction box 2JB559 i which is located a couple of feet east of 2PT-1041-2. From 2JB559 these cables are routed via embedded conduit SJ2009 to 2JB528 which is located outside the shield wall on floor elevation 376'6". NOTE: From 2JB528 the routing to the penetration is the same as for the channel 2 pressurizer pressure signals. From 2JB528 the routing goes back up to 2JB551 on floor elevation 386' via embedded conduit SJ2010. , The routing to the north penetration area is via embedded conduit SJ2016. Conduit SJ2028 completes the routing to penetration 2WR42-2 which is ; located at radial coordinate 41* 30' and elevation 398'. l I O i Document No. 6370-ICE-3316 Revision 00 Page 91 of 257 l
93-R 2003-01 h) In Containment Cable Routing - Channel 3 - As shown on drawings O E-2875, E-2876, E-2879 and E-2880 the signal cable routing for transmitters 2PT-1041-3 and 2LT-1031-3 is as follows:
- The channel 3 transmitter cables are routed down to tray SJ303 via conduit SJ3023.
Tray SJ303 completes the routing to penetration 2WR42-3 which is located at radial coordinate 160" 30' and elevation 376', i) In Containment Cable Routing - Channel 4 - As shown on drawings E-2875, E-2876, E-2879 and E-2880 the signal cable routing for transmitters 2PT-1041-4 and 2LT-1031-4 is as follows:
- The channel 4 transmitter cables are first routed to junction box 2JB560 which is located immediately east of these transmitters.
From 2JB560 these cables are routed via embedded conduit SJ4014 to 2JB530 which is located outside the shield wall on floor elevation 376'6". NOTE: From 2JB530 the routing to the penetration is the same as for the channel 4 pressurizer pressure signals. From 2JB530 these cables are routed via embedded conduit SJ40ll to junction box 2JB562 which is located outside the shield wall on floor elevation 376'6". Routing to the north penetration area is via embedded conduit SJ4017. Trays SJ404 and SJ403 complete the routing to penetration 2WR42-4 which is located at radial coordinate 55* 30' and elevation 376'. j) Separation Between Steam Generator 2E24A Water Level and Pressure Channels Separate instrument taps and root valves have been provided for the transmitters of each channel. A separate penetration through the south steam generator cavity wall exists for the sensing lines of each channel. The transmitters are widely dispersed along the outer periphery of the steam generator cavity wall. The channel 2 and 4 signal cables are routed in embedded conduit to the respective penetration area. The channel I signal cables are routed up to a cable tray at elevation 396' 6", and then west to the penetration area. The channel 3 signal cables are routed down to penetration 2WR42-3. The channel I cable tray is more than 5 feet above the channel 2 ,A and 3 transmitters. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Separation between channels in the penetration area has been previously discussed in ; Document No. 6370-ICE-3316 Revision 00 Page 92 of 257 i
l 93-R-2003-01 l Section 3.3.1.j. In summary, the routing of the steam generator 2E24A water , O level and pressure sensing lines and signal cables is consistent with the separation criteria presented in Section 1.4. 3.3.3 Steam Genemtor 2E24B Water Level and Pressure a) Transmitter Locations - As shown on drawings E-2876, E-2880, and M2508 sheet 2 all of the steam generator 2E24B water level and pressure transmitters associated with the protection system are located along the outer periphery of the north steam generator cavity wall at floor elevation 386'. Spacing between transmitters associated with each of the four protection channels has been maximized, b) Transmitter Sensing Lines - Channel 1 - As shown on drawings M-2508 SH.2, M-2511-J-L105-8,2LT-1131-1-1 and 2 and M-2206 SH 1, the routing of the transmitter sensing lines for steam generator transmitters 2PT-ll41-1 , and 2LT-ll31-1 is as follows: From valve 2SGS-1131-1 A located at elev. 416'-l1.5" on the northeast side of steam generator 2E24B the line runs vertically down on the inside of north steam generator cavity wall to penetration located at elev. 387'-6" (Detail #4 on drawing M-2508 SH.2) The line is then routed through the penetration to the outside of the north steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instrument tubing tray to transmitters 2PT-1141-1 and 2LT-ll31-1. From valve 2SGS-ll31-1B located at elev. 402'-10.3" on the northeast side of steam generator 2E24B the line runs vertically down on the inside of north steam generator cavity wall to penetration located at elev. 387'-6". (Detail #4 on drawing M-2508 SH.2) The line is then routed through the penetration to the outside of the north steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instmment tubing tray to tansmitter 2LT-il31-1. c) Transmitter Sensing Lines - Channel 2 - As shown on drawings M-2508 SH.2, M-2511-J-L105-9, 2LT-1131-2-1 and 2 and M-2206 SH.1, the routing of the transmitter sensing lines for steam generator tmnsmitters 2PT-1141-2 and 2LT-1131-2 is as follow s: O Document No. 6370-ICE-3316 Revision 00 Page 93 of 257
93-R-2003-01 From valve 2SGS-1131-2A located at elev. 416'-11.5" on the northwest O side of steam generator 2E24B the line mns vertically down on the inside of north steam generator cavity wall to penetration located at elev. 387'-6". (Detail #2 on drawing M-2508 SH.2)
- The line is then routed through the penetration to the outside of the north steam generator cavity wall and then drops down into a horizontal instrument tubing tray.
The line is then routed in the instrument tubing tray to transmitters 2PT-1141-2 and 2LT-1131-2. From valve 2SGS-1131-2B located at elev. 402'-10.3" on the northwest side of steam generator 2E24B the line runs venically down on the inside of north steam generator cavity wall to penetmtion located at elev. 387'-6" (Detail #2 on drawing M-2508 SH.2) The line is then routed through the penetration to the outside of the north steam generator cavity wall and then drops down into a horizontal instmment tubing tray. The line is then routed in the instmment tubing tmy to transmitter 2LT-1131-2. d) Transmitter Sensing Lines - Channel 3 - As shown on drawings M-2508 SH.2, M-2511-3-L105-10, 2LT-1131-3-1 and 2 and M-2206 S.H.1, the routing of the transmitter sensing lines for steam generator transmitters 2PT-ll41-3 and 2LT-1131-3 is as follows: From valve 2SGS-Il31-3A located at elev. 416'-11.5" on the nonheast side of steam generator 2E24B the line mns vertically down on the inside of north steam generator cavity wall to penetration located at elev. 387'-6". (Detail #3 on dmwing M-2508 SH.2) The line is then routed through the penetration to the outside of the north steam generator cavity wall and then drops down into a horizontal instmment tubing tray. The line is then routed in the instrument tubing tray to transmitters 2PT-1141-3 and 2LT-ll31-3. From valve 2SGS-1131-3B located at elev. 402'-10.3" on the northeast side of steam generator 2E24B the line runs vertically down on the inside of north steam generator cavity wall to penetation located at elev. 387'-6". (Detail #3 on drawing M-2508 SH.2) Document No. 6370-ICE-3316 Revision 00 Page 94 of 257
93-R-2003-01 The line is then routed through the penetration to the outside of the / north steam generator cavity wall and then drops down into a horizontal instmment tubing tray. The line is then routed in the instrument tubing tray to transmitter 2LT-ll31-3. c) Transmitter Sensing Lines - Channel 4 - As shown on drawings M-2508 SH.2, M-2511-3-L105-11,2LT-1131-4-1 and 2 and M-2206 SH.1, the routing of the transmitter sensing lines for steam generator transmitters 2PT-1141-4 and 2LT-1131-4 is as follows: From valve 2SGS-1131-4A located at elev. 416'-11.5" on the northwest side of steam generator 2E24B the line runs vertically down on the inside of north steam generator cavity wall to penetration located at elev. 387'-6" (Detail #1 on drawing M-2508 SH.2) The line is then routed through the penetration to the outside of the north steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instrument tubing tray to transmitters 2PT-1141-4 and 2LT-1131-4. From valve 2SGS-Il31-4B located at elev. 402'-10.3" on the northwest side of steam generator 2E24B the line runs vertically down on the inside of north steam generator cavity wall to penetration located at elev. 387'-6". (Detail #1 on drawing M-2508 SH.2) The line is then routed through the penetration to the outside of the north steam generator cavity wall and then drops down into a horizontal instrument tubing tray. The line is then routed in the instrument tubing tray to transmitter 2LT-l l 31 -4. f) In Containment Cable Routing - Channel 1 - As shown on drawings E-2876, E-2879 and E-2880 the signal cable routing for transmitters 2PT-1141-1 and 2LT-1131-1 is as follows: The channel 1 transmitter cables are first routed to junction box 2JB555 which is located immediately east of 2LT-1131-1. From 2JB555 these signal cables are routed via embedded conduit SJ1017 to junction box 2JB552 which is located on the outer south steam generator cavity wall at floor elevation 386'. O Document No. 6370-ICE-3316 Revision 00 Page 95 of 257
93 R-2003-01 These cables are then routed to the south penetration area via embedded I conduit SJ1016. C Tray SJ104 completes the routing to penetation 2WR42-1 which is located at radial coordinate 174 30' and elevation 398'. g) In Containment Cable Routing - Channel 2 - As shown on drawings E-2876, E-2879 and B-2880 the signal cable routing for transmitters 2Irr-1141-2 and 2LT-1131-2 is as follows: The channel 2 transmitter cables are first routed straight up to tray SJ205 via conduit SJ2024. Routing to the north penetration area is via tray sections SJ205 and SJ204 which run along the outer periphery of the north steam generator cavity wall. Cable tray SJ204 completes the routing to penetration 2WR42-2 located at mdial coordinate 41 30' and elevation 398'. h) In Containment Cable Routing - Channel 3 - As shown on drawings E-2875, E-2876, E-2879 and E-2880 the signal cable routing for transmitters 2PT-1141-3 and 2LT-il31-3 is as follows: O - The channel 3 transmitter cables are first routed to junction box 2JB556 which is located immediately east of 2LT-1131-3. From 2JB556 these cables are routed to junction box 2JB529 via embedded conduit SJ3014. 2JB529 is located on the outer south steam generator cavity wall at floor elevation 376'6". Routing to the south penetmtion area is via embedded conduit SJ3012. Cable tray SJ303 completes the routing to penetration 2WR42-3 which is located at radial coordinate 160' 30' and elevation 376'. i) In Containment Cable Routing - Channel 4 - As shown on drawings E-2875, E-2876, E-2879 and E-2880 the signal cable routing for transmitters 2PT-1141-4 and 2LT-1131-4 is as follows: The channel 4 transmitter cables are routed down to elevation 374'6" and east to cable tray SJ404 via conduit SJ4022. Cable trays SJ404 and SJ403 complete the routing to penetration 2WR42-4 which is located at radial coordinate 55 30' and elevation O 376'. Document No. 6370-ICE-3316 Revision 00 Page 96 of 257
93-R-2003-01 j) Separation Between Steam Generator 2E24B Water level and Pressure Channels Separate instmment taps and root valves have been provided for the transmitters of each channel. A separate penetration through the north steam generator cavity wall exists for the sensing lines of each channel. The transmitters are widely dispersed along the outer periphery of the steam generator cavity wall. The channel 1 and 3 signal cables are routed in embedded conduit to the respective penetration area. The channel 2 signal cables are routed up to a cable tray at elevation 398', and then a few feet east toward the penetration. The channel 4 signal cables are routed down to penetration 2WR42-4. The channel 2 cable tray is more than 5 feet above the channel 4 transmitters. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Separation between channels in the penetration area has been previously discussed in Section 3.3.1.j. In summary, the routing of the steam generator 2E24B water level and pressure sensing lines and signal cables is consistent with the separation criteria presented in Section 1.4. 3.3.4 Containment Pressure a) Transmitter Locations - As shown on drawing E-2876, containment pressure transmitter 2PT-5601-1 is located on the outer south steam generator cavity O wall, near safety injection tank 2T2A, on floor elevation 386'. This drawing also shows transmitter 2N-5602-2 to be located in a similar location on the nonh side near SIT 2T2C. As shown on drawing E-2875, the channel 3 and 4 containment pressure transmitters (2FT-5603-3 and 2PT-5604-4) are located on floor elevation 374'6", along the outer periphery of the steam generator cavity walls, in the south-east and nonh-east quadmnts respectively. b) Transmitter Sensing Lines - This discussion is not applicable to the containment pressure transmitters. c) In Containment Cable Routing - Channel 1 - As shown on drawings E-2876 and E-2879 the signal cable routing for transmitter 2PT-5601-1 is as follows: The signal cable is first routed via conduit SJ1026 to junction box 2JB552 which is located a few feet above 2PT-5601-1. From this junction box the cable is routed to the south penetration area via embedded conduit SJ1012. Cable tmy SJ104 completes the routing to penetration 2WR42-1 which is located at radial coordinate 174 30' and elevation 398'. O Document No. 6370-ICE-3316 Revision 00 Page 97 of 257
. . ~ _. . . ._ _. . _ __
4 t 93 R-2003-01 d) In Containment Cable Routing - Channel 2 - As shown on drawings E-2876 and E-2879 the signal cable routing for transmitter 2PT-5602-2 is as follows: The signal cable is first routed via conduit SJ2025 to junction box 2JB551 which is located a few feet above 2PT-5602-2. From this junction box the cable is routed to the north penetration area via embedded conduit SJ2016. f Conduit SJ2028 completes the routing to penetration 2WR42-2 which is located at radial coordinate 41' 30' and elevation 398'. e) In Containment Cable Routing - Channel 3 - As shown on drawings E-2875 and E-2879 the signal cable routing for transmitter 2PT-5603-3 is as follows: The signal cable is first routed via conduit SJ3020 to junction box 23B545 which is located a few feet above 2PT-5603-3. , From this junction box the cable is routed to the south penetration area via conduit SJ3021. ; Cable tray SJ303 completes the routing to penetration 2WR42-3 which is located at radial coordinate 160* 30' and elevation 376'. O f) In Containment Cable Routing - Channel 4 - As shown on drawings E-2875 ' and E-2879 the signal cable routing for transmitter 2PT-5604-4 is as follows: i The signal cable is routed a few feet east to cable tray SJ404 via conduit SJ4023. Cable trays SJ404 and SJ403 complete the routing to penetmtion 2WR42-4 which is located at radial coordinate 55 . 30' and elevation 376'. g) Separation Between Containment Pressure Channels r Sensing lines are not utilized for the containment pressure transmitters, the t high pressure port is left open to atmosphere. As discussed in Section 3.3.4.a, these transmitters are widely dispersed both radially and vertically in containment. The channel 1 and 2 signal cables are routed to the respective.
- penetration area in embedded conduit. The channel 3 and 4 transmitters are located in their respective penetration areas. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Separation between channels in the penetration area has been previously discussed in Section 3.3.1.j. In summary, the routing of the containment pressure signal cables is consistent with the separation criteria ,
presented in Section 1.4. > Document No. 6370-ICE-3316 Revision 00 Page 98 of 257 - ,
93-R-2003-01 i 3.3.5 Reactor Coolant Pump 2P32A Speed Sensors a) Sensor IAcations As shown on drawing E-2876 the channel 1 and 2 speed sensors (2SE-6120-1 and 2SE-6120-2) are located on the pump,180 degrees apart, at elevation 394'. As shown on drawing E-2875, the channel 3 and 4 speed sensors (2SE-6120-3 and 2SE-6120-4) are also located 180 degrees apart at elevation 382'. b) In Containment Cable Routing - 2SE-6120-1 As shown on drawings E-2876 and E-2879 the signal cable routing for speed sensor 2SE-6120-1 is as follows: The signal cable is first routed due north to the reactor cavity wall at elevation 392' via conduit SJ1035. This cable is then routed via embedded conduit SJ1015 to junction box 2JB564 which is located on the west reactor cavity wall on floor elevation 386'. The associated transmitter, 2ST-6120-1, is located immediately above 2JB564. From 2JB564 this signal cable is routed via embedded conduit SJ1013 to junction box 2JB552 which is located near safety injection tank O 2DA on floor elevation 386', Routing to the south penetration area is via embedded conduit SJ1012. Cable tray SJ104 completes the routing to penetration 2WR42-1 located at radial coordinate 174 30' and elevation 398'. c) In Containment Cable Routing - 2SE-6120-2 As shown on drawings E-2876 and E-2879 the signal cable routing for speed sensor 2SE-6120-2 is as follows: The signe! cable is first routed due north via conduit SJ2060 to junction box 2JB53G located on the reactor cavity wall at elevation 392'. From 2JB53G the esble is routed via embedded conduits SJ2035 and SJ2014 to junction box 23B563 located on the outer west reactor cavity wall on floor elevation 386'. The associated transmitter,2ST-6120-2, is located immediately above 2JB563. O Document No. 6370-ICE-3316 Revision 00 Page 99 of 257
93-R-2003-01 P - From 2JB563 the cable is routed via embedded conduit SJ2013 to junction box 2JB551 which is located near safety injection tank 2T2C on floor elevation 386'. Routing to the north penetration area is via embedded conduit SJ2016. Conduit SJ2028 completes the routing to penetration 2WR42-2 which is located at radial coordinate 41 30' and elevation 398'. d) In Containment Cable Routing - 2SE-6120-3 As shown on drawings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6120-3 is as follows: The signal cable is first routed due south to the steam generator cavity wall via conduit SJ3032. This cable is then routed via embedded conduit SJ3013 to junction box 2JB526 located on the outer south steam generator cavity wall on floor elevation 374'-6". The associated transmitter, 2ST-6120-3, is located immediately above 2JB526. From 2JB526 the signal cable is routed via conduit SJ3022 and cable O tray SJ303 to penetration 2WR42-3 located at mdial coordinate 160' 30' and elevation 376'. e) In Containment Cable Routing - 2SE-6120-4 As shown on drawings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6120-4 is as follows: The signal cable is first routed due north via conduit SJ4031 to the reactor cavity wall. Routing continues via embedded conduit SJ4015 to junction box 23B530 located on the outer west cavity wall. As detailed in Section D on drawing E-2875, junction box 2JB561 and the associated speed sensor transmitter (2ST-6120-4) are located immediately north of 2JB530. Connections between these junction boxes are via conduit SJ4025. i !O l l l Document No. 6370-ICE-3316 Revision 00 Page 100 of 257 l l I
i 9.3:R:2003-01 From 2JB530 this signal is routed via embedded conduit SJ4011 to - junction box 2JB562 located on the outer north steam generator cavity wall on floor elevation 376' 6". Routing to the nonh penetration area is via embedded conduit SJ4017. Cable trays SJ404 and SJ403 complete the routing to penetration 2WR42-4 which is located at radial coordinate 55 30' and elevation 376'. f) Separation Between RCP 2P32A Speed Sensor Channels As discussed in Section 3.3.5.a, the 2P32A speed sensor channels 1 & 3 and 2
& 4 are separated by a vertical distance of 12'. Speed sensor channels 1 & 2 and 3 & 4 are at the same elevation but on opposite sides of the pump motor.
Speed sensor signals are routed to either the reactor cavity wall or steam generator cavity wall, whichever is closer, in exposed conduit. These exposed conduit runs have a minimum separation of 6'. From this point all signals are routed to the respective speed sensor transmitter in embedded conduit. Transmitters located on the same floor elevation are separated by at least 20 feet. The channel 1,2 and 4 signals are routed to the respective penetration area in embedded conduit. 2ST-6120-3 is located in the channel 3 penetration area. All conduit and cable trays utilized for these signals contain only cables s)
, associated with the respective PPS channel. Sepamtion between channels in the penetration area has been previously discussed in Section 3.3.1.j. In summary, the routing of the 2P32A speed sensor signal cables is consistent with the separation criteria presented in Section 1.4.
3.3.6 Reactor Coolant Pump 2P32B Speed Sensor a) Sensor Locations As shown on drawing E-2876 the channel 1 and 2 speed sensors (2SE-6130-1 and 2SE-6130-2) are located on the pump,180 degrees apan, at elevation 394'. As shown on drawing E-2875, the channel 3 and 4 speed sensors (2SE-6130-3 and 2SE-6130-4) are also located 180 degrees apan at elevation 382'. b) In Containment Cable Routing - 2SE-6130-1 As shown on dmwings E-2876, E-2879 and E-2880 the signal cable routing for speed sensor 2SE-6130-1 is as follows: The signal cable is first routed to the nearest section of the south steam generator cavity wall at elevation 392' via conduit SJ1036. O
/
Document No. 6370-ICE-3316 Revision 00 Page 101 of 257
93-R-2003-01 This cable is then routed via embedded conduit SJ1018 to cable tray SJ107 on the outer cavity wall.
- As sl.own on Section C of drawing E-2880, the cable is then routed via cable tray SJ107 and conduit SJ1025 to the associated speed tmnsmitter, 2ST-6130-1, which is located on the outer south steam generator cavity wall on floor elevation 386'.
The routing from 2ST-6130-1 to south penetration 2WR42-1 is via conduit SJ1025 and cable tray sections SJ107, SJ106, SJ105 and SJ104. Penetration 2WR42-1 is located at radial coordinate 174 30' and elevation 398'. c) In Containment Cable Routing - 2SE-6130-2 As shown on drawings E-2876, E-2879 and E-2880 the signal cable routing for speed sensor 2SE-6130-2 is as follows: The signal cable is first routed due north via conduit SJ2037 to the reactor cavity wall. The routing continues via embedded conduit SJ2020 to junction box 0 2JB554 located on the extreme east end of the south reactor cavity wall on floor elevation 386'. The associated speed transmitter,2ST-6130-2, is located just above 2JB554. From 2JB554 the cable is routed via embedded conduit SJ2019 to cable tray SJ205 located on the outer north steam generator cavity wall. Routing to penetration 2WR42-2 is completed via cable tray sections SJ205 and SJ204. 2WR42-2 is located at radial coordinate 41*30' and elevation 398'. d) In Containment Cable Routing - 2SE-6130-3 As shown on drawings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6130-3 is as follows: The signal cable is first routed east via conduit SJ3030 and embedded conduit SJ3011 to junction box 2JB523 located on the outer steam generator cavity wall on floor elevation 374' 6" The associated speed transmitter is located just above 2JB523. The cable is then routed to junction box 2JB545 via conduit SJ3019 ) which nms along the outer steam generator cavity wall. This junction O box is shown in Section G of drawing E-2875. l Document No. 6370-ICE-3316 Revision 00 Page 102 of 257
SkR:2003-01 O V From 2JB545 the routing to penetration 2WR42-3 is via conduit SJ3021 and cable tray SJ303. Penetration 2WR42-3 is located at radial coordinate 160'30' and elevation 376'. e) In Containment Cable Routing - 2SE-6130-4 As shown on drawings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6130-4 is as follows: The signal cable is first routed due north to the reactor cavity wall via conduit SJ4032. The cable is then routed under the shield pool and to junction box 2JB522 via embedded conduit SJ4013. 2JB522 is located on the east end of the north steam generator cavity wall on floor elevation 374' 6". As shown in Section E of drawing E-2875, the associated speed transmitter 2ST-6130-4 is located just north of 2JB522. From 2JB522 the cable is routed to penetration 2WR42-4 via conduit SJ4024 and cable trays SJ404 and SJ403. Penetration 2WR42-4 is located at radial coordinate 55 30' and elevation 376'. f) Separation Between RCP 2P32B Speed Sensor Channels As discussed in Section 3.3.6.a, the 2P32B speed sensor channels 1 & 3 and 2
& 4 are separated by a vertical distance of 12'. Speed sensor channels 1 & 2 and 3 & 4 are at the same elevation but on opposite sides of the pump motor.
The channel 2 and 4 signals are routed horizontally to the reactor cavity wall in exposed conduit. The channel 1 and 3 signals are routed horizontally to the steam generator cavity wall in exposed conduit. Since the conduit runs diverge, separation is maximized. From this point all signals are routed to the respective speed sensor transmitter in embedded conduit. Transmitters located on the same floor elevation are separated by at least 20 feet. The channel 2 signal is routed to the respective penetration area in embedded conduit. The ; other three transmitters are located near their respective penetration areas. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Separation between channels in the penetration area has been previously discussed in Section 3.3.1.j. In summary, the routing of the 2P32B speed sensor signal cables is consistent with the separation criteria presented in Section 1.4. ] l 1 O l I Dccument No. 6370-ICE-3316 Revision 00 Page 103 of 257 j
93-R-2003-01 3.3.7 Reactor Coolant Pump 2P32C Speed Sensors a) Sensor Locations As shown on drawing E-2876 the channel 1 and 2 speed sensors (2SE-6140-1 and 2SE-6140-2) are located on the pump,180 degrees apart, at elevation 394'. As shown on drawing E-2875 the channel 3 and 4 speed sensors (2SE-6140-3 and 2SE-6140-4) are also located 180 degrees apart at elevation 382'. b) In Containment Cable Routing 2SE-6140-1 As shown on drawings E-2876 and E-2879 the signal cable routing for speed sensor 2SE-6140-1 is as follows: The signal cable is first routed due south to the reactor cavity wall via conduit SJ1034. Routing continues via embedded conduit SJ1014 to junction box 23B564 located on the outer west shield wall on floor elevation 386'. The associated speed transmitter,2ST-6140-1, is located just above this junction box. From 2JB564 the cable is routed via embedded conduit SJ1013 to junction box 23B552 which is located on the outer south steam generator cavity wall on floor elevation 386'. Cable routing to the south penetration area is via embedded conduit SJ1012. Cable tray SJ104 completes the routing to penetration 2WR42-1 located at radial coordinate 174 30' and elevation 398'. c) In Containment Cable Routing - 2SE-6140-2 ; i As shown on drawings E-2876 and E-2879 the signal cable routing for speed sensor 2SE-6140-2 is as follows: The signal cable is first routed due south to the reactor cavity wall via conduit SJ2034. Routing continues via embedded conduit SJ2015 to junction box 2JB563 located on the outer shield wall on floor elevation 386'. The associated speed transmitter, 2ST-6140-2, is located just above this junction box. O l Document No. 6370-ICE-3316 Revision 00 Page 104 of 257
93.R-2003-01 O From 2JB563 the cable is routed via embedded conduit SJ2013 to junction box 2JB551 located near safety injection tank 2T2C on the outer shield wall. Routing to the north penetration area is via embedded conduit SJ2016. Conduit SJ2028 completes the routing to penetration 2WR42-2 which is located at radial coordinate 41 30' and elevation 398'. d) In Containment Cable Routing - 2SE-6140-3 As shown on drawings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6140-3 is as follows: The signal cable is first routed due south to the reactor cavity wall in conduit SJ3029. Routing continues via embedded conduit CSJ3015 to junction box 2JB533 located on the west outer shield wall on floor elevation 376' 6". The associated speed transmitter, 2ST-6140-3, is located just above this junction box. O - From 2]B533 the cable is routed via conduit SJ3017 to junction box 2JB529 located near the elevator on floor elevation 376' 6". Routing to the south penetration area is via embedded conduit SJ3012, Cable tray SJ303 completes the routing to penetration 2WR42-3 which is located at radial coordinate 160 30' and elevation 376'. e) In Containment Cable Routing - 2SE-6140-4 As shown on dmwings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6140-4 is as follows: The signal cable is first routed north to the steam generator cavity wall l via conduit SJ4020. ! Routing continues via embedded conduit SJ4010 to junction box 2JB562 which is located on the outer north steam generator cavity wall on floor elevation 376' 6". As shown on Section H of drawing E-2875 the associated speed transmitter, 2ST-6140-4, is located just above this junction box. O Document No. 6370-ICE-3316 Revision 00 Page 105 of 257 I
93.-R.-2003-01 O' - Routing to the nonh penetration area is via embedded conduit SJ4017. (O Cable trays SJ404 and SJ403 complete the routing to penetration 2WR42-4 which is located at radial coordinate 55"30' and elevation 376'. f) Separation Between RCP 2P32C Speed Sensor Channels As discussed in Section 3.3.7.a, the 2P32C speed sensor channels 1 & 3 and 2
& 4 are separated by a venical distance of 12'. Speed sensor channels 1 & 2 and 3 & 4 are at the same elevation but on opposite sides of the pump motor.
- Speed sensor signals are routed to either the reactor cavity wall or steam -
generator cav ty wall in exposed conduit. These exposed conduit nms have a minimum separation of 6'. From this point all signals are routed to the respective speed sensor transmitter in embedded conduit. Transmitters located on the same floor elevation are separated by at least 20 feet. The signals of all 4 channels are routed to the respective penetration area in embedded conduit. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Separation between channels in the penetration area has been previously discussed in Section 3.3.1.j. In summary, the routing of the 2P32C speed sensor signal cables is consistent with the separation criteria presented in Section 1.4. O 3.3.8 Reactor Coolant Pump 2P32D Speed Sensors a) Sensor Locations As shown on drawing E-2876 the channel 1 and 2 speed sensors (2SE-6150-1 and 2SE-6150-2) are located on the pump,180 degrees apart, at elevation 394'. As shown on drawing E-2875 the channel 3 and 4 speed sensors (2SE-6150-3 and 2SE-6150-4) are also located 180 degrees apan at elevation 382'. b) In Containment Cable Routing - 2SE-6150-1 As shown on drawings E-2876 and E-2879 the signal cable routing for speed sensor 2SE-6150-1 is as follows: The signal cable is first routed due south to the reactor cavity wall via conduit SJ1037. Ibating continues via embedded conduit SJ1020 to junction box 2JB553 located on the northeast corner of the reactor cavity wall on floor elevation 386'. The associated speed transmitter, 2ST-6150-1, is loca*ed just above this junction box. Document No. 6370-ICE-3316 Revision 00 Page 106 of 257
93-R-2003-01 From 2JB553 the cable is routed via embedded conduit J1021 to the south penetration area. Cable tray sections SJ107, SJ106, SJ105 and SJ104 complete the routing along the outer steam generator cavity wall to penetration 2WR42-1 which is located at radial coordinate 174'30' or.d elevation 398'. c) In Containment Cable Routing - 2SE-6150 2 As shown on drawings E-2876, E-2879 and E-2880 the signal cable routing for speed sensor 2SE-6150-2 is as follows: The signal cable is first routed to the north steam generator cavity wall via conduit SJ2036. Routing to the north penetration area is via embedded conduit SJ20!7. Speed transmitter 2ST-6150-2 is located below cable tray SJ204 in the north penetration area. From conduit SJ2017 the signal cable is routed via cable tray sections SJ205 and SJ204 and conduit SJ2023 to this transmitter. Routing from the transmitter to penetration 2WR42-2 is back through conduit SJ2023 and cable tray SJ204. Penetration 2WR42-2 is located at radial coordinate 41" 30' and elevation 398'. d) In Containment Cable Routing - 2SE-6150-3 As shown on drawings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6150-3 is as follows: The signal cable is first routed due south to the reactor cavity wall via conduit SJ3031.
- The cable is then routed under the refueling cavity floor via embedded ;
conduit SJ3010 to junction box 2JB523. As shown in Section F of ' drawing E-2875 the associated speed transmitter, 2ST-6150-3, is located just above this junction box. l From 2JB523 the cable routing is along the outer steam generator j cavity wall to junction box 2JB545 via conduit SJ3019. 2JB545 is shown in Section G of drawing E-2875. From 2JB545 routing continues via conduit SJ3021 to the south O penetration area. l Document No. 6370-ICE-3316 Revision 00 Page 107 of 257 l l
93-R.-2003-01 Cable tray SJ303 completes the routing to penetration 2WR42-3 which is located at radial coordinate 160 30' and elevation 376'. e) In Containment Cable Routing - 2SE-6150-4 As shown on drawings E-2875 and E-2879 the signal cable routing for speed sensor 2SE-6150-4 is as follows: The signal cable is first routed to the steam generator cavity wall via conduit SJ4021. Routing continues via embedded conduit SJ4012 to junction box 2JB522 located on the outer east end of the nonh steam generator cavity wall on floor elevation 374' 6". As shown in Section E of drawing E-2875 the associated speed transmitter, 2ST-6150-4, is located just north of 2JB522. Routing to the north penetration area is via conduit SJ4024. Cable trays SJ404 and SJ403 complete the routing to penetration 2WR42-4 which is located at radial coordinate 55 30' and elevation 376'. f) Separation Between RCP 2P32D Speed Sensor Channels As discussed in Section 3.3.8.a, the 2P32D speed sensor channels 1 & 3 and 2
& 4 are separated by a vertical distance of 12'. Speed sensor channels 1 & 2 and 3 & 4 are r.t the same elevation but on opposite sides of the pump motor.
The channel 1 and 3 signals are routed horizontally to the reactor cavity wall in exposed conduit. The channel 2 and 4 signals are routed horizontally to the steam generator cavity wall in exposed conduit. Since the conduit runs diverge, separation is maximized. From this point all signals are routed to the respective speed sensor transmitter in embedded conduit. Transmitters located on the same floor elevation are separated by at least 20 feet. The channel 2 signal is routed to the respective penetration area in embedded conduit. The other three transmitters are located near their respective penetration areas. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Separation between channels in the penetration area has been previously discussed in Section 3.3.1.j. In summary, the routing of the 2P32D speed sensor signal cables is consistent with the separation criteria presented in Section 1.4. O Document No. 6370-ICE-3316 R.evision 00 Page 108 of 257
9.3:R 2003-01 3.3.9 Reactor Coolant Temperature - a) Sensor Locations As shown on drawing E-2874, all RTDs are supported from their respective thermowells located in the RCS hot and cold leg piping outside of the reactor cavity shield wall. From drawing M-2230 Sh.1, hot leg RTD's 2TE-4635-1,
-2,-3,& -4 and 2TE-4735-1 A,-2A,-3A,& -4A are located approximately 6 to 8
[ inches apart and are aligned axially on the east side of the pipe above the centerline. Hot leg RTD's 2TE-4610-1,-2,-3A,& -4A and 2TE-4710-1,-2,
-3A,& -4A are located approximately 6 to 8 inches apart and are aligned axially on the west side of the pipe above the centerline. For steam generator 2E24A, cold leg channels 1 and 3 are on the discharge from RCP 2P32B, and channels 2 and 4 are on the discharge from RCP 2P32A. For steam generator 2E24B, channels 1 and 3 are on the RCP 2P32C cold leg, and channels 2 and 4 are on the RCP 2P32D cold leg.
b) In Containment Cable Routing - RCS Temperature Channel 1 The routing of all channel I hot and cold leg temperature signals is common after cable tray SJ102. Therefore, the routing of each individual temperature signal up to SJ102 will be presented, followed by the routing from this cable tray to the penetration. As shown on drawing E-2874 the signal cable routing from each channel 1 RCS RTD to cable tray SJ102 is as follows: The 2TE4711-1 signal cable is routed to the north reactor cavity shield wall via conduit SJ1030. This signal is then routed under the refueling pool floor to tray SJ102 via embedded conduit SJ1005. The 2TE4611-1 signal cable is routed to the south reactor cavity shield wall via conduit SJ1032. This signal is then routed to tray SJ102 at the west end of the south reactor cavity shield wall via embedded conduit SJ1007. The 2TE4710-1 signal cable is routed to junction box 21B52J on the north reactor cavity shield wall via conduit SJ1031. The 2TE4735-1 A and 2TE4735-1B signals are also routed to 2JB52J via conduit SJ1040. All three signals are then routed under the refueling pool floor to tray SJ102 via embedded conduit SJ1006. The 2TE4610-1 signal cable is routed to junction box 2JB52R on the south reactor cavity shield wall via conduit SJ1033. The 2TE4635-1 signal cable is also routed to 2JB52R via conduit SJ1039. Both signal O cables are then routed to tray SJ102 at the west end of the south reactor cavity shield wall via embedded conduit SJ1008. Document No. 6370-ICE-3316 Revision 00 Page 109 of 257
93-R-2003-01 1 As shown on drawings E-2874, E-2875, E-2876 and E-2879 the signal cable routing from tray SJ102 to the penetration is as follows: From tray SJ102, which is located inside the south steam generator cavity wall at elevation 373', the signals are routed to jursction box 2JB552 via embedded conduit SJ1010. 2JB552 is locatrJ on floor elevation 386', near safety injection tank 2T2A. Routing continues via embedded conduit SJ1016 to the south penetration area. Cable tray SJ104 completes the routing to penetration 2WR42-1 located at radial coordinate 174 30' and elevation 398'. c) In Containment Cable Routing - RCS Temperature Channel 2 The routing of all channel 2 hot and cold leg temperature signals is common after cable tray SJ202. Therefore, the routing of each individual temperature signal up to tray SJ202 will be presented, followed by the routing from this cable tray to the pt.mtration. As shown on drawing E-2874 the signal cable routing from each channel 2 RCS RTD to cable tray SJ202 is as follows: O - The 2TE4711-2 signal cable is routed to the north reactor cavity shield wall via conduit SJ2031. This signal is then routed to tray SJ202 at the west end of the north reactor cavity shield wall via embedded conduit SJ2005. The 2TE4611-2 signal cable is routed to the south reactor cavity shield wall via conduit SJ2033. This signal is then routed under the refueling pool floor to tray SJ202 via embedded conduit SJ2007. The 2TE4710-2 signal cable is routed to junction box 2JB52S on the north reactor cavity shield wall via conduit SJ2030. The 2TE4735-2A and 2TE4735-2B signals are also routed to 2JB52S via conduit SJ2042. All three signals are then routed to tray SJ202 at the west end of the north reactor cavity shield wall via embedded conduit SJ2004. The 2TE 4610-2 signal cable is routed to junction box 2JB52P on the south reactor cavity shield wall via conduit SJ2032. The 2TE4635-2 signal is also routed to 2JB52P via conduit SJ2041. Both signals are then routed under the refueling pool floor to tray SJ202 via embedded conduit SJ2006. O Document No. 6370-ICE-3316 Revision 00 Page 110 of 257
93-R-2003-01 As shown on dawings E-2874, E-2875, E-2876 and E-2879 the signal cable routing from tray SJ202 to the penetration is as follows: From tray SJ202, which is located inside the nonh steam generator cavity wall at elevation 372', the signals are routed to junction box 2JB551 via embedded conduit SJ2011. 2JB551.is located on floor elevation 386', near safety injection tank 2T2C. Routing continues via embedded conduit SJ2016 to the north penetration area. Conduit SJ2028 completes the routing to penetration 2WR42-2 located at radial coordinate 41 30' and elevation 398'. d) In Containment Cable Routing - RCS Temperature Channel 3 The routing of all channel 3 hot and cold leg tempemture signals is common after wireway SJ350. Therefore, the routing of each individual temperature signal up to wireway SJ350 will be presented, followed by the muting from this wireway to the penetration. As shown on drawings E-2874 and E-2875 the signal cable routing from each ' channel 3 RCS RTD to wireway SJ350 is as follows: The 2TE4611-3A signal cable is routed to the south reactor cavity shield wall via conduit SJ3027. This signal is then routed east through the shield wall and up to wireway SJ350 on floor elevation 374' 6" via embedded conduit SJ3008. The 2TE4711-3A signal cable is routed to the north reactor cavity shield wall via conduit SJ3025. This signal is then routed east through the shield wall, under the refueling pool floor and up to wireway SJ350 via embedded conduit SJ3006. The 2TE4610-3A signal cable is routed to junction box 2JB52E on the south reactor cavity shield wall via conduit SJ3028. The 2TE4635-3 signal cable is also routed to 2JB52E via conduit SJ3033. Both of these cables are then routed east through the shield wall and up to wireway SJ350 on floor elevation 374' 6" via embedded conduit SJ3009. The 2TE4710-3A signal cable is routed to junction box 2JB52G on the nonh reactor cavity shield wall via conduit SJ3026. The 2TE4735-3A and 2TE4735-3B signals are also routed to 2JB52G via conduit SJ3034. All three signals are then routed southeast under the refueling pool O floor and up to wireway SJ350 via embedded conduit SJ3007. Document No. 6370-ICE-3316 Revision 00 Page 111 of 257
93-R-2003-01 As shown on drawings E-2875 and E-2879 the signal cable routing from wireway SJ350 to the penetration is as follows: These signals are routed via wireway SJ350, which is located on the east end of the south steam generator cavity wall on floor elevation 374' 6", to nearby junction box 2JB523. From 2JB523 routing continues via embedded conduit SJ3019 to junction box 2JB545, which as shown in Section G of E-2875, is located on the outer south steam generator cavity wall. Routing continues via embedded conduit SJ3021 to the south penetration area. Cable tray SJ303 completes the routing to penetration 2WR42-3 located at radial coordinate 160* 30' and elevation 376'. e) In Containment Cable Routing - RCS Temperature Channel 4 The routing of all channel 4 hot and cold leg temperature signals is common after junction box 2JB522. Therefore, the muting of each individual temperature signal up to 2JB522 will be presented, followed by the routing O from this junction box to the penetration. As shown on drawings E-2874 and E-2875 the signal cable routing from each channel 4 RCS RTD to junction box 2JB522 is as follows: The 2TE4711-4A signal cable is routed to the north reactor cavity shield wall via conduit SJ4029. This signal is then routed east through the shield wall and up to 2JB522 on floor elevation 374' 6" via embedded conduit SJ4008. The 2TE4611-4A signal cable is routed to the south reactor cavity shield wall via conduit SJ4027. This signal is then routed nonheast under the refueling pool Door and up to 2JB522 via embedded conduit SJ4006. The 2TE4710-4A signal cable is routed to junction box 2JB52H on the north reactor cavity shield wall via conduit SJ4030. The 2TE4735-4A and 2TE4735-4B signals are also routed to 2JB52H via conduit SJ4034. All three of these cables are then routed east through the shield wall and up to 2JB522 on Door elevation 374' 6" via embedded conduit SJ4009. i O l Document No. 6370-ICE-3316 Revision 00 Page 112 of 257
l I 93-R-2003-01 ! The 2TE4610-4A signal cable is routed to junction box 2JB52F on the l O south reactor cavity shield wall via conduit SJ4028. The 2TE4635-4 i signal cable is also routed to 2JB52F via conduit SJ4033. Both of these ! signals are then routed nonheast under the refueling pool floor and up ) to 2JB522 via embedded conduit SJ4007. As shown on drawings E-2875 and E-2879 the signal cable routing from 2JB522 to the penetration is as follows: From 2JB522, which is located on the east end of the north steam generator cavity wall on floor elevation 374' 6", these cables are routed approximately 10 feet nonh via conduit SJ4024 to cable tray SJ404. Cable tray SJ404 completes the routing to penetration 2WR42-4 which is located at radial coordinate 55 30' and elevation 376'. f) Separation Between Reactor Coolant Temperature Channels Due to the relatively short length of the hot and cold leg piping outside of the reactor cavity shield walls, the RCS RTDs are located in close proximity. As described in Section 1.4, redundant PPS sensors must be sufficiently separated so that functional capability of the protection system will be maintained for all design basis events. The core protection calculators utilize these temperature signals as part of the LPD and DNBR calculations. These reactor trip parameters are not credited in the LOCA analysis. All high energy piping in the vicinity of these temperature detectors is directly connected to the RCS and thus within the scope of the LOCA analysis. Other than the LOCA breaks, for which the temperature signals are not required, there are no design basis events for which the minimum number of redundant RCS tempenture channels would not be available. Where dual element RTDs are used, both signals are associated with the same channel. All RCS temperature signals are first routed to the reactor cavity shield wall in exposed conduit. A minimum one inch separation between enclosed raceways is maintained. With the exception of a shon length of exposed raceway in channels 1,2 and 3, all signals are routed from the reactor cavity shield wall to the respective penetration area in embedded conduit. All conouit and cable trays utilized for these signals contain only cables associated with the respective PPS channels. Separation between channels in the penetation area has been previously discussed in Section 3.3.1.j. In summary, the routing of the RCS temperature signal cables and location of the RTDs is consistent with the separation criteria presented in Section 1.4. Document No. 6370-ICE-3316 Revision 00 Page 113 of 257
93-R-2003-01 3.3.10 Excore Detectors a) Detector Iecations As showr on drawing E-2873 the four safety channel excore detectors (2JE-9004, 2JE-9005, 2JE-9006 and 2JE-9007) are located between the reactor vessel and the primary shield wall. Together the upper, middle and lower detector sections span the height of the active core area. The safety channel 1, 2, 3 and 4 detectors are located at radial coordinates 195*,285 ,105 and 15 (referenced to reactor vessel centerline) respectively. Maximum spacing is maintained between channels by routing the signal cables through the primary and secondary shield walls at approximately the same radial locations. The penetrations through the primary shield wall are located at elevation 345' b) In Containment Cable Routing - 2JE-9004 Each of the three detector sections hcve individual signal and high voltage cables, all of which have a common routing between the detector and the pre-amplifier. In addition, all individual cables between the pre-amplifier and the penetration have a common routing. As shown on drawings E-2873, E-2874, E-2875, E-2876 and E-2879 the common channel I signal cable routing is as follows: The bottom end of the detector instrument thimble includes a 90 elbow with a 6' bend mdius which connects with cable tray SJ101 at the outer surface of the primary shield wall. From SJ101 these cables are routed through the secondary shield wall to pre-amplifier box 2R195 via conduit CSJ1001. The cables between the pre-amplifier and the penetration are first . routed via conduit SJ1022 to junction box 2JB507, which is located several feet west of box 2R195, at radial coordinate 180 and elevation 349' From 2JB507 the routing is straight up to elevation 386' via embedded conduit SJ1002. Conduit SJ1028 completes the routing to penetration 2WR42-1 which is krated at radial coordinate 174 30' and elevation 398'. l l Document No. 6370-lCE-3316 Revision 00 Page 114 of 257 ! 1
93-R-2003-01 c) In Containment Cable Routing - 2JE-9005 Each of the three detector sections have individual signal and high voltage cables, all of which have a common routing between the detector and the pre-ampliner. In addition, all individual cables between the pre-ampliner and the penetration have a common routing. As shown on dmwings E-2873, E-2874, E-2875, E-2876 and E-2879 the common channel 2 signal cable routing is as follows: As shown in Section A of E-2873, the bottom end of the detector instmment thimble includes a 90 elbow with a 6' bend radius which connects with cable tray SJ201 to the outer surface of the primary shield wall. As shown in Section A of E-2873, tray SJ201 extends from the primary shield wall to pre-amplifier box 2R196, located outside of the secondary shield at radial coordinate 275 and elevation 352'. Junction box 2JB513 is located immediately west of the pre-amplifier box. From 23B513 these cables are routed via embedded conduit SJ2001 to junction box 2JB551 which is located near safety injection tank 2T2C on floor elevation 386'. Routing from 2JB551 to the nonh penetration area is via embedded conduit SJ2016. Conduit SJ2028 completes the routing to penetration 2WR42-2 which is located at radial coordinate 41 30' and elevation 398'. d) In Containment Cable Routing - 2JE-9006 Each of the three detector sections have individual signal and high voltage cables, all of which have a common routing between the detector and the pre-amplifier. In addition, all individual cables between the pre-amplifier and the penetration have a common routing. As shown on drawings E-2873, E-2874, E-2875 and E-2879 the common channel 3 signal cable routing is as follows: As shown in Section G of E-2873, the bottom end of the detector instmment thimble includes a 90 elbow with a 6' bend radius which connects with cable tray SJ301 at the outer surface of the primary shield wall. From SJ301 these cables are routed through the secondary shield wall to pre-amplifier box 2R197 via conduit SJ3001. O l l Document No. 6370-ICE-3316 Revision 00 Page 115 of 257 1 I
93-R-2003-01
,m
'{} - The cables between the pre-amplifier and the penetration are first routed via embedded conduit SJ3002 to junction box 2JB504, which is located on the outer secondary shield wall at radial coordinate 150' and elevation 349'. From 2JB504 the routing is straight up to elevation 384' via embedded conduit SJ3003. Conduit SJ3024 completes the routing to penetration 2WR42-3 which is located at radial coordinate 160 30' and elevation 376'. e) In Containment Cable Routing - 2JE-9007 Each of the three detector sections have individual signal and high voltage cables, all of which have a common routing between the detector and the pre-amplifier. In addition, all individual cables between the pre-amplifier and the penetration have a common routing. As shown on drawings E-2873, E-2874, E-2875 and E-2879 the common channel 4 signal cable routing is as follows: The bottom end of the detector instrument thimble includes a 90 elbow with a 6' bend radius which connects with cable tray SJ401 at the outer g surface of the primary shield wall. Q) - Cable tray SJ401 ends at the south face of the north steam generator concrete support pad. Routing through this concrete structure is via embedded conduit SJ4001. Routing between the north face of the steam generator support pad and the secondary shield wall is via cable tray SJ402. From SJ402 these cables are routed through the secondary shield wall to the pre-amplifier box 2R198 via conduit SJ4002. The cables between the pre-amplifier and the penetration are first routed via conduit SJ4019 to junction box 2JB501 which is located on the outer secondary shield wall at radial coordinate 50" and elevation 349'. From 2JB501 the routing is straight up to elevation 383' via embedded conduit SJ4003. Conduit SJ4026 completes the routing to penetration 2WR42-4 which is located at radial coordinate 55 30' and elevation 376'. e Document No. 6370-ICE-3316 Revision 00 Page 116 of 257
93-R-2003-01 f) Separation Between Excore Detector Channels O' As discussed in Section 3.3.10.a, the four safety channel excore detectors are equally separated around the reactor vessel periphery. This channel separation is maintained as the signal cables are routed radially outward through the primary and secondary shield walls. The four pre-amplifiers are equally separated around the outer periphery of the secondary shield wall on floor elevation 336' 6". The routing of the signal cables for each channel from the pre-amplifiers to the respective penetration areas is predominantly in embedded conduit. All conduit and cable trays utilized for these signals contain only cables associated with the respective PPS channel. Separation between channels in the penetration ama has been previously discussed in Section 3.3.1.j. In summary, the routing of the excore safety channel signal cables is consistent with the separation criteria presented in Section 1.4. O O Document No. 6370-ICE-3316 Revision 00 Page 117 of 257
93 R:2003-01~ 3.4 PPS Process Measurement Channel Physical Separation - Outside Containment 3.4.1 Cable Routing From Penetration 2WR42-1 To Process Protective Cabinet 2C15-1 The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: High Pressurizer Pressure 2PT4601 Low Pressurizer Pressure 2PT4624-1 Containment Pressure 2Fr5601-1 S/G A Water Level' 2LT1031-1 S/G A Pressure 2PT1041-1 S/G B Water Level- 2LT1131-1 S/G B Pressure 2PT1141-1 S/G A Hot Leg Temperature 2TE4610-1 , 2TE4635-1 i S/G B Hot Leg Temperature 2TE4710-1 2TE4735-1A , RCP B Cold Leg Temperature 2TE4611-1 RCP C Cold Leg Tempemture 2TE4711-1 RCP A Speed 2SE6120-1 ! RCP B Speed 2SE6130-1 O RCP C Speed RCP D Speed 2SE6140-1 2SE6150-1 l As shown on drawings E-2868, E-2870 and E-2891 the' channel I signal cable routing from penetration 2WR42-1 located at radial coordinate 174* 30' and EL. 398'-0" to process protective cabinet 2C15-1 located on EL 404'-0" in panel room no. 2150 is as follows:
- From penetration 2WR42-1 the signal cable is routed to cable tray EJ106 - -
which is located below penetration at EL. 396'-9" in the upper south electrical penetration room.
- From cable tray El106 the cable is routed via cable tray EJ105, which is also located in the upper south electrical penetration room, to cable tray El104.
Cable tray Ell 04 is located in ceiling space above the hot instrument shop and decontamination room at EL. 400'-3".
- The cable is then routed via cable tray Ell 03 up to cabinet 2C15-1.
O c Document No. 6370-1CE-3316 Revision 00 Page 118 of 257
a 93-R-2003 . 3.4.2 Cable Routing From Penetration 2WR42-2 To Process Protective Cabinet 2C15-2 The routing described in this section is applicable to the. signal cables associated with' the following PPS process measurement sensors: 4 High Pressurizer Pressure 2Fr4601-2 ; Containment Pressure 2PT5602-2 .. S/G A Water Level 2LT1031-2' S/G A Pressure 2Fr1041-2 , S/G B Water 12 vel 2LT1131-2 S/G A Hot Leg Temperature . 2TE4610-2 , 2TE4635-2 . S/G B Hot Leg Temperature 2TE4710-2 l 2TE4735-2A RCP A Cold Leg Temperature 2TE4611-2 RCP D Cold Leg Temperature 2TE4711-2 : RCP A Speed 2SE6120-2 RCP B Speed 2SE6130-2 < 1 RCP C Speed 2SE6140-2 RCP D Speed 2SE6150-2 As shown on drawings E-2839, E-2868, E-2870 and E-2890 the channel 2 signal O cable routing from penetration 2WR42-2 located at radial coordinate 41' 30' and EL. 398'-0" to process protective cabinet 2C15-2 located on EL. 404'-0" in panel room no. 2150 is as follows:
- From penetmtion 2WR42-2 the signal cable is routed to cable tray B212 which is located vertically on outside containment wall in upper north '
electrical penetration room between penetration 2WR42-2 and cable tray. E1211.
- The cables are then routed via cable trays E1211 and EI210 along the containment wall to the south end of the electrical penetration room.
- From EI210 half of these cables are routed via embedded conduit B2013, and the remaining cables are routed via embedded conduit EI2019. ; These conduits mn side by side and both end near cable tray EI219, which is located in the ceiling space alongside the elevator in the containment auxiliary building at elevation 397'-9".
- From cable tray EJ219, the routing continues via cable trays EI218, EI217 and EI216 which are located above ceiling in hallway west of control room.
- The cable is then routed via cable tray EI215 to cabinet 2C15-2. ,
l + Document No. 6370-ICE-3316 Revision 00 Page 119 of 257
-. - = . . - - . -- - - -- . . -
93-R-2003-01 : 3.4.3 Cable Routing From Penetration 2WR42-3 To Process Protective Cabinet 2C15-3_ V The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: High Pressurizer Pressure - 2FT4601-3 Low Pressurizer Pressure 2PT4624-3 Containment Pressuie 2PT5603-3 S/G A Water Level 2LT1031-3 S/G A Pressure 2PT1041-3 S/G B Water Level 2LTil31-3 S/G B Pressure 2Pril41-3 S/G A Hot Leg Temperature 2TE4610-3A 2TE4635-3 S/G B Hot Leg Temperature 2TE4710-3A 2TE4735-3A RCP B Cold Leg Temperature 2TE4611-3 RCP C Cold Leg Temperature 2TE4711-3 RCP A Speed 2SE6120-3 RCP B Speed 2SE6130-3 RCP C Speed 2SE6140-3 RCP D Speed 2SE6150-3
~
As shown on drawings E-2868, E-2870 and E-2891 the channel 3 signal cable routing from penetration 2WR42-3 located at mdial coordinate 160' 30' and EL.;376'-0" to process protective cabinet 2C15-3 located on EL. 404'-0" in panel room no. 2150 is s as follows: 3
- From penetration 2WR42-3 the signal cable is routed to cable tray B307 which is located vertically on outside containment wall in lower south electrical penetration room between penetration 2WR42-3 and cable tray EI306. ,
- The cable is then routed via cable tray EI306, which is located in the upper south electrical penetration room at EL. 394'-3" to cable trays EJ305 and-EI304 located in ceiling space above the hot instmment shop and decontamination room at EL. 400'-3".
- The routing continues via cable tray EI303 up to cabinet 2C15-3.
O Document No. 6370-ICE-3316 Revision 00 Page 120 of 257
93-R-2003:01 3.4.4 Cable Routing From Penetration 2WR42-4 to Process Protective Cabinet 2C15-4 / The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: High Pressurizer Pressure 2PT4601-4 Low Pressurizer Pressure 2Fr4624-4 Containment Pressure 2PT5604-4 S/G A Water Level 2LT1031-4 S/G A Pressure 2PT1041-4 S/G B Water Level 2LTll31-4 S/G B Pressure 2Fil141-4 S/G A Hot leg Temperature 2TE4610-4A 2TE4635-4 S/G B Hot 12g Temperature 2TE4710-4A 2TE4735-4A RCP A Cold Leg Temperature 2TE4611-4 RCP D Cold Leg Temperature 2TE4711-4 RCP .A Speed 2SE6120-4 RCP B Speed 2SE6130-4 RCP C Speed 2SE6140-4 RCP D Speed 2SE6150-4 As shown on drawings E-2862, E-2868, E-2870 and E-2890 the channel 4 signal cable routing from penetration 2WR42-4 located at radial coordinate 55 30' and EL. 376'-0" to process protective cabinet 2C15-4 located on EL. 404'-0" in panel room no. 2150 is as follows:
- From penetration 2WR42-4 the signal cable is routed to cable trays B412 and EI411 which are located at EL. 375'-0" in the lower north electrical penetration room.
- From cable tray EI411 these cables are routed up through floor elevation 386' via cable tray EJ410, which is located at the south end of the electrical penetration room.
- From EI410 half of these cables are routed via embedded conduit EJ4003 to cable tray EI420. The remaining cables are routed via embedded conduit EJ4007 to cable tray EJ419. These two embedded conduits run side by side.
Cable tray EI420 is located one foot above EJ419, in the ceiling space above floor elevation 386', near the containment auxiliary building elevator.
- From either cable tray EJ419 or EJ420, the routing continues via cable trays EJ418, EI417 and EI416 which are located above ceiling in hallway west of control room.
- The cable is then routed via cable tray EI415 to cabinet 2C15-4.
Document No. 6370-ICE-3316 Revision 00 Page 121 of 257
4 _. _ . _ . . _ _ _ 93-R-2003-01 3.4.5 Cable Routing From Penetration 2WR42-1 to Plant Protection System Cabinet 2C23-1 The routing described in this section is applicable to the signal cables associated with ' the upper, middle and lower sections of excore safety channel detector 2]E9004. These seven signal cables are routed in conduit El1079 all the way from the penetration to PPS cabinet 2C23-1. The conduit layout is shown on drawings E-2868 and E-2891. From 2WR42-1 at elevation 398', this conduit mns horizontally across the upper. south penetration room to column line C2. EI1079 then runs east above the hallway outside the penetration room to column line 4. At this point the routing is south above the hallway outside the west control room wall. EJ1079 enters the control room through the west wall, and enters 2C23-1 from the top. , 3.4.6 Cable Routing From Penetration 2WR42-2 To Plant Protection System Cabinet 2C23-2 The routing described in this section is applicable to the signal cables associated with the upper, middle and lower sections of excore safety channel detector 2JE9005. As shown on drawings E-2839, E-2868 and E-2890 the routing for these seven signal cables is as follows:
- From penetration 2WR42-2, the routing is south along the containment building wall via conduit EJ2081 to junction box 2JB30K which is located in the upper north electrical penetration room at elevation 395'.
- From 2JB30K routing continues via embedded conduit EJ2080 to junction box 2JB033, which is located at column lines D2 and 5 at elevation 399'.
- From 2JB033 these cables are routed to 2C23-2 via conduit EI2079. This conduit mns above the control room parallel to column line 5 between D2 and '
B2. It then mns west and enters 2C23-2 from the top. 3.4.7 Cable Routing From Penetration 2WR42-3 To Plant Protection System Cabinet 2C23-3 The routing described in this section is applicable to the signal cables associated with the upper, middle and lower sections of excore safety channel detector 2JE9006. These seven signal cables are routed in conduit EI3013 all the way from the penetration to PPS cabinet 2C23-3. The conduit layout is shown on drawings E-2868 and E-2891. From penetation 2WR42-3 this conduit runs up through floor elevation 386' to elevation 400', Then the conduit runs horizontally across the upper south electrical penetration room to column line C2. EI3013 then runs east above the hallway outside the penetration room to column line 4. At this point the routing is south above the hallway outside the west control room wall. EJ3013 enters the ! control room through the west wall, and enters 2C23-3 from the top. ! O i Document No. 6370-ICE-3316 Revision 00 Page 122 of 257
93-R-2003-01 3.4.8 Cable Routing From Penetration 2WR42-4 To Plant Protection System Cabinet C] 2C23-4 The routing described in this section is applicable to the signal cables associated with the upper, middle and lower sections of excore safety channel detector 2JE9007. As shown on drawings E-2839, E-2868 and E-2890 the routing for these seven signal cables is as follows:
- From penetration 2WR42-4, the routing is south along the containment building wall and up through floor elevation 386' via conduit EJ4028 to junction box 2JB30L which is located in the upper north electrical penetration room at elevation 395'.
- From 2JB30L routing continues via embedded conduit EI4027 to junction box 2JB034, which is located at column lines D2 and 5 at elevation 399'.
- From 2JB034 these cables are routed to 2C23-4 via conduit EJ4026. This conduit runs above the control room parallel to column line 5 between D2 and B2. It then mns west and enters 2C23-4 from the top.
3.4.9 Cable Routing From Penetration 2WR42-1 to Instrument Cabinet 2C336-1 g The routing described in this section is applicable to the B steam generator hot leg g temperature input signal to the EFAS bypass circuit,2TE4735-1B. As shown on drawings E-2867, E-2868, E-2870, E-2885, E-2889, E-2891 and E-2892 the channel 1 signal cable routing from penetration 2WR42-1 located at radial coordinate 174 30' and EL. 398'-0" to instmment cabinet 2C336-1 located on El. 386'-0" in control room is as follows:
- From penetration 2WR42-1 the signal cable is routed to cable tray EJ106 which is located below penetration at EL. 396'-9" in the upper south electrical penetration room.
- From cable tray EJ106 the cable is routed via cable tray Ell 05, which is also located in the upper south electrical penetration room at EL. 400'-3", to cable tray EJ104. Cable tray Ell 04 is located in ceiling space above the hot instrument shop and decontamination room at EL. 400'-3".
- The routing continues via cable tray EJ103, which is located in ceiling space east of decontamination room at EL. 398'-0", to cable tray EJ127. Cable tray EJ127 is a vertical wireway located in hallway west of control room.
- The cable is then routed via wireway Ell 25, which is located in the cable spreading room at EL. 381'-11".
O V Document No. 6370-ICE-3316 Revision 00 Page 123 of 257
93-R-2003-01
^
(
- From wireway Ell 25 the cable is then routed via conduit EJ1100 to junction N - box 2JB057 mounted on ceiling of cable spreading room. From junction box 2JB057 routing continues through cabinet 2C18-1 to conduit EJ1097 to cabinet 2C336-1.
3.4.10 Cable Routing From Penetration 2WR42-2 To Instrument Cabinet 2C336-2 The routing described in this section is applicable to the B steam generator hot leg temperature input signal to the EFAS bypass circuit,2TE4735-2B. As shown on drawings E-2839, E-2868, E-2870, E-2890 and E-2892 the channel 2 signal cable routing from penetration 2WR42-2 located at radial coordinate 41 30' and El. 398'-0" to instmment cabinet 2C336-2 located on EL. 386'-0" in control room is as follows:
- From penetration 2WR42-2 the signal cable is routed to cable tray EI212 which is located vertically on outside containment wall in upper north electrical penetration room between penetration 2WR42-2 and cable tray EJ211.
- The cable is then routed via cable trays EI211 and EI210 which are also located in the upper north electrical penetration room at EL. 389'-l1" and embedded conduit EI2014 to cable tray EI220 located in ceiling space alongside elevator in containment auxiliary building at El. 399'-6".
- From cable tray EI220 the routing continues via cable trays EI218, EI217 and EJ216 which are located above ceiling in hallway west of control room.
- From cable tray EI216 the routing continues via cable tray EI227, which is a vertical wireway located in hallway west of control room at column line B-2.
- The cable is then routed via wireway EI225 which is located in cable spreading room and conduit E12078 to cabinet 2C16. From 2C16, the cable is routed in conduits EI2096 and EI2095 to junction box 2JB059 mounted on ceiling of cable spreading room.
- From junction box 2JB059 routing continues through cabinet 2C18-2 to conduit EI2104 to cabinet 2C336-2.
3.4.11 Cable Routing From Penetration 2WR42-3 To Instrument Cabinet 2C336-3 The routing described in this section is applicable to the B steam generator hot leg temperature input signal to the EFAS bypass circuit,2TE4735-3B. As shown on drawings E-2868, E-2870 and E-2891 the channel 3 signal cable routing from penetration 2WR42-3 located at radial coordinate 160 30' and El. 376'-0" to instmment cabinet 2C336-3 located on EL. 386'-0" in control room is as follows: O Document No. 6370-ICE-3316 Revision 00 Page 124 of 257
93.-R.-2003-01
- From penetration 2WR42-3 the signal cable is routed to cable tray B307
\ which is located venically on outside containment wall in lower south electrical penetration room between penetration 2WR42-3 and cable tray E1306.
- The cable is then routed via cable tray E1306, which is located in the upper south electrical penetration room at EL. 394'-3" to cable trays EI305 and EI304 located in ceiling space above the hot instrument shop and decontamination room at EL. 400'-3".
- The routing continues via conduit E13015 to cabinet 2C336-3.
3.4.12 Cable Routing From Penetration 2WR42-2 To Instrument Cabinet 2C336-4 The routing described in this section is applicable to the B steam generator hot leg temperature input signal to the EFAS bypass circuit, 2TE4735-4B. As shown on drawings E-2862, E-2868, E-2870 and E-2890 the channel 4 signal cable routing from penetration 2WR42-4 located at radial coordinate 55 30' and EL. 376'-0" to instmment cabinet 2C336-4 located on EL. 386'-0" in control room is as follows:
- From penetration 2WR42-4 the signal cable is routed to cable trays EI412 and r EI411 which are located at EL. 375'-0" in the lower nonh electrical penetration room.
- From cable tray EI411 the cable is routed via cable tray EI410, which is also located in the lower nonh electrical penetration room, to embedded conduit EI4007 in the upper nonh electrical penetration room.
- From conduit EI4007 the routing continues in cable tray EI419 located in ceiling space alongside elevator in containment auxiliary building at EL. 395'-
5".
- From cable tray E1419 the routing continues via cable trays EI418 and EI417, which are located above ceiling in hallway west of control room.
- The cable is then routed via conduit EI4031 to cabinet 2C336-4.
3A.13 Cable Routing From Penetration 2WR42-2 To Instrument Cabinet 2C384 The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: Low Pressurizer Pressure 2PT4624-2 S/G B Pressure 2PT1141-2 As shown on drawings E-2859 and E-2890 the routing for these signal cables is as follows: Document No. 6370-ICE-3316 Revision 00 Page 125 of 257
93-R-2003-01 From penetration 2WR42-2 these cables are routed down nine feet in cable O tray B212 to cable tray FJ211. O - The routing continues via cable tray sections U211 and FJ210 southeast along the containment building wall. Conduit EJ2115 completes the routing to 2C384, which is located in the upper north electrical penetration room. 3.4.14 Cable Routing From Instrument Cabinet 2C384 To Process Protective Cabinet 2C15-2. The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: Low Pressurizer Pressure 2PT4624-2 S/G B Pressure 2Fril41-2 As shown on drawings E-2839, E-2868, E-2870 and E-2890 the routing for these signal cables is as follows: From 2C384 these cables are routed several feet over to cable tray EJ210 via conduit B2115. Cable tray B210 ends at the south wall of the upper north electrical O penetration room at elevation 389'-11". From the penetration room wall these cables are routed via embedded conduit FJ2019 to cable tray EJ219 which is located near the elevator at elevation 398' Routing continues via cable tray sections B218, FJ217, and EJ216 south, above the hallway outside the west control room wall. These cables are then routed up through floor elevation 404' and into the bottom of 2C15-2 via cable tray B215. l 3.4.15 Cable Routing From Process Protective Cabinet 2C15-1 To Plant Protection ; System Cabinet 2C23-1 l The routing described in this section is applicable to the signal cables associated with ! the following PPS process measurement sensors: ) High Pressurizer Pressure 2PT4601-1 low Pressurizer Pressure 2PT4624-1 Containment Pressure 2FT5601-1 1 S/G A Water I2 vel 2LT1031-1 l S/G A Pressure 2PT1041-1 l S/G B Water Ixvel 2LTil31-1 O' I S/G B Pressure 2PTil41-1 RWT Level 2LT5636-1 Document No. 6370-ICE-3316 Revision 00 Page 126 of 257
93 R-2003-01 As shown on drawing E-2205 sheet 2, these signals are all carried by two O multiconductor prefabricated cables. Drawings E-2868, E-2870, E-2885 and E-2889 show the routing of these cables to be as follows: Cable tray EIl03 completes the routing up through floor elevation 404' and into 2C15-1. Ell 27 ends at cable tray Ell 04. The cables are routed a few feet south until they are directly beneath 2C15-1 via EI104. The cables are routed through the west wall of the cable spreading room and back up through floor elevation 386' via wireway Ell 27. From 2C23-1 the cables are routed down through floor elevation 386' into the cable spreading room via wireway Ell 26. 3.4.16 Cable Routing From Process Protective Cabinet 2C15-2 To Plant Protective System Cabinet 2C23-2 The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: High Pressurizer Pressure 2PT4601-2 Low Pressurizer Pressure 2FT4624-2 Containment Pressure 2PT5602-2 S/G A Water Level 2LT1031-2 S/G A Pressure 2PT1041-2 S/G B Water Level 2LTil31-2 S/G B Pressure 2PT1141-2 RWT Level 2LT5637-2 As shown on drawing E-2205 sheet 2, these signals are all carried by two multiconductor prefabricated cables. Drawings E-2868, E-2870, E-2885 and E-2889 show the routing of these cables to be as follows: Cable tray EI215 completes the routing up through floor elevation 404' and into 2C15-2. EI227 ends at cable tray EI216. The cables are routed a few feet south until they are directly beneath 2C15-2 via EI216. The cables are routed through the west wall of the cable spreading room and back up through floor elevation 386' via wireway EI227. From 2C23-2 the cables are routed down through floor elevation 386' into the cable spreading room via wireway EJ226. Document No. 6370-ICE-3316 Revision 00 Page 127 of 257
J 93-R-2003-01 3.4.17 Cable Routing From Process Protective Cabinet 2C15-3 To Plant Protection System Cabinet 2C23-3 , The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: 1 High Pressurizer Pressure 2PT4601-3 Low Pressurizer Pressure 2PT4624-3 Containment Pressure 2PT5603-3 j S/G A Water Level 2LT1031-3 - S/G A Pressure 2PT1041 S/G B Water Level 2LTl131-3 S/G B Pressure 2PT1141-3 i RWT Level 2LT5639-3 As ::hown on drawing E-2205 sheet 2, these signals are all carried by two multiconductor prefabricated cables. Drawings E-2868, E-2870, E-2885 and E-2889 show the routing of these cables to be as follows: Cable tray EI303 completes the routing up through floor elevation 404' and into 2C15-3. , EJ327 ends at cable tray EI304. - The cables are routed a few feet south until they are directly beneath 2C15-3 via EJ304. The cables are routed through the west wall of the cable spreading room and back up through floor elevation 386' via wireway EJ327.
- From 2C23-3 the cables are routed down through floor elevation 386' into the cable spreading room via wireway EI326.
3.4.18 Cable Routing From Process Protective cabinet 2C15-4 To Plant Protection : Systern Cabinet 2C23-4 The routing described in this section is applicable to the signal cables associated with : the following PPS process measurement sensors: High Pressurizer Pressure 2PT4601-4 Low Pressurizer Pressure 2PT4624-4 Containment Pressure 2PT5604-4 S/G A Water Level 2LT1031-4 S/G A Pressure 2FT1041-4 S/G B Water Level 2LT1131-4 S/G B Pressure 2PTl141-4 . RWT Level 2LT5640-4 O . Document No. 6370-ICE-3316 Revision 00 Page 128 of.257 ;
93-R-2003-01 As shown on drawing E-2205 sheet 2, these signals are all carried by two [ multiconductor prefabricated cables. Drawings E-2868, E-2870, E-2885 and E-2889 show the routing of these cables to be as follows: Cable tray EI415 completes the routing up through floor elevation 404' and into 2C15-4. EI427 ends at cable tray EI416. The cables are routed a few feet south until they are directly beneath 2C15-4 via EI416. The cables are routed through the west wall of the cable spreading room and back up through floor elevation 386' via wireway EI427. From 2C23-4 the cables are routed down through floor elevation 386' into the cable spreading room via wireway EJ426. 3.4.19 Cable Routing From Process Protective Cabinet 2C15-1 To CPC Termination Cabinet 2C394 The routing described in this section is applicable to the signal cables associated with the follewing PPS process measurement sensors: High Pressurizer Pressure 2144601-1 S/G A Hot Leg Temperature 2TE4610-1 2TE4635-1 S/G B Hot Leg Temperature 2TE4710-1 2TE4735-1 A RCP B Cold Leg Temperature 2TE4611-1 RCP C Cold Irg Temperature 2TE4711-1 RCP A Speed 2SE6120-1 RCP B Speed 2SE6130-1 RCP C Speed 2SE6140-1 RCP D Speed 2SE6150-1 As shown on drawings E-2868, E-2870, E-2885 and E-2889 the routing of these signal cables is as follows: From 2C15-1 the cables are routed down through floor elevation 404' via cable tray EI103. The signal cables drop into cable tray EIl04 which mns above the hallway outside the west control room wall. The cables mn north several feet in EIl04 to wireway Ell 27. I The cables are routed down through floor elevation 386' and through the west O wall of the cable spreading room via wireway E1127 to wireway EI125. Document No. 6370-ICE-3316 Revision 00 Page 129 of 257 l l
93 R-2003-01 Conduit Elll22 completes the routing to cabinet 2C394 which is located in the O-V south west corner of the cable spreading room. This conduit enters the cabinet from the top. 3.4.20 Cable Routing From Process Protective Cabinet 2C15-2 To CPC Termination Cabinet 2C396 The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: High Pressurizer Pressure 2PT4601-2 S/G A Hot Ixg Temperature 2TE4610-2 2TE4635-2 S/G B Hot Leg Temperature 2TE4710-2 2TE4735-2A RCP A Cold Leg Temperature 2TE4611-2 RCP D Cold Leg Temperature 2TE4711-2 RCP A Speed 2SE6120-2 RCP B Speed 2SE6130-2 RCP C Speed 2SE6140-2 RCP D Speed 2SE6150-2 As shown on drawings E-2868, E-2870, E-2885 and E-2889 the routing of these signal cables is as follows: From 2C15-2 the cables are routed down through floor elevation 404' via cable tray E1215. The signal cables drop into cable tray EI216 which runs above the hallway outside the west control room wall. The cables run north several feet in B216 to wireway B227. The cables are routed down through floor elevation 386' and through the west , wall of the cable spreading room via wireway B227 to wireway EI226. l Conduit E12134 completes the routing to cabinet 2C396 which is located in the l south west corner of the cable spreading room. This conduit enters the cabinet ; from the top. 3.4.21 Cable Routing From Process Protective Cabinet 2C15-3 to CPC Termination Cabinet 2C399 The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors. ; i O ! l 1 Document No. 6370-ICE-3316 Revision 00 Page 130 of 257 ,
93-R 2003-01 High Pressurizer Pressure 2PT4601-3 . S/G A Hot Leg Temperature 2TE4610-3A 2TE4635-3 S/G B Hot Leg Temperature 2TE4710-3A 2TE4735-3A RCP B Cold Leg Temperature 2TE4611-3 RCP C Cold Leg Temperature 2TE4711-3 RCP A Speed 2SE6120-3 RCP B Speed 2SE6130-3 RCP C Speed 2SE6140-3 RCP D Speed 2SE6150-3 As shown on drawings E-2868, E-2870, E-2885 and E-2889 the routing of these signal cables is as follows: From 2C15-3 the cables are routed down through floor elevation 404' via cable tray E1303. The signal cables drop into cable tray EJ304 which runs above the hallway outside the west control room wall. The cables mn north several feet in EI304 to wireway E1327. The cables are routed down through floor elevation 386' and through the west wall of the cable spreading room via wireway EJ327 to wireway EJ326. Conduit EJ3021 completes the routing to cabinet 2C399 which is located in the south west comer of the cable spreading room. This conduit enters the cabinet from the top. 3.4.22 Cable Routing From Process Protective Cabinet 2C15-4 to CPC Termination Cabinet 2C401 The routing described in this section is applicable to the signal cables associated with the following PPS process measurement sensors: High Pressurizer Pressure 2PT4601-4 S/G A Hot leg Temperature 2TE4610-4A 2TE4635-4 S/G B Hot Leg Temperature 2TE4710-4A 2TE4735-4A RCP A Cold Leg Temperature 2TE4611-4 RCP D Cold Leg Temperature 2TE4711-4 RCP A Speed 2SE6120-4 RCP B Speed 2SE6130-4 RCP C Speed 2SE6140-4 RCP D Speed 2SE6150-4 Document No. 6370-ICE-3316 Revision 00 Page 131 of 257
93-R-2003-01 As shown on drawings E-2868, E-2870, E-2885 and E-2889 the routing of these signal cables is as follows:
- From 2C15-4 the cables are routed down through floor elevation 404' via cable tray EJ415.
The signal cables drop into cable tray EI416 which nms above the hallway outside the west control mom wall. The cables mn north several feet in EI416 to wireway EI427.
- The cables are routed down through floor elevation 386' and through the west wall of the cable spreading room via wireway EJ427 to wireway EI426.
Conduit EI4037 completes the routing tu cabinet 2C401 which is located in the south west corner of the cable spreading room. This conduit enters the cabinet from the top. 3.4.23 Cable Routing From Instrument Cabinet 2C336-1 To Plant Protection System Cabinet 2C23-1 The routing described in this section is applicable to the B steam generator hot leg temperature input signal to the EFAS bypass circuit,2TE4735-1B. As shown on drawings E-2868, E-2885, E-2889 and E-2892 the channel 1 signal cable routing from instrument cabinet 2C336-1 located on EL. 386'-0" in control room to plant protection system cabinet 2C23-1, which is also located in control room, is as follows: From instrument cabinet 2C336-1 the signal cable is routed via conduit EJ1097 to cabinet 2C18-1 and then through floor to junction box 2JB057 which is mounted on ceiling of cable spreading room. From junction box 2JB057, routing continues via conduit Ell 100 to wireways Ell 25 and EJ126, both of which are located in cable spreading room, to cabinet 2C23-1. 3.4.24 Cable Routing From Instrument Cabinet 2C336-2 To Plant Protection System Cabinet 2C23-2 The routing described in this section is applicable to the B steam generator hot leg temperature input signal to the EFAS bypass circuit,2TE4735-2B. As shown on drawings E-2868, E-2870, E-2885 and E-2892 the channel 2 signal cable routing from instrument cabinet 2C336-2 located on EL. 386'-0" in control room to plant protection system cabinet 2C23-2, which is also located in control room O is as follows: Document No. 6370-lCE-3316 Revision 00 Page 132 of 257
93-R-2003-01 From instrument cabinet 2C336-2 the signal cable is routed via conduit EI2104 ( to cabinet 2C18-2 and then through floor to junction box 2JB059 which is \- mounted on ceiling of cable spmading room. From junction box 2JB059, routing continues via conduits EI2095 and FJ2096 to cabine-t 2C16. From 2C16, the cable is routed in conduit EJ2078 to wireways EJ225 and EJ226, both of which are located in cable spreading room, to cabinet 2C23-2. 3.4.25 Cable Routing From Instrument Cabinet 2C336-3 To Plant Protection System Cabinet 2C23-3 The routing described in this section is applicable to the B steam generator hot leg temperature input signal to the EFAS bypass circuit, 2TE4735-3B. As shown on drawings E-2868, E-2870 and E-2885 the channel 3 signal cable routing from instmment cabinet 2C336-3 located on EL. 386'-0" in control room to plant protection system cabinet 2C23-3, which is also located in control room is as follows: From instrument cabinet 2C336-3 the signal cable is routed via conduit EJ3015 to cable tray EI304 located in ceiling space above the hallway outside the west control room wall. O V From cable tray EI304 the routing continues via ET327, which is a vertical wireway located in hallway west of control room, down to wireway EI326 located in cable spreading room. The route then continues in wireway EJ326 up into cabinet 2C23-3. 3.4.26 Cable Routing From Instrument Cabinet 2C336-4 To Plant Protection System Cabinet 2C23-4 The routing described in this section is applicable to the B steam generator hot leg temperature input signal to the EFAS bypass circuit,2TE4735-4B. As shown on drawings E-2868, E-2870 and E-2885 the channel 4 signal cable routing from instmment cabinet 2C336-4 located on EL. 386'-0" in control room to plant protection system cabinet 2C23-4, which is also located in control room is as follows: From instrument cabinet 2C336-4 the signal cable is routed via conduit EI4031 above control room ceiling to cable trays E1417 and EI416 located in ceiling space above hallway west of control room. The routing continues from cable tray EI416 to cable tray EI427, which is a vertical wireway located in hallway west of control room. Document No. 6370-ICE-3316 Revision 00 Page 133 of 257
i 93-R-2003-01 From wireway EJ427 the route continues via wireway FJ426 up to cabinet
/O 2C23-4.
G 3.4.27 Cable Routing From Plant Protection Sys'em Cabinet 2C23-1 To CPC Termination Cabinet 2C394 The routing described in this section is applicable to the CPC LPD and DNBR trip output signals, and the upper, middle and lower linear power signals from excore safety channel detector 2JE9004. As shown on drawings E-2868, E-2885 and E-2889 the routing for this signal cable is as follows: The cable is routed down through floor elevation 386' via wireway EJ126. Conduit EJll22 completes the routing to 2C394 which is located almost directly below 2C23 in the south west corner of the cable spreading room. The cable enters 2C394 from the top. 3.4.28 Cable Routing From Plant Protection System Cabinet 2C23-2 to CPC Termination Cabinet 2C396 The routing described in this section is applicable to the CPC LPD and DNBR trip output signals, and the upper, middle and lower linear power signals from excore safety channel detector 2JE9005. As shown on drawings E-2868, E-2885 and E-2889 the routing for this signal cable is as follows: The cable is routed down through floor elevation 386' via wireway EI226. Conduit EJ2134 completes the routing to 2C396 which is located almost directly below 2C23 in the south west corner of the cable spreading room. The cable enters 2C396 from the top. 3.4.29 Cable Routing From Plant Protection System Cabinet 2C23-3 to CPC Termination Cabinet 2C399 The routing described in this section is applicable to the CPC LPD and DNBR tnp output signals, and the upper, middle and lower linear power signals from excore safety channel detector 2JE9006. l l As shown on drawings E-2868, E-2885 and E-2889 (he routing for this signal cable is as follows: The cable is routed down titrough floor elevation 386' via wireway EJ326. Document No. 6370-ICE-3316 Revision 00 Page 134 of 257 l
93-R-2003-01 Conduit EI3021 completes the routing to 2C399 which is located almost A directly below 2C23 in the south west corner of the cable spreading room. O The cable enters 2C399 from the top. 3.4.30 Cable Routing From Plant Protection System Cabinet 2C23-4 to CPC Termination Cabinet 2C401 The routing described in this section is applicable to the CPC LPD and DNBR trip output signals, and the upper, middle and lower linear power signals from excore safety channel detector 2JE9007. As shown on drawings E-2868, E-2885 and E-2889 the routing for this signal cable is as follows: The cable is routed down through floor elevation 386' via wireway EI426. Conduit EJ4037 completes the routing to 2C401 which is located almost directly below 2C23 in the sova vest corner of the cable spreading room. The cable enters 2C401 frorr. the top. 3.4.31 Cable Routing From RWT Level Transmitter 2LT5636-1 To Process Protective Cabinet 2C15-1 O As shown on drawings E-2836, E-2866, E-2868, E-2870, E-2882, E-2885 anci E-2889 the channel 1 signal cable routing from RWT level transmitter 2LT-5636-1 located on west side of refueling water tank 2T3 to process protective cabinet 2C15-1 located on EL. 404'-0" in panel room no. 2150 is as follows: The 2LT5636-1 signal cable is routed via embedded conduit EJ1014 to junction box 2JB639 located on west side of sodium hydrox.ide tank above EL. 355 '-4 " . The routing continues from junction box 2JB639 via embedded conduit Ell 013 to junction box 2JB498 located on floor EL. 354'-0" at column lines B2 and 5. From junction box 2JB498 the route continues via conduit El1032 to wireway Ell 25, which is located in cable spreading room at EL. 381'-11". From wireway EJ125 the cable is routed via wireway EJ127 to cable tray EIl03, which is located in the ceiling space east of decontamination room at EL. 398'-0". Cable is then routed up into cabinet 2C15-1 via cable tray Ell 03. lO Document No. 6370-ICE-3316 Revision 00 Page 135 of 257
93-R 2003-01 3.4.32 Cable Routing From RWT Level Transmitter 2LT-5637-2 To Process Protective h J Cabinet 2C15-2 As shown on drawings E-2836, E-2867, E-2868, E-2870, E-2882, E-2885 and E-2889 the channel 2 signal cable routing from RWT level transmitter 2LT-5637-2 located on the east side of refueling water tank 2T3 to process protective cabinet 2C15-2 located on El. 404'-0" in panel room no. 2150 is as follows: The 2LT-5637-2 signal cable is routed via conduit EJ2008 to junction box 2JB640 located on south side of sodium hydroxide tank above EL. 355'-4". The routing continues from junction box 2JB640 via embedded conduit EI2009 to junction box 2JB053 located on floor EL. 354'-0" at column lines B2 and 5. From junction box 2JB053 the route continues via conduit B2038 to cabinet 2C16 then through conduit EJ2092 to wireway EI225, which is located in the cable spreading room. From wireway EI225 the routing continues via EJ227, which is a vertical wireway located in hallway west of control room. From wireway EJ227 the route continues via cable trays EJ216 and EJ215, which are both located above ceiling in hallway west of control room, to cabinet 2C15-2. 3.4.33 Cable Routing From RWT Level Transmitter 2LT-5639-3 To Process Protective Cabinet 2C15-3 As shown on drawings E-2836, E-2866, E-2868, E-2870, E-2882, E-2885, E-2887 and E-2889, the channel 3 signal cable routing from RWT level transmitter 2LT-5639-3 located on the nonh side of refueling water tank 2T3 to process protective cabinet 2C15-3 located on EL. 404'-0" in panel room no. 2150 is as follows: The 2LT-5639-3 signal cable is routed via embedded conduit EJ3001 to junction box 2JB499 located on floor EL. 354'-0" at column lines B2 and 5. From junction box 2JB499 the route continues via conduit EJ3006 to wireway E1325, which is located in cable spreading room. From wireway EJ325 the routing continues via EJ327, which is a vertical wireway located in hallway west of control room. From wireway EJ327 the cable is routed via cable trays EI304 and EI303, which are both located above ceiling in hallway west of control room, to q cabinet 2C15-3. k/ l l Document No. 6370-ICE-3316 Revision 00 Page 136 of 257
93-R-2003-01 3.4.34 Cable Routing From RWT Level Transmitter 2LT-5640-4 To Process Protective Cabinet 2C15-4 . As shown on drawings E-2836, E-2867, E-2868, E-2870, E-2882, E-2885 and E-2889 the channel 4 signal cable routing from RWT level transmitter 2LT-5640-4 - located on the west side of refueling water tank 2T3 to process protective cabinet. 2C15-4 located on EL. 404'-0" in panel room no. 2150 is as follows: The 2LT-5640-4 signal cable is routed via conduit EJ4032 to terminal box 2TB644 located on south side of refueling water tank 2T3. From terminal box 2TB644 the route continues via embedded conduit EI4001 ' to junction box 2JB054 located on floor EL.154'-0" at column lines B2 and 5. From junction box 2JB054 the route continues via conduit EI4016 to wireway EI425, which is located in the cable spreading room. From wireway EI425 the routing continues via EI427, which is a vertical wireway located in the hallway west of the control room. From wireway EI427 the cable is routed via cable trays EI416 and EI415, which are both located above ceiling in hallway west of control room, to O cabinet 2C15-4. 3.4.35 Separation Between PPS Process Measurement Channels Within The South Electrical Penetration Rooms And IIallway North Of Column Line C2 As discussed in Sections 3.4.1, 3.4.5 and 3.4.9, the following channel 1 (red) raceways are routed through this area: Cable Tray EIl05 Cable Tray Ell 06 Conduit EJ1079 As discussed in Sections 3.4.3,3.4.7 and 3.4.11, the following channel 3 (yellow) raceways are routed through this area: Cable Tray EJ306 Cable Tray EI307 Conduit EJ3013 As shown on drawings E-2868 and E-2891, the minimum horizontal separation between these channel 1 and 3 cable trays occurs at the column line C2 wall and is 4'-6". At this location both cable trays, El105 and EI306, are at elevation 400'-3". t Channel I conduit EJ1079 is run 1" below cable tray EI306 which has a bottom cover. Conduit EI3013 is mn greater than 1" below cable tray EJ105 which has a Document No. 6370-ICE-3316 Revision 00 Page 137 of 257
I i 93-R-2003-01 s covered bottom. Conduits EJ1079 and E3013 mn parallel to each other above the hallway between column lines 2 and 4. A minimum separation distance greater than . 1" is maintained. All conduit and cable trays sitilized for these routings contain only cables associated with the respective PPS channel. In summag, sepamtion between PPS measurement channels in the south electrical penetration area is consistent with the requirements of Section 1.4. 3.4.36 Separation Between PPS Process Measurement Channels Within The North ; Electrical Penetration Rooms As discussed in Sections 3.4.2, 3.4.6, 3.4.10, 3.4.13 and 3.4.14, the following channel 2 (green) raceways, junction boxes and cabinets are located in this ' area: Cable Tray EI210 Cable Tray EJ211 , Cable Tray EI212. Embedded Conduit EI2013 , Embedded Conduit EJ2014 Embedded Conduit EJ2019 Embedded Conduit EJ2080 Conduit E12081 Conduit EI2115 i Junction Box 2JB30K Cabinet 2C384 i As discussed in Sections 3.4.4,3.4.8 and 3.4.12 the following channel 4 (blue) raceways and junction boxes are located in this area: Cable Tray EI410 Cable Tray EI411 Cable Tray EI412
- Embedded Conduit EJ4003 Embedded Conduit EJ4007 ,
Embedded Conduit EI4027 Conduit EJ4028 Junction Box 2JB30L As shown on drawing E-2890, cable trays EI210 and EJ211 are located at elevation 389'-11". Channel 4 cable trays EJ411 and EI412 are located at elevation 375'. Cable tray EJ410 mns up through floor elevation 386' and ends at elevation 388'. Channel 2 cables are airlined between cable tray EJ210 and embedded conduit EI2019. Channel 4 cables entering embedded _ conduit EI4003 are exposed since cable tray covers are not in place on tray EI410. Appendix F documents that the separation distance between these Channel 2 and 4 cables is suf6cient to satisfy the requirements of this analysis. Junction boxes 2JB30K and 2JB30L are mounted side by side at elevation 394'. Conduit EI2081 enters 2JB30K from the top. Conduit Document No. 6370-ICE-3316 Revision 00 Page 138 of 257
93-R-2003-01 EI4028 enters 2JB30L from the bottom. A minimum one inch separation distance between these junction boxes and conduits is maintained. Channel 2 cables are airlined between cable tray EI210 and embedded conduit EI2026. Appendix F documents that the separation distance between these Channel 2 cables and Channel 4 conduit B4028 is sufficient to satisfy the requirements of this analysis. Instmment cabinet 2C384 is above floor elevation 386' and well separated from all channel 4 raceways. In summary, separation between PPS measurement channels in the north electrical penetration area is corsistent with the requirements of Section 1.4. 3.4.37 Separation Between PPS Process Measurement Channels Within The Area West Of The Control Room On Elevation 386' As discussed in Sections 3.4.1, 3.4.5, 3.4.9, 3.4.15, 3.4.19, and 3.4.31 the following channel 1 (red) raceways are routed through this area: Cable Tray EIl03 Cable Tray B104 Cable Tray Ell 05 Wireway Ell 27 Conduit B1079 As discussed in Sections 3.4.2, 3.4.10, 3.4.14, 3.4.16, 3.4.20 and 3.4.32 the following channel 2 (green) raceways are routed through this area: Cable Tray EI215 Cable Tray EI216 Cable Tray EI217 Cable Tray EI218 Wireway EI227 As discussed in Sections 3.4.3, 3.4.7 3.4.11, 3.4.17, 3.4.21 and 3.4.33 the following channel 3 (yellow) raceways are routed through this area: Cable Tray EJ303 Cable Tray EI304 Cable Tray EI305 Wireway EI327 Conduit EJ3013 Conduit EI3015 As discussed in Sections 3.4.4, 3.4.12, 3.4.18, 3.4.22 and 3.4.34 the following channel 4 (blue) raceways are routed through this area:
~
l - Cable Trays EJ415 Cable Trays EJ416 Document No. 6370-ICE-3316 Revision 00 Page 139 of 257
93-R-2003-01 Cable Trays EJ417 O - Cable Trays EI418 Wireway E1427 Conduit EI4031 As shown on drawing E-2868 there is a horizontal separation of l'-6" between cable trays EJ103/104 and EI304/305 above the decontamination room. This is acceptable since this room meets the requirements of a non hazard area. As shown on drawing l E-2870, the cable trays associated with each of the four PPS measurement channels l are stacked one above the other along the length of the hallway west of the control j room. A minimum vertical separation distance of l'-4" exists between these I redundant cable trays. This sepamtion distance is acceptable since covers are in place on all of the above mentioned cable trays located above this hallway. Wireways , Ell 27 through 427 are also enclosed raceways and therefore a one inch separation between redundant channels is acceptable. Conduits El1079 and EJ3013 nm parallel to each other between column lines C2 and B2 above the column line 4 hallway. A minimum separation distance of one inch has been maintained between these two conduit mns. The vertical cable trays that serve the process protective cabinet (EJ103, EI216, EJ303, and EI416) have a horizontal separation of more than three feet. All conduit and cable trays utilized for these routings contain only cables associated with the respective PPS channel. See Appendix F for additional evaluation of this area. In summary, separation between PPS measurement channels within the area west of , O the control room on elevation 386' is consistent with the requirements of Section 1.4. 3.4.38 Separation Between PPS Process Measurement Channels Within The Area North Of The Control Room On Elevation 386' As discussed in Sections 3.4.2, 3.4.6, 3.4.10 and 3.4.14 the following channel 2 (green) meeways and junction boxes are located in this area: Cable Tray EI219 Cable Tray EJ220 Embedded Conduit EJ2013 Embedded Conduit EI2014 Embedded Conduit EI2019 Embedded Conduit EJ2080 Conduit EI2079 Junction Box 2JB033 As discussed in Sections 3.4.4,3.4.8 and 3.4.12 the following channel 4 (blue) raceways and junction boxes are located in this area: Cable Tmy E1419 Cable Tray E1420 O - Embedded Conduit E14003 Embedded Conduit EI4007 Document No. 6370-ICE-3316 Revision 00 Page 140 of 257
93-R-2003-01 Embedded Conduit EI4027 O - Conduit E14026 Junction Box 2JB034 As shown in Section C of drawing E-2868, cable trays EJ219 and EJ420 have a venical separation distance of less than 3'. This is acceptable since cable tray covers are in place. Channel 2 cables are airlined between cable trays EI219/B220 and embedded conduits EI2013/EJ2014/EJ2019. Channel 4 cables are airlined between cable trays EI419/EI420 and embedded conduits EJ4003/EI4007. Appendix F documents that the separation distance between these Channel 2 and 4 cables is sufficient to satisfy the requirements of this analysis. Junction boxes 2JB033 and 2JB034 are mounted side by side at elevation 399'-0". As shown in Section F of dmwing E-2868, these two junction boxes are separated by more than one inch. Conduits EI2079 and EI4026 run parallel to each other between column line D2 and the control room. A minimum one inch separation exists between these conduits. All conduit and cable trays utilized for these routings contain only cables associated with the respective PPS channel. In summary, separation between PPS measurement channels within the area north of the control room on elevation 386' is consistent with the requirements of Section 1.4. 3.4.39 Separation Between PPS Process Measurement Channels Within The Control Room As discussed in Sections 3.4.5, 3.4.9, 3.4.15, 3.4.23 and 3.4.27 the following channel 1 (red) raceways are located in the control room: Wireway EJ126 Conduit EJ1079 Conduit Ell 097 As discussed in Sections 3.4.6, 3.4.10, 3.4.16, 3.4.24 and 3.4.28 the following channel 2 (green) raceways are located in the control room: Wireway EJ226 Conduit EJ2079 Conduit EJ2104 As discussed in Sections 3.4.7, 3.4.11, 3.4.17, 3.4.25 and 3.4.29 the following channel 3 (yc llow) raceways are located in the control room: Wireway EI326 Cr nduit EJ3013 ' Conduit EI3015 1 Document No. 6370-ICE-3316 Revision 00 Page 141 of 257 l i
93-R-2003-01 p v As discussed in Sections 3.4.8, 3.4.12, 3.4.18, 3.4.26 and 3.4.30 the following channel 4 (blue) raceways are located in the control room: Wireway B426 Conduit EI4026 Conduit EI4031 The four wireways identified above penetrate the control mom floor directly below the corresponding bay of the PPS cabinet. These wireways are enclosed raceways and the separation exceeds the minimum one inch required distance. Conduits B1079 and B3013 penetrate the control room west wall in the ceiling space adjacent to the PPS cabinet. The conduits mn parallel to each other for several feet before : entering the respective PPS cabinet bay from the top. Conduits EJ2079 and EI4026 penetrate the control room north wall in the ceiling space. These conduits mn parallel to each other across the length of the control room before entering the respective PPS cabinet bay from the top. Conduits EJ1097 and B2104 are routed in the control room ceiling from cabinet 2C18 to the corresponding bay of cabinet 2C336. Conduits B3015 and EJ4031 are routed between 2C336 and the west control room wall in the ceiling space. A minimum separation distance of one inch has been maintained between all of the above conduits. All conduit and wireways utilized for i these routings contain only cables associated with the respective PPS channel. O In summary, separation between PPS measurement channels within the control room is consistent with the requirements of Section 1.4. 3.4.40 Separation Between PPS Process Measurement Channels Within the Cable Spreading Room As discussed in Sections 3.4.9, 3.4.15 3.4.19, 3.4.23, 3.4.27 and 3.4.31 the following channel 1 (red) raceways and junction boxes are located in this area: Wireway EJ125 Wireway B126 Wireway EI127 Conduit EJ1032 Conduit Ell 100 Conduit EJ1122 Junction Box 2JB057 As discussed in Sections 3.4.10, 3.4.16, 3.4.20, 3.4.24, 3.4.28 and 3.4.32 the following channel 2 (green) raceways and junction boxes are locaiad in this area: Wireway EJ225 1 Wireway E1226 . Wireway B227 Conduit B2038 , l l Document No. 6370-ICE-3316 Revision 00 Page 142 of 257 ; l
i 93-R-2003-01 Conduit EJ2078 ' O - Conduit EJ2092 Conduit EJ2095 Conduit E12096 Conduit 92134 ; Junction Box 2JB059 As discussed in Sections 3.4.17,3.4.21,3.4.25,3.4.29 and 3.4.33 the following channel 3 (yellow) raceways are routed through this area: Wireway EI325 Wireway EJ326 Wireway EJ327 Conduit EJ3006 Conduit EJ3021 As discussed in Sections 3.4.18, 3.4.22, 3.4.26, 3.4.30 and 3.4.34 the following > crannel 4 (blue) raceways are routed through this area: Wireway EI425 , Wireway EI426 Wireway EI427 Conduit EJ4016 Conduit EI4037 As shown on drawings E-2885 and E-2889, wireways EJ125, EJ225, EJ325 and EI425 mn east / west across the cable spreading room. They feed into wireways ; Ell 27, EJ227, EJ327 and EI427 at the west _wal.l. Wireways B126, EJ226, EJ326-and EJ426 tee off near the west wall and extend up through floor elevation 386' into. J the PPS cabinet. All of these raceways are 8" x 8" enclosed wireways'. A minimum separation distance of 1/2".is maintained between redundant wimways within the cable spreading room. As allowed by Reg. Guide 1.75 and IEEE Standard 384, this i separation distance of less than 1" between enclosed raceways has been evaluated and ' found to be acceptable. This msult is based on the _following: These wireways are located within the cable spreading room and are not subject to external hazards (e.g., fires, missiles and high energy. lines). See Attachment F of Appendix F for additionaljustification, j These wireways do not contain power cables of any voltage. . The typical cable routed in these wireways is a single twisted shielded pair- ; cable carrying either a 1-5 VDC or a 4-20 mA signal. ) t All cables have a minimum insulation rating of 600 volts. P O l i Document No. 6370-ICE-3316 Revision 00 Page 143 of 257
93-R.-2003-01 As shown in Section B of drawing E-2889, conduits EJ1032, B2038, EJ3006 and EJ4016 enter the cable spreading room from elevation 354' at column lines B2 and 5. These conduits are then routed to the corresponding nearby wireways. Conduits EJ1122, E2134, EJ3021 and EJ4037 are routed between the associated wireway and CPC termination cabinet in the south west corner of the cable spreading room. Junction boxes 2JB057 and 2JB058 am mounted on the ceiling beneath cabinet 2C18. Conduit EJ1100 is routed between B125 and 2JB057. Conduits EI2078, EJ2095 and E2096 are routed between EI225 and 2JB059. All of these conduits are separated by a minimum of 1". All conduit and wireways utilized for these routings contain only cables associated with the respective PPS channel. In summary, separation between PPS measurement channels within the cable spreading room is consistent with the requirements of Section 1.4. O O Document No. 6370-ICE-3316 Revision 00 Page 144 of 257
93-R.-2003-01 3.4.41 Separation Between The RWT Level Channels Below Elevation 372' O The routing of the four RWT level transmitter signal cables is described in Sections 3.4.31 through 3.4.34. As shown on drawing E-2882, the four level transmitters are dispersed around the periphery of the RWT. The closest two transmitters,2LT5636-1 and 2LT5640-4, are separated by more than 10'. Signal cables from the channel 1, 2 and 4 transmitters are routed to nearby junction boxes. The closest two junction boxes,2JB639 and 2JB640, are separated by more than 10'. Each of the four level signals are then routed into the auxiliary building via separate embedded conduits. As shown in Section A of drawing E-2866, a minimum separation distance of greater than 1" exists between junction boxes 2JB053 and 2JB054. As shown in Section B of drawing E-2887 from drawing E-2866,1" is also maintained between 2JB498 and 2JB499. From these junction boxes each level signal is routed up through floor elevation 372' via individual conduits that maintain a separation of at least 1" between redundant channels. All conduit utilized for these routings contain only cables associated with the respective PPS channel. In summary, separation between the RWT level channeIs below elevation 372' is consistent with the requirements of Section 1.4. 3.4.42 Channel Separation At The Plant Protection System Cabinet 2C23 O The PPS cabinet assembly,2C23 is comprised of four (4) physically separate bays 2C23-1,2C23-2,2C23-3 and 2C23-4 associated with the four (4) PPS channels respectively. The physical separation between the PPS channels housed in the PPS cabinet 2C23 is maintained by mechanical and thermal barriers. The PPS process measurement signals are channelized and their entries to the associated cabinet bay are through fireproof floor penetrations at each bay. There are no interbay connections associated with the measurement signals at the PPS cabinet. As described previously, drawings E-2868, E-2870, E-2885 and E-2889 show the process measurement cable entries to each cabinet bay as follows: Channel I cables arrive at the cabinet bay 2C23-1 via wireway EJ126, and conduit EJ1079. Channel 2 cables arrive at the cabinet bay 2C23-2 via wireway EJ226 and conduit EJ2079. Channel 3 cables arrive at the cabinet bay 2C23-3 via wireway EJ326 and conduit B3013. Channel 4 cables arrive at the cabinet bay 2C23-4 via wireway EJ426, and conduit EI4026. O Document No. 6370-ICE-3316 Revision 00 Page 145 of 257
93-R-2003-01 3.4.43 Channel Separation At The Process Protective Cabinet 2C15 Process protective cabinet 2C15 is comprised of four physically separate bays 2C15-1,2C15-2,2C15-3 and 2C15-4 associated with the four (4) PPS process measurement channels respectively. The physical separation between the PPS process measurement channels at the cabinet assembly 2C15 is maintained by fireproof mechanical barriers. The channelized PPS process measurement signals enter and exit the associated cabinet bay through Door penetrations. With the exception of the auctioneered power supplies for steam generator level and RWT level instrument loops B and C, there are no interbay connections associated with the measurement signals at the process protective cabinet. Interbay wiring associated with these auctioneered power supplies is routed in rigid steel conduit. The design maintains the integrity of the interbay nreproof mechanical barriers. As described previously, drawings E-2868, E-2885 and E-2889 show the PPS process measurement cable entries to each cabinet bay as follows: Channel I cables arrive at (or leave) cabinet bay 2C15-1 via cable tray EJ103. Channel 2 cables arrive at (or leave) cabinet bay 2C15-2 via cable tray EI215. Channel 3 cables arrive at (or leave) cabinet bay 2C15-3 via cable tray EJ303. Channel 4 cables arrive at (or leave) cabinet bay 2C15-4 via cable tray E1415. O 3.4.44 Channel Separation At The CPC Termination Cabinets There are four (4) physically sepamte CPC termination cabinet assemblies. Each assembly is associated with one of the four (4) PPS measurement channels and is separated from the others by space and mechanical barriers. There are two bays for each CPC cabinet assembly and they are identified as follows: Channel 1 - CPC Tennination Cabinet - 2C394 l CPC Computer Cabinet - 2C395 Channel 2 - CPC Tennination Cabinet - 2C396 CPC Computer Cabinet - 2C397 Channel 3 - CPC Termination Cabinet - 2C399 CPC Computer Cabinet - 2C398 Channel 4 - CPC Termination Cabinet - 2C401 i CPC Computer Cabinet - 2C400 l The separation between the cabinets of each channel is provided by mechanical l barriers and space (greater than minimum required). The channelized PPS measurement signals and the DNBR and LPD trip signals enter and exit the associated cabinet assembly through rigid steel conduits. O Document No. 6370-ICE-3316 Revision 00 Page 146 of 257
93-R-2003-01 As described previously, drawings E-2868, E-2885 and E-2889 show the O measurement and trip output signal cable interface with the CPC termination cabinets as follows: Channel I cables arrive at (or leave) cabinet 2C394 via conduit B1122. Channel 2 cables arrive at (or leave) cabinet 2C396 via conduit E12134. Channel 3 cables arrive at (or leave) cabinet 2C399 via conduit EJ3021. Channel 4 cables arrive at (or leave) cabinet 2C401 via conduit EJ4037. 3.4.45 Channel Separation At Instrument Cabinet 2C336 There are four (4) physically separate instrumentation cabinet assemblies 2C336-1, 2C336-2,2C336-3 and 2C336-4 associated with the four (4) PPS measurement channels respectively. The separation between each assembly is provided by 6 reproof mechanical barriers. The channelized PPS process measurement signals enter and exit the associated cabinet assembly through rigid steel conduits. There are no inter channel connections associated with the measurement signals at these cabinet assemblies. As described previously, drawings E-2839, E-2868 and E-2890 show the process measurement cable entries to each cabinet assembly as follows: Channel I cables arrive at (or leave) cabinet 2C336-1 via conduit EJ1097. Channel 2 cables arrive at (or leave) cabinet 2C336-2 via conduit EI2104. Channel 3 cables arrive at (or leave) cabinet 2C336-3 via conduit E13015. 1 Channel 4 cables arrive at (or leave) cabinet 2C336-4 via conduit EJ4031. O Document No. 6370-ICE-3316 Revision 00 Page 147 of 257
93-R-2003-01 3.5 High Energy Line Break Analysis In accordance with the March 31,1982 NRC letter of Appendix E, this part of the analysis will demonstrate that a high energy line break in coincidence with the bypass of a channel will not negate the minimum acceptable redundancy of the protection system required by IEEE Standard 279-1971. Since one channel will be assumed to be in bypass, the analysis must demonstrate that those portions of the protection system credited in the safety analysis with mitigating the effects of a HELB will not be adversely affected by that break. Since all protection system components located in a harsh environment are qualified for that environment, the only effects of a line break which need be further addressed in this analysis are jet impingement and pipe whip. It should be noted that the electrical penetration rooms are not classified as harsh environment areas. The electrical penetation rooms would be automatically isolated from the effects of a HELB in the associated piping penetration room via closure of ventilation system dampers which were installed during refueling outage 2R9. SAR Section 3.6 identifies all high energy lines and their credible break locations. For convenience this discussion has been organized to coincide with the discussion presented in SAR Section 3.6. 3.5.1 HELB Analysis - Outside Containment a) Main Steam Lines Main steam line 2EBD 1 runs within a vertical pipe chase between elevations 428'-4" and 346'-0* at column lines H2/J2 and 4 of the turbine auxiliary building. The other main steam line 2EBD-2 runs within the same pipe chase between elevations 436'-3" and 346'-0". Both lines are then routed east to the turbine building through the main steam tunnel. As shown in SAR Figures 3.6-5. and 3.6-6, break points in both lines are postulated just below floor elevation 404'. On main steam line 2EBD-2 a second break point is postulated on the 90 degree elbow at the bottom of the vertical pipe chase. The concrete wall between the pipe chase and the north electrical penetration room will prevent a main steam line break from adversely affecting a PPS measurement channel. All other postulated break locations are in the turbine building, and therefore, not in the vicinity of any PPS measurement channel signals. b) Main Feedwater Lines The routing of the main feedwater lines in the turbine auxiliary building l between the north piping penetration room and column line 5 is shown on drawings M-2032 and M-2033. As shown on SAR Figures 3.6-7, 3.6-8 and ) 3.6-9, break points are postulated at the containment penetmtion of each main feedwater line. As discussed in detail in SAR Section 3.6.4.1.2.2, a feedwater line break at the penetration will not compromise the structural integrity of the electrical penetation room floor. Therefore, these postulated break locations O can not adversely affect any PPS measurement channel. All channel 2 and 4 PPS signals are routed in embedded conduit from the north electrical Document No. 6370-ICE-3316 Revision 00 Page 148 of 257 l l
93:R:2003-01 penetration room to a location near column line D2 . Therefore all PPS measurement channel signals are widely separated from all other postulated main feedwater line break locations, c) Steam Generator Blowdown As shown in SAR Figures 3.6-10,3.6-11 and 3.6-12, all portions of the steam generator blowdown piping are below elevation 368'. With the exception of the RWT level signals, all PPS measurement channel signals are above floor elevation 374'-6" in the electrical penetration rooms, and above floor elevation 372' in the containment auxiliary building. The RWT level signals are routed in conduits embedded in the floor slab at elevation 354' between column lines I and 5. The conduit stub-ups near column lines B2 and 5 are widely separated from all blowdown piping. d) Emergency Feedwater As shown in SAR Figures 3.6-13 through 3.6-23, all portions of the emergency feedwater piping are below elevation 368'. With the exception of the RWT level signals, all PPS measurement channel signals are above floor elevation 374'-6" in the electrical penetration rooms, and above floor elevation 372' in the containment auxiliary building. The RWT level signals are routed in conduits embedded in the floor slab at elevation 354' between column lines 1 and 5. The conduit stub-ups near column lines B2 and 5 are widely separated from all emergency feedwater piping. e) Main Steam Supply To Emergency Feedwater Pump Turbine As shown on SAR Figure 3.6-24 and Section P-P of drawing M-2039, the main steam supply line to the emergency feedwater pump turbine runs within a vertical pipe chase between elevations 413' and 350'-3" at column lines G2 and 4 of the turbine auxiliary building. The concrete wall between the pipe chase and the north electrical penetration room will prevent a break in this line from adversely affecting a PPS measurement channel. All other break locations are widely separated from the PPS signal cable routings, f) Main Steam Supply To The Atmospheric Dump Valves As shown in Section P-P of drawing M-2039, the main steam supply lines to the atmospheric dump valves,2 EBB-8-10" and 2 EBB-9-10", are located at column lines H2 and 4. As shown in SAR Figures 3.6-5 and 3.6-6, all postulated break locations are above elevation 425' All PPS measurement channel signals are widely separated from these lines by both distance and intervening concrete stmetures. Document No. 6370-ICE-3316 Revision 00 Page 149 of 257
93 R-2003-01 g) Charging O As shown in SAR Figures 3.6-25 and 3.6-26, the maximum elevation of the charging system piping is 362'-0". With the exception of the RWT level signals, all PPS measurement channel signals are above the floor at elevation 374'-6" in the electrical penetration rooms, and above the floor at elevation 372' in the containment auxiliary building. The RWT level signals are routed in conduits embedded in the floor slab at elevation 354' between column lines I and 5. The conduit stub-ups near column lines B2 and 5 are widely separated from all charging system piping. h) Letdown As shown in SAR Figure 3.6-27 the maximum elevation of the letdown line is 370'-0". With the exception of the RWT level signals, all PPS measurement channel signals are above the floor at elevation 374'-6" in the electrical penetration rooms, and above the floor at elevation 372' in the containment auxiliary building. The RWT level signals are routed in conduits embedded in the floor slab at elevation 354' between column lines 1 and 5. The conduit stub-ups near column lines B2 and 5 are widely separated from the letdown line. i) Steam Supply To Concentrators O As shown in SAR Figures 3.6-28,3.6-29 and 3.6-30, the maximum elevation of the concentrator steam supply lines is 350'-0". With the exception of the RWT level signals, all PPS measurement channel signals are above floor elevation 374'-6" in the electrical penetration rooms, and above floor elevation 372' in the containment auxiliary building. The RWT level signals are routed in conduits embedded in the floor slab at elevation 354'. Concentrator steam supply line 2HBD-180-6" is routed near these embedded conduits at column lines B2 and 1. The floor slab will prevent a postulated break in this steam line from adversely affecting the RWT level signals. 3.5.2 HELB Analysis -Inside Containment a) Reactor Coolant System As described in SAR Section 3.6.2 a break is postulated to occur in any location on the hot and cold leg piping. Breaks may also occur in the h intennediate leg (pump suction) piping from the steam generator to the 45* elbow weld and from the RCP to the 90 elbow weld. The steam generator cavity walls and primary shield walls limit the effects of all postulated RCS l pipe breaks. As detailed in the Chapter 15 LOCA analysis (Section 15.1.13) ! O credit is taken for the following protection system measurement channels: ; Document No. 6370-ICE-3316 Revision 00 Page 150 of 257 l
93-R-2003-01
- Low Pressurizer Pressure - channels 2PT-4624-1 2PT-4624-2 2PT-4624-3 2PT-4624-4
- Containment Pressure - channels 2PT-5601-1 2PT-5602-2 2PT-5603-3 2PT-5604-4 As described in Section 3.3.1, the pressurizer pressure transmitter sensing lines are routed vertically along the inside surface of the south steam generator cavity wall.
The cavity wall sensing line penetrations are located at elevation 381' 7" and 381' 9". As shown on drawings M-2055 and M-2061, the concrete floor around the base of the pressurizer at elevation 381' 4" and the half height wall between the pressurizer and RCP 2P32A, ensure an RCS pipe break will not adversely affect the transmitter sensing lines. As discussed in Section 3.3.4, the containment pressure transmitters are located outside the steam genemtor cavity walls. All cable routing for the pressurizer pressure and containment pressure transmitters is located outside (or embedded within) the steam generator cavity walls. In summary, all protection system measurement channels required to mitigate the consequences of a LOCA are sufficiently separated from the postulated RCS piping break locations to ensure they are not adversely affected by jet impingement or pipe whip. b) Main Steam Lines As shown in SAR Figures 3.6-33 and 3.6-34 main steam line breaks are postulated at both terminal ends and at two intermediate points. The main steam line nozzles are located at elevation 429' 6". The main steam line 2 EBB-1 and 2 EBB-2 containment penetrations are at elevations 428' _4" and 436' 3" respectively. All intermediate break locations are also at elevation 436' 3". Vertical separation distance and intervening floor stmetures limit the effects of all postulated main steam line breaks. As detailed in the Chapter 15 steam line break analysis (Section 15.1.14) credit is taken for the following protection system measurement channels as either the primary trip pammeter or as a backup trip which may occur depending on the severity of the line break:
- Linear Power - channels 2JE-9004 2JE-9005
, 2JE-9006 2JE-9007 Document No. 6370-ICE-3316 Revision 00 Page 151 of 257
93 @ 2003-01
- Low Pressurizer Pressure - channels 2PT-4624-1
( 2PT-4624-2 2PT-4624-3 2PT-4624-4
- Steam Generator A Pressure -channels - 2FT-1041-1 '
2Fr-1041-2 2PT-1041-3 2PT-1041-4
- Steam Generator B Pressure -channels 2PT-1141-1 2FT-1141-2 2PT-1141-3 2PT-1141-4
- Steam Generator A Level -channels 2LT-1031-1 2LT-1031-2 2LT-1031-3 2LT-1031-4
- Steam Generator B Level -channels 2LT-1131-1 2LT-1131-2 2LT-1131-3 2LT-1131-4
- Containment Pressure -channels 2PT-5601-1 2PT-5602-2 2PT-5603-3 2PT-5604-4
- Credit is also taken for LPD and DNBR trips which in turn requires all CPC input signals.
As described in Sections 3.3.2 and 3.3.3 the elevation of the steam generator upper taps is 416' 11.5". The closest distance between a postulated break location and a required protection channel occurs between the condensing pot for 2LT-1131-1 and break location number 20 shown on SAR Figure 3.6-34. The separation distance is greater than 20 feet and there is floor grating between the two at elevation 426' 6". Break location 20 is on the second 90* elbow from the steam generator nozzle. Restraints on both sides of this elbow would prevent the line from impacting the floor stmeture. .All other steam generator level and pressure transmitter sensing lines are separated from the postulated steam line break locations by more than 20 feet and also are below the floor grating at elevation 426' 6". As discussed throughout Section 3.3, p all other protection channel sensors and cable routings are below floor elevation 405' 6". y Document No. 6370-1CE-3316 Revision 00 Page 152 of 257
93-R-2003-01 In summary, all protection system measurement channels required to mitigate the consequences of a steam line break are sufficiently separated from the l postulated break locations to ensure they are not adversely affected by jet I impingement or pipe whip. c) Main Feedwater Line As shown in SAR Figures 3.6-39 and 3.6-40 main feedwater line breaks are postulated at both tenninal ends and at two intermediate locations. For main feedwater line 2DBB-1, the first intermediate break location is at the 24" to 18" reducing elbow outside the steam generator cavity wall at elevation 408' 10 25/38". The second intennediate break location on line 2DBB-1 is at the 90* elbow just below floor elevation 357'. For main feedwater line 2DBB-2 both intermediate break locations are at expansion loop 90 elbows below floor elevation 357'. The 2DBB-1 and 2DBB-2 main feedwater penetrations are located at radial coordinate 67 elevation 370', and radial coordinate 34 elevation 370' respectively. As detailed in the Chapter 15 feedwater line break analysis (Section 15.1.14) credit is taken for the following protection system measurement channels as either the primary trip parameter or as a backup trip which may occur depending on the severity of the line break:
- High Pressurizer Pressure -channels 2PT-4601-1 2PT-4601-2 2PT-4601-3 2PT-4601-4
- Low Pressurizer Pressure -channels 2FT-4624-1 2PT-4624-2 2PT-4624-3 2FT-4624-4
- Steam Generator A Pressure -channels 2PT-1041-1 2PT-1041-2 2PT-1041-3 2PT-1041-4
- Steam Generator B Pressure -channels 2PT-ll41-1 2PT-1141-2 2PT-ll41-3 2PT-1141-4
- Steam Generator A Level -channels 2LT-1031-1 2LT-1031-2 2LT-1031-3 2LT-1031-4 O
Document No. 6370-ICE-3316 Revision 00 Page 153 of 257
93-R-2003-01
- Steam Generator B Level -channels 2LT-1131-1
/ 2LT-1131-2 2LT-1131-3 2LT-1131-4
- Containment Pressure -channels 2FT-5601-1 2PT-5602-2 2FT-5603-3 2PT-5604-4 As described in Sections 3.3.2 and 3.3.3 the safety mlated steam generator instmment taps are located at elevations 416' 11.5" and 402' 10.3". The feedwater nozzle is at elevation 408' 10 25/38" and from a radial perspective is also located in the middle of these eight instrument taps. However, the -
costulated break location on each line is recessed within the steam genemtor cavity wall thus preventing pipe whip. The cavity wall penetmtion also narrowly focuses the credible jet impingement target area into a small diameter circle against the steam generator. Them are no PPS sensors or cables opposite the feedwater penetrations outside the steam generator cavity walls above floor elevation 405' 6". As discussed throughout Section 3.3, the only PPS measurement channel sensors or cable routings below elevation 357' are the excore power range signals. Since these channels are not credited in the FWLB analysis no further evaluation is needed for the remaining three intermediate break locations. The concrete floor slab at elevation 374' 6" ensures a line break at either feedwater penetration can not adversely affect the PPS signals routed to penetration 2WR42-4. In summary, all protection system measurement channels required to mitigate the consequences of a main feedwater line break are sufficiently separated from the postulated break locations to ensure they are not adversely affected by jet impingement or pipe whip. d) Steam Generator Blowdown Lines As discussed in SAR Section 3.6.4.2.4.2, mpture of a steam generator blowdown line does not necessitate protective action. The maximum rate of secondary system fluid loss is within the additional capacity of the main feedwater system. Therefore, operation with one PPS channel in extended bypass does not adversely affect the existing steam generator blowdown line break analysis, e) Emergency Feedwater Lines As shown in SAR Figures 3.6-44 and 3.6-45, emergency feedwater line breaks are postulated at both terminal ends and at two intermediate locations. As O discussed in SAR Section 3.6.4.2.5.2, rupture of an emergency feedwater line upstream of the check valve does not necessitate protective action. The line Document No. 6370-ICE-3316 Revision 00 Page 154 of 257
93-R-2003-01 upstream of the check valve would not be pressurized during power operation, O and the check valve would prevent blowdown of the steam generator through V the rupture. Therefore, no funher evaluation of the upstream postulated break locations is needed. The remaining two break locations on each emergency feedwater line are at the connection to the main feedwater line and at the 90* elbow just upstream. For lines 2DBB-3 and 2DBB-4 these postulated breaks are at elavations 400' 4 5/16" and 370' respectively. Emergency feedwater line breaks downstream of the check valve are treated as small main feedwater breaks. As discussed throughout Section 3.3 there are no PPS sensors or cables located outside the north steam generator cavity wall between floor elevations 357' and 376' 6". Therefore, the two 'oreak locations on 2DBB-4 near the main feedwater line connection can not adversely affect any PPS measurement channels. TN postulated breaks on 2DBB-3 near the main feedwater line connection are located approximately four feet above cable trays SJ105 and SJ106. Channel I steam generator level and pressure signals are routed in these cable trays. Channel 3 steam generator level and pressure transmitters 2LT-1031-3 and 2PT-1041-3 are also located near these postulated breaks at elevation 390'. Although the steam generator level and pressure trip functions are credited in the Chapter 15 analysis for a major feedwater line break, these parameters are not needed to mitigate the consequences of an emergency feedwater line break. Due to the small size of the emergency feedwater lines O (4 inches) and the excess available capacity of the main feedwater system, the steam generator inventory reduction would be relatively gmdual. If steam generator level reached the point where heat transfer was degraded without operator intervention, then a reactor trip on high pressurizer pressure would occur. The emergency feedwater system would be available to supply the intact steam generator for decay heat removal. f) Pressurizer Surge Line As shown in SAR Figure 3.6-46, pressurizer surge line breaks are postulated at both terminal ends and at seven intermediate locations. The surge line is located within the south steam generator cavity. The highest elevation is 380' 9" and is located at the connection to the pressurizer nozzle. A surge line break is a small area LOCA, and as discussed in Section 3.5.2.a of this analysis, credit is taken in the Chapter 15 analysis for the low Pressurizer Pressure and Containment Pressure channels. As detailed in Section 3.3.1, the Pressurizer Pressure transmitter sensing lines are routed vertically along the inside surface of the south steam generator , cavity wall. The cavity wall sensing line penetrations are located at elevation j 381' 7" and 381' 9". As shown on drawings M-2055 and M-2061, the l concrete floor around the base of the pressurizer at elevation 381' 4", and the I half height wall between the pressurizer and RCP 2P32A, asure a surge lint I break will not adversely affect these transmitter sensing lines. As &cmed in Document No. 6370-ICE-3316 Revision 00 Page 155 of 257
93-R-2003-01 Section 3.3.4, the Containment Pressure transmitters are located outside the C steam generator cavity walls. All cable routing for the Pressurizer Pressure and Containment Pressure transmitters is located outside (or embedded within) the steam genemtor cavity walls. In summary, all protection system measurement channels required to mitigate the consequences of a lOCA are sufGeiently separated from the postulated pressurizer surge line break locations to ensure they are not adversely affected by jet impingement or pipe whip. g) Shutdown Cooling Line , The shutdown cooling line, 2CCA-25-14", between the B hot leg and isolation valve 2CV-5084-1 is a high energy line. As shown in SAR Figure 3.6-47, breaks are postulated at both terminal ends and at several intermediate locations. This line is routed along the outer surface of the primary shield wall. 2CV-5084-1 is located at elevation 347' 6", and the connection to the hot leg nozzle is at elevation 367' 4 1/8". Credit is taken for the Low Pressurizer Pressure and Containment Pressure PPS channels in the Chapter 15 LOCA analysis. Since the high energy po tion of the shutdown cooling line is within the north steam generator cavity, the PPS measurement channels required to mitigate the consequences of a break in this line are sufficiently separated to ensure they are not adversely affected by jet impingement or pipe whip. h) Safety Injection Lines Breaks in the 12 inch safety injection lines from the nozzle on each cold leg to the Grst check valve are small area LOCA's. As discussed in SAR Section 3.6.4.2.8.2, safety injection line breaks beyond this first check valve do not require protective action. Therefore, no further evaluation of the upstream break locations is necessary. As previously discussed, credit is taken in the Chapter 15 LOCA analysis for the IAw Pressurizer Pressure and Containment Pressure channels. That portion of each Safety Injection line on the RCS side of the Grst check valve is well within ten feet of the cold leg nozzle. As discussed in Section 3.5.2.a the concrete floor around the base of the pressurizer and the steam generator cavity walls ensure those PPS channels which are required to mitigate the consequences of a LOCA would not be adversely affected by any postulated safety injection line break on the RCS side of the first check valve. O O Document No. 6370-ICE-3316 Revision 00 Page 156 of 257
93-R-2003-01 i) Charging Lines O Breaks in those portions of the charging lines between the RCS connection points and the first upstream check valve are considered small area LOCA's. As discussed in SAR Section 3.6.4.2.9.2, charging line breaks upstream of the Grst check valve do not require protective action, and therefore will not be funher addressed. As previously discussed, cmdit is taken in the Chapter 15 LOCA analysis for the Low Pressurizer Pressure and Containment Pressure channels. The three charging system check valves referred to above are located below floor elevation 357' near the base of reactor coolant pump 2P32A. From this location line 2CCA-27-2" is routed east toward the 2P32B cold leg connection point. Line 2CCA-26-2" is routed up above floor elevation 357' and north toward the 2P32C cold leg connection point. The auxiliary spray line,2CCA-16-2", is routed up and west to the pressurizer spray line connection point at elevation 371'. Once again the concrete floor around the base of the pressurizer and the steam generator cavity walls ensure those PPS channels which are required to mitigate the consequences of a LOCA would not be adversely affected by any postulated charging line break on the RCS side of the Urst check valve. j) Letdown Line O A break anywhere in the letdown line from the 2P32A RCP suction line nozzle to the contaimaent penetration is treated as a small area LOCA. The postulated break locations are shown in SAR Figures 3.6-63 and 3.6-64. As previously discussed, credit is taken in the Chapter 15 LOCA analysis for the low pressurizer pressure and containment pressure channels. As shown on drawings M-2856 and M-2857, the letdown line isolation valves, 2CV-4821-1 and 2CV-4820-2, are located in the south steam generator cavity below floor elevation 357' The regenerative heat exchanger is also in the south steam gerierator cavity just above Door elevation 357', The entire letdown line and in particular that portion between the cavity wall and the containment penetration is below Door elevation 374' 6". Therefore, all PPS channels required to mitigate the consequences of a LOCA are adequately sepamted from all postulated letdown line break locations. Document No. 6370-ICE-3316 Revision 00 Page 157 of 257
93-R.-2003-01 k) Pressurizer Spray Line O A break anywhere in the pressurizer spray line is treated as a small area LOCA. As shown on SAR Figure 3.6-65, breaks are postulated on all welds. As previously discussed, credit is taken in the Chapter 15 LOCA analysis for the low pressurizer pressure and containment pressure channels. As shown on drawings M-2055 and M-2056, the spray line connections to the A and B cold legs,2CCA-13-3" and 2CCA-14-3", are routed within the south steam generator cavity. The pressurizer cubicle floor and half height wall provide adequate sepamtion between these ponions of the spray line and the - pressurizer pressure transmitter sensing lines. As shown on the pressurizer spray system isometric drawings, 2CCA-15-2 and 2CCA-15-4, the spray lines enter the pressurizer cubicle just above elevation 382'. The piping on the downstream side of each spray valve extends toward the nonhwest corner of the pressurizer cubicle. At the closest point the separation distance between the spray line and the sensing line associated with pressurizer pressure transmitters 2PT4601-4 and 2PT4624-4 is less than five feet. The potential for a spray line break to adversely affect this transmitter sensing line was explicitly evaluated in calculation number 82-D-2072-04, revision 1, dated 2/28/88. This calculation considered both jet impingement and pipe whip. It was concluded that the pressurizer pressure sensing line would not be adversely affected by any of the postulated spray line break locations. The remaining portions of the spray line piping are located near the nonheast side of the pressurizer. These sections are separated from the transmitter sensing lines by the pressurizer itself. As previously discussed, the containment pressure channels are not located in this area.
- 1) Low Temperature Overpressure Protection (LTOP)
As discussed in SAR Section 3.6.4.2.12.2, only those Sections of the LTOP , lines between the first block valves and the pressurizer are considered to be high energy lines. An LTOP line break is a small area LOCA, and credit is taken in the Chapter 15 LOCA analysis for the Low Pressurizer Pressure and Containment Pressure channels. The LTOP lines are on top of the pressurizer above the platform at elevation 405' The Pressurizer Pressure instmment nozzles are at elevation 407' 4 3/8". Structumi steel frames built around these nozzles and instmment root valves provide adequate protection against the effects of an LTOP line break. As previously discussed, the containment pressure channels are not located in this area. O Document No. 6370-ICE-3316 Revision 00 Page 158 of 257
3.6 Impact of 2-out-of-3 on Accident Analysis 93-R-2003-01 O U A review of the accident analysis was conducted to verify that bypass of a specific protection channel in coincidence with a single failure of a redundant channel will not prevent the required protective trip for any anticipated operational occurrence (AOO) or accident. Table 3.6-1 lists the Reactor Protection System (RPS) trips relied on for each Safety Analysis Report (SAR) event. Table 3.6-2 lists the Engineered Safety Features Actuation System (ESFAS) trips relied on for each SAR event (for those NSSS ESFAS trips considered in this study). A more detailed evaluation of the functional redundancy of each RPS and ESFAS trip is found in Section 3.2. Asymmetric Events: The accident analysis was reviewed to ensure there are no cases where the prolonged bypass of a specific protection channel in combination with a single failure might jeopardize plant protection. This review looked for cases where the remaining channels will not sufficiently detect transients and accidents for which they are relied upon for protection, without causing unacceptable consequences such as violation of a Specified Acceptable Fuel Design Limit (SAFDL), or excessive fuel damage. The events identified as having asymmetric effects on the plant include: O Excess heat removal events affecting one steam generator
- Increased feedwater flow
- Decreased feedwater temperature
- Auxiliary feedwater actuation
- Increased steam flow through a MSSV, ADV, or the SDBCS
- Steam line breaks upstream of the MSIVs Single CEA drops Single CEA withdrawals CEA ejection Partial loss of flow Sheared RCP shaft Locked RCP rotor Asymmetric steam generator transient (closure of a single MSIV)
Some decreased heat removal events, such as closure of a Main Feedwater Isolation Valve (MFIV) or feedwater line break, may produce asymmetric results, but clearly rely on a trip (High Pressurizer Pressure) which is not symmetry sensitive. The spectmm of loss of coolant accidents, including steam genemtor tube ruptures, may also produce asymmetric affects, but clearly rely on a trip (Low Pressurizer Pressure) which is not symmetry sensitive. O Document No. 6370-ICE-3316 Revision 00 Page 159 of 257
93 R-2003 Table 3.6-1 identifies the RPS trips relied on for each event. Table 3.6-2 identifies the ESFAS trips relied on for each event. The following discussion details the inputs A to each RPS and ESFAS trip, and discusses the affects of the asymmetric events which rely on them. RPS Trip Innuts (from Technical Specification Table 3.3-1):
- 1. Manual (Not Subject to Indefinite Bypass)
- 2. Linear Power Level - High Four sets of excom neutron detectors arranged symmetrically around the reactor vessel. Can be affected by geometry of events occurring within the core.
During increased heat removal events affecting one steam generator, the excore neutron flux can be affected by actual power asymmetries within the core, or by asymmetric decalibration of the signals due to azimuthal differences of coolant temperature in the reactor vessel downcomer. Only minor asymmetries in the temperature of the coolant in the reactor vessel downcomer occur prior to reactor trip during increased heat removal events. However, for analyses that credit a high power trip, the trip is assumed to be initiated by the two most decalibrated excore detector channels. (Likewise, the CPC trip discussed below, is based on a calculated decalibration of the excore detectors using the lowest measured cold leg temperature. Therefore, the time to the CPC trip would not be delayed due to such asymmetry.) For the CEA ejection event, protection requires a trip in the two most decalibrated channels, which are assumed to be on the opposite side of the core from the ejected CEA. A continuum of CEA wonhs is also evaluated to determine at what worth a trip would pf1 be generated. The analysis then assures that the results of ejecting any CEA of lower worth v/ithout a high linear power trip, are bounded by the results of the most limiting case. A low pressurizer pressure trip will occur due to the resultant small break LOCA, and a high pressurizer pressure trip may also occur initially, due to the reactivity addition. It is noted that even with four channels available, there will be some small CEA insenions that will not produce a high power trip for a CEA ejection event, thus the results for three channels are not exceptional. For purposes of justifying the use of indefinite bypass, the ANO-2 CEA ejection analysis has been performed explicitly accounting for the most decalibiated channel. / l U} ; Document No. 6370-ICE-3316 Revision 00 Page 160 of 257 i l
93 R-2003-01
- 3. Logarithmic Power Level - High Four sets of excore neutron detectors arranged symmetrically around the reactor vessel.
Events initiated from suberitical conditions are protected by this trip. Specifically, group CEA withdrawal from subcritical conditions and toron dilution events rely on this trip. No analyzed events crediting this trip produce asymmetric response. Note that-individual CEA withdrawal events, which could produce asymmetries, use the CPC trips (DNBR-Low, LPD-High) based on CEA position measurement . which is not symmetry sensitive.
- 4. Pressurizer Pressure - High Four pressure transmitters - no geometric effects.
- 5. Pressurizer Pressure - Low Four pressure transmitters - no geometric effects.
i
- 6. Containment Pressure - High .
l Four pressure transmitters - no geometric effects.
- 7. Steam Generator Pressure - Low i Four pressure transmitters per steam generator - no geometric effects, )
even for events affecting only one steam generator. l
- 8. Steam Generator Level - Low l
.1 Four level transmitters per steam generator - no geometric effects, even for events affecting only one steam generator. ;
Operatii.g bypass enable on hot leg temperatum <200*F l Four temperature inputs (RTDs) from CPC input signals (one per hot leg to each channel) no geometric effects. O l Document No. 6370-ICE-3316 Revision 00 Page 161 of 257 1 1
93 R-2003-01
- 9. Local Power Density - High (CPCs)
U NOTE It is the LPD-highfunction that is bypassed, not its individual inputs. However, it is the inputs that detennine the acceptability of bypassing a channel of thisfunction. CEA position via CEAC penalty factors and target CEA position, two reed switches per CEA, each feeding a separate CEA Calculator, no geometric effects. Radial Peaking Factors (RPFs) - signals from target reed switch stack per CEA for one quadrant of the core. Each CPC channel thus receive.s target CEA input from one quadrant of the core. Failure of any one target RSPT stack thus affects only one CPC channel. This does not represent a geometric effect, as the subgroups are symmetric between the four quadrants, thus each quadrant is taken as representative of the whole core. Target CEAs are used to calculate normal RPFs, group out of sequence penalties, subgroup deviation penalties within a group. Since all group-related CEA events affect CEA position in all four CEAs in a subgroup, geometry is not an issue. Individual CEA deviations within a core quadrant are accommodated by the CEACs. Axial Power Distribution - four sets of inputs from the excore detectors. Each set of inputs counts of three venical detectors. Only dropped or slipped CEAs produce geometric effects. These events are protected using CEAC input. i Excore neutron flux - four sets of excore neutron detectors arranged i symmetrically around the reactor vessel. Can be affected by geometry l of events occurring within the core, but not events in other pans of the l plant. A 10% uncertainty is applied to the CEA Ejection analysis to ) account for Ex-Core asymmetries. l RCP speed (as a measure of RCS flow) - four sets of mechanical speed ! sensors per RCP - no geometric effects. I Power (BUC), taken from the higher of either excore power (PHICAL) i or delta-T power (BDTD). l l Document No. 6370-ICE-3316 Revision 00 Page 162 of 257
93-R-2003-01 Cold leg temperature - four sets of two RTDs (one set per cold ( leg - two per CPC channel from diagonally opposite Cold Legs. Hot leg temperature - two sets of four RTDs (one set per hot leg) - two pairs of Hot Leg RTDs (one pair per Hot Leg) to each CPC channel. Pressurizer pressure, narrow range - no geometric effects. This trip protects the core from violation of a SAFDL for events that are less severe than the limiting cases analyzed. Events protected against are CEA withdrawal from critical conditions, small SGTR, and some small break LOCAs. For these non-limiting events, the symmetry affects are less pronounced than for more severe events. O l 1 i O l Document No. 6370-ICE-3316 Revision 00 Page 163 of 257
93-R-2003-01
- 10. DNBR - IAw (CPCs)
\
NOTE 11 is the DNBR-lowfunction that is bypassed, not its individual inputs. However, it is the inputs that determine the acceptability ofbypassing a channel of thisfunction. CEA position via CEAC penalty factors and target CEA position, two reed switches per CEA, each feeding a separate CEA Calculator, no geometric effects. Excore neutron flux - four sets of excore neutron detectors arranged symmetrically around the reactor vessel. Can be affected by geomety of events occurring within the core, but not events in other parts of the plant. A 10% uncertainty is applied to the CEA Ejection analysis to account for Ex-core asymmetries. RCP speed (as a measure of RCS flow) - four sets of mechanical speed sensors per RCP - no geometric effects. Power (BUC), taken from the higher of either excore power (PHICAL) or delta-T power (BDTD). O d Cold leg temperature - four sets of two RTDs (one set per cold leg) - two per CPC channel from diagonally opposite Cold Legs. Hot leg temperature - two sets of four RTDs (one set per hot leg) - two pairs of Hot Leg RTDs (one pair per Hot Leg) to each CPC channel. Pressurizer Pressure, narrow range - no geometric effects. During increased heat removal events affecting one steam generator, the excore neutron flux can be affected by either actual power asymmetries within the core or asymmetric decalibration of the signals due to azimuthal differences of temperature of coolant in the reactor vessel downcomer. Only minor asymmetries in the temperature of the coolant in the reactor vessel downcomer occur prior to reactor trip during increased heat removal events. However, for analyses that credit a high power trip, the trip is assumed to be initiated by the two most decalibrated excore detector channels. Likewise, the CPC trip is based on a calculated decalibration of the excore detectors using the lowest measured cold leg temperature. Therefore, the time to the CPC trip would not be delayed due to such asymmetry. The change in core radial peaking factor is accounted for by an off-line calculated penalty factor supplied by the CEACs based on measured CEA position. The penalty factors have been determined so that their application to Document No. 6370-ICE-3316 Revision 00 Page 164 of 257
93-R-2003-01 the " worst" (least conservative) CPC channel is still conservative. Therefore, O V protection (2 out of 3 logic) is still provided for these ev.:nts, since power, temperature, pressure, and radial peak are conservative for the reuining three channels. Should one or both CEACs be out of service, the technical specifications specify conservative actions. Protection for the locked rotor, total loss of flow, and partial loss of flow events is provided by the CPCs. The decreased flow is detected by a decrease in reactor coolant pump shaft speed from each coolant pump. Bypassing one CPC channel leaves the other three channels from each RCP. Thus, even though these events may be asymmetric, the protection is not symmetry sensitive. Protection for the asymmetric steam generator transient (ASGT) event (closure of a single main steam isolation valve) is provided by the CPCs. A trip is genemted by the CPCs based on cold leg temperature difference between diagonally opposite loops. Bypassing a single CPC channel leaves three channels measuring the temperature difference between opposing loops. Thus protection for the ASGT will be available even with another CPC or cold leg RTD failure. f) G
- 11. Steam Generator Level - High Four level transmitters (pressure transducers) per steam generator - no geometric effects, even for events affecting only one steam generator.
Operating bypass enable on hot leg temperature <200*F Four temperature inputs (RTDs) from CPC input signals (one per hot leg to each channel) no geometric effects. ESFAS Trip Inputs from Technical Specification Table 3.3-3):
- 1. SIAS:
- a. Manual (Not Subject to indefinite Bypass)
- b. Containment Pressure - High Four pressure transmitters - no geometric effects.
Document No. 6370-ICE-3316 Revision 00 Page 165 of 257
93-R-2003-01
- c. Pressurizer Pressure - Low
-~.
Four pressure transmitters - no geometric effects. Bypass enable < 400 psia served from same pressure channel
- 2. CSAS:
- a. Manual (Not Subject to indejnite Bypass)
- b. Containment Pressum - High-High Four pressure transmitters - no geometric effects.
- c. SIAS: Pressurizer Pressure - Iow Four pressure transmitters - no geometrie effects. ,
Containment Pressure - High Four pressure transmitters - no geometric effects.
- d. Indirect bypass of SIAS/CCAS on low pressurizer pressure (see SIAS) i
- 3. CIAS:
- a. Manual (Not Subject to Indefnite Bypass)
- b. Containment Pressure - High ;
Four pressure transmitters - no geometric effects.
- 4. MSIS:
- a. Manual (Not Subject tu indepnite Bypass) Y l
- b. Steam Generator Pressure - Low Four pressure transmitters per steam generator - no geometric ;
effects, even for events affecting only one steam generator. j 1 1 O Document No. 6370-ICE-3316 Revision 00 Page 166 of 257 j
93 R-2003-01
- 5. CCAS:
/h U a. Manual (Not Subject to Indefinite Bypass)
- b. Containment Pressure - High Four pressure transmitters - no geometric effects.
- c. Pressurizer Pressure - Low Four pressure transmitters - no geometric effects.
- 6. RAS:
- a. Manual (Not Subject to Indefinite Bypass)
- b. Refueling Water Tank Level - Low Four level transmitters - oc geometric effects.
- c. Operating bypass enable on low pressurizer pressure Four pressure transmitters - no geometric effects, b
V 7. Loss of Power (LOV):
- a. 4.16 kv Ixss of Voltage (Not Subject to Indejinite Bypass)
- b. 4.16 kv Degraded Voltage (Not Subject to Indejinite Bypass)
The LOV channels measure voltage between two of the three phases, with one channel being a duplicate between two phases. It thus has only three independent channels even with four channels operable.
- 8. EFAS:
- a. Manual (Not Subject to Indefinite Bypass)
- b. Steam Generator (A&B) Level - Low Four level transmitters per steam generator - no geometric effects, even for events affecting only one steam generator.
Document No. 6370-ICE-3316 Revision 00 Page 167 of 257
93:R:2003-01
- c. Steam Generator AP - High (SG-A > SG-B)
I C') - Four pressure transmitters per steam generator - no geometric effects, even for events affecting only one steam generator,
- d. Steam Generator AP - High (SG-B > SG-A)
Four pressure transmitters per steam generator , no geometric effeus, even for events affecting only one steaal generator.
- e. Steam Generator (A&B) Pressure . Low Four pressure transmitters (pressum transducers) per steam generator - no geometric effects, even for events :ffecting only one steam generator.
- f. Operating bypass enable on hot leg temperature <200 F Four temperature inputs (RTDs) from CPC input signals (one per hot leg to each channel) - no geometric effects. This affects the Hi/ Low SG Level RPS trips also.
O O Document No. 6370-ICE-3316 Revision 00 Page 168 of 257
'able 3.6-1 RPS Trip Reliec.' on f or Each SAR Event SAR Linear Log Pzr Pzr Cont. SG SG SG Section Power Power Press. Press. Press. Press. Level LPD DNBR Level 15.1.- Event Manual - High - High - High - Low - High - Low - Low - High -Low - High 1 Uncontrolled CEA Withdrawal From X X B B Subcritical Condition 2 Uncontrolled CEA Withdrawal From X X X X Critical Condition 3 CEA Misoperation X nc X 4 Uncontrolled Boron Dilution B B X B X X incident 5 Total and Partial loss of Reactor X Coolant Flow 6 Idle Loop Startup None 7 Loss of External Load and/or X Turbine Trip 8 Loss of Normal Feedwater Flow X X 9 Loss of All Normal ard Preferred X AC Power to the Station Auxiliaries 10 Excess Heat Removal Due to Secondary System Malfunction O
- a. Excess feedwater X nc nc B(nc) y
- b. Opening of relief or safety X X X X nc nc y valve O
O Note: X = primary trip credited in Chapter 15 analysis Q) B = trips that may occur for less limiting events y nc = but may occur lop = not tosscredited,te of offsi power O. N/A = Not Applicable Document No. 6370-ICE-3316 Revision 00 Page 169 of 257
O O D Table 3.6-1 RPS Trip Relied on for Each SAR Event SAR Linear Log Pzr Pzr Cont. SG SG SG Section Power Power Press. Press. Press. Press. Level LPD DNBR Level 15.1.- Event Manual - High - High - High - Low - High - Low - Low - High -Low - High 11 Failure of the Regulating N/A Inst rtsnentat i on 12 Internal and External Events X Including Major and Minor Fires, Floods, Storms, and Earthquakes 13 Major Ruptures of Pipes X NC Containing Reactor Coolant up to and includirrg Double-Ended Rupture of Largest Pipe in the RCS (LOCA) 14 Major Secondary System Pipe Breaks with or without a Concurrent loss of AC Power
- a. SLB X B NC X B(nc) B X(lop)
- b. FWLB X B NC 15 Inadvertent Loading of a Fuet None Asseebly into the Wrong Position 16 Waste Gas Decay Tank Leakage or --
Rupture 17 Failure of Air Ejector Lines N/A (BWR) CD 18 Steam Generator Tube Rupture with NC X or without a Concurrent Loss of M AC Power l O O Note: X = primary trip credited in Chapter 15 analysis CA) B = trips that may occur for less limiting events i nc = but may occur O lop = not tosscredited,te of offsi power N N/A = Not Applicable Document No. 6370-ICE-3316 Revision 00 Page 170 of 257
r r ~n
\
Table 3.6-1 RPS Trip Relied on for Each SAR Event SAR Linear log Pzr Pzr Cont. SG SG SG Secti on Power Power Press. Press. Press. Press. Level LPD DNBR Level 15.1.- Event Manual - High - High - High - Low - High - Low - Low - High -Low - high A Asymmetric Steam Generator X X Transient B CEA Deviation X X 19 Failure of Charcoal of Cryogenic N/A System (BWR) 20 Control Element Ejection X NC NC NC NC 21 Spectrtn of Rod Drop Accidents N/A (BWR) 22 Break in Instrtment Line or other -- Lines from RCPB that Penetrate Cotitainment 23 Fuel Handling Accident -- 24 Small Spills or Leaks of None Radioactive Material Outside Containment 25 Fuel Cladding Failure Combined None O with Steam Generator Leak y
.2 26 Control Room Uninhabitability X d
O O CD I O w Note: X = primary trip credited in Chapter 15 analysis B = trips that may occur for less limiting events nc = but may occur top = not tosscredited,te of offsi power N/A = Not Applicable Document No. 6370-ICE-3316 Revision 00 Page 171 of 257
b U(%' Table 3.6-1 RPS Trip Relied on for Each SAR Event SAR Linear Log PZr Pzr Cont. SG SG SG section Power Power Press. Press. Press. Press Level LPD DNBR Level 15.1.- Event Manual - High - High - High - Low - High - Low - Low - High -Low - High 27 Failure or Overpressurization of N/A low Pressure Residual Heat Removal System 28 Loss of Condenser vacum X s 29 Turbine Trip with Coincident X Failure of Turbine Bypass Valves to Open 30 Loss of service Water System -- 31 Loss of One DC System -- 32 Inadvertent Operation of ECCS X During Power Operation 33 Turbine Trip With Failure of X Generator Breaker To Open 34 Loss of Instrument Air System -- 35 Malfunction of Turbine Gland Seal -- System CD, M. TO O O CD
=
I Note: X primary trip credited in Chapter 15 analysis C) B = trips that may occur for less limiting events w. nc = not credited, but may occur t op = toss of offsite power N/A = Not Applicable Document No. 6370-ICE-3316 Revision 00 Page 172 of 257
r w ( O Table 3.6-2 ESTAS Trip Actuated for Each SAR Event SAR Pcont Ppzr Peont Peont PSG Pcont Ppzr LSG/PSG Sec t i on High low Hi Hi High Low High Low. Low /High 15.1.- Event SIAS SIAS CSAS CIAS MSIS CCAS CCAS EFAS 1 Uncontrolled CEA Withdrawal From Subcritical None Condition 2 Uncontrolled CEA Withdrawal From Critical Condition None 3 CEA Misoperation None 4 Uncontrolled Boron Dilution Incident None 5 Total and Partial Loss of Reactor Coolant Flow None 6 Idle Loop Startup None 7 Loss of External Load and/or Turbine Trip None 8 Loss of Normal Feedwater Flow X 9 Loss of All Normal and Preferred AC Power to the Station Auxiliaries 10 Excess Heat Removal Due to Secondary System Malfunction
- s. Excess feedwater X NC B(nc)
- b. Opening of relief or safety valve X NC (D
11 Failure of the Regulating Instrtsnentation N/A (A.) e Z
. 12 Internal and External Events Including Major and Minor Fires, Floods, Storms, and Earthquakes as required Q
.o
-~
O (A) Note: X = primary trip credited in Chapter 15 analysis I 8 = trips that may occur for less limiting events O nc = but may occur N l ep = not tosscredited,te of offst power N/A = Not Applicable Document No. 6370-ICE-3316 Revision 00 Page 173 of 257
( U r\
~
Table 3.6-2 ' ESF AS trip Actuated f or Each SAR Event SAR Pcont Ppzr Pcont Pcont PSG Pcont Ppzr LSG/PSG Section High Low Hi Hi High low High Low. Lew/High 15.1.- Event SIAS SIAS CSAS CIAS MSIS CCAS CCAS EFAS 13 Major Ruptures of Pipes Containing Reactor Coolant up X X X X X X to and Including Double-Ended Rupture of Largest Pipe in the RCS (LOCA) 14 Major Secondary System Pipe Breaks with or without a Concurrent Loss of AC Power
- a. SLB
- b. FWt.B B X X B X X B X B X X B X X 9 X 15 Inadvertent Loading of a Fuel Assembly into the Wrong None Position 16 Waste Gas Decay Tank Leakage or Rupture None 17 Failure of Air Ejector Lines (BWR) N/A 18 Steam Generator Tube Rupture with or without a B Concurrent Loss of AC Power 19 Failure of Charcoal of Cryogenic System (BWR) N/A 20 Control Element Ejection X B 21 Spectrum of Rod Drop Accidents (BWR) N/A g (A) 22 Break in Instrunent Line or Other Lines f rom RCPB that Penetrate Containment None h e N)
O 23 Fuel Handling Accident None O CA) i Note: X = primary trip credited in Chapter 15 analysis O 8 = trips that may occur for less limiting events N nc = but may occur top = not tosscredited,te of offsi power N/A = Not Applicable Document No. 6370-ICE-3316 Revision 00 Page 174 of 257
O O Tabte 3.6-2 ESFAS Trip Actuated for Each SAR Event SAR Pcont Ppzr Pcont Pcont PSG Pcont Ppzr LSG/PSG Section High Low Hi Hi High Low High Low. Low /High 15.1.- Event SIAS SIAS CSAS CIAS MSIS CCAS CCAS EFAS 24 Small Spitts or Leaks of Radioactive Material outside None Containment 25 Fuel Cladding Failure Combined with Steam Generator None Leak 26 Control Room Uninhabitabitity None 27 Failure or Overpressurization of Low Pressure None Residual Heat Removat System 28 Loss of Condenser Vacuum None 29 Turbine Trip with Coincident Failure of Turbine None Bypass Valves to Open 30 Loss of Service Water System None 31 Loss of One DC System None (may consequently actuate ESFAS signals) 32 Inadvertent Operation of ECCS During Power Operation None 33 Turbine Trip With Failure of Generator Breaker To None Open Co 34 Loss of Instrtsnent Air System None e N 35 Malfunction of Turbine Gland Seat System None O CD t Note: X = primary trip credited in Chapter 15 analysis O B = trips that may occur for less limiting events N nc = t op = not tosscredited,te of offsi powerbut may occur N/A = Not Applicable Document No. 6370-ICE-3316 Revision 00 Page 175 of 257
93-R-2003-01 3.7 Electrical Fault Isolation Between the 120 VAC Vital Buses and the PPS Power , Supply Load PURPOSE : The PPS power supply fault and surge qualification test program is being evaluated' against the NRC Design Criteria to demonstrate that the PPS test program completely - envelopes, and is in full compliance with the NRC Design Criteria No. 4 and 5 as . delineated in Enclosure-2 of th'e NRC to AP&L letter, 3/21/8210, . Design Criteria - 4 Independence of Vital Buses Review and evaluation of the PPS and ESFAS power supply qualification test program demonstrates that the power supplies required to perform an isolation function were qualified as Class IE isolation devices. The test program also demonstrated that the power supplies do not permit credible Vital Bus faults and surges to propagate into the protection channel nor degrade the operation of the PPS t circuits or functions. The independence and separation of the Vital Buses are not , compromised through the use of redundant PPS power supplies, which are powered from separate Vital Buses within a single protective channel. A complete list of PPS/ESPAS power supplies including the 120 VAC Vital Bus power distribution within the PPS cabinet is included in Appendix C-1. The ANO-2 PPS power supplies are a mix of those initially delivered with the system in 1978 and those that were replaced in 1990. Therefore, the ANO-2 PPS power supply qualification program and documentation is based upon the initial test program performed in 1977tmou2m251 and a mplacement power supply test program
. performed in 1989 tin 261, Table 3.7-1 lists the PPS/ESFAS, and Process Instrumentation (PI) power supplies required to perfonn an isolation function and were qualified as isolation devices in 1 accordance with IEEE 279-1971, IEEE 323-1971. I Document No. 6370-ICE-3316 Revision 00 Page 176 of 257
93 R-2003-01 Table 3.7 - Qualified Isolation Devices System Manufacturer Model Circuit Loads PPS Lambda LRS-58-12-42859-1 Bistable Comparator Card (BCC) Differential Bistable Comparator Card - Bistable Relay Card PPS Acopian VA5-H-1700 Trip Channel Bypass Circuits PPS Lambda LNS-X-12-42862-1 Auxiliary Logic' Circuits RPS/ESFAS Trip Path Relays : RPS 2/4 Logic Matrix Relays ESFAS 2/4 Logic Matrix Relays ESFAS PowerMate FPS-28-26' Subgroup MDR Relays PI Fischer Poner 55GL1151 PI Loop Power Supply PI Lambda LCD-2-44 PI Loop Power Supply The original PPS, ESFAS A.R.C., and Process Instntmentation power supply fault ' and surge qualification is based upon the following initial qualification program test ' reports, procedures, and analyses contained in Table 3.7-2. These procedures tested additional power supplies other than those listed; however, they are not associated with PPS channel bypass. Table 3.7-2 Initial - Qualification Test Program 6370-ICE-3736 - ABB-CE, Test Repon for Input Fault and Surge Testing of Power Supplies for AP&L, Model FPS-28-26 .; 6370-ICE-3536 . ABB-CE, Test Procedure for Input Fault and Surge Testing of Power Supplies for AP&L. 2 6370-ICE-3721 ABB-CE, Test Repon for a Plant Protection System RAS Circuit Surge Test for AP&L. 6370-ICE-3565 ABB-CE, Test Procedure for a Plant Protection System RAS Circuit Surge Test for AP&L. 6370-ICE-8608 ABB-CE, Final Analysis Report of the PPS, EFS/ ARC, and LRWTL Process Instmmentation to Determine Effects on the Recirculation Actuation Signal Due to Vital Bus Faults at ANO-2. 6370-ICE-8607 ABB-CE, Analysis of the PPS, ESF/ ARC, and the LRWTL - Process Instmmentation for RAS Trip Signal Generation as a Result of Vital Bus Faults at ANO-2. O 2 8 Original power supply not replaced in the 1990 PPS power supply upgrade. Recirculation Actuation Signal , Document No. 6370-ICE-3316 Revision 00 Page 177 of 257
93 R-2003-01 The replacement ANO-2 PPS power supply qualification is based upon the qualification program test procedures and reports contained in Table 3.7-3. Table 3.7-3 Replacement - Qualification Test Program 82689-ICE-37205 ABB-CE, Qualification Summary Report for Replacement PPS Power Supply Door Assembly _for AP&L ANO-2. QTR 10551-1 ABB-EM, PPS and ESFAS Aux. Relay Cab. Replacement Power Supply Fault and Surge Qualincation Test Report. ANO-2 Models: LRS-58-12 LNS-X-12 VA5H1700 TP 10551-7' ABB-EM, PPS and ESFAS Aux. Relay Cab. Power Supply Replacement QualiGcation Test Procedure for Input Fault & Surge Testing. TP 10551-6' ABB-EM, PPS Power Supply Output Fault Isolation Circuit Test. PPS POWER SUPPLY TESTS This section identiGes the PPS power supplies and the qualincation test performed for Input Fault / Surge, Output Fault Isolation, Acceptance Criteria, and a Summary. The PPS power supply mock-up configuration for the Input Fault / Surge and Output Fault Isolation tests, shown in Appendix C-2, C-3, replicates the actual As-Built PPS power supply circuit conGgurations shown in Appendix C-4, with the following exception.
- Resistors were used to simulate the power supply load versus relay contact and coils because the matrix relay cards include suppression diodes, which would clamp the negative transients at zero resulting in a "less conservative" test. ,
1 O %J ' Included in appendices to QTR 10551-1 (Ref. 26) Document No. 6370-ICE-3316 Revision 00 Pap 178 of 257 1 l
93 R-2003-01 1pput Fault and Surge Tests o C The intent of the Input Fault and Surge tests was to prove that credible faults of (140 VDC and 508 VAC) and surges (1500V peak) applied to the inputs of the selected power supply do not propagate through the redundant power supply to the second Vital Bus. The power supply Input Fault tests for the LRS-58-12, VA5H1700, and LNS-X-12 power supplies were performed at 140 VDC and 508 VAC in accordance with TP-10551-7. The power supply Input Surge tests for the LRS-58-12, VA5H1700, and LNS-X-12 power supplies were performed at 1500V peak in the Common and Transverse Modes in accordance with TP-10551-7. The Transverse Mode Input Fault tests were accomplished by applying the 140 VDC and 508 VAC fault voltage across the 120 VAC input terminals of the selected power supply; see Figure 1, Appendix C-2. The Common Mode Input Surge tests were accomplished by applying a 1500V peak surge voltage between each of the selected power supply 120 VAC input terminal and its chassis; see Figures 2 and 5b, Appendix C-2. The Transverse Mode Input Surge tests were accomplished by applying a 1500V peak surge voltage across the selected power supply 120 VAC input terminals; see Figures (V 2 and Sa, Appendix C-2. Preliminary testing identified that surge voltages in excess of 2.2 kVolts peak caused some power supply over-voltage circuits to activate. This in turn shorted the output of the supply being faulted and prevented any surge from being applied to the output of the supply not being faulted. This parameter was re-evaluated and it was determined that a range of 1.0 to 1.5 kVolts peak (2.0 to 3.0 kVolts peak-to-peak) was sufHcient to qualify the supplies'. Accentance Criteria The acceptance criteria for the PPS power supply Input Fault and Surge tests are as follows:
- Transient voltage limit on AC line s 150V peak
- Tmnsient voltage duration limit s5 milliseconds with a maximum rate of 50 V/psec :
- AC line input of the unfaulted redundant power supply shall be unaffected i
- Tmnsient currents limited to s 15 amperes in excess of the power supply normal load for the unfaulted redundant power supply ;
l Excerpted fmm Reference 26. Document No. 6370-ICE-3316 Revision 00 Page 179 of 257
93 R-2003-01 Output Fault and Isolation Tests The intent of the Output Fault Isolation test was to prove that credible faults of (600 VAC and 400 VDC) applied to the load (output) side of the selected power supply will not propagate through the power supply to the Vital Bus. The power supply Fault Isolation tests for the LRS-58-12, VA5H1700, and LNS-X-12 power supplies were performed at 600 VAC and 400 VDC in the Common and Transverse Modes in accordance with TP-10551-6. The Common Mode Isolation tests were accomplished by applying a 600 VAC and 400 VDC fault voltage between the power supply negative output and the power supply chassis; see Figure 3.1, Appendix C-3. The Transverse Mode Isolation tests were accomplished by applying a 600 VAC and 400 VDC fault voltage between the power supply negative and positive outputs; see Figure 3.2, Appendix C-3. Acceptance Criteria The acceptance criteria for the PPS power supply Output Fault Isolation Common Mode and Transverse Mode tests are as follows: A * < 10% AC line vohage fluctuation V
- Transient voltage limit on AC line s170V peak
- TransMnt voltage duration s6 milliseconds Summary The PPS power supply tests were performed in accordance with ABB-EM, Plant Protection System, and ESFAS A.R.C. Power Supply Replacement Qualification Test Procedure for Input Fault and Surge Testing, TP-10551-7, and ABB-EM Plant Protection System Power Supply Fault Isolation Circuit Test, TP-10551-6. The test execution was documented in ABB-EM Test Records TR-10551-7, TR-10551-6, respectively.
The PPS power supply qualification testing demonstrated that the power supplies meet or exceed the Class 1E isolation device requirements. During Bus-to-Load testing the input of the redundant, auctioneered power supply was continuously monitored for transients that may propagate through the power supply. All recorded transients were less than the specified acceptance criteria. During Load-to-Bus testing of PPS power supplies, the power supply 120 VAC Vital Bus input was continuously monitored for transients that rnay propagate through the power supply. All recorded transients were less than the specified acceptance criteria. Document No. 6370-ICE-3316 Revision 00 Page 180 of 257
93-R-2003-01 All test results were satisfactory and testing conforms to IEEE Std. 323-1971 and IEEE Std. 472-1974, as noted. (~ The test results were summarized in ABB-EM, Plant Protection System and ESFAS A.R.C. Replacement Power Supply Fault and Surge Qualification Test Report, QTR-10551-1r263, and ABB-CE Qualification Summary Repon for the Replacement Plant Protection System Power Supply Door Assembly for AP&L, ANO-2,82689-ICE-37205181 O O Document No. 6370-ICE-3316 Revision 00 Page 181 of 257
93-R-2003-01 ESFAS AUXILIARY RELAY CABINET POWER SUPPLY TESTS This section identifies the ESFAS A.R.C. power supplies and the qualification tests performed for Input Fault / Surge, Acceptance Criteria, and a Summary. The ESFAS A.R.C. power supply mock-up configuration for the Input Fault and d Surge tests, shown in Figures l A,2A, and 3A of Appendix C-5, replicated the actual As-Built ESFAS A.R.C. power supply configuration shown in Figure 1-2 of Appendix C-6, with the following exceptions:
- two power supplies were used versus four because the output capacitors in the power supplies would tend to attenuate output transients n:sulting in a "less conservative" test
- auctioneering diodes were not utilized because they would attenuate the positive tmnsients to the power supply rated voltage, which results in a "less conservative" test
- resistors were used to simulate the power supply load versus relay contacts and coils because the matrix relay includes suppression diodes, which would clamp the negative transients at zero resulting in a "less conservative" test Input Fault and Surge Tests The intent of the Input Fault and Surge tests was to prove that credible faults of (140
' VDC and 508 VAC) and surges of (2.5 to 3.0 kVAC) applied to the input of the N selected power supply do not propagate through the redundant power supply to the second Vital Bus. The power supply Input Fault tests for the FPS-28-26 power supplies were performed at 140 VDC and 508 VAC in accordance with test procedure 6370-ICE-353g241, The power supply Input Surge tests for the FPS-28-26 power supplies were performed at 2.5 to 3.0 kVAC in accordance with test procedure 6370-ICE-3536f2'l. The Transverse Mode Input Fault tests were accomplished by applying the 140 VDC and 508 VAC fault voltage across the 120 VAC input terminals of the selected power supply; see Figure la, Appendix C-5. The Common Mode Input Surge tests were accomplished by applying the 2.5 to 3.0 kVAC surge voltage between the selected power supply 120 VAC input terminal and its chassis; see Figure 2a, Appendix C-5. The Transverse Mode Input Surge tests were accomplished by applying the 2.5 to 3.0 kVAC surge voltage across the 120 VAC input terminals of the selected power supply; see Figure 3a, Appendix C-5. Document No. 6370-ICE-3316 Revision 00 Page 182 of 257
93 R-2003-01 Accentance Criteria l' \, The acceptance criteria for the ESFAS A.R.C. Input Fault and Surge tests are as follows:
- Transient voltage limit s 150V peak
- Transient voltage duration limit s5 milliseconds with a maximum rate of 50V/ sec
* < 10% AC line voltage fluctuation @ 60 Hz for the unfaulted redundant power supply
- Transient currents limited to s15 amperes in excess of the power supply nonnal load for the unfaulted redundant power supply Summary The ESFAS A.R.C. power supply tests were performed and documented in accordance with ABB-CE Test Procedure for Input Fault and Surge Testing of Power Supplies for AP&L,6370-ICE-3536,1/26/77:2y, The test results were summarized in ABB-CE Test Report for Input Fault and Surge Testing of Power Supplies for ANO-2,6370-ICE-3736,7/22/77071 All test results were satisfactory and testing conforms to IEEE Std. 323-1971 and IEEE Std. 472-1974.
O Document No. 6370-ICE-3316 Revision 00 Page 183 of 257
93-R-2003-01 PPS/ESFAS FAULT ACTUATION TESTS (RAS) 0 Q The intent of the PPS/ESFAS, Recirculation Actuation Signal (RAS) circuit surge test was to demonstrate that the PPS/ESFAS auctioneered power supplies and logic circuitry could withstand the occurrence of a credible surge on a single Vital Bus and would not result in the initiation of the RAS trip during or after the occurrence of Vital Bus faults at the AP&L ANO-2 facility. The mock-up configuration for the RAS circuit surge test replicates the actual PPS/ESFAS circuitry including a portion of the 2/4 Trip Logic Matrices as shown in Appendix C-7. The RAS circuit surge testing was conducted with the simulated Vital Bus voltage at 132 VAC, which represents a +10% voltage excursion over the 120 VAC nominal value. The RAS circuit surge test was performed at 300 VAC and 400 VAC, rather than 3.0 KVAC specified in IEEE 472-1974, in the Common and Transverse Modes. This reduced surge transient level is based upon the ANO-2 invener surge transient analysis" i which established the maximum surge transient as 328 VAC for Common or Transverse Modes. Note that the maximum credible surge level was funher reduced to 100 VAC upon replacement of the original inverters with SCI invertersr2o, Surge Tests The Common Mode Surge tests were accomplished by applying a 300 VAC and 400 VAC peak-to-peak surge voltage between the RAS circuit 120 VAC input terminal and its chassis. The Transverse Mode Surge tests were accomplished by applying a 300 VAC and 400 VAC peak-to-peak surge voltage between the RAS circuit 120 VAC input tenninals. Acceptance Criteria The acceptance criteria for the PPS/ESFAS RAS Surge test is as follows:
- The application of the surge test voltage to the simulated Vital Bus supplying the PPS shall not cause an inadvenent actuation of the simulated PPS/ESFAS RAS circuit.
Summary The PPS/ESFAS, Recirculation Actuation Signal (RAS) circuit surge test was perfonned in accordance with Test Procedure 6370-ICE-3565I28 and documented in Test Repon 6370-ICE-3721M. No inadvertent actuation of the RAS circuit occurred, the test results were satisfactory and testing confonns to IEEE Std. 323-1971 and IEEE Std. 472-1974, as noted. l Subsequent to the completion of the ANO-2 RAS testing, AP&L redefined and reduced the worst case limits of AC, DC, and Surge voltages presented to the PPS O auctioneered power supplies from the Vital Bus due to credible Vital Bus supply faults. This reduction was made as a result of the replacement of the original Vital Bus Static Power Inverters with a ferroresonant Uninterruptible Power Supply (UPS) Document No. 6370-ICE-3316 Revision 00 Page 184 of 257
93-R-2003-01
~
by Solid State Controls, Inc. Additionally, the inverter input and output cables have ! been re-located to provide separation of the 480 VAC and 125 VDC inputs, and the' .: 9 120 VAC output._ These changes in conjunction with the surge capacitors and fast j response overvoltage devices in the replacement inverter vinually eliminates the - possibility of 508 VAC and 140 VDC fault voltages from the ANO-2 Vital Bus Invener subsystem r2 j , , l The resultant acceptance criteria was changed as follows: .i Voltage Orieinal - Revised AC 508 VAC 132 VAC DC 140 VDC Not Applicable ; Surge 2.5-3.0 KVAC 100 VAC ; i O O ' Document No. 6370-ICE-3316 Revision 00 Page 185 of 257 y v , , , ,,,m.,- ,-c- - - . _ ~.y,. , . -.,o , , _ _ . - . . - , - .
93 @ 2003-01 PROCESS INSTRUMENTATION POWER SUPPLY REDUNDANCY h Channels 2 and 3 of the Refueling Water Tank (RWT) level and Steam Genemtor A&B level process instniment loops employ redundant auctioneered power supplies. The original RWT and SG level process instalmentation power supplies were Fischer
& Poner, Model No. 55GL1151 with a redundant Lambda, Model No. LCD-2-44 power supply.
The use of redundant power supplies in these loops prevents inadvenent generation of the ESFAS Recirculation Actuation Signal (RAS) and the Emergency Feedwater Actuation Signal (EFAS) when a Loss of Offsite Power (LOOP) event occurs coincident with a battery failure. The Fischer & Porter and Lambda power supplies were qualified as isolation devices in accordance with IEEE 279-1971 and IEEE 323-1971; see Table 3.7-1 Qualified Isolation Devices and Table 3.7-2 Initial Qualification Test Program. ANO replaced the Fischer & Porter loop power supplies in the Steam Generator instrument loops in 1991 with Acopian Model No. 28EB08 power suppliest2y , Fault and surge testing of the Acopian power supply was not performed because the redundant Lambda power supply is a qualified isolation device which provides and maintains the separation and independence of the Vital Buse::. Therefore, the h Acopian power supply is not required to perform an isolation function since it is powered from the same vital bus channel as the instrument channel it powers. pJ i l l O O 1 Document No. 6370-ICE-3316 Revision 00 Page 186 of 257 l
93-R-2003-01 DESIGN CRITERIA - 5 I.ogic Matrix Failure Due to a Vital Bus Single Failure Initial Conditions A single PPS trip parameter in Channel A is placed in Channel Bypass. This action negates the bypassed trip parameter's Bistable Relay Card contacts in the "A" side of the AB, AC, and AD two-out-of-four (2/4) Trip logic Matrices. The PPS is now functioning in a two-out-of-three (2/3) logic condition for this parameter. This leaves the remaining BC, BD, and CD trip matrices which are driven by protection channels B, C, and D, to implement the required protective function for the Channel A trip parameter placed in Channel Bypass. Reference attached drawing (ANO-2 PPS Functional Diagram, 6600-M2001-MI-139, SH.1) for the following discussion. Single Failure The postulated, but undefined, single failure is stated to occur on Vital Bus IB, which is common to the power supplies powering the "B" and "C" side of the three remaining 2/4 Trip Logic Matrices BC, BD, and CD. I At this point the following events must occur within the three remaining protection channels and six 2/4 Trip Logic Matrices. The postulated single failure must ' propagate through each of the three matrix power supplies, which provide power to the six Matrix Trip Relay coils in the "B" and "C" side of the BC, BD, and CD matrices. The six Matrix Trip Relays (6BC1/6BC2,6BDl/6BD2, and 6CDl/6CD2) must all fail in a manner that welds, bends, or otherwise renders the Matrix Trip Relays reed-switch contacts inoperable. Also, a reactor trip condition must exist and O be detected by protection channels B, C, and D, which are unable to effect a reactor trip by de-energizing the Matrix Trip Relay coils because their associated Matrix Trip Relay contacts remain closed and inoperable. Assumptions The following assumptions are made in order to properly bound the evaluation of the postulated single Vital Bus failure event.
- 1. Vital Bus fault / surge shall not exceed the surge criteria denned in IEEE-472-1974, Surge Withstand Capability.
- 2. Vital Bus fault / surge shall not exceed the inverter maximum credible fault.
- 3. Vital Bus fault / surge shall not exceed the maximum level the system was tested to.
t Review of the power supply qualification Test Proceduresr2m:5im and qualincation Test ReportsMW263 for Vital Bus fault and surge testing of PPS matrix power supplies has demonstrated that any fault or surge effects that propagated into the 2/4 Trip Logic Matrix circuitry were not of sufficient amplitude, duration, or frequency to cause any equipment malfunction, negate the trip logic matrix action, nor propagate through the redundant power supply to the redundant Vital Bus supply. O Document No. 6370-ICE-3316 Revision 00 Page 187 of 257
93-R-2003-01 The PPS/ESFAS and Process Instnlmentation power supply fault and surge tests subjected the power supplies to various fault levels and durations, which are (^ summarized in Table 3.7-4 below and accompanied with the acceptance criteria for each group of tests. Table 3.7-4 Power Supply Fault & Surge Test Summary Level Duration Type Mode System Reference l 140 VDC 30 sec. Bus / Load' Transverse PPS TP-10551 -7" 508 VAC 30 sec. Bus / Load' Transverse PPS TP-10551-7 1.5 KVAC 2 sec. Bus / Load' Comon PPS TP-10551-7 1.5 KVAC 2 sec. Bus / Load Transverse PPS TP 10551-7 600 VAC 5 min. Load / Bus' Common PPS TP 10551-6" 500 VDC --- Lead / Bus' Insulation PPS TP-10551 6 Resistance 400 VDC 5 min. Load / Bus' Comon PPS TP-10551-6 600 VAC 5 min. Load / Bus' Transverse PPS TP 10551-6 500 VDC --- Load / Bus' Insulation PPS TP-10551-6 Resistance 400 VDC 5 min. Load / Bus' Transverse PPS TP-10551-6 140 VDC 30 sec. Bus / Load Transverse ESFAS A.R.C. 6370 ICE-3536" 508 VAC 30 sec. Bus / Load Transverse ESFAS A.R.C. 6370-ICE-3536 2.5-3.0 KVAC 2 sec. Bus / Load Common ESFAS A.R.C. 6370-ICE-3536 2.5-3.0 KVAC 2 sec. Bus / Load Transverse ESFAS A.R.C. 6370-ICE-3536 300 VAC P/P 2 sec. Bus / Load Common PPS RAS 6370-ICE 3565" j 300 VAC-P/P 2 sec. Bus / Load Transverse PPS-RAS 6370-lCE-3565 400 VAC-P/P 2 sec. Bus / Load Comon PPS RAS 6370-ICE-3565 400 VAC-P/P 2 sec. Bus / Load Transverse PPS RAS 6370-ICE 3565
' The acceptance criteria for the PPS power supply input f ault and Surge (Bus / Fault) tests" are as follows:
AC line input of the unfaulted redundant power supply shall be unaffected Transient voltage limit on s150V peak Transient voltage duration s5 milliseconds with a maxirm.rn rate of rise 50V/ see Transient currents limited to s15 amperes in excess of the power supply normal load 2 The acceptance criteria for the PPS power supply Output Fault Isolation Comon Mode and Transverse Mode test" are as follows: AC line voltage fluctuation limited to s10% f ransient voltage limit on At line s170V peak Transient voltage duration s6 milliseconds The acceptance criteria for the ESFAS A.R.C. Input Fault and Surge tests" are as follows: AC line voltage fluctuation limited to s10% a 60 Hz for unf aulted redundant power supply Transient voltage limit s150V peak Transient voltage duration limit s5 milliseconds with a maximtsn rate of rise 50V/ see Transient currents limited to s15 amperes in excess of the power supply normal load for the unfaulted redundant power supply The acceptance criteria for PPS RAS circuit surge tests"""' are as follows: The application of the surge test voltage to the simulated Vital Bus supplying the PPS shall not cause an inadvertent actuation of the simulated PPS/ESFAS RAS circuit. Document No. 6370-ICE-3316 Revision 00 Page 189 of 257
93-R-2003-01 Analysis of the ANO-2 inveners supplying the PPS Vital Busest:73 determined that the O highest instantaneous voltage that may occur on the Vital Buses as a result of an invener surge transient is 328 volts, in Common or Transverse mode. The inveners were- subsequently replaced with improved inverters subject to maximum output surge tmnsients of 100 VAC. The inveners are equipped with suppression capacitors credited with reducing surge transients, whose characteristics are defined in IEEE-472-1974. All PPS powcr supplies provide overvoltage and overcurrent protection for their respective loads. Each 2/4 trip Logic Matrix power supply output also powers an undervoltage relay that provides alarm indication and annunciation in the event the power supply output voltage drops below the undervoltage alarm relay coil minimum dropout voltage. During normal operation the Matrix Trip Relay is energized, holding its "normally-open" trip path contacts closed. When a trip condition exists in the 2/4 Trip Logic Matrices, the Matrix Trip Relay coil voltages are intermpted allowing the contacts to reven to their de-energized "normally open" status. When the Matrix Trip Relay trip path contacts are open, they de-energize the K , 2K , 3K , and K 3 4 MDR relay coils, which open the Reactor Trip Circuit Breakers (TCB1-TCB8). This interrupts power to the Control Element Assembly power supplies resulting in a reactor trip. The PPS Matrix Trip Relay characteristics and failure mode were examined with respect to the postulated single Vital Bus failure. The ANO-2 relays are reed-type O relays. These relays incorporate a reed switch encapsulated in a pressurized glass envelope and a coil, both of which are enclosed in a hermetically sealed assembly. The failure mode of the Matrix Trip Relay contact is " fail open". Review of the Nuclear Plant Reliability Data System for Matrix Trip Relay failures did not indicate that these relays have an operating history exhibiting a " fail to open" failure moder31 The database record search produced only ora incident citing a Matrix Trip Relay contact that failed to open during testing. However, the root cause of this failure has not been documented. Based upon this infonnation and the PPS performance history of all systems installed to date, it is concluded that this failure is a single random failure and does not indicate a common mode failure for Matrix Trip Relays where the contacts fail to open. The operating history associated with the PPS Matrix Trip Relay does not show any evidence of, nor does it indicate a potential common mode failure associated with this relay or its use. l l The relays are mounted on printed circuit cards that contain transistor driver ; circuitry. There are four relays / card, 305 relay driver cards, and a total of 1,220 ; relays in each PPS system. There are 8,540 of these relays currently in use in seven different PPS systems at l four sepamte utilities with approximately 59 years of cumulative commercial l operation, as shown in Table 3.7-5 below. 1 Document No. 6370-ICE-3316 Revision 00 Page 190 of 257 l
93-R-2003-01 Table 3.7-5 f' Relay Utilization Summary
\ No. Relays Comm. Oper.
Utility _Qpen Xga_n ANO-2 1,320 1980 13 SONGS-2 1,320 1983 10 SONG S-3 1,320 1984 9 WSES-1 1,320 1985 8 ANPP-1 1,320 1986 7 ANPP-2 1,320 1986 7
/ d F-3 1,320 1988 5 Additional research on this subject indicates that the posnilated Matrix Trip Rday failure is probably based upon the use of mercury-wetted Matrix Trip Relays, which are no longer in use, and did have an established failure mod?. of the contacts failing l to open t20 USNRC IE Bulletin No. 80-19, July 31,1980, identified mercury-wetted Matrix Trip Relays as a potential common mode failure in Combus+'an Engineering's Reactor Protective Systems. This bulletin required all plants using mercury-wetted relays to replace them with qualified re'. 5 of a different design to eliminate the fail to open problem.
Siun;M It is likely that the postulated Matrix Trip Relay failure is based upon the use of mercury-wetted Matrix Trip Relays in early versions of Combustion Engineering's Reactor Protective System. The PPS power supplies have been thoroughly and successfully tested in two separate qualification test programs. The first qualification and actuation tests were performed on the ANO-2 PPS/ESFAS power supplies, which were initially delivered and installed in 1978. The second qualification test program was performed for an ANO-2 PPS power supply replacement and upgrade in 1989. Considering that the results of two separate detailed PPS/ESFAS power supply fault and surge test programs did not produce any matrix circuitry failures, and that the ANO-2 PPS does not use mercury-wetted Matrix Trip Relays, it is concluded that a single Vital Bus failure would not cause multiple Matrix Trip Relay failures and would not prevent the PPS from performing its protective function with a single PPS trip parameter in bypass. Likewise, it follows that a single Vital Bus failure would not cause multiple Matrix Trip Relay failures and would not prevent the PPS from performing its protective function with all trip parameters of one PPS channel in bypass. Document No. 6370-ICE-3316 Revision 00 Page 191 of 257 l
93-R-2003-01 3.8 Independence of 120 VAC Vital Buses This section of the analysis addresses the following three issuc :
- 1) What impact does a postulated loss of more than one vital bus have on the extended bypass evaluation?
- 2) Given that the ANO-2125VDC system includes only two safety related batteries, to what extent are the four 120VAC vital buses independent, and what impact does this have on the extended bypass evaluation?
- 3) What are the maximum credible faults that could be applied to the PPS power supplies?
If a loss of off-site power (LOOP) occurs and a single failure is postulated that results in the loss of one DC bus, then two vital 120 VAC me1surement channel buses will be temporarily lost. The effects of this scenario on the operability of the plant protection system will be discussed in this section. In particular, it will be shown that for those PPS functions where unwarranted actuation may adversely affect plarc. safety (i.e., RAS and EFAS) the consequences of this scenario have been previously evaluated and are acceptable. As shown on drawing E-2006, loss of the 2D01 125 VDC bus in conjunction with a LOOP would result in loss of 120 VAC vital buses 2RSI and 2RS3. Loss of 2D02 with a LOOP would result in loss of 2RS2 and 2RS4. The effects of losing either of these combinations of buses on the circuits within the PPS cabinet (2C23 .11 be discussed first. The channel A and B bistable relay power supplies are auctioneered, as are the channel C and D bistable relay power supplies. Therefore, loss of either buses (2RS1 and 2RS3) or (2RS2 and 2RS4) will not directly result in deenergization of any bistable relays. RPS matrix relay coils 1 and 2 are always powered from either channel A or B, and coils 3 and 4 are powered from either channel C or D. Loss of either combination of vital 120 VAC buses will open all four RPS trip paths. A reactor trip during this scenario is an acceptable consequence. ESFAS matrix relay coils 1 and 3 are always powered from either channel A - or C, and coils 2 and 4 are powered from either channel B or D. Loss of either combination of vital 120 VAC buses will only result in a half trip. Since the auxiliary relay cabinet logic is selective two-out-of-four, the half trip will not result in actuation of any safeguards equipment. Each trip path is powered from the associated channel. The ESFAS trip paths which .vould lose power during this scenario are the same ones in which matrix relay cont; cts would open due to loss of power to the matrix relay power supplies. Again the dective two-out-of-four auxiliary relay cabinet logic prevents unwarranted actuation of safeguards equipment. Each auxiliary relay cabinet includes four actuation logic power supplies. A pair of auctioneered power supplies feed each trip leg (i.e., leg 1-3 and leg 2-4). Each train A auxiliary relay cabinet (2C39) trip leg is fed from either 2RS1 or 2RS2 (reference drawing C)E E-2022). Each train B auxiliary relay cabinet (2C40) trip leg is fed from either 2RS3 or Document No. 6370-ICE-3316 Revision 00 Page 192 of 257
93-R-2003-01 2RS4. Therefore, loss of either (2RSI and 2RS3) or (2RS2 and 2RS4) (as postulated during 0 a LOOP and single battery bus failure) will not cause a loss of }mer to any auxiliary relay cabinet trip leg circuits. Going back to the process measurement instmmentation, cenain loops would failin the tripped mode on loss of instrument power. The instrument loops of concern are RWT level and steam generator level since these signals initiate RAS and EFAS. As shown on drawings E-2723 and E-2725, the channel 2 and 3 loops include an auctioneered power source. For example, RWT level channel 3 (2LT-5639-3) can be powered from either 2RS3 or 2RS4, and steam generator level channel 2 )2LT-1031-2) can be powered from either 2RSI or 2RS2. This auctioneered power source arrangement ensures that this scenario will only result in a trip signal from one of the four redundant channels. The CPC is credited in the safety analysis for the LOOP protection. In the event of loss of off-site power, the plant would experience a simultaneous loss of load, feedwater flow, and forced reactor coolant flow. As the speed of the reactor coolant pumps decrease to 96.5% of the rated design speed, the CPC will initiate a loss of flow trip signal, which in turn trips the reactor. The CPC requires approximately 300 milliseconds after the trip setpoint is reached to execute and initiate a Low DNBR reactor trip signal to the PPS. With a loss of offsite power and an assumed single failure of a vital bus battery,120 VAC vital power will be lost in two CPC channels. Whenever the CPC senses the loss of 120 VAC power an internal machine interrupt occurs in each affected channel. For these O channels, the ALARM subroutine is called, which sets all Pre-Trip and Trip Bits. The software will output to the trip contacts. The software execution takes less than two milliseconos to initiate the Iww DNBR reactor trip signal to the PPS, which is considerably less than the 300 milliseconds stated in the safety analysis. As discussed in the preceding paragmphs, a LOOP in conjunction with a single DC bus failure will produce the following consequences:
- A reactor trip will occur.
- The actuation logic of the ESFAS functions will be in a half trip condition (i.e., l either trip leg 1-3 or trip leg 2-4 will be open in both auxiliary relay cabinets).
- Single channel RWT and steam generator level trips will occur. i e The RAS and EFAS actuation logic becomes one-out-of-three, or one-out-of-two if a channel is assumed to be in bypass.
All of these consequences have been previously evaluated as part of the original SER and are acceptable. [ Regarding item 2, it will be shown that there are no credible single failures alone or design basis events alone that result in a loss of power or an unacceptable electrical transient on more than one vital bus. As discussed in detail in Section 3.8.1, each vital invener has nonnal, alternate and backup sources of power. Each invener continuously monitors its O power sources, and will automatically shift to the alternate or backup source as necessary to continuously supply the load. Due to the characteristics of the constant voltage Document No. 6370-ICE-3316 Revision 00 Page 193 of 257 !
93-R-2003-01 (ferroresonant) transformer, and the sync board which maintains the invener output in sync with the alternate AC source, disniptions of the normal and/or alternate sources do not cause significant distortions in the output waveform. The response of the various inverter circuits to all credible faults on the AC and DC input power sources is presented in Section 3.8.5. The effect of each credible fault on the output voltage and frequency is discussed, and references to test data which substantiate the corresponding inverter specifications are provided. As discussed in Section 3.8.2, physical separation is maintained between the components and meeways associated with each of the four vital 120 VAC buses. The inverters, distribution panels and aceways are seismically mounted. The inveners and distribution panels are located in limited hazard areas, and therefore are not exposed to the effects of high energy lines, exposure fires or missiles. The areas in which this equipment is located are not subject to flooding. Where fire protection lines are located in close proximity to vital 120 VAC system components (e.g.,2RS2 and 2RS4) the equipment enclosures have been designed to provide adequate protection against the effects of spraying water. In summary, there are no design basis events or single failures that would result in loss of mom than one vital 120 VAC bus, and therefore the four vital buses are independent. During initial NRC review of the ANO-2 Plant Protection System questions were raised concerning the impact of the auctioneered power supplies on the independence of the 120 VAC vital buses. In Section 7.2.2 of the original SER test data was requested to prove that Ns independence would be maintained during postulated maximum credible faults and surges. SER supplements 1 and 2, and related correspondence further clarified this issue. In panicular, tests designed to verify RAS would not be inadvertently actuated by a fault or [ surge were required. In response, the maximum credible faults were defined and tests were conducted on the PPS power supplies and RAS circuits to verify that the effects of any fault or surge would be limited to a single channel or matrix. The PPS power supply test progmm is presented in Section 3.7. This section of the analysis will reevaluate the basis for each of the previously identified maximum credible faults. The original PPS power supply test program included a 508VAC input fault. At that time this fault was considered to be credible based on inadequate physical separation between the 480VAC invener input power feed and the invener 120VAC output. Prior to the initial fuel load the original inveners were replaced. As described in Section 3.8.3, adequate separation between the 480 VAC input and the 120VAC output is maintained within the existing SCI inverters. The original test program also included a 140VDC fault which was considered to be credible based on inadequate separation within the previous inverters. Separation between the 125VDC input and the 120VAC .5verter output is also described in Section 3.8.3. The inverter input power sources are routed a separate raceways. No 480VAC power cables are routed in any of the raceways utilized for the 120VAC vital power distribution system. In conclusion, the 120VAC vital buses are physically and electrically isolated from the 480VAC and 125VDC systems, and the maximum credible fault voltage is limited to 132VAC. This value is based on the normal bus voltage plus the invener voltage regulation specification of 10 percent. As discussed in Section 3.8.4 surge suppression circuits are present at the input O, and output of each vital inverter. Test data demonstrates the ability of these circuits to attenuate the magnitude of typical voltage transients. When subjected to the surge waveform Document No. 6370-ICE-3316 Revision 00 Page 194 of 257
93-R-2003-01 defined in IEEE Standard 472-1974, a maximum output voltage of 50 volts (100 volts peak ]v to peak) was observed. 3.8.1 Description Of The 120 VAC Power Sources To The PPS Equipment 3.8.1.1 Power Distribution Panels 2RS-1,2RS-2,2RS-3 and 2RS-4 Power distribution panels 2RS1, 2RS2, 2RS3 and 2RS4 are the four (4) independent power sources providing all the 120VAC requirements of the Plant Protection System. Since the PPS is comprised of four redundant channels, the 120VAC power sources to PPS equipment are channelized accordingly. Power distribution panel 2RS-1 provides power to the PPS measurement channel equipment associated with channel 1 as follows:
- Auxiliary Equipment Cabinet 2C336-1 via breaker number 1.
- CPC cabinet 2C395 via breaker number 7
- CPC cabinet 2C394 via breaker number 16.
- PPC cabinet 2C15-1 via breaker number 17.
- PPS cabinet 2C23-1 via breaker number 18.
(
Reference:
Dmwing E-2022, Rev.19) The power distribution panel 2RS-2 provides power to the PPS measurement channel equipment associated with channel 2 as follows:
- Auxiliary equipment cabinet 2C336-2 via breaker number 1.
- CPC cabinet 2C397 via breaker number 7.
- CPC cabinet 2C396 via breaker number 16.
- PPC cabinet 2C15-2 via breaker number 17.
- PPS cabinet 2C23-2 via breaker number 18.
(
Reference:
Drawing E-2022, Rev.19) The power distribution panel 2RS-3 provides power to the PPS measurement channel equipment associated with channel 3 as follows:
- Auxiliary equipment cabinet 2C336-3 via breaker number 1.
- PPC cabinet 2C15-3 via breaker number 3.
- CPC cabinet 2C398 via breaker number 7.
- CPC cabinet 2C399 via breaker number 16.
- PPS cabinet 2C23-3 via breaker number 18.
(
Reference:
Drawing E-2022, Rev.19) O ; Document No. 6370-ICE-3316 Revision 00 Page 195 of 257 j
93-R-2003-01 The power distribution panel 2RS-4 provides power to the PPS measurement channel [ equipment associated with channel 4 as follows:
- Auxiliary equipment cabinet 2C336-4 via breaker number 1.
- PPC cabinet 2C15-4 via breaker number 3.
- CPC cabinet 2C400 via breaker number 7.
- CPC cabinet 2C401 via breaker number 16.
- PPS cabinet 2C23-4 via breaker number 18.
(
Reference:
Drawing E-2022, Rev.19) 3.8.1.2 Inverters 2Y11,2Y13,2Y22 and 2Y24 ' Each of these class IE inverters is the sole source of power for only one of the 120 VAC vital buses: g*
- 2Y11 supplies power distribution panel 2RS-1 via cables R2Y010lK and R2YO10lJ.
2Y22 supplies power distribution panel 2RS-2 via cables G2Y0102B, G2Y0102A, G2Y01028 and G2Y01029. Inverter 2Y22 also supplies instrument cabinet 2C384 via cables G2YO102A, G2Y0102B and G2Y0102C.. A'+ 2Y13 supplies power distribution panel 2RS-3 via cables Y2Y0103K and Y2Y0103J. t.d'
- 2Y24 supplies power distribution panel 2RS-4 via cables B2Y01049 and B2Y01048.
(Reference drawings E-2524 Rev.14 and E-2971 sheets 3 and 4, Rev. 9.) 0
, There are two input power sources for each inverter, i.e., the normal 480VAC and the backup battery supplied 125VDC. In addition the design provides for an alternate 480VAC power source associated with each inverter.
3.8.1.3 480 VAC Normal Source For The Vital Inverters During nonnal operation, the power sources to the inverters are as follows:
- 480VAC MCC 2B54 supplies inverter 2Y11 via breaker 52-54El.
- 480VAC MCC 2B53 supplies inverter 2Y13 via breaker 52-53E2.
- 480VAC MCC 2B64 supplies inverter 2Y22.via breaker 52-64El.
- 480VAC MCC 2B64 supplies inverter 2Y24 via breaker 52-64E2.
(Reference Drawings E-2971 Sheets 3 and 4, Rev. 9, E-2014 Sheet 3, Rev. 27 and Sheet 4, Rev. 28, E-2524, Rev.14, and E-2015, Sheet 1, Rev. 26.) 3.8.1.4 125 VDC Backup Source For The Vital Inverters The battery supplied backup 125VDC sources for the inverters are as follows:
- 125 VDC Control Center 2D01 supplies inverter 2Yll via breaker number 72-0113 and inverter 2Y13 via breaker number 72-0114.
O Document No. 6370-ICE-3316 Revision 00 Page 196 of 257
93-R.-2003-01
- 125 VDC Control Center 2D02 supplies invener 2Y22 via breaker number 72-0213 and invener 2Y24 via breaker number 72-0214.
(
Reference:
Drawing E-2017, Rev. 35) 3.8.1.5 480 VAC Alternate Source For The VitalInverters The alternate (or emergency) 480VAC sources associated with the inverters are as follows:
- 480VAC MCC 2B53 supplies invener 2Y11 output via breaker 52-53El.
- 480VAC MCC 2B54 supplies invener 2Y13 output via breaker 52-54E2.
- 480VAC MCC 2B61 supplies inverter 2Y22 output via breaker 52-61C1.
- 480VAC MCC 2B61 supplies inverter 2Y24 output via breaker 52-61C2.
(Reference Drawings E-2971 Sheets 3 and 4, Rev. 9, E-2014 Sheet 3, Rev. 27 and Sheet 4, Rev. 28, E-2524, Rev.14, and E-2015, Sheet 1, Rev. 26.) O
)
Document No. 6370-1CE-3316 Revision 00 Page 197 of 257 i
l 93-R-2003-01 3.8.2 kparation Of The 120VAC Vital Bus Power Feeds To PPS 3.8.2.1 Inverter Power Feeds To The 120VAC Vital Distribution Panels 3.8.2.1.a Cable Routing For The 120VAC Power Feed From Inverter 2Y11 To i 120VAC.10 Panel 2RS1 I I As shown on drawings E-2867 and E-2872 the power cable routing from inverter 2Y11, 1 located in D.C. equipment room on floor EL. 372'-0", to panel 2RSI located in access corridor outside electrical equipment room on floor EL. 372'-0" is as follows:
- From inverter 2Y11, the cable is muted via conduit ECl249 to cable tray EC120.
The route continues in cable trays EC120, ECl21, EC122 and EC126, all of which h- are located in ceiling space on floor EL. 372'0". The cable is then routed via cable tmy riser ECR101 down into panel 2RSI. 3.8.2.1.b Cable Routing For The 120VAC Power Feed From Inverter 2Y22 To 120VAC.10 Panel 2RS2 As shown on drawings E-2858, E-2867, E-2872 and E-2925, the power cable routing from inverter 2Y22, located in electrical equipment room no. 2091 on floor EL. 372'-0" in area v 23 to panel 2RS2 located in access corridor outside electrical equipment room in area 24 on floor EL. 372'-0" is as follows:
- From inverter 2Y22, the cable is routed via cable tray EC275 and conduit EC2446 to terminal box 2TB995.
From terminal box 2TB995, the route continues via conduit EC2447 to cable tray EC275 and then to embedded conduit EC2364. From embedded conduit EC2364, the cable is routed via cable tray EC276 to junction box 2JB42J. The routing continues from junction box 2JB42J via conduit EC2365, cable trays EC216, EC217 and finally down into panel 2RS2 via cable tray riser ECR201. All the routing of cable trays and conduits is in ceiling space on floor EL. 372'-0". 3.8.2.1.c Cable Routing For The 120VAC Power Feed From Inverter 2Y22 To Instrument Cabinet 2C384 As shown on drawings E-2858, E-2859, E-2890 and E-2925, the power cable routing from inverter 2Y22 to instrument cabinet 2C384, located in the upper north electrical penetration , room is as follows: N]J Document No. 6370-ICE-3316 Revision 00 Page 198 of 257
93-R-2003-01 From invener 2Y22, the cable is routed to terminal box 2TB995 as described above. p J Within 2TB995, separate fuses are provided for 2RS2 and 2C384. From terminal box 2TB995, the route continues via conduit EC2447 to cable tmy EC275 which runs from room no. 2091 to the lower nonh electrical penetration-room. From cable tray EC275, the cable is routed up to cable tray EB256 in the upper north electrical penetration room via conduit EC2449. Conduit EC2436 is used to complete the routing between cable tray EB256 and cabinet 2C384. 3.8.2.1.d Cable Routing For The 120VAC Power Feed From Inverter 2Y13 To 120VAC.10 Panel 2RS3 As shown on drawings E-2867 and E-2872 the power cable routing from inverter 2Y13, located in D.C. equipment room on floor EL. 372'-0" to panel 2RS3 located outside electrical equipment room on floor EL. 372'-0" is as follows: From invener 2Y13, the cable is routed via conduit EC3001 in ceiling space on EL. 372'-0" directly to panel 2RS3. 3.8.2.1.e Cable Routing For The 120VAC Power Feed From Inverter 2Y24 To O- 120VAC.10 Panel 2RS4 As shown on drawings E-2858, E-2867, E-2872, and E-2925, the power cable routing from invener 2Y24 located in electrical equipment room no. 2091 on floor EL. 372'-0" in area 23 to panel 2RS4 located in access corridor outside electrical equipment room in area 24 on floor El. 372'-0" is as follows: From inverter 2Y24, the cable is routed via conduit EC4032 to junction box 2JB35D. From junction box 2JB35D the route continues in embedded conduit EC4033 to junction box 2JB42H. From junction box 2JB42H, the cable routing continues via conduit EC4034 which routes cable down into panel 2RS4. 3.8.2.1.f Separation Between The Inverter Power Feeds To The 120VAC Vital Distribution Panels The channel 1 and 3 inveners (2Y11 and 2Y13) are located side by side in DC Equipment Room 2099. Separation is maintained by mechanical barriers and an air gap of approximately one inch. The channel 2 and 4 inverters (2Y22 and 2Y24) are also located side by side in Electrical Equipment Room 2091. Separation is again maintained by mechanical barriers and a one inch air gap. All four vital distribution panels (2RS1 through Document No. 6370-ICE-3316 Revision 00 Page 199 of 257
93-R-2003-01 2RS4) are located in the hallway outside the cable spreading room. Panels 2RS2 and 2RS4 0 are located on the east side of column line 5. Panels 2RS1 and 2RS3 are located on the west side of column line 5, approximately 11 feet away. A minimum horizontal separation distance of 18" exists between any two panels. There are no high energy lines or missile I hazards in these three areas. The areas in which this equipment is located are not subject to flooding. Where fire protection lines are located in close proximity to vital 120 VAC system components (e.g.,2RS2 and 2RS4), the equipment enclosures have been designed to provide adequate protection against the effects of spraying water. All conduit and cable trays utilized for the routing of these power cables contain only low voltage control cables associated with the respective PPS channel. Due to the locations of the channel 1 and 3 inverters and distribution panels, all associated raceways are located west of column line 5. Due to the ; locations of the spent fuel pool and distribution panels, the channel 2 and 4 power feeds are l routed to the east of column line 5. Separation between channels 1 and 3 and between l channels 2 and 4 has been maintained by routing the power feeds to 2RS3 and 2RS4 in l dedicated conduits. Separation is also maintained between the channel 2 power feed to instrument cabinet 2C384 and all other channels. In summary, the separation between channels is consistent with the requirements of Section 1.4. ! l 3.8.2.2 120VAC Vital Power Feed To Instrument Cabinet 2C336 3.8.2.2.a Cable Routing For The Power Feed From 120VAC.10 Panel 2RS1 (30A Breaker 2RS101) To Instrument Cabinet 2C336-1 As shown on Drawings E-2867, E-2868 and E-2872 the power cable routing from panel , 2RSI located in access corridor outside electrical equipment room on floor EL. 372'-0" to instrument cabinet 2C336-1 located in control room on floor EL. 386'-0" is as follows: From panel 2RS1, the cable is routed via conduit ECl339 up to floor EL. 386'-0" and then to ceiling space above hallway west of control room. ; The route continues in conduit ECl339 above control room in the ceiling space and then drops down into top of cabinet 2C336-1, 3.8.2.2.b Cable Routing For The Power Feed From 120VAC.10 Panel 2RS2 (30A Breaker 2RS201) To Instrument Cabinet 2C336-2 As shown on Drawings E-2867, E-2868 and E-2872 the power cable routing from panel 2RS2 located in access corridor outside electrical equipment room on floor EL. 372'-0" to instrument cabinet 2C336-2 located in control room on floor EL. 386'-0" is as follows: From panel 2RS2, the cable is routed via conduit EC2390 up to floor EL. 386'-0" and then to ceiling space above hallway west of control room. , l The route continues in conduit EC2390 above control room in the ceiling space and then drops down into top of cabinet 2C336-2. Document No. 6370-ICE-3315 Revision 00 Page 200 of 257
93 R.-2003-01 3.8.2.2.c Cable Routing For The Power Feed From 120VAC.10 Panel 2RS3 (20A Breaker 2RS301) To Instrument Cabinet 2C336-3 (V] As shown on Drawings E-2867, E-2868 and E-2872 the power cable routing from panel 2RS3 located in access corridor outside electrical equipment room on floor EL. 372'-0" to instrument cabinet 2C336-3 located in control com on floor EL. 386'-0" is as follows: From panel 2RS3, the cable is routed via conduit EC3035 ap to floor EL. 386'-0" and then to ceiling space above hallway west of control rocm. The route continues in conduit EC3035 above control room in the ceiling space and then drops down into top of cabinet 2C336-3. 3.8.2.2.d Cable Routing For The Power Feed From 120VAC.10 Panel 2RS4 (20A Breaker 2RS401) To Instrument Cabinet 2C336-4 As shown on Drawings E-2867, E-2868 and E-2872 the power cable routing from panel 2RS4 located in access corridor outside electrical equipment room on floor EL. 372'-0" to instrument cabinet 2C336-4 located in control room on floor EL 386'-0" is as follows: From panel 2RS4, the cable is routed via conduit EC4036 up to floor EL. 386'-0" and then to ceiling space above hallway west of control room. ( - The route continues in conduit EC4036 above control room in the ceiling space and then drops down into top of cabinet 2C336-4 3.8.2.2.e Separation Between Power Feeds To Instrument Cabinet 2C336 As described above the power feed to each bay of cabinet 2C336 from the associated vital distribution panel is routed in dedicated conduit. The required minimum separation distance of one inch has been maintained between these four conduit mns. 3.8.2.3 120VAC Vital Power Feed To The CPC Computer Cabinets 3.8.2.3.a Cable Routing For The Power Feed From 120VAC.10 Panel 2RS1 (20A Breaker 2RS107) To CPCA CPU Cabinet 2C395 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RSI located in access corridor outside electrical equipment room on floor EL. 372'-0" to CPU cabinet 2C395 located in CPC room on floor EL. 372'-0" is as follows: From panel 2RS1, the cable is routed via conduit ECl390 into Electrical Equipment l Room 2108. It continues in conduit EC1390 below ceiling in Electrical Equipment Room 2108 and drops down below false floor in CPC room and up into bottom of cabinet 2C395. Document No. 6370-ICE-3316 Revision 00 Page 201 of 257
93-R-2003-01 3.8.2.3.b Cable Routing For The Power Feed From 120VAC.10 Panel 2RS2 (20A O V Breaker 2RS207) To CPCB CPU Cabinet 2C397 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RS2 located in access corridor outside electrical equipment room on Door EL. 372'-0" to CPU cabinet 2C397 located in CPC room on Door EL. 372'-0" is as follows: From panel 2RS2, the cable is routed via conduit EC2456 into cable spreading room and then into Electrical Equipment Room 2108. It continues in conduit EC2456 below ceiling in Electrical Equipment Room 2108 and drops down below false floor in CPC room and up into bottom of cabinet 2C397. 3.8.2.3.c Cable Routing For The Power Feed From 120VAC.10 Panel 2RS3 (20A Breaker 2RS307) To CPCC CPU Cabinet 2C398 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RS3 located in access corridor outside electrical equipment room on floor EL. 372'-0" to CPU cabinet 2C398 located in CPC room on floor EL. 372'-0" is as follows: From Panel 2RS3, the cable is routed via conduit EC3037 into Electrical Equipment Room 2108. It continues in conduit F.C3037 below ceiling in Electrical Equipment Room 2108 and drops down below false floor in CPC room and up into bottom of cabinet 2C398. 3.8.2.3.d Cable Routing For The Power Feed From 120VAC.10 Panel 2RS4 (20A Breaker 2RS407) To CPCD CPU Cabinet 2C400 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RS4 located ) in access corridor outside electrical equipment room on floor EL. 372'-0" to CPU cabine.t ! 2C400 located in CPC room on floor EL. 372'-0" is as follows: From panel 2RS4, the cable is routed via conduit EC4038 into cable spreading room and then into Electrical Equipment Room 2108. i It continues in conduit EC4038 below ceiling in Electrical Equipment Room 2108 and ! drops down below false Door in CPC room and up into bottom of cabinet 2C400. 3.8.2.3.c Separation Between Power Feeds To The CPC CPU Cabinets l The power feed to each CPC CPU cabinet is run in conduit all the way from the associated i vital distribution panel. The only other cable in each of these conduits is the power feed to the CPC termination cabinet of that charmel. The required minimum sepamtion distance of one inch has been maintained between these four conduit mns. Document No. 6370-ICE-3316 Revision 00 Page 202 of 257
93-R-2003-01 ' 3.8.2.4 120VAC Vital Power Feed To The CPC Termination Cabinets 3.8.2.4.a Cable Routing For The Power Feed From 120VAC.10 Panel 2RS1 (20A Breaker 2RS116) To CPC A Termination Cabinet 2C394 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RSl located in access corridor outside electrical equipment room on floor EL. 372'-0" to CPC cabinet 2C394 located in CPC room on floor EL. 372'-0" is as follows: From panel 2RS1, the cable is routed via conduit ECl390 into Electrical Equipment Room 2108. It continues in conduit EC1390 below ceiling in Electrical Equipment Room 2108 and drops down below false floor in CPC room and up into bottom of cabinet 2C394. 3.8.2.4.b Cable Routing For The Power Feed From 120VAC.10 Panel 2RS2 (20A Breaker 2RS216) To CPC B Termination Cabinet 2C396 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RS2 located in access corridor outside electrical equipment room on floor EL. 372'-0" to CPC cabinet 2C396 located in CPC room on floor EL. 372'-0" is as follows: From pancl 2RS2, the cable is routed via conduit EC2456 into cable spreading room O and then into Electrical Equipment Room 2108.
- It continues in conduit EC2456 below ceiling in Electrical Equipment Room 2108 and .
drops down below false floor in CPC room and up into bottom of cabinet 2C396. 3.8.2.4.c Cable Routing For The Power Feed From 120VAC.10 Panel 2RS3 (20A Breaker 2RS316) To CPC C Termination Cabinet 2C399 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RS3 located in access corridor outside electrical equipment room on floor EL. 372'-0" to CPC cabinet 2C399 located in CPC room on floor EL. 372'-0" is as follows: From panel 2RS3, the cable is routed via conduit EC3037 into Electrical Equipment Room 2108. It continues in conduit EC3037 below ceiling in Electrical Equipment Room 2108 and drops down below false floor in CPC room and up into bottom of cabinet 2C399.- 1 V Document No. 6370-ICE-3316 Revision 00 Page 203 of 257
93 R 2003-01 3.8.2.4.d Cable Routing For The Power Feed From 120VAC.10 Panel 2RS4 (20A Breaker 2RS416) To CPC D Termination Cabinet 2C401 As shown on Drawings E-2872 and E-2892 the power cable routing from panel 2RS4 located in access corridor outside electrical equipment room on floor EL. 372'-0" to CPC cabinet 2C401 located in CPC mom on floor EL. 372'-0" is as follows: From panel 2RS4, the cable is routed via conduit EC4038 into cable spreading room and then into Electrical Equipment Room 2108. It continues in conduit EC4038 below ceiling in Electrical Equipment Room 2108 and drops down below false floor in CPC room and up into bottom of cabinet 2C401. 3.8.2.4.e Separation Between Power Feeds To The CPC Termination Cabinets The power feed to each CPC termination cabinet is mn in conduit all the way from the associated vital distribution panel. The only other cable in each of these conduits is the power feed to the CPC CPU cabinet of that channel. The required minimum separation distance of one inch has been maintained between these four conduit mns. 3.8.2.5 120VAC Vital Power Feed To Process Protective Cabinet 2C15 3.8.2.5.a Cable Routing For The Power Feed From 120VAC.10 Panel 2RS1 (30A Breaker 2RS117) To Process Protective Cabinet 2C15-1 As shown on Drawings E-2868 and E-2872 the power cable routing from panel 2RS1 located in access corridor outside electrical equipment room on floor EL. 372'-0" to process protective cabinet 2C15-1 located in panel room no. 2150 on floor EL. 404'-0" is as follows: From panel 2RSI, the cable is routed via conduit ECl337 up to floor EL. 386'-0" and then to ceiling space above hallway west of control room. - The route continues in conduit EC1337 above hallway and turns up into bottom of cabinet 2C15-1. 3.8.2.5.b Cable Routing For The Power Feed From 120VAC.10 Panel 2RS2 (50A Breaker 2RS217) To Process Protective Cabinet 2C15-2 As shown on Drawings E-2868 and E-2872 the power cable routing from panel 2RS2 located in access corridor outside electrical equipment room on floor EL. 372'-0" to process protective cabinet 2C15-2 located in panel room no. 2150 on floor EL. 404'-0" is as follows: From panel 2RS2, the cable is routed via conduit EC2387 up to floor EL. 386'-0" and then to ceiling space above hallway west of control room. O Document No. 6370-ICE-3316 Revision 00 Page 204 of 257
93-R-2003-01 The route continues in conduit EC2387 above hallway and tums up into bottom of cabinet 2C15-2. 3.8.2.5.c Cable Routing For The Power Feed From 120VAC.10 Panel 2RS3 (50A Breaker 2RS303) To Process Protective Cabinet 2C15-3 As shown on Drawings E-2868 and E-2872 the power cable routing from panel 2RS3 located in access corridor outside electrical equipment room on floor EL. 372'-0" to process protective cabinet 2C15-3 located in panel room no. 2150 on floor EL. 404'-0" is as follows: From panel 2RS3, the cable is routed via conduit EC3025 up to floor EL. 386'-0" and then to ceiling space above hallway west of control room. The route continues in conduit EC3025 above hallway and turns up into bottom of cabinet 2C15-3. 3.8.2.5.d Cable Routing For The Power Feed From 120VAC.10 Panel 2RS4 (30A Breaker 2RS403) To Process Protective Cabinet 2C15-4 As shown on Dmwings E-2868 and E-2872 the power cable routing from panel 2RS4 located in access corridor outside electrical equipment room on floor EL 372'-0" to process protective cabinet 2C15-4 located in panel room no. 2150 on floor EL. 404'-0" is as follows: From panel 2RS4, the cable is routed via cable tray riser ECR400 to conduit w EC4015. Conduit EC4015 is routed up to floor EL. 386'-0" and then to ceiling space above hallway west of control room. The route continues in conduit EC4015 and turns up into bottom of cabinet 2C15-4. 3.8.2.5.e Separation Between Power Feeds To Process Protective C8 binet 2C15 As described above the power feed to bays 1,2 and 3 of cabinet 2C15 from the associated vital distribution panel is routed in dedicated conduit. The channel 4 power feed is routed in a covered cable tray from 2RS4 up into the overhead. Dedicated conduit is utilized for the remainder of this route. The required minimum separation distance of one inch has been maintained between these four conduit runs. O Document No. 6370-ICE-3316 Revision 00 Page 205 of 257
93-R-2003-01 3.8.2.6 120VAC Vital Power Feed To Plant Protective System Cabinet 2C23 i 3.8.2.6.a Cable Routing For The Power Feed From 120VAC.10 Panel 2RS1 (30A Breaker 2RS118) To Plant Protection System Panel 2C23-1 As shown on Drawings E-2872 and E-2884 the power cable routing from panel 2RSI located in access corridor outside electrical equipment room on floor EL. 372'-0" to plant protection system panel 2C23-1 located in control mom on floor EL. 386'-0" is as follows: From panel 2RS1, the cable is routed via cable tray riser ECR101 to conduit EC1058. The route continues in conduit EC1058 thmugh wall into cable spreading room ceiling slab and then turns up into bottom of panel 2C23-1. 3.8.2.6.b Cable Routing For The Power Feed From 120VAC.10 Panel 2RS2 (50A Breaker 2RS218) To Plant Protection System Panel 2C23-2 As shown on Drawings E-2867, E-2868 and E-2872 the power cable routing from panel 2RS2 located in access corridor outside electrical equipment room on floor EL. 372'-0" to plant protection system panel 2C23-2 located in control room on floor EL. 386'-0" is as follows: From panel 2RS2, the cable is routed via cable tray riser ECR201 and cable tray-EC217 to conduit EC2214. The route continues in conduit EC2214 up to floor EL. 386'-0" and then to conduit EC2216. The route continues in conduit EC2216 to junction box 2JB046 which is located in control room ceiling space. From junction box 2JB046, the route continues via conduit EC2212 which runs in ceiling space above control room and then turns down into top of panel 2C23-2. 3.8.2.6.c Cable Routing For The Power Feed From 120VAC.10 Panel 2RS3 (30A Breaker 2RS318) To Plant Protection System Panel 2C23-3 As shown on Drawings E-2867, E-2868 and E-2872 the power cable routing from panel 2RS3 located in access corridor outside electrical equipment room on floor EL. 372'-0" to plant protection system panel 2C23-3 located in control room on floor EL. 386'-0" is as , follows, i From panel 2RS3, the cable is routed via conduit EC3021 to junction box 2JB41W. ) h- From junction box 2JB41W the route continues via conduit EC3022 up to floor EL. 386'-0" when: it enters a tee and then continues in conduit EC3015. (3 V l l Document No. 6370-ICE-3316 Revision 00 Page 206 of 257 l ___________ _ i
93-R-2003-01 O - Conduit EC3015 is routed above control room ceiling to junction box 2JB045, which b is located in control room ceiling space. The cable routing then continues via conduit EC3013 in ceiling space above control room and then turns down into top of panel 2C23-3. 3.8.2.6.d Cable Routing For The Power Feed From 120VAC.10 Panel 2RS4 (30A Breaker 2RS418) To Plant Protection System Panel 2C23-4 As shown on Drawings E-2872 and E-2884 the power cable routing from panel 2RS4 located in access corridor outside electrical equipment room on floor EL. 372'-0" to plant protection system panel 2C23-4 located in control room on floor EL. 386'-0" is as follows: From panel 2RS4, the cable is routed via conduit EC4003 through wall into cable spreading room ceiling slab and then turns up into bottom of panel 2C23-4, 3.8.2.6.e Separation Between Power Feeds To Plant Protection System Cabinet 2C23 The channel 1 and 4 power feeds are routed up into the overhead above the respective distribution panel. From this point on the routing is via embedded conduit to the PPS cabinet. The channel 2 and 3 power feeds are routed up to junction boxes mounted on the ceiling in the north east comer of the control room. The channel 2 and 3 power feeds enter O bays 2 and 3 of the PPS cabinet from above. Separation between channels meets the requirements of Section 1.4. 3.8.3 Separation Between The Inverters Input and Output Power Circuits The as-built condition of the power cable terminations inside each inverter cabinet are as follows:
- 1. The power cables associated with the 480VAC normal source tenninate on a four point terminal block. The termination points are identined as LL1, LL2 and LL3 (the founh point is left unused).
- 2. The power cables associated with the battery supplied backup D.C. source, terminate on a two point terminal block. The terminating points are identified as 31 and 32.
- 3. The power cables associated with the 480 VAC alternate source, terminate on a two point terminal block. The terminating points are identified as 310 and 315.
- 4. The power cables associated with the 120VAC output, tenninate on a two point tenninal block. The terminating points are identified as 12 and 298.
(Reference Drawings E-2971 Sheets 3 and 4, Rev. 9). Document No. 6370-ICE-3316 Revision 00 Page 207 of 257
93-R-2003-01 The wiring connections described above, are in accordance with the Specification E-2028, Rev. 6, which specifies that: The AC nonnal input source, the battery supplied D.C. input source, the AC altemate source and the inverter system output shall be connected to physically separate terminal blocks, and the separation shall be adequate to prevent cable failures associated with the AC input from adversely affecting the inverter system output. As shown on drawing 6600-E-2028-10, Rev.1, the cable entries are made from the top of the inverter cabinet through their associated conduits. Inside the cabinet immediately below the top side, there are two termination channels where the sepamte terminal blocks are installed. This con 0guration precludes the inverter output from experiencing faults directly from faulty 480VAC or 125VDC input cables. Since the inverters are capable of providing electrical isolation between the input and output power circuits, and since physical separation is also maintained, the credible fault levels that could be experienced at the output of the inverters are those associated with the 120VAC output power circuits. The inverter's design limits the maximum deviation to 120VAC i10%D81 3.8.4 Surce Withstand Caoability As discussed in IEEE Standard 399-1980 " Recommended Practice for Industrial And Commercial Power Systems Analysis", transient voltages and currents are genemted whenever switching events occur in circuits with large inductances or capacitances. Within a power plant the opening or closing of a circuit breaker feeding a large motor would constitute a typical switching event. Abnormal events such as lightning and electrical faults also generate surges in distribution systems. Several techniques are used in virtually all power plants to protect sensitive low voltage equipment from surges originating in the higher voltage power circuits. These included: switchyard surge arresters, breaker design, motor starting circuit design, surge capacitors, filters and segregation of cabling by voltage. Due to the number of circuit elements involved and the nonlinearity of their response, quantitative analysis of surge propagation in electrical distribution systems does not provide a practical base for establishing equipment surge withstand requirements. This dif0culty is resolved by IEEE Standard 472-1974 "IEEE Guide for Surge Withstand Capability (SWC) Tests". As discussed in the appendix of this standard, the electrical characteristics of the SWC test wavefonn are based on measurements of actual surges in typical power distribution systems. The critical waveform characteristics are peak voltage, frequency and source impedance. Due to the short duration of a surge burst (approximately 12 cycles at 1.0 sec/ cycle) and the relatively high source impedance (150 ohms), the power which must be dissipated in the load components is small. However, the defined minimum peak voltage of 2.5 KV far exceeds the voltage rating of many components used in relay systems. It should also be noted that overcurrent protective devices (e.g., fuses) offer virtually no protection to the load components from the voltage transient. The original PPS power supply tests verified that transient voltages present on one vital bus could not propagate through the auctioneered power supplies and cause an unacceptable s disturbance on another vital bus. However, the high voltage surge input did cause a loss of power supply output voltage in some test cases. All PPS functions are designed to fail in the tripped state on loss of power. Premature actuation of RAS could compromise the safety Document No. 6370-ICE-3316 Revision 00 Page 208 of 257
~- 93 R-2003-01 injection and containment spray functions. Therefore, it would be unacceptable for a surge present at one of the two redundant ESF 480VAC load centers to propagate through the two associated vital inveners retaining sufficient voltage amplitude to simultaneously cause actuation (via power supply damage) of two RAS channels. In response to this postulated failure mechanism, the inverter manufacturer (SCI) was contracted to design and test a surge suppression circuit for the vital inverters. This circuit was designed to attenuate the maximum transient invener output voltage to below the PPS power supply damage threshold of 400 volts. The surge suppression circuit design consists of two capacitors connected in series across the input / output tenninals with the center connection grounded. This arrangement provides a low impedancef shunt to ground for high frequency transverse mode and common mode transients Tests were conducted by SCI to optimize the capacitor size based on the input waveform described in IEEE standard 472-1974. Based on these test results 2 microfarad capacitors were selected for use, and the maximum observed output voltage was 100 volts peak to peak. The inverter output surge suppression circuit is shown on drawing 6600-E-2028-24, Rev.6. The D.C. noise suppression board V105 is also shown on this drawing and performs the same function at the inverter input. 3.8.5 Evaluation Of The Faults Associated With The Inout And Outnut Of The Inveners And The Availability Of Power At The Vital Buses The vital inverters 2Yll,2Y13,2Y22 and 2Y24 are Solidstate Controls Inc. (SCI) series SV ferroresonant transformer-based static inverters designed for use in uninterruptible power systems. The required power for each invener is nonnally provided by the 480VAC power sources described in Section 3.8.1.3. Inside an invener cabinet, the 480VAC is directed to a 3 phase input transfonner where the voltage is stepped down to a level suitable for rectification. During nonnal conditions, this rectified power source supplies all the D.C. requirements of the power switching circuits where the inversion process takes place. I (Reference drawings 6600-E-2028-21, Rev. 3, and 6600-E-2028-24, Rev. 6). The invener design provides for a backup battery supplied D.C. source to provide all the requirements of the power switching circuits when the normal power source is experiencing a failure. The backup D.C. source for each inverter is described in Section 3.8.1.4. l (Reference drawing 6600-E-2028-24, Rev. 6) l I The design also provides for an alternate 480 VAC power source for each inverter fed from a different MCC than the normal 480 VAC source. Inside an inverter cabinet the 480VAC is directed to the transformer T5 where the voltage is stepped down to 120VAC providing an alternate power source to the inverter's loads. The conditions in which the alternate power i source is designed to be used are as follows:
- 1. Manual actuation of pushbutton by operation personnel, commanding the invener to tansfer to alternate source.
- 2. Loss or degradation of the inverter's backup battery supplied D.C. input source.
I Document No. 6370-ICE-3316 Revision 00 Page 209 of 257
93-R-200h01
- 3. Failures associated with the inverter's output resulting in loss or degradation of voltage or overcurrent.
The next three subsections will describe the inverters operation when the normal input source, or the backup input source or the output is experiencing a failure. 3.8.5.1 Loss Or Deterioration Of The Normal 480VAC Source To The Inverters The 125 VDC input to the power switching circuits of an inverter can be supplied from the rectified power from the normal 480VAC source or the battery supplied D.C. sburce. A failure associated with an inverter's nonnal 480 VAC input source resulting in loss or degradation of voltage below 432V would cause the inverter system to shift to the backup 125VDC supplied by the station battery. The invener's input circuits are designed such that only one D.C. source will be providing the required power. The Silicon Controlled Rectifier (SCR) logic board V093A which is integral to the invener's input circuit normally allows the rectified D.C. source to supply the D.C. requirements of the invener. However, when the 480VAC normal source falls below the 10% tolerance range (432V), the rectified voltage level will drop to a point where the logic SCR will be supplied a gate signal causing the device to conduct thus applying the battery supplied D.C. source to the invener. The effect of the transfer from normal power source to the backup power source on the f ( inverter's output is just a slight drop in the voltage. The electrical tests performed on the inveners demonstrated that when failures were applied to the normal 480VAC, the input circuits transferred to the backup battery supplied D.C. source. The output of the inverter remained within limits of Specification 6600-E-2028, which specifies the maximum output voltage deviation and recovery time to be 10% and 2 cycles. (Reference Invener Final Test Reports for SCI Job number 9417, dated 3/10/77 for 2Yll,3/24/77 for 2Y13,3/25/77 for 2Y22 and 3/26/77 for 2Y24.) Since the Plant Protection System design can tolerate power source disturbances of 10% for 2 cycles, a failure associated with the 480 VAC normal power to the vital inverters does not prevent the PPS from performing its protective functions. 3.8.5.2 Loss Or Deterioration Of The Backup 125 VDC Input Source To The Inverters As described in Section 3.8.5.1, an inverter operates on it's battery supplied backup D.C. source, only when the 480VAC normal power source is experiencing a failure. However, in the unli.kely event of a fault associated with the battery supplied D.C. source while feeding an inverter, the design provides for transferring the load from the invener output to the alternate 480VAC, thus bypassing the inverter circuits. Any degradation of the DC input power which adversely affects the invener output will cause a transfer to the alternate 480 ' VAC source as described in Section 3.8.5.3. Document No. 6370-ICE-3316 Revision 00 Page 210 of 257
93-R-2003 3.8.5.3 Loss Or Deterioration Of The 120 VAC Output Power Of The Inverters 1 A failure associated with an inverter resulting in loss or deterioratiori of the 120VAC output, would cause the transfer from the invener's output to the 480VAC alternate power source, bypassing the inverter circuits. Imss or deterioration of the output is detected by the inverter's static switch printed circuit board V107A. The PC board must see the undervoltage for a period of 4 milliseconds before it will force a transfer to the alternate ' power source. This delay will result in the loss of inverter's output voltage to the load for a maximum of 1/4 of a cycle. The PPS design can tolerate power source degradation for a period of 1/4 of a cycle. Therefore, a failure associated with the invener output does not prevent the PPS to perfonn it's protective functions. The electrical tests performed on the inveners demonstrated th'e operation of the static switch when failures were applied to the inverter output. (
Reference:
Inverter Final Test Reports for SCI job number 9417, dated 3/10/77 for 2Y11, 3/24/77 for 2Y13, 3/25/77 for 2Y22 and 3/26/77 for 2Y24.) O O Document No. 6370-ICE-3316 Revision 00 Page 211 of 257
RS3 JMo*W d*R0ed $ls4N, he.Sh 6Lf3 M4W/,EMfO .Y A*C (JUd FJegst) , (2) canswe~ - t.s O es.s.wess ^ , 93-R-2003-01 - m _ cy,'v,'r' Q. c, ird q r r, + y ' s, " w ' r. ' i ' ' ' ' ' i i ' y y'r 8 Pa}'.Wgg*'57 , -
,'m i .-----r i n .. ic. b p. ii E.
')
,mr .c-
, i
, i i o ~ i ,
, e, a i n ;
I ' J ',l l E',I I i g,
,8,i );. h,), '
)
u) r t p'i I i n h ,, p' , ~h l p ~.'i,l J h.1 4., p
+ a . .
p 1 , , s _... _.
=
n-+ g-A. , . . . . n,;. --
-+-=:~ -
-,-n r
x+~~.: :.,+wq &. - w -
.2:...,3; :n, e..- .
m- ,,; x
.tf=uz- -: .W -,,
b e.. a .a. . . w
- w
. m. -
- n m. .
%, = . , . ...
=lJ c J w}. .w}; y. y M l [}w wlp.,,t.; -w T'.s.. p, o
2,,I
< =, I*
*:I -*
... I..*..
I~m
-r.. .:I .... I c...
- w.s
~m 4 c-m=I I '*". .,
T mI w
~*r Y' a w q\ %.~? 1, ,T, 1.4.. %. ,1, ,, .1,D' . ,
< u s
[ 1f. W1
. . . . , ' ,IM, s e, l ' 1, 4 - M.
s g . ... .. .. .u. , f\ - h-
*}
i E g]
- .T;~wo .
m w .. , ..,o 4
'c....,
-- %%*--'l abm r-,e ~.
' ac ~.Tra erse cowr ;
l c -- ro sai -- : ('a$
%j
'*';'t.P
f
-Pt- = - ~.s.
. .-s T. ,o e **' ' I i mad
-><-a,-- 14.., Ll rat I" "I =.
I w. g
- '~*g.\. ' - .::,n @-
" ~ 1
/
/ .9
'l
&'.aa n.
1 ~~ % o. t f - {1--L ou% . .. u... p 4. g, r u s s
,,,,u v.--.
..m 1
%,g .. g ,,,
- o. , ,,, > y - . a
. j39 - -- -.--o.
y
,?"*.,
s . .sem g 7 g r. i
'** , ett J .. -..
. . . ,,,, ,,, e,,
h ----
- . , ;. 7 y, , . --.
%g
.3 "'
,*, ~ , , " ,
" a_ a- In a l =,,aws
~'
- ", ";~ ~ a-. . . c
; - '. n
~~ u, , ~s :
-, m ,,
-a,<.<,< t.: H . r*p* - i y - - f) s 4 _,y:- , , , , , .
hm- , ' .
-4 e
i
, , , , . . ,r, q x ,-], . -- - '--m .. .
. _p
, . g;,,, .a r K
.se u '~
, - .ua << >>
m Sil(C6 Sit) Ave-531) ' El
,. .r . n ., m .. ,
- p. q'.. 4 r
,n .-
rer wvrs m (} - ..
.3 .3
- - - -- 2.
a
. w a,,,na.
-. . e- cm.,
BEM TRIP 6YPAS3
^
+i~~g ~" "** m VLTAL BUSFAULT ><,
r - m u. am - ~c [, I
> **** M&.h!'%*.'s*!1W31
<raarcr asret .tret 4 7
. a w rs r arra. e. s j '
9 un sr 6f.a 88 Asp.&# 6< 18vd M4 L r6'.a Wil f
)YuipaTe f.(se a}tA Lte
- e. # seusin W,5 tt.aet4 > .
e is o.sru m m.sna uwta. x., t enaensisic
..J
. wwr W 5t
. : - , I *
- g esemas spads.
- - . . , , ,,-.,r .,,- , - - , . -,,...--m--,.E.- + ,. -m., me-.-tv. .- - . . . . . m_ . .., . i-....d.. - -
e.. - e ,--, 1 i Wi d4_ i l 8 6,i*ip:-eq ;d::i p5; _,_. c6;r'y' prt?q rcs H i i i g i i i e i i i i 1.._---- I l p s l_ _ _ _ _.. m f r f t I h, l_. -
. , r q
i , vy a q h p. j n l y , i . g, m @ io , i L i u ., t ,, a , 3 . , i x .
) wm :. :
~
g_ _ y i p ! n
,,,L x , L,, r s ,-c,waaer "***
rw m n ~ * <
- r* ~~ n M + ,remaq - ?-M , rr% *
.A, -+ n . ,,, ,
M-+< mpyg ,, M-v - 4 . ,,,, m,;- + M
--v,
--e3- -
e- .
'y cE,
-Ej -
y a g5-m
.;;.,,) .,
- [f ;c.- -;gj
,r
'ms3-q m; n :,,n., ,
mpy -a,4
- up '
*w
- c,, .. g * -
.). 3 n.. 1,~ =,,-.
* ]).} ) (1 t: * .g) m]g} w a jp{3 , _j) w a }p})
p's un.
- w. = F,, c ps .-_ .:
M... c
'~s
= = st 13,, -w, x[.
w . c:I
~ I,*~ wI I...o
- m. I. . I. ._g F e wI
.I Im wI I.:w , yl w a lI
,l , I l'. m.Id, G.I
~ IM U.... I T APE 14TURERT.. ". s wI,,4a.s e
, , , , , . c.,I
- , I,c.-.m. .-. 1 .. CnRD p.l, , I,~m. -,
I I i I
- q ' Im r- c1
~1
' rla W ~: ' IM r-Alm witable G rRf'r J@
r-g.rtere car E- .
[f!f(f(_
Ef$ !ff[ 4+
QFflf(_ ;
ffM,f($_ -
rror ca.ss resr cor cow.s rear cas s nA.rtY 31 Costner l M472VA 753rCs4%W7l I l AD Ae.rgst FF77 can mw_.m --rr -e.Lm _) , o=5_m 's i 7, ,f. __<.t._= "*>~1L ,(=.Sc_m e 'twf'
..a pu , _, 4 , ,. ._ m. z. a; .-. %{ CD M,fM*/A TES ldn. - nuh gC,i+T'~,_,$m
- c . _ ,,_ ~~ #,,,,,,
p
, _X -D , . , :. -
e~_ ^ ;tr - t _~~,p : I g gMEN (BM$g-, g:+:_.e t~h.,, p g,,.,.,,, x%b~ _ ~
. 1 . ::=;:~
-f-o m : u ---
r >
- ==> , :
y.q7 ,.y.{ e,t ( n . . _
- rra w '
-rwe_.Q-_ ,
a , . - - , - -
- 7. "%----- o egg } , ,,,, , _ { 3pe - --- -7 4 ----{ ,,,,,,, =='4L c n g2 h ao n d
<~* =<~
pq <== l
. -c. ,
- 1. . ,
( 4;$bf. L 7 J, -"-~ m d ~ f__ , o;{-, 1~ _ l
.-f-y, _ _ _ _( ,
,_ , ,, _ f
\
)_ ._ _ _. g-__.g 22 _ _;.
., - - :-- r- .
~ % sao* l C c., S70. <1 s t 50 s r.
t g B ; l t .
.g q ) .J
[m_.l p% n.= =_ :.=_,-y, m {t_._Q_ c ---
.i a -. ..
-~
{} Ite.@W s-
" II?d saa"UE MN U1"IIon
\
.--D ivst -- -{} -S nst-~
h M. j nn . w .n. =, . m e....'.~ L; - . - , ng$,e....s.f":n.PI
. 1 w-f M M N & w w-F:ii8 mi-w ""
$"]:" """ '
_ww. - , 9308110396- O - m"ma%nm".>mmn_. a.a oi j 1. .5 l T
. ,- , , i .. i . i s ,.n %'-w "a 1.wsv-w-*,ar rw .-7,ir,.w ew-,,--ek =e.u.ssr-es.sp. e, wwyyr . www ww.y g.,%*.4ee-cqvr-r,-m- p.,egcy,g-'g + t-y vrg-9ww'.i--w"+e-9' Pv'Tt e - re +rve y y*gr**=tTfiF-rP-f.'*'*u.==rf^*-9,*"'t-4t'*P** T'W*g'7% Tr W @"r"WFWf
93-R-2003-01 4.0 DOCUMENTATION CIIANGES 4.1 Summary of Document Revisions As part of this effon, the ANO-2 Updated Safety Analysis Repon (SAR) and Technical Specifications were reviewed. This review has resulted in the following changes: SAR - presented in Section 4.2: 3.6 High Energy Line Break Analysis 7.1 Instrumentation 7.2 Reactor Protection System 7.3 Engineered Safety Features Systems 8.3.1 AC Power Systems SAR - presented in Section 4.3: 7.2.2.4 Failure Modes and Effects Analysis (RPS) 7.3.2.3 Failure Modes and Effects Analysis (ESFAS) Only Table 7.2-5, the FMEA itself, has been revised. Technical Specifications - presented in Section 4.4: T LCO 3/4.3.1 Reactor Protective Instmmentation: Table 3.3-1 Reactor Protective Instrumentation Table 4.3-1 Reactor Protective Instrumentation Surveillance Requirements LCO 3/4.3.2 Engineered Safety Features Actuation System Instrumentation Table 3.3-3 Engineered Safety Features Actuation System Instmmentation Administrative Controls 6.5.1.7.n (new) SAR - Chapter 15 Accident Analysis No revisions to Chapter 15 are required. The ANO-2 Cycle 10 reload analysis, as modified for reduced pressure operation, incorporates the l conservatisms discussed in Section 3.2.1 of this report. Any SAR changes due to this analysis will be made in conjunction with that reload repon. 1 O l l Document No. 6370-ICE-3316 Revision 00 Page 212 of 257
93-R-2003-01 s 4.2 SAR Section Revisions Table 4-1 contains a list of the SAR sections that might be impacted by the proposed '
- . change. It is supplied to ensure that all appropriate sections are considered. Not all of these sections will need revision.
See Appendix B for proposed SAR revisions. ; 1 i Table 4-1 Potentially Affected SAR Sections SAR
- Page 3 DESIGN OF STRUCTURES. COMPONENTS. EOUIPMENT. AND SYSTEMS l 36 Protection Anainst Dynamic Effects Associated With the Postulated-Ruoture of Pinine 3.6.1 Systems in Which Design Basis Piping Breaks Occur '
3.6.4.1 High Energy Pipe Break Outside Containment 3.6.4.1.1 Main Steam Lines 3.6-8 , 3.6.4.1.2 Main Feedwater Lines 3.6-10
- 3.6.4.1.3 Steam Generator Blowdown 3.6-12 3
\ 3.6.4.1.4 Emergency Feedwater 3.6-14 3.6,4.1.5 Main Steam Supply to Emergency Feedwater Pump Turbine Driver 3.6-15 ;
3.6.4.1.6 Main Steam Supply to Atmospheric Dump Valves 3.6-16 3.6.4.1.7 Charging 3.6-17 1 3.6.4.1.8 Letdown 3.6-18 3.6.4.1.9 Steam Supply to Concentrators 3.6 3.6.4.2 Hich Enercy Pine Break Inside Containment 3.6.4.2.1 Reactor Coolant System 3.6-20 1 3.6.4.2.2 Main Steam 3.6-21 3.6.4.2.3 Main Feedwater 3.6-21 3.6.4.2,4 Steam Generator Blowdown 3.6-23 3.6.4.2.5 Emergency Feedwater 3.6-25 3.6.4.2.6 Pressurizer Surge 3.6-26 3.6.4.2.7 Shutdown Cooling 3.6-26 3.6.4.2.8 Safety Injection 3.6-27 1 3.6.4.2.9 Charging 3.6-28 3.6.4.2.10 Letdown 3.6-29 3.6.4.2.11 Pressurizer Spray 3.6-29. 3.6.4.2.12 Pressurizer Low Temperature Overpressure Protection 3.6-30 O Document No. 6370-ICE-3316 Revision 00 Page 213 of 257
93 R:2003-01 Table 4-1 (continued) fg Potentially Affected SAR Sections V SAR Pags 4A.7 TRANSIENT ANAIJSIS 4A.7-1 4A.7.1 Boron Dilution Event 4A.7-1 4 A.7.2 Steam Line Break Event 4A.7-3 4 A.8 JCCCS A.NALYSIS 4A.8-1 4A.8.5 Small Break LOCA 4A.8-2 2 INSTRUMENTATION AND CONTROIS 2d Lntroduction 7.1.2 Identification of Safety Criteria 7.1-3 7.1.2.1 Design Bases 7.1-3 7.1.2.2 Independence of Redundant Safety-Related Systems 7.1-4 7.1.2.3 Physical Identif'ication of Safety-Related equipment 7.1-5 p 7.1.2.9 Conformance to Regulatory Guide 1.47 7.1 l 7.1.2.10 Conformance to IEEE 379-1972 7.1-10 2J Reactor Protective System
- 7. 2. l_.J. System Description 7.2-1 7.2.1.1.1 Trips 7.2-2 7.2.1.1.2 Initiation Circuits 7.2-6 7.2.1.1.3 Logic 7.2-121 7.2.1.1.4 Actuated Devices 7.2-122 7.2.1.1.5 Bypasses 7.2-123 7.2.1.1.6 Interlocks 7.2-123 7.2.1.1.7 Redundancy 7.2-124 7.2.1.1.8 Diversity 7.2-125 7.2.1.1.9 Testing 7.2-126 7.2.1.1.10 Vital Instmment Power Supply 7.2-129 7.2.1.2 Desien Bases 7.2-129 7.2.2.3.1 General Design Criteria 7.2-137 7.2.2.3.2 Equipment Design Criteria 7.2-140 7.2.2.4 Failure Modes and Effects Analysis 7.2-146 O
i Document No. 6370-ICE-3316 Revision 00 Page 214 of 257
93-R-2003-01 Table 4-1 (continued) ( Potentially Affected SAR Sections SAR P189 2,2 Engineered Safety Features Systems 211 Description 7.3-2 7.3.1.1.1 Initiating Circuits 7.3-3 7.3.1.1.2 Logic 7.3-4 7.3.1.1.3 Group Actuation 7.3-7 7.3.1.1.4 Bypasses 7.3-7 7.3.1.1.5 Interlocks 7.3-8 7.3.1.1.6 Redundancy 7.3-8 7.3.1.1.7 Diversity 7.3-9 7.3.1.1.8 Sequencing 7.3-10 7.3.1.1.9 Testing 7.3-10 7.3.1.1.10 Vital Instrument Power Supply 7.3-13 7.3.1.1.11 Actuated Systems 7.3-13 7.3.1.1.12 ESF Supponing Systems 7.3-20 7.3.1.2 Design Basis Infonnation 7.3-20 7.3.2 Analysis 7.3-22 7.3.2.2.1 General Design Criteria 7.3-23 7.3.2.2.2 Equipment Design Criteria 7.3-24 7.3.2.3 Failure Modes and Effects Analysis 7.3-31 Table 7.2-1 Reactor Protective System Bypasses 7.8-1 Table 7.2-5 Failure Modes and Effects Analysis 7.8-7 Table 7.3-1 ESFAS Bypasses and Blocks 7.8-263 i 8 ELECTIUC POWER 313 Reactor Protection and Engineered Safety Feature Loads 8.1-2 EJ.A Desien Bases for safety-Related Electric Systems 8.1-2 311 AC POWER SYSTEMS 8.3-1 8.3.1.1.6 120-Volt Uninterruptable AC Power Supply 8.3-8 8.3.1.1.8.2 Busing Arrangement 8.3-12 8.3.1.1.8.3 Loads Supplied From Each Bus 8.3-13 ; 8.3.1.1.8.4 Manual and Automatic Interconnections Between Buses, Buses and Loads, and Buses and Supplies 8.3-13 l 8.3.1.1.8.6 Redundant Bus Separation 8.3-15 8.3.1.1.8.11.13120-Volt Vital AC System 8.3-31 (Part of " Electric Circuit Protection System") j O v Document No. 6370-ICE-3316 Revision 00 Page 215 of 257
)
93-R-2003-01 Table 4-1 (continued) O Potentially Affected SAR Sections h SAR au 8.3.1.2 Analysis 8.3-41 Regulatory Guide 1.75 (2/74) 8.3-49 thru -56 IEEE 379-1972 8.3-59 IEEE 279-1971 8.3-60 BJ_d 4 IILdspendence of Redundant Systems 8.3-64 , 8.3.1.5 Physical Identification of Safety-Related Equipment 8.3-71 JL12 DC POWER SYSTEMS 8.3-81 Table 8.3-10 120 Volt Vital AC System Single Failure Analysis 8.4-22 Table 8.3-11 125 Volt DC Engineered Safety Feature System Single Failure Analysis 8.4-23 15 ACCIDENT ANALYSIS h 15.1.1 Uncontrolled Control Element Assembly Withdrawal From A Sjiberitical Condition 15.1-9 h15.1,2 Uncontrolled CEA Withdrawal From Critica.1, Conditions 15.1-10 15.1.3 CEA Misoneration 15.1-13 15.1,4 Uncontrolled Boron Dilution Incident 15.1-19 15.1.5 Total And Partial Loss Of Reactor Coolant Forced Flow 15.1-24 l 15.1.6 Idle Loop Stariup 15.1-30 15.1.7 Loss Of EXI.ernal Load And/Or Turbine Trip 15.1-32 1 ILLB Loss Of Nonnal Feedwater Flow 15.1-33 l l 15.1.9 Loss Of All Normal And P_rs.ferred AC Power To The Station ) Auxiliaries 15.1-34 15.1.10 Excess Heat Removal Due To Secondary System Malfunction 15.1-36 15.1.11 Failure Of The Regulating Instrumentation 15.1-39 Document No. 6370-ICE-3316 Revision 00 Page 216 of 257
- 93. R.-2003-01 Table 4-1 (continued)
,3 , Potentially Affected SAR Sections () SAR P123 15.1.12 Int.qrnal And External Events Includine Maior And Minor Fires. Floods. Storms. And Eanhquakes 15.1-39 15.1.13 Maior Rupture Of Pipes Containine Reactor Coolant Up To And Including Double-Ended Rupture Of 12rcest Pipe In The Reactor Coolant Systq_m Ross Of Coolant Accident) 15.1-40 15.1.14 hiajor Secondary System Pine Breaks With Or Without A Concurrent Loss Of AC Power l',. 16 15.1.15 Inadvertent Loading Of A Fuel Assembly Into The Improper Position 15.1-65 15.1.16 Waste Gas Decay Tank Leakage Or Rupture 15.1-68 15.1.18 Steam Generator Tube Rupture With Or Without A Concurrent Loss Of AC Power 15.1-69 15.1.20 Control Element Assembly Ejection 15.1-74 p d 11,L22 Break In Instrument Lines Or Other Lines From Reactor Coolant System Pressure Boundary That Penetrate Containment 15.1-78 15.1.23 Euel Handline Accident 15.1-78 15.1.24 Small Spills Or Iraks Of Radioactive Material Outsid_q C_untainment 15.1-86 15.1.25 Fuel Cladding Failure Combined With Steam Generator Leak 15.1-87 15.1.26 Control Room Uninhabitability 15.1-87 15.1.27 Failure Or Overpressurization Of Low Pressure Residual Heat Removal System 15.1-88 15.1.28 Loss Of Condenser Vacuum 15.1-89 15.1.29 Turbine Trip With Coincident Failure Of Turbine Bvnass Valves to Onen 15.1-89 N 15.1.30 I.oss Of Service Water System 15.1-90 (d Document No. 6370-ICE 3316 Revision 00 Page 217 of 257
93 R 2003-01 Table 4-1 (continued) [N Potentially Affected SAR Sections SAR 'v/ D , 15.1.31 Loss Of One DC System 15.1-91 15.1.32 Inadvertent Onemtion of ECCS During Power Ooeration 15.1-91 15.1.33 Turbine Trip With Failure Of Generator Breaker To Open 15.1-92 15.1.34 I.oss OfInstrument Air System 15.1-92 15.1.35 Malfunction Of Turbine Gland Sealine System. 15.1-93 O O Document No. 6370-ICE-3316 Revision 00 Page 218 of 257
93-R-2003-01 4.3 FMEA for 2-out-of-3 logic 0 1 d }I\ Section 7.2, paragraph III.2-c, of the Standard Review Plan (NUREG-0800) requires L__\l that it be demonstrated that the PPS meets the single failure criterion. Appendix A provides a revised ANO-2 PPS Failure Modes and Effects Analysis (FMEA) to demonstrate that the PPS meets that criterion with one channel continuously in bypass. The FMEA addresses failures in the PPS system from the sensors to the actuation devices. The FMEA also addresses failures of the power supplies for the PPS. The PPS power supplies are supplied from the four 120 VAC vital instmment buses. The reliability and independence of the 120 VAC vital instrument buses is evaluated in Section 3.8 of this report. O n%s Document No. 6370-ICE-3316 Revision 00 Page 219 of 257
93-R-2003-01 4.4 Technical Specification Amendments 2 In the course of revising LCO Table 3.3-1 to reflect incorporation of the indefinite bypass, it became apparent that there are other table entries unrelated to the indefinite bypass issue which should be revised. These involve the RPS .and ESFAS IAgic, which is incomplete in the ANO-2 Technical Specifications. For example, there are four channels of RPS Imgic specified in the table. This could be interpreted as meaning initiation logic, rather than , matrix logic. This shortcoming led San Onofre, which has similar Technical Specifications, - to enter LCO 3.0.3 and shut down when a single matrix relay failed, since it was interpreted that matrix logic is not addressed in the Technical Specifications. Palo-Verde Units 1,2, and 3, which are the most recent CE plants to license, have included separate line entries for both matrix logic and initiation logic. In addition, the Restructured Standard Technical Specifications (RSTS), NUREG-1432, have similar logic entries. The ANO-2 ESFAS Table (3.3-3), presently excludes any ESFAS Imgic entries. At Palo Verde, and in the RSTS, the ESFAS Logic has been separated into matrix logic, initiation logic, and actuation logic. Although San Onofre does include actuation logic, there is no entry for matrix logic or initiation logic. For ANO-2 the revised table is therefore similar to Palo Verde. There are also other inconsistencies in the San Onofre Technical Specifications with regard to Actions associated with Mode 3*,4*, and 5* operation. In this case, the current requirement to repair the failed channel within 48 hours conflicts with the indefinite bypass O completion times in Modes 1 and 2. This has been corrected so as to be consistent with Mode 1 and 2 Actions. These, and other similar changes unrelated to the indefinite bypass issue, have been included in the proposed table, and are explained below: Table 3.3-1 Line 1 - Rewrite line 1, " Manual Reactor Trip" to provide one sub-line for MODES 1 and 2, and one sub-line for MODES 3*,4*,5*. In the revised Technical Specification, line I is divided into two sub-lines. The first sub-line is similar to the existing line 1, for MODES 1 and 2 and changes the required ACTION from "1" to "5". ACTION 1 in the existing Technical Specifications requires that the inoperable channe! be restored to OPERABLE status within 48 hours or that the plant be placed in HOT STANDBY within 6 hours and/or that the protective system trip breakers be opened. ACTION 5 in the revised Technical Specifications requires that the reactor trip breakers of the inoperable channel be placed in the tripped condition within I hour or that the plant be placed in HOT STANDBY within 6 hours. These changes are consistent with industry efforts to simplify technical specifications and make them more operator-friendly. They are Document No. 6370-ICE-3316 Revision 00 Page 220 of 257 ;
93-R-2003-01 similar to approved Technical Specifications for Palo Verde and CE Restructured Standard Technical Specifications. The second sub-line makes the editorial change from "and *" to "3*,4*,5*" and changes the required ACTION from "1" to "8". ACTION 1 in the existing Technical SpeciScations requires that the inoperable channel be restored to OPERABLE status within 48 hours or that the plant be placed in HOT STANDBY within 6 hours and/or that the protective system trip breakers be opened. The new ACTION 8 requires that the inoperable channel be returned to OPERABLE status within 48 hours or that the affected reactor trip breakers be opened within the next hour. These changes are similar to approved Technical Specincations for Palo Verde and CE Restructured Standard Technical Speci6 cations. Line 2 - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications provides requirements for O bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 2.b in existing technical speciHcations requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 2 in the proposed technical speci5 cations requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. 1 ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for 1 maintenance or testing. I ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing i all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Document No. 6370-ICE-3316 Revision 00 Page 221 of 257
93-R-2003-01 Line 3.a - Change Functional Unit description from "Startup and Operating" to
~
1 Startup and *". This is an editorial change which has no impact on the intent or technical l requirement of the technical specification. l In the existing technical specifications, "*" means the following: "With the protective system trip breakers in the closed position and the CEA drive system capable of CEA withdrawal." The proposed technical specification enhances the meaning of " Operating" with the use of the "*". Line 3.a - Change APPLICABLE MODES column from "2 and *" to "2,3*, 4*,5*", This is an editorial change which has no impact on the intent or technical requirement of the technical specification. 1 In the existing technical specifications, "*" means the following: "With the protective system trip breakers in the closed position and the CEA drive , system capable of CEA withdrawal." - p d The proposed technical specifications do not change the meaning of "*", but list the associated OPERATIONAL MODES. Line 3.a - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a r maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications pmvides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the net COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. , O Document No. 6370-ICE-3316 Revision 00 Page 222 of 257 i
93-R-2003-01 ACTION 2 in the proposed technical specifications requires that all associated fD d functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for , maintenance or testing. ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 3.b - Change ACTION column from "3" to "4". This is an editorial change which renumbers ACTION 3 to . ACTION 4 due to rewriting ACTION 2 into two ACTIONS. Line 4 - Change ACTION column from "2" to "2,3". O ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the trijped condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the stanup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for mamtenance or testmg. Document No. 6370-ICE-3316 Revision 00 Page 223 of 257
93-R-2003-01 ACTION 3 in the proposed technical specification allows one channel to be T- placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 5 - Change APPLICABLE MODES column from "1,2 and *" to "1,2,3*, ; 4*,5*". This is an editorial change which has no impact on the intent or technical requirement of the technical specification. In the existing technical specifications, "*" means the following: "With the protective system trip breakers in the closed position and the CEA drive system capable of CEA withdrawal." The proposed technical specifications do not change the meaning of "*", but list the associated OPERATIONAL MODES. Line 5 - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for
\ tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition.
ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the stanup i following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional l units receiving an input from the inoperable channel be placed in bypass or , trip. 1 ACTION 2 in the proposed technical specifications requires that all associated ) functional units be placed in bypass or trip, and lists associated functional units l for all process measurement circuits which affect more than one functional l unit. ACTION 2.c in existing technical spec.fications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. Document No. 6370-ICE-3316 Revision 00 Page 224 of 257 ) l
' 93-R-2003-01 ACTION 3 in the proposed technical specification allows one channel to be Q
(._/ placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 6 - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 7 - Change APPLICABLE MODES column from "1,2 and *" to "1,2,3*, l 4*,5*". This is an editorial change which has no impact on the intent or technical l requirement of the technical specification. l l Document No. 6370-ICE-3316 Revision 00 Page 225 of 257 j i
93-R-2003-01 In the existing technical specifications, "*" means the following: "With the p protective system trip breakers in the closed position and the CEA drive (/ system capable of CEA withdrawal." The proposed technical specifications do not change the meaning of "*", but list the associated OPERATIONAL MODES. Line 7 - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. v ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Document No. 6370-ICE-3316 Revision 00 Page 226 of 257
93-R-2003-01 Line 8 - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the stanup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testmg. ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which .fNct ; more than one functional unit. ' I l 1 Line 9 - Change ACTION column from "2" to "2,3". l ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channei in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped , condition. l ACTION 2 in the proposed tecnnical specifications provides requirements for bypassing or tripping an inopemble channel within one hour. The inoperable channel may be maintained in tae bypassed condition until the startup following the next COLD SHUTDOWN. Document No. 6370-ICE-3316 Revision 00 Page 227 of 257 I
..____-____-a
93-R-2003-01 ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or O trip. ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be ' tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 10 - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for O tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped , condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. Document No. 6370-ICE-3316 Revision 00 Page 228 of 257
93-R4003-01 ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing (] v all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 11 - Change ACTION column from "2" to "2,3". ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. O V ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process metsurement circuits which affect more than one functional unit. O Document No. 6370-ICE-3316 Revision 00 Page 229 of 257
93-R-2003-01 Line 12 - Rewrite line 12, " Reactor Protection System Logic" to address Matrix Logic and Initiation Logic. O The RPS Logic consists of everything downstream of the bistable relays and upstream of the Reactor Trip Circuit Breakers. The RPS IAgic is divided into two parts, Matrix Logic and Initiation logic. Failure of individual bistables and their relays are considered measurement channel failures and are covered by ACTION 2 and ACTION 3. Matrix Logic refers to the matrix power supplies, trip channel bypass contacts, and interconnecting matrix wiring between bistabl: relay cards up to, but not including, the matrix relays. Contacts on the bistable relay cards used in the Coincidence Matrix are excluded from the Matrix Logic definition since they are addressed as part of the measurement channel. Initiation Logic consirts of the trip path power source, matrix relays and their associated contacts, all interconnecting wiring, and the initiation relays. The existing line 12 is oriented toward Initiation Logic in MODES 1,2 and
- with ACTION 4. In the revised Technical SpeciHcation, this is divided into two sub-lines under "B. Initiation logic". The first sub-line is identical to the existing line 12, for MODES I and 2 with the editorial change of renumbering ACTION 4 to ACTION 5 due to rewriting ACTION 2 as two ACTIONS. The-Q V
second sub-line under Initiation Iwgic makes the editorial change from "and *" to "3*, 4*, 5*" and changes the required ACTION from "4" to "8". ACTION 4 in the existing Technical Specifications requires that the inoperable channel be placed in the tripped condition within I hour or that the plant be placed in HOT STANDBY within 6 hours. The new ACTION 8 requires that the inoperable channel be returned to OPERABLE status within 48 hours or that the affected reactor trip breakers be opened within the next hour. These changes are consistent with industry effons te simplify technical specifications and make them more opemtor-friendly. They are similar to approved Technical Specifications for Palo Verde and CE Restructured Standard Technical Specifications. The revised technical specification adds a line "A. Matrix Logic" to explicitly address requirements for Matrix Logic which are not addressed in current ANO2 technical specifications. There are two sub-lines under Matrix logic. Each sub-line provides TOTAL NO. OF CHANNEIS of 6, CHANNELS TO TRIP of 1, and MINIMUM CHANNELS OPERABLE of 3. The first sub-line addresses APPLICABLE MODES of 1,2 and has ACTION 1. ACTION 1 requires that with the number of channels OPERABLE one less than required by the Minimum Channels Operable requirement, restore the inoperable channel to OPERABLE status within 48 hours or be in HOT STANDBY within the next 6 hours and/or open the protective system trip breakers. The Q V second sub-line addresses APPLICABLE MODES of 3*,4*,5* and has ACTION 8. The new ACTION 8 requires that the inoperable channel be Document No. 6370-ICE-3316 Revision 00 Page 230 of 257
H 93 R 2003-01 retumed to OPERABLE status within 48 hours or that the affected reactor trip breakers be opened within the next hour. These requirements are similar to O approved Technical Specifications for Palo Verde. ! Line 13 - Rewrite line 13, " Reactor Trip Breakers" to provide one sub-line for MODES 1 and 2, and one sub-line for MODES 3*,'4*,5*. In the revised Technical Specification, line 13 is divided into two sub-lines. The first sub-line is identical to the existing line 13, for MODES 1 and 2 with the editorial change of renumbering ACTION 4 to ACTION 5 due to rewriting ACTION 2 as two ACTIONS. The second sub-line makes the editorial change from "and *" to "3*, 4*, 5*" and changes the required ACTION from "4" to "8". ACTION 4 in the existing Technical Specifications requires that the inoperable channel be placed in the tripped condition within 1 hour or that the plant be placed in HOT STANDBY within 6 hours. The new ACTION 8 requires that the inoperable channel be returned to OPERABLE status within 48 hours or that the affected reactor trip breakers be opened within the.next hour. These changes are consistent with industry efforts to simplify technical specifications and make them more operator-friendly. They are similar to approved Technical Specifications for Palo Verde and CE Restmetured Standard Technical Specifications. O Line 14 - Change ACTION column from "2 and 6" to "2,3, 7". ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or . trip. ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. i O Document No. 6370-ICE-3316 Revision 00 Page 231 of 257
- - w +- ,,,
93-R 2003-01 ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for (T i maintenance or testmg. ACTION 3 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be _ tripped, providing all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. Renumbering ACTION 6 to ACTION 7 is an editorial change due to rewriting ACTION 2 into two ACTIONS. Line 15 - Change ACTION column from "5 and 6" to "6,7". This is an editorial change which renumbers ACTION 5 to ACTION 6, and ACTION 6 to ACTION 7 due to rewriting ACTION 2 into two ACTIONS. ACTION 2 - Replace ACTION 2 with new ACTION 2 and new ACTION 3. ACTION 2.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a Os maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 2 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 2.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 2 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. 'O %) Document No. 6370-ICE-3316 Revision 00 Page 232 of 257
93-R:2003r01 ACTION 3 in the proposed technical specification allows one channel to be /~'N placed in the bypassed condition and a second channel to be tripped, providing V all associated functional units are placed in bypass or trip. ACTION 3 lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 2 refers to Tech. Spec. 6.5.1.7.n which provides for appropriate review of PPS channel bypass / trip by the Plant Safety Committee. The goal is to repair the inoperable channel and return it to service as quickly as practicable. PSC review of extended channel bypass complements the requirements of ACTION 2 of Table 3.3-1 and ACTION 10 of Table 3.3-3 which require that the bypassed channel be returned to OPERABLE status prior to startup following the next COLD SHUTDOWN. The requirement for PSC review of extended PPS channel bypass / trip is added to ANO Unit 2 technical specifications to satisfy requirements described in the NRC letter contained in Appendix E. ACTION 3 - Renumber ACTION 3 to ACTION 4. Renumbering ACTION 3 to ACTION 4 is an editorial change due to rewriting ACTION 2 into two ACTIONS. ACTION 4 - Renumber ACTION 4 to ACTION 5. Change "... place the inoperable channel in the tripped condition..." to "... place the reactor trip breakers of the inoperable channel in the tripped condition...". Renumbering ACTION 4 to ACTION 5 is an editorial change due to rewriting ACTION 2 into two ACTIONS. Adding the words " reactor trip breakers of" clarifies the intent of this action and is consistent with Palo Verde technical specifications and Restmetured Standard Technical Specifications. ACTION 5 - Renumber ACTION 5 to ACTION 6 and renumber ACTION 5.b reference to ACTION 6.b. Renumbering ACTION 5 to ACTION 6 and ACTION 5.b reference to ACTION 6.b are editorial changes due to rewriting ACTION 2 into two ACTIONS. ACTION 6 - Renumber ACTION 6 to ACTION 7. Renumbering ACTION 6 to ACTION 7 is an editorial change due to rewriting ACTION 2 into two ACTIONS. Document No. 6370-ICE-3316 Revision 00 Page 233 of 257
93-R-2003-01 ACTION 8 - insert a new ACTION 8. New ACTION 8 provides required actions for RPS Logic and Reactor Trip Breakers in MODES 3,4, and 5 with the protective system trip breakers in the closed position and the CEA drive system capable of CEA withdrawal. ACTION 8 requires that "with the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement restore the inopemble channel to OPERABLE status within 48 hours or open the reactor trip breakers within the next hour." This is consistent with the San Onofre Unit 2 technical speci0 cations, (Table 3.3-1, ACTION 7A) which follow the model for indefinite bypass technical specifications in the NRC letter contained in Appendix E. Table 4.3-1 Line 5 - Change MODES IN WIIICII SURVEILLANCE REQUIRED from "I, 2 and *" to "1, 2, 3*, 4*, 5*". This is an editorial change which has no impact on the intent or technical requirement of the technical speciHeation.
\ In the existing technical specifications, "*" means the following: "With the reactor trip breakers in the closed position and the CEA drive system capable of CEA withdrawal."
The proposed technical specifications do not change the meaning of "*", but designate the OPERATIONAL MODES to which the "*" is applicable. Line 7 - Change MODES IN WIIICII SURVEILLANCE IEQUIRED from "1, 2 and *" to "1, 2, 3*, 4*, 5*". l This is an editorial change which has no impact on the intent or technical requirement of the technical speci6 cation. ! In the existing technical specifications, "*" means the following: "With the ! reactor trip breakers in the closed position and the CEA drive system capable l of CEA withdrawal." The proposed technical speciGeations do not change the meaning of "*", but designate the OPERATIONAL MODES to which the "*" is applicable. 1 O Document No. 6370-ICE-3316 Revision 00 Page 234 of 257 l
93-R-2003-01 Line 12 - : Change MODES IN WIIICII SURVEILLANCE REQUIRED from _.
"1, 2 and *" to "1, 2, 3*, 4*, 5*".
This is an editorial change which has no impact on the intent or technical requirement of the technical specification. In the existing technical specifications, "*" means the following: "With the reactor trip breakers in the closed position and the CEA drive system capable of CEA withdrawal." The proposed technical specifications do not change the meaning of "*", but designate the OPERATIONAL MODES to which the "*"_is applicable. Line 13 - Change MODES IN WIIICII SURVEILLANCE REQUIRED from "1, 2 and *" to "1, 2, 3*, 4*, 5*". This is an editorial change which has no impact on the intent or technical requirement of the technical specification. In the existing technical specifications, "*" means the following: "With the reactor trip breakers in the closed position and the CEA drive system capable of CEA withdrawal." The proposed technical specifications do not change the meaning of "*", but designate the OPERATIONAL MODES to which the "*" is applicable, n O Document No. 6370-ICE-3316 Revision 00 Page 235 of 257
93-R-2003-01 Table 3.3-3 Line 1.a - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. Line 1.b - Change ACTION column from "9" to "10,11". ACTION 9.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 9.b in existing technical speciDcations requires that all functional (~ \ units receiving an input from the inopemble channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. i ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 1.c - Change ACTION column from "9" to "10,11". ACTION 9.a in existing technical speciDeations provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel Document No. 6370-ICE-3316 Revision 00 Page 236 of 257
93-R-2003-01 must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the stanup following the next COLD SHUTDOWN. ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists O- associated functional units for all process measurement circuits which affect more than one functional unit. Line 1.d - Add a new line for ESFAS Logic. (applies to insen A to Table 3.3-3) This new line (actually 3 lines) addresses the Matrix Logic and Initiation Logic as the two separate entities that they actually are. There is a total of six channels of Matrix bgic and only four channels of Initiation Logic. The Initiation Logic applicability corresponds to that for the Manual (Trip Buttons). The Matrix logic applicability corresponds to that for its inputs. , The ESFAS Logic consists of everything downstream of the measurement channels and upstream of the subgroup relays. The ESFAS Logic is divided into three parts, Matrix Logic, Initiation Imgic, and Actuation Logic. Failures of individual bistables and their relays are considered measurement channel failures and are covered by ACTION 10 and ACTION 11. Matrix Logic refers to the matrix power supplies, trip channel bypass contacts, and interconnecting matrix wiring between bistable relay cards up to, but not including, the matrix relays. Contacts on the bistable relay cards used in the e Coincidence Matrix are excluded from the Matrix Logic definition since they are addressed as part of the measurement channel. Document No. 6370-ICE-3316 Revision 00 Page 237 of 257
93-R-2003-01 Initiation logic consists of the trip path power source, matrix relays and their associated contacts, all interconnecting wiring, and the initiation relays. Actuation Imgic consists of all circuitry housed within the Auxiliary Relay Cabinets (ARCS) used to house the ESF Function; excluding the subgroup relays, and interconnecting wiring to the initiation relay contacts mounted in the PPS cabinet. Line 1.e - Add a new line for Automatic Actuation Logic. (applies to Insert A to Table 3.3-3) This new line, addressing requirements for Automatic Actuation Logic, must be added since indefinite bypass of an inoperable channel does not apply to Automatic Actuation Imgic. There are only two channels of Actuation Imgic. Action 13 is a new Action developed to address the condition of one of the two channels being inoperable. Action 13 allows 48 hours to repair an Actuation channel. This is reasonable as everything downstream is allowed 72 hours for repairs and usually problems with the Actuation Logic cannot be repaired within the 6 hours allowed by the existing specifications. This change is consistent with industiy efforts to improve technical specifications. Line 2.a - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. Line 2.b - Change ACTION column from "10" to "10,11". ACTION 9.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup l following the next COLD SHUTDOWN. l i
)
O 1 Document No. 6370-ICE-3316 Revision 00 Page 238 of 257- i
93-R-2003-01 ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or O trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical speciGcations allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one funcLonal unit. ACTION 10 in existing technical specification allowed one channel of the CSAS to be placed in bypass for an indeGnite period due to the undesirability of an inadvertent spray actuation. This has been deleted entirely, having been replaced by new ACTIONS 10 and 11. Line 2.c - Add a new line for ESFAS Logic. (applies to Insert B to Table 3.3-3) This new line (actually 3 lines) aduresses the Matrix Logic and Initiation Logic as the two sepamte entities that they actually are. There is a total of six channels of Matrix Logic and only four channels of Initiation Logic. The Initiation Logic applicability corresponds to that for the Manual (Trip Buttons). The Matrix Logic applicability corresponds to that for its inputs. [ Line 2.d - Add a new line for Automatic Actuation Logic. (applies to Insert B to Table 3.3-3) ; This new line, addressing requirements for Automatic Actuation Logic, must l be added since indeGnite bypass of an inoperable channel does not apply to Automatic Actuation Logic. There are only two channels of Actuation Imgic. , I Action 13 is a new Action developed to address the condition of one of the two channels being inoperable. Document No. 6370-ICE 3316 Revision 00 Page 239 of 257 l l
93-R-2003-01 Line 3.a - Renumber ACTION 8 to ACTION 9. (applies to Insert B to Table 3.3-3) Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. Line 3.b - Change ACTION column from "9" to "10,11". ACTION 9.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated p functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 3.c - Add a new Iine for ESFAS Logic. (applies to Insert B to Table 3.3-3) This new line (actually 3 lines) addresses the Matrix logic and Initiation I.ogic as the two separate entities that they actually are. There is a total of six channels of Matrix Logic and only four channels of Initiation Logic. The Initiation Logic applicability corresponds to that for the Manual (Trip Buttons). The Matrix Logic applicability corresponds to that for its inputs. O Document No. 6370-ICE-3316 Revision 00 Page 240 of 257
93-R 2003-01 Line 3.d - Add a new line for Automatic Actuation Logic. (applies to Insert B to () Table 3.3-3) V This new line, addressing requirements for Automatic Actuation Iegic, must be added since indefinite bypass of an inoperable channel does not apply to Automatic Actuation IAgic. There are only two channels of Actuation Logic. Action 13 is a new Action developed to address the condition of one of the two channels being inoperable. Line 4.a - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. Line 4.h - Change ACTION column from "9" to "10,11". ACTION 9.a in existing technical speci6 cations provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for d bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one functional unit. Document No. 6370-ICE-3316 Revision 00 Page 241 of 257
93.-R:2003-01 Line 4.c - Add a new line for ESFAS Logic. (applies to Insert B to Table 3.3-3) O V This new line (actually 3 lines) addresses the Matrix Logic and Initiation logic as the two separate entities that they actually are. There is a total of six channels of Matrix Logic and only four channels of Initiation Logic. The Initiation Logic applicability corresponds to that for the Manual (Trip Buttons). The Matrix Imgic applicability corresponds to that for its inputs. Line 4.d - Add a new line for Automatic Actuation Logic. (applies to Insert B to Table 3.3-3) This new line, addressing requirements for Automatic Actuation Iegic, must be added since indefinite bypass of an inoperable channel does not apply to Automatic Actuation logic. There are only two channels of Actuation Logic. Action 13 is a new Action developed to address the condition of one of the two channels being inoperable. Line 5.a - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. O Al Line 5.b - Change ACTION column from "9" to "10,11". ACTION 9.a in existing technical specincations provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 9.b in existing techmcal speclGcation:: requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. Document No. 6370-ICE-3316 Revision 00 Page 242 of 257
93-R-2003-01 ACTION 9.c in existing tecimical specifications allows one channel to be N tripped, and a second channel to be bypassed for up to 48 hours for (b maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 5.c - Change ACTION column from "9" to "10,11". ACTION 9.a in existing technical specifications provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. O O ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists . l associated functional units for all process measurement circuits which affect more than one functional unit. ; (3 i d I Document No. 6370-ICE-3316 Revision 00 Page 243 of 257 i I l
93
- 2003:01 Line 5.d - Add a new line for ESFAS Logic. (applies to insert A to Table 3.3-3)
O V This new line (actually 3 lines) addresses the Matrix Logic and Initiation Logic as the two separate entities that they actually are. There is a total of six channels of Matrix Logic and only four channels ofInitiation Irgic. The Initiation Logic applicability corresponds to that for the Manual (Trip Buttons). The Matrix Logic applicability corresponds to that for its inputs. Line 5.e - Add a new line for Automatic Actuation Logic. (applies to Insert A to Table 3.3-3) This new line, addressing requirements for Automatic Actuation logic, must be added since indefinite bypass of an inoperable channel does not apply to Automatic Actuation Logic. There are only two channels of Actuation Logic. Action 13 is a new Action developed to address the condition of one of tic two channels being inoperable. Line 6.a - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. h Line 6.b - Change ACTION column from "9" to "10,11", ACTION 9.a in existing technical specifications provides requirements for tripping or bypassing an inopemble channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. I V Document No. 6370-ICE-3316 Revision 00 Page 244 of 257
93-R-2003-01 ACTION 9.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypn. sed condition and a second charmel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect j more than one functional unit.
.Line 6 c - Add a new line for ESFAS logic. (applies to insert B to Table 3.3-3)
This new line (actually 3 lines) addresses the Matrix Logic and Initiation Logic l as the two separate entities that they actually are. There is a total of six channels of Matrix Logic and only four channels ofInitiation Jogic. The Initiation Logic applicability corresponds to that for the Mants (Trip Buttons). ! The Matrix Irgic applicability corresponds to that for its inputs. Line 6.d - Add a new line for Automatic A etuation Logic. (applies to Insert B to Table 3.3-3) This new line, addressing requirements for Automatic Actuation Logic must be added since indefinite bypass of an inoperable channel does not apply to r Automatic Actuation Logic. There are only two channels of Actuation Irgic. ( Action 13 is a new Action developed to address the condition of one of the two channels being inoperable. Line 7.a - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an edc rial change due to the revision of preceding ACTIONS. Line 7.b - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. I 1 O Document No. 6370-ICE-3316 Revision 00 Page 245 of 257
93-R-2003-01 Line 8.a - Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. Line 8.b - Change ACTION column from "9" to "10,11". ACTION 9.a in existing technical specifications provides requirements for trippirig or bypassing an inoperable channel within one hour, and provides a maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped condition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. O . ACTION 10 in the proposed technical specincations requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functiond unit. ACTION 9.c in existing technical speciEcations allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specifi.ution allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 8.c - Change ACTION column from "9" to "10,11". i ACTION 9.a in existing technical specifications provides requirements for l tripping or bypassing an inoperable channel within one hour, and provides a I maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped i I_T condition. l
%)
l Document No. 6370-ICE-3316 Revision 00 Page 246 of 257 j
93-R-2003-01 ACTION 10 in the proposed technical specifications provides requirements for
- (7 bypassing or tripping an inoperable channel within one hour. The inoperable V channel may be maintained in the bypassed condition until the stanup following the next COLD SHUTDOWN.
ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inoperable channel be placed in bypass or trip. ACTION 10 in the proposed technical speci6 cations requires that all associated functional units be placed in bypass or trip, and lists associated functional units - for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical specifications allows one channel to be tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one functional unit. Line 8.d - Add a new line for ESFAS Logic. (applies to Insert A to Table 3.3-3) This new line (actually 3 lines) addresses the Matrix Logic and Initiation Logic as the two separate entities that they actually are. There is a total of six channels of Matrix Logic and only four channels ofInitiation Logic. The Initiation Logic applicability corresponds to that for the Manual (Trip Buttons). The Matrix Logic applicability corresponds to that for its inputs. Line 8.e - Add a new line for Automatic Actuation Logic. (applies to Insert A to Table 3.3-3) This new line, addressing requirements for Automatic Actuation Logic, must ce added since indefinite bypass of an inoperable channel does not apply to i Automatic Actuation Logic. There are only two channels of Actuation Logic. Action 13 is a new Action developed to address the condition of one of the ) two channels being inoperable. ! ACTION 8. Renumber ACTION 8 to ACTION 9. Renumbering ACTION 8 to ACTION 9 is an editorial change due to the revision of preceding ACTIONS. 1 l l Document No. 6370-ICE-3316 Revision 00 Page 247 of 257 j
93-R-2003-01 l ACTION 9 - Replace ACTION 9 with new ACTION 10 and new ACTION 11. ACTION 9.a in existing technical specifiutions provides requirements for tripping or bypassing an inoperable channel within one hour, and provides a l maximum of 48 hours for a channel in bypass. After 48 hours, the channel must be either restored to OPERABLE status or placed in the tripped ccndition. ACTION 10 in the proposed technical specifications provides requirements for bypassing or tripping an inoperable channel within one hour. The inoperable channel may be maintained in the bypassed condition until the startup following the next COLD SHUTDOWN. ACTION 9.b in existing technical specifications requires that all functional units receiving an input from the inopemble channel be placed in bypass or trip. ACTION 10 in the proposed technical specifications requires that all associated functional units be placed in bypass or trip, and lists associated functional units for all process measurement circuits which affect more than one functional unit. ACTION 9.c in existing technical specifications allows one channel to be O tripped, and a second channel to be bypassed for up to 48 hours for maintenance or testing. ACTION 11 in the proposed technical specification allows one channel to be placed in the bypassed condition and a second channel to be tripped, providing all associated functional units are placed in bypass or trip. ACTION 11 lists associated functional units for all process measurement circuits which affect more than one functional unit. h ACTION 10 refers to Tech. Spec. 6.5.1.7.n which provides for appropriate review of PPS channel bypass / trip by the Plant Safety Committee. The goal is to repair the inopemble channel and return it to service as quickly as practicable. PSC review of extended channel bypass complements the requirements of ACTION 2 of Table 3.3-1 and ACTION 10 of Table 3.3-3 which require that the bypassed channel be retumed to OPERABLE status prior to startup following the next COLD SHUTDOWN. The requirement for PSC review of extended PPS channel bypass is added to ANO Unit 2 technical specifications to satisfy requirements described in the NRC letter contained in Appendix E. O Document No. 6370-ICE-3316 Revision 00 Page 248 of 257
93.-R.-2003-01 ACTION 12 - Insert new ACTION 12. ACTION 12 is a new ACTION that applies to the Matrix I.ogic portion of the ESFAS Logic. ACTION 12 applies if one Matrix Logic channel is inoperable. The channel must be restored to OPERABLE status within 48 hours. This provides the operator with time to take appropriate action and still ensures that any risk involved in opemting with a failed channel is acceptable. Operating experience has demonstrated that the probability of a random failure of a second Matrix Logic channel is low during any given 48 hour period. If the channel cannot be returned to OPERABLE status within 48 hours, the plant must be placed in at least HOT STANDBY within the next 6 hours, and in COLD SHUTDOWN within the following 30 hours. ACTION 12 also applies to the tailure of a matrix power supply. Since matrix power supplies in a given matrix (e.g., AB, RC, etc.) are common to all ESFAS Functions, a single power supply failure may affect more than one matrix. For the purposes of this LCO, de-energization of up to three matrix power supplies due to a single failure, such as loss of a vital instmment bus, is to be treated as a single matrix channel failure, providing the affected matrix relays de-energize as designed. Although each of the six matrices within an 4 ESFAS Function (e.g., SIAS, MSIS, CSAS, etc.) uses separate power LL1l supplies, the matrices for the different ESFAS Functions share power supplies. Thus, failure of a matrix power supply may force entry into the Condition I specified for each of the associated ESFAS Functional Units. ACTION 13 - Insert new ACTION 13 ACTION 13 is a new ACTION that applies to the Actuation Logic portion of the ESFAS Logic. ACTION 13 applies if one Actuation Logic channel is inoperable. The channel must be restored to OPERABLE status within 48 hours. This provides the operator with time to take appropriate action and still ensures that any risk involved in operating with a failed channel is acceptable. Operating experience has demonstrated that the probability of a random failure of a second Actuation Logic channel is low during any given 48 hour period. Additionally, the equipment downstream of the Actuation Logic is pennitted to be out of service for up to 72 hours per the existing Technical Specifications. If the channel cannot be returned to OPERABLE status within 48 hours, the plant must be placed in at least HOT STANDBY within the next 6 hours, and in COLD SHUTDOWN within the following 30 hours. O Document No. 6370-ICE-3316 Revision 00 Page 249 of 257
93-R-2003-01 h Technical Soecification 6.5.1.7.n Add the following new paragraph under 6.5.1.7:
- n. Review and documentation of judgment concerning extended operation
[ (longer than 48 hours) with a PPS trip channels in bypass. Review shall determine whether to leave the trip channel in bypass, place the channel in trip, and/or repair the defective channel. This paragraph is added to ANO Unit 2 technical specifications to satisfy requirements described in .NRC letter of Appendix E. This paragraph provides for appropriate review of PPS channel bypass / trip by the Plant Safety Committee (PSC). The goal is to repair the inoperable channel and return it to service as quickly as practicable. PSC review of extended channel bypass complements the requirements of ACTION 2 of Table 3.3-1 and ACTION 10 of Table 3.3-3 which require that the bypassed channel be returned to OPERABLE status prior to startup following the next COLD SHUTDOWN. Bases: add to 3/4.3.1 and 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF) INSTRUh1ENTATION, page B 3/4 3-1: Plant Protective System (PPS) logic is designed for operation as a 2-out-of-3 logic, although normally it is operated in a 2-out-of-4 mode. The RPS Logic consists of everything downstream of the bistable relays and upstream of the Reactor Trip Circuit Breakers. The RPS Logic is divided into two parts, hiatrix Logic, and Initiation Logic. Failures of individual bistables and their relays are considered measurement channel failures. The ESFAS Logic consists of everything downstream of the bistable relays and upstream of the subgroup relays. The ESFAS Logic is divided into three parts, hiatrix Logic, Initiation Irgic, and Actuation Logic. Failures of individual bistables and their relays are considered measurement channel failures. i hiatrix Logic refers to the matrix power supplies, trip channel bypass contacts, and interconnecting matrix wiring between bistable relay cards, up to, but not including the matrix relays. hiatrix contacts on the bistable relay cards are excluded from the hiatrix Logic defmition since they are addressed as part of the measurement channel. Initiation Irgic consists of the trip path power source, matrix relays and their associated contacts, all interconnecting wiring, and the initiation relays. ESFAS Actuation Logic consists of all circuitry housed within the Auxiliary Relay Cabinets (ARCS) used to house the ESF Function; excluding the subgroup relays, and ! interconnecting wiring to the initiation relay contacts mounted in the PPS cabinet. Document No. 6370-ICE-3316 Revision 00 Page 250 of 257 i l
93-R-2003-01 O For the purposes of this LCO, de-energization of up to three matrix power supplies due to a single failure, such as loss of a vital instrument bus, is to be treated as a single matrix channel failure, providing the affected matrix relays de-energize as , designed to produce a half-trip. Although each of the six matrices within an ESFAS Function (e.g., SIAS, MSIS, CSAS, etc.) uses separate power supplies, the matrices for the different ESFAS Functions share power supplies. Thus, failure of a matrix power supply may force entry into the Condition specified for each of the associated ESFAS Functional Units. l O l l
)
l l I O Document No. 6370-ICE-3316 Revision 00 Page 251 of 257 l l P
93-R-2003-01 5.0 SUPPORTING INFORMATION 5.1 Comparison to San Onofre Nuclear Generating Station Units 2 anc 3 Plant Protection System The purpose of this section is to present an outline of the San Onofre PP3 design features that correspond to the criteria set forth by the NRC against which the prolonged bypass of one PPS channel is evaluated. Since the Technical Specifications of the San Onofre Units 2 and 3 allow an inoperable PPS channel to remain i.t bypass for an extended period of time, the outline presented in this section can be useful in the ovemil evaluation of the ANO-2 extended bypass Technical Specification change request. The San Onofre Units 2 and 3 Plant Protection Systems were designed and manufactured by Combustion Engineering and were provided as part of their Nuclear Steam Supply Systems. The PPS of these units are designed in accordance with the C-E Specification 00000-ICE-3001 " General Engineering Specification for a PPS", which is the same specification used for the design of PPS at ANO-2. The common design features that are important to this discussion are summarized as follows:
- 1. The bistable comparator cards, bistable relay cards, and the matrix relay cards are manufactured by Electro Mechanics and are identical in the PPS cabinets-of both plants. Their physical and electrical interface with other components in the PPS cabinet are equivalent in both plants.
- 2. The trip path initiating relays which provide for the interface of the 2-out-of-4 coincident logic in the PPS cabinet and the selective 2-out-of-4 logic in the ESFAS Auxiliary Relay cabinets are designed to the same functional and electrical requirements in both plants.
- 3. The San Onofre Units ESFAS Auxiliary relay cabinets are designed in accordance with C-E Specification 00000-ICE-3002 "Genem! Engineering Specification for ESFAS Auxiliary Relay Cabinet", which is the same specification used for the design of ANO-2 ESFAS cabinets. The selective 2-out-of-4 logic circuitry which is housed in these cabinets is identical in both plants. The functional design and electrical requirements of all original components within these cabinets are the same in both plants. Although implementation of the Diverse Emergency Feedwater Actuation System (DEFAS) has created some differences between the ANO-2 and San Onofre Auxiliary Relay Cabinets, these differences do not adversely impact the extended bypass justification or the validity of this comparison.
- 4. The bypass circuits and their interface with the primary circuits in the PPS cabinet are identical in both plants.
- 5. The surveillance test circuits and their interface with the primary circuits in the PPS cabinet are identical in both plants.
O Document No. 6370-ICE-3316 Revision 00 Page 252 of 257
93
- 2003-01
- 6. The power distribution throughout the PPS cabinet is primarily from four
- power supply panels, one for each bay. Each of the four identical power
( supply panels include fourteen power supplies and associated components. As specified in the C-E Specification 00000-ICE-3001, the power supply assemblies used in the PPS cabinets of San Onofre and ANO-2 were designed to the same requirements and criteria and are functionally identical. The original set of power supplies used in the PPS cabinets of the two plants were the same make and model numbers, and were subjected to the same general qualification program. In response to FSAR question numbers 032.32,032.12, and 032.18, San Onofre took credit for PPS power supply fault and surge tests and RAS circuit tests submitted in support of the ANO-2 license. This was possible due to the fact that the PPS power distribution circuits are functionally identical. No additional power supply testing was requested from San Onofre to justify their Technical Spec!!!c~ ns which allow extended bypass.
- 7. San Onofre Units 2 3 FSAR Sections 8.3.1.1.1, 8.3.2.1 and figure 8.3-6 describe the 120 VAC power sources to the PPS equipment as follows:
Four independent Class IE 120 VAC power distribution panels supply the four channels of the reactor protection system and the ESF actuation system. Each power distribution panel normally is supplied by only one of the four vital inveners. If an inverter is to be removed from service for maintenance or testing, a backup supply is provided from a Class IE AC regulating transformer through a manual switch. Each invener is supplied by a separate Class lE 125 VDC bus. Each DC bus is connected to one 125 volt battery and one battery charger. The battery charger associated with each DC bus is supplied with 480 VAC power from a motor control center associated with one of the two ESF load centers. Cbmparing the design of the power sources to the PPS equipment at San Onofre with the design at ANO-2 as described in Section 3.8, we su that the main difference is the power sources to each of the vital inveners. The vital inverters at ANO-2 are normally fed from 480 VAC sources, and the battery supplied backup 125 VDC provides power to an invener only when the normal source is experiencing a failure. Furthe-rmore, the inveners at ANO-2 are provided with 480 VAC altemate power sources to be used when the invener output or the backup battery supplied 125 VDC input source is experiencing a failure. At San Onofre, two vital inveners are electrically coupled to a single 480 VAC load center via the associated battery chargers. Thus, some small potential for a surge originating in the high voltage system to simultaneously affect two vital buses exists at both ANO-2 and San Onofre. Both plants rely on the inherent surge suppression characteristics of the battery chargers and/or inverters. At San Onofre, no credible single failure can result in loss of more than one 120 VAC vital bus. As discussed in Section 3.8, the PPS at ANO-2 remains capable of performing its safety related functions after postulating a loss of two vital buses. In conclusion, the 120 VAC vital power distribution systems of both plants provide four independent, highly reliable, transient-free, and regulated 120 VAC power sources. The independence of these sources is established at the inverter output, and maintained down to their associated loads. Document No. 6370-ICE-3316 Revision 00 Page 253 of 257
l l 93:R:2003-01
6.0 CONCLUSION
This analysis demonstrates that:
- 1. A high energy line break in coincidence with the bypass of a PPS channel will not negate the minimum acceptable redundancy required by IEEE Std. 279-1971, with no credit taken for the fail safe mode of the affected channels.
- 2. Assuming one channel in bypass and a second channel subject to a single failure, the PPS will provide the protection assumed in the accident analysis.
A The affected events were reanalyzed for Cycle 10 in support of a TS
/13 amendment to allow operation at reduced pressurizer pressure. These reanalyses included the PPS bypass assumption.
- 3. As-built, the four protection channels meet the physical separation criteria of NRC Regulatory Guide (RG) 1.75, Rev. 2, with exceptions justified in accordance with the Regulatory Guide. The cable routing for the CEA position indication channels has been justified as an appropriate exception to RG 1.75.
- 4. A fault and surge qualification test program conducted on the ANO-2 PPS demonstrates that the maximum credible de and ac faults and surges applied to the inputs of selected PPS power supplies do not propagate through the redundant power supply to the second vital bus.
O The acceptability of the separation of vital bus power feeds to the PPS, and the separation between the inverter input and output power circuits is demonstrated. This demonstrates the adequacy of the independence of the four vital buses given that there are only two batteries supplying their emergency power source.
- 5. The fault and surge qualification test program also demonstrates that, with a channel in bypass, there is no credible single failure of a vital bus that will affect the six Matrix Trip Relays in such a manner that the actuation of the PPS is jeopardized.
The analysis also assures that bypass of more than one channel of any one functional unit is prevented by interchannel electrical interlocks and bypass of more than one channel of interrelated functional units is prevented by the administrative controls contained in the proposed Technical Specifications. Therefore, it is concluded that operation of ANO-2 with the PPS in a 2-out-of-3 logic mode will not prevent the PPS from performing its functions as assumed in the accident analysis. For any design basis event, with the occurrence of any postulated single failure (e.g., failure of a battery) the PPS will provide the protection assumed in the accident analysis. Documentation changes required to support the proposed license amendment have been reviewed and prepared as necessary. The documentation changes are attached, with the exception of those relating to SAR Chapters 4A and 15 which are included with the Cycle 10 reload repon. Document No. 6370-ICE-3316 Revision 00 Page 254 of 257
93-R-2003-01
7.0 REFERENCES
- 1. NRC letter dated March 31,1982, Clark to Cavanaugh, " Design Criteria", Enclosure 2 (Contained in Appendix E)
- 2. ANO EIC Contract Letter,1/24/92, Attachment 1
- 3. ANO-2 PPS Technical Manual C490.0850, Vol. II, Revision F,1/28/91, Fig. 8-31 Sh.1, 2, 3, 4 and Fig. 8-34
- 4. ANO-2 PPS Technical Manual C490.0850, Vol. I, Revision F,1/28/91, Figure 3-16
- 5. ANO-2 PPS Technical Manual C490.0850, Vol. U, Revision F,1/28/91 Figures 8-7, 8-8, 8-9, 8-10, 8-11, 8-12, 8-13 Sh.1&2, 8-14 Sh.1&2, 8-15 Sh.1&2, 8-16 Sh.1&2, 8-17 Sh.1&2, 8-18 Sh.1&2
- 6. Annunciator Window Arrangement Engineering Safety Features, Annunciator 2K04 Panel 2C16, ANO Drawing M-2591, Sh. 3, Rev. 23; Annunciator 2K04 Schematic Diagram (on Panel 2C16) E-2454 Sh.1, Rev.12 p 7. ANO-2 CPC Technical Manual C490.0900 Vol. I, Rev. 01, 8/27/91, d Figure 4-11, Figure 4-12
- 8. ABB-CE Qualification Summary Report for the Replacement Plant Protection System Power Supply Door Assembly for the Arkansas Power and Light Company ANO-2, 82689-ICE-37205, Rev. 00,11/23/92
- 9. Test Report on a Plant Protection System RAS C reuit Surge Test for AP&L ANO-2, 6370-ICE-3721, Rev. 00, 7/18/78
- 10. ABB/C-E Specifications:
General Engineering Specification for a Plant Protection System, 00000-ICE-3001, Rev.1, 3/30/73 ANO-2 Project Engineering Specification for a Plant Protection System, 6370-ICE-3001, Rev. 01, 4/4/73 General Engineering Specification for ESFAS Auxiliary Relay Cabinet, 00000-ICE-3002, Rev. 4, 5/21/73 ! ANO-2 Project Engineering Specificatior. for a ESFAS Auxiliary Relay Cabinet, 6370-ICE-3002, Rev. 3,12/2/75
- 11. AP&L ANO-2 Drawings:
Low Voltage Safety Systems Power Supplies Single Line Diagram E2006, Rev. 23,10/28/91 Document No. 6370-ICE-3316 Revision 00 Page 255 of 257
)
i
93 R-2003-01 120 VAC RPS/ESF Power Distribution Panels E2022, Rev. 20, 12/5/91 U,o
- 12. ANO-2 SAR Chapter 8, Section 8.3.1.1.6, Amendment 9
- 13. ANO-2 PPS Technical Manual C490.0850, Vol. II, Rev. F,1/28/91, Figures 8-50, Sh.1-5; 8-51, Sh.1-6; 8-52, Sh.1-6; and 8-53, Sh.1-5
- 14. ABB-EM Isolation Transformer Type Test Report, ITR-5330-1,4/4/77
- 15. AP&L ANO-2 Drawings:
E2454, Sh.1, Schematic Diagram 2K04 on 2C16 M2591, Sh. 3, Annunciator Window Arrangement ESF,2C16
- 16. AP&L ANO-2 Drawings 6600-M2001-M3-3, Sh. 2, ESFAS A. R. C.
Fabrication, 6600-M2001-M3-12, Sh.10,11,12,13, ESFAS A. R. C.
. Assembly
- 17. ABB-CE Qualification Test Report for Input Fault and Surge Testing of Power Supplies for Arkansas Power and Light,6370-ICE-3736,7/22/77
- 18. AP&L ANO-2 Drawings:
E2454, Sh. 2, Schematic Diagram Annunciator 2K04 and 2K05 on 2C16 M2591, Sh. 3, Annunciator Window Armngement ESF,2C16
- 19. ANO-2 ESFAS A. R. C. Technical Manual, C490.0730, Figure 4-7, Sh.3
- 20. NUREG-0308 Safety Evaluation Report related to Operation of Arkansas Nuclear One, Unit 2.
- 21. ANO-2 FSAR Figure 7.2-32, Core Protection Calculator System CEA Calculators
- 22. ANO-2 FSAR Figure 7.2-27, System Configumtion
- 23. ANO-2 CPC Technical Manual C490.0900; Figure 6-5, Channel.B CEAC #1 Block Diagram; Figure 6-6, Channel C CEAC #2 Block Diagram
- 24. ABB-CE Test Procedure for Input Fault and Surge Testing of Power Supplies for AP&L,6370-ICE-3536,1/26/77. (Applies to original PPS ;
and ESFAS P/S still installed.) ]
- 25. ABB-CE Test Procedure for a Plant Protection System RAS Circuit Surge Test for AP&L,6370-ICE-3565, Rev. 00,7/18/78.
Document No. 6370-ICE-3316 Revision 00 Page 256 of 257 l l
i 1 93 R-2003-01 l 1
- 26. ABB-EM Plant Protection System and ESFAS A.R.C. Replacement !
Power Supply Fault and Surge Qualification Report, QTR-10551-1, d 8/9/89. (This document includes Test Procedures as appendices.)
- 27. ABB-CE, Final Analysis Report of the PPS, EFS/ ARC, and LRWTL Process Instrumentation to Determine Effects on the Recirculation Actuation Signal Due to Vital Bus Faults at ANO-2,6370-ICE-8608-00, 2/13/78.
- 28. AP&L/NRC letter 2-048-33 dated 4/28/78.
- 29. Design Change Package 89-2053, " Diverse Emergency Feedwater Actuation System".
- 30. Nuclear Plant Reliability Data System - Failure Report.
- 31. USNRC IE Bulletin No. 80-19, 7-31-80, Failures of Mercury-Wetted Matrix Relays in Reactor Protective Systems of Operating Nuclear Power Plants Designed by Combustion Engineering, Inc.
O m Document No. 6370-ICE-3316 Revision 00 Page 257 of 257
AiJ .4t*- A 6 4 # w 4 +-4* 2 J ~ as A ' = n.A h - O . h 4 4 C h APPENDIX A-1
- O FAILURE MODES AND EFFECTS ANALYSIS, REV. 01 i
1 i
-1 1
I O 93 R 2003-01. agei l
ANALYSIS SERVICES hogeIof9 ABB COMBUSTION ENGINEERING, INC. Contract Number:A1007.(C-001-G) Total Calculation 9 Pages Total Appendix 103 Pages Total Microfiche 0 Sheets Document / Calculation Number: 011-AS92-DA-001 Revision: .__Q1 5 Document
Title:
Arkansas Power and Licht. Arkansas Nuclear One. Unit 2. Failure Modes and Effects Annivsis for the Plant Protection System with One Channel in Bypass - Originator (s): Georce Berntsen Signature: 1 e Joseoh L. Runo Date: J2L4/92 Signature: /\(A li h e Date: 12/:.4/92 This document contains safety related design info on: Yes No " VERIFICATION STATUS: COMPLETE The safety-related design information contained in this document has been verified to be correct by means of: Design Review using Checklist (s) 1 of QAM 101 4 Altemate Analysis - Copy attached, N//L Verification Testing - Test Report No. 4/M Nam. Dad T F,u:em signaturc Y. Y M ~ ' oate /2/AW Independent Reviewer
/[
Cognizant Engineering Organization ana ement Approval 3
, hG .f '
Sighature) (Date) R. E. Jaauith Suoervisor RS
~
(Printed Name) (Title) Distribution: D. Finnicum. R. Jaouith. ORC (2 oermanent) Summary of
Purpose:
The purpose of this analysis is to update calculation 0ll-AS92-DA-001, Rev. 00 to incorporate Arkansas Power and Light Company review comments Summary of QA Results: O n*2xw -
? age fH
~ ~. l
011-AS92-DA-001 Rev. 01 PAGE 2 0F 9 f) V CHECKLIST NO. 2 REVIEW 0F DESIGN ANALYSIS
- 1. Is the material presented sufficiently detailed as to purpose, methopN/Aassumptions, Yes design input, references, and units?
- 2. Were the inputsfcorrectly selected and incorporated into the analysis? Yes A/ N/A
- 3. Have the assumptions necessary to perfofm the analysis been' adequately documented and justified? Yes v N/A 4.
Are applicable codes, standards and regulatory requirements, including issue and addenda, employed in the anafysis properly identified, and were their requirements met? Yes V N/A
~
- 5. Have interface requirements been satisfied? Yes N/s
- 6. Have the adjustment factors, uncertainties, and empirical correlationspsed in the analysis been correctly applied?
Yes N/A V _
- 7. appropriate analysis or calculation method used?
Was Yes v ay'N/A
- 8. Have the versions of the computer codes employed in the analysis been certifie for application? If not, has sufficient information been provide to enable verification of the program and results?
Yes N/A
- 9. Is the purpose sufficiently clear, and are the yesults and conclusions reasonable when compared to inputs? Yes r N/A
- 10. Has gaappropriate title page similar to Exhibit 3.4-1 been;used?
Yes N/A
- 11. Are all pages equentially numbered and marked with the analysis number? Yes N/ S___.
- 12. Where necessary, are the assumptions identified for subsequent rever)fications when the detailed design activities ar completed?
Yes v N/A
- 13. Is the presentation legible and reproducible? Yes N/A
- 14. Have all cross-outs or overstrikes in/the documentation been initialed and dated by the Author? Yes V N/S
/
Reviewef signature
/h Date k
93 R-2003-01 Page Al-2 l
~
Oll-AS92-DA-001 Rev. 01 PAGE 3 0F 9 e TABLE OF CONTENTS Section No. Descriotion Paae No. Q/A Checklist #2 2 Table of Contents 3 List of Acronyms 4
- 1. Introduction 5
~
II. Assumptions 6 III. Analysis Procedures 6 IV. Data Items Needing Verification "6 V. Data Files 9 VI. Results 12 , VII. References 12 0 O 93-R-2003:01 - Page $1-3
011-AS92-DA-001 Rev. 01 PAGE 4 0F 9 LIST OF ACRONYMS Acronym Description AN02 Arkansas Nuclear One, Unit 2 AP&L Arkansas Power and Light CEAC Control Element Assembly Calculator CPC Core Protection Calculator FMEA Failure Modes and Effects Analysis PPS Plant Protection System SRP Standard Review Plan 9 m O , O 93-R-2003-01
~
Pne Al-4
011-AS92-DA-001 Rev. 01 PAGE 5 0F 9 I. INTRODUCTION The purpose of this analysis is to demonstrate that the Plant Protection Systems (PPS) for Arkansas Power and Light (AP&L), Arkansas Nuclear One, Unit 2 (AN02), complies with the single failure criterion as s Section 7.2 of the Standard Review Plan (SRP)"pecified
, assuming in Paragraph that one of theIII.2-c four of PPS channels is in the bypass mode. This is done by providing a Failure Modes and Effects Analysis (FMEA) for the PPS. This revision updates Oll-AS92-DA-001, Rev. 00 to include the AP&L review comments.
II. ASSUMPTIONS The following Assumptions were used in performing this analysis:
- a. The analysis need only be done to the lowest " functional level" .
necessary to demonstrate defense against single failure;
- b. The measurement channels can be treated as " black box" components;
^
- c. The Core Protection Calculators (CPCs) can be treated as single components;
- d. The testing circuits are included in the scope of analysis;
- e. Actuators and actuated devices (i.e., pumps, pump circuit breakers, -
valves, valve operators, etc.) are not included within the scope of the analysis; O f. All four PPS channels are identical;
- g. Operator induced hardware faioures need not be included;
- h. All parameter bistables in one of the four PPS channels are in the bypass mode.
III. ANALYSIS PROCEDURES This analysis was conducted in accordance with the procedures specified in reference 2. The system description and design bases for the AN02 PPS are presented in sections 7.2 and 7.3 of the Arkansas Nuclear 1, Unit 2, Safety Analysis Report *. The PPS technical manual * , the CPC functional design specification
- and the CEAC functional design specification
- provide additional technical detail on the system design and operation. For this analysis, the system boundaries are defined to include all signal processing equipment from the measurement channels to the interface with the equipment actuators. The system boundaries are indicated on the Plant Protection System Interface Logic Diagram *.
This analysis was conducted at the lowest " functional level" necessary to demonstrate defense against single failure given that o_ne of the four PPS ' channels is initially in the bypass condition. The analysis was performed for one typical channel (see assumption II.f). This analysis is based on the O ~ 93-R-2003-01 Page Al-5
Oll-AS92-DA-001 Rev. 01 PAGE 6 0F 9 technical descriptions of the PPS provided in references 3, 4, 5 and 6 and on the drawing listed as references 7 through 47. IV. THE FAILURE HODES AND EFFECTS ANALYSIS The completed Failure Modes and Effects Analysis (FMEA) worksheets are contained in Appendix A. The FMEA worksheets are presented as Table 7.2-5 of the Safety Analysis Report. The FMEA worksheets in this analysis contain the same information as currently in Table 7.2-5 of the AN02 Safety Analysis Report', but the structure and arrangement of information has been changed to improve the organization of the analysis. These FMEA worksheets are intended to replace Table 7.2-5 currently in the AN02 Safety Analysis Report i in its entirety. V. RESULTS AND CONCLUSIONS . The results of this analysis show that, even with one of four PPS channels in the bypass condition, no single failure in the remaining three channels will-prevent the system from performing its intended functions concurrent with the existance of the single failure. Therefore, the Plant Protection System meets the single failure criterion as specified in Paragraph III.2-c of Section 7.2 of the Standard Review Plan"' with one of the four channels in the bypass mode. O
=
1O ~ 93-R-2003-01 l hage Ald
- - , , - - - - . . r
Oll-AS92-DA-001 Rev. 01 PAGE 7 0F 9 VI. REFERENCES
- 1. NUREG-75/087; " Standard Review Plan"; U. S. Nuclear Regulatory Commission.
- 2. RSA-PROC 02, Rev. 0; " Procedures for Performing Failure Modes and Effects Analysis"; Nuclear Power Systems, Combustion Engineering, Inc.; December, 1976.
- 3. " Arkansas Nuclear One - Unit 2 Final Safety Analysis Report"; Amendment 9.
- 4. " Technical Manual for Plant Protection System for Arkansas Nuclear One -
Unit 2", Volumes I & II, Rev. F; January 28, 1991.
- 5. 00000-ICE-3208; " Functional Design Specification for a Core Protection Calculator", Rev. 7; September 12, 1984. ,
- 6. 00000-ICE-3234; " Functional Design Specification for a Control Element Assembly Calculator", Rev. 5; September 14, 1984.
- 7. 6600-M2001-M1-158, Rev 3 (E-6370-411-503, Rev. 2); " Plant' Protection System Interface Logic Diagram".
- 8. 6600-M2001-Q2-46, Rev 13 (B-6370-416-013, Rev. 08); " Channel P-102A, P-101A Interconnection Diagram".
- 9. 6600-M2001-Q7-20, Rev 4 (B-6370-416-067, Rev. 05); " Channel P-1013A, P-1023A Interconnection Diagram".
- 10. 6600-M2001-07-24, Rev 4 (8-6370-416-071, Rev. 04); " Channel L-lll3A, L-1123A Interconnection Diagram".
- 11. 6600-M2001-Q4-37, Rev 5 (B-6370-416-066, Rev. 05); " Channels L-305A, L-305B, L-305C & L-305D Interconnection Diagram".
- 12. 6600-M2001-M1-139 (E-6370-411-501) Sheet 1-Rev. 04, Sheet 2-Rev 3, Sheet 3-Rev 2, Sheet 4-Rev 2; " Plant Protection System Functional Diagram".
- 13. 6600-M2001-M1-157, Rev 2 (E-6370-411-541, Rev. 02); "PPS Bistable Input / Output Signals".
- 14. 6600-H2001-M1-138, Rev 3 (E-6370-411-560, Rev. 03); "PPS Bypass and Block Schematic".
- 15. 6600-M2001-M1-159 (E-6370-411-570), Sheet 1-Rev 02, Sheet 2-Rev 2; " Plant Protection System Annunciator Input Schematic".
- 16. 6600-M2001-M1-137, Rev 1 (E-6370-411-537, Rev. 01); "PPS Variable Setpoint Schematic".
- 17. 6600-M2001-M1-187, Rev 0 (E-6370-411-532, Rev. 01); "PPS Testing System Schematic".
- 18. 6600-M2001-M1-188, Rev 0 (E-6370-411-550, Rev. 01); "PPS Calibration and Test Panel Schematic".
93:R-2003-0.1 PageH-7
l Oll-AS92-DA-001 Rev. 01 PAGE 8 0F 9 19. E-6370-411-580, Rev. 06; " Plant Protection System Control Room Cabling Diagram". 20. 6600-M2001-Q2-84, Rev 5 (B-6370-416-084, Rev. 05); " Channels S-Il3A, S-123A, S-133A & S-143A Interconnection Diagram".
- 21. 6600-M2001-Q2-40, Rev 2 (B-6370-416-008, Rev. 00); " Channels P-101A, P-111A & P-121A Interconnection Diagram".
22. 6600-M2001-Q2-34, Rev 8 (B-6370-416-002, Rev. 05); " Channel T-ll2CA & HA, T-122CA & HA Interconnection Diagram". 23. 6600-M2001-Q2-35, Rev 8 (B-6370-416-003, Rev. 05); " Channel T-ll2CB & HB, l T-122CB & HB Interconnection Diagram".
- 24. '
6600-M2001-Q2-36, Rev 8 (B-6370-416-004, Rev. 05); " Channel T-112CC & HC, T-122CC & HC Interconnection Diagram". 25. 6600-M2001-02-37, Rev 9 (B-6370-416-005, Rev. 05); " Channel T ,ll2CD & HD, T-122CD & HD Interconnection Diagram".
- 26. !
6600-M2001-Q2-41, Rev 2 (B-6370-416-009, Rev. 00); " Channels P-1018, P- i 111B & P-121B Interconnection Diagram". 27. 6600-M2001-Q2-42, Rev 2 (B-6370-416-010, Rev. 00); " Channels P-101C, P ~ 111C & P-121C Interconnection Diagram". I 1 P 28. 6600-M2001-02-43, Rev 2 (B-6370-416-011, Rev. 00); " Channels P-101D, P-1110 & P-121D Interconnection Diagram". j
- 29. i 6600-M2001-Q2-48, Rev 12 (B-6370-416-015, Rev. 06); " Channel P-102C, P- !
101C Interconnection Diagram". 30, 6600-M2001-Q2-49, Rev 12 (B-6370-416-016, Rev. 06); " Channel P-1020, P-1010 Interconnection Diagram". 1 31. 6600-M2001-Q2-85, Rev 5 (B-6370-416-085, Rev. 05); " Channels S-(138, S- ' 123B, S-1338 & S-1438 Interconnection Diagram". i 32. 6600-M2001-02-86, Rev 5 (B-6370-415-086, Rev. 05); " Channels S-113C, S-123C, S-133C & S-143C Interconnection Diagram". j 4 i 33. 6600-M2001-Q2-87, Rev 5 (B-6370-416-087, Rev. 05); " Channels S-1130, S-1230, S-133D & S-143D Interconnection Diagram". l 34. 6600-H2001-Q7-21, Rev. 5 (B-6370-416-063, Rev.- 05); " Channel P-1013B, P-l l 10238 Interconnection Diagram". l 35. l 6600-M2001-Q7-22, Rev. 3 (B-6370-416-069, Rev. 04); " Channel P-1013C, P-1023C Interconnection Diagram". I 36. 6600-M2001-Q7-23, Rev. 3 (B-6370-416-070, Rev. 04); " Channel P-1013D, P-1023D Interconnection Diagram". O . i 93-R-2003-01 ' ye Al-8 ;
Oll-AS92-DA-001 Rev. 01 PAGE 9 0F 9
- 37. 6600-M2001-Q7-25, Rev. 5 (B-6370-416-072, Rev. 03); " Channel L-11138, L-1123B Interconnection Diagram".
- 38. 6600-H2001-Q7-26, Rev. 5 (B-6370-416-073, Rev. 03); " Channel L-1113C, L-1123C Interconnection Diagram".
39, 6600-H2001-Q7-27, Rev. 4 (B-6370-416-074, Rev. 03); " Channel L-11'13D, L-11230 Interconnection Diagram".
- 40. 6600-M2001-Q2-12, Rev. 5 (B-6370-413-101, Rev. 03); " Loop fl Temperatures Heasurement Channel Block Diagram".
- 41. 6600-M2001-Q2-13, Rev. 5 (B-6370-413-102, Rev. 04); " Loop #2 Temperatures Measurement Channel Block Diagram".
- 42. 6600-M2001-Q2-14, Rev. 3 (B-6370-413-103, Rev. 01); " Reactor Coolant AP '
Pressure Channels Measurement Channel Block Diagram".
- 43. 6600 $t2001-Q2-15, Rev. 5 (B-6370-413-104, Rev. 03); " Loops # JA,118, 2A, 2B Temps Measurement Channel Block Diagram".
- 44. 6600-M2001-Q2-16, Rev. 5 (B-6370-413-105, Rev. 04); " Pressurizer Pressure (Safety) Measurement Channel Block Diagram".
- 45. 6600-M2001-Q2-94, Rev. 3 (B-6370-413-114, Rev. 01); " Reactor Coolant Pump -
Safety Heasurement Channel Block Diagram". O 46. 6600-M2001-Q7-4, Rev. 5 (B-6370-413-401, Rev. 03); " Steam Generator Protective System Measurement Channel Block Diagram".
- 47. 6600-M2001-07-5, Rev. 6 (B-6370-413-402, Rev. 03); " Steam Generator Protective System Measurement Channel Block Diagram".
- 48. 6600-M2001-H3-7, Sheet 1- Rev. 5, Sheet 2-Rev. 3; " Auxiliary Relay Cabinei
- Electrical Schematic".
- 49. 6600-M2001-H3-8, Rev. 2 (SE-6370-400-003, Rev. 02); "EFAS Iq,terface Drawing".
- 50. 6600-M2001-H2-26, Sheet 1-Rev. 3, Sheet 2-Rev. 2, Sheet 5-Rev. 3, Sheet 6-Rev. 2, Sheet 9-Rev. 0; "ESFAS Aux Relay Cabinets Interconnection Diagram".
O . 93-R-2003-01 PageAR 1
011-AS92-DA-001, Rev. Of Pagel. O Arkansas Power and Licht. Arkansas Nuclear One. Unit 2. Failure Modes and Effects Analysis for the Plant Protection System with one Channel in Bypass APPENDIX A FAILURE MODES AND EFFECTS ANALYSIS WORKSHEETS 102 pages of FMEA worksheets follow this cover page. The work sheets are presented in the format of Table 7.2-5 of the Arkansas Nuclear One, Unit 2 FSAR and have appropriate sheet numbers on them. Each sheet has a sheet number in the form "Page x of 102" with x ranging from 1 to 102. These sheet numbers are used as the page numbers for this appendix. 4 0 . 93-R-2003-01 h49e Al-l0
TABLE 7.2-5 PLANT PROTECTION SYSTEh! FAILURE MODES AND EFFT. CTS ANALYSIS P No. Name Failure Came Syn *ptoms and local Method Inherent Effwl Upon Remaris Made Effats including of Compensating PPS and Dependent Failures Detation 1%,ision Other Effects Measurernent Channel, Reactor Flux, FhlEA Diagrams 1 & 2 a' l
- 1) Ex Core low - all less of II.V. less of data, erroneous Annunciating. 3-channel redundancy Makes reactor trip Reactor trip logic for HI Flut detectors power supply. data. Affects local power Tnp alarms on HI (4th channel logic for LO DNBR LOG P41, LO DNBR, Monitor (Iow, mid, density (LPD), departure from LPD and LOW bypassed), and HI LPD l-out-of 2 Ill LPD, and HI LIN (68) and high) nucleate boiling ratio (DNBR) DNBR. Nuclear Nuclear instrument coincidence. PWR trips must be and calibrated nuclear power instrument trouble bistable channel Makes reactor trip converted to 1-out+f-2 calculations. LPD and DNBR inoperative a! arm. trip. logic for ill LOG PWR by placing appropriate channel trips due to Nuclear CPC sensor failure and HI LIN PWR 2- histables in effected lastrument System (NIS) alarm. out+f 2 coincidence. channelin the tripped trouble contacts. 3-channel comparison. state.
Periodic manual test. Iow - one Breakdown in less of data, erroneous Annunciating. 3-channel redundancy Makes reactor trip Reactor trip k>gic for til detector. insulation data. Affects local power Pre-trip and trip (4th channel logic for LO DNBR LOG P%R (mid resistance. density (LPD), departure from alarms on III LPD bypassed). and HI LPD l-out+f 2 detector only), til LIN PWR, LO DNBR, and ' Cable breal nucleate boiling ratio (DNBR) and LO DNBR. 3- Channel trip. coincidence. and cabbrated nuclear power channel comparison. Makes reactor trip 111 LPD trips must be calculations. Possible LPD and Periodic manual test. logic for HI LIN PWR convened to 1-out-of-2 , DNBR channel trips. and HI LOG PWR by placing appttyriate (mid detector only) 2- histables in affected out-of.2 coincidence. channel 'm the tripped 'a state. % e FO High Detector shorts, Erroneous data. Affects LPD, Annunciating. 3-channel redundancy Makes reactor trip Reactor trip logic for HI O continuous DNBR. and calibrated nuclear Pre-trip and trip (4th channel bgic for HI LIN PWR, LOG PWR (mid O ionization. power calculations. LPD, alarms on LPD, bypassed). LO DNBR, HI LOG detector only) HI LIN CM DNBR, and possible Hi IJnear DNBR,111 LIN Channel trip. PWR (mid detector PWR, LO DNBR, and PWR channel trips. PWR, and HI LOG only), and HI LPD l- HI LPD trips must be e-a For mid detector, possible PWR (mid detector out-of-2 coincidence. maintained in 1-out-of-2 additional HI LOG PWR only). by placing apprtyriate channel trip. Possible leg rate bistables in affected alarm (mid detector channel in the tripped only). state. CPC sensor failure alarm. 3-channel comparison. Periodic manual test. p Lh m b T 011-AS92-D A401, Rev. 02 Page 1 of 102
TABLE 7.2-5 FIANT PROTECTION SYSTEh! FAILURE A10 DES AND EFITCTS ANALYSIS Na Name Failure Cause Symptoms and local niethod Inherent Efftet Upon Remarks Slade Effetts including of Compensating PPS and Dependent Failures De<cction Pruvision Other EfTects Afeasurement Channel. Reactor Flux, Fh1EA Diagrams 1 & 2
- 2) Ex-core Low Linear Loss of Low less of data, erroneous data. Annunciating. 3<hannel redundancy hiakes reactor trip Reactor trip logic for 111 Power Level and leg Voltage power Affecta LPD, DNBR, Log and Trip alarma on HI (4th channel bypassed) logic for LO DNBR LOG Pw1. LO DNBR, (69) eutputs. supply. calibrated nuc! car power LPD and LOW Nuclear instrument and 111 LPD I-out-of 2 HI LPD, and HI LIN calculations. LPD and DNER. DNER. tmuble bistable causes coincidence. PWR trips must be channel trips due to Nis trouble Nuclear instrument DNBR/LPD autiliary htakes reactor trip converted to 1-out-of-2 alarm contacts. inoperative alarm. channel trip. logic for HI LOG PWR by placing appropriate CPC sensor failure and HI LIN PWR 2- bistables in affected alarm. out-of 2 coincidence. channeiin the tripped 3<hannel comparinon. state.
Periodic manusi test. Low Linear Amplifier failure - Less of data, ermneous data. Annunciating. 3-channel redundancy hiakes reactor trip Reactor trip logic for HI output. Unear section. Affects LPD, DNBR, and CPC sensor failure (Ith channel bypassed) logic for LO DNBR LIN PWR, LO DNBR, calibrated nuclear power ala m. Channel trip. and HI LPD l-out-of-2 and HI LPD trips must calculations. Possible LPD and Pre-trip and trip coincidence. be converted to I-out- ' DNBR channel trips. alarms on HI LPD hinkes reactor trip of-2 by placing and LOW DNBR. logic for HI LIN PWR appropriate bistables in t 3 <hannel comparison. 2-out-of 2 coincidence. affected channelin the tripped state. Periodic manual test. g Low log Amplifier failure - less of data, erroneous data. 3-channel comparison. 3-channel redundancy hfakes reactor trip Reactor trip logic for HI CA.) s Output. leg section. (4th channel bypassed) logic for HI LOG PWR LOG PWR trip must be Periodic manual test. 2-out-of-2 coincidence. converted to I-out-of-2 f\3 by placing approrriate O l>istablein effected channelin the tripped y state. C) b-a High Linear Amplifier failure - Erroneous data. Affects LPD, Annunciating. 3-channel redundancy hiales reactor trip Reactor trip logic for HI Output. Unear section DNBR. and calibrated nuclear Pre-trip and trip (4th channel bypassed) logic for HI LIN PWR, LIN P%R, LO DNBR. T power calculations. Possible alarms on LPD, Channel trip. HI LPD, and LO and HI LPD trips must LPD, DNBR. HI Linear PWR DNBR and HI LIN DNBR l-out-of-2. be maintained in 1-out-channel trips. PWR. of-2 by placing CPC sensor failure alarm. appropriate bistables in D affected channel in the m Automatic sensor tripped state. validity test. g 3-channel comparison. y N Periodic manual test. N O!1- AS92-DA-001. Rev. 02 Page 2 of 102
~
TABLE 7.2-5 Pl. ANT PROTECTION SYSTEhl FAILURE MODES AND EFITCTS ANALYSIS NA Name Failure Cause Symptoms and Local bl< hod Inherent Effect Upon Remarks hlnde EfTwis including of Compmsating PPS and Dependent Failures Detwrion Provision Other Effects hieasurement Channel. Reactor Flux, rhtEA Diagrama 1 & 2 liigh leg Amphfier failure - Ermneous data. Annunciating. 3<hannel redundancy Makes reactor trip Reactor trip logic for l{l output. Log section. Possible ill LOG PWR channel Possible pre-tdp and (4th channel bypassed) logic for til LOG PWR LOG PWR tdp must be = trip. trip til LOG PWR Channel tdp. 1 -out+f-2. maintained in 1-out+f.2 alarms, by placing appropriate Possible Irg Rate bistable in effected alarm channel in the tripped 3-channel comparison. state. Periodic manual test. Measurement Channel, CPC Inputs, FhlEA Diagrams 1 & 3
- 3) Core Outlet Low Power supply Erroneous data. Reduces aT Annunciating. 3-channel redundancy Makes reactor trip Reactor tdp logic for til Temp- failure. power calculation. Affects Autoenetic sensor (4th channel bypassed) logic for LO DNER LPD and LO DNBR erature Tw Shorted RTD or Quality Margin, LPD, DNBR, validity test (CPC CPC selects higher of and !!! LPD 2+ut+f 2. trips must be maintained (80) cable. and RCS flow calculations, sensor failure alarm). neutmn flux power and in 1-out+f-2 by placing Temperature 3 channel comparison. aT power for appropriate bistables in -
transmster failure. TwoTw calculation of DNBR affected channel in the Resistor short. measurements per and LPD. tripped state. 1/I isolator failure. channel. CD liigh Open RTD or cable. Erroneous data. Increases aT power calculation. Affects Annunciating. Trip alarms on LO 3-channel redundancy (4th channel bypassed) Makes reactor trip logic for LO DNBR Reactor trip logic for 111 LPD and LO DNBR T W Quality Margin, LPD, DNBR, Temperature transmitter failure. and RCS flow calculations. LO DNBR, til LPD. Automatic sensor Channel trip due to CPC auxiliary trip on and til LPD l-out+f-2. trips must be maintained in 1-outef-2 by placing d O Resistor failure. DNBR, til LPD channel trips. validity test (CPC lew Quality Margin, appropriate bistables in O Auxiliary LO DNBR, til LPD sensor failure alarm). affected channelin the Cd channel trips due to low Quality Margin. 3 channel comparison. Two Tw tripped care. CPC auxiliary tdre do [ b* measurements per not generate pre-trip channel alarms a 4. (s 011-A592-DA@l, Rev. 02 Page 3 of 102
TABLE 7.24 PLANT PROTECTION S)W1 FAILUkE MODES AND EHTETS ANALYSIS No. Name Failure Cause Symptnms and Imal hlethod Inherent EITwt Upun Ranarks blode Effats Including of Comtwnsating PPS and Dependent Failures Detection Provision Other Effects Measurement Channet. CPC Inputs. FMEA Diagrams I,3 & 4
- 4) Core Inlet Low Power surply Erroneous data. Increases t.T Annunciating. 3-channel redundancy Makes reactor trip Reactor trip logic for HI Temp- fadure. power and calibrated neutmn Trip alarms on LO (4th channel bypassed) logic for LO DNBR LPD and I.D DNBR erature T. Shorted RTD or flux power. 'ne higher of these DNBR, til LPD. Channel trip due to and 111 LPD l-out+f-2. trips nust be maintained (82) cable. Shorted two atYects LPD and DNBR Automatic sensor CPC LO DNBR.111 in 1-out cf-2 by placing resistor calculatmas. LO DNBR. IU validity test (CPC LPD auxiliary trip on appropriate bistables in Tempersrure LPD channel auxiliary trips due sensor failure alarm). Ta outside normal affected channelin the transmitter failure. to Ta sennor input outside 3 channel comparison. range. tripped state.
1/1 isofstor failure. normal range. Two T. measurements per channel. High Open RTD or Erroneous data. Decreases eT Annunciating. 3-channel redundancy Makes reactor trip Reactor trip logic for HI cable, power and DNBR calculatmns. Trip alarms on LO (4th channel bypassed) logic for LO DNBR LPD and LO DNBR Temperature Affects LPD calculation. LO DNBR,111 LPD. Channel trip due to and HI LPD l-out-of-2. trips rnust be maintained transmitter failure. DNBR. IH LPD ausiliary trips CPC sensor failure CPC auxiliary trip on in 1-out+f-2 by placing Resistor failure. due to Ta sensor input outside alarm. A:nomatic Ta outside normal appropnate bistables in ' normal range. sensor validity test. range. affected channelin the 3 channelcomparison. tripped state. Two Ta measurementa per channel. (D
- 5) Reactor less of Power supply, Less of data. Reduces DNER Annunciating. 3-channel redundancy Makes reactor trip Reactor trip logic for Cd coolant signat speed transmitter, calculation. LO DNBR channel Pre 4 rip and trip (4th channel bypassed) logic for IJO DNBR l- LO DNBR trip must be y pump flow or signal processor failure.
trip. alarms on LO DNBR. Automatic sensor Channel trip. out-of-2. main'ained in 1-out+f-2 by placing appropriate g (84) O Mechanical validi*y test (CPC bistables in effected O damage to sensor. sensor failure alarm). channel in the tripped CD state. w G) Non target Other than Shorted resistor. Ermneous data input to one Annunciat;ng. Redundant CEAC. Possible penahy factor One CEA calculator CEA actual Power supply CEA calculater (CE AC). CEA deviation alarm. will be applied to each (CEAC) wi!! detect position position. malfunction. Possible penalty factor added to CWP alarm. CPC channel. DNBR CEA denation and (149) Shorted reed DNBR and LPD calculation in Comparison with and LPD operating apply penalty to all switches. each CPC channel. redundant CEAC. margins will be CPCs. reduced. Possible LD e DNBR,HILPD (b reactor trip. gi
-4A 011-AS92-DA4)01. Rev. 02 Pege 4 of 102
i 0)
\ \/
\
TABLE 7.2-5 PLANT PROTECTION SYSTEh! FAILURE hlODES AND EHTCTS ANALYSIS No. Name Failure Symptoms and beal hiethod Inherent Effat Upon Remarks blode Efrats Including of Compensating PPS and j Dependent Failures Detection Providon Other Effects Measurement Channel, CPC Inputs, FMEA Diagram i Excessive Shorted resister, Erroneous data input to one Annunciating. CEAC uses last valid None One CEAC will detect rate of power supply CEAC. Automatic sensor position if sensor CEA sensor failure change high malfunction. validity test (CEAC failure is detected. based on rate of change or icw. sensor failure alarm). Redundant CEAC. of indicated position. l- Comparison with redundant CEAC. Off scale. Broken wire, open Loss of data input to one Annunciating. CEAC uses last valid None one CEAC will detect reed switch, open CEAC. Aute natic sensor position if sensor CEA sensor failure resistor, electrical validity test (CEAC failure is detected. based on rate of change short, power sensor failure alarm). Redundant CEAC. ofindicated position supply Comparison with andkw input out of malfunction. redundant CEAC. range.
- 7) Target CEA Other than Shorted resistor. Erroneous data input to one Annunciating. 3-channel redundancy Makes reactor trip Reactor trip logic for HI position actual Power supply CPC channel and one CEAC. Pre-trip and trip ,
(4th channel bypassed) logic for LO DNBR LPD and LO DNBR { (87) position - malfunction. Out of sequence or sub group alarms on LO DNBR Channel trip. and HI LPD l-outef-2. trips must he maintained l Low Shorted reed deviation penalties applied to and HI LPD. in 1-out42 by placing switches. DNBR and LPD calculations Automatic sensor f appropriate bistables in l (escept for lead reg group validity test (CEAC affected channel in the CEA). LO DNBR and HI LPD sensor failure alarm). tripped state. channel trips. 3-channel comparison. O DQ Other than Shorted resistor. Erroneous data input to one Annunciating. actual Power supply CPC channel and one CEAC. Automatic sensor 3-channel redundancy (4th channel bypasse<!) None At power rod positions are normally all rcJs ke ( position - malfunction, validity test (CEAC out (ARO). For other [ liigh Shorted reed sensor failore alarm). conditions, effects may O I switches. 3-channel comparison. ) be the same as for the DO low failure mode. I D Off scale Broken wire, open Loss of data to one CPC Annunciating. a l 3-channel redundancy Possibly makes reactor Effects are, similst to j reed switch epen channel and one CEAC. Automatic sensor (4th c.hannel bypassed) trip logic for LO Low and High failure resistor, electrical Po.sible Out of sequence or sub validity test (CEAC Possible channel trip. DNBR and HI LPD l- nules with the addition short power group deviation penalties sensor failure alans out-of-2. of a CPC sensor failure supply applied to DNBR and LPD and CPC sensor alarm. malfunction. calculations (except for lead reg failure alarm). group CEA). Possible LO Possible prearip and DNER and HI LPD channel trip alarrns on LO g trips. DNBR and it! LPD. 3-channel comparison. g Oll-AS92-D A-001. Rev. 02 Pege 5 of 102
YABLE 7.2-5 PIANT PR6?ECTION SYSTEM FAILURE MODES ANG EFITCTS ANALYSIS No. Name Failure i w.e Symptoms and leal Mettmd Inhermt Effect Upon Remarks Mode Effe< ts includma of Contpensatmg PPS and Degwndmt Failures Detection Provision Other EITerts Measurement Channel. CPC Inputs FMEA Diagram I
- 8) Contml No data 1.nse of ac power, Less cf one CEAC penalty Annunciating. CPCs use either the None CEAC diagnostic Element output inpuuouTut factor inruts to each CPC CEAC trouble alarra. output of the redundant routine or loss of date Assembly failure. Data link chanrel. Loss of CEA position Comparison of CEA CEAC or the last link sends failure flag to Calculator failure. display from failed CEAC. position displays. previous penalty factor CPCs.
A-ithmetic, logic, from the failed CEAC, (88) or memory failure. g which ever is most l t .se:vative. Erroneous CEA positien Erroneous CEAC penalty r p Annunciating. :i CPCs use the largest s Possible LO DNBR Assumes CEAC feiture data output. eensor failure, factors applied to CICs. CEAC trouble alarm. penalty factor from the and til LPD reactor flag not generated. input! output Possible LO DNBR and ill Comparison of CEA two CEAca. trip. CPCs compere CEAC failure. Data link LPD tripe. position displap outputs ar,d annunciate failure. on significant Arithmetic, logic, difference. or memory failure.
- 9) Core Tripped less of er power. Erroncus c=' - -sults. Annunciating. 3-channel redunda,cy Mates reactor trip computer shuts down in Prntection input / output less of CP
- perator Pre-trip and trip (4th channel byrassed) logic for LO DNBR orderly sequence on Calculator i failure. moduie un - alarms on LO DNBR Channel trip. and HI LPD l-outof-2. loss of ac power and 3 and ill LPD. CPC resomes norma!
(89) Arithmetic, logic, CPC inter * . testing and or mernory failure. watchdog . . trip outputs on failure alsrm. operation with Sensor failure fault. 3 <hannel restoration of power. comparisons. Reactor trip logic for HI LPD and LO L)N3R , trips must be maintained Z in I-out-of-2 by placing appropriate bistables in h O affected channel in the O tripped state. O Stays in Input / output Erroneous cal ulated results. Non-Annunciating. 3-channel redundancy Makes rea -tor trip Reactor trip logic for 111 pa untripned failure. 3 channel comparison. (4th channel bypassed) logic for LO DNBR LPD and LO DNBR state Arithmetic, logic Periodic test. and HI LPD 2-out-of-2. trips must be co,verted or rnemory failure. to 1-out+f-2 by placing Sensor failure. appropriate bistables in afTected channel in the tripped state. 42 a 1 a Ol l-AS92-D A401, Rev. 02 Page 6 of 102 - - - _ _ -__--_-_-_________________m _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _
O O . O TABLE 7.2 5 FLANT PROTECTION SYSTEM FAllERE MODES AND EFITCTS ANALYSIS No. Name Failure Came Symptoms and tecal M 1hort Inhermt EfTect Upon Remarks Mode Effats including of Comlwesating PPS and Dependent Failures De4wtion Provision Other Effwts Measurement Channel, S/G Water level. FMEA Diagrams 1 & 5
- 10) SC No. 2 tow Sensor failure, de less of data. Erroneous data. Annunciating 3-channei redundancy Makes reactor trip and Reactor tnp and EFAS Level Signal power supply Irw SG-!G) level signal to Pre-trip and inp (4th channel bypassed) EFAS logic for SG- logic for SG LVL (51) failure, L'l isolator associated channel bisrables. alarms on SG-lC) LO Channel trip on SG- 1(2) LO LVL I-out-of- functions must be SG No. I failure, open SG IC) LO LVL bistable trips. LVL. IG) LO LVL. 2 coincidence. converted to 1-out+f-2 level Signsi circuit, resistor 3-channel comranson. Makes reactor trip by placing the (55) failure, junction SG-!G) HI LVL histable logic fx SG-lG) HI appropriate bistables in box failure. disabled. LVL 2-out+f-2 atTec-d channelin the coincidence. tripped reste.
Same response for 50-1 and SG-2. Rgh Sensor failure, I'l Ernmeous data. Ifigh SG-IC) Annunciating. 3-channel redundancy Makes -eactor trip and Reactor trip and EFAS isolator failure. level signal to assxisted Pre-trip and trip (4th channel bypassed) EFAS logic for SG- hpc for SG-lG) LVL Resister failure. channel bistah!es. alarms on SG-1G) 111 Channel trip on SG- IG) LO LVL 2-out+f functions must be Cable failure. SG-IG) til LVL bistable trips. LVL. 1C) Ill LVL. 2 coincidence. converted to I-out+f-2 Junction box SG-li2) LO LVL bistable 3-channel comparison. Makes reactor trip by placing the failure. disabled. Period st. logic for SG-lC) Ill appnyrinte bistables in LVL l-out-of-2 r affected channel in the coincidence. tripped state. RPS Operating Bypass. S/G Water Level. FMEA Diagrams I & 9 g
- 11) SG-l&2 Off RTD cren, H1/LO temperature Unable to bypes 50 LVL trip functions in affected channel Periodic test.
Bypass ar.d/or 3-channel redundancy (4th channel bypassed) Possibly makes reactor trip logic for one or This bypass permits CEA testing during cold hZ LEVEL transmitter failure, when Tu < 200 'F or if Permissive lights on SG LVL fII/ LOW more SG LVL shutdown. ,d Operating histable bypass was previ:nsiy in, it Remote Operator channel trips are functions 1-out+f-2 Twsignal faults can O Bypass comparator failure, will be removed. SG LVL b Permissive auxiliary re!ay reactor trip and FFAS-If2 Module (ROM) go out. enabled. coincidence depending on plant conditions. also produce consequences described O (222) card failure, channel functions remain or Possible pre-trip and Operating trip become active. trip alarms on one or for item No. 3). o For detailed component b* bypass switch more SG LVL failure moden see items failure. functions during I 20,21,22, and 23 startup. (identical hardware). WM (4
-L N
O I l- AS92-D A4)01. R ev. 02 Page 7 of 102
f s - TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILt!RE MODES AND EFTTCTS ANALYSIS N.a. Name Failure Cauw Symptnes and lecal Mr4 hod Inherent Effect Upt,n Rem arts Mode Effwts including of Compensating PPS and Del *mlmt Failures Detation Providon Other Effects RPS Opermng Byrass, S!G Water Level, FMEA Diagrams 1 & 9 k On Bistable comparator failure SG LVL reactor inp and EFAS-1'2 chamel functions for Possible bypass annunciator. Bypass 3-channel redundancy (4th channel bypassed) Makes reactor trip and EFAS logic for SG Operator may be able to remove bypass rnanually (no trip). affected channel disabled. light and possibly LVL functions 2-out- at ROM, otherwise, Auxiliary relay permissive light on of-2 coincidence. reactor trip and TFAS card fai!ure (stuck ROM. logic for SG LVL clowd contacts). Periodic test. functions must % Operating trip converted to 1-out-of-? bypass switch by placing the l failure, appropriate bistsbles in affected channelin the tripped state. Ila SG-l&2 Off less of permissive SG LEVEL renc*or trip and 3-channel comparison. 3-channel redundancy Possibly makes HI/LO tens of permissive fault Ill!LO (Item II), EFAS-1/2 channel functions ROM Bypasslight (4th channel bypassed) 50 LEVEL reactor trip also produces LE*'EL auxiliary relay remain or become enabled. off. Periodic test. Affected channel trip and EFAS-1/2 consequences described Operating (AK-26) or driver, Possible trip alarm (s) and EFAS functions are functions 1-out+f-2 for Item i1). Bypass trip bypass opto- on Ill or LO SO enabled. coincidence dependmg isolator failure. LEVEL depending on on plant conditions. plant co:.ditions. On Auxiliary relay SG LEVEL reacter trip and Possible Byper 3-channel redundancy Makes SG LEVEL Logic for SG LEVEL ( AK-26) or driver EF- S-1/2 channel functions alarm. 3<hannel (4th channel bypassed) reactor trip and EFAS- reactor trip and EFAS. e failure. will be disabled. comparison. ROM 1/2 functions 2-out-of-2 1/2 functions must be bypass light on. coincidence. converted to 1-cutef-2 M Periodic test. by placing the O appropriate bistables in affected channelin the g tripped state. O t-a Measurement Channel, PZR Pressure, FMEA Diagrams 1 & 6
- 12) Wide Range High Sensor failure,1/1 Erroneous data. High PZR 3-channel 3<hannel redundancy Makes reactor trip, Reactor trip and ESFAS PZR isolator failure. press. signal to LO PZR comparisons. (4th channel bypassed) CSAS enable, CCAS, logic for LO PZR g
Pressure Resistor failure. PRESS bistable. LO PZR Periodic 1"st. and SIAS logic for LO PRESS must be Signal Axtion box PRESS bistable disabled. PZR PRESS 2-out-of-2 converted to 1-out-of-2 a (61) failure. Affects reactor trip, SIAS, coincidence, by placing the g CCAS, and CSAS functions. appropriate bistable in % affected channel in the tripped s' ate. Oll- AS92-DA401, Rev. 02 Page 8 of 102
.~ p
\~
f\ 5 TABLE 7.2-5 PLANT PROTECTION SnWI FAllfRE MODES AND DTECTS ANALYSIS No. Name Failure Cause Symptams and Imcal Method Inherent EJTwt Upon Remarks Mode EfTwts including of Compeating PPS and thpendent Failurn Det& tion Prnvidnn Other EfTwts low Sensor failure Ill Less of data. Erreneous data. Annunciating. 3-channel redundancy Makes reactor trip. Reactor trip and ESFAS isolator failure, de Low PZR press. signal to LO Pre-trip and try (4th channel bypassed) CSAS ensble, CCAS. logic for LO PZR poner supply PZR PRESS bistable. LO PZR alarms on LO PZR Channel trip, and SIAS logic for LO PRESS must be failure, npen PRESS bistable trips. Causes PlcESS. PZR PRESS 1-outef-2 maintained in 1.out+f-2 circuit. Resistor channel trips on reactor trip, 3 -ch a ru.-t coincidence, by placing the failure. Junction SIAS and CCAS functions. compadsm.s. appropriate bistable in box failure CSAS function is affected atTected channel in the trigyed state. Measurement Channel, PZR Pressure, FMEA Diagrams 1 & 6
- 13) barrow High Sensor failure,1/1 Erroneous data. High PZR Annunciating. 3-channel redundancy Makes CWP and Reactor trip logic for HI Range PZR isolator failure. press. signal to til PZR PRESS Pre-trip and trip alarm (4th channel bypassed) reactor trip logic for 111 PZR PRESS, HI LPD, Pressure Resistor failure. bistable and CPC.111 PZR on HI PZR PRESS. Automatic sensor PZR PRESS, LO and LO DNBR trips Signal Junction box PRESS bistable trips. CPC LO Trip alarma on LO validity test. DNBR and HI LPD l- must be maintained in (91) failure. DNBR and 111 LPD auxiliary DNBR,HILPD. Channel trips on HI out+f-2 coincidence. 1 -out+t y placing channel tnps due to PZR press. CWP alarm. CPC PZR PRESS. LO appropria. ystables in sensor input outside operating sensor failure alarm. DNBR, HI LPD. affected channel in the
- range. CWP channel trip. 3 channel comparison. tripped state, low Sensor f.ilure,1/1 Loss of data. Erroneous data. Annunciating. 3-channel redundancy Makes teactor trip Reacter trip logic for HI isolator failure, de low PZ_R press, signal to HI Trip alarms on LO (4th channel bypassed) logic for HI PZR PZR PRESS,111 LPD.
power supply PZR PRESS bistable and CPC. DNBR.HILPD. Automatic sensor PRESS 2-out+f-2. and LO DNBR trips (D failure, open circuit, resistor Hi PZR PRESS bistable disabled. CPC LO DNBR and CPC sensor failure alarm. validity test. Channel trips on LO Makes reactor trip logic fer LO DNBR must be convened to I-outef.2 by placing y failure, junction HI LPD auxiliary channel trip * $ box failure. due to PZR press. sensor input 3 channel comparison. DNBR,HILPD. and HI LPD 1-out+f-2 coincidence. appropriate histables in atTected channel in the g outside operating range. tripped state. o O Measurement Channel, (A) S/G Pressure, FMEA Diagrama 1 & 7 i O
- 14) SG No.2 tow Senaer failure,1/1 Loss of data. Erroneous data. Annunciating. 3<hannel redundancy Makes reactor trip and Reactor trip and ESFAS Pressure isolator failure, de lew SG-lG) press. signal to Pre-trip and trip (4th channel bypassed) MSIS logic for SG-!G) 3_
logic for SG-lG) Lo Signal power supply associated channel bistables. alarms on SG-lG) LO Channel trip for reactor LO PRESS 1+ut+f-2 PRESS and SG-2>SG-G7) failwe, ryen SG-IG) LO PRESS and SG- PRESS and 50- trip and MSIS. coincidence. 1 (50-1 > SG-2) PRESS SG No. I circuit, reniator 2 > SG-1 (SG-1 > SG-2) PRESS 2 > SG-1 (SG-l > SG- Two steam generators. Makes EFAS-lG) logic mu t be converted to I-failure, junction QD Pressure histables trip. 2) PREM. 2+ut+f-2 coincidence out-of-2 by placing the Signal box failure. Channel trip for reactor tdp, 3-channel comparison. for initiation to an arpmpriate bistables in n (42) and MSIS actuation. operable SG. affected channelin the Affects EFAS-1(2) function. tdpped state. 4y-
~O 011-AS92-DA4)01. Rev. 02 Page 9 of 102
( s () n TABLE 7.2-5 PLANT PROTECTION SYSTDI FAILURE hlODES AND EFFECTS ANALYSIS No. Name Failure Came Symptoms and Lncal Method Inherent Effect Upon Remarks Mode Effats ImIndmg of Compensating PPS and Dependent Failures Detection Presisica Other Effects liigh Sensor failure,1:1 Erroneous data. liigh SG-IC) Annunciating. 3-channel redundancy hiskes reactor tr;p and Reactor trip and ESFAS isolator failure, press. signal to associated Pre-trip and trip (4th channel bypassed) MSIS logic for SG-lC) logic for SG-IC) LO resistor fadure, channel bistables. alarms on SG-1 > SG- LO PRESS 2+ut+f-2 PRESS and SG-2 > SG-junction box SG-!C) LO PRESS disabled. 2 (50-2 > SG-1) coincidence. 1 (SG-1 >SG-2) PRESS failure. SG-1 > SG-2 (SG-2 > SG-1) PRESS. Alakes EFAS-1C) logic must be converted to l-
- PRESS bistable trips. 3<hannel comparison. 2-out+f-2 coincidence cut-of-2 by placing the AtYects reactor trip, MSis, and for preventing initiation appropriate bistables in EFAS functions, to a damaged SG. atYected channel in the tnpred state.
Measurement Channel, Containment Press., FMEA Diagram i
- 15) Contain- liigh Instrument loop Erroneous data.
~
Annunciatmg. 3-channel redundancy Makes CSAS logic l- Reactor trip and ESFAS ment component failire. liigh containment press. signal Prearip and trip Pressure (4th channel bypassed) l on.t-of-2 coincidence. logic for til CONT to til CONT PRESS reactor alarms on RPS and Channel trips initiad. Makes reactor trip, Signal PRESS and CSAS logic trip and ESFAS channel ESFAS Ill CONT CIAS, SIAS, and 2-nst-nf-3 tor.c for 111-111 CONT (6) bistables and to 111-111 CONT PRESS and on lil-fil prevents inat vertent CCAS logic for lll PRESS must be PRESS channel bistable. CONT PRESS. actuation of CONT PRESS 1-out- maintained in 1+ut+f-2 Reactor trip. ESFAS 111 CONT 3-channel contarison. containnent spray on a of.2 coincidence, ' by placing the PRESS, and 111-111 CONT single channel failure. appropriate bistables in PRESS bistables trip. AfTects affected channel in the reactor trip CIAS, SlAS. tripped state. CCAS and CSAS functions. CD s
%s low Instrument loop less of data. Erinneous data. 3-channel comparison. IV 3-channel redundancy Makes CSAS logic 2- Reactor trip and ESFAS component failure. lew containment press. signal Periodic Test.
O (4th ctiannel bypassed) out-of-2 coincidence. logic for 111 and 111-111 O to associated channel histables Makes reactor trip, Cd CONT PRESS must be Reactor trip and ESFAS 111 CIAS. SI AS. and converted to 1-out+f-2 CONT PRESS bistables CCAS loFi c for ill by placing the p.a disabled. CONT PRESS 2-out- appropriate bistables in 111-111 CONT PRESS bistable of-2 coincidence. affected channel in the disabled. tripped state. Affects reactor trip, CIAS. SIAS, CCAS, and CS AS functions. g W
- (%
- 16) (221) 4
_! 1 (Deleted) t Oi l-AS92-DA4k)l, Rev. 02 Page 10 of 102
, p- (
TABLE 7.2-5 PLANT PROTECTIOM SY5TEh! FAILURE hlODES AND EDTCTS ANALYSIS No. Name Failure Cause Symptoms and lxal hiahed Inherent Effat Upon Remarks blode Effats including of Compmuting PPS and Dependmt Failures Dwettion Prorisian Other EITects Measurement Channel, R%T Level, Rf EA Diagrams 1 & 9
- 17) Refueling I.nw Instrument loop Loss of dda. Erroneous data. Annunciating. 3-channel redundancy hiskes R AS logic R AS logic must be Water Tank component failure. Low R%T level signal to Preanp and trip alarm (4th channel bypassed) 1-cotef 2 comeidence. maintained in 1-cut-of-2 Level Signal REFUEL TANK LO LEVEL on REFUEL TANK Channel trip initiated, by placing the (1) bistable. REFUELTANK LO LO LEVEL. appropriate histables in LEVEL bistab!e trips. Affects 3-channel comparison. affected channel in the RAS function. tripped state.
, High Instrument loop Erroneous data. liigh R%T 3-channel comparison. 3-channel redundancy hf akes RAS logic R AS he must be component failure. level signal to REFUEL TANK PerioAc Test. (4th channel bypassed) 2+ut-ef-2 coincidence. convened to I-out-of-2 LO LEVEL bistable. REFUEL by placing the TANK LO LEVEL bistsble appropriate bistables in disabled. Affects RAS afTuted channel in the function. tripped state. PPS Operating Bypass, R%T Lvl/PZR Press., RTEA Diagrams I & 9
- 18) LOR %T Off WR PZR press. Unable to bypass LO R%T 3 <ha nnel comparison. 3-channel redundancy Possibly makes LO This bypass permits LEVEL >LO signal failure high, LEVEL RAS function and LO ROh! permissive light (4th channel bypassed) R%T LEVEL RAS CEA testing during cold PZR PRESS bistable PZR PRESS reactor trip, SI AS, off. Affected channel trip function ar d LO PZR shutdown.
Operating comparatortA25) CCAS and CSAS functions in Periodic test. and ESFAS functions PRESS reactor trip, WR Pm signal faults Bypass failure, auxiliary affected channel when Pm< PPS trouble alarm if are enabled. SIAS, CCAS, and also produce Permissive relay ( AK-21) or 400 psi. If bypass was
- fault due to power CSAS functions 1-out- consequences described (59) driver failure, loss previausly in, it wsi be supply failure. of-2 coincidence for Item 12).
of auxiliary logic removed. LO R%T LEVEL Possible trip alarm (s) depending on plant g power surr!y. RAS function and LO PZR on LO R%7 LEVEL conditions. (A) PRESS reacter trip, $1AS, and/or LO PZR CCAS and CSAS functions PRESS depending on a remain or become enabled. plant conditions. N) O On WR PZR press. Permissive will be present when 3-channel comparison. 3<hannel redundancy During startup, makes During startup, operator signal failure low, plant conditions do not warrant ROM permissive light (4th channel bypassed) LO R%T LEVEL RAS can manually remove g cren circuit, it. During plant startup, bypass on hianual operator action function and LO PZR bypass and reatore PPS O bistable will not be automatically Periodic test. required to activate PRESS reactor trip, to 2-out-of-3. If fault N comparator(A25) removed. Possible to have bypa ss. SIAS, CCAS and occurs at power, there failure, auxiliary channel protective functions CSAS functions 2-out- is no effect on PPS relay (AK-21) or bypassed when still required. of-2 coincidence. logic. driver failure D W
~~.
Oll-AS92-DA-001 Rev. 02 Page 1I of 102
/ \
> 1 f -H J
\ /
( / % /- TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFTICTS ANALYSIS No. Name Failure Cause Symptoms and Lmca! Method Inherent Effwt Upon Retnarks Mode Effwts Including of Compensating PPS and Dependet Failures [ Ddertien Provisims Other Effects PPS Operating Bypass. R%T Lvl/PZR Press., FMEA Disgrams 1 & 9
- 19) LORWT Off less of permissive LO R%T LEVEL RAS 3-channel comparison. 3<hannel redondancy Possibly makes LO Orto-iu4stor fault uill LEVEULO Orem 18), functLm andler LO PZR RONI bypass hght (4th channel bypassed) R%T LEVEL RAS atTect esther LO RWT PZR PRESS auxiliary relay PRESS reactor trip, SIAS, off. Affected channel trip function and LO PZR LEVEL or LO PZR Operstmg (AK-22) or driver. CCAS and CSAS channel Periodic test. and ESFAS functens PRESS reactor trip, PRESS functions, not Bypass trip bypass opto functions remain or become Possible trip alarm (s) are enabled. SlAS, CCAS tad both.
(60) isolator failure. enabled. on LO R%T LEVEL CSAS functbns 1-out- Less of permissive fault and/or LO PZR of-2 coincidence also produces PRESS depending on depending on plant consequences described plard conditions. conditions. for item 18). On Auxiliary relay LO R%T LEVEL RAS, LO Possible Bypass 3<hannel redundancy Makes LO R4T Logic for LO RWT (AK-22) or driver PZR PRESS reactor trip, SIAS, alarm. (4th channel bypassed) LEVEL RAS function LEVEL RAS function CSAS, and CIAS channel 3 <hannel comparison. and LO PZR PRF35 and LO PZR PRESS functions mill be diubled. ROM bypasa light on. reactor tnp, SIAS, reactor trip, SIAS, Periodic test. CCAS and CSAS CCAS and CSAS f functions 2-out-of-2 functions must be l coincidence. converted to 1-out-of 2 by placing the I appropriate bistables in atTected channel in the tripped state.
- 20) Pressurizer Output Input signal bu+fer Energires auxilary relay AK- Same as item No.18) Same as item No.18) Same as hem No.18) Same as hem No.18)
Preasure energized failure, trip 21. Generates permissive to On. On. On. 09. (D Auxiliary actpoint LO R%T LEVEULO PZR CA) Bistable (BS- comparator failure, PRESS crerating bypass circuit.
- 25) setpoint power Same etTect as item No.18) on
%a supply failure.
Output Failure of: Deenergizes auxiliary relay AK- 3<hannel comparisen. Same as item No.18) Same effect as item O g deenergized input signal buffer, 21. Removes permissive to LO ROM permissive light Off. No.18) Off. 3 trip setpoint RwT LEVEULO PZR PRESS otT. O comparator, operating bypass circuit. Same Per. oic test. serpoint power effect as item No.18) Off. PoniSte t-ip alarm (s) supply. DC/DC on LO R%T LEVEL converter, trip and/or LO PZR output yto- PRESS depending on % isolator. plant conditions. D 011- AS92-DAW 1. Rev. 02 Page 12 of 102
- r .,
,, \
I \ ( I
%/ \. ,
TABLE 715 PLANT PROTECTION 5YSTDI Fall 1RE hlODES AND EFTICTS ANALYSiti Ns. Name Failure Came Sympemns and lecal Method Inherent EIYat Up n Remarks Mode Effats tricluding of Compemating PPS and
; Dependent Failures Deention Preisn Other Effwts
, PPS Operarmg Bypan, R%T Lvl/PZR Press., FMEA Diagrams 1 & 9
- 21) ' Aus Relay AK-21 Sustained Removes + 12V fmm AK-22 Same as item No. 20) Same as Item No.18) Same etTect as Item Card 24 (K101) eservoltage and perminaise light. R emoves Output Deenergized Oti. No. I8) Off.
Coil open perTnissive to LO R%T l LEVEULO PZR PRESS
,1 operstmg bypass circuit. Senw etTect as item No.18) OfL AK-21 Deterioration of Generstron of the permissive Samt as item No 20) Same as item No.18' Same as item No.18)
(K101) insulanon fram auxiliary histab!e tard BS. C;tput DeenerF ized. OtT. OtY. Coil short 25 at <400 pai wdi cau c AK-21 to drsw excessive current and place a severe load on the relay driver. This may cause the relay coil to open or the driver to short er epen, less of permissive signal. Same effect s as hem No.18) OtT. AK-21 Deteriorstien of Same as open coil. Same as men coil. Same as Ten coil. Same as open coil. AK-21 uses one NO (K101) centact Contset contact to provide W open +12V source to AK-22 Ws (Aut relay card 23) and y the ROM permissive s light. TV g AK-21 Welded comact, Generates permissive to LO Same as Item No.18) Same as item No.18) O (K101) stuck contact. RAT LEVEULO PZR PRESS On . On. Same as item No.18) On. w t Contact operating bypass circuit. Same shon O effect as hem No.18) On. AK.21 Open transistor l'eenergizes AK-21 coil. loss Same as Item No. 20) Same as item No.18) Same as Item No.18) Reisy junctmn. of permissive. Same effect an Output Deenergized. oft. Off. Driver item No.18) Off. l (Q101) Off W t i 01l ASEDA-001,Rev. 02 ( Page 13 of 102
O p t f%
\ l % Q)
TABLE 7.2-5 PLANT PROTECTION SYSTDI FAltrRE B10 DES AND EDTfTS ANALYSIS No. Name Failure Cauw Symptoms and Local highed Inherent htede Effwt Upna Remarks EHwts laclading af Compensatina PPS and Dependent Failures Duettien Provision Other Effects PPS Operating Bypass, R%T Lvl'PZR Press., F31EA Diagrams I & 9 AK-21 Emitter to Energizes AK-21 coil, Same as Itera No.18) Same as item No.18) Same as hem No.18) Shorted trsasistoe may Relay co!!ector short. On. Generstes rermissive to LO On. On. open due to increased Driver R%T LEVEL /LO PZR PRESS (Q101) on current tiew. operating b>rass circuit. Same effect as bem No.18) On.
- 22) ex Relay AK-22 Suvained Renwwes operating bypass from Same as Iterr 19) Off. Same as Item 19) Off. Same as item 19) Off.
Card 23 (K101) overveltsge LO R%T LEVEL and LO PZR Coil Open PRESS bistaStes. Removes
+ 12V fmm ROM Bypass light applies it to Normal 1;ght.
Opens contact to Bypass annunciator. Same effect as hem 19) Off. AK-22 Deterioration of Attempting to insert LO Same as Item No.19) Same as Item No.19) Same as Item No.19) (K101) insulation R4T/LO PZR PRESS OtT. Off. oft. Ctsi short operating bypass with permissive present will cause AK-22 to drew excessive current and place a severe had on the relay driver. This may D cause the relay coil to open or (d s the driver to short or open. I. css of bypass function. Sann effect as Item No.19) oft. M O AK-22 Deterioration of Renuwel of + 12V to trip O Periodic test. Same as item 19) Off. Same as item 19) Off. CO contact, stuck AK 22 unes 3 seta of (K101) bypass opto-isolators for LO Possible trip alarm (s) Open contact to cornact. R%T LEVEL and LO PZR on LO RWT LEVEL contacts. Normallight remains d 6a PRESS bistables. LO RWT and/or LO PZR lit. epto- LEVEL RAS channel function PRESS depending on isolators Bypass annunciator and LO PZR PRESS reactor plant conditions, remains on. trip, SIAS, CCAS and CSAS channel functions remain or become enabled. kt 8 N
-h Oll- AS92-DA401, Rev. 01 Page 14 of 102
j'~) % ~
\ ) s) ,
TABLE 7.2-5 PLANT PROTECTION SYSTEh! FAILURE Sf0 DES AND EITECTS ANALYSIS Ns. Name Failure Cause Spnproms and Imal Methud inherent Effect Upon Mode Remarks EITats Including of Canpensating PPS and Depmdent Failurn DHation Provision Other Eticcts PPS Orerating Bypass. R%T Lvl/PZR Press., FMEA Diagrama 1 & 9 AK-22 Welded or stuck Applies + 12V to trip bypass 34bannel comparison. Same as item 19) On. Same as item 19) On. Same as item 19) On. (K101) contact. orto-i$o38' ors for LO RWT ROM bypass light on. Shor+ed LEVEL and LO PZR PRESS Periodic test. contact to bis *aMes and to the ROM opto. Bypass light. LO R%T isolators LEVEL RAS channel funethm and LO PZR PPESS reactor trip, SIAS, CS AS, and CCAS channel functions become disabled. AK-22 Deterioration of ROM Normallight does not 3-channel comparis.m. 3-channel redundancy None (K101) contact, stuck come on when Bypass light ROM Normallight (4th channel bypassed) Open contact, goes out. No effect on LO off. cour.act to RRTILO PZR PRESS ROM operating bypass operabiliry. Normal Light AK-22 Welded, stuck ROM Normallight stays on 3-channel comparison. 3-channel redundancy None (K101) contact. when Bypass light comes on. ROM Normal and (4th channel bypassed) Shorted No effect on LO R%TILO PZk Bypass lights on contact to PRESS operating bypass simultaneously. ROM operability. g Normal g Light AK-22 Deteriorstion of Bypass Annunciatordoes not 3-channel comparison. IO 3-channel redundaccy None O (K101) contact, stuck actuate when channelis placed ROM Bypass light on Open contact. (4th channel bypassed) O in bypass. with annunciator off. ROM Bypass light uses contact to Periodic test. separate contact. Bypass O N Annunciat-or AK-22 Welded or stuck Bypass annunciator 3-channel comparison. 34:hannel redundancy None (K101) contact. enntinuously actuated. ROM Bypass light off % (4th channel bypassed) _ (4 Shorted contact to Bypass with annunciatoron. Periodic test. ROM Bypasslight uses separate contact. gi Annunciat-011-AS92-DA-001, Rev. 01 Page 15 of 102
(- (Y 5 (d TABLE 7.2-5 PLANT PROTECTION SYSTE31 - FAllfRE MODES AND EFFECTS ANALYNIS No . Name Failure Casse Syn.ptoms and lxal Method Inherent EfTwt Upon Rnnarks Mode EITwts including of Cese pmsating PPS and
; Depmdmt FaGures Dention Prorhion Other ElYects PPS Operstmp Bypass, R%T Lvl/PZR Press., FMEA DiaFrams 1 & 9 AK-22 Open transistm Deenergizes AK-22 coil. less Same as Item 19) OtT. Sarne as Item 19) OtT- Same as hem 19) Off.
Relay junction. of LO R%T LEVEULO PZR Drrver PRESS bypass capability. (Q101) Off Same effect as Item 19) OtT. AK-22 Enutter to If permissive is pasent. Annunciating. 3-channel redundancy None. Shorted transistor may Relay collector short. energizes AK-22 coil. Bypass alarm. (4th channel bypassed) epen due to increased Driver Generates LO RwT 3<hannel comparison. By pass will current flow. (Ql01) On LEVELLO PZR PRESS ROM Bypass light on. autornatically be bypass withmt operator action. Periodic test. removed when LO PZR PRESS permissive is removed.
- 23) LOR %T Short in Mechanical failure. If permissive is present, Annunciating. 3-channel redundancy b5ne.
LEVE11LO bypass generates LO R%T LEVEULO Bypass alarm. (4th channel byrsssed) PZR PRESS pesition PZR PRESS b) Tass without 3-channel comparison. Bypass will ROM orerator action. ROM Bypass light on. automatically be Bypass Periodic test. remnved when LO PZR Switch PRESS permissive is reawed. Open in Mechanical failure. Loss of LO RWT LEVEULO Unable to bypass. Same as Item 19) Off. Same as trem 19) Off. bypass PZR PRESS bypass capability. ROM Bypass light not position Sarne effect as Item 19) Off. tit. Periodic test. g RPS Operating Bypass, Ili Log Power. T FMEA Diagrams 1 & 9 F .O e
- 24) HI LOG Off irg power signal Unable to bypass HI LOG PWR Unable to bypas.. 3 <hannel redundancy Possibly makes HI leg power signal r% s FOWER failure low, N1 reactor trip when nucteer power y
3<hannel comparison. (4th channel bypassed) LOG PWR reactor trip failure will also produce O Operating Safety Channel is > 104% of full power for the ROM Permissive light Affected channel trip logic l-out-of-2 consequences described O Bypass histable fails off, affected channel. If bypass was off. function enabled. coincidence dependirig for items 1) and 2). Permissive NI Safety Channel previously in it will be Periodic test. on plant conditions. (70) bistable relay removed. III LOG PWR PPS ttuuble alarm if o 8-a failure, auxiliary channel trip remains or fault due to power relay AK-27 or becomes enabled. supply failure. driver failure, Possible trip alarm on g auxiliary logic a 111 LOG PWR M ] power supply depending on plant 4 failure. conditions. D 011-AS92-DA401, Rev. 01 Page 16 of 102
p m w _.\ - 4 / g TABli 7.2-5 PLANT PROITC110N SYSTEM FAILURE MODES AND EITECTS ANALYSIS Ns. Name Failure Cause Symgwams and Lacal Method Inherent E&ct Upon Remarks Mode Effects larludmg of Cosapennating PPS and Dependent Failures Detwtion Provisi<m Other Effwts RPS Ope sting Bypass. Hi leg Power, TMEA Diagrams 1 A 9 On leg poner signal Permissive mill be present when 3<hannel comparison. 3-channel redundancy when shutting down, Bypass can be manually failure high, Ni pier * ~miitions do not m arrant Periodic test. (4th channel bypassed) makes HI LOG PWR removed to restore HI Safety Channel it. Durmg riant shutdown, & l.cg Pwr Bypenes are not reactor trip logic 2-out- LOG PWR reactor trip bistable fai!: on. bypass sill not be automatically Permissive alarm if automatically activated. of-2 coincidence. logic to 2mutef-3. NI Safety Channel removed. Possible to have bypass was not bistable relay channelIII LOG PWR reactor already inserted. failure, auxiliary trip bypassed when it is relay AK.27 or required (< 10*% of full driver failure. poserh
- 25) HILOG off Irss of permissive Affected char. net HI LOG PWR Annunciating. 3-channel iedundancy if reactor poser is POWER (hem 24), ROM reactor trip function remains or Pretrip and trip alarm (4th channel bypassed) >0.75%, makes HI Operstmg latching solenoid becomes enabled. on 111 LOG PWR if Affected channel trip LOG PWR reactor trip Bypass failure, ROM reactor power is function is enabled. iogic leut<f.2 (71) DCIDC convertor >0.75%. Possible Hi coincidence.
failure, HI LOG Leg Pwr Permissive PWR bistable trip alarm. bypass opto- 3-channel comparison. isolator failure. ROM bypass light off. Periodic test. Unable to bypass. (O On High leg Power Affected channel HI LOG PWR CA3 Annunciating. 3-channel redundancy During startup, makes Reactor trip logic for HI e Bypass Smitch reactor trip function is HI LOG PWR pre- (4th channel bypassed) reactor t ip logic for HI LOG PWR must be stuck contact. automatically bypassed when trip alarm. LOG PWR 2w-of-2 converted to latef-2 to reactor power increases above 3-channel comparison. coincidence, by placing the O 10d%. This effectively defeats ROM bgess light on. appropriate bistable in the channel HI LOG PWR trip Periodic test. the affected channelin y function at I % power, the trirred state. O ba
- 26) HILOG Coil open Sustained Same as item 24) Off. Unable to bypass. Same as Item 24) Off. Same as Item 24) Off.
IUWER overvohage. 3-channel comparison. Permissive ROM Permissivelight Relay AK-27 off. Periodic test. Possible trip alarm on HI LOG PWR depending on plant k conditions. h q 011-AS92-DA-001, Rev. Of Pege 17 of 102
( ) [] O_ Lj \ G' i
,'ABLE 7.2-5 PLANT PROTECTION SYSTDI FAILURE MODFli AND EFTECTS ANALYSIS 1
No. Name Failure Cauw l Symptoms and local hitthod Mode Inherent Effect Upon Remarks Effects including of Compensatina PPS and Depmdent Faibsres Deta tion Provision Other Effects
, RPS Operating Bypess. Hi Log Puser, FMEA Diagrams 1 & 9 l
Coil short Determration of Generation of permissive from Unable to bypass. Same as item 24) Off. insulation. NI safety channel at > 10*% Same as Item 24) Off. 3-channel comparison. power si!! cause AK-27 to ROM Permissive light draw excessive current and off. place a severe load on the relay Periodic test. driver. This may cause the Possible trip a arm on relay coil to open or the driver 111 LOG PW1t to short or open. I.ess of depending on plant permissive signal results. Same conditions. effect as item 24) Off. N.O. Deterioration of Same as item 24) Off. Same as open coil. Same as Item 24) Off. contact in contact, smck Same as Item 24) Off. bypass contact. cirruit open N.O. Welded or stuck Same as Item 24) On. 3<hannel comparison. Same as item 24) On. contact in contact. Same as item 24) On. ROM bypass light bypass remains on when circuit permissive clears. shorted N.C. Welded or stuck ROM lil LOG PWR Bypass ROM Offlight Affects indication only. None contact in contact. Off light will not go out when remains on concuitent Off light bypass is actuated. No effect with Bypass light. 3-t.D circuit on bypess operability. channel comparison. y shorted Periodic test. y N.C. Deterioration of FO contact in If ROM 111 LOG PWR bypass Periodic test. Affects indication only. None. O contact, stuck button is depressed without g Offlight contact. permissive present the Off light w ! circuit open will go out until the button is i released. O N.C. Welded or stuck When the HI LOG PWR Periodic test. Affects indication only. None. contact in contact. permissive is generated, it will 3<hannel redundancy annunciator not be annunciated. circuit (4th channel bypassed) D shorted g M O!l.AS92-DA4)01, Rev 01 Page 18 of 102
% ) J TABLE 7.2-5 PLANT PROTECTION SYSTEh!
FAILURE MODES AND EFTECTS ANALYSIS No. Name Failure Came Sympanms a.ad lxal Method Inherent Effect Upim Remarks Mmle Effs as Including of Compensating PPS and Degendent Failures DMxthm Prnvision Other Effects RPS Operating Bypass. Ili leg Power, FMEA Diagrams 1 & 9 N.C. Deterioration of III LOG PWR Bypass Annunciating, Affects indication only. None. contact in contact, snick Permissive annunciator mi11 be Permdic test. a nnunciator contact. on when actual permissive is circuit tren not present.
- 27) liigh Log Solenoid Mechanical failure li! LOG PWR Trip Bypass Attempting to place Channel trip remains if reactor gewer is Channel can be Puwer open of wire, sustained pushbuttan will tot latch in the the affected channel in enabled. increased > I %, bypassed by Manual overvohage. ON position. bypa ss. bisrable will trip continuously holding in Bypass making III LOG PWR the HI LOG PWR Switch reactor trip logic l-out- Bypass pushbutton.
of-2 coincidence. (4th channel by pasned) Solermid Deterioration of Attempting to bypass the III Attempting to place If reactor power is When pushbutton is short insulation. LOG PWR trip in the affected the affected channelin increased > 1 %, released, power surPI ) channel will reduce the output bypass. bistable will trip output should recover. voltage of the auxiliary logic Possible PPS Trouble making 111 LOG PWR See DC Power power supply and possibly alarm. reactor trip logic 1.out- Distribution Failure of produce associated faults, of-2 coincidence. (4th Auxiliary Logic Power Bypass will not be actueed. channel bypassed) Supply. N.O. Mehanical failure, Some as item 25) Off. Same as item 25) Off. Same as item 25) Off. Same as item 25) Off. contact in coatact trip bypass deterioration. W circuit open y a N.O. Mechanical failure, same as item 25) On. Same as Item 25) On Same as Item 25) On. M Same as Item 25) On. contact in welded contact. trip bypass O circuit w shorted I O N N.C. Mechanical failure, ROM III LOG PWR Bypass ROM Off light Affects indication only. None. contact in welded contact. Off light will not go out whet. remains on concurrent Bypass Off bypass is actuated. No effect with Bypass light. 3-light circuit on bypass operability. channel comparison. - shorted Periodic test. (4 h T N
-o O! !-AS92-D A4)01, Rev. 01 Page 19 of 102
fJ J %.. TABLE 7.2 5 PLANT PROTECTION SYSTEN! FAILURE MODES AND EFECTS ANALYSIS No. Name Failure Cause Symptoms and local Method inhermt Effat Upna Resnaris Mode Efrats f acteding of Compemating PPS and Depmdent Failures Detation Preissan Other Efrats RPS Operstmg Bypass, Ili la Power, FMEA Diagrams 1 & 9 N.C. Mechanical failure, ROM !!! LOG P%R Bypass ROM Off hght goes Affects indicatkm only None. contact in contact OtY light goes out when off before bypass in Bypass Off deterioration. permissive ;s generated. No actuated . 3<hannel light circuit effect on bypass operabahty. comparismt. open. PeruWic test. N.O. Mechanical failure. til LOG P%R Bypass 4 hen bypass in Affects indication only. None. contact in contact Permissive annunciator aill not actuated, permissive annunciator deterioration. clear aben bypass is actusted. annunciator does nd circuit open clear. Periodic test. N.O. Mechanical fai!=re, HiIDG PuR Bypasa 3-channel comparison. Affects indicatien only. None. cornact in melJed centact. Permissive annunciator will not Periodic test. annunciator alarm for the affected channel. circus 5 shorted N O. Mechanical failure, til LOG P%R pre.tnp 3<hannel comparison. AfTeets indication only. None. contact in contact annunciarortemnins enabled. If Periodic test. protrip deterioration. romer > pre 4 rip actroint, annunciator alarm will be generated. circuit open N.O. Mechanical failure, (D HI LOG P%R pre-trip 3-channel comparison. contact in welded contact. annunciatordisabled at a!! Affects indication only. None. .M pre-trip times. If power > pre-trip Periodic test. k annunciator segmint with no bypasa, alarm circuit will not be generated. Cj shorted O W I DC/DC Open, component Converter failure. same as item 25) Off. Same as Item 25) Off. same as Item 25) Off. Same as Item 25) Off. 3 fai!ure. h b O!!.A592-DA 001. Rev. 01 Page 20 of 102
) _
TABLE 7.2-5 PLANT PROTICTION SYSTE31 FAILURE MODES AND ETTECTS ANALYSIS No. Name Failure Cause Symptoms and Imcal Method Inherent Effect Upc. Reinarks hiede Effwts Including of Compensating PPS and Depmdent Fa%res Detation Provision Other Effats RPS Operating Bypass, CPCs FMEA Diagrams 1 & 9
- 23) CPC oft leg power signal Unab!e to bypass LO DNBR Unable to bypass. 3- 3-channel redundancy < 10* % power, Leg power signal Operating failure high, Ni and HI LPD reactor tnps when channel comparison. (4th channel bypassed) possibly makes LO failure will also produce Bypass Safety Channel nuclear poweris <10*% of Possible trip and pre- Affected channel tnp DNBR and HI LPD consequences described Permissive bistable failure on, full power for the effected trip alarms on LO functions enabled. trip logic l-out-of-2 for items 1) and 2).
histable relay channel. If bypass was DNBR and HI LPD coincidence depending his b> Tass permits failure, auxiliary previously in, it will be depending on plant on plant conditions. CEA testing during relay AK-20 or removed. LO DNBR and HI conditions. > 10*% power, no shutdown. For detailed driver failure. LPD channel trips remain or Periodic test. effect. relay failures see item become enabled. 26). On Log power signal Permissive will be present when 3-channel comparison. 3-channel redundancy During reactor startup, Bypass can be manually failure low, NI power is > 10*% for the Periodic test. (4th channel bypassed) makes LO DNBR and rernoved at the CPC Safety Channet effected channel. During plant Bypasses do not HI LPD reactor trip Operator Module to bistable failure off, startup, bypass sill nd activate automatically. logic 2-out+f-2 restore LO DNBR and bistable relay automatically be removed. coincidence. HI LPD reactor trip failure, auxiliary Possible to have LO DNBR and logic to 2-out-of-3. For relay AK-20 HI LPD channel trips bypassed detailed relay failures failure. when they are required. see item 26). CWP Automatic Bypass. FMEA Diagram 1
- 29) CWP Off Same as Item 28) CPC CWP signal for the 3-channel comparison. 3-channel redundarry No re. nis function is ret Automatic Off. effected channel will be enabled Periodic test. (4th channel bypassed) credited in the safety Bypass when power is Not required for analysis.
< 10* % . prc4ection. Generated from same U')
circuit as the CPC CA} e manual bypass y permissive. On Same as item 28) CPC CWP signal for the 3-channel comparison. 3-channel redundancy None. O On. affected channel will be always Periodic test. (4th channel bypassed) O (f) be disabled. Not required for I protection. O wIP t% k as 011-AS92-DA4MI, Rev. 01 Page 21 of 102
TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFITCTS ANALYSIS N o. Name Failure Cause Symptoms and lual Method Inherent Meie Effwt Upon Revaarks EITwts including of Compmsating P8'S and Dependent Failures Detwtion Provision Other Efferts Tr?p Channel Bvpass. Channel A (Typical), FMEA Diagrams 9&9A
- 30) Trip Cmtect Deterioration cf Rypist-s of the effected 3-channel comparison . No effect on logic Channel AXKB6-7 contset, stuck Contact used for functirn sill not be indicated Periodic testing or matrices.
Bypass - or AXKI-4 conract. snnunciation only. on the Remote Operator when bypassing ChannelA open AXKI represents RPS Module (ROM) or on the PPS during operation. (Typicel) only application. Bistable Control Panel (BCP). AXKB6 represents RPS and ESFAS application. Contact Welded contact. Bypasses of the affected ROM and ECP No effect on logic AXKB6-7 stuck contact. funct>on sill be continuously bypass lights lit. or AXKl.4 matrices. indicated on the ROM snd on Periodic testing. short the BCP. Contact Deterioration of Plant annuncistor sill indicate a Annunciating. No effect on logic AXKA6-5 contact, stuck bypass condition on the affected Contact used for plant Affected channel matrices. or AXK!-5 contact. channel function at all times. annunciation only. function bypass ' cien alarm. Contact Welded contact. Plant annunciator will never Periodic test. No effect on logic AXKA6-5 stuck contact. indicate a bypass condition on or AXKI-5 matrices. the affected channel function. short Relay coil Sustained (O Affected channel bistable cannot Periodic testing or Associated trip function Cd AXKA6 If the associated The ESFAS (RPS) overvettage, be bypassed for 6e RPS when attempting to s remains or becomes bistable is tripped, function is not affected (AXKB6) mechanical failure. (ESFAS) function. bypass. enabled. makes affected RPS as a different relay is open (ESFAS) trip logic l-M used to bypass the C out-of-3 coincidence. bistable contacts used in O the ESFAS (RPS) matrices. Relay coil Deterioration of o N No symptoma until an attempt Periodic testing or Removal of bypass (es) AXKA6 insulation. Removal of trip is made to bypass the affected when attempting to enables associated trip channel bypasses mey (AXKB6) bistaHe Excessive current will bypass. short function (s). result in channel trips reduce the supply voltage for onw or more possibly causing all bypasses in functions depending on affected channel to be removed. plant conditions. g l ' D (.t
.ps N
011-AS92-DA401, Rev. 01 Page 22 of 102
[ f) r%
\ ,
l Y TABLE 7.2-5 PLANT PROTECTION SThTEAl FAllERE hlODES AND EFTTITS AN ALYSIS Ns. Name Failure Cause Symptoms and Imal MMhod lahesnt EfTwt Upon Rensarks Mode EfTwts incleiding of Coengenating PPS and Dependent Failures DMwtion Provision Other Effects Trip Channel Bypass, Channel A (Typical), FMEA Diagrams 919A Trip Bypass Mechanical failure. Channel bistaMe cann(< be Periodic testing or Channeltrip functionis if bistable is tripped. Same effect for BXS-l Channel switch contact bypassed fx the affected shen strempting to enaNed. makes affected RPS or Contact S2. CXS-1 Bypass AXS-1 deterieratim function. byTass. ESFAS tnp logic l-out- Contact S3, and DXS-1 (Typical) Contact 51 of-3 coincidence, Contact 54. in normally off position Bypasa Mechanical failure. Channel bistable is bypassed Annunciating. If an attempt is made to Makes effected RPS or switch contact welded. regardless of the petion of the Trip channel bypass bypass the same p ESFAS trip logic 2-out-AXS-1 switch. alarm. function in another of-3 coincidence. Contact $1 ROM and BCP channel, both bypasses in normally bypass lights. sill be renmed. on position Periodic testing. Bypass Mechanical failure, Will n.< be able to bypese the Petiodic testing or Channel trip function is if bistable in channel B Similar effect for BXS-1 switch contact
- effected function in channel B shen attempting to enabled. (C,D) is tripped, makes Contacts St. 53, & $4; AXS-1 deterioration. (C D). bypass. the affecta! RPS or CXS-1 Ca *etts St. S2, Contact S2 ESFAS trip logic l-out- & 54; or DXS-1 (53,S4) in of-3 coincidence. Contacta SI,52, & 53.
norma!!y off position Bypasa Mechanical failure. Con.act permissive for bistable Periodic test. A b) Tass on bistable i None. switch contact welJed. I in channel B (C,D) bypass in channel B (C,D) will AXS-1 will be present even thcugh remove a bypass on (D Contact S2 channel A bistable 1 is in bistable 1 in channel A. 00 (S3,S4) in bypass. The circuit, however. ruwmally on will still rmw allow 2 channels in ha position bypess simultaneously, o O) I O
>-.s J
*t
(,N us Oll-AS92-DA4)01, Rev. Of Page 23 of 102
p
'w- .
TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFTECTS ANALYSIS No. Name Failure Cause Symptoms and I;ical Method Inherent EfTat Upon Rnnarks Mode Effects including of Compesating PPS and Depeedmt Failures De<ection Provision Other Efrats Bistable Circuits, RPS FhlEA Diagrams 1 & 10
- 31) RPS BistsNe Trip output Open circuit. BistaMe relays in RPS logic Annunciating. 3<hannel redundancy Makes the affected Affected reactor trip for: deenergized Failure of: deenergize. Places a half trip Trip alarm on (4th channet bypasses) reactor trip logic l-out- logic nmst be ill CONT (ofD i 15V poner in 3 coincidence logic matrices associated function. Channel trip. of-2 coiacidence. maintained in f ort-of.2 PRESS (24), supply, for the associated function. Periodic test. by placing the 50-I HI Trip vohage LVL(135), appropriate bistable in comparator, the tripped state.
SG-2 HI Setpoint voltage LVill34), supply, Ill LIN Trip setroint PWR(72), potentiometer, til LOG Trip opto-isolator. PWR(75) Trip output Faisure of: Bistable relays in RPS logic Periodic testing. 3-channel redundancy Makes the effected Affected reactor trip energized i 15V power will remain energized. (4th channel bypasses) reactor trip logic 2+ut- logic must be converted (on) supply, Affected channel function is of-2 coincidence. to 1-out+f.2 by placing Trip voltage inoperatise. the appropriate histable comparator, in the tripped state. Setpoi a voltage supply. Trip setpoint potentiometer. Trip opto-isolator. Trip relay Open transistor. One trip relay is deenergized. Annunciating. 3-channel redundancy I of 3 logic matrices is Channel trip outputs to driver open Places a half trip in one Trip alarm on (4th channel bypasses) half tripped for the the other two logic g) coincidence logic matrix. associated function. affected function. matrices are unaffected. CA) Periodic test. Makes reactor trip logic l-out4sf-2 using
% a the affected channel.
Logic remains 2-out+f-3 using the unaffected o (A) channels. I O pa nt 011-AS92-DA4X)l, Rev. 01 Page 24 of 102
.m f
( s
) ( .
/
e A. TAELE 7.2-5 PIANT PROTECTION SYSTT_M FAILE RE MODES AND EFFTCTS AN ALYSIS No. Name Failure Came Symptoms and 1xal Method inhermt Effat Upon Remarks Mmle Effats Includanz of Cornpensating PPS and Dependent Failurm th4tethm Providan (hter Effats Bistebie Circuits, RPS FMEA Diagrams 1 & 10 Trip relay Shetted transistor. T6p relay does nte deenergize Periodic test. 3<hannet redundancy I of 3 logic rnatrices is Affected reactor trip driser short on a trip condithm. Effectively (4th channel byrasses) disabled for the logic mud be convened bypasses one logic matnx. affected function. to lout-sf-2 by placing If escessive current is dnu n. Makes reactor tnp the associated bistable may resub i- m . aied DC logic 2wt-of-2 using in the tripped state. 3 peer supply failure. See DC the af'ected channel. power distnbution faults. Logic remains 2-out+f-3 using the unatYected channels. Trip relay Deterimtion of May cause relay dnver to fait, coil shorted insulatkm. as desenbed above, due to excessive current. Relay contacts will not pick up, same etTect as open cost Trip relay Sostained One bistable relay is in tripped Same effect as open Same as oren relay same as open relay same as open relay coilopen everveltage, condition. Same effect as open relay driver. driver. driver. driver. broken wire. relay driver. Pre 4 rip Open circuit, Pre-trip relays are deenergized. Annunciating. None. Indication only. output Failure of: Pre-trip alarm for deenergized i 15V power affected function. (off) eupply, PerkMic test. Pre-trip w4tage comparator. Setpoint voltage supply, (O Pre-trip serpoint potentiometer. y Pre-trip opto-isolator- O O CA) i O i w b W C% l M
\
Oa 011-AS92-DA-001, Res . 01 Page 23 of 102
m l O L) J TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILt'RE MODES AND EFTECTS ANALYSIS Na. Name Failure Cause Symptoms and Lncal Method Inhermt EfTert Upe Mode Remarks EITwts including of Compemating PPS and Depmdent Failures Detection P'wision Other Erects Bistable Circuits, RPS FMEA Diagrams 1 & 10 Prearip Failure of: Pre-trip relays do not Perindic test. None. Indication ordy.. output i 15V power deenergize on a pre-trip enerrized supply, condition. No pre-trip (on) Pre-trip voltage annunciation for affected comparator, channel function. Serpoint vohage supply, Pre-trip setpoint potentiometer, Prearip or'o-isolator. Pre-trip open transistor. Prearip relay deenergizes. Pre- Annunciating. relay driver None. Indication only. trip annunciation on affected Pre-trip alarm for open channel function. atTected function. ! Pre-trip Shorted tramistor. Pre 4 rip relay does not Periodic test. telsy driver None. Indication only. deenergize on a pretrip short condition. 1 Pre trip Sustained Same as open relay driver. Same as open relay None. Indication only. relay coil overvoltage, driver, open broken wire. Pre-trip Deterioration of May cause relay driver to fail, O relay coil insulation. as described above, due to JM short excessive current. Relay %e contacts will not pick up, same etTect as open coil. O CD I O s- a i
& t W
w 011-AS92-DAWI, Rev. 01 Page 26 of 102 L. _ _ . . _ _ _ _ ._ ._ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ~ . , , _ . . _
ps rg i \
\ / {
s ) TABLE 7.2-5 PLANT PROTECTION STS1EM FAILURE MODES AND EFTICTS ANALYSIS Ns. Name Failure Cause Symptoms and incal hie 1 hod Inhermt EITert Upon Remarks Mode Erfa es including of Cornpensating PPS and Dependent Failurts Detection Pruision Other Effats Bistable. R PS!C%T FMEA Diagram I & 10
- 32) R PS/CWP Trip outrut Same as item 31) Bistable relays in RPS and Annunciating. 3<hannel redundancy Makes the reactor tnp Reactor trip logic for HI Bistable for deenergized CWP legic decc-reze. Places HI PIR PRESS trip (4th channel bypassed) and CWP 13gic for 111 PZR PRESS must be HI PZR (ofD a half trip in i RPS logic alarm. Channel tnp. PZR PRESS 1-out+f-2 maintained in 1-out+f-2 PRESS (65) matrces fm HI PZR PRESS. Penn&c test. coincidence. by placing the Places a ha itnp in the CWP appr ynate bist.ble in matrix . the atTected channelin the tripped state.
CWP function is not credited in the safety analysis. Tnp ou.put Same as item 31) Bistable relays in RPS and Penodic testing. 3<hannel redundancy Makes the reactor trip Reactor trip logic for HI energized CWP logic mi!! remain (4th channe! bypassed) and CWP logic for Ill PZR PRESS must be (on) energized. Affected channel PZR PRESS 2wt+f-2 converted to 1-out-of-2 reactor trip and CWP functions coincidence. by placing the are inoperable. appnyriate bistable in the affected channelin the tripped state. Trip relay. Same as item 31) Same as Item 31) Same as item 31) Same as Item 31) Same as item 31) pre-trip relay, and g relay driver g faults e Bistable, RPS/EFAS, FMEA Diagrams 1 A 10 h O
- 33) RPS/EFAS Trip output Same as item 31) Bistable relays in RPS and Annunciating. 3-channel redundsney Makes the reactor trip Reseter trip and EFAS- O Bistable for deenergized EFAS-lG) logic deenergize. Trip alarm on LO (4th channel bypassed) and EFAS-lG) logic IC) logic for LO SG- CA)
LO SG 1 LUL (59) (of') Ptaces a half trip in 3 RPS logic matrices for LO SG-lG) LVL. SG-1(2) LVL. Periodic test. Channel trip. for LO SG-l(2) LVL 1-out-of-2 coincidence. 1(2) LVL must be maintained in 1-cutef-2 d w ani LO SG- Provides a channel EFAS-!(2) by placing the 2 VL (52) initiation signal if associated SG appropriate bistable in is rw ruptured. the effected channelin the tripped state. n 1 w O! 1-ASED A A)l, Rev. 01 Page 27 of 102
\ r Q_
TABLE 7.2-S PLANT PROIECTION SYSTEM FAILURE MODES AND EFTECTS ANALYSIS No. Name Failure Cauw Symptoms and leal Method Inherent Effwt Upon Remarks Mode FJfwts including of Compmsating PPS and Depmdmt Failarn Dention Provision Other Effwls Bistable. R PS/EFAS, F11EA Diagrams ! & 10 Trip ou*put Same as Item 311 Bistabte relays in RPS and Periodic test. 3-chennel redundancy Makes the reactor trT Reactor trip and EFAS-energized EFAS-!C) logic will remain (4th channel bypassed) and EFAS-lC) logic IC) logic for LO SG-(on) ene:Ti zed. Affected channel for LO SG-IC) LVL IC) LVL must be reactor trip and EFAS.!C) 2-out+f-2 coincidence. converted to 1<mtef-2 functions are inaperable. by placing the appropriate bistable in the affected channel in the tripped state. Trip relay, Same as item 31) Same as item 31) Some as Item 31) Same as Item 31) pre-trip q Same as item 31) relay, and relay driver faults Bistable ESFAS, F%1EA Diagrams 1 & 10 i l
- 34) ESFAS Trip output Same as item 31) ' Bistable relaya in ESFAS logic Annunciating. 3-channel redundancy Makes the actuation SIAS/CCAS, CSAS and a Bistable for deenergized matnces deenergize. Places a Trip alarm on HI (4th channel bypassed) logic for SIAS/CCAS, CIAS actuation logic fw HICONr (off) half trip in 3 ESFAS legic CONT PRESS. Channel trip. CS AS and CIAS on HI HI CONT PRESS must PRESS (13) matrices for HI CONT PRESS Periodic test. CSAS actuation CONT PRESS l-out- be maintained in I-out-SIAS/CCAS, CIAS and CSAS requires coincident HI- of-2 coincidence. of-2 by placing the g actuation. HI CONT PRESS trip. appropriate bistable in g the affected channel in a the tripped state.
Trip output Same as item 31) Bistable elays in ESFAS logic Periodic test. 3<hannel redundancy To Makes the actuation SLASICCAS, CSAS and C) energized matrices remain energized (4th channel bypassed) logic for SIAS/CCAS, CIAS actuation logic for O (on) Effecnvely disables 3 ESFr i CSAS and CIAS on Hi HI CONT PRESS must logic matrices for HI CONT CONT PRESS 2mut-PRESS actuation of of-2 coincidence. be converted to 1-out-of-2 by placing the o N SIAS!CCAS, CSAS and CIAS. apprtyrista bistable in the affected channel in the tripped state. Trip relay. Same as Item 31) Same as Iters 31) Same as item 31) Some as Item 31) Same as Item 31) preW
~.,...d relay driver d,
faulta 4 T(Ja oQ 011- ASED A401, Rev. 01 Page 28 of 102
y i ab
$/v,d elp:7h IMAGE EVALUATION
\\\\\(g'q,&
N \[g 't # 9f9 //'/ / 4 TEST TARGET (MT-3)
${fh+%[
4 4
}>p. /////p {f
+ -
r,
,.o I" lij! 2.2 L-- pp lhiMfu A =
l.1 L LJ4 I_i.25jji.4 i.6 4- 150mm > 4_..._. 6" >
? ?'
s@' "%f 4
$ f'k %
,g n &ty e ,a <y s g,/////,w a; oyy/ ,
.p};g+
4
*%i A ., y by hg;' ,, *g g t .
,27 i
(. ~ I# f 9vv>,3, e.,vQb (0 t. t O' g //o// (, 9t()hi# IMAGE EVALUATION TEST TARGET (MT-3) / / /g[4 ,f4,
*/
W// $$ $/ khb'
+ <e 1.0 ;?" Ma U ~ 3 5 { ! 2.2
[ ry t!
- I~ ll!
l,l i 2;.S
~
l 1.8 i== 1.25 !!l.4 l ll=== l =1.6
==
4 - -- 150mm > d- 6" > 84 cs A w g%;r 4 4% *////z y v yg ihe,,,e t 7 - Q ,o
. u. ,, , s, /
w 41{ N db
<p L.. A
[ %~. ; , .
,;w g;a&Q ,, j_jj
e O TABLE 7.2-S PLANT PROTECTION SYSTEh! FAILURE MODES AND EFTECTS ANALYSIS No. Name 5'adure Cause Sympemns and teral hiethat inherent Effect Upem Remarks Mode Effet ts including of Compensating PPS and Depndent Failmes Detection Pruisi<m Other Effects Bistable, ESFAS. FMEA Diagrams I & 10
- 35) ESFAS Trip output Same as Item 31) Bistable relays in ESFAS logic Annunciating. 3-thannel redundancy Makes the actuation CSAS logic must be Bistsble for deenergized matrices deenergize. Places a Trip alarm on 111111 (4th channel bypassed) logic for CSAS l-out- maintained in 1+ut+f-2 111 111 (eff) half trip in 3 ESFAS logic CONT PRESS. Channel trip. of-2 coincidence. by placing the CONT matrices for ill 111 CONT Periodic test. Concurrent automatic appropriate bistable in PRESS PRESS actuation of CS AS. SIAS/CCAS signal is the affected channel in (7) required to initia'e the the tripped state.
CSAS funuinn. Trip output same as Item 31) Bistable relays in CSAS logic Peri (xfic test. 3-channel redundancy Makes the actuation CSAS logic must be energized matrices remain enerF i zed. (4th channel bypassed) logic for CSAS 2-out- converted to I-out- _f-2 (on) Effectively disables 3 CSAS of.2 coincidence. by placing the logic matrices. appropriate bistable in the effected channel in the tripped state. Trip relay. Same as Item 31) Same as Item 31) Same as Item 31) Same as item 31) Same as item 31) pre 4 rip q relay, and relay driver faults
- 36) ESFAS Trip output Same es item 31) Bistable relays in RAS logic Annunciating. 3-channel redundancy Makes the actuation RAS logic must be Bistable for deenergized matrices deenergite. Places a Tnp alarm on (4th channel bypassed) logic for RAS 1+ut+f- maintained in I-out+f-2 REFUEL (off) half trip in 3 RAS logic REFUEL TANK LO Channel trip. 2 coincidence. by placing the TANK LO matrices. LEVEL appropriate bistable in @
LEVEL Periodic test. the affected channel in (2) the tripped state. ,% e Trip output Same as Item 31) Bistable relays in RAS logic Periodic test. 3-channel redundancy Makes the actuation RAS logic must be IV energized matrices remain energized. O (4th channel bypassed) logic for RAS 2+ut+f- converted to I-out-of-2 O (en) Effectively disables 3 RAS 2 coincidence. by placing the (A) legic matrices. appropriate bis:able in the affected channel in 6. a the tripped state. Trip relay, Same as Item 31) Same as Item 31) Same as item 3!) Same as Item 31) Same as item 31) pre-trip relay, and g relay driver faults g __. b 4 011-AS92 DA4101, Rev. 01 Page 29 of 102
n C) s F) m TABLE 7.2-S PLANT PROTECTION SYSTEM FAILURE MODES AND EFTECTS ANALYS!S No. Name Failure Cauw Symptoms and laral Method Inhermt Emet Upnn Remarks Mode Effwts Inchiding of Com pensating PPS and Dermdent Failures Detwtion Presision Other Flfwts Differential 7 h!able, ESFAS, FMEA Diagrams I & 10
- 37) LSFAS Trip output Open circuit. Deenergizes histable relay in Annunciating. 3<hannel redundancy Makes EFAS-1G) logic The tripped state of Differential deenergized Failure of: EFAS 1(2) actuation logic Trip slarm on SG- (4th channel bypassed) 2-out+f-2 coincidence this bistable is preferred Bistable for (off) i 15V power cirtuit for the effected channel 1 > SG-2 (SG-2 > SG- for Feed Only Goal since it allows EFAS SG-1 > SG-2 supply, Trip Provides permissive for channel I) PRESS. Generator (FOGG) initiation. Since.
PRESS (48) compa rator. -10V EFAS-lG) initiation on SG LO Periodic test. feature. however, both states of or setroint supply, LVL rt gardless of SG Makes EFAS-lG) logic this histable are used for SG-2 > SG-1 Trip setroint ot -rab eity. 1-out-of-2 coincidence safety-related functions, PRESS (39) potentiometer, for allowing initiation either the bypassed Trip opto-isointer, to an operable SG on enannel or the fault Signal A buffer, SG-lG) LO LVL. channel should be Signa' B buffer. returned to service as soon as possible. Trip relay, pre-trip relay and relay driver faulta result in the same i e%ets described here. See Item 31) for fault ' details. Trip output Failure of; Bistable relay in EFAS-lG) Peric4ic test. 3-channel redundancy Makes EFAS-lG) logic Placing the affected energized i 15V power actuation logic circuit for the (4th channel bypassed) 2<mt-of-2 coincidence bistable in the tripped (on) supply, Trip affected channel remains for a!!owing initiation state is prefered since it comparator. -10V energized. Channel EFAS-l(2) to an operable SG. allows EFAS initiation. setpoint supply, initiation will be disabled Makes EFAS-lG) kgic Si' 'e, however, both Trip setroint ahenever 50-1C) LO PRESS @ 1-out-of-2 coincidence str af this bistable potentiometer, bisraMe is tripped. for Feed Only Good Trip opto-isolator, are used for safery-related functions, either Signal A buffer, Generator (FOGO) % feature. Signal B buffer. the bypassed channel or the fault channel should f o be returned to service as O soon as pcssible. CA) Trip relay, pre-trip relay and reley driver d w faults result in the same effects described here. I See item 31) for fault deuils. p W O k k 011-AS92-D A401, Rev. O! Page 30 of 102 \ l .
5 p m 1 y: \/ . TABl.E 7.2-5 PLANT PROTECTION SYSTEM - FAILURE MODES AND EFTECTS ANALYSIS No. Name Failure Canse Symptoms and Lncal Method Inherent Effett Upon Rentarks Mode Effwts Including af Compemating PPS and Dependent Failures Detection Provision Other F.fTects Variable Serpoint Bistable, S/G Pressure FMEA Diagramn 1&ll
- 38) Variable Ttip output Open bruit, Bistable relays in RPS, EFAS- Annunciating. 3-channel redundancy Makes reactor trip and Reactor trip and MSIS Serpoint deenergized Failure of tJ-*able IC), and MSIS logic Tnp alarm on SG-lC) (4th channel bypassed) MSIS logic for SG-l(2) logic for 50-!(2) LO Bistable for (off) comparato- (see deenergize. Places a half trip LO PRESS. LO PRESS 1-out+f-2 PRESS must be SG-1 LO Item 31), in 3 RPS and 3 MSIS logic Possible low variable coincidence. maintained in 1-out-of-PRESS (45) Failure of: matrices for SG-lC) LO setpoint alarm. Makes EFAS-1(2) logic 2. EFAS trip logic for and SG 2 Peak detector, PRESS. Channel EFAS-!(2) Periodic test. 2-out-of-2 coincidence initiation must be LO PRESS step, min, or max initiation will be disabled for allowing initiation converted to 1-out-of-2 (30) adyust circuits, w henever SG-l > SG-2 (SG- to an operable SG. by tripping the SG-Subtractor/ limiter 2>SG 1) PRESS channel Makes EFAS-1(2) logic 1 > SG-2 (50-2 > SG-1) circuit, tr;p bistable is not tripped. leut of-2 coincidence bistable in the affected setroint output for FOGO. channel. See item 37).
buffer, low setpdnt comparator, reset circuit. DC/DC Converter. Trip output Failure of bistable Bistable relays in RPS, EFAS- Periodic test. 3-channel redundancy Makes reactor trip and Reactor trip and MSIS energized comparator (see 1(2), and MSIS logic remain (4th channel bypassed) MSIS logic for SG-1(2) logic for 50-1(2) LO (on) Item 31), energized. Effectively disables LO PRESS 2-out-of-2 PRESS must be Failure of: 3 RPS and 3 MSIS logic coincidence. converted to 1-out-of-2 Peak detector, matrices. Allows channel Makes EFAS-1(2) logic by placing the affected step, min, or max EFAS-1(2) initiation on SG-1(2) 1-out-of-2 coincidence bistable in the tripped adjust circuits, LO LVL regardless of SG for allowing initiation state. EFAS trip logic Subtractor/ limiter prensure. to an operable SG. for irutiation must be circuit, trip Makes EFAS-1(2) logic converted to 1-out-of-2 g) setpoint output 2-out-of-2 coincidence by tripping the SG- M buffer, low for Feed Only Good setpoint Generator (FOGG). I >SG-2 (50 2 >SG-1) bistable in the affected
%a comparator, reset channel. See item 37).
circuit. DC/DC Converter. O w t O s-a b o 4.
~
Ol l-AS92-DA 001. Rev. 01 Page 31 of 102
(~')
'. Q( n
(/ . TAllLE 7.2-5 PIANT PROTECTION SYSTEh! FAILURE MODES AND EITICTS ANALYSIS No. Name Failure Cause Symptoms and local Methmi Inherent Efrat Upon Remarks Mode Effats luciuding of Compemating PPS and Dependent Failures Detection Prusiskm Other Effects EFAS Chsnnel Initiation. FMEA Diagrams 1 & 12
- 39) EFAS-l Off SG IG) press. The 3 EFAS-lG) matris relays Periodic test. 3-channel redundancy Makes EFAS-lG) logic For SG-lG) press.
Channel signal failure low, in the afTected channel remain (4th channel bypassed) 2-out+f-2 coincidence signal faults see item Initiation SG-lG) LO energized in the presence ef a for allowing initiation I4). Permissive PRESS bistable SG-!G) LO LVL bistable trip. to an operable SG. For SG-lG) LO PRESS Circuit All( Al2) failed This efTectisely disables the Makes EFAS-l(2) logic histable faults see Item C9)(35) off. SG-1 > SG-2 affected channel EFAS-lG) 1-out+f-2 coincidence 38). EFAS-2 (SG-2 > SG-D function. for FOGG. For 50-1 > SG-2 (SG-Channel PRESS bistable 2 > SG-1) PRESS Initiation A19( A20) failed bistable fautta see item Permissive on, bistable 37). Circuit relay / relay driver For bistable relay C8)(34) All(12)-6 or related faults, see A 19CO)-6 failure. below. On SG-I C) press. The 3 EFAS-lG) matrix relays Periodic test. 3<hannel redundancy Makes EFAS-lG) logic signal failure high, in the affetted channel will (4th channel bypassed) 1-outef-2 coincidence SG-lG) LO deenergize in the presence of a for allowmg initiation PRESS bistable SG-!C) LO LVL bistable trip to an operable SG. Al1( Al2) failed regardless of SG cperab;Iity. Makes EFAS-1(2) logic on. 50-1 > SG-2 This efTectively disables the 2-out+f-2 coincidence (SG-2 > SG-1) affected channel Feed only for Feed only Good PRESS bistable Good Generstor (FOGG) Generator (FOGG). Al9(A20) failed EFAS-1(2) function. off, bistable relay / relay driver g) Al1(12) 6 or A19CO)4 failure.
.M
*s
- n) L AS-1 OtY less of permiseive This effectively disables the Periodic test. 3<hannel red'endancy Makes EFAS-l(2) logic M EFAS-lG) logic must Channel (Item 39), SG-lG) affected channel EFAS-lG) (4th channel bypassed) 2-out-of-2 coincidence. be converted to 1-out-Initiation level signal failure function. of-2.
O Circuit (86) high, SG-lG) LO g For failed level signal, t EFAS-2 LVL histable see item 10). For failed O Channel A7(A8) failed on, bistsble, see item 33). Initiation bistable relay / relay For failed relays see Circuit (85) driver A7(S)4, below. A19-1. A19-2, ,%p Al9-3 failure. O N 011- AS92-DA4X)l, Rev. 01 Page 32 of 102
(%I ( f s \/ C)./ TABLE 7.2-5 PLANT PROTECTION SY%TE31 t FAILURE hlODES AND EITECTS ANALYSIS No. Name Failure Cause Symptmns and 1 mal Method Inherent EITwt Upon Remarks Mode Effnts including of Compemating PPS and Dependent Failures Detection Provision Other Effects EFAS Channel rn itiation, FhlEA Diagrams 1 & 12 On 50-1(2) level with permissive present, ?eriodic test. 3-channel redundancy Makes EFAS-1(2) logic EFAS-lG) logic must l signal failure low, channel EFAS-l(2) function (4th channel bypassed) 1-out-of-2 coincidence. be maintained i: l-out-SG-1(2) LO LVL will be initiated regardless of of-2 by tripping the l bistable A7(AR) actual SG level. afTected channel. failed etT, bistable relay /reley driver A7(S)-6, A19-1, A19-2 A19-3 failur*.
- 41) EFAS-IC) N.C. Stuck or welded EFAS-1(2) matrix relays in the Periodic test. 3-channel redundency Makes EFAS-lG) logic ne EFAS-lG) logic SG-lG) LO centset contact, relay coil affected channel will remain (4th channel bypassed) 2-cut +f-2 coincidence must be converted to 1-PRESS closed open or shoned, energized whenever the SG- for two operable SGs. out-of-2 by tripping the Bistable reley driver open. 1 > $G-2 (SG-2 >SG-1) PRESS SG-l > SG-2 (50-Relay channel bistable is not tripped. 2 > SG-1) bistable in the All(12)-6 This would effectively disable stTected channel, his the channel EFAS-1(2) also changes EFAS-IC) initiation when both SGs are FOGG feature to 2-out-operable, of-2. See item 37).
N.C. Stu-k or EFAS-lC) matrix relays in the Periodic test. 3<hannel redundancy Makes EFAS-IC) logic EFAS trip logic for cmtsct deteriorated afTected channel will deenergize (4th channel bypassed) 1-out+f-2 coincidence initiatim must be open contact, relay shenever the SG-lG) LO LVL for allowing initiation maintained in 1-out-of-2 driver shorted. channelbistable trirs. Allows to an operable SG. by tripping the 50- (O channel EFAS-1G) initiation on SG-1(2) LO LYL regardless of Makes EFAS-lG) logic 2-out-of-2 coincidence
! > SG-2 (SG-2 > SG-1) bistable in the affected y
SG pressure. for FOGG feature. channel. See liem 37).
- 42) EFAS-lG) N.O. Stuck or EFAS-lG) matrix relays in the Periodic test. 3<hannel redundancy Makes EFAS-lG) logic EFAS trip logic for O
SG-1 >SG-2 contact deteriorated affected channel will deenergize o (SG-2 > SG- open contact, relay coil whenever the 50-1(2) LO LVL (4th channel bypassed) 1-out-of-2 coincidence for allowing initiation initiation must be w maintained in 1-out+f-2 I I) PRESS open or shorted, channel bistable trips. Allows to an operable SG. by tripping the SG-Bistable relay driver open. channel EFAS-1(2) initiation on Makes EFAS-1(2) logic 1 > SG-2 (SG-2 > SG-1) Relay SG-lG) LO LYL regardless cf 2-out-of-2 coincidence bistable in the affected A19CO)-6 SG pressure. for FOGG feature. channel D (D O t O3 01 l-AS92-DA401. Rev. 01 Page 33 of 102 _ r -
A. m
\ \
I ..
}
TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFTECTS ANALYSIS No. Name Failure Cause Symptoms and lecal Method Inhesent Effwt Upon Remarks Mode Effnts Incheding of Compmsating PPS and Dependmt Failurn Detection Provision Other Efrects EF AS Channel Initiation, FMEA Diagrams 1 & 12 N.O. Stuck or seided EFAS-IC) matrit relays in the Periodic test. 3-channel redundancy FOGG circuit makes EFAS-lG) logic must contact contact, relay affected channel will rema n ' (4th channel b 3passed) EFAS.lG) logic 2-out- be converted to 1-out-closed driver shorted. energized a benever the SG-IG) of-2 coincidence for of-2 by tripping either LO PRLSS channel bistable is initistion m hen the the affected channel trippn!. opposite SG is matrix relays or the Thrs would disable the channel ruptured. bypassed channel. EFAS-lG) initiation only when With both SGs SG-lG) pressure u as low due operable, EFAS-lC) to a rupture on the opposite SG. logic remains in 2-out-of.3.
- 43) EFAS-lG) N.O. Stuck or EFAS-!G) matrix relays in the Annunciating. 3-channel redundancy Makes EFAS-lG) logic EFAS logic for must be SG-lC) LO contact deteriorated afTected channel will deenergize Trip alarm. (4th channel b)7sssed) 1-out-of-2 coincidence. maintained in 1-outmf-2 LVL open contact, relay coil whenever the SG is operaNe. Period.c test. FOGG feature remains by tripping the SG-lG)
Bistable open or shorted, EFAS-lG) channel initiation in 2-out-of-3. LO LVL bistable in the Relay A7(5)- relay driver open. regardless of actual SG level. , 6 affected channel. t N.O. Stuck or melded EFAS-lG) matrix relays in the Periodic test. 3-channel redundancy Makes EFAS-l(2) logic EFAS-1(2) logic must contset contact, relay affected channel will remain (4th channel bypassed) 2-out-of-2 coincidence. be converted to 1-out-closed driver shoned. energized. EFAS.!(2) channel of-2 by tripping either is disabled from feeding an the affected channel operable SG with low water matrix relays or the lev el, bypassed channel. O (A3 Variable Serpoint Bistable, PZR Press., FMEA Diagrams I&ll e We
- 44) Variable Trip output Same as SG LO AtTected channel histable telsys Annunciating. 3-channel redundancy Makes reactor trip, Reactor trip, CSAS and Setroint deenergized PRESS bistable, in RPS, CSAS, and Trip alarm on LO (4th channel bypassed) CSAS, and SIAS/CCAS logic for Bistable for (otT) liem 35) SIAS!CCAS coincidence logic PZR PRESS. Channel trip.
Q SIAS/CCAS logic for LO PZR PRESS must Q) LO PZR deenergize.11 aces a half trip Possible low variable LO PZR PRESS 1-out- be maintained in I-out- I PRESS (62) in 3 RPS,3 CSAS, and 3 setroint alarm. of-2 coincidence. of-2 by tripping the SIAS/CCAS matrices for LO Periodic test. bistable in the effected PZR PRESS. channel. Trip output Same as SG LO Affected channel bistable relays Periodic test. 3-channel redundancy Makes reactor trip, Reactor trip, CSAS, and energized PRESS bistable, in RPS, CSAS, and (4th channel bypassed) CS AS, and SIAS/CCAS logic for (on) Item 38) SIAS/CCAS coincidence logic g HI CONT PRESS also SIAS/CCAS logic for LO PZR PRESS must g remain energized. Effectively actuates SIAS/CCAS, LO PZR PRESS 2-out- be converted to I-out-disables 3 RPS,3 CSAS, and 3 and provides of-2 coincidence, of-2 by tripping the g SIASICCAS matrices for LO permissive for CSAS. bistable in the affected -% PZR PRESS. channel.
- Oll-AS92-DA-001, Rev. 01 Page 34 of 102
p-l . TABLE 7.2-5 PLANT PROTECTION SYSTEh! FAILURE MODES AND EITICTS ANALYSIS No. Name Failure Cause Sympenas and Local Method Inherent Efrat Upnn Remarks Mode EfTnts including of Comiwmating PPS and Depedent Failures Detntion Provision Other Effects CPCiRPS Trip Circuit, FMEA Diagram 1 l
- 45) LO DNBR Trip circuit Broken wire, CPC Channel bistable relays in RPS Annunciating. 3-channel redundancy Males reactor t6p Reactor trip logic for Trip Circuit open LO DNBR (HI coincidence logic deenergire. Trip alarm on LO (4th channel bypassed) logic for LO DNBR the effected function (92) LPD) trip contact Places a half trip in 3 RPS DNBR (lll LPD). Channel trip. (HI LPD) 1-out+f-2 must be maintained in 111 LPD failed open, NIS coincidence logic matrices for Periodic test. coincidence. leut-of-2 by tripping Tnp Circuit trouble trip circuit LO DNBR (111 LPD). the channel via the (96) fa sit. power trip test interlock Note: this trips both the LO DNBR and III LPD functions simultaneously.
Tnp circuit CPC LO DNBR Channel bistable relays in RPS Periodic test. 3-channel redundancy Makes reactor trip Reactor trip logic for closed (HI LPD) trip coincidence logic remain (4th channel bypassed) logic for LO DNBR the affected function contact failed energized for a trip condition. (111 LPD) 2-out+f.2 must be converted to I-closed NIS Affected channel function is coincidence. out-of-2 by tripping the ' trouble trip circuit inoperative. channel via the power fault. trip test interlock. , Note: this trips both the LO DNBR ard III LPD functions simultaneously. W CO. W
*e 70 O
O W t O
>-a a
kt A W' OI l-AS92-D A@l, Rev. 01 Page 35 of 102
% p
\
,%- \% '
TABLE 7.2-S PLANT PROTECTION SYSTEM FAILURE Sf0 DES AND EFFECTS ANALYSIS No. Name Failure Cause Symptoms and local hiethnd Inherent Ef'nt Upon Remarks Mode Effwts Inc!uding of Compmsating PPS and Dependent Failura Dv4wtion Provision Other Effects 2+ut of-4 Coincidence Logic Reactor Trip FMEA Disgrams I,13, & 14
- 46) 2/4 RPS Lcgic Compone . All 4 matrix relays in the AB Annunciating. Reactor protective Requires failure of two Coincidence Matrix OtT faihe.e, power matrix deenerFi ze. Opens all 4 PPS trip alarm. system tnp. independent relay Logic for: (e g., AB supply pair failure. RPS trip paths. All 8 reactor Matrix power supply
*, contacts or redundant 50-2 LO Matrix) trip breakers open. Reactor trip trouble alarm (for power supplies in the PRESS (41) occurs. power supply faults affected matrix 50-1 LO only)
PRESS (50) III CONT PRESS (26) SG-2 III LVL (43) 50-1 H1 LVL (44) 50-2 LO Component LVL (54) togic failure; one set of The AB matrix relays will not Periodic teet. Reactor trip conditions Makes reactor trip RPS trip logic can be , SG-1 LO Matrix on contacts failed deenergize when a reactor trip sensed in the A&C logic for affected converted to 1-out-of-3 LVL (58) (e.g., AB closed. condition is sensed in the A and channels or the B&C parameter a selective 2- by tripping the bypassed LO PZR Matrix) B channels. PPS will not channels, will trip the outef-3 coincidence. channel or trip logic can PRESS (64) initiate a reactor trip for signals reactor via the AC or be converted to 2+ut-HI PZR originating only from A and B BC matrices. (Channel of-3 by renoving the PRESS (67) channels. D assumed bypassed). bypass from the HI LIN bypassed channel and PWR (74) bypassing the effected III LOG channel. PWR (77) LO DNBR g (A) (94) ill LPD (93) ge IV O O
- 47) Matrix relay Open coil Sustained Trip path with associated relay Annunciating. RPS trip path logic is The system has I of 2 CA)
Each trip path is formed g e.g. 6AB-1 overvoltage. contact mill deenergize. 2 of 8 RPS actuation alarm. selective 2+ut-of4 or 6AB-2 or para!!el actuation paths by one set of contacts O reactor trip breakers will apen. PPS status panel coincidence. open. Remaining RPS from each set of logic
- 6AB-3 or CEDMs will not deenergio. indication. trip paths are 6AB4 unaffected.
matrix relaya.
%p t%
M 01I-AS92-DA-001 Rev. 01 Page 36 of 102 - - - - - _ _ - _ _ _ _ _ - _ _ _ - - - _ _ = --_____-_____ _ _ ._ - - - .
D. l ( l N f ' TABLE 7.2-5 PLANT PROTECTION SYSTEnt FAILURE MODES AND EFITCTS ANALYSIS No. Name Failure Cause Symptoms and lxal 5fethod Inherent Effect Upon Reinarks hfode Effnts including of Compersating PPS and Dependent Failures Detection Provision Other Effects 2+ut+f-4 Coincidence legic Reactor Trip FMEA DiaFrams I,13, & 14 Shorted coil Deterioration of The shorted coil may cause the insulation relay driver to fail open or short. If the driver fails open, the symptoms will be the same as the open coil fault. If the driver fails short, the power supply will be shorted producing the same symrtoms as loss of the power supply. See item 165).
- 48) Matrix Relay On Emitter to One RPS trip path will not Periodic test. Selective 2-out<>f-4 trip System will still The matrix relays in the Driver collector short. deenergize when a trip paths. respond to a valid trip other 2 unbypassed condition is detected by the Remaining matrix condition. logic matrices are associated 2/4 matrix. relays / trip paths are unaffected. A trip in unaffected. either of these will cause a trip in all fier trip raths.
oft Open transistor Same effect as open relay coil, junction. hem 47).
- 49) Bypass Contset Stuck or welded The AB logic matrix is not Periodic test. Reactor trip conditions Makes reactor trip RPS trip logic can be Relay short contact. responsive to a concurrent trip sensed in the A&C logic for afTected converted to I-out4)f-3 Contact of the Al armi B1 bistables. channels or the B&C parameter a selective 2- by tripping the bypassed (e.g. AB channels wdl trip the out-of-3 coincidence. channel or trip logic can matrix, reactor via the AC or be converted to 2-out-AXKl-1 or BC matrices. (Channel of-3 by removing the %
BXKl-1 D assumed bypassed). bypass from the bypassed channel and h O bypassing the affected O channel. Contact Deterioration of It is not possible to bypass the Periodic test. Within a coincidence During testing, makes No effect when channel O y open contact, stuck contact of bistable Al (BI)in matrix, twh channel reactor trip logic for is unhypassed. contact. one of three matrices. During contacts for a given trip the affected parameter For bypass relay coil PPS testing, the AB matrix will are required to open to a selective 1-out-of-3. be half tripped when the initiste a reactor trip. If coincident channel is fautta see Item 30), Trip Channel Bypass faults. % p affected bistable is tripped. tripped, testing will f4 cause a reactor trip. g n
-4A
-Q Oll-AS92-DA401, Rev .01 Page 37 of 102
p m w I . TABIE 7.2-5 PLANT PFOTECTION SYSTEh! I'AILURE MODES AND EFFTCTS ANALYSIS No. Name Failure Cause Symptoms and local Method Inherent EITwt Upon Remarks Mode Effats Including of Compensating PPS and Depm! tut Failures Detntion Provision Other Elfats 2-out+f4 Coincidence Logic Reactor Trip FMEA Diagrams I,13, & 14
- 50) Distable N.O. Welded contact. The AB matrix releys mi!I not Pedod c test. De AC and BC Makes reactor trip RPS trip logic can be Relay contact fails stuck contact. deenergize when the afYected matrices are still logic for effected ennverted to 1-out+f-3 Contact (e.g. chwed/N.C. function trips in the A and B capable of deenergizing parameter a selective 2- by tripping the bypassed AB matrix, contact fails channels. AB trip path is all four trip paths and out-of-3 coincidence, channel or trip hvic can Al-l or Bl. open. inoperable for the affected tnpping the reacter.
- 1) ITorm C be converted to 2+ut-function. Bistable Control (Channel D assumed of-3 by removing the contact) Panel (BCP) LED will not bypassed) bypass from the light.
bypassed channel and bypassing the effected channel. N.O. Welded contact, he AB matrix is half tripped. Periodic test. 2-out+f-3 trip Makes reactor trip contact fails stuck contact. If complementary bistable trips, coincidence (4th logic for affected open/N.C. a reactor tdp mill occur via all channel bypassed). parameter a se-lective t-contact fails four trip raths. Bistable Matrix half tdp. out-of-3. (4th channel closed Control Panel (BCP) LED will bypassed) (Form C be ht centinuosly. contact) l N.O. Deterioration of The AB matrix is half tripped. Troubleshooting. 2-out-of-3 trip Makes reactor trip PPS testing will not contact fails contact. If complementary bistable trips, his fault will not be coincidence (4th logic fix effected detect this fauh as the open - high a reactor trip mili occur via all detected until a channel bypassed). parameter a selective l- N.C. contact used for resistance. four trip raths. reactor trip is Matrix half trip. out+f-3. (4th channel the BCP LED will still inadvertently bypassed) function, genersted by tdpping For bistable relay coil the complementary faulta see item 31),. RPS bistable individually. bistable circuit faulta g 2-out+f4 Coincidence logic CSAS, SIAS, CCAS, and CIAS. FMEA Diagrams 1,13.16 (A) e SI) HI CONT Logic Multiple Spurious actuation of SIAS,
%a Annunciating. SIAS, CIAS, and Requires failure of two PRESS 2/4 matrix Off component CCAS, and CIAS. Permissive CIAS, SIAS, and M Coincidence (e g. AB faihrres. available fbr actuation of CSAS CCAS actuation. parallel, redundant O CCAS alarms. O legic (15) matrix) componenta in the logic on 2-out+f-3 til-HI CONT matrix.
PRESS (4th channel bypassedt O e-a I O l 5 T-C4 Oll-AS92-DAMI, Rev .01 Page 38 of 102
w s q TABLE 7.2-$ PLANT PROTECTION SYSTEM FAILURE MODES AND EITECTS ANALYSIS No. Name Failure Cause Symptoms and Imal Methmi inherent Effect Upon Mmle Effwts Inchuling Reinarks of Compensating PPS and Dependent Failures Detection Prwision Other Effects 2mutef-4 Coincidence Logic CS AS, SI AS, CCAS, and CIAS FMEA Diagrams I,13,16 l#F ic Component AB logic matrix for 111 CONT Periodic test. AC and BC coincidence matrix On Makes SlAS, CCAS, SIAS, CCAS, and CIAS failure; one set of PRESS will not respond to a matrices remain and CIAS logic for H1 logic can be converted (e.tr. AB contacts failed valid trip signal coincidence in available to initiate CONT PRESS a to Imut-of-3 by tripping mat:ix) closed. the A and B channels. PPS will SIAS, CIAS, and selective 2-out-of-3 the bypassed channel or not initiate SIAS, CCAS, and CCAS. (Channel D coincidence. the logic can be CIAS for signals originating assumed bypassed). only from channels A and B. converted to 2-outmf-3 by removing the bypass from the bypassed channel and 1ypassing the stTected channel.
- 52) LO PZR Logic Multiple Spurious actuation of SIAS and Annunciating. SIAS and CCAS Requires failure of two PRESS 714 matris Off conyonent CCAS. Permissive available CCAS and SIAS Coincid. actuation. parallel, redundant (e.g. AB failures. for actuation of CSAS on 2-out- alarms.
Logic (u ') matris) components in the logic of-3 Ill-III CONT PRESS (4th matrix. channel bypassed). Logic Component AB logic matrix for LO PZR Periodic test. AC and BC coincidence Males SIAS and CCAS matrix On failure; one set of SIAS and CCAS logic PRESS will raA respond to a matrices remain logic for LO PZR (e.g. AB contacts failed valid trip signal coincidence in can be converted to l-available to initiate PRESS a selective 2- outef-3 by tripping the matrix) closed. the A and B channels. PPS will SIAS and CCAS. outmf-3 coincidence, bypassed chmanel or the not initiate SIAS and CCAS for (Channel D assumed logic can be :onverted signals originating only from bypassed). to 2mutmf-3 by g channels A and B. removing the bypass g from the bypaissed a channel and bypassing the affected channel. h3
- 53) Hi-ill Logic Multiple All 4 CSAS trip paths open. If O Periodic test. Containment spray CSAS actuation signal Requires failure of two O CONT matrit Off component SIAS signalis present, if fault is concurrent requires concurrent in all 4 trip paths. parallel, redundant PRESS 2!4 (e.g. AB failures. containmerr spray will occur. with SIAS signal, SIAS signal.
Coincidence matris) components in the logic O CSAS alarm will matrix. >-* Logic (9) occur.
$(4 k
A
.O 011-A592-DA4)01,Rev .01 Page 39 of 102
3 (~), (j'r
/
( % TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFTTCTS ANALYSIS No. Name Failnre Cause Symptoms and lecal Afethod Inherent EfTect Upem Remarks Mode EITects including of Compemating PPS and Dependent Failures DHection Provision Other FJfects 2+ut+f-4 Coincidence Logic, CSAS, FMEA Diagrams I,13,16 legic Component AB logic matrix for CSAS will Periodic test. AC and I4C coincidence Makes CSAS logic a CS AS logic can be matrix On failure; one set of not respond to a valli 111-111 matrices remain selective 2-out-of-3 converted to I-out-of-3 (e g. AB contacts failed CONT PRESS condition. PPS available to initiate coincidence. by tripping the bypassed matrix) closed. will nd initiate CSAS for CS AS. (Channel D channel or the logic can signals originating only from assumed bypassed). be converted to 2. cut-channels A and B. of-3 by removing the bypass from the bypassed channel and bypassing the affected channel. 2-out-of4 Coincidence Logic. MSis, FMEA Disgroms I,13,15
- 54) 2/4 logic Multi Pe l All 4 MS15 trip paths open. Annunciating. MSIS actuation. Requires failure of two Comeidence matrix Off component Spurious actuation of MSIS MSis alarm. parattel, rafundant logic for: (e.g. AB failures. occurs. ,
components in the logic SG-2 LO matrix) matrix. PRESS (32) or SG-1 LO PRESS (47) Logic Component AB logic matrix for MSIS will Periodic test. AC and BC coincidence Makes MSIS logic a MSIS logic can be matrit On failure; on= so of rot respond to a valid 50-l(2) matrices remain selective 2+ut-of-3 @ converted to 1-out-of-3 (e g. AB contacts failed LOW PRESS condition. PPS available to initiate coincidence. by tripping the bypassed matrix) closed. will not initiate MSIS for MSIS. (Channel D channel or the logic can *0 signals originating only from assumed bypassed). channels A and B. be converted to 2-out-of-3 by removing the Q O bypass from the - O bypassed channel and CM bypassing the affected channet [ sa 2+ut+f-4 Coincidence legic, RAS, FMEA Diagrams 1.13,15
- 55) REFUEL legic Muhiple All 4 RAS trip raths open. Annunciating. RAS actuation. Repires failure of two TANK LO matrix Off LEVEL 2/4 (e g. AB component failures.
Spurious actuation of RAS occurs. RAS alarm. parallel, redundant components in the logic M 4 Coincidence matrix) matrix. Logic (4) h-4 t . Oll-AS92-DA4)01. Rev .01 Page 40 of 102
TABLE 7.2-$ PLANT PROTECTION SYSTEM FAILUkE MODES AND EITECTS ANALYSIS W. Name Failure Cause Sympenms and Local Method Inherent Eff&t Upos Remarks Mode Effnts Inchiding of Compenuting PPS and Dependent Failures Ddectina Provision Other Effects 2at-of4 Coincidence l#gie, RAS, FMEA Diagrams I,13,15 logic Component AB logic matriz for RAS will Periodic test. AC and BC coincidence Makes RAS logic a RAS logic can be matrix On failure; one set of not respond to a vahd R%T LO matrices remain selective 2-out-of-3 converted to I-out+f-3 (e g. AB contacts failed LEVEL condition. PPS will available to initiate coincidence. by tripping the bypassed matrix) c'esed. not initiate RAS for signals RAS. (Channel D channel or the logic can originating only from channels assumed bypassed). be converted to 2*t-A and B. of-3 by removing the bypass from the bypassed channel and bypassing the affected channel. 2-cut-of-4 Coincidence Logic, EFAS, FMEA Diagrams 1,13,15
- 56) 2/4 legic Multiple All 4 EFAS-l(2) trip paths Annunciating. Feedwater Conernt EFAS-l(2) actuation. Requires failure of two Coincidence matrix Off component open. Spuricus actuation of EFAS-1(2) alarm. System will compensate parallel, redundant Logic for: (e g. AB failures. EFAS-1(2) occurs. for excess feedwater. components in the logic a EFAS-1 matrix) metrix.
(129) or EFAS-2 (125) Logic Component AB logic matrix for EFAS-1(2) Periodic test. AC and BC coincidence Makes EFAS-l(2) logic EFAS-1(2) logic can be g matrix On failure; one set of will not respond to a valid matrices remain a selective 2-out-of-3 converted to 1-out-of-3 m (e.g. AB contacts failed condition. PPS will not initiate available to initiate coincidence, by tripping the b3Tassed matrix) closed. EFAS-1(2) for signals EFAS-l(2). (Channel channel or the logic con , originating only from channels D assumed bypassed). be converted to 2-out- M A and B. of-3 by removing the bypass from the g bypassed channel and 3 bypassing the affected O channel W (4 A t D Oll-AS92-DA-001,Rev .01 Page 41 of 102
,. ~
~ -
TABLE 7.2-5 PLANT PROTECTION SYSTEh! FAILURE MODES AND EFFECTS ANALYSIS No. Name Failure Cause Symptoms and lual Method inhesent Effat Upon Remarks Mode Effwts including of Compmsating PPS and Depmdent Failures Detation Provision Other Effects 2-out ef-4 Coincidence Logic Circuit, CSAS, RAS,EFAS, AB (Typical), FMEA Diagrams 13,15,16
- 57) lxgic N.O. Welded, stuck Same as Item 53), Item 55), or Same es item 53), Same as liem 53). Irem Same as Item 53), item 2/4 Coincident logic Matrit Relay contact fails contact. Item 56) Logic on fault. Item 55), or item 56) 55), or Item 56) legic 55), or item 56) Logic matrices use Form C Contact closed /N C. BCP LED will not light. Logic On fault. On fault. On fault, contacts.
contact fails CSAS epen Al7-1 or B17-1 N.O. Welded, stuck The AB matrix is half tripped. Periodic test. 2+ut-of-3 trip Makes affected ESFAS RAS contact fails contact. If complementary bistable trips, coincidence (4th function logic a Al8-1 or open/N C. the associated ESFAS function channel bypassed). selective I-out-of-3. BIS-1 contact fails will occur via all four trip Matrix half trip. (4th channel bypassed) closed paths. BCP LED will be lit EFAS-1 continuosly. A19-1 or B19-1 N.O. Deterioration of The AB matrix is half tripped. Troubleshooting. 2mt-of-3 trip Makes affected ESFAS PPS testing will not EFAS-2 contact fails contact. If complementary histable trips, This fault will not be coincidence (4th function logic a detect this fault as the A20-1 or open - high the associated ESFAS function detected until the channel bypassed). selective 1+ut+f-3. N.C. contact used fiw B20-1 resistance. will occur via all four trip ESFAS funionis Matrix half trip. (4th channel bypassed) the BCP LED will still paths. inadvertently actuated function. by tripping the complemerrary bistable ind vidually.
- 58) legic Contact Welded or stuck The AB logic matrix is not Periodic test. ESFAS trip conditions Makes logic for Affected ESFAS logic @
Matrix Relay shorts contact. Bypass responsive to a concurrent trip of the A and B channel sensed in the A&C channels or the B&C affected ESFAS function a seleoive 2-can be converted to l-out+f-3 by tripping the Y Contact bistables. channels can still CSAS initiate the affected out-of-3 coincidence. bypassed channel or trip logic can be converted d O AXK17-1 or BXK17-1 ESFAS function via the to 2-out-of-3 by O RAS AC or BC matrices. removing the bypass W AXKl8-1 or (Channel D assumed bypsssed). from the bypassed channel and bypassing d F.-a BXKl8-1 EFAS-1 the affected channel. AXKl9-1 or BXKl9-1 EFAS-2 % O AXK20-1 or BXK20-1 k v Oll- AS92-D A4)01, Rev. 01 Page 42 cf 102
m , TABLE 7.2-5 PLANT PROTECTIt)N SYSTEM FAII URE MODES AND EFTECTS ANALYSIS No. Name Failure Cauw Symptoms and Isal Method Inhermt Effwt Upna Mode Resnarks Effwts including of Com pensating PPS and Dependent Failures Detection Provision Other Effects 2-out-of4 Coincidence logic Circuit, CS AS.R AS,FFAS, AB (Typical) FMEA Diagrams 13,15,16 Contact Deterioratien of It is not possible to bypass the Periodic test. Within a coincidence During testing, makes No effect when channel opens contact, stuck contact of associated charmel A matrix, both channel affected ESFAS logic a is unhypassed. contact. or B bistable in one of three contacts fc a given trip selective I-cut-of-3. For bypass relay coil matrices. During PPS testing, are required to open to If coincident channel is faults see Item 30), Trip the AB matrix will be half icitiate an ESFAS tripped, testing will Channel Bypass faults. tripped when the affected function. [ cause the affected bistable is tripped. I function to actuate. 2 eut-of-4 Coincidence logic Circuit, CIAS,CCAS/SI AS, AB (Typical) FMEA Diagrams 13,15,16
- 59) Logic N.O. Welded or stuck Same as item 51) or item 52) Same as Item 51) or Same as Item 51) or Ssme as Irem 51) or 2/4 Coincident logic Matrix Relay contact fails contact. Logic On fault. BCP LFD will item 52) Logic on Item 52) Logic on Item 52) Logic On Con'act close/N.C. matrices use Form C not light. fault. fault. fault.
fails open contacts. CCAS/S!AS A6-9 or ' B6-9 N.O. Welded er stuck The AB matrix is half tripped. Periodic test. 2-out+f-3 trip Makes affected ESFAS A16-1 or contact fails contact. If complementary bistable trips, coincidence (4th function logic a B16-1 epen/N.C. the associated ESFAS function channel bypassed). selective 1-out-of-3. contact fails will occur via all four trip Matrix ha!f trip. (4th channel bypassed) CIAS ckwed paths. BCP LED will be lit 4 A16-1 or continuously. B16-1 N.O. Deterioration of The AB matrix is half tripped. Troubleshooting. 2-out-of-3 trip Makes effected ESFAS PPS testing will not contact fails contact. If complementary bistable trips, This fault will not be coincidence (4th function logic a detect this fault as the g open - high the associated ESFAS function detected until the channel bypassed). resistance will occur via all four trip ESFAS function is selective l<mt-of-3. N.C. contact used for W paths. inadvertently actuated Matrix balf trip. (4th channel bypassed) the BCP LED will still function. gs by tripping the M complementary CD bistable individually. O g I O pa n, b T 011-AS92-DA4)01, Rev. 01 Page 43 of 102
j n L TABLE 7.2-5 O_ PLANT PROTECTION SYSTEM FAILURE MODES AND EFFECTS ANALYSIS I No. Name Failure Cause Symptoms and Inal Method Inherent EITat Upon Ranarks ! Mode Effats induding of Compemating PPS and Dependent Failures Detection Provision y Other EITects 2.out+f-4 Coincidence Logie Circuit. CIAS,CCAS/SIAS, AB (Typical) FMEA Disgrams 13,15,16
- 60) legic Contact Welded or stuck The AB logic matrix is not Periodic test. ESFAS trip conditions Makes logic for Affected ESFAS logic '
Matrix Relay shoits contact responsive to a concurrent trip sensed in the A&C atTected ESFAS can be converted to l-Bypass of the A and B channe! channels or the B&C function a selective 2- out+f-3 by tripping the Contact histables. channels can still out+f-3 coincidence. bypassed channel or trip initiate the affected logic can be converted AXK6-9 or ESFAS function via the to 2-cut <>f-3 by BXK49 AC or BC matrices. removing the bypass (Channel D assumed from the bypassed AXKl6-1 er bypassed). channel and bypassing BXK16-1 the affected channel. Contact Deterioration of it is not possible to bypass the Periodic test. Within a coincidence Durhg testing, makes No effect when channel opens contact, stuck contact of associated channel A matrix, both channel affected ESFAS logic a is unbypassed, contact. or B bistable in one of three contacts for a given trip selective 1-out-of-3. For bypass relay coil matrices. During PPS testing, are required to open to If coincident channel is faults see item 30). Trip , the AB metrix will be half initiate an ESFAS tripped, testing will Channel Bypass faults. tripped when the afTected function. cause the effected bistable is tripped. function (s) to actuate.
- 61) LO PZR legic Off Multirle The LO PZR FRESS/HI CONT PRESS /Ill component failures PRESS OR function consists of CONT a series connection of N.O.
PRESS contacts from the LO PZR OR Function PRESS and HI CONT PRESS (15) Component failure bistables. See items 59) and Logic On 60) for failure modes and etTects for these contacts. T CD.
'a P0 O
O CD I O W 0) Oll- AS92.DA 4X)l, Rev. 01 Page 44 cf l02
T ABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE h! ODES AND EITECTS ANALYSIS No. Name Failure Cause Symgdoms and Local Method Inherent EfTwt Upon Remaris Mode Effats including of Compensating PPS and Dependent Failures Detwtion Provision Other Effects 2 cst-of-4 Coincidence logic Circuit. MSIS, AB (Typical) FMEA DiaFrams 13,15
- 62) Irgic N.O. Welded or stuck Same as !!em 54), MSIS Legic Same as item 54) Same as Item 54) Same as item 54) 2/4 Coincident logic Matdx Relay contact fails contact. Matrix on fault. BCP LED matrices use Form C Conract close/N.C. will not light. contacts.
fails open All-9 er Bf1-9 N.O. Welded or stuck The AB matrix is half tripped. Periodic test. 2-out+f-3 trip Makes MSIS logic for Al2-9 or centact fails contact. If complementary bistable trips, coincidence (4th affected SG e selective B12-9 open/N _C. MSIS will actuate via all four channel bypassed). I-out-of-3. (4th channel contact fails trip paths. BCP LED will be lit Matrix half trip. bypassed) closed continuously. N.O. Deverioration of The AB matrix is half tripped. Troubleshnoting. 2-out-of-3 trip Makes MSIS logic for PPS testing will not contact fails contact. If complementary bistable trips, This fault will not be coincidence (4th a!Tected SG e selective detect this fault as the . epen - high MSIS will actuate via all four detected until the channel bypassed). 1-out+f-3. (4th channel N.C. contact used for resistance trip paths. MSIS function is Matrix half trip. bypassed) the BCP LED will still madvertently actuated function. by tripping the complementary histable individually.
- 63) Logic Contact Welded or stuck The AB logic matrix is not Periodic test. SG-1(2) LO PRESS Makes MSIS logic for MSIS logic can be Matrix shorts contact. responsive to a concurrent trip sensed in the A&C the affected SG a converted to 1-out-of-3 Bypass of the A and B channel channels or the B&C selective 2-out-of-3 by tripping the bypassed Relay histables. channels can still coincidence. channel or trip logic can O Contact actuate MSIS via the be convened to 2-out- Y AXKBil-9 AC or BC matrices, of-3 by rernoving the %
or (Channel D assumed bypassed). bypass from the bypassed channel and d O BXKBIl-9 bypassing the effected O channel. W AXKB12-9 or d w BXKB12-9 Concact Deterioration of It is not possible to bypass the Periodic test. Within a coincidence During testing, makes No effect when channel epens contact, stuck contact of associated channel A matrix, both channel MSIS logic a selective is unhypassed. contact. or B bistable in one of three contacts for a given trip 1 -outw>f-3. For bypass relay coil matrices. During PPS testing, are required to open to if coincident channel is faults see Item 30), Trip the AB matrix will be half actuate MSIS. tripped, testing will Channel Bypass faults. M tripped when the affected bistable is tripped. cause MSIS to actuate. $ Y 011-AS92-DA4X)l Rev. 01 Page 45 of 102 %
m
-) J s% /N G
4 i TABLE 7.2-5 PLANT PROTECTION SYSTEnt FAILURE 510 DES AND EFFECTS ANALYSIS No. Name Failure Cauw Symptoms and local Alethod Inherent Effect Upon Remarks blode Eff'ects Including of Compemating PPS and Dependent Failures Detwtion Provision Other Effats 2mut+f-4 Coincidence Logic Circuit, klSIS, AB (Typical) Th1EA Diagrams I,13
- 64) SG-1/SG-2 Lngic Off hlultiple The SG-l'SG-2 LO PRESS OR LO PRESS component function consists of a series OR function failures. connection of N.O. contacts-(33) from the SG-1 and SG-2 LO PRESS bistables. See Items
- 62) and 63) for failure modes Logic On Component and effects for these contacts.
failure. l 2 -out +f-4 Coincidence Logic Circuit, CSAS, FFAS, hlSIS, CIAS, CCAS/SIAS, AB (Typical) FhfEA Diagrams 13,15,16
- 65) Logic On Transistor short, histrix relay will not deenergize Periodic test. Trip paths operate a hiskes ESFAS The matrix relays in the hiatris Relay emmitter to when A & B channels trip. selective 2mut-ef4 actuation logic a other 2 unbypassed Drivers co!!ector. One ESFAS trip rath will not ESFAS actuation logic selective 2-out-of-3 trip matrices are unaffected.
(Transistors deenergize when a trip occurs circuit. paths. A trip in either of these and in only the A & B channels. will cause a trip in all
- associated four trip paths.
conyonent: 4th channel bypassed. driving AB One of the four matrix relays ESFAS function will matrix relay Off Trsnsistor junction will be deenergized causing the Annuneisting. Trip paths operate a hiskes ESFAS still actuate on 2-out-of-coils) open. associated trip rath to Trip path actuation selective 2-cutmf4 actuation logic a 3 coincidence for any deenergize. alarm. ESFAS actuation h , selective 1-outmf-3 trip parameter. Periodic test. circuit. paths.
- 66) Lcgic Open coil Sustained Same as open relay driver, itern histrix g
overvoltage. Relays 65). W CSAS hiechanical break in coil winding. ga 3 AB-1,2,3,4 M RAS O 4 AB-1,2,3,4 Shorted coil Insulation The shorted coil may cause the O EFAS-1 g breakdown. relay driver to fail open or 1 7AB-I,2,3,4 short. If the driver fails open, O EFAS-2 the symptoms will be the same W 8 A B- 1,2,3,4 as the open cod fault. If the htSIS driver fails short, the power 5 AB-I ,2,3,4 supply will be shorted CIAS producing the same symptoms
! AB-1,2,3,4 as loss of the power supply See CCASISIAS o
Item 164). 2 A B- 1,2,3,4 g Ol l-A592-DA-001, Rev. O f Page 46 of 102
-w i ) L/ _
TABLE 7.2-5 PLANT PROTECTION SYSTEM - FAILURE hlODES AND EFTECTS ANALYSIS No. Name Failure Cause Symptoms and laal Method Inherent Effert Upon Remarks Mode Effects Inrluding of Compensating PPS and j Dependent Failures Detectiem Provision Other EITects 2 +ut+f-4 Coincidence Logic, CEA WithdrawI Pmhibit (CWP), FhlEA Diagram 1
- 67) Core l#F ic Muhiple CPC CWP function is Periodic test. Loss of CPC CWP Either the logic on or Protection matrix On component inoperative. function. logic off fault requires Calculator failures, failure of two parallel, CWP 2/4 CWP function is not redundant componente Coincidence required for plant in the 2/4 logic met:ix.
Logic (121) safety. Logic hiultirle CWP occurs. Inability to raise Annunciating. Actuation of CWP. matrix Off component CEAs in any nnfe other than CWP alarm. failures. Manual Individual.
- 68) 111 PZR logic hfultiple 111 PZR PRESS CWP function Periodic test. Loss of HI PZR Either the logic on or PRESS matrix On component is inoperative. PRESS CWP function. logic off fault requires CWP 2/4 failures.
failure of two parallel, Coincidence CWP function is not redundant components Logic (150) required for plant in the 2/4 logic matrix. safety. logic Multiple CWP occurs. Inability to raise Annunciating. Actuation of CWP. matrix Off component CEAs in any mmfe other than CWP alarm-failures. Manual Individual.
- 69) CWPOR The OR function for CWP Function consists of a series connection (151) of the CPC CWP 2/4 relay matrix and the HI PZR PRESS g CWP 2/4 relay matrix. See g e
items 67) and 68) for failure e nnks ar4 effecta for these TO matrices. O O O) 1 O 6- *
'ft b
~P r
W N I 011-AS92-D A@l, Rev. 01 Page 47 of 102
TABLE 7.2-5 PLANT PROTECTION SYSIT.51 FAILURE MODES AND EFTICTS ANALYSIS No. Name Failure Cause Symptoms and Local M Hhod Inherent Effect Upon Remarks Mode Effwts Including of Compensating PPS and Depemlent Failures Detection Provision Other Effects I cut +f4 Coincidence Logic, PPS Alarms FhlEA Diagram 1
- 70) Trip Alarm (114), Pre-trip Alarm (115),(113) and Plant OfY Relay coil or Trip, pre-trip, or plant Audible end visual None.
Computer contact failure, computer irput activated. PPS alarm in control (117),(116) Relay driver room. Comparisen for: failure. with other plant REFUEL indications. TANK LO LEVEL (3), 50-2(l) LO PRESS (31)(46), On Relay contact Loss of ela m signal for a Periodic test. Redurdant channels. Makes alarm logic l-111-111 failure. Relay single channel. If protective CONT out-of-2 (4th channel driver failure. action occurs, alarm will be bypassed). PRESS (8) generated via redundant No effect on PPS logic. til CONT channels. PRESS (14), (25). 50-2 > SG-1 PRESS (40), @ SG-I > SG-2 PRESS (49), SG-2(1) fil
- LVL IO (136),(137). O O
S0-2(1) LO @ LVL l (53).(57), O b-6 LO PZk PRESS (63), til PZR PR ESS (66), til LIN PWR G3), HI LOG 4 PWR 66), Ol l-AS92-DA4101. Rev. 01 Page 48 cf 102 .. _ - _ _ _ _ _ _ _ - - _ - _ _ _ _ _ - _ _ _ _ _ _ - - - _ _ _ _ _ - _ _ - _ . . _ . - - _ - - - - _ _ ._ _ -. __ _ . -._ _ , ~ _ _ - _ _ _ _ _ _ . _ _ _ . _ . -.
pm . t l
)
( TABLE 7.2-5 i PLANT PROTECTION SYSMt l FAILURE hlODES AND EFITCTS ANALYSIS I i No. Name Failure Cause Symptoms and lecal Blethod Inherent Effwt Upon Remarks Mode Effwts including of Campensating PPS and Dependent Failures Detation Provision Other Effects 1 -out+f-4 Coincidence legic, PPS Alarms FMEA Diagram 1 ! LO DNBR Item 70) , (93), con't. l til LPD (97) l Trip Path, RPS, Channel I (Typica!), FM EA DinFram 14
- 71) Relay Shorted Welded or stuck A trip of the logic matns Periodic test. Trip raths operate a Makes reactor trip All four trip paths will Contact contact. associated with the failed selective 2-out+f4 circuit logic a selective deenergize if either of 6AB-1 or contact will tent cause reactor trip circuit. 2+ut+f-3 for the the other 2 unhypassed 6BC-1 or deenergization of the affected affected matrix. For 2/4 coincidence 6I4D-1 or trip rath. other matrices, the trip matrices trip. (4th 6AC-1 or paths remain selective channel assumed 6CD-l or 2-outef4. bypassed).
6AD-1 Open Deterioration of One of the four RPS trip paths Annunciating. Trip raths operate a Makes reactor trip 2-out-of-3 coincidence contact, stuck deenergize. RPS actuatien slarm. selective 2 cut +f-4 circuit logic a selective of the appropriate contact. reactor trip circuit. 1-out-of-3 or any 2+ut- histables is still required of-3 trip paths. to produce a reactor trip. (4th channel bypassed). (O CA)
- 72) Either Vital Bus Circuit Open, either or both Deterioration of contact, stuck Relay K-1 deenergizes which will cause one pair of UV coils Annunciating.
RPS actuation alarm. CEDM power supplied through selective 2-out-Makes reactor trip circuit logic a selective 2-out+f-3 coincidence of the appropriate ha Breaker contacts contact. to deenergize and one pair of shunt trip coils to energize. PPS status panel. PPS ROM. of4 reactor trip circuit. 1-outef-3 or any 2-out-of-3 trip paths. bistables is still required to produce a reactor h O 7his causes one parallel pair of trip. (4th channel (A) reactor trip breakers to open, bypassed). I O Short both Welded contacts. The circuit breaker will not Periodic test. No effect. , centacts mechanical failure. open should a fault occur in the AC portion of the trip path. Would cause associated vital bus AC power distribution breaker to open. n Welded contact Short one None. No effect. I contact 011-AS92-DA-00 I, Rev. 01 Page 49 of 102
/m r"N i ,
TABLE 7.2-5 PLANT PROTECTION SYSTEnt FAILURE MODES AND EFTECTS ANALYSIS No. Name Failure Came Symptoms and Inral Methmt Inherent Effat Upon Remarks Mode EITats including of Compmsating PPS and Dependent FaiHres Detection Provision Other Effects Trip Path, R PS, Channel I (Typical). FMEA Diagram 14
- 73) Resistor 2K Open Overvoltage. The Bistable Control Panet Periodic test. No effect upon the Indication only.
ohms environmental (BCP) sill fail to indicate the functional operation of RI er R3 effects. opening of one of the solid state the system. relays in the RPS trip path. R2 or R4 Decrease in Overvoltage. Indicator may be brighter than There are two equal No efTect upon the Indication only. resistance envirenmental usual. value resistors in the fbnctional operation of effects. circuit. The operating the system. range of the indicator is such that it will operate indefinitely even with one of the resistors shorted out. Increase in Overvoltage, Indicator sill be dimmer than Periodic test. No effect upon the Indication only, resistance environmental usual. functional operation of efTects. the system.
- 74) Fuses Open Transient Trip path deenergizes. Annunciating. Trip Paths operate a Males reactor trip 2eut+f-3 coincidence overturrent RPS actuation alarm. selective 2-out+f-4 circuit logic a selective of the appropriate condition.
g PPS status panel. reactor trip circuit. 1-out-of-3 or any 2wt- bistables is still required e PPS ROM. of-3 trip paths. to produce a reactor trip. (4th channel j fg bypassal). O O
- 75) SSR 3 or input open Voltage transient. Output of SSR will open circuit W SSR 4 and cause same effects as item 72), Circuit Breaker Open. h N
trput short Voltage transient. The fbses in the trip path will open producing the effects described for item 74), open fuse. g It is possilde the short could momentarily load the trip path h power supply enough to cause 7 other PPS trip paths using thst D power supply to deenergize. D Oll- AS92-D A401, Rev. 01 Page 50 of 102
( / , s \. / ,. TABLE 7.2-5 PLANT PROTECTION SYSTEh! FAILURE MODES AND EF11 CTS ANALYSIS No. Name Failure Cause Symptoms and lxal Method inherent Effat Upon Researks Mode Effnts including of Compensating PPS and Dependent Failures Detection Provisism Other Effats Trip Path, R PS, Channel I (Typical), l'M EA Diagram 14 SSR 3 or Outut Voltage transient One side of the current circuit Periodic test. Dere are two SSRa in No effect on functional SSR 4 short overload. to trip relay K-1 mill nit the circuit. Either one operation of the (con't) interrupt when the trip path can open the circuit system. trips. Will not prevent trip that provides a tnp to relay K-1 from functioning the selective 2wt-of4 properly, reactor trip circuit. Output open Voltage transient Relay K-1 deenergizes which Annunciating. CEDM poser supplied Makes reactor trip 2+ut-of-3 coincidence overload, will cause one pair of UV coils RPS actuation alarm. through selective 2wt- circuit logic a selective of the appropriate to deenergize and one pair of PPS status panel. of-4 reactor trip circuit. I-out+f-3 or any 2-cut- bistables is still required shunt trip coils to energize. PPS ROM. of 3 trip paths, to produce a reactor his causes one parallel pair of trip. (4th channel reactor trip breakers to open. bypassed). I
- 76) 250 ohm Decrease in hervoltage, None. Bench check. Dere are two equal No effect on functional I Resistor R5 resistance ei vironmental resistors in the series operationof the ,l or R6 effects. circuit. The operating system.
range of the SSR is such that it will operste indefinitely even with one of the resistors shorted. (D Open Overvoltage, environmental De PPS status panel will indicate that the trip path is Periodic test. No effect on functional operation of the Indication only. Y
,0 effecta. deenergized even when it is not. system.
f O Increase in Overvoltage, Dere will be no syrnptoms O resistance environmental until the resistor has increased (A) effects in value to about 2 K rams. 1 Above this value, the efTects could be the same as those for an open resistor, above.
$(4 T
eN Ol l-A592-DA@l, Rev. Ol Page 51 of 102
TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFTECTS ANALYSIS No. Name Failure Cause Symptoms and Imral Method Inhermt Effect Upon Remarks Mode Effects including of Compmsating PPS and Depmdent FaDures Detection P mision Other Effects Trip Path, RPS, Channel 1 (Typical), FMEA Diagram 14
- 77) SSR1 Output Voltage transient The PPS status panel will Peri +xfic test. No effect on functional Indication only.
Renute open/ input overload. indicate that the trip path is operation of the Indication open deenergized even when it is not. system. Input short Voltage transient. SSR output will probably open Current limiting circuit (see effect for output resistors R5 and R6 open). R5 and R6 may limit current sufficiently to preclude blowing the trip path power supply fuses. If fuse does blow, effects of item 74) apply. Output Voltage transient. The PPS status panel mill sut Periodic test. No effect on functional Indication only. short indicate a trip of the trip rath , operation of the channel. system.
- 79) 250 ohm Decrease in Overvoltage, No symptoms Bench check. 'there are two equal Resistor R7 resistance environmental resistors in the series or R8 effects. circuit. The operating range of the SSR is such that it will operate W indefmitely even with Cd one of the resistors shorted.
hs IV open overvoltage. The actuation reset indicator Periodic test. No effect on functional Indication only. O environmental will be flashing when the PPS operation of the O effects. y in in the test nuwie. Erroneous system. 1 indication of trip path O deenergizat'en. Increase in Overvoltage, There will be no symptoms resistance erwironmental until the resirdr has increased effects. in value to about 2 K chms. Above this value, the effects could be the same as those for N an open resistor, above. b T D N 011-A592.DA@l, Rev. 01 Page 52 of 102
\ % \s TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFFECTS ANALYSIS No. Narne Failure Cause Sympenms and Local Method Inhenvnt Effwt Upnn Remarks Mode F.fTwts including of Compensating FPS and Dependent Failures Dete< tion Presision Other Effects Trip Path, R PS, Channel 1 (Typical), FMEA Diagram 14
- 79) SSR 2 Output Vohage transient The actuation reset indicator Periodic test. No effect on functional Indication only.
Test Reset open, input overload. will be flashing when the PPS operation of the Indicator open is in the test nuxle. Erroneous system. indication of trip path deenergization. Input short Voltage transient. SSR output will probably open Current limiting No effect on functional Indication only. circuit (see effect for output resistors R7 and RS. operation of the open). R7 and R8 may limit system. current sufficiently to preclude blowing the trip path power supply fuses. If fuse does blow, effects of item 74) apply. Output Voltage transient An RPS trip in the affected Periodic test. No effect on functional Indication only. short overload. channel will not cause the PPS , operation of the actuation reset indicator to flash system. when the test mode is selected. (O l CO e
'M e 70 o
O CA) - 1 O N w r% I t D LM Oll-AS92-DA MI, Rev. 01 Page 53 of 102 l
s d TABLE 7.2-5 PLANT PROTECTION SYSTEM FAllt!RE MODES AND EITECTS ANALYSIS No. Name Failure Cause S3 mptorns and Isal Methnd inherent EITnt Upon Remarks Mode EfTats Including of Comp mating PPS and Depmdent Failures Detntion Prsvision Other EfTwts Trip rath. Engineered Safety Features CIAS-RAS-MSIS- (fypical) FMEA Diagram No.15 EFAS
- 80) Relay Shorted Welded contact A trip of the logic matrix with Periodic PPS testing The other three trip One trip path fa All four trip paths will Contact the failed component will not paths are not affected. inoperative for 'ast deenergize if either of ,
AB contact cause de<nergization of the trip In the affected trip path pt.ticular logic matriz. the other two (typical) path with the shorted contact. any of the other The other two unbypassed 2/4 (FMEA unbypassed matrices unbypassed matrices coincidence matricies Diagram 13 will stil! de-energize will still de-energize all trip. (4th channel
& 15) the tnp path upon four trip paths upon assumed bypassed.)
CIAS-l AB-1 receipt of a bona-fide receipt of a bone-fide R AS-4 AB-l trip. tdp. MSIS-5 AB-l EFAS 7AB-1 EFAS 8 A B-1 O (J) e Open Deterioration of The trip path will be de- Trip is annunciated on The other three tnp Selective 2-out-of-4 Actuation still requires a contact energized the plant annunciator paths are not affected Actuation logic 2-out-of-3 coincidence o converts to 1 out+f-2 of the appropriate O (opposite leg) or any 2- bistables fA) out-of-3
- 81) Fuse Open Transient The trip path sill be de- Trip is annunciated The other three trip Selective 2-outef-4 Actuation still requires a overcurtent energized on the plant paths are not affected Actuation logic 2-out-of-3 coincidence condition annunciator converts to I out-of-2 of the oppropriate (opposite leg) or any 2- bistables nut-of-3 n,
h-T e 011-AS92-DA4'101, Rev. 01 Page 54 of 102
d' '
\/ (/
TABLE 7.2-5 PLANT PROTECTION SY.MEhl FAILURE htODES AND EFITCTS ANALYSIS No. Name Failure Cause Symptoms and Local 5fethod Inherent Effect Upon Resnarks hlode Effats Including of Compmsating PPS and Depmdent Failures Detwtion Provision Other Fifects Trip path. Engineered Safety Features CIAS-RAS-MSIS- (Typical) FMEA Diagram No.15 EFAS
- 82) Test SSR Output Ovedoad, voltage ne actuation reset indicator Periodic PPS testing Current limiting None Safety function of open. input transient sill be flashing when the PPS resistors R5 and R6 circuit not impaired.
epen. Input is in the test mode, indicating prevent malfunctioning short that a trip path has been de- of this convenent from energized affecting the functional operation of this circuit. Output Voltage transient ne actustion reset indicator on Periodic PPS testing None Safety function of short overload the PPS will not flash when the circuit not impaired. trip path with the faulty component is exercised.
- 83) Latching Output overload ne trip rath will be de- Trip is annunciated on The other three trip Selective 2-cut-of4 Actuation still requires a Circuit SSR open, input Voltage transient energized. the plant annunciator. paths are not affected. Actuation logic 2-out-of-3 coincidence (n/a for open. Input converta to 1-out-of-2 of the appropriate EFAS-1, short (opposite leg) or any 2- bistables.
EFAS-2) out-of 3. Output Voltage transient The trip circuit will not lock out Periodic PPS testing The trip circuit will not The Actuatio a circuits shorted Overload and will track the state of the remain in the tripped should not follow any trip path contact string de- condition but will fluctuating condition of energizing whenever one or follow the action of a single trip path e more of the contacts is open the series string of circuit. Under a trip and energizing when they are matrix relay contacts. condition with a channel M a!! closed. in bypass all four trip O paths will be de- O energized and three will be latched in that state. O The selective 2-out<>f4 >8 sctuation circuits will have three of their four contacts latched open with the fourth fluctuating between m l open and closed states. t 4N of I- AS92-DA40!, Rev. 01 Page 55 of 102
v u-TABLE 7.2-5 O l PLANT PROTECTION SYSTEM FAILURE MODES AND EFTECTS AN ALYSIS I No. Name Failure Cause Symptoms and Imal Method Inherent Effwt Ugen Resnarks Mode EITerts Including of Compmuting PPS and Dependent Failures Detection Prothian Other Effnts Trip path, Engineered Safety Features CI A S-RAS -MSIS- (Typical) FMEA Diagram No.15 EFAS C4) 250 ohm Open Environments! The trip path will be de- Trip is annunciated The other three trip Selective 2-out-of 4 Actuation still requires a resistor effects energized. on the plant paths are not affected. Actuation logic 2+utef-3 coincidence R t or R2 annunciator. converts to I-out+f-2 of the appropriate (latching ekt) (opposite leg) er any l bistables. (n/a for 2+ut-of-3. EF AS-1 EFAS-2) Decrease in Environmental No eymptoms Bench check Two equal resistors in None Safety function of resistance efTects the series circuit. He circuit is not impaired. operating range of the SSR is such that it is , std! within limits if one of the resistors is shorted, increase in Environmental here wi!! be no symptoms For resistance equal The other three trip For rnistance equal to Actuation still requires a resistance efTects until resistor has increased in to or greater than 2K paths are not affected. or greater then 2K 2-outef-3 coincidence value to about 2K OllMS. a trip is annunciated. OIIMS the Selective 2- of the appropriate Values exceeding that will out+f4 actuation logic bistables. cause prnMems similar to those converts to 1-out-of-2 (D listed for the failed open nwx!e. (opposite icg) or any 2- 00 out-of-3.
%e M
- 85) 250 ohm Decrease Environmental No symptoms Bench check Two equal resistors in None Safety function of O resistor in resistance efrects the series circuit. He O
R3 or R4 operating range of the circuit is not impaired. w 1 (indicator SSR is such that it in O ekt.) still within limite if one of the resistors is shorted. Open Mechanical failure The PPS status panel and PPS Periodic PPS testing None Safety function of remote nnjule wil! indicate a circuit is not impaired. l trip for the affected function. gn Oil-AS?2-DAU)l, Rev. 01 Page 56 of 102
-- - - - - - - - - - - - - - - ~
fx r p'
^k
__ ,. v . TABLE 7.2-5 PLANT PROIECTION SYSTEh! FAILURE MODES AND EITECTS ANALYSIS N o. Name Failure Cause Symptoms and Imal Method inherent Effect Upon Resnarks Mode Effects Including of Compmsating PPS and Defendent Failures Detwtion Provision Other Effwts Trip path, Engineeret rety Features CIAS-RAS-MSIS- (Typical) FMEA Diagram No.15 EFAS Increase in Environmental There will be no symptoms None Safety f5nction of resistance efTects until resistor has increased in circuit is not impaired. value to about 2K OHMS. Values exceeding that will cause problems simil.n to those lised for the failed g n mode.
- 86) 250 ohm Decrease in Environmental No symptoms Bench check Two equal resistors in None Safety function of resistor resistance effects the series circuit. He circuit not impaired.
R5 or R6 operating range of the (test ckt.) SSR is such that it is still within limits if one of the resinors is , shorted. Open Mechanical failure The actuation reset indicator Periodic PPS testing None , Safety function of will be flashing when the PPS circuit not impaired. is in the test mode indicating that a trip path has been de-energized. Increase in Envimamental There will be no symptoma None Safety function of @ resistance effects until resistor has incr=ased in g circuit not impaired. e value to about 2K OHMS. Values exceeding that will cause problems similar to those M O listed for the failed open mode. O M
$7) Indicator Output Voltage transient SSR open. Input The PPS status panel and PPS remore mndule will indicate a Periodic PPS testing None Safety function of circuit not impai ed.
h
>a open trip for the affected function.
D 3 D N l O! !-AS92-DA-001, Rev. 01 Page 57 of 102 l i .~
TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EITECTS ANALYSIS No. Name Failure Came Symptoms and Locci M Mhod Inhermt EfTect Upon Remarks M mie g Effects including of Com pmsating PPS and l Depmdent Failures Detwtion Providon Other Elints Tnp path, Engineered SaEty Features CI AS-R AS4tSIS- (Typical) FMEA Diagram No.15 EFAS 11 I Input feils Volta e transient ne PPS status panel and PPS Periodic PPS testing Resistors in the inpat of None Safety function of short renue module will indicate a the SSR limit the l' circuit not impaired, tnp for the affected function. current that the SSR may drew from the circuit should the input of the SSR shert. Output fails Voltage transient A bona fide trip for the fonction PerWie PPS testing None Safety function of short and cha m*I affected will not be circuit rW impaired. in tic- M on the PP' statua par te PP0 - nue r sic.e.
- 80) Rencre Open Mechanical '
will be de- Trip is annundated The other three trip Selective 2-out+f-4 Actuation still requires a Manual Trip Failure, e. 6e- on the plant paths are not affected. Actuation logic 2-out+f-3 coincidence Path PIB deterioration of computer. converts to 1-out+f-2 of the appropriate a (n/a for contact. (opposite leg) or any histables. RAS) 2-out-of-3. (Reference items 132.134,136
.and 135 for (D specific M PIBs).
ha short Mechanical failure ne tHp path cannot be Penmiie PPS testing ne other three trip The trip rath is Actuation still requires a manually tripped. or when attempting to paths are not effected. inoperative for that 2-cut-of-3 coincidence o manually trip. particular renne of the appropdate W manua' pushbutton and bistables. All four trip t1 actuationis dependent paths will still de-upon a selective 2-out- energize upon receipt of of the remaining three a bone-fide trip from p trip paths from their the matrix circuits. respective remote manual pushbu: tons. n I b T w at 011-AS92-D A4X)l, Rev. 01 Page 58 of 102
O '\ \ ( ), d .) TABLE 7.2-5 PLANT PROTECTION SYSTF31 FAILURE IntODES AND EFFECTS ANALYSIS No. Name Failure Cause Symptoms and lecal hiethod Inhermt Effwt Upon Remarks
$ fade EfTects Including of Compmsating PPS and Dependmt Failures DHection Provision Other Effects Trip path. Engi.W Safety Features CIAS-R AS41 SIS- (Typical) FMEA Diagram No.15 EFAS
- 89) Lakout Open htechanical failure, Once tripped, the affected trip Perimfic PPS testing The other three trip Once tripped, the trip Actuatkwt still requirra a Reset PtB deterioration of path cannot be rnanually reset. or when attemp6ng to paths are not affected. path cannot be 2cutef-3 coincidence (n/a fm contact reset a trip path manually reset, of the appropriate EFAS-1 Trip rath de- Selective 2eutef-4 bistables.
EFAS-2) energized remains Actuation hvic remains annunciated. 1-outef-2 (opposite leg) or any 2mt-of-3 after bistables have reser. Short htechanical failure ne trip circuit will not lock out Periodie PPS testing. De trip circuit will not ne Actuation circuits and will track the state of the remain in the tripped should not follow any trip path contact string de- condition but will fluctuating conditimt of , energizing shenever one or follow the action of the a single trip path more of the contacts is open series string of matrix circuit. Under a trip and energizing when they are relay contacts. condstion with a channel all closed. in bypass all four trip paths will be de-g energized and three si!! g be latched in that state. e ne selective 2-outef4 actuation circuits wi!! 10 have three of their four O contacts latched open with the fourth y' tluctuating between O open and closed states. H r% t b 4 011-AS92-DA-001, Rev. 01 Page 59 of 102 -
O O TABLE 7.2-5 PLANT PROTECTION SYSTFM Fall.URE MODES AND EETECTS ANALYSIS No. Name Failure Cause Symptoms and local Method Inkm Effect Upnn Resnarks Mode Effwts including of Compmsating PPS and Dependmt Failures Detwtion Provisiim Other Effats Trip rath Engineered Safety Features SI AS CCAS-CS AS (Typical) FMEA Diagram No.16
- 90) Relay Shorted Welded contact A trip of the logic matrix with Periodic PPS testing he other three trip One trip path is All four trip paths will contact the failed cornponent will not paths are not affected. inoperative for that deenergize if either of AB contact cause de-energization of the trip la the affected trip path particular logic matnx. the other two (typical) Path with the shorted contact. any of the other De other two unbypassed 2/4 (FMEA unbypasned matrices unbypassed matrices coincidence matricies diagram 13 mill still de+nergize ud! st'll de-energite a!! trip. (4th channel
& 16) the inp path upon four trip paths for the assumed bypassed).
SIAS/CCAS receipt of a bona-fide affected functions upon 2AB-1 trip. receipt of a bone-fide trip. Open Deterioration of The trip path will be de- Trip is annunciated. The other three trip Selective 2+ut-of-4 Actuation still requires a contact energized for SIAS and CCAS. paths are not affected. Actuation logic 2-outmf-3 coincidence The trip path for CS AS will be converts to I out-of-2 of the appropriate enabled but not tripped. (opposite leg) or any 2- bistables. outmf 3 for SIAS and CCAS. Affected trip D path of CSAS has a permissive signal. Z
'e
- 91) Relay Shorted Welded contact A trip of the logic matrix with Periodic PPS testing FO he other three trip One trip path is All four trip paths will contact the failed component s<ill not paths are not affected. inoperative for that deenergize if either of o
AB contact C cause de-energization of the trip in the affected trip path particular logic matrix. the other two CA) (typical) path with the shorted contact. any of the other ne other two unbypassed 214 (FMEA unbypassed matrices unbypassed matrices coincidence matricies p diagram 13 will still de4nergize will still desnergize all trip. (4th channel
& 16) tne trip path upon four trip paths for assumed bypassed).
CSAS receipt of a bons-fide CSAS upon receipt of a 3 AB-1 trip. bona-fide trip. Open Deterioration of For the effected CSAS trip path Periodic PPS testing. He other three trip No effect unless an Actuation still requires a On contact one of the two conditions for paths are not affected. SIAS trip is also 2mut-ef-3 coincidence g dunergizing will be present. present. If $1AS is of the appropriate p present Actuation logic bistables and the y for CSAS converts to l-outmf-2 presence of an SIAS D trip. (opposite leg) or any 2-E out-of-3. 011-AS92-D A-001. Rev. 01 Page 60 of 102
/"% A
{ !
% ~l TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFFECTS ANALYSIS No. Name Failure Cause Symptoms and Emcal Method Inherent Effect Upon Remarks Mode Effects Including of Couupensating PPS and Dependesit Failures Detection Prodsion Other Effects Trip path Engineered Safety Features SIAS-CCAS-CSAS (Typical) FMEA Diagram No.16
- 92) SIAS Open coil Spamined For the effected CSAS trip path Periodic PPS testing.
- The other three trip No effect unless a Actuation still requires a Auxiliary osc:vohage one of the two conditions for paths are not affected. CSAS trip is also 2+ut-of-3 coincidence Relay de-energizing will be present. present. If CSAS trip is of the appropriate (10) also present, a trip will bistables and the be present in the presence of an SIAS affected CSAs trip trip.
path. Shorted coit Deterioration of A shorted coil will cause the Trips are annunciated. The other three trip For SIAS and CCAS Actuation still requires a insulation fuse (s) supplying the SIAS and paths are not affected. the selective 2-outef-4 2-out-of-3 coincidence CCAS trip paths in the affected Actuation logic of the appropriate channel to open. This will converts to I-out-of-2 histables and the result in a trip in the $1AS and (opposite leg) or any 2- presence of an SIAS CCAS trip paths. For the out-of-3. If CSAS trip trip. , affected CSAS trip path one of is also present, a trip the two conditions for de- will be present in the energiring will be presera. affected CSAS trip path. g
- 93) SIAS Open Deterioration of For the affected CSAS trip path Periodic PPS testing. No effect unless a Actuation still requires a Auxiliaty contact Relay one of the two conditions for CSAS trip is also 2-out-of-3 coincidence W de-energizing will be present.
Comeet present. If CSAS trip is slao present, a trip will of the appropriate bistables and the hO be present in the presence of an SIAS O affected CSAS trip path trip. Shooted Welded conract "the CSAS trip path with the Periodic PPS testing. One CSAS trip path is O affected component will not Actuation still requires a W inoperative. Actuation 2-out-of-3 coincidence respond to a trip from the logic is dependent upon a of the appropriate matrix in which the faulty selective 2-out-of-the bistables and the component is located. remaining three trip presence of an SIAS paths for CSAS. trip.
$n A
T N 011-AS92- DA401, Rev. 01 Page 61 of 102
m
- s. -
o TABLE 7.2-5 PLANT PROTECTION SYSTE51 FAILURE MODES AND EFFECTS ANALYSIS Ns. Name Failure Cauw Symptants and laal hiethod Inherent Effect Upon Remarks Mode Effects Including of Compeatating PPS and Depmdent Failures Detwtion Provision Other Effats Trip path Engineered Safety Features SIASCCAS43AS (Typica!) FMEA Diagram No.16
- 94) Fuse open Transient ne trip path will be de-- Trip is annunciated. The other three trip Selective 2-outef4 Actuation still requires a overeurrent energized. paths are not affected. Actuation hvic 2eutef-3 coincidence condition converts to I outef-2 of the appropriate (opposite leg) or any 2- bistables, out<>f-3 for SIAS and CCAS. Affective trip path of CSAS has a permissive signal.
- 95) Test SSR Output Overload, voltage The actuation reset indicator Periodic PPS testing Current limiting None Safety function of open, input - transient will be flashing when the PPS resistors circuit ont impaired.
cren, input is in the test mode, indicating R5 and R6 or short that a trip path has been de- R11 and R12 or energized. R17 and RI8 prevent , malfunctioning of this cgment from affecting the functional operation of this circuit. O Output shorted Vohnge transient, The actuation reset indicator on the PPS mill not flash shen the Periodic PPS testing. None Safety function of circuit is not irnpaired. Y W overload trip path with the faufty component is exercised. hO O
- 96) latching Output Overload he trip path will be de- Trip is annuaciated. The other three trip Selective 2-out-of4 Actuation still requires a W circuit SSR opert, input voltage transient energized. paths are not affected. Actuation logic 2eutef-3 coincidence open, input converts to I-outef-2 of the appropriate M short (opposite leg) or any 2- bistables.
outer-3. G M (% h T 4 N 011-AS92-DA431, Rev. 01 Page 62 of 102
k / ( - L TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFFECTS ANALYSIS No. Name Failure Cause Symptonn and Isal Methnd Inherent Effect Upna Ranarks Mode Effects including of Compensating PPS and Dependent Failures Detection Provision Other Effects Trip rath Engineered Sefery Features SI AS CC AS-CS AS (Typical) FMEA Diagram No.16 Output he affected trip circuit will not Periodic PPS testing He other three trip He effected trip circuit he Actuation circuits shorted lock out and wi!! track the state paths are not affected. will not remain in the should not fo!!ow any of the trip path contact string tripped condition but fluctuating condition of de-energizing whenever one or will folkm the action a single trip path more of the contacts is open of the series string of circuit. Under a trip and energizing when they are matrix relay contacts condition with a channel all closed, for the effected in bypass all four trip function paths will be de-(SIAS.CCAS,or CS AS energired and three wi!! permissive). be latched in that state for the effected function.The selective 2-out-of4 actuation circuits will have three i of their four contacts latched open with the fourth fluctuating between open and closed states.
- 97) 250 ohm Open Mechanical failure The trip path containing the Trip is annunciated. The other three trip Selective 2mut-of4 Actuation still requires a resistor affected component will be de- paths are not affected. Actuation logic 2-out4f-3 coincidence (latching energized. converts to 1-cut-of-2 of the appropriate @
SSR) (opposite leg) or any 2- bistables. Rt or R2 or cut-of-3 'h R7or %O R8 or O R13 or W Rld t1 O b^ Decrease in Envirer. mental No sytnptoms Bench check Two equal resistors in None Safety function of resistance effects the series circuit. The circuit is rwt impaired.
, operating range of the
.."+' SSR is such that it is stilt within limits if one b of the resistors is I shorted, s
M Ol l-AS92-DA401, Rev. 01 U Page 63 of 102 ~. .
- - m (m) I \
x / V TABLE 7.2-5 PLANT PROTECTION SYSTEh! FAILURE A10 DES AND EFFECTS ANALYSIS Na. Narne Failure Cause Syn ptoms and local hiethod Inherent Effect Upon Remarks Mode Effects including of Com pmsating PPS and Depmdent Failures Detection Provision Other EITects Trip path Engineered Sefwy Features SIASCCAS-CSAS (Typical) FMEA Diagram No.16 increase in Environmental here will be no symptorns For resistance equal For resistance equal to Actuatioc still requires a resistance effects notil resistor has increased in to or greater than 2K or greater than 2K 24>ut-of-3 eincidence value to about 2K chms. Values OHMS a trip is OllMS the Selective 2- of the approprbte exceeding that will cause annunciated on the out-of-4 Actuation logic bistables. problems similar to those listed plant computer, converts to I-out-of-2 for the failed open mode. (opposite leg) or any 2-outsf-3.
- 98) 250 ohm Open Mechanical failure The actuation reset indicator Periodic PPS testing. None Safety function of resistor will be flashing when the f*PS circuit not impaired.
(test SSR) is in the test mode, indicating R5 or that a trip path has ten de-R6 or energized. Ril or R12 or R17 er RIS Decrease in Environmental No Symptoms Bench check There are two equal None Safety function of resistance etTects resistors in the series circuit not impaired. circuit. The operating range of the SSR is @ broad enough to CM tolerate a short in one of the resistors h e N Increase in Environmental There will be no symptoms None Safety function of resistance effects until resistor has increased in circuit not impaired. g value to about 2K ohms. Values 1 exceeding that will cause O problems similar to those listed for the failed open mode. da b 7 011-AS92-DA 001, Rev. 01 Page 64 of 102
n
+
q r%
)
TAB 117.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFFECTS ANALYSIS No , Name Failure Cause Syniptonn and Imal Method Inherent Effect Upon Rnnarks Mode Effwts includina of Compemating PPS and Dependent Failures Detec tion Prnvision Other Effnts Trip path Engineered Safety Features SIAS-CCAS-CSAS (Typical) I' MEA Diagram No.16 9% 250 ohm Oren Mechanical failure The PPS status panel and PPS Periodic PPS testing. None Safety function of resistor remote nwstule will indicate a circuit not impaired. (Iraficator trip for the effected function. SSR) R3 or R4 or R9 cc RIO or Rl5 or R16 Decrease in Emironmeres! No symptoms Bench check %ere are two equal None Safety fianction of resistance etYects resistors in the series circuit not impaired. circuit. De operating range of the SSR is brned enough to tolerate a short in one of the avsistors. Increase in Environmental There will be no symptoms None Safety function of resistence etTects until resistor has increased in circuit not impaired. value to about 2K ohms. Values exceeding that will cause g problems similar to thoee listed g e for the failed open mode. Ne 103 Imticator output VohsFe transient He PPS status panel and PPS Periodic PPS testing. tQ None Safety function of O SSR epen, input renwee module will indicate a circuit not impaired. O open trip for the effected function. @ l Input fails Voltage transient De PPS status panel and PPS Periodic PPS Testing Resistors in the input of None Safety function of O p short remote module will indicate a the SSR limit the circuit not impaired. trip for the affected function, current that the SSR may draw from the circuit should the input of tlw SSR short. u D M h T oil-AS92-dam t. Rev. 01 Page 65 of 102
, fm , - .
\' ) I ) i i v 'w/
TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE A10 DES AND EITECTS ANALYSIS No. Name Failury Cauw Symptoms and Local Mr4 hod inherent Effect Upon Remarks Mode Effats lacluding of Compemating PPS and Dependent Failures Detection Pruision Other Effects Trip path Engineered safety Features SIAS-CCASCSAS (Typical) FMEA Diagram No.16 Output fails Voltage transient A bona fide trip for the function Periodic PPS testing. None Safety function of and channel affected will not be circuit not impaired. indicated on the PPS status panel and the PPS remote module. 101 Remote Open Mechanical failure, De afYected trip path wi!! be Trip is annunciated. He other three trip Selective 2 cut-of-4 Actuation still requirea a Manual T6p deterioration of de-energized. paths are rwt effected. Actuation logic 2-out-of-3 coincidence Path PIB contact convens to 1-out+f-2 of the appropriate (Reference (cpposite leg) or any 2- histables. items out-of-3. 126,128, and 130 for specific P/Be) Short Mechanical failure ne tnp path canrut be Periodic PPS testing he other three trip he trip path is Actuation still requires a manuany tripped. or when attempting to paths are rut afTected. inopentive for that 2+ut+f-3 coincidence manually trip. particular remote of the appropriate manual pushbutton and bistables. actuation is dependent All four trip paths will upon a selective 2-out- still de+wrgize upon of the remaining three receipt of a bone-fide trip raths from their trip from the matrit (D respective rernote circuits. (A) manual pushbuttons. 102 Lockout Open Mechanical failure, it will not be possible to reset Periodic PPS testing e Once tripped, the trip Actuation still requires a TQ reset P/B deterioration of the effected trip path once it is or when attempt ng to path cannot be 2-out+f-3 coincidence cor: tact de-energized. reset the affected trip manually reset. of the appropriate path. g Actuation logic remains bistables, y Trip path de- I-cut-of-2 C) energized remains (opposite leg) or any 2-
- annuncisted. out-of-3 after bistables have reset.
e, b T-011-AS92-DA@l, Rev. 01 M Page 66 of 102
1-- TABLE 7.2-5 O - l PLANT PROTECTION SYSTEM FAILURE MODES AND EFFECTS ANALYSIS No. Name Failure Cause Symptoms and Local Method Inherent Effect Upon Resnarks Mode Effects Including of Compmsating PPS and Dependmt Failures Detection Provision Other Effects Trip rath Engineered Safety Features SI AS-CCAS-CS AS (Typical) FMEA Diagram No.16 Short Mechanical failure The affected trip circuit will not Penodic PPS testing, None The Actuation circuits remain in the tripped condition should not follow any but will ft41ow the action of the fluctuating condition of series string of rnatrix relay a single trip path contacts for the affected circuit. Under a trip function cr%on with a channel (SIAS,CCAS, or CSAS (with i . bypass all four trip permissive)). paths will be de-energized and three will be latched in that state for the afTected function. He selective 2mtof4 actuation circuits will have three of their four contacts latched open with the f wrth fhetuating between open and closed states. OJ s fG O O fa 1 O Fa D c s. (% h T M M 011- AS92-DA4X)l. Rev. 01 Page 67 of 102
T f' TABLE 7.2-5 PLANT PROTECTION SYSTEh1 FAILURE MODES AND EITECTS ANALYSIS No. Name Failure Cause Symptoms and Local Method Inhermt Effect Upon Remarks Mode EITnts including of Compmsating PPS and Depmdent Failures Detection Pruvision Other EITwts Actuators, RPS Trip (Path No.1-Typica!) FMEA Diagrams No.1
& 17 103 CEA Drop One CEA CEA mechanical CEA position Logic becomes I-mt-(111) fails to drop failure indicahon of-3.
Inadvertent CRDM coil failure Possible change in calculated Annunciated. CEA Reduced operating CEA drop DNBR and local power density deviation alarm. CEA margins. margins . position indication, drtyped CEA indicator. Inadvertent CEDMCS logic Possible change in calculated CEA position Reduced operating drop of four element failure DNBR and local power density indication, dropped margins. symmetric margins. CEA indicator. CEAs 104 Open No single One CEDM MG A single failure of MG set or Plant annunciation Redundant MG set. None May initiate reactor CEDM failure set, Trip circuit TCB will not initiate or prevent and status indicator TCB's and trip paths. trip, turbine trip; or Power modes. breaker or trip a reactor trip during routine lights for circuit . bkwk steam bypass Supply (108) path actuates or operations. A single failure of breakers and phase (if Teve is low). If fails to actuate. DSS contactoror DSS bypass current. single failure occurs q) b<eaker will not irutiste or during testing. (A) prevent a reactor trip during routme operatens. % a FO 105 CEDM Bus Off Shcrted or opened Reduces turbine trip to 1/3 Annunciated. Logic becomes 1-out-Under. UV relay coil. logic and steam bypass block to UV indicator lights, of-3. voltage I/3 logic. g 3 (107) C) 6- a On Mechanically Turbine trip and steam bypass Not annunciated. Logic becomes 2-out-jammed relay. logic becomes 2/3 logic. Periodic testing. of-3. Off Shorted or opened Initiates turbine trip and stearn Plant reactor trip Steam b> Tass blocked Q D-UV relay coil bypass block, annunciator and UV only if T(ave) is low. C4 while testing indicator lights. another UV relay - b i N C4 I i 011-AS92-DA401, Rev. 01 Page 68 of 102
/*% r TABLE 7.2-5 PLANT PROTECTION SYSTEnt FAILURE MODES AND EFFICTS ANALYSIS No. Name Failure Cause Symptoms and Local Method Inhermt Effat Upon Remarks Mode Effats including of Compmsating PPS and Dependent Failures Detwtion Provision Other Effects Actuators RPS Trip (Path No.1-Typical) FMEA Diagrams No.1
& 17 106 Manual Trip No mp Mechanically Failure to open the two Not annunciated. There are two sets of Actuation logic Redundant pair of (105) output jammed suitch associated reactor trip circuit Periodic testing. two pushbuttons. converts to selective manust trip pushbuttons breakers (TCBs) when actuated. 2-outef-3 for manual available.
trip pushbuttons. Trip outpur Wiring open or ne two associated TCBs open. Annunciated, ne other three trip Actuation logic A channelin bypass has shorted. Breaker indication paths are not effected. converts to 1-out-of-2 no effect on the manual lights and phase (redundard pair of trip pushbuttons. current lights. manual trip pushbuttons) or any 2-out +f-3. 107 Actuation Cod open Broken wire. One trip circuit breaker trens Annunciated. Redundant trip paths Both selective 2-out-of- With a channelin Relay (K1- sustained in each of the two selective 2- Bresker indication 4 Actuationlogics bypass actuation still K4) overvoltage out of-4 Actuation circuits. lights and phase convert to I-out-of-2 requires a 2-out+f-3 (FMEA current monitors. (ryposite leg) or any 2- coincidence of the diagram No. out-of-3. appropriate bistables. 14) Coil short Deterioration of One trip circuit breaker opens Annunciated. Red.mdant trip raths Both selective 2-out-of- With a channelin insulation. in each of the two selective 2- Breaker indication 4 Actuationlogics bypass actuation still out-of-4 Actuation circuits. lights and phase convert to 1-out-of-2 requires a 2-out-of-3 current monitors. g (opposite leg) or any 2- coincidenceof the 'e out-of-3. appropnate bistables. , Output Broken wire, One trip circuit breaker opens Annunciated. Redundant trip paths The affected selective m contact to contact failure in the affected selective 2-out-With a channelin O Breaker indication 2-out-of-4 Actuation bypass actuation sti!I O under- of-4 Actuation circuit. lights and phase logic converts to 1-out- requires a 2-out-of-3 voltage trip current monitors. of-2 coincidenceof the coil open. (opposite leg) or anY *FPropriate bistables. o D-d 2-out-of-3. Output Contact failure. One trip circuit breaker opens Annunciated. Redundant trip paths The affected selective With a channelin contact to ahoned contact in the effected selective 2-out- Breaker indication 2-nut-of-4 Actuation bypass actuation still shunt trip of-4 Actuation circuit. lights and phase logic converts to I-out- requires a 2-cut-of-3 c61 ch> sed current monitors. g of-2 coincidenceof the (opposite leg) or any appropriate bistables. % 2-out+f-3. 011-A592-DA-001 Rev. 01 Page 69 ef 102
s '
, i J TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFTICTS ANAIXSIS No. Name Failure Cause Symptoms and local Method Inherent Effect Upon Ranarks Mode Effats Including of Compensating PPS and Dependent Failures Detation Prnvision Other EITwts Actuators, RPS Trip (Path No.1-Typical) FMEA Diagrams No.1
& 17 Output Shorted contact. The undervoltage trip coils will Periodic testing Channel has redundant legic for the afTected With a channelin contact to contact failure fail to open one trip circuit trip path to shunt trip RPS undervoltage trip bypsis actuation still under- breaker in the affected selective coils. converts to 2+ut+f-3 requires a 2wt-of-3 voltage trip 2.out of4 Actuation circuit selective. coincidence of the coil closed when required, but the shunt Logic for RPS shunt appropriate bistables.
trip coils will open the same remains selective 2-out-trip circuit breakers. of-4. Output Contact failure. The shunt trip coils will fail to Periodic testing Channel has redundant logic for the affected With a channelin contact to broken wire. open one trip circuit breaker in trip path to RPS shunt trip converts bypasa actuation still shunt trip the affected selective 2+ut+f4 undervo!tagetrip coil. to 2-out+f three requires a 2-out-of-3 coil open Actuation circuit when selective. coincidence of the required, but the undervoltage logic for RPS appropriate bistablea. trip coils will open the same undervoltage trip , trip circuit breakers. remains selective 2-out-of4. 108 Manual Trip Contact to Contact failure. One trip circuit breaker opens Annunciated . Redundant manual trip With one TCB open the With a channelin (I or 2) under- broken mire in the affected selective 2+ut- Breaker indication pushbuttons_ affected actuation logic bypass actuation still voltage trip of4 Actuation circuit. lights and phase Automatic RPS for RPS trip converts requires a 2-out-of.3 coil open current monitors. selective 2-out-of4 not to coincidenceof the to affected. 1-out+f-2 (opposite apprnpnate bistables. (A.) leg) or any 2-outef-3. y a Contact to Contact failure, One trip circuit breaker opens Annunciated . Redundant manual trip With one TCB open the With a channelin N shunt tnp shorted contact in the affected selective 2-out- Breaker indication pushbuttons. affected actuation logic bypass actuation still coil closed. of4 Actuation circuit. lights and phase Automatic RPS for RPS trip converta requires a 2-out+f-3 y current monitors. selective 2-outef4 not to coincidenceof the 3 affected. 1-out+f-2 (opposite appropriate bistables. O leg) or any 2-out-of-3. Contact to Contact failure. The undervoltage trip coils will Periodic testing. Redundant manual trip logic for RPS With a channelin under- Shorted contact fail to open one trip circuit pushbuttons. undervoltige trip bypass actuation still voltage trip coil closed breaker in the affected selective Manual trip of shunt conveds to 2+ut+f requires a 2-out+f-3 D 2+ut-of4 Actuation circuit coils not affected. three selutive, coincidenceof the when required, but the shunt Automatic RPS logic for RPS shunt trip appropriate bistables. trip coils will open the same trip circuit breakers selective 2-out+f4 not affected. remains selective 2-out-of-4. kt i Ol l-AS92-DA4X)l, Rev. 01 Page 70 of 102
\
TABLE 7.2-5 PLANT PROTECTION SYSTEM FAILURE MODES AND EFTECTS ANALYSIS l No. Name Failure Came Symgwams and Local Mi<lmi inhernet Effwe Upun Remaris Mode Effects including of Compmsating PPS and Depmdent Failures Detection Presisinn Other Effects Actuators, RPS Trip (Path No.l. Typical) fMEA Diagrarns No.1
& 17 i
Contact to Contact failure, The shunt trip coils will fail to Periodic testing. Redundant rnanual trip logic for RPS shunt With a channelin shunt trip bniken wire epen one trip circuit breaker in pushbuttons. trip converts to 2-out- bypass actuation still coil open the afrected selective 2-out-of4 Manual trip of of-three selective. requires a 2-out-of-3 Actuation circuit when undervoltage coils not logic for RPS coincidenceof the required, but the undervoltage affected. undervoltage trip appnynate bistables. trip coils will open the same Autornatic RPS remains selective 2-out-trip circuit breakers. selective 2-out+f4 not of4. affected. 109 Under- Coil opens broken wire. One trip circuit breaker opens Annunciated. Redundant trip paths. Logic for the atvected With a channelin voltage trip sustained in the effected selective 2mut- Breaker indication RPS selective 2+ut-of- bypass actuation still coil overvoltage of4 Actuation circuit. lights and phase 4 converts to 1-outef- requires a 2-out-of 3 current monitors. 2 (opposite leg) or any coincidenceof the 2-out-of-3. apprtyriate bistables. Coil shod Deterioration of One trip circuit breaker opens Annunciated . Redundant trip paths. logic for the With a channelin insulation in the affected selective 2-out- Breaker indication atTected RPS selective bypass actuation still of4 Actuation ci tuit. lights and phase 2-outef4 converts to requires a 2.out+f-3 current monitors. I-out-of-2 (orposite comcidence of the leg) or any 2-out-of-3, appropriate bistables. I10 Shunt trip Coil open O coil Broken wire. sustained Iecal shunt coil trips Periodic testing Underveltage trip coil None y overvoltage. y Coil short Deterioration of Shorted coil will cause breakers Annunciated. Logic for the effected With a channelin O insulation supplying 125 VDC to trip in Breaker indication o turn causing undervoltage trip lights and phase RPS selective 2-out-of- bypass actuation still w 4 converts to I-outer- requires a 2-outef-3 I coil to lose voltage. current monitors 2 (opposite leg) or any coincidenceof the 2-out+f-3. appropriate bistables. 1II 125V DC low Open, short, One trip circuit breaker opens Annunciated. None Logic for RPS selective Wh a channelin BUS (14) blown fuse in each of the two selective 2- Breaker indication 2-out-of4 converts to bypass actuation still outmf4 Actuation circuits. lights and phase 1-out<>f.2 (opposite requires a 2-out-of-3 current monitors. leg) or any 2-out-of-3. coincidence of the 3 appropriate bistables. I C4 Ol l-ASCDA 401, Rev. 01 Page 71 of 102
i
~. / )
TABII 7.2-5 PLANT PROTECTION SYSTEnf FAILURE MODES AND EITECTS ANALYSIS No. Narne Failure Cause Symptoms and 12iral Mettuxl inherent Effect Upna Remarks Mode ElTerts including of Compmsating PPS and Dependestt Failures Detection Provision Other Effects Actuators, RPS Trip (Path No.1-Typicaf) FMEA Diagrarns No.1
& 17 112 480V AC trw Open, short, open MG frern unatTected bus has an Annunciated. None None There are two MG sets 3 Phase input breaker increase in load. Breaker indication ihr plant availability and Bus (1,2) lights, MG set voltage they will have no effect and current. on the RPS trip system.
113 M (I,2) Output Motor or generator increased load on the unaffected Annunciated. None MG (1,2) low failure. MCB MG. Breaker indication 29-1/ DSS breaker failure, fights, MG set vohage 29-21 DSS DSS bypass and current. 52-1/ DSS breaker or DSS contactor and 52 2/ DSS cornactor failure. bypass breaker indication lights. Shorted output increased load on the unaffected Annunciated. None Possible reactor lines. MG. Breaker indication shutdownif the short lights, MG set vohage results in a loss of both}}