ML17157B681

Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 7, Instrumentation and Controls

ML17157B681
Person / Time
Site:	Duane Arnold
Issue date:	05/22/2017
From:	NextEra Energy Duane Arnold
To:	Office of Nuclear Reactor Regulation
Shared Package
ML17157B650	List: ML17157B649 ML17157B674 ML17157B675 ML17157B677 ML17157B678 ML17157B679 ML17157B680 ML17157B681 ML17157B682 ML17157B683 ML17157B684 ML17157B685 ML17157B686 ML17157B687 ML17157B688 ML17157B689 ML17157B690 ML17157B691 ML17157B692 NG-17-0086, Transmittal of Revision 24 of the DAEC Updated Final Safety Analysis Report and the Current DAEC Technical Specifications Bases NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 1, Introduction and General Description of Plant NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 10, Steam and Power Conversion NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 11, Radioactive Waste Management NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 12, Radiation Protection NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 13, Conduct of Operations NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 14, Initial Test Program NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 15, Accident Analyses NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 16, Technical Specifications NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 17, Quality Assurance NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 3, Design of Structures, Components, Equipment, and Systems NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 4, Reactor NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 5, Reactor Coolant System and Connected Systems NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 6, Engineered Safety Features NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 7, Instrumentation and Controls NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 8, Electric Power NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 9, Auxiliary Systems NG-17-0111, Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Table of Contents NG-17-0111, Redacted - Duane Arnold Energy Center, Revision 24 to Updated Final Safety Analysis Report, Chapter 2, Site Characteristics
References
NG-17-0111
Download: ML17157B681 (363)

Text

{{#Wiki_filter:UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-i Revision 23 - 5/15

7.1 INTRODUCTION

.............................................................................................. 7.1-1 7.1.1  Identification of Safety-Related Systems  ....................................................... 7.1-1 7.1.1.1  Safety Systems  ............................................................................................. 7.1-1 7.1.1.2  Safety Function  ............................................................................................ 7.1-2 7.1.1.3  Power Generation Systems  .......................................................................... 7.1-3 7.1.1.4  Definition and Symbols ................................................................................ 7.1-3 

7.1.2 Identification

of Safety Criteria ...................................................................... 7.1-4

7.1.3 Instrument

Setpoint Control Program .............................................................. 7.1-4

7.2 REACTOR

PROTECTION SYSTEM .............................................................. 7.2-1

7.2.1 Description

...................................................................................................... 7.2

-1 7.2.1.1 System Description ....................................................................................... 7.2-1 7.2.1.1.1 Identification .............................................................................................. 7.2-1 7.2.1.1.2 Power Supply ............................................................................................. 7.2-1 7.2.1.1.3 Physical Arrangement ............................................................................... 7.2-2 7.2.1.1.4 Logic ......................................................................................................... 7. 2-3 7.2.1.1.5 Operation .................................................................................................. 7.2-3 7.2.1.1.6 Mode Switch ............................................................................................ 7.2-5 7.2.1.1.7 Scram Bypass ............................................................................................ 7.2-6 7.2.1.1.8 Wiring ........................................................................................................ 7.2 -7 7.2.1.2 Design Basis Information ............................................................................. 7.2-8 7.2.1.2.1 Safety Objective ........................................................................................ 7.2-8 7.2.1.2.2 Safety Design Bases ................................................................................. 7.2-8 7.2.1.2.3 Scram Functions and Trip Settings ........................................................... 7.2-10 7.2.1.2.4 Design Criteria .......................................................................................... 7.2-19 7.2.1.3 Inspection and Testing .................................................................................. 7.2-20

7.2.2 Analysis

........................................................................................................... 7.2 -22 7.2.3 ATWS-RPT/ARI ............................................................................................. 7.2-24 7.2.3.1 Design Basis Information ............................................................................ 7.2-25 7.2.3.2 System Description ....................................................................................... 7.2-25

REFERENCES FOR SECTION 7.2 ......................................................................... 7.2-27

7.3 ENGINEERED

SAFETY FEATURES SYSTEM ........................................... 7.3-1

7.3.1 Description

 ..................................................................................................... 7.3

-1 7.3.1.1 System Descriptions ................................................................................... 7.3-1 7.3.1.1.1 Primary Containment Isolation and Nuclear Steam Supply Shutoff System . ...................................................................................................... 7.3-1 7.3.1.1.1.1 Definitions ............................................................................................. 7.3-1 UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-ii Revision 23 - 5/15 7.3.1.1.1.2 Identification .......................................................................................... 7.3-2 7.3.1.1.1.3 Power Supply .......................................................................................... 7.3-2 7.3.1.1.1.4 Physical Arrangement ............................................................................. 7.3-2 7.3.1.1.1.5 Logic ...................................................................................................... 7.3 -3 7.3.1.1.1.6 Operation ............................................................................................... 7.3-5 7.3.1.1.1.7 Isolation Valve Closing Devices and Circuits ....................................... 7.3-8 7.3.1.1.1.8 Isolation Functions and Settings ............................................................. 7.3-12 7.3.1.1.2 Emergency Core Cooling Systems Instrumentation and Control ............. 7.3-26 7.3.1.1.2.1 HPCI System Instrumentation and Control ........................................... 7.3-26 7.3.1.1.2.2 Automatic Depressurization System Instrumentation and Control ....... 7.3-33 7.3.1.1.2.3 Core Spray System Instrumentation Control .......................................... 7.3-36 7.3.1.1.2.4 LPCI System Instrumentation and Control ............................................ 7.3-39 7.3.1.2 Design-Basis Information ............................................................................ 7.3-46 7.3.1.2.1 Design Bases for Primary Containment Isolation ..................................... 7.3-46 7.3.1.2.1.1 Safety Objective ...................................................................................... 7.3-46 7.3.1.2.1.2 Safety Design Bases ................................................................................7.3-47 7.3.1.2.2 Design Bases for Emergency Core Cooling Systems Instrumentation and Control ....................................................................................................... 7.3-49 7.3.1.2.2.1 Safety Objective ...................................................................................... 7.3-49 7.3.1.2.2.2 Safety Design Bases .............................................................................. 7.3-50 7.3.1.3 Final System Drawings ............................................................................... 7.3-51

7.3.2 Analysis

.......................................................................................................... 7.3

-51 7.3.2.1 Primary Containment Isolation .................................................................... 7.3-51 7.3.2.2 Emergency Core Cooling System Instrumentation and Control ................ 7.3-54 7.3.3 Instrumentation .............................................................................................. 7.3-56 7.3.3.1 Containment Isolation Monitoring System ................................................... 7.3-61

7.3.4 Tests

and Inspection ........................................................................................ 7.3-62 7.3.4.1 Primary Containment Isolation and NSS Shutoff System ............................ 7.3-62 7.3.4.2 Emergency Core Cooling Systems .............................................................. 7.3-62 7.3.4.3 Test Provisions and Procedures .................................................................... 7.3-62

7.3.5 Environmental

Considerations ......................................................................... 7.3-65 7.3.5.1 Primary Containment Isolation and NSS Shutoff System ........................... 7.3-65 7.3.5.2 HPCI System ............................................................................................... 7.3-65 7.3.5.3 Automatic Depressurization System ............................................................ 7.3-66 7.3.5.4 Core Spray System ....................................................................................... 7.3-66 7.3.5.5 LPCI ............................................................................................................. 7. 3-66 REFERENCES FOR SECTION 7.3 ........................................................................ 7.3-67 UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-iii Revision 23 - 5/15

7.4 SYSTEMS

REQUIRED FOR SAFE SHUTDOWN .......................................... 7.4-1 7.4.1 Description ...................................................................................................... 7. 4-1 7.4.1.1 Reactor Trip System .................................................................................... 7.4-1 7.4.1.2 Reactor Core Isolation Cooling System ....................................................... 7.4-1 7.4.1.3 High Pressure Coolant Injection System ...................................................... 7.4-3 7.4.1.4 Safety Relief Valves .................................................................................... 7.4-3 7.4.1.5 Residual Heat Removal System ................................................................... 7.4-3

7.4.2 Plant

Shutdown From Outside the Control Room .......................................... 7.4-3 7.4.2.1 Description ................................................................................................... 7.4 -3 7.4.2.1.1 General ...................................................................................................... 7. 4-3 7.4.2.1.2 Hot Standby .............................................................................................. 7.4-4

7.4.2.1.3 Cold Shutdown .......................................................................................... 7.4-4

7.4.2.2 Analysis ....................................................................................................... 7. 4-5 7.4.2.2.1 NRC General Design Criterion 19 ............................................................ 7.4-5 7.4.2.2.2 IEEE-279-1971 ......................................................................................... 7.4-5

REFERENCES FOR SECTION 7.4 ........................................................................ 7.4-7

7.5 SAFETY-RELATED DISPLAY INSTRUMENTATION ................................. 7.5-1 7.5.1 Reactor, Reactor Coolant, Containment Readouts and Indications . .............. 7.5-1 7.5.1.1 Design Criteria. ............................................................................................ 7.5-1 7.5.1.2 Loss-of-Coolant Accident Information ........................................................ 7.5-2 7.5.1.3 Control Room Accident Monitoring Panel .................................................. 7.5-6 7.5.1.4 Direct Valve-Position Indication ................................................................. 7.5-6

7.5.2 Automatic

Depressurization System Annunciation ........................................ 7.5-6

7.5.3 Automatic

Annunciation of Operating Bypasses ............................................ 7.5-7

7.5.4 Control

Rod Position Indicating System ........................................................ 7.5-7

7.5.5 Detailed

Control Room Design Review. ......................................................... 7.5-7

REFERENCES FOR SECTION 7.5 ......................................................................... 7.5-9

7.6 ALL OTHER INSTRUMENTATION SYSTEMS REQUIRED FOR SAFETY 7.6-1

7.6.1 Neutron

Monitoring System .......................................................................... 7.6-1 7.6.1.1 Safety Objective ........................................................................................... 7.6-1 7.6.1.2 Power Generation Objective ........................................................................ 7.6-1 7.6.1.3 Identification ................................................................................................. 7.6 -1 7.6.1.4 Source Range Monitor Subsystem ............................................................... 7.6-1 7.6.1.4.1 Power Generation Design Bases ............................................................... 7.6-2 7.6.1.4.2 Physical Arrangement ............................................................................... 7.6-2

UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-iv Revision 23 - 5/15 7.6.1.4.3 Signal Conditioning ................................................................................. 7.6-3 7.6.1.4.4 Trip Functions ........................................................................................... 7.6-4 7.6.1.4.5 Power Generation Evaluation ................................................................... 7.6-4 7.6.1.4.6 Inspection and Testing .............................................................................. 7.6-5 7.6.1.5 Intermediate Range Monitor Subsystem ...................................................... 7.6-5 7.6.1.5.1 Safety Design Bases .................................................................................. 7.6-5 7.6.1.5.2 Power Generation Design Bases .............................................................. 7.6-5 7.6.1.5.3 Identification ............................................................................................. 7.6-6 7.6.1.5.4 Power Supply ............................................................................................ 7.6-6 7.6.1.5.5 Physical Arrangement ................................................................................ 7.6-6 7.6.1.5.6 Signal Conditioning .................................................................................. 7.6-6 7.6.1.5.7 Trip Function ............................................................................................ 7.6-7 7.6.1.5.8 Safety Evaluation ..................................................................................... 7.6-7 7.6.1.5.9 Power Generation Evaluation ................................................................... 7.6-8 7.6.1.5.10 Inspection and Testing .............................................................................. 7.6-8 7.6.1.6 Local Power Range Monitor Subsystem .................................................... 7.6-8 7.6.1.6.1 Power Generation Design Bases ................................................................ 7.6-9 7.6.1.6.2 Power Supply . ........................................................................................... 7.6-9 7.6.1.6.3 Physical Arrangement ............................................................................... 7.6-9 7.6.1.6.4 Signal Conditioning .................................................................................. 7.6-10 7.6.1.6.5 Trip Functions ........................................................................................... 7.6-11 7.6.1.6.6 Power Generation Evaluation .................................................................. 7.6-11 7.6.1.6.7 Inspection and Testing .............................................................................. 7.6-12 7.6.1.7 Average Power Range Monitor Subsystem ................................................ 7.6-12 7.6.1.7.1 Safety Design Bases .................................................................................. 7.6-12 7.6.1.7.2 Power Generation Design Bases ............................................................... 7.6-12 7.6.1.7.3 Power Supply ............................................................................................ 7.6-12 7.6.1.7.4 Signal Conditioning ................................................................................. 7.6-13 7.6.1.7.5 Trip Function ............................................................................................ 7.6-14 7.6.1.7.6 Safety Evaluation ...................................................................................... 7.6-14 7.6.1.7.7 Power Generation Evaluation .................................................................. 7.6-15 7.6.1.7.8 Inspection and Testing .............................................................................. 7.6-15 7.6.1.8 Rod Block Monitor Subsystem . .................................................................. 7.6-15 7.6.1.8.1 Power Generation Design Bases ............................................................... 7.6-16 7.6.1.8.2 Power Supply ............................................................................................ 7.6-16 7.6.1.8.3 Signal Conditioning .................................................................................. 7.6-16 7.6.1.8.4 Trip Function ........................................................................................... 7.6-17 7.6.1.8.5 Isolation .................................................................................................... 7.6-17 UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-v Revision 23 - 5/15 7.6.1.8.6 Power Generation Evaluation .................................................................. 7.6-18 7.6.1.8.7 Inspection and Testing . ............................................................................. 7.6-19 7.6.1.9 Traversing Incore Probe Subsystem ........................................................... 7.6-19 7.6.1.9.1 Power Generation Design Basis . ............................................................. 7.6-19 7.6.1.9.2 Physical Arrangement . .............................................................................. 7.6-19 7.6.1.9.3 Signal Conditioning ................................................................................. 7.6-21 7.6.1.9.4 Power Generation Evaluation . ................................................................. 7.6-22 7.6.1.9.5 Inspection and Testing .............................................................................. 7.6-22

7.6.2 Refueling

Interlocks ........................................................................................ 7.6-22 7.6.2.1 Safety Objective . .......................................................................................... 7.6-25 7.6.2.2 Safety Design Bases .................................................................................... 7.6-25 7.6.2.3 Safety Evaluation ........................................................................................ 7.6-25 7.6.2.4 Inspection and Testing ................................................................................. 7.6-26 7.6.3 Rod Sequence Control System ........................................................................ 7.6-26

7.6.4 Reactor

Vessel Instrumentation ...................................................................... 7.6-26 7.6.4.1 Safety Objective . .......................................................................................... 7.6-26 7.6.4.2 Safety Design Basis ..................................................................................... 7.6-27 7.6.4.3 Power Generation Objective ........................................................................ 7.6-27 7.6.4.4 Power Generation Design Bases .................................................................. 7.6-27 7.6.4.5 Reactor Vessel Temperature ........................................................................ 7.6-27 7.6.4.6 Reactor Vessel Water Level ......................................................................... 7.6-28 7.6.4.7 Reactor Vessel Coolant Flow and Differential Pressures ............................ 7.6-31

7.6.4.8 Reactor Vessel Internal Pressure .................................................................. 7.6-32 7.6.4.9 Reactor Vessel Top Head Flange Leak Detection ........................................ 7.6-33 7.6.4.10 Safety Evaluation ....................................................................................... 7.6-33 7.6.4.11 Inspection and Testing ................................................................................ 7.6-33

7.6.5 Safety

Relief Valve Low-Low Set Logic ........................................................ 7.6-33

REFERENCES FOR SECTION 7.6. ......................................................................... 7.6-35

7.7 CONTROL

SYSTEMS NOT REQUIRED FOR SAFETY .............................. 7.7-1

7.7.1 Feedwater

System Control and Instrumentation ............................................. 7.7-1 7.7.1.1 Power Generation Objective ........................................................................ 7.7-1 7.7.1.2 Power Generation Design Basis .................................................................. 7.7-1 7.7.1.3 System Description ...................................................................................... 7.7-1 7.7.1.3.1 Reactor Vessel Water Level Measurement ............................................... 7.7-2 7.7.1.3.2 Steam Flow Measurement ......................................................................... 7.7-2 7.7.1.3.3 Feedwater Flow Measurement .................................................................. 7.7-2 7.7.1.3.4 Feedwater Control Signal ......................................................................... 7.7-3 UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-vi Revision 23 - 5/15 7.7.1.4 Inspection and Testing ................................................................................. 7.7-5 7.7.2 Turbine-Generator Instrumentation and Control Systems .............................. 7.7-5 7.7.2.1 Power Generation Objectives ...................................................................... 7.7-5 7.7.2.2 Power Generation Design Basis .................................................................. 7.7-5

7.7.2.2.1 Electrohydraulic Control (EHC), and Turbine Supervisory Instrumentation (TSI) Controls ................................................................ 7.7-5 7.7.2.2.2 Main Condenser Instrumentation and Control ........................................... 7.7-6 7.7.2.2.3 Condensate System Instrumentation and Control ..................................... 7.7-6 7.7.2.2.4 Condensate Demineralizer Instrumentation .............................................. 7.7-6 7.7.2.3 System Description ...................................................................................... 7.7-7

7.7.2.3.1 IPR, EHC, and Turbine Bypass Controls ................................................ 7.7-7 7.7.2.3.2 Low Main Condenser Vacuum Trip ......................................................... 7.7-8

7.7.3 Reactor

Manual Control System .................................................................... 7.7-9 7.7.3.1 Power Generation Objective ......................................................................... 7.7-9 7.7.3.2 Safety Design Bases ..................................................................................... 7.7-9 7.7.3.3 Power Generation Design Bases ................................................................. 7.7-9 7.7.3.4 System Description ...................................................................................... 7.7-9 7.7.3.5 General Operation . ...................................................................................... 7.7-10 7.7.3.5.1 Insert Cycle . .............................................................................................. 7.7-11 7.7.3.5.2 Withdraw Cycle ........................................................................................ 7.7-12 7.7.3.6 Control Rod Drive Hydraulic System Control ............................................ 7.7-12 7.7.3.7 Rod Block Interlocks ................................................................................... 7.7-12 7.7.3.7.1 General ...................................................................................................... 7.7-13 7.7.3.7.2 Rod Block Functions ................................................................................ 7.7-13 7.7.3.7.3 Rod Block Bypasses .................................................................................. 7.7-16 7.7.3.7.4 Arrangement of Rod Block Trip Channels ................................................ 7.7-17 7.7.3.8 Control Rod Information Displays ............................................................... 7.7-18 7.7.3.9 Safety Evaluation ........................................................................................ 7.7-20 7.7.3.10 Inspection and Testing ................................................................................. 7.7-21

7.7.4 Plant

Process Computer System .................................................................... 7.7-21 7.7.4.1 Power Generation Objective ......................................................................... 7.7-21 7.7.4.2 Power Generation Design Bases .................................................................. 7.7-21 7.7.4.3 Safety Objective ........................................................................................... 7.7-22 7.7.4.4 Safety Design Basis . ................................................................................... 7.7-22 7.7.4.5 Computer System Components .................................................................... 7.7-22 7.7.4.5.1 Central Processor ...................................................................................... 7.7-22 7.7.4.5.2 Bulk Memory Subsystem .......................................................................... 7.7-22 7.7.4.5.3 Peripheral I/O Subsystem .......................................................................... 7.7-23 UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-vii Revision 23 - 5/15 7.7.4.5.4 Data Acquisition Subsystem (DAS) Hardware ......................................... 7.7-23 7.7.4.5.5 CRT Color Terminals ............................................................................... 7.7-23 7.7.4.6 Reactor Core Performance Function ............................................................ 7.7-23 7.7.4.6.1 Power Distribution Evaluation ................................................................... 7.7-23 7.7.4.6.2 Fast Core Monitoring ................................................................................ 7.7-24 7.7.4.6.3 LPRM Calibration ...................................................................................... 7.7-24 7.7.4.6.4 Fuel Exposure ........................................................................................... 7.7-24

7.7.4.6.5 Control Rod Exposure ............................................................................... 7.7-24

7.7.4.6.6 LPRM Exposure ........................................................................................ 7.7-25 7.7.4.6.7 Isotopic Composition of Exposed Fuel ..................................................... 7.7-25 7.7.4.6.8 Stability Monitoring .................................................................................. 7.7-25 7.7.4.7 Plant Process Computer System Software ................................................. 7.7-25 7.7.4.7.1 Data Acquisition and Processing Software ............................................... 7.7-25 7.7.4.7.2 Balance of Plant (BOP) Software. ............................................................. 7.7-26 7.7.4.7.2.1 Man-Machine Interface (MMI). ............................................................. 7.7-26 7.7.4.7.2.2 NSSS/BOP Post Trip Logging ............................................................... 7.7-27 7.7.4.8 Inspection and Testing .................................................................................. 7.7-27

7.7.5 Recirculation

Flow Control System ............................................................... 7.7-28 7.7.5.1 Power Generation Objective . ....................................................................... 7.7-28 7.7.5.2 Power Generation Design Bases .................................................................. 7.7-28 7.7.5.3 Safety Design Bases .................................................................................... 7.7-28 7.7.5.4 System Description ....................................................................................... 7.7-28 7.7.5.4.1 General ...................................................................................................... 7.7-28 7.7.5.4.2 Motor-Generator Set ................................................................................. 7.7-29 7.7.5.4.3 Speed Control Components ...................................................................... 7.7-30 7.7.5.4.4 Safety Evaluation ...................................................................................... 7.7-32 7.7.5.4.5 Inspection and Testing ............................................................................... 7.7-32

7.7.6 Safety

Parameter Display System ................................................................... 7.7-32 7.7.6.1 Power Generation Objective ......................................................................... 7.7-32 7.7.6.2 Power Generation Design Bases .................................................................. 7.7-33 7.7.6.3 System Description ...................................................................................... 7.7-34 7.7.6.3.1 Data Acquisition Subsystem (DAS) .......................................................... 7.7-34 7.7.6.3.2 Host Processor Subsystem ........................................................................ 7.7-34 7.7.6.3.3 Colorgraphic User's Terminal (CUT) ....................................................... 7.7-35 7.7.6.4 Safety Parameters and Associated Variables ............................................... 7.7-35 7.7.6.4.1 Safety Parameters ...................................................................................... 7.7-35 7.7.6.4.2 Key Plant Variables .................................................................................. 7.7-36 7.7.6.5 Emergency Operating Procedure Graphs ..................................................... 7.7-36 UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS TABLE OF CONTENTS Section Title Page 7-viii Revision 23 - 5/15 7.7.7 Rod Worth Minimizer (RWM) Microcomputer System ................................ 7.7-36 7.7.7.1 Description ................................................................................................... 7.7-3 6 7.7.7.2 Rod Worth Minimizer Inputs. ....................................................................... 7.7-37 7.7.7.3 Rod Worth Minimizer Outputs. .................................................................... 7.7-38 7.7.7.4 Rod Worth Minimizer Indications ................................................................ 7.7-38 7.7.7.5 Design Objective .......................................................................................... 7.7-39

7.7.7.6 Design Basis ................................................................................................ 7.7-39 7.7.7.7 Safety Evaluation. ......................................................................................... 7.7-39 7.7.7.8 Inspection and Testing. ................................................................................. 7.7-39 7.7.7.9 Diagnostics Available for RWM. ................................................................. 7.7-40 7.7.7.9.1 RWM Failure Detection. ............................................................................ 7.7-40 7.7.7.9.2 RWM Computer Stall Indication. .............................................................. 7.7-40

REFERENCES FOR SECTION 7.7. ......................................................................... 7.7-41 UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS LIST OF TABLES Tables Title 7-ix Revision 23 - 5/15 7.1-1 Definitions Applicable to Instrumentation and Control of Protection Systems ......................................................................................................... T7.1-1

7.2-1 Reactor Protection System Scram Settings ................................................... T7.2-1

7.2-2 Valve Channel Sensing Logic ...................................................................... T7.2-2

7.2-3 ATWS-RPT-ARI Initiation Instrumentation ................................................. T7.2-3

7.3-1 Process Pipelines Penetrating Primary Containment ................................... T7.3-1

7.3-2 Primary Containment Isolation and Nuclear Steam Supply Shutoff System Isolation Setpoints .............................................................................T7.3-21

7.3-3 High-Pressure Coolant Injection System Instrument Trip Settings . .............T7.3-23

7.3-4 Automatic Depressurization System Instrument Trip Settings ......................T7.3-24

7.3-5 Core Spray System Instrumentation .............................................................T7.3-25

7.3-6 Low-Pressure Coolant Injection Instrument Trip Settings ............................T7.3-26

7.4-1 Locations of Remote Shutdown Panels ....................................................... T7.4-1

7.4-2 Safety-Related Controls, Alternate Shutdown Capability Panels ................ T7.4-2

7.4-3 Non-Safety-Related Controls and Monitoring Indicators, Alternate Shutdown Capability Panels .......................................................................................... T7.4-4

7.4-4 Other Controls and Monitoring Indicators Provided Outside the Main Control Room ................................................................................................ T7.4-9

7.4-5 Location of Remote Shutdown Fuse Panels (RSFP) .....................................T7.4-10

7.4-6 Reactor Core Isolation Cooling System Trip Setting ....................................T7.4-11

7.6-1 SRM Trips and Alarms ................................................................................ T7.6-1

7.6-2 IRM Trips and Alarms ................................................................................... T7.6-2

UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS LIST OF TABLES Tables Title 7-x Revision 23 - 5/15 7.6-3 LPRM Trips and Alarms .............................................................................. T7.6-3

7.6-4 APRM Trips and Alarms .............................................................................. T7.6-4

7.6-5 Refueling Interlock Effectiveness ................................................................ T7.6-5

7.6-8 Reactor Vessel Instrumentation Instrument Specifications .......................... T7.6-10

7.7-1 Safety Parameter Display System Safety Parameters and Associated Key Plant Variables ..............................................................................................T7.7-1

7.7-2 Safety Parameter Display System Key Plant Variable Ranges .................... T7.7-6

UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS LIST OF FIGURES Figure Title 7-xi Revision 23 - 5/15 7.1-1 Piping and Instrumentation Symbols, Sheets 1 through

7.1-2 Logic Symbols Used on Functional Control Diagrams

7.2-1 Reactor Protection System Schematic Diagram, Sheets 1 through 3

7.2-2 Schematic Diagram of Logics in One Trip System

7.2-3 Schematic Diagram of Actuators and Actuator Logics

7.2-4 Relationship between Neutron Monitoring System and Reactor Protection System

7.2-5 Functional Control Diagram for Neutron Monitoring Logics

7.2-6 Typical Arrangement of Channels and Logics

7.2-7 Turbine Stop Valve Performance Characteristics

7.2-8 Typical Configuration for Turbine Stop Valve Closure Scram

7.2-9 Typical Configuration for Main Steam Line Isolation Scram

7.2-10 DAEC ATWS-RPT/ARI

7.3-1 Temperature Switch Location RCIC and HPCI Steam Line Isolation, Sheets 1 through 3

7.3-2 Temperature Switch Location Main Steam Line Isolation Sheets 1 through 3

7.3-3 Piping Arrangement Drawing, Sheets 1 through 9

7.3-4 Typical Isolation Control System for Main Steam Line Isolation Valves

7.3-5 Typical Isolation Control System Using Motor-Operated Valves

7.3-6 Nuclear Boiler System - FCD, Sheets 1 through 3

7.3-7 Main Steam Line Isolation Valve, Schematic Control Diagram

7.3-8 Main Steam Isolation Valve Performance Characteristic UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS LIST OF FIGURES Figure Title 7-xii Revision 23 - 5/15 7.3-9 Typical ECCS Actuation and Initiation Logic

7.3-10 HPCI System - FCD, Sheets 1 through 3

7.3-11 Typical ECCS Trip System Actuation Logic

7.3-12 Core Spray System - FCD

7.3-13 RHR System - FCD, Sheets 1 through 3A

7.3-14 LPCI Break Detection Logic Component Arrangement

7.3-15 Recirculation System - FCD, Sheets 1 through 3

7.3-16 Main Steam Line High Flow Channels

7.3-17 Typical Arrangement for Main Steam Line Break Detection by Flow Measurement

7.3-18 Typical Elbow Flow Sensing Arrangement

7.3-19 Typical HPCI or RCIC High Exhaust Pressure Detection Arrangement

7.3-20 HPCI or RCIC Room Temperature Detector Arrangement

7.3-21 Reactor Water Cleanup Break Detection by Differential Flow Measurement

7.3-22 Reactor Water Cleanup Break Detection by High Ambient and High Differential Temperature Measurement

7.6-1 Neutron Monitor - Instrument and Electrical Diagram, Sheets 1 and 2

7.6-2 SRM/IRM Neutron Monitoring Unit

7.6-3 Detector Drive System Schematic

7.6-4 Functional Block Diagram of SRM Channel

UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS LIST OF FIGURES Figure Title 7-xiii Revision 23 - 5/15 7.6-5 Neutron Monitoring System - FCD

7.6-6 Ranges of Neutron Monitoring System

7.6-7 Functional Block Diagram of IRM Channel

7.6-8 Typical IRM Circuit Arrangement for Reactor Protection System Input

7.6-9 Control Rod Withdrawal Error During Start-Up

7.6-10 Deleted

7.6-11 Power Range Neutron Monitoring Unit

7.6-12 Flow Reference and RBM Instrumentation

7.6-13 Typical APRM Circuit Arrangement for Reactor Protection System Input

7.6-14 APRM Tracking Reduction in Power by Flow Control

7.6-15 APRM Tracking With On-Limits Control Rod Withdrawal

7.6-16 Assignment of Power Range Detector Assemblies to RBM

7.6-17 Assignment of LPRM Strings to TIP Machines

7.6-18 Traversing Incore Probe Subsystem Block Diagram

7.6-19 Traversing Incore Probe Assembly

7.6-20 TIP Equipment and Neutron Monitoring System Arrangement

7.6-21 Traversing Incore Probe Functional Control Diagram

7.6-30 Reactor Vessel Level Indication

7.6-31 Safety/Relief Valve Low-Low Set Function

UFSAR/DAEC-1 Chapter 7: INSTRUMENTATION AND CONTROLS LIST OF FIGURES Figure Title 7-xiv Revision 23 - 5/15 7.6-32 Deleted

7.7-1 Feedwater Control System - Instrument and Electrical Diagram

7.7-2 CRD Hydraulic System - FCD, Sheets 1 through 7

7.7-3 Arrangement Reactor Coolant BB

7.7-4 Input Signals to Four-Rod Display

7.7-5 Deleted

7.7-6 Recirculation Flow Control Illustration

7.1-1 Revision 19 - 9/07 CHAPTER 7 INSTRUMENTATION AND CONTROLS

7.1 INTRODUCTION

Chapter 7 presents the details of major instrumentation and control systems in the plant. Some of these systems are safety systems; others are power generation systems.

7.1.1 IDENTIFICATION

OF SAFETY-RELATED SYSTEMS

7.1.1.1 Safety Systems

The safety systems described in this chapter are the following:

1. Nuclear safety systems and engineered safeguards (required for accidents and abnormal operational transients), as follows:

a. Reactor protection system.

b. Primary containment isolation and nuclear steam supply (PCI/NSS) shutoff systems.

c. Emergency core cooling systems control and instrumentation.

d. Neutron monitoring system (specific portions).

2. Process safety systems (required for planned operation), are as follows:

a. Neutron monitoring system (specific portion).

b. Refueling interlocks.

c. Reactor vessel instrumentation.

d. Process radiation monitors (except main steam line radiation monitoring system).

7.1-2 Revision 19 - 9/07 7.1.1.2 Safety Function

The major functions of the safety systems are summarized as follows:

1. Reactor Protection System

The RPS initiates an automatic reactor shutdown (scram) when monitored nuclear system variables exceed preestablished limits. This action limits fuel damage and system pressure and thus restricts the release of radioactive material.

2 Primary Containment Isolation and Nuclear Steam Supply Shutoff System

This system initiates the closure of various automatic isolation valves in response to out-of-limit nuclear system variables. The action provided limits the loss of coolant from the reactor vessel and contains radioactive materials either inside the reactor vessel or inside the primary containment. The system responds to various indications of pipe breaks or radioactive material release.

3. Emergency Core Cooling Systems Control and Instrumentation

This chapter describes the arrangement of control devices for high- pressure coolant injection (HPCI), automatic depressurization system (ADS), core spray (CS), and the low-pressure coolant injection (LPCI) mode of residual heat removal (RHR).

4. Neutron Monitoring System

The neutron monitoring system uses incore neutron detectors to monitor core neutron flux. The safety function of the neutron monitoring system is

to provide a signal to shut down the reactor when an overpower indicator. In addition, the neutron monitoring system provides the required power

level indication during planned operation.

5. Main Steam Radiation Monitoring System

Gamma-sensitive radiation monitors are installed in the vicinity of the main steam lines just inside the steam tunnel. These monitors can detect a gross release of fission products from the fuel by measuring the gamma radiation coming from the steam lines. As approved in Amendment 261, these monitors no longer have a safety function.

7.1-3 Revision 14 - 11/98

6. Refueling Interlocks

The refueling interlocks serve as a backup to procedural core reactivity control during refueling operation.

7. Reactor Vessel Instrumentation

The reactor vessel instrumentation monitors and transmits information concerning key reactor vessel operating parameters during planned operations to ensure that sufficient control of these parameters is possible.

8. Process Radiation Monitors (except Main Steam Line Radiation Monitoring Systems)

A number of radiation monitoring systems are provided on process liquid and gas lines to provide control and/or alarm of the radioactive material release from the site to ensure that such releases are within the limits of

applicable guidelines.

7.1.1.3 Power Generation Systems

The power generation systems described in this chapter are the following:

1. Feedwater system control and instrumentation (Section 7.7.1).

2. Turbine-generator control and instrumentation (Section 7.7.2).

3. Reactor manual control (Section 7.7.3).

4. Process computer (Section 7.7.4).

5. Recirculation flow control system (Section 7.7.5).

7.1.1.4 Definitions and Symbols

The complexity of the instrumentation and control systems requires the use of certain terminology and symbolism for clarification in the description of the protection systems.

Table 7.1-1 presents definitions applicable to the instrumentation and control of protection systems. 7.1-4 Revision 14 - 11/98 Figure 7.1-1, Sheets 1 through 4, presents piping and instrumentation symbols. Figure 7.1-2 presents logic symbols used on functional control diagrams.

7.1.2 IDENTIFICATION

OF SAFETY CRITERIA

Safety criteria for systems are identified on a case-by-case basis within the

various sections of this chapter.

7.1.3 INSTRUMENT

SETPOINT CONTROL PROGRAM The DAEC Setpoint Control Program establishes the design controls on instrument setpoints required by the Technical Specifications and for other selected instrumentation based upon its safety significance. The Program establishes the methodologies for determining the Allowable Values and Trip Setpoints that ensure, with a high probability, the design or safety analysis limits are not exceeded in the event of transients or accidents. The DAEC Instrument Setpoint Methodology is based on the General Electric (GE) Instrument Setpoint Methodology; NEDC-31336, "General Electric Instrumentation Setpoint Methodology," which has NRC approva

l. The Allowable Values and Trip Setpoints have been established from each applicable design or safety analysis limit by accounting for instrument accuracy, calibration and drift uncertainties, as well as process measurement accuracy, primary element accuracy and environmental effects. Administrative procedures have been established that ensure the proper design controls are applied to activities that could impact the setpoint calculations, such as, testing practices, plant modifications and procedure revisions.

UFSAR/DAEC - 1 T7.1-1 Revision 14 - 11/98 Table 7.1-1 DEFINITIONS APPLICABLE TO INSTRUMENTATION AND CONTROL OF PROTECTION SYSTEMS Sensor - A sensor is that part of a channel used to detect variations in a measured variable.

Channel - A channel is an arrangement of one or more sensors and associated components used to evaluate plant vari ables and produce discrete outputs used in logic. A channel terminates and loses its identity where individual channel outputs are combined in logic.

Logic - Logic is that array of components that combines individual bistable output signals to produce decision outputs.

Trip - A trip is the change of state of bistable device that represents the change from a normal condition.

Trip system - A trip system is that portion of a system encompassing one or more channels, logic, and bistable devices used to produce signals to the actuation device.

Setpoint* - A setpoint is that value of the mon itored variable that causes a channel trip. Allowable Value - The instrument setting used to define Channel Operability in the Technical Specifications.

Actuation device - An actuation device is an electrical or electromechanical module controlled by an electrical decision signal and produces mechanical operation of one or more activated devices.

Activated device - An activated device is a mechanical component used to accomplish an action. An activated device is controlled by an actuation device.

Component - Items from which the system is assembl ed (e.g., resistors, capacitors, wires, connectors, transistors, switches, springs, pumps, valves, piping, heat exchangers, vessels).

Module - Any assembly of interconnected com ponents that constitutes an identifiable device, instrument, or piece of equipment.

Incident detection circutry - Incident detection circuitry includes those trip systems that are used to sense the occurrence of an incident. Such circuitry is described and evaluated separately where the incident detection circuitry is common to several systems.

• Other synonymous terms are used throughout the UFSAR, such as trip setpoint, trip setting, nominal setting, nominal trip setpoint and trip level.

-r(H,.,..e;EOFPIPESf'EClflCI:lTtoHcsAIRTRAPIYE::IFIAtNISHEOBYBEtlnEt.TOTlflSPOINT,FUl.NISHI;OBYvEM)ORAFTERTHEPOINtINITIALSBSTEAM---0-TRACEHEATINGOAAINTAIlP,ORAltEA*FlRNlSl-EDWITHASSOCIATEDEOUIPMENTFl.llNlS!-£D9YAPEDfLtlCTlONALI0SEISMICCUISSIMEAl(CtHE"CTlON1Q15EfIONEOOIPM.OWG.ICIltJTlOHoSEEHOTE41c:=:::::>DRA'lI11fGREfERENCEc:::::::sDRAWINGREfEREN:EF'\.tIICTIlJW...I10-51OftA'lIINGCOlJlDlJiATESSEISMICAOEIl"lATEeAPEDClH£eTJONtU48EA*CONTROl.ROODRIVEMISCELLANEOUSABBREV!AT[QNSCROHS-CmlTROLROOHYl)f:IALA.lCSYSTEMHCU-HYORAlI..ICCONtROL"'IfRBCCWS-REACTORBUILDINGCLOSEDCOl1INGWATERSYSTEMTi!:CWS-fURBltEBUILDINCiCLOSEDCOOLING\lAT£ASYSTEMHPCI-HIGHPRESSIAtECOOLANTINJECTION-RESIOUALWEAT"EHOV....AtlC-REACTtJRCOM:ISOLAlIClNCOOlING-LOCl'£OTI<<OTTL[ONI-NORMIIlLTTHAl)TTLEO-fAIl.SASIS-,.AILSOI'EHFC-FAI\.SnOSED-LOCKEDINNEUTRAL11/01.!iQIlliI.TKESYMBOLSSHOWNHEREAREfOAUSEWITHP.UO:SBECH'MI9JTHfiOUCiHMI4q&.MIBOTHROUOHMI8JCM..Y.AEFERTOBECIol-MI1QFORSYMBOLSAHOABBREVIATIONSuSEOONTHEHY/ACP.&.I.0.'5MI59'HROUCHHl1B.2.FORHECIol.,ElECT,AN()HYACOWGS.OFTHEDATAACQUISITIONCENTeRSEEvEHOOAPRINTSA85'!-1i!JlnSERIES.3.SEISMICAOEOUAT[FLAGIHCORPORATEDPER"I.PIPIHc;STflVCTU'lAI.RESTflAINTSOUTSIDETHISSEISMICCLASSIBR£AKMAY8EPIlATOF"THESEISMICCLASSISTRUCTURAl8OU!C1A1!Y..,.VALVESINPAOCESSAUJlIUAAYLINESISEC(N)AATLlNE:SICANaE.SHO\INUSINOHEGATEVAl'l'£$YHBOL.UN.ESSTHEVAlVETYP£15I...-oRTANTTOTl*'RQC£SS.FIGURE7.1-1SH.lREVISION16PIPINGANDINSTRUMENTATIONSYMBOLSDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTPIPINGANDINSTRUMENTDIAGRAMSP."I.o.PIPINGSYHBOLS1'."1.0.INSTRUMENTSYH80LSP.ll.o.INSTRUMENTIOEIHlFlCATleJlS1'."1.0.HAINSTEAM.TUIlBlNESTOPANDCONTROLVALVESP.II.o.HAINSTEAM.HIGHANDLO'olPRES5LflETlItSINESP....D.MAINSTEAM,MOISYURESEPARATOR&.P,a.JD.TUR91NESTEAMSEALSP...I,o.FEEDVATERMEATERSIEeeJA,4A,5AANO6Ap,a.JD,FEEDVATERHEATERSIEeeIA.2AAHOMAIHCO!lDENSERICll97AP."I.o.STEAMAIREJECTOR1'...1.0.rEEDVATERMEAIERS1EeeI9,2SANOMAINCOHQENSEA:£8078P,ll.O.FEEOVAIERHEATERSIEOOJEl.4B,58"NO6BP.&I.o.C(N)/FEEOWAT£AP.lI.o.C(lt()/FEEOWATEA1'.11.0.CCHl/[)[HINSYSTEMPID.C(lt()/OEHINSYSTEM1'0.HAKElf'OEMIHtAAUlE:RSYSTEMP.&ID.liENERAlSERVICEVATERSYST04P.lID.AEACTORBlDGCOOLVATERSYST&!PI.o.RHA:WATERMeEHEllli.SlRvlCEvATER1'.0.NOCLEAABOILERSYSTEMPI,o.REACTORYESSELINSTIIl.M:NTATION1'.&.1.0.REACTORRECIRCULATIONSYSTEMP.ll.O.CQHTROLROODAIVEHYDRAU\.ICSYSTEMP.ll.o.CONTROLROODRIVEHYOAAlA.ICSySTEMP.ll.o.RESIOUALIlEATREMOVALSYSTEMp.lID.AESIDUALREMOVALSYSTE",P.61D.COAESPRAYSYSTEMp.lID.HPCISYSTEMSTEAMSIDEP.lID.NPCISVSTEM....ATERSIDEP.&ID.AtICSYSTEMSTEAMSlOEP."I.D.AClCSYSTEMWATERSlOEP.&ID.STANOBYLlOUIOCONTRCk.SYSTEI>4P.&.I.o.REACTOR\lATERCLEAtu'SYSTEM1'."1.0.REACTOR\lATEAFILTEROEKINP.&.ID.RIVERWATERSUPPLYINTAKESTRLCTUREP.&.I.o.INSTRLlHENTANOSERVICEAIRlICeqeA,BAI<!CCOOLINGSYSTEMP.&.I.o.INSTAlJMEHTN()SERVICEAIRCOI>4PR[SSOASIkeqsA.6M()CP.&I.D.INSfAUHENTANOSERViCEAlACOMPRESSORS\kBIUA,9AAOCP.....D.INSTR\R>1ENTAIRDAn:AS.TUReII'*SLDG.BASEMENT".&.l..D.Ih'STRlNHTAIRSYSTEM.TURBIHE1tLOG.ANDOFFliAS6A[ASp.nD.INSTAt,KHTAIRSTSTEM.BLDG.HEATER!JAYAREA.I't.WHOUSEAREAP.&.'.D.IHS'A\.t1EHTAIRSYSTEM.R{ACHIRBLDG.TORUSROOM.RAOWASTEBlOC.HPCI.ReICAREASP.&.I.o.INSTAl.>>4[NTAlASYSTEM.REACTORIlLOG_R£rU£:LFUXlAHVA(CONTROLS.KIVolAHSp.&.1.0.S[RVICEAlASYSTEMP.ll.o.BREATHINGAIRCOHJ>RESSORSIKe28A.BANDSUl'PLYP.&.ID.TURElIHELUBEon.SYSTE'"P.&.ID.DIESELCENERATORSYSTEMP.&.I.O.[Ce)1STANDBYDIESELGEt£RATORP.&.I.O.Icoe21STANDBYDIESELGENERATOR1'.&.1.0.FIREPROTECTIONP.&.I.0.FIREPROTECTION1'.&.1.0.FIREPROTECTIONHOSESTATIONSP.&I.o.FIREPROTECTIONOELl.CESYSTEMSP.&.I-O.FIREPROTECTIONSYSTEMSP.&.I.O.FUEl.POOlCOOLINGANDCLEAf'AJPSySTEMP."I.D.FUELPOOLFILTERQEMIf.lSYSTEMP.&.I.O.SERVICECOflOEtl$ATESYSTEMp,&I'O,R/lOASTESlM'5YSTEMP.&ID.RAOASTESUMPSYSTEMP.&.ID.EOUIPH[NTRAOWRST[SYSTE'"ICLOSEOlP.&I.D.EOUIPMfNTRAOWA$TESYSTEMICLOSEOlP.".o.FLOORDRAINRAO'IIASTESTSTEM,OPEN*P.&.I.o.RAOWASTE501...105HArlOLESYSTEMP.&.I.o.OFFliASSYSTEMP,&.I.o.CIRCLl.ATlIIjWATERSYSTEHP...I.o.COHTlllf'IoIENTMIolOSPHERECOHTRO.SYSTEM".&.1.0.CONIAI....ENTATMOSPNERECONTROlSYSTEMP.&.I.o.COHlAltfoENTATMOSlH£AECttnRCl.SYSTEM1'.&.1.0.COHTAII*iENTA'HOSPH£RECQ04TROl.SYSTEMP.&I.D.CODLIIo(>WATERSySTEMP...I,o.COOlINGVATERSYSTEMP.&I.o.ElECTROHYORAU.ICFLUIDPO\lEAP.&.I,o.STATORWINCINGcoo...lHGWATERSYSTEMP.&.I.D.GASCONTRa...PIPINGSYSTEMP.lI.O.HYOROGENSEALOILSuPPLYSYSTEMP."I.O.SERVICEWATERSYSfEMPUMPHlIUSE1'.&.1.0.TUR8[NEBUILDINGSAMPLESTSTEM1'."1.0.AREARADIATIONMONITORSYSTEMP."I.O.OFFCASRECCt19INERAlAFLOWDIAGRAMP."I.D.CONTROLBLOC_AN[)TSCAIRfLOW...P.&.I.O.REACTOR8Loo.AIRFLOWDIAGRAMP.&.I,o.TunOINEBLDG.AIRFLOWOIACRAM1'.&1.0.HVI.cR/lOWASTEBLDG.AlAFLO\lOIIlCAAMP."I.O.ADMIN.BLDG,AIRfLO\lDIAGRAMP.&.I.O.ORYW{LLAIRfLOWOIA()RAMp...I.o.OIIYWELLCOOLINGWATEASYSTEM1'.&1.0.ORYW[LLCOOLINGWAfERSYSTEMP.a.T.o.NYACAlAFLOWOIAGRAMSTANDBYCASTREA'M[HTSTSTEM1'.&.1.0,vt:NTSYSTEHTURSINE&LOC,1'.&.1.0.AUXILIARYHEATIMGSYSTENMAINlOOP1',6.1.0.AUXIt.\ARYHEATINGBDILER1'.8-1.0,AlACOflOlT1OHINCSfSTEHCONTROLBLOC.P."I..D.4UXILIMYSYS.REACTOR8LDC.1'.&.,.0.AUXh.IARYHEATINGSYS.TlelNEBUll;.1'.&1.0.YiN'SYSTEMRt\OWASTE0UXi.P."I,o.HAINPLANTAll'INTAKEAI<<)HI;;ROOM1',"1.0.cnul(;AH{It£ATlI<<iSYSTEI1Pl./lHTAIRS\iPP\.Y1'.801.0.ADMIIt.BLDG.KEATINGANDCODLINGSYSTEMPI,o.ADMIN.BLDG.HEATIHOANDCODLINGSYSTEMPI.o.CON'ROLBLOC.tlEATlHGSYSTEM1','1.0.CONTROLBLOC,COOLING-CN[LLEO....ATERSYSTEMp.ll,o.COtnROLBLDG.CHILLERSIYCH"eIAAlIOIVClt091BP...I.o.HVACMISC.CONTAOLSYSTEM1'.&1.0.REACTORBLOC.HVACCDOLINGSYSTEM1'**1.0.AIRfLOWDIAGRAMH[ATI""ANDCOOLINOSYSTEMMACHINESMOP;OI'f(';ASRETENTIONBLDG.P.lI,o.AIRFLOWDIAGRAMSTANDBYFILTERP.&.I,o.ORYWELLHVACfANSYSTEMP.&.I.o.AIRfLOWOIAGRAMPUMPHOUSEP."I.O.REACTORBLDG.EXHAUSTPLENUMANDOFFGASSTACICP,&I.o.AEAC'()1lBLOG.VENTILATIONSYSTEHP.&.I.o.INTAKESTRLC'UREAlj()TSCCONTROlDIACIlAMP.&.I.o.HYAC$YM9OLSAIIO"B8REVIATlOHP.&.'.o.Ct4..0RIHATlOHAp.(}ACIOFEEOSYSTEMP.&.I.o.CONTAIW".ENTATHOS'HEREI>4ONlfDRSYSTEMP."I.D.AAOWASTEEVAPORATORSTSTEMP.6oI.o.A/lOWASTEsAMPt..ESYSTEMP,"I.D.MIlINS'EAMISOLATIONVALVELEAKCONTROl.HSIVp.lI.D,ClIR(JOII.SYSTEHP.&.I.o.AA(lWA$TElINDSTORAa:HIlfj()lINGSYSTEMP.U.O.POSTA[CIO£NTSAI1I'L1NGSYSTEMP...'.o.LO'oILEVELRAQWA.STEHYACSYST[MP.&I,o.LOWLEVEl.RAOWAST'EHYIlCSYSIE)(P."I.b.AIIIFt,.O\lDlACRAMLt.lti"5F1','1.0.AlArLOWDIAGRAMLLRP5FP.&I.o.HYDROGENWATERCt£MISTRYSYSTEMP.".D.HYOROGENWATEACHEMISTRTSYSTEM,CAVSP.&i.D.IINCINJECTIONSYSTEMOECH-MllB(SnBECI1-Hi73BECH-HI?"BECH-M\758ECH-HI?S(1)BECH-11116(2)BECH-HlnBECH-MI1"!BECH-MIt!08ECH-MI81BECH-MI828ECH-MI838ECH-MI848ECH-MIS6BECH-MI87BECH-MI8B<1>BECH-MI89(Z>BECH-MI88(3)8ECN-MI88<4>BECH-MI6't8ECH-H[8q(Z>8ECH-MI8"(J>BECH-"lIJil<e2>BECH-MIJ6H0J>BECH-MIJlH".)BECH-MIJB<es)BECH*MIJIH6G>BECH-MIJiI(lile>BECH-MIseBEeH-HlelBECH-11102BECH-Mle3<1>BECH'Mle3<2>BECH-MIB3(3)BECH'Mle4<1>BECH-MIB4<2>BECH-MIS4<)BECH-Mle5<l)BECH-Mle5<2>BECH-MliI5<J>BECH-HlesBECH-Mle1BECH-Hli8BECN*MI,"BE:CN-H1leBECH-MIIlBECH*MIl2BECH-Mll')BECH-MII4BECH-MIISBECH-MIlGBECH-M1I7BECH*MIIBBECH-Mll'!BECH-MI29BECH-MI21BECH-MI22BECH-MI23BECH*MI24BECH-MI2SBECH-MI2SBECH-HI21BECH-MI2eBECH-MlJe<el>BECI1-MI:)g(lil'l)BECH-MIJlilCllil)BECH'MIJIBECH-MIJ2mBECH-HI32<l>BECH*MlllC'>>8ECH-MIJ)(I)BECH-MIJ3<2>BECH-MIJlC>>BECH-MIJ)<4)8ECH-MI3J<S)BECH-MIJ4BECH-MIJSBECH-MIJGBECH-MI37<1>BECH-MIJ7(2)BECH-MIJ1I(1)BECH-HIJ8(2)BECH-MIJ'IB£CH-MH"llECH*MHIllECtH1I42llECH-MI4)<I)BECH*MI43<2>OECH44(4)(')BECH-HI4)(4)8ECH-HI44<1>BECH-/1144<2>BECH-MI..5<1>BECH'MI45<2>eECH-MI45(3)8£CH-MI45<4>BECH'MI4!>BEeH-MI.?BECH-MI48BECH*MI4<JBECH-11159BECH-MI:llBECH-MIS2BECH'MIS3BECH-MIS4BECH*MI5GBECH-HIS?<1>BECH-MIS7<2>BECH-HI58SECH-MIS'!BECH-MI4ieBECN-MI6Di2>BECH-MIGIIECH-MISZBECH-MIS3BECH-M[S4BECH'MISSBECH-H[66BECH-HI67IECH-MI61BECI1-M[6'1BECH-MIG'I(2)8ECH-MIS'I<J>BEeH'HI?0BECH-Ml718ECH-MI72IoItll"ERCHECK/4*EOLEEOUALIZlt<<;YALYE(iI.OBESTOPCHfCKFLOVCOUROlBALLREHOTEOPERATEDGATElNOflMAlLYCLOSEOlCHECkSAt>><<ADIAPtflAGHO!.tEDEATRIP(iAfErNORMAlLYoPEN)BUTTERfLYDAI1PERORVALVEOL'&[)CCESSFLO\ICHECKSTOPCH£eK'CooJWAYPLUGtt<<lRMIlLLYCLOS£OLEGSliAOEOIlOOTINOICtoTE5CL05EDLEG\MENVALVEISINS£COtIOMYPOSITIONIVAL.VES(NOTE51---1-o..f----0---1k-----K>I------H------te::J------{X}----kJ------6<l------el::J---X-iAPl;O-ATOM[CPO'llER[DUIPM.DEPT.OFC.E.CO.-MEETSAPEDAEO'TSFORtlJCLEARSfRVICE-EOUIPM[NTICLOSEOlAAOIolASTEOR'll-HOORIOPENITE-ACIDWASTEICCFlROSIVE.CAUSTlCl-NORHALWASTElCONVENTlONALl*OILY\lATEA\lASTE:5\1-SANITARY'11IlSTELO*LOCKEDOPENLC-LOCKEDCLOSEO-AIRLOCKSP-SETPOINTlCONTROLIPPS-PlANTP1IOTECTIONSTSTEM*INDICATESDQJlllEPACKEDSTE'"-YCLOSEDNO-NORMALLYOPENHI:-NORMALLYENERGIZEDN.O-NORMALLYOE-EHfRGIZEDIH$U.ATEOCOlJPllttG00VNIOHHU..TlPlEORIFICEELECTRICfI'OliERISl,FPLYFIREHOSESTATlCJolSAIotPlECOOLERSTARrUPSTRAINERSPECTACLEFU'NCE:Kn.Tll'l[MSKflSlfl'lINERFIREHYORAATEXPANSIONJOINTSINGLEBASkETSTRAINER'(-IYP[STRAINERrFLANGEDIlNSUlATINliFLAM:iESAMPLETESTPOINTSYMBOLS--B-QQ£-2-EJECTORORfOUCTORvtlOCAPPENETRATIONHUHeERLINEIDENTIFICATIONHOS[COIfl:.CTIOHtH.C.1PROCESSMiffliNEINCA£A5£R.R£OUCERCONTAINYENTP£NETRAIIOHI$l.EE'i£DIBLINDFlAHGEIB.F.JCLOSEDDRAIHIll.AIEDPIPEPIPIf(iAEDUIRIt(;ST"I4'11fGPERseCTIIIEXTENSIONl)fCLASSBvESSELBOILERCOOEPIPINCPROCESSMJx.L1/<E£XHAUSTHEADSCREWEDCAPoPENOflAINFLHlELFLEKIBLECOlECTlI;J4CONTAINlo9tTPENETRATIONUlOTSlEEVEOIoP£NVENTTOAll-OSPt£fIE1---E-tt----II---OJ-------1)-£--£--£--£-osn1801,.5---II..::....i:--1---<V\/"Vn-1SIZE}...-1,:------o:::::::J--D-SEISMICCLASSIPIPINGSEISMICADEQUATEINSIDE-;:-C)Jr5IOEREV.24BECH-MI00 LINESVARIA8LESCONTROLVALVEBODIESSELF-ACTUATEDDEVICESMISCELLANEOUSPNEUMATICSIGNALHYDRAULICSIGNALDIGITALDATASYSTEM-COMPUTERCONNECTIONTOPROCESS,MECHANICALLINKORINSTRUMENTINPUTNOTE,THESYMBOLSSHOwNHEREAREFORUSEWiTHP&IO'sM-108THOUGHM-14qM-IB0THROUGHM-183ONLY.REFERTOFORSYMBOLSANDABBREVIATIONSUSEOONTHEHVIACPliO',M-150THOUGHM-178.ALARMJI-INSTRUMENTIDENTIFIER(PREFix)J2-INSTRUMENTNUMBERINCLUDING(SUFFIX)J3-NUMBEROfREPRESENTATIONFORBALLOONSSHOWNMORETHA"IONCEONP&.IO',.J4-LOCATIONJ5-FUNCTION*,E.G.5C])J6-OTHERP&IJLOCATIONSWHEREIN5TRUMENTBALLOON15SHOwN'SEEJ3ABOVE'1:1IIILAV(VOLUMr1I00STIR)RELAYSQU...II1lOOT'.XTIACTORHIGHM£...sURIOVAIIIA.LIUL!CTORIFHIGHSIGNA'-ULECTOR"'00(SfGN"'L)lIlONAL110MR-RED<:-GE..'"-SElI£HHlGoH'¢tL(LOW)b'.,"aDJSJ2J6J32.TExTENTRIESAROUNDINS1RUMINTBALLOON0'0(OPt..)PlLOILIGHTS(C.l.OStD)PANELMOUllnDMTl:HIIOAILO*O.......flllItOIiNICTlOHFO.ADDITIONAL1ll...,..'L"Ssirl'A5I-'(f)INTERLOCK-"-(Y41---Ie>NOTES,1.THISDRAWINGISBASEDONTHEINSTRUMENTSOCIETyOFAtlERICASTANDARDNo.55.1-tQS7-<1--(!J..VACUUMIlLIn,Awn'ATlI.",ST'IlINI*D.",r""T.LOADED,O.WITIIINrEnAL"La'PUSSUIf.UII'01"'FETYVALVI,AN6L1,,,rrl.lI.Til"10....1.,NIALIDLINO.DIUPTU.'DISKO.s...nTyHIADFOR'IIUSUIIIILIIPrr""I....TU.rREIU'LATO**FlLLIOIYSTDtTV'IPAUSUnliLli'O.S...FIiTYVALVI,ANGLIM"UII,SPI'N6'01WIIGHT'LOAOEO,OIWITHIIITlUALPILOTLEVI:.LOllFlllEHTIAL-PRlsSUIf*llnu*ClNIRlllULATOIW,TIINAL"'NDunlNALPlnSUIlTA'S....tcPRfSSUn;iUVII.IIGUL...TD."HMrCHANIC...LLINe..."PRESSURE'lIKJu.'-IfOUQIIfUIULAlDtWITHIITUNM.'RUSU.ITA'.ACCPt1USUllrIEGULlTOlIlflTlIIllTfRIIAL'RlSSURIT""PI.SSUIll-KDVCIIMUIUl.Aror.IILF-CO"T"'INlDAUPTUUDISKO.SAFlTvHlAD'01YACUUMIlLl"TEMPERATURE.pUSSUIlIILI.'O'YALYI,STIAII,"'TMIOl*lFmlltUI'Nll'OIWlIllIIt-LOADIO.01WITHINTlIlRAL'ILO'rFLOW</I""IU"---nowREGULArO.5,SEL'-CONTAIN'O(_mlNORn.:at'e&es'5,SVANGI.IFOUR-WAVBALLBunIRFL....DAM'U011LOWI.TNIlII-WAY,.'AIL'05lTION'INCIlV...INIUNCL...UlflID.(TV,r0'lOGYIiWRITTlNINO."'DJlltrNTTo!SYMBOL)NOTE'LIM<<n_V1ILVIlOGYOl'fIOMALDI...PHRAGM,.,IL"'NCIDCI'L'NDU,DDU.LI-ACTIN.,WITH"CTIIATINIPILOT'",ALVI:l,lIpil...........TV..)CVLINon,DOU.LI-ACTINGWITHOUTPILOTHJ,ND",CTU...TOI(Moulino"'TTOPSIOI,OI10nOMOfACTlIATEODIVICIASA""CULI)IUCTRO-HYOIAULICUHCLASS",ID(TV"Of'AnoATO.TO..W.lTTtNAOJACrNTTOTHIS......OL)StlLrNOIDIIS£T(OPTION...L)ACTUATORSGLOIE*GAffOROTHIIIK'LINrTVI'I.NOTOT!tEIWISIIDlNTI'I..'0IIIDICATISFAILO,rN,e,KDIC..TB'ILCLOUDPLI.DICAUS'1LLOC"IDFIINOIC...U\...IN...nIIQT....VMOTa.0'";;;t.TYPICALLYWITIIIt:leTlICII11HAL)C*ILIND..,SI"I"""'"Nll,"'LtoDOUaLr*IICTIN.CYL'"DfRTII_TISw,ntPILOT,sont_T"'<'TUATO.Aln..ILVISAC1UATII.vOlllCOIITIlOLLlDIN'UT-.(><}---4'D-ill---'II()IIPLUG._tv1...J..LFII9o-crvIIOD)PI;[UMATICACTUATO.AI)INOICATESIROPINSAI;,"DICATESCLOUS-Efm-::tpT1-1,.........LEVELGAGEGLA5S.FLOATDRDISPLACEMENT-TYPELEVELIN5TRUMENTGAIGE-BOARD*TYPELEVELINSTRUMENTINTERNALBALL-FLOAI-TyPELEVELINSTRUMENTnDIFFERENTIAL-PRESSURETYPELEVELINSTRUMENTtrnFREa'D1FLANGE-MOUNTEDDIFFERENTIAL-PRESSURETVPELEVELTRANSMITTERf]](LEtTRleAI.CONlllcrlONCONNfGTIONP.OCISSaLOCKVALVISYM.OLOPTIONALQ1'f:L'ILLrDSYSTlH,DlnCTCONNICTION-0-INLINIDIVICI"...,.ATIONOtIIONICSINSIII.lDI...PIl.A6...SIALCONNCCTIONFLOWORIFICEpL...nORIIESTRICTION0.1'1'1ORIpL...nQUICKCH...NCI"TTIN.vrNTUIIITUB!ORFLOWNOZZLITEMPERATUREQPITOTO.PITOTVINTURI(),DTUlIlDUALO.DU"LUI'TIIIIMOCOUJlLIIIIIIMIWILL!'--IXIFLUMI()-o'INGUTHI.NOCOl/PLIi--C::::1-4WIIRII1I0lMALLYUCOIDIO,1""---------10'T10MALLV'""CATIDs-o::J--4TUR.INI-O.'ROPELLER-TY'I(Ji-QSlNGLITHUNOCOUPU,PIIIMAAVIUMINTI".......LULWIIiDROTAMITERO*IN-LINI'N5TA.SUCHAI:IIUI5T..."CITlNP.DITICT,-0-"'...GNITIC'LOWMITI".DISPL...CIMrNT",nl**"'UJLow...n."FLOW516lfT.L"'SSHI-tnow"....'.HTlNIN.V...II1STYPICALCONNECTION-ANYVARIABLECOMPUTERPOINTlOENHFICATIoN(SEEliBL15T-0lIQ.NO.7884-M*mlFUNCTIONALIDENTIFICATIONA-ANALOGC-DIGITALORCONTACTMEASUREDVARIABLE(TEMP..PRESS..ETC.)SEENOTE2FORSTANDARDLOCATIONOFTEXTENTRIESAROUNDINSTRUMENTBALLOONPANELMOUNTEDINSTRUMENTFORSINGLEMEASUREDVARIABLECONTAINMENTISOl.ATlONMONITORINGS'STEM.(PANELlC500)PANELMOUNTEDINSTRUMENTFORTwOt-IEASUREDVARIABLEDRMORETHANONEFUNCTIONLOCALINSTRUMENTFORTwOMEASUREDVARIABLESORMOllETHANONEFUNCTIDNLOCALINSTRUMENTINCLUDINGTRANSMITTERFORSINGLEMEASUREDVARIABLEWATERSUPPLYRADIATIONORSONICSIGNAL(WITHOUTwIRINGORTU8ING'INSTRUMENTAIRSUPPL,GASSUPPLYNITROGENSUPPLYPURGETHEMEANSOFREGULATINGPURGEMAYBESHOWNINPLACEOFPURGESYMBOLINSTRUMENTSlollSAISGISII&.-.sELECTRICSIGNALCAPILLAR,TUBING(FILLEDSYSTEM)DC[J8eta-+---DATAACQUISITIONSYSTEM-SPOAMEASUREDVARIABLESEECHARTDwG.NO.7BB4-M-102SP05POINTIDENTIFICATIONA-ANALOGORCONTACTRtF-MASTERSIGNALLISTy:Jc.e-NT"OL.VAL""."'NL.}"OR.-...,.i.e.0'$HQWN)Po.iITION()NPN,rUIN4TIe.ACTUATO!tDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTPIPINGANDINSTRUMENTATIONSYMBOLSFIGURE7.1-1SH.2BECH-MI01REV.12REVISION12-10/g5 IFIRSTLETTERSECOND&SUCCEEDINGLETTERSSYMBOLDISPLAYDEVICa::*....r.:SENSINGMEASUREDFORINlEGRATING.ALARMINDICATINGRECORDINGBLINDCONTROLSELFFINALSWITCHPRIMARYBLtNOINDICATINGLOCALRELAYORVARIAILEMEASUREDINDICATINGRECORDINGINDICATORSCANIS..Note121VALVEACTUAlEDCONTROL(5"Note6)ELEMENTTRANSMITIERPBSERVATIONTESTCONVERTERMONITORVARIABLESISetNote5)(SeeNote'IELEMENTCONNECTIONLOWHIGHVALVE(S"NoteU)GLASS(BLINOITYI/IalSymbolI)(II1IR(IQI(IJIIIAL(IAHI)AHLIIIC(IRCIICIIV(ICV(IZ(IS(I1IE()TIIITIIG()P1)YI1MAnalySIS15"NOte11AAIARAJ(IMLAAHLAAHLAICARCAtAVALASIIAEATAllAPAYBurnertllmeB81BRBJBALBe*BvB5BtB1BGBPBYConductlYltyCCICRCJ()CALCAHCAHLCICCRCCVCZCSIICECTCITCPCYDensD01DRDJ(JDALDAHDAHLDICDRCDVDZDSDEDOJrDPDYValli11001EEIER£J(IEALEAHEAHLEICERCECEZESIIEEETEI'fEYflOWeeNOIe1111FFIFRfQIfJIIFALFAHFAHLFICFRC,FCfVFCVFZFSI)FEFTnfFGFPFYFlow1110FFFFIFFR.FFJIIFFICFFRCFFCFFVHZIDlmenslonallGGIGRGJf)GALGAHGAHLGICGRCGCGVGZ'GS()GEGTGIT--HIMHHICHCHVHeVHZHS(IcurrentIIIIRIQrIJIIIALIAHIAHLIICIRCICIZISIIIEITmIYPowerJJIJRJQIJJ1IJALJAHJAHLJICJRCJCJZJSIIJEJT---n'rJYTimeKKIKRKQIKJIIKALIKICKRCKCKZKS(IKTKITKYleVILLILRUI,LALlieLHeu;LVLCVLZLSI,ULTL1iLGLP"TMOIstureMMIMRM.MALMICMIICMeMVMZMS(NItMIM1TMpMYUsersChoIce(S"NoteZINToroue001OROJ(IOALOAHOAHLOICORCocOVOZOSIIOEOTOYPressurePPIPRPJ1IPALPAHPAHLPICPRCPCPV""VpL1'5I'tI'TI'llPI'PYPressureDifferentialI'DPDIPDRPOALPOAHPOAHLPOICPORCPDCPDVPOCVPOZposepDTl'II,TQuantityorEventQQIQR001QJIIQALQAHQAHLQICQRCQCQVQZQSIIOTQlrOYfljdlatlonRRIRRRQIRJ()HAlRAMRAHLRICRRCRCRLRSINtKIHITRPRYRIASaeedorFreauellCYSSISRSQISJ(-)SALSAHSAHLSICSRCSCSZSSIISTSiTSYTemlllriture(SE!NOTt:TTITRTJ(ITALTAHMTICTRCTCTVTCVTZTSII1t11I1WTYTemllIratureDillerentlalTDTDIlORTOALTOAH.lOlCTOReTDCTOV.ToevTDZTDSII)ISeeNote8I(S"Note81Multi-VariableUUIURUJIIUAlUAILL:UICURCUCUVlIZUS(IuvViscosityVVIVRVJ(IVALVAHVAHLVICVRCVCVVVZVS(IVEVTVITVYWelgntWWIWRWQIWJIIWALwAHWAHLWICWRCWCWVWZWSIIWIWTWITWYUncllSsllllldISeeNOte4/xxlXI(XJIIXALXAHXAHLXICXRXC*XVXZXS,XtxTxxvX.1MUser'sChoice1511Note21Yvvxv£'PositionZZIZRZJIIZALZAHZAHL71C7RC7CZZZS(IZEZTZITzvGENERALNOlES:(AIAllInstrumentk1entlflCltlonseretIIseduponISAs1Indard"S5.1-1967".ForfurtherdetllllsrefertoISAsllndal'd.IBIWhenspecialdesignationIsrequired,pilotslllllbeIdentIfiedwiththeparticular¥lrllbleletter,followedsecondletter"L".(J)"A"IsusedforalllnalytlCiI¥lrflblll:Forelllmple:02.H2O,CO2,pH,oc:taneImpl'OYemenl,ehrolllitograpllanelyz1n9oneormorestrelmsforoneormorecompounds,boilingpoint,freezingpoint,combustiblesetc.ThelalformularecogniZedsymbol(suchaspHIorIdescriptiondenotingthefunction01tileanllyzershouldbenotedonthe1'&10outsidetheInslrumentsymbol.(ZIAuser'schoiceletterIsIntendedtoc;oyerameaningthatwouldbeusedrepetitivelyInapilrtlcullrproJec:lWhenused,theletterlillyhaveonemllnlngISIfirstletterandanothermNnlngasasuce:eedlngletter.TilemllnlngsneedbedefinedonlyonceInalegend,orotherwisefOrthatproject.Forexample.theletter"N"maybedefinedasturbidityISIfirstletterllIdtelevisionmonitorISIsecondtetter."BN"wouldbeIburnerfl.metelevIsionmonitor..mTheequltlonofdescriptiondenotingthefunction01therelly"Y"shouldbeshownonthePIID.Foreumple:A*8+C+K,LPselector.volumebooster.1"1"X"15usedtorepresentany"specIal"¥lrilblesandlillybedefinedasrequired.Forexample:MissflowrecordersWhichreceiveasignallromImUltiplyingrellywhichcombInestheproductofdensItyInd"ow.ThisItemIsnot10beconfusedwith"U"multl-wrlablesymbol.151Wilen"Q"'IsusedISaSelondorsueteedlnglitterItdenotesInIntegratingmodifier.For,!Xlmple:"FQI"ISanIndicatingflowIntegratorlortotIllzerl.otethltthelntegl'ltlngfunetlonshallbeshownwithseplrateldentlflatlon:FormmplelFQI/FRSorFRlFQIS.161StartupIndshutdowndeYleesareusuallyblind,butl1\Iybedicatingorrecording.1110,Idd"I':or"R"litermeasuredvarllble.Formmple:FIS,TRS.Iftheswlll:hparformsInoffcontrolfunctIon,replace"s""C".Forexample:"FS"becomes"FC".SwitchshillbefurthermodlRed"L"forlowInd"H"for5uffix's'to'HS'etc..m'Clnll.S818ct:ngfco-tul'e.elftheInThedeslgnallon"AJ(f'rnlydenoteIStlnnlnglnalyzerdicator,recorder,transmletc.,usingthedesIgnationAJI,AJR,AJT,etc.,resplictlvely.181"TW'denotesanemplythermowell."Te'denotesathermllWellwitIIthermocoupleorreslslancebulbandheldsultllbleforusewithasecondaryInstrume,1.191PressurereliefvalvlSIndrupturedisksshillbeIdentifiedIS"PSV"and"PSF'respectl"ly.llOl"FO"Isusedtodeslgnltllrestrictionorifice.(INCUDi6llNII'fI'ERS,m.)IllIFordevicesotherthancon:rolvalves,suchIShydraulicCOUll"lings,wrlablespeedetc.(l21High-highalilrmswillbedlslgnlted"(IAHH"andlow-low.Iarms"IIALL".ForIXoImple:LAHHdenotes"hIQll-hlghlevelalarm"..llalLSSi!>uscdtoindic;Itelevelalternator.Whenappliedtotwo'00"CaptlciLypumpsitswitchest.hepur...,.1°9'"tost.artpumpsalter..atel,)'.(1-4-)TUE..STTEIl*.....SHAI.I.BI."£0A$TH[TH/IlP1.[T"rEP,FOP,':EIlAGliTEMPSt'AT"uAfINPICAT/N6AHDI;1t"PL[:TIAW'*ULI)BE"AV"......[TE""PI'RATUAiINDICATO/>.ANDTR,A..JULD'6'"rl'l"IPrRATuRl:....eCORIlEIl.(15.)XV..:W4Mrlt>H,SE...."1fNOTE.'lllolOWNHI!IU!AIZI!Ius!.WITH...,o'eM-IO!>TIHZCUGHM-I"""NOhI-180THIZOUGHMI89!l1!,.11tTOM-1T',.OltfMeOUlAN?ueicONTHI."'v/.....e1""Io'e/>11-IIS0THlZCUGH""-\16.DUANEARNOLDENERGYCENTERrESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTP&ID.INSTRUMENTIDENTIFICATIONBECH-M102REV.9FIGURE7.1-1SHe3REVISION12-10/95 D*XX-'IIMR-OXoPIID!lF1'lJoGIlT:m,l!IIl'IERlilT'lllWmlClDODAIIIROfWTIlIC_TICI1C1VAO..saA!lAllAVIDIDD3S'COHI:-.ClItv,...DACIeinctillieflflCPOFRClIIIIl1wrIT..Il\CIC(ltllllI'£11III'IAClURCHAtCESIDOORIlIIIIll/CT__TGIlAllll'UJfllIlIlTOllAIROPEIiTilI(VALVE..1IIlIPIRlAllSlPPLVC1!IITUEITATIOIIIAIImOLIA'XFlm:liI")III.IJIEMTID)VIL¥!!IALANeINDDAMl'IIl.IACKDWIDAM,..SASIIETSTRAI:ER*CUlSt:OII'IIImIIUI*..CLOI'OIIlEMP1RATUIlUISI*ce:mlPlIiALIIITOItmlllL!I:1ITITEII'EISIlRIIIICIXITnVAL',!C'UMULATOIDATIl""rc"IVINDN"ELECTRICHEATERCGNTACTDRELECTRIC(TDlP1ElNTlCCDN'IERTERPOIIIIISlPPl.VfAILCLOSmOIlUWCOIIIICWIlflllllAMPEllfL'I'!E11'Irn1:tlICAlOROW"ILINlImRMINilnFLlI:I1:lDICATI:.co:nllllLLEIFAILIlPEllJRMIIlRlflCEFLOlililllmH&.VABBREVIATIONSPIMI'ITCItQAT*oursiDiAIRTfMfOAlUMI'YIfRIIfE!IIRIfL'IImESIlGI(LDCATUlIl:I01:1WlS1iITOI6t\llfTMTIA.',IITTUIJlPll0I'ElIIIPmSURfSIlSNIfl!POlmIIlTROPElIIIl!IftRATlIIElISE"10UlS11EP!lSSIRl£IE.'llIlIItTl'lPORTUIE'ITIlFERATI:li11I!'1f1S1'ATltVTflIlIERATUIECQlITIX.VILVEIII!IINI".DW1AlUM......PIfllSllllTTlII101TEPflERATUREDIFFERENTIALIt<<lICATDR'11IM1","IUlIIAL**PCTICCON1IIOWIImlcTEIfIERATlIlEDIFFERENTIAL1t<<lICATINDCDNTRIl.LERHClII"mn0IITIlLLDPatPlEIIIATItCIIII1lOUEII1III1II1F11IlOISTEIfIERATlIlEDIFFERENTIAL1t<<lICATINDSlIITCH_Ie__"'DICA""'_PCVPRESSLllECONTROLVALVEIDATEIfIERATlIlEDIFFERENTIALRECDAlIEA,,1.0HI&HLINITSVITC1tPDtPRESSUREDIFFERENTIALCDNTRDLLERlOSTEIfIERATlIlEDIFFERENTIALSWITCHlimHI&HUIf111'1MSIII'UPOIPRESSlIlEDIFFERENTIAL1t<<lICATDRlOTTEIfIERATlIlEDIFFERENTIALTRAHSHITTERIII1II1TCItPOlSPRESSlIlEDIFFERENTIALIt<<lICATINGSWITCHIETE:ftRAlUlEEll'EITilliTeHIITElI'ElAlURfOllITJlUEIPORPRESSlIlEDIFFERENTIALRECOIIlERTITE'I!UlnlRf1:t!lICATIIltHSlTICHI,TE'fl:lDlCATI:IIOllml'lLUPOTPRESSlIlEDIFFERENTIALTRANSHITTERTICTflIlIERAlURf1:DICATI:liCQlITJUllh'¥VALVEPOTIFIPRESSlIlEDIFFERENTIALTRNlSHITTER..FLOWIIIlICAT111TEJl'ERATlIIE1IE0lRIDPD9PRESSlIlEDIFFERENTIALSWITCH1'1TE'FERATUIiIVITOITTTEJl'ERATlIIETIA.'IlIIITmflDI'lITItnolwcmclELAYIXTEll'WTIIEIMIIIIfOl1TIIClIRIIIIlI1ICATOIIt1M7U!IF:IlNTItnolwcmcSHITOI-"""A"MNIA".....*H,.HfIE!I':IlI\ITItITOIweTN.'IlIIITTBTrTPIESSIIEl:IIlCATIlR(II"_POllYVII.VARIAII1OIIlflCIIJIIPIP!USEIllliU.ATIlR""PIlIUIIAIICUGWTOII¥-XX*1VALVE*(lH\IQliFl-l.-rIlT:fl,1)f00(10IfIVl!ELIEflSlImVALVE(X)PTl'M.'lSIllTTD'I.tP_.....LCLMLCIl:IIRIll.I..,JaM"'M"'PI,....LILMLBlASS(qlIIV*PRTlmsmllDLLCLJfLEVELCO!ITIX.IICfIlADIAnll:JCllUECTl'JIPILlERLDCLXAlJ.Y1I'JI:ImL'll1'Of'I1t'lP!lDS'JRDRCF!:IIADCllUCTI'IIIFILmEUIIIlTLIIILlClOIITlEIAYII!IlADIATI'l:lWlEIITIaPOSlrJlllSVITOILILMLmTOl1111IIWTlVEIUllm)'1:IIIICA1llllLTeLINITlMRATURECG:ITJILRillq"T,\C/lUM,DITY,,,,/nHlIlTUtATlYEHUUDln1RNII'lITm1:lIIICATJlI...1ICIM.11CALII11IIIIIITCl1I!l'lIImIICTII.IIIlflC!RIP.1qIERINCIfflsSLIU"....PlLTIRl1li_Ol'lIlTliIIL....I-L1rlllD(:D*SETPQIiIT'lIlTAnC'1I£SIllIIIIIISIIL\RItmTICll:M'1UISTSlIAlITIlV'ITT*fIT,ltollUl:mlSlISmoIl:IDIVillIDVlL\tPIPINGSYMBOLSDUINFIIINIL-4V'lf-flIXllllCDIII:CTIDIIDIAWlNG_*.I'D"CUIW'CICT"...DMf""M'NllJlMr'culAN.ITA""**.CU*"Oll(l)Ali'aaut*AII.(I).DUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORT.Jm&.i.I.SYIeOLSSI'OWNONTHISDRAWINGARETOBEL6EDWIlHDRAWINGS"*IeelTHROUGH/.I-IlIANOM-IS8SHTIf2ONLYr.ALI.AUlOMATlCHlVVALVUAUSHOWN.INPI-lNIRaiZIDORIIlfllESSUl-'IzmCONDITION.,.FOIlADDITIONALINSTIIUMS<<STMlClSSBM-IILCoCfM'1INDICATINGAPFIlOllIMATIAIRR.OWTHiDlIlIILIlCOtIIROlWlOP!JtoINGSIta.,STAIIMAVI,IIITCIIIS,DC.)SIllRIININtil"ID'SANDourORAWIHOSAUTOIllISEDFOIIIIFfIlfM:EONLY10THITOIALSYSlIMAIUALANCtTHIARIlOlISDESIDNATlTIIDIRICTIDNOfAIRR.OW.**1'OItI1cc".,NC.IWO..c*.,wo,_'OlfTHeD",A"'MrIM,Ire".NQOIf'If'itO.'.00/.FIGURE7.1-1SH.4P&IDHEATING,VENTILATING&AIRCONDITIONINGH&VSYMBOLSANDABBREVIATIONSH&VAIRFJ.9W&P&IDI1'4)EXLGlo/."51l!Au",,,nl'Ma,I'"N&VLNIfAIRrtDWDIAGllMICONTROLlIDO.AIRfLOWDIAIRAMREAClDIiIDO.AIRPlDWDIAlRAMTUlIIMlIIDO.AIIIFIllWDIMRAMRAOWAmlIDO.AIRRDWDIAOIIMIADMINISIIIATTONlIDO.AIRFLOIlDIAIRAMDR'/IILI.AIRfLOWDIAilRAMDIIYWILI.CODLINGIIjAIDIYSTIMSTANDlYOASIIIAMN1'IYSIIMCODLlNIIlWAlIR..vt:NI'ILATlOIIIYmM-T11I1M1IUllOINGIYSlIM-IOILD.MAl"lOOP1IA1INGANDNCIYSlIM-COIllROLIUllOlNIIIIArINOsvmM-IIAClO11IU1lOINIl1E..rINDIYSlIM-TUIIIIIEIUILDINGIIA1'INGAHlINCIYmMUJlWAS1fILDI.MAIN'LANTAIRINIAIINflII.I.ROOMIEAI'INGAHlICOOLINGSTSlIM-PLANTAllSIP'LYMIMINGANDCOOLINGSTSlIM-ADMINISTIIATIOIlILDI.IIA1'INIIMIllCOOLINGSTSlIM-ADMINISTIIATIDIIILDI.C"IWDNflIIAfINGWAIDIYSlIM-CONIIIDLILDI.INACoMIIe.CONTROLSTmMCOOLINGWAIDSTS1IM-RlACIOIIIUIIllINIIIIA1'ING*COOLINGSYSTEM-MACHIMISItOP,OPJ-OAIRmNrlONlIDO.*R.II.fNllANCISTNflIYFlLIIRIIlIT-CONIIIOI.IUILDINGDRYMUfANSTSIfM"IDIAIRrtDWDIAGlIMIPlIoV'NIIL1S1"ID.AClDRILDO**OfF-lIASSfa'IIlITl¥SlIM101'30"°11,INAl:-MIs't':"CiiNfioLST.,...HIVSYMMLS..AlIUVIATIDNS"NVwINT.11MoUDMo"1MolllMoI'I...1MMol.Mo'"Mom...DI.'"****1.111..........1'1Mo....W.......""M*IID**\71,:...171:M*\71':.IM...\IlI:Moln.Mour""Ill'MoutCIIANIlI(}IIPlPIII'IClflCAlIDIIf\lllIIIIDWITHAlSOCIAlIDBlUIPMDlI'.,..ISIIOIYIICHIIL10'""POINT'ISIIDIIDDIIIWRIllISPOINrII::....,,'"H&.YSYMBOLSf.'ATYAL\!IHIONDFICIINCVPMTlCWll:DA.VALVIIROUONINGPlL1IIlAIRGI'A1flL1TIIIlIlIlMALLYOl'lltDAIIVALVItlDllMAlLYCIllSRIll.OIlVALW00'MAUlLllAIlIDAMfIIdhriAlDAMPlllll'OllNDuCTC.'VALWemNOTIIII00'UllVAlVII.cURAfTDAMPEROPPOSRILAIlIDIMl'IIDIIVALW-SIALANCINIIDAMPER-,IDI1111'"DIllYVALVII@:CIRCUITSETTlI'Ill.tS,""VRmIITDCIRCUliSOIS011(SIllVMIAlIIINllTVANlS-IOlllIIIDVALVIIclJIIlNAUITIIlITUllNAIIlIlfIlITD1IlIIIlAIIIIIII.H.'l1liOWIRItI;IIIOTWAIIRORiUeTRlC!IPlSlaNATJONSt:-:{)-UlRICRIIAYIYSIIM...tllACK1010°I\ESETS1I!ITCHC*CGlILiNG"*HIATINOfllUMATICOfUA1llIII.He*IIAJIIIO.CllOI.INGmlNDIII,*'IIIIIATR*RlIlATI*lumlCf:r._,..m.POSTTltllIlIEf?**--¢--a:J----LT--w---H--4J----1'r---iOI--r1-DUWINGCODIIDINATlII1IICTIONAlSlISMICCUSSIIMAIlV*MI!SlIIAI..fUNIlIDImMllU'AlIX.LN0fIIINDRMALWAS1IINIIAIR\INI'CIIIfIAIItIIIII'PUITIIATIDNISLlNDttI,eIeSTAITIPSIIAIIDIrcawtowl-ItJ...*-+rr.=="Z1IICWIL1MllINIlPICAfIOll:..u--IllAl'IIe00CGOLINIIBECH-M17QREV.12REVISION14-111Qa INPUT(IFNOTTHESTARTINGPOINT)INPUT-ILOCATIONSEALINOUTPUTRESETDEVICESIGNALPRES£NT\01101COHOITIONDESCRIBEDWITHINTHEa.OCKEXISTS.OUTPUTINITIATINGDEvlCrACTUATEDBYPHYSICALCONDITIONSIGNAL/SPRESENT'oMENCONDITIONISDESCRIBEDWITHINTHEBLOCKEXISTS.OUTPUTAUXINPUTOROUTPUTSIGNALIDENTIFICATIONNO.ClH1ANDBLOCKTHISBLOCKCANREPRESENTASWITCH,VALVE,PROBE,TIMER,ORTRIPCIRCUIT.ITISNORMALLYTHESTARTINGPOINTOFAFUNCTIONALSEQUENCEWITHANOUTPUTONLY,BUTCANHAVEINPUTANDAUX.INPUTDEPENDINGONTHETYPE0,DEVICE.THESAMEDEVICEMAYHAVEAOUTPUTS,BUTEACH,UNCTIONALSEQUENCEINITIATEDSHALLBESHOWNBYANINDIVIDUALBLOCKSHOWINGTHESAMEIDENTI,ICATIONNUMBER.PERMISSIVECONDITIONBLOCKWHERETHEPERMISSIVE19AGENERALCONDITIONAHPNOTIDENTIFIEDWITHASINGLEDEVICETHEOUTPUTSENCLOSUREONLYISSH<MISEAL-INBlOCKASEAL-INORLATCHINGBLOCK'S,UNCTIONISTOMAINTAINANINPUTSIGNALTOADEVICEONCETHEDEVICEHASBEEN'ACTUATED.RESETTINGORINHIBITINGASEAL-INBEEITHEREXPRESSEDORIMPLIED.IFIMPLIED!..THESEAL-INWILLBERESETORINHIBITEDBYINTERRUPTINGTHESIUNALTOTHEDEVICE"OO,"",STREAM',ROMTHEPOINT'oMERESEAL-INISINDICATED.ASEAL-INSHOWNWITHOUTARESETDEVICEIMPLIESTHATTHERESETDEVICEISPARTO,!ANDLOCATEDONTHENEARESTVALVEORCONTACTOR.INALLCASESTHERESETDEVICESHALLBESHOWNINCONJUNCTIONWITHTHESEAL-IN.CONTROLLED,DEVICEORMtCHANISMLOCATiONTYP.Of'MECH.OUTPUTORMECH.LINKAGE.INPUTLINESA<;SOCIATEDWITHLOGrcSYMBOLSfiNALDEVICEBLOCKTHISBLOCKCANBEARELAY,VALVE,ELECTRO-MECHsw.ETC.NORMALLYITHASONLYINPUTS,BUTCANHAVEMECHOUTPUTSORPOSITIONSWITCHOUTPUTS.'IDENTIFICATIONNO.AUXl..--INPUTINPUTOROUTPI.:TINPUTOROUTPUTLOCATIONINPUTOUTPUTPERMISSIVEOPERATEDBYOTHERDEV+CESBLOCKTHISBLOCKISAPERMISSIVEOPERA£DBYDEVICESSUCHASVALVEORPUMPSWITCHGEARDESIGNATEDINTHEINNERBLOCK.THISCOND.ORDEVICEE"ECTSTHEOPERATIONOFTHE,INALDEVICE.ITHASELECT.INPUTS,INPUTS,AUXINPUTS(MECHORELEC)ANDMECHORELECTOUTPUTS.THISDEVICEISNORMALLYAVALVE.THISISALSOUSED,OROTHERINPUT/OUTPUTPOWERSOURCESSUCHASAIRORHYDRAULIC.ASOLENOIDPILOTVALVEFORANAIROPERATEDVALVEISANEXAMPLE,Of'THISTYPEDEVICE.AUXINPUTLOCATIONLP*CR*CONTROLROCJoILOCAL.MOUNTEDLOCALLYNOTE-FORRMS&CONTROL9'ITCHESSHOWNINONEPOSITIONONLY,ANXINTHELOCATION0,OTHERPOSITIONSINDICATESTHATTHEIRBLOCKSAREANINTRICATEPARTOf'THENUMBEREDSWITCHASSEMBLYfBUTADI"ERENTPOSITION0,HESWITCHHANDLE.---\----PERMISSIVEDEVICESIGNALPRESENT,'oMENDEVICEPERMISSIVEOUTPUTINPUTIDENT!nCATIONNUMBER.DEVICEBLOCKtHISBLckoErlNSAPERMISSIVE,UNCTION'oMICHMUSTBESATIS,IEDTOPERMITTHESIGNAL,LOWTOPASSTOTHENEXTBLOCK.THISBLOCKHASINCOMING,OUTGOINGANDMAYHAVEAUXILIARYSIGNALS.THEOUTPUT,ROMTHISPERMISSIVEMAYBESEALEDIN.ELECT.,LOWSIGNALAUXILIARYSIGNALSOURCESUCH..,,-I.>ENERGYCENTERLIGHT&POWERCOMPANYSAFETYANALYSISREPORTDUANEARNOLDIOWAELECTRICUPDATEDFINAL---------+oMECHANICALLINKAGEMATCHCIRCLETHISCIRCLEDESIGNATESTHATTHELINECONNECTEDTOITISCONTINUEDTOANOTHERLOCATIONOFTHESAMEFIGURE.THELINECANBEFOLLOWEDFROMACIRCLEWITHTHECORRESPONDINGMATCHLETTERONTHEDESIGNATEDFIGURESHEET.MATCHLETTERSHEETNO._YYZZIFAREFERENCENUMBERISINDICATEDHERETHELINEISCONTINUEDTOTHATREFERENCEFIGURE.IFNOREFERENCE'ISDESIGNATEDTHEMATCHCIRCLECANBEFOUNDONTHESAMEFIGURE.LogicSymbolsUsedonFunctionalControlDiagramsFigure7.1-2 UFSAR/DAEC-1 7.2-1 Revision 17 - 10/03

7.2 REACTOR

PROTECTION SYSTEM

7.

2.1 DESCRIPTION

7.2.1.1 System Description

7.2.1.1.1 Identification

The reactor protection system (RPS) includes the motor-generator power supplies, sensors, relays, bypass circuitry, and switches that cause rapid insertion of control rods (scram) to shut down the reactor. The RPS is designed to meet the intent of the Institute

of Electrical and Electronic Engineers (IEEE) Proposed Criteria for Nuclear Power Plant Protection Systems (IEEE-279). The process computer system and annunciators are not part of the RPS. Although scram signals are received from the neutron monitoring system, this system is treated as a separate nuclear safety system in Section 7.6.1. The ATWS-RPT/ARI System is not considered to be a part of the reactor protection system; it is a back up to that system.

7.2.1.1.2 Power Supply

Power to each of the two reactor protection trip systems is supplied, via a separate bus, by its own high-inertia, flywheel, ac-ac motor-generator set (see Figure 7.2-1, Sheet 1). The inertia is sufficient to maintain voltage and frequency within 5% of rated values for at least 1.0 sec following a total loss of power to the drive motor.

Alternate power is available to either RPS bus from an electric bus that can receive standby electric power. The manual transfer switches prevent simultaneously feeding both buses from the same source. The switches also prevent paralleling a motor-

generator set with the alternate supply.

The backup scram valve solenoids receive dc power from the plant batteries.

The DAEC has installed General Electri c (GE) designed electrical protection assemblies (GE No. 914El75) to monitor the el ectric power in each of the three sources of power (RPS M-G sets A and B, and the alternate source) to the RPS. The electrical protection assemblies detect any abnormal output failure of the power sources and after a time-delay trip either one or both of the two Class 1E protective packages. The tripping would interrupt the power to the affected RPS channel, producing a scram signal on that channel, while retaining full-scram capability by means of the other channel. This system provides fully redundant Class 1E protection in conformance with General Design Criterion (GDC) 2, seismic qualification; GDC 21, single-failure criteria; and IEEE-279-1971.

UFSAR/DAEC-1 7.2-2 Revision 13 - 5/97 Each pair of electrical protection assemblies consists of two identical and redundant packages that include a circuit breaker and a monitoring module. When abnormal electric power is detected by either module, the respective circuit breaker will trip (after a time delay) and disconnect the RPS from the abnormal power source. The monitoring module detects overvoltage, undervoltage and under frequency conditions and provides the time-delayed trip when a setpoint is exceeded. The maximum time delay will be less than or equal to 3.8 seconds, allowing for an assumed maximum breaker opening time of 0.2 seconds. Consequently, the RPS will be disconnected from the abnormal power supply within 4.0 seconds as allowed by Reference 7. The Technical Specifications provide the setpoints and surveillance and testing requirements.

The electrical protection assemblies have been fully qualified by GE to the following criteria:

Temperature 40 to 137°F

Relative humidity 10 to 95%

Seismic 5.0g operating-basis earthquake

7.0g design-basis earthquake

1 to 33 Hz, frequency spectrum

These testing conditions exceed the DAEC requirements. IEEE 323-1974 and

344-1975 were used as testing guidelines.

The electrical protection assemblies input and output power and instrumentation cables are routed independently and in separate conduit or cable trays to meet the divisional requirements of IEEE-384 a nd Regulatory Guide 1.75. The following separation criteria were used during installation:

Minimum vertical separation 3 ft

Minimum horizontal separation between any two electrical protection assemblies in series with any other series of two electrical protection assemblies 3 ft

7.2.1.1.3 Physical Arrangement

Instrument piping that taps into the reactor vessel is routed through the primary containment wall and terminates inside the secondary containment (reactor building). Reactor vessel pressure and water-level information is sensed from this piping by UFSAR/DAEC-1 7.2-3 Revision 17 - 10/03 instruments mounted on instrument racks in the reactor building. Valve position switches are mounted on valves from which position information is required. The sensors for RPS signals from equipment in the turbine building are mounted locally. The two motor-generator sets that supply power for the RPS are located in an area where they

can be serviced during reactor operation. Cables from sensors and power cables are routed to two RPS cabinets in the control room, where the logic circuitry of the system is formed. One cabinet is used for each of the two trip systems. The logics of each trip system are isolated in separate bays in each cabinet. The RPS is designed as Seismic Category I equipment to ensure a safe reactor shutdown during and after seismic

disturbances.

7.2.1.1.4 Logic

The basic logic arrangement of the system is illustrated in Figure 7.2-2. Each trip system has three logics, as shown in Figure 7.2-3. Two of the logics are used to produce automatic trip signals. The remaining logic is used for a manual trip signal. Each of the two logics used for automatic rip signals receives input signals from at least one channel for each monitored variable. Thus, two channels are required for each monitored variable

to provide independent inputs to the logics of one trip system. At least four channels for each monitored variable are required for the logics of both trip systems.

As shown in Figure 7.2-3, each actuator associated with any one logic provides inputs into each of the actuator logics for the associated trip system. Thus, either of the two automatic logics associated with one trip system can produce a system trip. The logic is a one-out-of-two arrangement. To produce a scram, the actuator logics of both trip systems must be tripped. The overall logic of the RPS could be termed one-out-of-

two taken twice.

7.2.1.1.5 Operation

To facilitate the description of the RPS, the two trip systems are called trip system A and trip system B. The automatic logics of trip system A are logics Al and A2; the manual logic of trip system A is logic A3. Similarly, the logics for trip system B are logics Bl, B2, and B3. The actuators associat ed with any particular logic are identified by the logic identity (such as actuators B2) and a letter (see Figure 7.2-3). Channels are identified by the name of the monitored variable and the logic identity with which the

channel is associated (such as reactor vessel high-pressure channel Bl).

During normal operation, all sensor and trip contacts essential to safety are

closed; channels, logics, and actuators are energized. However, in contrast, trip bypass channels consist of normally open contact networks, as does the backup scram circuitry.

There is a dual solenoid coil scram pilot valve and two scram valves for each control rod, arranged as shown in Figure 7.2-1, Sheet 1. Each scram pilot valve is UFSAR/DAEC-1 7.2-4 Revision 17 - 10/03 solenoid operated, with the solenoids normally energized. The scram pilot valves control the air supply to the respective scram valves for each control rod. With either scram pilot valve energized, air pressure holds the scram valves closed. The scram

valves control the supply and discharge paths for control rod drive (CRD) water. One of the scram pilot solenoids for each control rod is controlled by actuator logics A, the other valve by actuator logics B. There are two dc solenoid-operated backup scram valves that provide a second means of controlling the air supply to the scram valves for all control rods. The dc solenoid for each backup scram valve is normally deenergized. The backup scram valves are energized (initiate scram) when both trip system A and trip system B are

tripped.

The functional arrangement of sensors and channels that constitute a single logic is shown in Figure 7.2-1, Sheet 2. A schematic is included as Figure 7.2-2. Whenever a

channel sensor contact opens, its sensor relay deenergizes, causing contacts in the logic to open. The opening of contacts in the logic deenergizes its actuators. When deenergized, the actuators open contacts in all the actuator logics for the trip system. This action results in deenergizing the scram pilot valve solenoids associated with that trip system (two scram pilot valve solenoids for each control rod). Unless the other scram pilot valve solenoid for each rod is deenergized, the rods are not scrammed. If a

trip then occurs in any of the logics of the other trip system, the remaining scram pilot valve solenoid for each rod is deenergized, venting the air pressure from the scram

valves, and allowing CRD water to act on the CRD piston. Thus, all control rods are scrammed. The water displaced by the movement of each rod piston is vented into a scram discharge volume. Figure 7.2-1, Sheet 1, shows that when the solenoid for each backup scram valve is energized, the backup scram valves vent the air supply for the scram valves; this action initiates the insertion of every control rod regardless of the action of the scram pilot valves.

A scram can be manually initiated. There are two scram buttons, one for logic A3 and one for logic B3. Depressing the scram button on the logic A3 deenergizes actuators

A3 and opens corresponding contacts in actuator logics A. A single trip system trip is the result. To cause a manual scram, the buttons for both logic A3 and logic B3 must be depressed. The manual scram buttons are close enough to permit one hand motion to cause a scram. By operating the manual scram button for one manual logic at a time, followed by the reset of the logic, each trip system can be tested for manual scram capability. It is also possible for the plant operator to scram the reactor by interrupting power to the RPS by one of five means: keylock channel test switch, panel breaker, distribution box breaker, EPA breakers, or RPS motor-generator set.

To restore the RPS to normal operation following any single trip system trip or scram, the actuators must be manually reset. After a 10-sec delay, reset is possible only if the conditions that caused the scram have been cleared and is accomplished by operating switches in the control room. Figure 7.2-1, Sheet 2, shows the functional arrangement of reset contacts for trip system A.

UFSAR/DAEC-1 7.2-5 Revision 17 - 10/03 Whenever an RPS sensor trips, it lights a printed red annunciator window, common to all the channels for that variable, on the reactor control panel in the control room to indicate the out-of-limit variable. Each trip system lights a red annunciator window indicating the trip system that has tr ipped. An RPS channel trip also sounds an audible alarm that can be silenced by the operator. The annunciator window lights latch in until manually reset; reset is not possible until the condition causing the trip has been cleared. A computer printout identifies each tripped channel; however, the physical positions of RPS relays may also be used to identify the individual sensor that tripped in a group of sensors monitoring the same variable. The location of alarm windows provides the operator with the means to quickly identify the cause of RPS trips and to evaluate the threat to the fuel or nuclear system process barrier.

To provide the operator with the ability to analyze an abnormal transient during which events occur too rapidly for direct operator comprehension, all RPS trips are recorded by an alarm printer controlled by the process computer system (Section 7.7.4.7.2.2). All trip events are recorded. The use of the alarm printer and computer is not required for plant safety, and information provided is in addition to that immediately available from other annunciators and data displays. The printout of trips is particularly

useful in routinely verifying the proper operation of pressure, level, and valve position switches as trip points are passed during startups, shutdowns, and maintenance

operations.

Reactor protection system inputs to annunciators, recorders, and the computer are arranged so that no malfunction of the annunciating, recording, or computing equipment can functionally disable the RPS. Signals directly from the RPS sensors are not used as inputs to annunciating or data logging equipment. Relay contact isolation is provided between the primary signal and the information output.

7.2.1.1.6 Mode Switch

A conveniently located, multiposition, key-lock mode switch is provided to select the necessary scram functions for various plant conditions. In addition to selecting scram functions from the proper sensors, the mode switch provides appropriate bypasses. The mode switch also interlocks such functions as control rod blocks and refueling equipment restrictions that are not considered here as part of the RPS. The switch itself is designed to provide separation between the two trip systems. The mode switch positions and their related scram functions are as follows:

1. SHUTDOWN - Initiates a reactor scram; bypasses main steam line isolation scram.

2. REFUEL - Selects neutron monitoring system scram for low neutron flux level operation (Section 7.6.1); bypasses main steam line isolation scram.

3. STARTUP - Selects neutron monitoring system scram for low neutron UFSAR/DAEC-1 7.2-6 Revision 17 - 10/03 flux level operation (Section. 7.6.1); bypasses main steam line isolation scram.

4. RUN - Selects neutron monitoring system scram for power range operation (Section 7.6.1).

7.2.1.1.7 Scram Bypass

A number of scram bypasses are provided to account for the varying protection requirements depending on reactor conditions and to allow for instrument service during

reactor operations.

Some bypasses are automatic, others are manual. All manual bypass switches are in the main control room, under the direct control of the plant operator. The bypass status of trip system components is continuously indicated in the main control room.

Automatic bypass of the scram trips from main steam line isolation is provided when the mode switch is not in RUN.

The bypass allows reactor operations at low power with the main steam lines

isolated. This condition exists during certain reactivity tests during refueling; additionally, it is an available but seldom-used method of reactor startup.

The scram initiated by placing the mode switch in SHUTDOWN is automatically bypassed after a time delay of 2 sec. The bypass is provided to restore the CRD hydraulic system valve lineup to normal. An annunciator in the main control room indicates the bypassed condition. An automatic bypass of the turbine control valve fast-closure scram and turbine stop valve closure scram is effected whenever the turbine first-

stage pressure is less than a preset fraction of rated pressure corresponding to approximately 26% of rated core power. The closure of these valves from such a low initial power level does not constitute a threat to the integrity of any barrier or to the release of radioactive material. Bypasses for the neutron monitoring system channels are described in Section 7.6.1. A manual key-lock switch located in the control room permits the operator to bypass the scram discharge volume high-level scram trip if the mode switch is in SHUTDOWN or REFUEL. This bypass allows the operator to reset the RPS so that the system is restored to operation while the operator drains the scram discharge volume. In addition to allowing the scram relays to be reset, actuating the bypass initiates a control rod block. Resetting the trip actuators opens the scram discharge volume vent and drain valves. An annunciator in the main control room indicates the

bypass condition. UFSAR/DAEC-1 7.2-7 Revision 17 - 10/03 The following overrides are used in support of the Emergency Operating Procedures (EOPS) in lieu of jumpers and lifted leads.

1. RPS Auto Scram Logic Trip Defeats.

Four (4) key-lock switches are installed; one for each automatic channel of RPS (Al, A2, Bl & B2). Each switch has an associated amber light and individually annunciates on front panel 1C-14 when taken to override. In addition, a separate amber light illuminates on panel 1C-05 when each switch is taken to override. These defeat switches permit the operator to reset a scram under conditions when the reactor is not fully shutdown (ATWS), but existing scram signals (such as high drywell pressure) continue to generate an automatic scram signal.

The locking brass handle switches are unique from others at DAEC and are only used for override functions associated with the EOPS. These switches are similar to

other brass handled keylock switches, but have a longer handle and are keyed differently. This provides additional administrative controls over their use. The switch action of this model is a two-position key switch with the key being removable only in

the left (counterclockwise) position. The override function is enabled only in the right (clockwise) position. Therefore, the key cannot be removed from the switch while the switch is in the override position, which enhances the administrative control aspects of the override feature. All keys required for deliberate override of safety systems are under the direct control of the Control Room Supervisor.

7.2.1.1.8 Wiring

Wiring and cables are selected to avoid excessive deterioration due to temperature and humidity during the design life of the plant. Cables and connectors used inside the primary containment are designed for continuous operation at an ambient temperature of 150°F and a relative humidity of 99%. Additional information on environmental

qualification of cables and wiring can be found in Section 3.11.3.

Cables required to carry low-level signal currents of less than 1mA or voltages of less than 100 mV are designed and installed to eliminate, insofar as practical, electrostatic and electromagnetic pickup from power cables and other ac or dc fields; ferromagnetic conduits or totally enclosed ferromagnetic trays are used.

Low-level signal cables are routed separately from all power cables with a minimum separation of 3ft. Where the low-level signal cable runs at right angles to a power cable, a separation distance of less than 3ft may be used, based on the probable

noise pickup relative to the allowable signal-to-noise ratio.

Wiring for the RPS outside of the enclosures in the control room is run in rigid metallic conduits used for no other wiring. UFSAR/DAEC-1 7.2-8 Revision 13 - 5/97 The wires from duplicate sensors on a common process tap are run in separate conduits. Wires for sensors of different variables in the same RPS trip logic may be run in the same conduit.

The scram pilot valve solenoids are powered from eight trip actuator logic circuits: four circuits from trip system A and four from trip system B. The four circuits associated with any one trip system are run in separate conduits. One trip actuator logic circuit from each trip system may be run in the same conduit; wiring for two solenoids on the same control rod may be run in the same conduit.

Electrical panels, junction boxes, and components of the RPS are prominently identified by nameplate. Circuits entering junction boxes or pull boxes are conspicuously marked inside the boxes. Wiring and cabling outside cabinets and panels are identified by color, tag, or other conspicuous means.

7.2.1.2 Design-Basis Information

7.2.1.2.1 Safety Objective

The RPS provides timely protection against the onset and consequences of conditions that threaten the integrity of the fuel barriers (uranium dioxide sealed in cladding) and the nuclear system process barrier. Excessive temperature threatens to perforate the cladding or melt the uranium dioxide. Excessive pressure threatens to rupture the nuclear system process barrier. The RPS acts to limit the uncontrolled release of radioactive material from the fuel and nuclear system process barrier by terminating excessive temperature and pressure increases through the initiation of an automatic scram.

7.2.1.2.2 Safety Design Bases

1. The RPS initiates with precision and reliability a reactor scram in time to prevent fuel damage following abnormal operational transients.

2. The RPS initiates with precision and reliability a scram in time to prevent damage to the nuclear system process barrier as a result of reactor pressure. Specifically, the RPS initiates a reactor scram in time to prevent nuclear system pressure when augmented by safety relief valves from exceeding the nuclear system pressure allowed by applicable industry

codes.

3. To limit the uncontrolled release of radioactive materials from thenuclear system process barrier, the RPS initiates with precision and reliability a reactor scram upon gross failure.

UFSAR/DAEC-1 7.2-9 Revision 13 - 5/97 4. To provide assurance that conditions which threaten the fuel or nuclear system process barriers are detected with sufficient timeliness and

precision, RPS inputs are derived, to the extent feasible and practicable, from variables that are true, direct measures of operational conditions.

5. To provide assurance that important variables are monitored with precision, the RPS responds correctly to the sensed variables over the expected range of magnitudes and rates of change.

6. To provide assurance that important variables are monitored with precision, an adequate number of sensors are provided for monitoring

essential variables that have spatial dependence.

7. The following bases provide assurance that the RPS is designed with sufficient reliability:

a. No single failure within the RPS prevents proper action of the RPS.

b. Any one intentional bypass, maintenance operation, calibration operation, or test to verify operational availability will not impair

the ability of the RPS to respond correctly.

c. The system is designed for a high probability that when the required number of sensors for any monitored variable exceed the scram setpoint, the event will result in an automatic scram and will not impair the ability of the system to scram as other monitored variables exceed their scram trip points.

d. Where a plant condition that requires a reactor scram can be brought on by failure, or malfunction of a control or regulating system, and the same failure or malfunction prevents action by one or more RPS channels designed to provide protection against the unsafe condition, the remaining portions of the RPS will meet the requirements of safety design bases 1, 2, 3, and 7a above.

e. The power supply for the RPS is arranged so that the loss of one supply neither causes nor prevents a reactor scram.

f. The system is designed so that once initiated an RPS action goes to completion. Return to normal operation after protection system

action requires deliberate operator action.

UFSAR/DAEC-1 7.2-10 Revision 13 - 5/97 g. There is sufficient electrical and physical separation between channels and between logics monitoring the same variable to prevent environmental factors, electrical transients, and physical events from impairing the ability of the system to respond correctly.

h. Earthquake ground motions will not impair the ability of the RPS to initiate a reactor scram.

8. The following bases are specified to reduce the probability that RPS operational reliability and precision will be degraded by operator error:

a. Access to all trip settings, component calibration controls, test points, and other terminal points for equipment associated with essential monitored variables will be under the control of plant

operations personnel.

b. The means for manually bypassing logics, channels, or system components will be under the control of the plant operator. If the ability to trip some essential part of the system has been bypassed, this fact will be continuously annunciated in the main control room.

9. To provide the operator with means independent of the automatic scram functions to counteract conditions that threaten the fuel or nuclear system process barrier, it is possible for the plant operator to manually initiate a reactor scram.

10. The following bases are specified to provide the operator with the means to assess the condition of the RPS and to identify conditions that threaten the integrities of the fuel or nuclear system process barrier:

a. The RPS is designed to provide the operator with information pertinent to the operational status of the protection system.

b. Means are provided for prompt identification of channel and trip system responses.

11. It is possible to check the operational availability of each channel and logic.

12. In addition to safety design bases 1 through 11 above, the RPS conforms to IEEE-279-1971 (except Section 4.17). In case of conflict, IEEE-279

shall prevail.

7.2.1.2.3 Scram Functions and Trip Settings

UFSAR/DAEC-1 7.2-11 Revision 13 - 5/97 The following discussion covers the functional considerations for the variables or conditions monitored by the RPS. Table 7.2-1 lists the specifications for instruments providing signals for the system. Figure 7.2-1, Sheet 2, shows the scram functions in block form.

Neutron Monitoring System Trip

To provide protection for the fuel agains t high heat generation rates, neutron flux is monitored and used to initiate a reactor scram. The neutron monitoring system setpoints and their bases are discussed in Section 7.6.1.

Figure 7.2-4 clarifies the relationship between neutron monitoring system channels, neutron monitoring system logics, and the RPS logics. The neutron monitoring system channels and logics are considered part of the neutron monitoring system. As shown in Figure 7.2-5, there are four neutron monitoring system logics associated with each trip system of the RPS. Each RPS logic receives inputs from two neutron monitoring system logics.

Each neutron monitoring system logic receives signals from one IRM channel and one APRM channel. The position of the mode switch determines which input signals will affect the output signal from the logic. The arrangement of neutron monitoring system logics is such that the failure of any one logic cannot prevent the initiation of a high neutron flux scram.

Nuclear System High Pressure

High pressure within the nuclear system poses a direct threat of rupture to the nuclear system process barrier. A nuclear system pressure increase while the reactor is operating compresses the steam voids and results in a positive reactivity insertion causing increased core heat generation that could lead to fuel failure and system overpressurization. A scram counteracts a pressure increase by quickly reducing the core

fission heat generation.

The nuclear system high-pressure scram setting is chosen slightly above the reactor vessel maximum normal operating pressure to permit normal operation without spurious scrams yet provide a wide margin to the maximum allowable nuclear system pressure. The location of the pressure measurement, as compared to the location of the highest nuclear system pressure during transien ts, was also considered in the selection of the high-pressure scram setting. The nuclear system high-pressure scram works in conjunction with the pressure relief system in preventing nuclear system pressure from exceeding the maximum allowable pressure. This same nuclear system high-pressure scram setting also protects the core from exceeding thermal-hydraulic limits as a result of pressure increases for some events that occur when the reactor is operating at less than

rated power and flow. UFSAR/DAEC-1 7.2-12 Revision 20 - 8/09 Reactor pressure is measured at two locations. An instrument sensing line from each location is routed through the primary containment and terminates at six local instrument racks (three per line) in the reactor building. One locally mounted, pressure transmitter that monitors reactor pressure is mounted on each of four racks that physically separated from each other. Each pressure transmitter provides a signal to an electronic alarm unit that is locally mounted near their respective transmitters. The alarm units are also physically separated from each other. The alarm units provide relay contact outputs to the control room RPS cabinets. Each transmitter/alarm unit provides a high pressure signal to one trip logic. The transmitters/alarm units are arranged so that one pair provides an input to trip system A and the other to trip system B, as shown in Figure 7.2-6. Reactor Vessel Low Water Level

Low water level in the reactor vessel indicates that the reactor is in danger of

being inadequately cooled. One effect of a decreasing water level while the reactor is

operating at power is to decrease the reactor coolant inlet subcooling. The effect is the same as raising feedwater temperature. Should water level decrease too far, fuel damage could result as steam forms around fuel rods. A reactor scram protects the fuel by

reducing the fission heat generation within the core.

During normal operation the reactor vessel low-water level trip protects the main turbine from excessive moisture carryover prior to steam dryer skirt uncovery and prevents excessive steam carryunder, which can impact reactor recirculation pump and jet pump Net Positive Suction Head (NPSH). This is an equipment protection function and not a safety function.

The reactor vessel low-water-level scram setting was selected to prevent fuel damage following those abnormal operational transients caused by single equipment malfunctions or single operator errors that result in a decreasing reactor vessel water level. Specifically, the scram setting is chosen far enough below normal operational levels to avoid spurious scrams but high enough above the top of the active fuel to ensure that enough water is available to account for steam formation and displacement of coolant following the most severe abnormal operational transient involving a level decrease (Reference UFSAR 15.1.7). The selected scram setting was used in the development of thermal-hydraulic operating limits.

For the design basis accidents, which place the most-strigent requirements on systems, structures, and components (SSCs) of any event category, the reactor vessel low-water trip (Scram) stops the fission process to keep fuel heat-up within regulatory limits (10 CFR 50.46).

Reactor vessel low-water-level signals are initiated from level-indicating type

differential-pressure switches that sense the difference between the pressure due to a reference column of water and the pressure due to the actual water level in the vessel. The switches are arranged in pairs in the same way as the nuclear system high-pressure switches (Figure 7.2-6). Two instrument lines attached to taps, one above and one below UFSAR/DAEC-1 7.2-13 Revision 20 - 8/09 the water level, on the reactor vessel are required for the differential-pressure measurement for each pair of switches. The two pairs of lines terminate outside the primary containment and inside the reactor building at two pairs of instrument racks; the rack pairs are physically separated from each other and the lines tap off the reactor vessel at widely separated points. The RPS pressure switches, as well as instruments for other systems, sense pressure and level from these same lines.

Turbine Stop Valve Closure

The closure of the turbine stop valve with the reactor at power can result in a significant addition of positive reactivity to the core as the nuclear system pressure rise collapses steam voids. The turbine stop valve closure scram, which initiates a scram earlier than either the neutron monitoring system or nuclear system high pressure, provides a satisfactory margin below core thermal-hydraulic limits for this category of abnormal operational transients. The scram counteracts the addition of positive reactivity

due to pressure by inserting negative reactivity with the control rods.

Although the nuclear system high-pressure scram, in conjunction with the pressure relief system, is adequate to preclude overpressurizing the nuclear system, the turbine stop valve closure scram provides additional margin to the nuclear system pressure limit.

The turbine stop valve characteristics used in the transient analysis (Chapter 15)

are given in Figure 7.2-7.

The reactor scram initiated by the turbine stop valve closure is backed up by a second scram signal initiated by reactor pressure which increases to the relief valve trip pressure.

The relief valve opening provides a path for rejection of heat to the torus so that the system is protected against the sudden loss of the condenser as a heat sink.

The redundant instrumentation for trip together with redundant means of scramming the reactor and the redundant heat sink provides the system with a high degree of inherent reliability.

The turbine stop valve closure scram setting is selected to provide the earliest positive indication of valve closure.

Turbine stop valve closure inputs to the RPS are from valve stem position switches mounted on the four turbine stop valves. Each of the double-pole, single-throw switches is arranged to open before the valve is more than 10% closed to provide an early

positive indication of closure. As shown in Figure 7.2-8, the logic is arranged so that the closure of three or more valves initiates a scram.

The limit switch configuration on the turbine stop valves that provides the RPS trip to scram the reactor upon closure of the turbine stop valves (loss of heat sink) meets IEEE-279-1971 requirements. UFSAR/DAEC-1 7.2-14 Revision 20 - 8/09 Four turbine first-stage pressure switches are provided to initiate the automatic bypass of the turbine control valve fast-closure and turbine stop valve closure scrams when the first-stage pressure nominal trip se tpoint is at or below 120.3 psig (without head correction), corresponding to approximately 26% of rated core power.

Turbine Control Valve Fast Closure (Loss of Control Oil Pressure Scram)

With the reactor and turbine-generator at power, fast closure of the turbine control

valves can result in a significant addition of positive reactivity to the core as nuclear system pressure rises. The turbine control valve fast-closure scram, which initiates a scram earlier than either the neutron monitoring system or nuclear system high pressure, provides a satisfactory margin to core thermal-hydraulic limits for this category of abnormal operational transients. The scram counteracts the addition of positive reactivity

due to pressure by inserting negative reactivity with the control rods. Although the nuclear system high-pressure scram, in conjunction with the pressure relief system, is adequate to preclude overpressurizing the nuclear system, the turbine control valve fast-closure scram provides additional margin to the nuclear system pressure limit. The turbine control valve fast-closure scram setting is selected to provide timely indication of

control valve fast closure.

Turbine control valve fast-closure inputs to the RPS are from four control oil pressure

switches located on the control valve operator hydraulic lines. The pressure switches sense a

loss of hydraulic pressure to the control valve operators on control valve fast closure.

Turbine control valve fast closure scram initiates a trip within 30 msec of the start of turbine control valve fast closure. The turbine control valve fast-closure scram is bypassed when turbine first-stage pressure nominal trip setpoint is 120.3 psig (without head correction), corresponding to approximately 26% of rated core power.

Main Steam Line Isolation

The main steam line isolation valve closure scram is provided to limit the release of fission products from the nuclear system. Automatic closure of the main steam line isolation valves is initiated upon conditions indicative of a steam-line break. Immediate

shutdown of the reactor is appropriate in such a situation.

The main steam line isolation scram setting is selected to give the earliest positive indication of isolation valve closure. This logic allows functional testing of main steam line isolation trip channels with one steam line isolated.

Main steam line isolation valve closure inputs to the RPS are from valve stem position switches mounted on the eight main steam line isolation valves. Each of the double-pole, single-throw switches is arranged to open before the valve is more than 10% closed to provide the earliest positive indication of closure. Either of the two trip channels associated with one isolation valve can signal valve closure. To facilitate the description UFSAR/DAEC-1 7.2-15 Revision 20 - 8/09 of the logic arrangement, the position sensing channels for each valve are identified and assigned to RPS logics as shown in Table 7.2-2.

Each RPS trip system logic receives signals from the valves associated with two steam lines (Figure 7.2-9). The arrangement of signals within each logic requires that at least one valve in each of the steam lines associated with that logic closes to cause a trip of that logic. For example, the closure of the inboard valve of steam line A and the outboard valve of steam line C causes a trip of logic Bl. This in turn causes trip system B to trip. No scram occurs because no trips occur in trip system A. In no case does the closure of two valves or the isolation of two steam lines cause a scram due to valve closure; a scram may result from exceeding the main steam line high differential flow setpoint in the lines that remain open. However, the closure of one valve in each of three or four of the steam lines causes a scram.

Wiring for the position sensing channels from one position switch is physically separated in the same way that wiring to duplicate sensors on a common process tap is

separated. The wiring for position sensing cha nnels feeding the different logics of one trip system are also separated.

The main steam line isolation valve closure scram function is effective when the reactor mode switch is in RUN.

The effects of the logic arrangement and separation provided for the main steam line isolation valve closure scram are as follows:

1. Closure of one valve for test purposes with one steam line already isolated without causing a scram due to valve closure.

2. Automatic scram on isolation of three or four steam lines.

3. No single failure can prevent an automatic scram required for fuel protection due to main steam line isolation valve closure.

Scram Discharge Volume High Water Level

The scram discharge volume receives the water displaced by the motion of the CRD pistons during a scram. Should the scram discharge volume fill up with water to the point where not enough space remains for the water displaced during a scram, control rod movement would be hindered in the event a scram were required. To prevent this situation, the reactor is scrammed when the water level in the discharge volume attains a value high enough to verify that the volume is filling up, yet low enough to ensure that the remaining capacity in the volume can accommodate a scram. UFSAR/DAEC-1 7.2-16 Revision 13 - 5/97 Scram discharge volume high water level inputs to the RPS are from four nonindicating Magnetrol float switches and four thermally actuated liquid level switches. The level sensors, which employ different operating principles, perform identical but redundant functions. Each pair of redundant switches provides an input into one channel (Figure 7.2-6). The switches are arranged in pairs so that no single event will prevent a reactor scram due to scram discharge volume high water level. The trip point for these

switches cannot be significantly adjusted without physically cutting the switch out of the scram discharge volume and rewelding it at a different level. With the scram setting as listed in Table 7.2-1, a scram is initiated when sufficient capacity remains to accommodate a scram. Both the amount of water discharged and the volume of air trapped above the free surface during a scram were considered in selecting the trip

setting.

In addition to the scram-function-level switches, there are two float-type switches on the south and two thermally-actuated-type switches on the north scram discharge volume instrument volumes. These level switches provide redundant functions of "alarm" and "block rod withdrawal." The design provides computer logging of the status of all scram discharge volume level switches.

Primary Containment High Pressure

High pressure inside the primary containment could indicate a break in the nuclear system process barrier. It is prudent to scram the reactor in such a situation to minimize the possibility of fuel damage and to reduce the addition of energy from the

core to the coolant.

The primary containment high-pressure scram setting is selected to be as low as possible without inducing spurious scrams. Primary containment pressure is monitored by four nonindicating pressure switches that are mounted on instrument racks outside the drywell in the reactor building. A cable is routed from each switch to the control room. Each switch provides an input to one channel (Figure 7.2-6). Instrument lines that terminate in the secondary containment (reactor building) at the racks connect the

switches with the drywell interior. The switches are grouped in pairs, physically

separated, and electrically connected to the RPS so that no single event will prevent a scram due to primary containment high pressure.

Main Steam Line High Radiation

High radiation in the vicinity of the main steam lines could indicate a gross fuel failure in the core. When high radiation is detected near the steam lines, an alarm is actuated in the main control room and the mechanical vacuum pump is tripped. The trip of the mechanical vacuum pump in turn closes its suction valve from the low pressure and high pressure condenser. The main steam line drain valves and recirculation loop sample valves also close on high radiation. More information on the trip setting is

available in Section 11.5.

UFSAR/DAEC-1 7.2-17 Revision 13 - 5/97 Main steam line radiation is monitored by four radiation monitors, which are discussed and evaluated in Section 11.5.1.

Manual Scram

To provide the operator with means to shut down the reactor, push buttons are located in the main control room that initiate a scram when actuated by the operator. In addition, keylock channel test switches are located at relay logic panels.

Mode Switch in SHUTDOWN

The mode switch provides appropriate protective functions for the condition in which the reactor is to be operated. The reactor is SHUTDOWN with all control rods inserted when the mode switch is in SHUTDOWN. To enforce the condition defined for the SHUTDOWN position, placing the mode switch in the SHUTDOWN position initiates a reactor scram. This scram is not considered a protective function because it is not required to protect the fuel or nuclear system process barrier, and it bears no relationship to minimizing the release of radioactive material from any barrier. The scram signal is removed after a short time delay, permitting a scram reset to restore the normal valve lineup in the CRD hydraulic system.

End-of-Cycle Recirculation Pump Trip

The end-of-cycle recirculation pump trip (EOC-RPT) is part of the RPS and is an essential supplement to the reactor scram function. The EOC-RPT feature is installed to improve the thermal margin of a BWR near the end of each fuel cycle by reducing the severity of possible pressurization transients. The RPT system accomplishes this objective by rapidly cutting off power to the recirculation pump motors during generator

load rejection (turbine control valve fast closure) or turbine trip (stop valve closure).

This results in a rapid reduction in recirculation flow and increases the core void content

during a pressurization transient, thereby reducing the peak transient power and heat flux. The operation of the EOC-RPT system reduces the change in reactor critical power ratio (CPR) that would be produced by a pressuriza tion transient. It should be noted that the EOC-RPT is not related to the recirculation pump trip that is associated with an anticipated transient without scram (ATWS-RPT).

The design philosophy for the RPT system is described in General Electric

NEDO-24220, 1 DAEC. The RPT system complies with IEEE-279-1971 except for Section 4.17 which covers manual trip feature and is discussed in Section 3.0 of NEDO-

24220. UFSAR/DAEC-1 7.2-18 Revision 17 - 10/03 The EOC-RPT is required to quickly shut down both reactor coolant recirculation pumps when the closure of all four turbine stop valves occurs, or when the fast closure of all four turbine control valves occurs. An EOC-RPT trip may occur, but is not required, when one turbine stop valve or one turbine control valve remains open. To mitigate

pressurization transient effects, the EOC-RPT must shut down the recirculation pumps within 175 msec after initial closure movement of either turbine stop valves or the turbine control valves, as specified in the Technical Specifications. The Turbine Control Valve Fast Closure Response Time is 140 msec. the Turbine Stop Valve Closure Response time is 120 msec. The EOC-RPT installation is composed of sensors that detect the closure of the turbine stop valves or the fast closure of the turbine control valves combined with relays, logic circuits, and fast-acting circuit breakers that interrupt the current from the recirculation pump motor-generator sets to the recirculation pump motors. When the redundant RPT breakers trip open, the recirculation pumps coast down

under their own inertia. To satisfy the RPS single-failure criterion, the EOC-RPT has two almost identical divisions that actuate recirculation pump trip in a one-out-of-two configuration. Either of the two RPT divi sions operates independent breakers in the supply circuits of both recirculation pumps.

Turbine stop valve closure is detected by four position switches that open when

the associated stop valves are less than 90% open. Turbine control valve fast closure is detected by four pressure switches in the hydraulic control system for the valves.

The pressure switches open when the hydraulic control fluid pressure decreases

below the trip level. The stop valve position sensors and the control valve hydraulic pressure sensors for recirculation pump trip are the same ones used in the reactor scram system to initiate scram when turbine stop valve closure or turbine control valve fast

closure occurs.

The actuation of any RPT sensor causes an associated electromagnetic relay to deenergize. The contacts of these relays are combined in logic circuits with contacts from an operating bypass and contacts from a key-controlled manual bypass switch. The logic circuits control the voltage to the trip circuits of the RPT circuit breakers. The operating bypass disables the RPT system when turbine first-stage pressure is less than that for 26% reactor power. The same operating bypass concurrently disables the turbine inputs to the scram system. A manual bypass switch allows each RPT division to be disabled and placed out of service for maintenance or testing. The functional arrangement of sensors for each logic channel is shown in Figure 7.2-1, Sheet 2A.

There is one interconnection between each EOC-RPT division and a nonsafety system. When each RPT breaker trips, auxiliary relay contacts in the RPT breaker actuate a control circuit for the recirculation pump motor-generator set to deenergize the motor-generator set after the RPT breaker interrupts the current from that set to the recirculation pump motor. This interlock is adequately isolated so that no credible failure

can prevent proper RPT action. UFSAR/DAEC-1 7.2-19 Revision 17 - 10/03 An operating bypass automatically disables the RPT system when the reactor is operating at less than 26% power. The operating bypass is annunciated automatically in the control room.

Each RPT division can be bypassed manually by use of an out-of-service key switch that is administratively controlled. The use of the out-of-service key switch bypass produces a suitable annunciator indication in the control room when the

keyswitch is turned to the "RPT SYS INOP" position.

The Technical Specifications for the DAEC provide suitable restrictions to limit

operating power when one or both of the EOC-RPT divisions are inoperable, and specify periodic functional checks of the initiating logic and scram logic.

7.2.1.2.4 Design Criteria

At the time of the initial FSAR, a comprehensive comparison of the RPS with the design requirements of IEEE-279-1968 had been assembled into topical report, NEDO-10139.2 The results of this analysis showed that the BWR RPS, which would produce protective actions during and after a postula ted reactor loss-of-coolant accident (LOCA) would meet the design requirements of IEEE-279-1968.

The topical report illustrated the basis for the analysis and presented the designer's interpretation of the IEEE-279-1968 design requirements in those cases where an exact fit of the requirements to the intended protective function was not achieved. The design of the DAEC reactor, however, was performed prior to the issue and effective date of the IEEE-279-1971 and was thus adequate to meet the then-effective IEEE-279-1968.

Changes in the DAEC reactor trip and engineered safety feature control systems

were designed to IEEE-279-1971 and the General Design Criteria requirements of circuit separation, circuit testability, and tolerance of single failure. With the above changes, the protective systems that activate reactor trip, engineered safety feature action, and other safety-related systems adequately conformed to the criteria of IEEE-279-1971 and the

NRC's General Design Criteria, with the exception of Section 4.17 of IEEE-279-1971, as follows:

1. This criterion is not met literally in that protective actions are not initiated at a system level using a minimum of equipment. It is believed that these two requirements are contradictory and practically unattainable because equipment added to obtain an initiation at the system level would clearly be in addition to the minimum needed to obtain operation manually. The scram system that uses two manual initiation buttons in order to obtain separation and testability is clearly more reliable than it would be if a

single button were used, but this is a literal violation of Section 4.17 of

IEEE-279-1971.

UFSAR/DAEC-1 7.2-20 Revision 13 - 5/97 2. The automatic depressurization system uses one manual switch for each of the four relief valves. A single device to control all four valves would

raise a question of whether a single failure in this control circuit allowing

all valves to open would be an acceptable alternative.

3. The manual control of isolation valves has been specially designed to give excellent operator information regarding status and has controls grouped in such a way that one man can shut off all isolation valves in seconds.

This is considered as fulfilling the intent of Section 4.17 of IEEE-279-

1971, but is in literal violation.

4. The core cooling manual control has been grouped to facilitate rapid operator action but does not initiate core cooling by a single operator action as implied by Section 4.17 of IEEE-279-1971. Thus, these various systems may be judged to comply with Section 4.17 by reasonable interpretation or to violate Section 4.17 literally as the reviewer may

choose to judge.

The protection systems that activate reactor trip and engineered safety feature

action as related to the General Design Criteria for Nuclear Power Plants, 10 CFR 50.34, Appendix A, effective July 1971, are discussed in detail under group III of Section 3.1.

7.2.1.3 Inspection and Testing

The RPS can be tested during reactor operati on by five separate tests. The first of these is the manual trip actuator test. By depressing the manual scram button for one trip system, the manual logic actuators are deenergized, opening contacts in the trip actuator logics. After resetting the first trip system, the second system is tripped with the other manual scram button. The total test verifies the ability to deenergize all eight groups of scram pilot valve solenoids by using the manual scram push-button switches. Scram

group indicator lights verify that the actuator contacts have opened.

The second test is the automatic actuator test, which is accomplished by operating, one at a time, the key-locked test switches for each automatic logic. The

switch deenergizes the actuators for that logic, causing the associated actuator contacts to

open. The test verifies the ability of each logic to deenergize the actuator logics associated with parent trip system. The actuator and contact action can be verified by

observing the physical position of these devices.

The third test includes the calibration of the neutron monitoring system by means of simulated inputs from calibration signal units. Section 7.6.1 describes the calibration

procedure.

UFSAR/DAEC-1 7.2-21 Revision 17 - 10/03 The fourth test is the single-rod scram test that verifies the capability of each rod to scram. It is accomplished by the operation of toggle switches on the protection system operations panel. Timing traces can be made for each rod scrammed. Before the test, a physics review must be conducted to ensure that the rod pattern during scram testing does

not create a rod of excessive reactivity worth.

The fifth test involves applying a test signal to each RPS channel in turn and

observing that a logic trip results. This test also verifies the electrical independence of the channel circuitry. The test signals can be applied to the process-type sensing instruments (pressure and differential pressure) through calibration taps.

There are only two dc solenoid-operated backup scram valves, either of which can control the air to all scram valves for all control rods. Thus, the backup scram valves

cannot be tested during reactor operation without tripping the reactor. The backup scram valves are tested during each refueling outage.

RPS response times were first verified during preoperational testing and may be verified thereafter by a similar test. The elapsed times from a sensor trip to each of the following events are measured:

1. Channel relay deenergized.

2. Trip actuators deenergized.

Surveillance requirements for the reactor protection system are specified in the

Technical Specifications.

The Reactor Vessel Steam Dome Pressure-High Sensor Response time shall be < 0.5 seconds and the Reactor Trip System Response Time shall be 0.55 seconds.

The Reactor Water Level-Low Sensor Response time shall be < 1.0 seconds and the Reactor Trip System Response time shall be 1.05 seconds.

The designed system response times from the opening of the sensor contact up to and including the opening of the trip actuator contacts shall not exceed 50 milliseconds.

The alarm printer provided with the process computer verifies the proper operation of many sensors during plant startups and shutdowns. Main steam line

isolation valve position switches and turbine stop valve position switches can be checked in this manner. The verification provided by the alarm printer is not considered in the selection of test and calibration frequencies and is not required for plant safety.

UFSAR/DAEC-1 7.2-22 Revision 14 - 11/98

7.2.2 ANALYSIS

The RPS is designed to provide timely protection against the onset and

consequences of conditions that threaten the integrity of the fuel barrier and the nuclear system process barrier. Chapter 15 identifies and evaluates events that challenge the fuel barrier and nuclear system process barrier. The methods of assessing barrier damage and radioactive material releases, along with the methods by which abnormal events are

sought and identified, are presented in that chapter.

Design procedures have been to select tentative scram trip settings that are far enough above or below normal operating levels that spurious scrams and operating

inconvenience are avoided; it is then verified by analysis that the reactor fuel and nuclear system process barriers are protected as is required by the basic objective. In all cases, the specific scram trip point selected is not the only value of the trip point that results in no damage to the fuel or nuclear system process barriers; trip setting selection is based on

operating experience and constrained by the safety design basis.

The scrams initiated by neutron monitoring system variables, nuclear system

high pressure, turbine stop valve closure, turbine control valve fast closure, and reactor vessel low water level are sufficient to prevent fuel damage following abnormal operational transients. Specifically, these scram functions initiate a scram in time to prevent the core from exceeding the thermal-hydraulic safety limit during abnormal

operational transients.

The scram initiated by nuclear system high pressure, in conjunction with the pressure relief system, is sufficient to prevent damage to the nuclear system process

barrier as a result of reactor pressure. For turbine-generator trips, the stop valve closure scram and turbine control valve fast closure scram provide a greater margin anticipatory to the nuclear system pressure safety limit than the high-pressure scram. Chapter 15 identifies and evaluates accidents and abnormal operational events that result in nuclear system pressure increases; in no case does pressure exceed the nuclear system safety limit.

The scram initiated by the neutron monitoring system, main steam isolation valve closure, and reactor vessel low water level satisfactorily limits the radiological consequences of gross failure of the nuclear system process barrier. Chapter 15 evaluates gross failures of the nuclear system process barrier; in no case does the release of radioactive material to the environs result in exposures that exceed the guideline values

of published regulations.

Neutron flux (the neutron monitoring system variable) is the only essential

variable of significant spatial dependence that provides inputs to the RPS. The basis for the number and locations of neutron flux detectors is discussed in Section 7.6.1. The other requirements are fulfilled through the combination of logic arrangement, channel redundancy, wiring scheme, physical is olation, power supply redundancy, and component environmental capabilities. The following discussion evaluates these subjects. UFSAR/DAEC-1 7.2-23 Revision 14 - 11/98 In terms of protection system nomenclature, the RPS is a one-out-of-two system

used twice. Theoretically, its reliability is slightly higher than a two-out-of-three system and slightly lower than a one-out-of-two system. However, since the differences are slight, they can, in a practical sense, be neglected. The advantage of the dual-trip system arrangement is that it can be tested thor oughly during reactor operation without causing a scram. This capability for a thorough testing program, which contributes significantly to increased reliability, is not possible for a one-out-of-two system.

The use of an independent channel for each logic allows the system to sustain any channel failure without preventing other sensors monitoring the same variable from initiating a scram. A single sensor or channel failure will cause a single trip system trip and actuate alarms that identify the trip. The failure of two or more sensors or channels would cause either a single trip system trip if the failures were confined to one trip system, or a reactor scram if the failures occurred in different trip systems. Any intentional bypass, maintenance operation, calibration operation, or test, all of which result in a single trip system trip, leaves at least two channels per monitored variable capable of initiating a scram by causing a trip of the remaining trip system. The resistance to spurious scrams contributes to plant safety because unnecessary cycling of the reactor through its operating modes would increase the probability of error or actual failure.

An actual condition in which an essential monitored variable exceeds its scram trip point is sensed by at least two independent sensors in each trip system. Because only one channel must trip in each trip system to initiate a scram, the arrangement of two channels per monitored variable trip system provides assurance that a scram will occur as any monitored variable exceeds its scram setting.

Each control rod is controlled as an individual unit although the rods are scrammed in groups. A failure of the controls for one rod would not affect other rods. The backup scram valves provide a second method of venting the air pressure from the scram valves, even if either scram pilot valve solenoid for any control rod fails to deenergize when a scram is required.

Sensors, channels, and logics of the RPS are not used directly for automatic control of process systems. Therefore, failure in the controls and instrumentation of process systems cannot induce a failure of any portion of the protection system.

The failure of either RPS motor-generator set would result, at worst, in a single trip system trip. Alternate power is available to the RPS buses. A complete, sustained loss of electric power to both buses would result in a scram, delayed by the motor-

generator set flywheel inertia.

The environmental conditions in which the instruments and equipment of the RPS must operate are considered in setting the environmental specifications. For the instruments located in the reactor or turbine buildings, the specifications are based on the UFSAR/DAEC-1 7.2-24 Revision 15 - 5/00 worst expected ambient conditions in which the instruments must operate. The RPS components that are located inside the primary containment are the condensing chambers. Special precautions are taken to ensure satisfactory operability after the accident. The condensing chambers are similar to those that have successfully undergone

qualification testing in connection with other projects. Additionally, a continous purge system has been installed to prevent the accumulation of non-condensible gases that could come out of solution following rapid de pressurization and subsequently adversely affect level indication.

Safe shutdown of the reactor during earthquake ground motion is ensured by the Seismic Category I design of the system and the fail-safe characteristics of the system. The system only fails in a direction that causes a reactor scram when subjected to extremes of vibration and shock.

To ensure that the RPS remains functional, the number of operable trip channels for the essential monitored variables should be maintained at or above the minimums

given in Technical Specifications Table 3.3.1.1-1. The minimums apply to any untripped trip system; a tripped trip system may have any number of inoperative channels. Because reactor protection requirements vary with the mode in which the reactor operates, the tables show different functional requirements for the RUN and STARTUP modes. These are the only modes where more than one control rod can be withdrawn from the fully

inserted position.

Calibration and test controls for the neutron monitoring system are located in the main control room and are, because of their physical location, under direct physical

control of the plant operator. Calibration and test controls for pressure switches, level

switches, and valve position switches are located in the turbine building, reactor building, and primary containment. The plant operator is responsible for granting access to the setting controls to properly qualified plant personnel for the purpose of testing or calibration adjustment.

7.2.3 ATWS-RPT/ARI

The NRC, in 10CFR50.62, requires that certain systems be provided to cope with anticipated transients without scram (ATWS). For BWRs, the required systems are the Standby Liquid Control System, the Alternate Rod Injection (ARI) System, and the Recirculation Pump Trip (RPT) system. The DAEC Standby Liquid Control system is described in Section 9.3.4, and the ARI-RPT system is described in the following

sections, and in References 3 through 6. UFSAR/DAEC-1 7.2-25 Revision 14 - 11/98 7.2.3.1 Design Basis Information

The ATWS-RPT/ARI system is designed to meet the requirements of

10CFR50.62 and NRC guidance (NRC Generic letter 85-03 and 85-06), which require it

-  to be diverse from and independent of the reactor trip system, from sensor output to the final actuation devices,  - to have redundant scram air header exhaust valves, and 
- to be designed to perform its function in a reliable manner. 

It is not required to be redundant or to function during or after a seismic event, a

design basis accident, or a sensing line failure.

The performance objective for ARI is that rod insertion should be completed within one minute to preclude degradation of the fuel cladding, and should also be completed prior to scram discharge volume pressurization or fill.

7.2.3.2 System Description

The ATWS-RPT/ARI system, shown in Figure 7.2-10, is provided to initiate both

RPT and ARI in the event of either reactor high pressure or reactor low level. It initiates depressurization of the scram valve pilot air header which causes control rod insertion and provides trip signals to the breakers feeding the recirculation pumps. The system, a backup to the Reactor Protection System, is both separate from and independent of RPS. The high pressure setpoint is above the RPS high pressure setpoint, and the low level setpoint is below the RPS reactor low water level setpoint. This is to ensure that the ATWS mitigators do not activate prior to normal RPS trips. Instrumentation data is

shown in Table 7.2-3.

There are two ATWS-RPT/ARI logic trains in the system, and each train has two

pressure sensors, two level sensors, one trip coil in a breaker supplying each recirculation pump, and one valve to depressurize the scram valve pilot air header. The

logic in each train is two-out-of-two: both pressure sensors or both level sensors must be tripped to trip their train. The system logic is one-out-of-two: a trip of either train will cause both reactor recirculation pumps to trip and ARI to initiate. This two-out-of-two-once logic ensures the system will respond to valid trips while minimizing the chance of spurious activation. Manual trip capability is also provided in the control room.

Power for the system is provided from the 125 VDC power systems, with separate

power supplies for the two logic trains. Energize-to-trip logic is required to be used. Separate contacts on the same level sensors are used for the ATWS-RPT/ARI system and for the nuclear steam supply shutoff systems, while the pressure sensors are dedicated solely to the ATWS-RPT/ARI system, i.e., not shared with any other system in order to be diverse from RPS. In the ARI circuits, a seal-in feature is provided to allow time for the scram air header to fully depressurize before the logic resets, even if the trip signal has cleared. RPT occurs immediately on high reactor vessel pressure, while it is delayed UFSAR/DAEC-1 7.2-26 Revision 14 - 11/98 for 9 seconds following low-low water level to allow the Low Pressure Coolant Injection system loop selection logic to complete its function. Each logic train is

equipped with a test switch which isolates the outputs and allows testing at power. However, the system, by virtue of its one-out-of-two-once design, will still provide the required trip with one train in the test mode. In addition, these test (keylocked) switches allow the operator to reset the ARI solenoid valves under conditions in which a Low-Low RPV level or High RPV Pressure signals exist as directed by Emergency Operating Procedures. The instrument sensing lines associated with instrument racks and all system components (with the exception of the ARI solenoid valves, which are located on the non-seismic scram air header) are seismically supported.

System equipment is qualified to the environmental conditions that may be associated with an ATWS event. Although not required, the ATWS-RPT/ARI modifications were designed, procured and installed as Class 1E in accordance with the facility quality assurance program.

Provisions are made for surveillance testing of the system.

Post installation testing of the installed system showed that the performance objective listed in Section 7.2.3.1 is met.

UFSAR/DAEC-1 7.2-27 Revision 13 - 5/97 REFERENCES FOR SECTION 7.2

1. General Electric Company, Basis for Installation Recirculation Pump Trip System, GE/NEDO-24220, September 1979.

2. General Electric Company, Compliance of Protection Systems to Industry Criteria and General Electric BWR Nuclear Steam Supply System, GE/NEDO-10139, June 1970.

3. General Electric Company, Anticipated Transients Without Scram (ATWS) Response to NRC Rule 10CFR50.62, GE/NEDE-31096-P, December 1985.

4. Letter from R. W. McGaughy (Iowa Electric) to H. Denton (NRC),

Subject:

Technical Specification Change (RTS-216) ATWS

Modifications, dated February 25, 1987 (NG-87-0468).

5. Letter from R. W. McGaughy (Iowa Electric) to T. Murley (NRC),

Subject:

Revision to Iowa Electric's ATWS Rule (10CFR50.62) Compliance Report, dated June 1, 1987 (NG-87-2038).

6. Letter from W. C. Rothert (Iowa Electric) to T. Murley (NRC),

Subject:

Response to Request for Additional Information Regarding the Duane Arnold ATWS Design, dated November 13, 1987 (NG-87-3837).

7. Letter from J. Franz (Iowa Electric) to T. Murley (NRC),

Subject:

Request for Technical Specifications Change (RTS-247) Removal of RPS Electrical Protection Assembly Time Delay Requirements, dated March

13, 1992 (NG-92-1269).

UFSAR/DAEC-1 T7.2-1 Revision 13 - 5/97 Table 7.2-1 REACTOR PROTECTION SYSTEM SCRAM SETTINGS Scram Function Instrument Nominal Setting Neutron monitoring system scram See Section 7.6.1, "Neutron Monitoring System" See Section 7.6.1, "Neutron Monitoring System" Nuclear system high

pressure Pressure switch 1040 psig (alarm) 1055 psig (trip) Reactor vessel low

water level Level switch +170 in. indicated level a Turbine stop valve

closure Position switch 10% valve closure Turbine control valve

fast closure (Loss of

Control Oil Pressure)

Pressure switch 30 msec following start of control

valve fast closure Main steam line

isolation valve closure Position switch 10% valve closure Scram discharge volume high water

level Level switch 60 gal Primary containment

pressure Pressure switch 2.0 psig a Zero referenced to top of active fuel (344.5 in. above vessel zero). UFSAR/DAEC-1 T7.2-2 Revision 12 - 10/95 Table 7.2-2 VALVE CHANNEL SENSING LOGIC Position Sensing Channel Logic Valve Identification Channels Relays Assignment

Main steam line A

inboard valve F022A (1) & (2) A, B A1, B1 Main steam line A,

outboard valve F028A (1) & (2) A, B A1, B1 Main steam line B, inboard valve F022B (1) & (2) E, D A1, B2 Main steam line B, outboard valve F028B (1) & (2) E, D A1, B2 Main steam line C, inboard valve F022C (1) & (2) C, F A2, B1 Main steam line C, outboard valve F028C (1) & (2) C, F A2, B1 Main steam line D, inboard valve F022D (1) & (2) G, H A2, B2 Main steam line D, outboard valve F028D (1) & (2) G, H A2, B2 UFSAR/DAEC-1 T7.2-3 Revision 12 - 10/95 Table 7.2-3 ATWS-RPT-ARI INITIATION INSTRUMENTATION Function Instrument Nominal Set point Reactor High Pressure Pressure Switch 1140 psig (max) Reactor Low Water Level Level Switch 119.5 in (min)

Above top of active fuel

SHEET2FIGURE7.2-1lEDREACTORPROTECTIONSYSTEMDUANEARNOLDENERGYCENTERNEXTERAENERGYDUANEARNOLD,LLCUPDATEDFINALSAFETYANALYSISREPORT...----------------------1,II'II:I1ftII:II,,(saEl'1(>4._),I.,I-r.>--<f(/>,1J1"O)\.APEO-C71-001<Z)REV.13REVISION20-08/09 NOTE$LOCALTURalNESTOPOPENAUXDEVICe:NOTEijAUXOEVICELOCALTURBINECONTROLVALve114FASTCLOSURERMSCRTCVTESTSWtlCHCLOSETOTESTTURBINESTOPVALVE113'"OPENLOCALRPTBREAKERCONTROLsWITCHINCLOSEPOSITIONCRNOTEeAUXDEVICETURaINECONTROLVALVE#3FASTCLOSURERPTeREAKERCONTROLSWITCHINCLOSEPOSITIONRMSCRTCV11$$TSWITCHCLOSETOTEST+'72(102308)".rr--o....,.---------..,.--------..--------,--------..,---------,125VDCBUSB*0<:t<J<:J*72(lDI308)[Jj(f)-fJl>-m(/)[Jj*6::),-'"Ii:I-'"il..J:"-J:n::If}n::rJ>n::If}n::<II\INOrSe.\!NOTES\INOrES\/NOTE5rCVTESTSWtTCHTURBINESTOPTCVTESTSWITCHTURBINECONTROLWRaINESTOPCLOSETOTESTVALVE#1FASTVALVE#1'"90%CLOSETOTESTVALVEtl2FASTVALVE#2'"9()o;('CLOSUREOPENCLOSUREOPENRMsCRLOCALAUXLOCALRMSCRAUXLOCALAUXLOCALDEVICEDEVICEI<<V<:...<<<t:'"d;mtJ);i;<f)<II.n'"'"Ii:I-'"Ii:t:J:illJ:J:0:tJ)ll:rnn::roy1NOTE5Y1NOTE5j11l0rE61NOTES.(fERMISSIVEWHE:\revTESTSW1TCHTURb'"ECONTROLH!RSINESlOPYAWTCVTESTSWITCHTURBINECONTROLTURlllNESTOPVAlVVALVE92FASTVALVE#1FASTCLOS'OCLOSURElI2<9Q%OPENCLOSEDCLosUREPRESENT"<90'11OPEN\RMSell/OR/\tUXCR/\RMsICR/OR/CR/DEVICEDEVICEDEVICE<<Wrnri....(\.:::ll::<J>\I(PIiRMlSSIVEWHENTURBIN.'STSTAG.PRESS,2Il'll.OFRATE!)POW'R_\tux(A)OROIiVICE<<'1:(I)in.Ii:Ii:.,cr:\I(PERMISSIVE\WHEWTURUINE1ST8TMEPRESS'26'11OFRATEDPOWE"\fUX(8)CR/OEVICE\WHENRPTINOPswrrcHtl'tTHENORMALPOSITIONRPTBREAKER\RMSCR/RPTBReAKERCONTROLSWITCHCONTROLSWITCHINCLOSEPOSITIONINCLOSEPOSITIONRMSICRRMSICR11I!"".-ICL,OSJNCCOlt.(:<>I'NCRPTBREAKERC1101RPTBREAKER(1A5111;(lA502)*52LOCAL*&2ILOCAL125VDCBUSACRCRDUANEARNOLDENERGYCENTERlESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTlEDREACTORPROTECTIONSYSTEMFIGURE7.2-1SHEET2AAPED-C71-001<2A>REV.3REVISION18-10/05

TESTSWITCHAETURBSTOPVALVECLOSUREATURBINECONTROLABYPASSVALVEfASTCLOSUREABYPASSAPRIMARYCONTAINMENTHIGHPRESSURENUCLEARSYSTEMHIGHPRESSUREREACTORLOWWATERLEVELA}NEUTRONMONITORINGSYSTEMEREACTORPROTECTIONSYSTEMlOGICAlEA1ceMODESWITCH(OPENINCSHUTDOWNREACTORPROTECTIONSYSTEMlOGICA2GAlNEUTRONMONITORINGINSTRUMENT1-------,TRIPSFORINITIALFUELI--__LOADINGONLYSHUTDOWNMODE}AUTOMATICIRESETAMANUALSCRAMREACTORPROTECTIONSYSTEMlOGICA3CA3RESETNOTE:CONTACTSSHOWNINNORMALCONDITIONDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTSchematicDiagramofLogicsinOneTripSystemFigure7.2-2Revision11-4/94 ACTUATORS.....---,TRIPSYSTEMASYSTEM--.LOGICAlLOGICA2LOGICA3lOGICBllOGIC82LOGIC83ACTUATORLOOICSASSOCIATEDWITHTRIPSYSTEMAACTUATORLOGICSASSOCIATEDWITHTRIPSYSTEMB/,..---------"------------,GROUP3GROUP4SOLENOIDSSOLENOIDSGROUPIGROUP2SOLENOIDSSOLENOIOSGROUP3GROUP4SOLENOIDSSOLENOIDSGROUPlGROUP2SOLENOIDSSOLENOIDSNOTE:CONTACTSSHOWNINNORMALCONDITIONc:::"U.......C1a):0>:;::---1):0>!Tl0(/)0!Tlc:::0r):0>:::r,.,!Tl:zCD......(I!Tl3:z---1III):0>:::0):>>llIM-.......:::0:::l.....ra..0(I:zII(/)a.....pO):0>rrtoo.......,.,.......0I:::<+IIIG)"',ic:u::::l!TlCDllI"',i---1::I:!Tl<+1lI-<---1:z"-J03!Tl."',i):0>Q:O:::0N0s:J)Ir.......zW0"U-<,0):0>....*0-<()OM-(/)!Tl!TlViI::::::0:z1lI......---1M-(/)0(I!Tl"',i:::0a:::0Vi!Tl3:-0-0a):>>:::0Z---1-< MONITORltlGSYSTEMTRIPCHANNELSIRMCHANNELAloneofelghllSCALETRIPAPRMCHANNELAIOI'lll!of$UP\.PRMI.PRMOETECTORlolhelIleleclol$'DEi£CTOR-_......---AMPLIFItF/AMPliFIERILPRMlILPRMIIy*'MPW'IER*SUMMERItIUPSCALE.UPSCALETRIPAIRMQUEeTORAMPLIFIER1AA><<INOPI(BYPASS(NEUTRONMONITOR*INGSYSTEMAIRMBYPASS4MODEswINRUNII>.APRMINOPAl\PRIII'--"""T"'--"UPSCALETRIPNOTE1EEEENOTE1NEUTRONMONITORINGSYSTEMLOGICSltwo01!!I&fIlIREACTORPROTECTIONSYSTEMNOTEs1.APRMDOWNSCALETRIPCONTACTJUMPERED.Rt.ACTORPROTECTIONSYSTEMLOGlC(one01fOUlIDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTRELATIONSHIPBETWEENNEUTRONMONITORINGANDREACTORPROTECTIONSYSTEMFIGURE7.2-4REVISION15-5/00 IkM<"l-IANNlU.\>A,ElIS.!")!M19&)ltE....c:rORNeuTRON£Sz-.---.......&,'(;1531APED-C51-002(1)REV.6(PARTIAL>..........._-_..........................."11IIIIINOTE:1.APAMDOWNSCALETRIPJUMPEAEO.DUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTFUNCTIONALCONTROLDIAGRAMFORNEUTRONMONITORINGLOGICSFIGURE7.2-5REVISION15-5/00 SENSQRSoocBTRIPSYSTEMAPOWER8USTRIPSYSTEMBPOWERBUSTRIPSYSTEMATRIPSYSTEM8r"----.-I"I...---..,,,-"1...-_"'"1©NOTECONTACTSSHOWNINNORMALCONDITIONAlA2BlB2REACTORPROTECTIONSYSTEMLOGICSTYPICALCONFIGURATIONFORSCRAMDISCHARGEVOLUMEHIGHWATERLEVEL;,!TURBINECONTROLVALVEFASTCLOSUREREACTORVESSELLOWWATERLEVELMAINSTEAMLINEHIGHRADIATIONPRIM:l.RvCONTAINMENTHIGHPRESSURENUCLEARSYSTEMHIGHPRESSURE*EACHLOGICTMIt,FORTHESCRAMDISCHARGEVOLUl1EHASTWOREDUNDANTPARALLELSWITCHES(MAGNETROLFLOATANDTHERMALlYACTIVATED).SEES£CTIOII7.2.1.2.3.DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTypicalArrangementofChannelsandLogicsFigure7.2-6Revision2-6/84 ""<::>0<:lV>.,""$,0UJ:::Ef=1.lJ2"'"0<I::0>'"..Ia:0"i=!:21-0<Co:aUJ0.d°Sd'--L..."'--J.-.!.--'--__---4Io<:>(%)NlO"1d/NOLlISOdDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&'POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTurbineStopValvePerformanceCharacteristicsFigure7.2-7 TRIPSYSTEMAPOWERBUSr-------.,III53I1..JSV-lSV-2r-f-----,IIL_l2lSV-3r--------,III53I1-._.1SV-4AFHTURBINESTOPVALVECLOSURECHANNELSAAIEcA2GBBIFDB2HNOTE:CONTACTSSHOWNINNORMALCONDITIONREACTORPROTECTIONSYSTEMLOGICSSV=STOPVALVEDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTypicalConfigurationforTurbineStopValveClosureScramFigure7.2-8 F022C(2)F02Z0i\1'-y--'STEAMLINECF028D(21FonDI21ACPOWERREACTORPROTECTIONHBUS8'--y-JSTEAMLINE0'--y-'STEAMLINEBFF028CU)F028011l'--y-JSTEAMLINEAF022SI21kF022C(I)F028B!21#F028CU)'-v--'STEAMLINEDF022Bl!1F028BIiI'--y--/STEAMLINECF022A,2lF028A121'--y-ISTEAMLINEBSTEAMLINEAF028Ar\1FonAlllACPOWERREACTORPROTECTIONRUSAMAINSTEAMLINEISOLATIONCHANNELS(SWITCHCONTACTSSHOWNINPOSITIONSWHENISOLATIONVALVESLESSTHAN10".CLOSEDlTRIPSYSTEMATRIPSYSTEMBIA\/A{AE}smMCG}8F}smMoH}STEAMLINEALINEBLINECLINE()LINELINECLINELINEDA281REACTORPROTECTIONSYSTEMLOGICS[CONTACTSSHOWNINNORMALCONDITION)c:......I\Ja0):::0):::0--lCl-0lTllTlc:-I.0I):::0\)lTlZP.>."eIlTl............--lInz:::0):::0-1*0):::0......:::0::S::SIeIZ(O-+,0."-I.U1II............'.0u:lV)C)::>......0co,."iD,--'P.>lTl:c(0P.>M---l--lM-......-<lTl--.J.....*0o::sl<<>:::0N::s):::0iDI-+,Z\J-<I.DU10)::>\),In,-<lTlrrlP.>3::3P.>U1:::0:.z-I.......--l::sU1nfl10:::0U1:::03:rt,(;)fl1P.>\J:30:::0-<--l-AlKEY:F022ASTEAMLINEA.INBOARDVALVEF0281\-STEAMLINEA.OUTBOAROVALVEF022B-STEAMLINEB.INBOARDVALVEF028B-STEAMLINEB.OUTBOARDVALVEB2f022CSTEAMLINEC.INBOARDVALVE.F02SG-STE.AMLINEC.OUTBOARDVALVEFOZiO-STEAMLINED.INBOARDVALVEF02BO-STEAMLINED.OUTBOARDVALVE PRESSURECDELATI1ItAGtMGSETse:rA-I9llIIARIARIVALVEVAL.VESV-1SG3$\1-"1864PUMP"OTDRREACTORVeSSelPUMPMOTORDUANEARNOLDENERGYCENTERrESUTILITIES,INC.UPDATEDFINALSAFETYANALYSISREPORTDAECATWS-RPT/ARIFIGURE7.2-10Revision14-11/98

+/-

° °°°° +/-+/-

+/-

+/-

oLOGICB2,:"L_IIIL__--lCHANNEL0A-CPOWER(REACTORPROTECTIONSYSTEMM-GSETBORALTERNATEA-CPOWER)8ISOLATIONmlPSYSTEM8LOGIC81,I'-__.IIBIIILJCHANNEL8{------------------------IIIIIIICHANNELSIIIIINPUTSfROMOTHERCHANNELSIIIISOLATIONLOGICSILOGICA2:__IIIILJCHANNELcLOGICAlIIIIL_ICHANNELAA-CPOWER(REACTORPROTECTIONSYSTEMSETAORALTERNATEA-CPOWER),,,ISOLATIONTRIPSVSTEMALOGICAIAILOGICA2AIIIIIIIIISOLATIONACTUATORSILOGIC8181LOGIC8282FROMACPOWERA1?FROMDCfPOWERB2B1FROM11AlA2FROMACPOWER"**,82LOGICSINBOARDVALVESOUTBOARDVALVESDUANEARNOLDENERGYCENTERNEXTERAENERGYDUANEARNOLD,LLCUPDATEDFINALSAFETYANALYSISREPORTTypicalIsolationControlSystemforMainSteamLineIsolationValvesFigure7.3-4Revision20-8/09 ISOLATIONTRIPSYSTHIAISOL'\TIONT:lIP'r-ll_I10ILJCHANNEL0A-CPOWERIREACTORPROTECTIONSYSTEMM-GSETBORUNIrHERRUPTIBLEA-CPOWER]-_,I--or!I,IILJCHANNELB,,,,,,IIIIIIICHANNELSI,r---,'"r--IIcI1ILJCHANNELC--,:.--I-l1ILJCHANNELAA-CPOWER[REACTORPROTt,CTIONSYSTEMM-GSETAORUNINTERR\lPTIBLEA,,CPOWERI-l.,-l.0--T----=f-LOGICBlLOGICB2L'.l1,1(A:LOGICA2IIIINPUTSFRIJMOTHEr?TRIPCHANNELSIIISOLATIONLOGICSIIIIIIISOLATIONACTUATORSLOGICBl81LOGIC'2B2INBOAROVALVESISOLATIONACTUATORLOGICSOUTBQAROVALVESVALVECONTROLPOWERr---,1T1I,,,,IKjI,,,,IMOTORCONTROLLERI'-JMOTORCONTROLLERS'/ALVECONTROLPOWER;--T;t----:,IIIIK2I,,_V,'l,LVECLOSI:>lCPO'I!FRVALVECLOSINGPOWER------Kl--LK1-LDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORT'TypicalIsolationControlSystemUsingMotor-OperatedValvesFigure7.3-5

1,",II"-.-..---_.---_._.[".,..,,1-'-.,"'.-----(!'lZ{-ID;;O)FCD.NUCLEARBOILERSYSTEMf.",."""..DUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORT....-...*_*_-;"',I'IO'.C)--_..A4,-!C,:>y'.,':Ut,':':.'K',"1':':.1.'-',.1,;,"1'[,(\..'"i."'.Il"*,",Hv,-(,;;.""""';",sC1aT,*NOlt'r.>"f'h',:,:1.!;'-'1i'.\'Ln"',...i*,'::'"'.,-".',1','.1,'.------'",1c<T'.11.;'.._..-..--_1.'.fU'"W

".',-_--------<,",,o;tT,*I'W'*--*------:.f!"N:"*\11"""*;u-':*1..,"""!In_******\1,111.r.H"'"IU'------------0:-1:""c,'"ll'jr:",'..",'el",",11,IIPCIrCD_**,.."n..",'.H'.>;'0'"-..,""I?.".".""Let'II;"*,,,,..,,,"".""",.**.'S';1.1.,,,rr,","NT,>.H'**[[fern'LI';",'L',p,,,""'"INT,1.*.'1""_";\le'-",.".."i;CN11lCLlOJJC..J.lK*I.l'iF:..c'*C;"::JIII'""cr.I?0';.),'IIII"":',..'":,,0t.\.l"l>.l!r.C":,>>""",.-"JHEc",,,.nl""WI"".ISO,ATlCI-lBei,t"L'I,"1OINIT1ATEoTHEeS'SE:I<l'1AL,A/,'!J/,\'.'01MEETOFII,A.E.TIlSUPPL'(TEMP,OE'{IC!:IJUIA!EllSIOIVA>l"TI1'Y.1'1..FORI;EEUFo"\.-mEHIGllf>1';YWIU..L""'....Il1!.!'>O"'l.""'It.,>Jtl'[ATIe>!\l.oo.l"'<"."""'Do.lOT""'T''O>J""GoI\l.O,L.,.\oIL"-0''''''0..,"'....t."*'.......,;,...."DtJ,......"TS......./*)_"(M't),ANDA'-;;O*4i!!*<III(d,,"(I).'$.)£AJff-r4V*4Tp".,.".....,..,..,,H,S')MoT,PA'DI'IOF/J,UfLYi!****,:.:*.:4:"'i!AAIU"-/JJV__Nr.uw,s,q:"$'""""'i!.Q.....-...."'",,c,)4'P.,swnl:H"'PffION_N,;;>rM,s'QC,.5'Wrr_,IJ',.,.nil!"";;A6.¥"C"!'""""ATMN.;"HI.Ut_r.II"_'7.,1$c£.s,&"It'Q.'n'IJd"'_.'.J!",-",IV.IN1t5',"I'l....UIC.IC."(U'I\;ICa.)-'"---E"IS[NT-(SYSI('\?')l!.lfS:>0,\\(I,IT-I11.M.l10',>>,H'[y."vr"ill"'""Dor'IRua,."'"""",:tITIlt'J1t'"0,"":J[f."N*'1"",_,e..,1"'"rlO."at*Otr.I,".'I,A.'nt,.,co:c,<O("01S"'*,"nowHtnr.10reNr.I.)...',;,1Le:IIQIO!;'LL."0:r'lO"".'Tlt<<9.\llall(S,',.'.""1m;'JEA"OtTHlfc...;.05Sr(lloU011LC50\",...I,Mr..\N""'"*L'"L:*,;"'l",c,-p,n"y""."11I'U.',Cl"U**il".L,_._--,IlI.I\IGHLf'H£F1flU'?...-:-""Y'NU,,:r.rwa,'I'I'.....".OA........LJ;>JUVEL/(S5'.lS,£/v,117)*SUCTIQN*Il....TA8L£.It"...ou.oxNIYTRIPIRAilWil'.>n:£\1EII*fa,,:>I(,MOlINJECfII)t.!\(rOl;rl1<I_REF7rcw**"**_-_*----..-----,W,.J"_,,_V;\!,lilU,'1111?1'::OtlES,l1_..__'lim_._-,"...._..,,,-,._--,---*.J1N""Qf,:!OLcr,!CSTtAM'JO'JT;;jl,1'.:r;:::;:\::rst)f--'!l"'7£'MP.TeMP.:;W.-,_J)/f'F,..JI:,-_.SWltct!,__,\tel<:,1.<>(;.(<:H"UOG-,C,"<dR"!"AIL.."TEAML£1IX.j>j;rLSYST£/'f*$<,:',ElL>,""'-17(")J£ACTOO\lATER'-"VELl'-'cO.HOwL,/'AA'/11'DSITlClNSl'lI.llI:C.If.,T'JI:.IJADSfE1.1E!"V!>J!J§_it_1_"r:;1':;:L."T,;",-:(j(,l(I)L..,.,-1N'1....T'ON01'"0.0'iIp-<</A>ln,...4',<j;""",...",AlUO-":E,>fATf.N-e",.,.,,;;;':';;""""#..-...a...""""I_N'LFIGURE7.3-6SH.IAPED-B21-038<1>REV.8REVISION13-5/'17 1.Dt'./c'.c:.'__lALPSWITCI<IN*OPe.N"POSITIONRMt,;C.R2posmoN:'WITCH"nOSE"*"OPEN*MAINTl\lNEOC.OIHM.T(£"12:SWI1lt.H'CLOSe;""OPEN"MAlNTIhiEOCONTC.TFCD.NUCLEARBOILERSYSTEM"",,,.,,,1>_I"....)DF..VM'o:(M*slDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORT"",",s*..'"FIGURE7.3-6SH.21<7"'('1CClN,/<,OLSWlrlNINPOS.RMSCf'l*FOO:>.Lce.....lTYp,(.....1.-1'0'1.)M'{M'Sj,'.<ILE;M"A*...-<<-,..If':t:.;Ei..I;!(1),",LOl.I(,l,(D)AUtDEVICE1":0OPE."-I[r,d*'",""....<v,,-<A,Trh*""n111l1200\i.O0E'f1((551lD\lJlJ()M....IN*S'TEAM\,.INEMAINl$Ol.ATJON-'4.'2..CtHORseA!.-INU",TOM,Wile"vh,VERMSE*SEAMIS3IIiEUNLESs\TESTSWISIN.\STORE'POSITIONRMIS.fIIEVALVE1$Mtll'lEfl-ll\M09<roGPENAIQieSnrOI'lT/oiQ:S'.lttl$W1Tn,:>,1"'::.------,,,,,II,,PI:l....I'l.S,'V.:rITEMPff]'MI$SWEWIlEIJ.*f.LII,l"tfWlll:LSE1POINT,LO(.lCI>Wl(:£,£N£Il:MZ:rot>'II£:WlIEUl.fJ517EM"SI;;TPQlNlRMS,CR",Ptll,t.\IS'l.'V...IttSE1'"1MII""!>CR1>\::,,'CtCIS<l5CMAIN5TEAMUNELE/>,KCETECTIONLQ(;IC'A'.IClS4(i>LCGIC'll")elMIe"'WNSTEAMLINEHIQI-<FlOWLDGIC."'"(C154ZlJX,IC'eO)Mc>rr10J,-1-._,,,two"""00""n.x.'wHy""0"'"""""-"riO.,lYP[APFn-R?I-1?i1R<?)RFV.91?11?i/%

SlY.IN*OPE.N"OO'.OliltlNRMr.(RSWlI'tw<:>>NT.$........."oIf..."....'"A<:!'_"'.._....HI_"",,,,,OFCD,NUCLEARBOILERSYSTEMDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTlll6-K&(CJ\..tilISIm"r(R?E.RMlS':.II/ElO(,IC"(O)..IIXDEVICE?PERMIS<:,IIIE(PEflH1SS:VEvm:N'a(0)WHEN/loUIOLlK\:LINERt\D.ISHIGHC-l0,ROMilll"II,SWITC.HPUh'lIS<:'I'IE(P<:Rl'I1SS:Vf;\,WENIOColeAltlWHeNMN.Sf.I'Ja.o!;E.AUtbrVKEISLINERAO.ISPOSITIONnEEIJE1\loI<.EOHIGHH",M"Dl".1.}--!PERMISS;VE\WHENfF:M""\SIl!TCI1INNORMPOSITIONMM,"""-\\W,,:::rMS)><O..2711'"""'"01'**..,'""'.-?ei;'fleNTORIr.....I,:,iI'rfilM""")WilENOltlYtTOt-QUE'\-FULL'!'OPENo;,ETi'.:l\NT...1';:,,£jOPE,t.JIIr"CR£\IER!>11l.l5COt.lTAoCTOQ7l!*M'It:Elc."jJ*/'"..M"""''......._1-..........,*,."...".rEITJWf-"IN-,oNe;;U<!""P05;TIDNNU.$""17'"INk,,;Sc*a1_,..1<'Ii'PEAMI>>ffEWPl:\_.r-<VAL"E15N<JRt:."T/Ji'No!"ENM>.........r"'u..rI.=""""'""'7I:NI$_.-ii,,"tI.Or-VM.VEII,,___.....l",puo"",,,,l";,ENERlO],I1----IVA'LVELIMIT.1WI7<'.'II'......l..-lNlIU'Bo.o.I1.DllE'l'lcrsSI\t1\IJ)Jll,'l.,o.(\(LTS()M.!I,lN'S'TENvILINEtJ'Vt,1N.!I'VS'tEM_FIGURE7.3-6SH.2AAPEO-B21-038<2A>REV.2REVISION1210/95

---

.----_._-_.----_._-----._-.----_._-------_.-----.-----_._-_.-----------.--_.----_._----_.-----------_.---------------._-.-----"----_..__.-------------._---_._-------_.----_.---------.----_.-----_.--.----_._-I'fl,.V,l,;,r;EllIC1'I,l'F03I1"OPElolLP"----IIJETPUMPI,,HI034LP,.(J9,11.13,15III,,IDIPRECOFlDER'"'r--FLOOP"S"F!.OWSIGNALl§tjIII:j[lifrIJETPU",,"IJErPUMPIIIW,FlOWMWICAUBRA,lEDJErPUMPIDIPs"IFT4517,IS[x.onaJJIII'IJ<MtllCJllADScOilTfiIO/..P'Nf(.f'AlWIlE<:0...J..J..'S,E/z.,lY:/./f+(I)<>>'llTTnIm'A""'1ARMEJlell."u&llBU'I70}//'I(Jfr\ENTAAYcoNTAcT(AI.SD:;r-UJ..,.I[l'f<>M>z)!fAoItMIl.5.IVE\<<.:CEl=P.llCoR1'-e<,,",1IIRPV>CJ"EI'lSETpl;J1IrNazar:.l..PJSUIL-/f/.L/...SMANUALRVFOf38-LllWTYPo(tHANN£I.*B*MIlNIJIlJ.RVPQ/JlF-Jl/fOH)DUANEARNOLDENERGYCENTERNEXTERAENERGYDUANEARNOLD,LLCUPDATEDFINALSAFETYANALYSISREPORTFCD,NUCLEARBOILERSYSTEMFIGURE7.3-6SHEET3II,REV.3.-.J

• GEMuc/earEII9rgyDESCRIPTIONITEM©EXHAUSTMUFFLERCONTROLVALVE[]JtIDNAMCO-QUICKDISCONNECT,PLUGIN[l[J'EC210-29025W25FT.CmLEP.C.FLOWCONTROLVALVE-1"IJ'ITJMANATRDL-'PCCMS-160D-SV21-X074D-EP(J)4-WAYCONTROLVALVEOJNDRGREN-'FOOI3A-EP(MDD.BYR.A.HILLERCD.)@3-WAYCONTROLVALVEIT]NDRGREN-'C0007A-EP(MDO.BYR.A.HILLERCD.>2-WAYCONTROLVALVE[5]NORGREN-'BOOD4A-EP(MDD.BYR.A.HILLER)PILOTCONTROLTHREEVALVEMANIFOLDIJDSOLENOIDOPERATEDA.C./D.C.COILSAUTOMATICVALVECO.B6930-081@GASCHARGINGVALVEELECTRICALTERMINALBLOCK[]JJBUCHANAN-'NQ0212006CD20"/5"TANDEMCYLINDERx15"STROKECDHYD.MANIFOLDWITHINTEGRALCHECKVALVE!W,NAMCD-QUICKDISCONNECT,RECEPTACLErnlJ'EC210-19001fi2,P.C.FLOWCONTROLVALVE-Y,"ffi2lMANATROL-*PCCMS-800-SV2D-XD742-EP.'4'GASCHARGEDACCUMULATORWITHWINTEGRALHYD.FILLVALVEEQUIPMENTNUMBERSCV4415CV441B5-=\.Vobb'\"0V(,;13:r-----1I(If?I?Ii'jjRECEPTACLEPINCONFlGffiPPToonlyDApprovedwithDApp.roved-NeedoDisllpprovedmlcrl:lfllmabJeJI----1;-SOLf2EG-;::;--I---3aIJ120V'60HzSOLIL/1----L5..G..-120V'60HzI----WSOL3\6.L.l...-I\o79/7/942/20/9201/21/951/8/9001121/951/18/901//9711/30/8912/14/89DATE10/7/9410/25/94fADDITEM15TODESCRIPTIONWASSHEET4OF9ECR152ADDCLUSTERNOCHANGETOTHISDRAWINGECR173NOCHANGETOTHISDRAWINGECR167NOCHANGETOTHISDRAWINGECR159CORRECTTYPOSECR162NOCHANGETOTHISDRAWINGCHANGESOLENOIDVALVEWIRINGARRANGEMENTNOCHANGETOTHISDRAWINGCHANGEDETAILNOCHANGETOTHISDRAWING37REV6II45891012NOTES:l.CIRCUITSHOWNWITHCYLINOERRODEXTENOED:ALLSOLENOIOVALVESDEENERGIZED.<:)INDICATESPORTDESIGNATIONASSTAMPEDONVALVES2.oITEMNUMBERS.REFERTOASSEMBLYORAWINGS.DUANEARNOLDENERGYCENTERNEXTERAENERGYDUANEARNOLD,LLCUPDATEDFINALSAFETYANALYSISREPORTMAINSTEAMLINEISOLATIONVALVESCHEMATICCONTROLDIAGRAMFIGURE7.3-7APED-B21-2793-0B5REV.4REVISION20-08/09 100\90\\,80,\70'vFLOW£60\§FLOWAREAl"",'"UJ0:'"50POSITION..J""\,z0i=in\0400-\30\\20\\10l_---......000.51.01.52.02.53.0TIME(sec)DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTMainSteamIsolationValvePerformanceCharacteristicsFigure7.3-8 SENSORTYp.LTODCBUSINITIATIONLOGIC1-----1I-,LTODCBUSMANUALOROTHER}INITIATIONSIGNALACTUATINGSIGNAL-------,POWER---110+-----,IIISWITCHGEAR--1IPOWER--,IITOEQUIPMENTTOEQUIPMENTDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTypicalECCSActuationandInitiationLogicFigure7.3-9 L7,3-10FIGUREriIGriPRESSURECOOLANTINJECTIONSYSTEMJUANEARNOLDENERGYCENTER::WALIGHTANDPOWERCOMPANYFINALSAFETYANALYSISREPORTJ,OGlt-"**************-*_000___c.-_.......'O.*-***ca_uuoLBIIIIlr11l:I'I._*****.***.*..*..,_fltlC10"0"_'il.******-********...[1.......tuPIIlULtcIllMJIT__,,1.._STSTOO-**_._******_1_....Ie'"<.AniXVI"""'"_""rc::'SUCVI__l!....._c,",,"tTl""'.PUP'lP'SV'TIONFROI'!CHAP'IElER..1..JI:I'll'If+!.!lEENlIT£'1z.lS".,...I......",*u!'OsIS__0'DOrPT'"ITI'\U."-""'M,.ot>FOII!lI'DI""tC="I''.,_TI,,,,,""J'tA'\.1II11UT1:'""LU'......."..""t,yaTU:........'1I<t,."'al1'"'S,.....TE'"""ua:_.lH[:I.,""',_..U...*......".._-1......-..,.-",c,.Oe'ltOCT",,'e__*..._D,C.".'.0.>cT:l'lct'(Ult:1U,.,.....__OC-'I<.E"'***C....-S**u-."""...."..."011r.ITO\K..,......."""nUl'8",Y">,(.:..Il.........-0tt;M,**""ToOZOlIlllV'tEIll*.,s.o.wr.,Of.a.....""""M:;;!WI'IlInn.",IsnI[T__"-,SIIo'<'L.....c!II:"'"'HI;n"'{'f>UToustt""...,tOIl'1M[fttlfltCl15O<..T,,,,£.':",IJIL....";"n>Ill:UIll'IC11-&"l'Ias<_""""",,.U'_""1T!lI1t!lrur.H)8."""UltAT,[O,_IlltNT""'"",.'_""'-§f!,"'......'DolT.Sl£ETIN......'0'u=-1".-.....,..,*1.,.....<>-Tt-.tr!CUlCCf'.lilt-..-.....,__....11111.lsoun.._or110roll2.1'ROl'I....OII1-:,.m,:'i'i..*sL'.""_....ee81:_moTEl!Il'Tn..-c"""'-aiDnn.._r=.llImo..........1.IIl.CI..lM"'LD1'6'0.--.<<t-lltoI.IIIQUIII"H.UtICD*--oilHI.__1'61.*--****__*******0(11*1****__f'Ql******-*---*****...[11-1_10l'llM:_lfttT1llr=****_***.****-rn*1_I._'_'61.'*'*'**_'*'*,'*'1...,..T,lCltlnTlllrcll********,--'**_...['1*1_.,_'-n-a.n;",,1'(10*****--****-.........u.U_u_u.".",0-IJ?,_____C_*.'.I.'"PUMPI'RIIM'KAI"l&ER"'0,,,..r.!EENOn!"ZtS'iItoNolLa:iIt')."':IttWi,tI,....l<='I'L11---__APED-E4Ha12<l);j'=:°1'.8".__"'-;>.l[_,....,......_TI........_.....*UIClN:t.....lUPollo.e:I'G'!'!t>LT....ND'17i$Cl'NTlNUIDI"/.4&"rs6.11'As.....IN/U&A7'4"""-'N'_':UTN"HW_hAI'<l1It.lW1.1INlIN*...,rrioSrAWrw.....:,a./...JG,lfIr.sWI4.4.dT!'IINCTION.TNAIS""'0*"0.'(""".lI...,:;:)'.."'l1'I1:lISOtllneN(NOT!I)'SU,"I"lYLINE',ou:rlONVIIlV£MOFQClZNlITE'SZ,5".10STEAMliNEVALVEFtn/!'2.,S"(,11Revision11-4/94 2I:::.A:ol:"l"1?eT"\(,0"(,-emI!.....u..I,JI'O.'I£.j>C.GlOS!l..1"""1.0['l/IIKD6'\"-'::>rWER"'---'Iv6!\!AL':SISi...\'t..oo,Itt>I_IeCOIfTIIOl"l'OliQ..->IGllUJI.......,;,TIJ".....,f;:l(Il,.t.U5T;."'CI,-,1o<Q'11l0'Ii'!!RuU:,a..l!lOl,.,.nONW<J.."[tl\f'l:r'l.....'0'(..x"til,til>,Et1*..(3,,,,"'1:MOVFOOl:NOTFVLLYCLOSED-v...,,'-';'T"'_"\.1_/.,IOru,l.PC'i1,,!!1\.\C"UUfll\JL="LOC...l.-I,,-*<RT"QH-rnIII/\N-H--{'-.)I'0\U,r-:--N,r-.'"VrVi!c--",1u'-.-,V,l,GUUMroWDt:N,,o,,TI!HIlil"oI,.tVIll-""P£RMI$SlV(W!f:R155(C.llf,,£DELAYTABLE1lURBlNECOWDIT10MALJZF'IINm..."lol6tleVlcltNOlAal.t!.IIlOlL(.OOl.EIl':l\Sl:1I.OILTU'lP.......I-X-l'AloIlC.il-OWI-1N41TU1HI.z""4!K?!Ii'--JCONOENS",,.EO!'l,t,INPOT01'.......'fALIIESO"."'0,.31'UJ'I&IIJ£E>>lPilUSHIGHNI./"..*l,I.potlmowI!-'N,oc?.::,..STr,I.l",.....HI","OilI"lUIWt<<&k!1I1:=...L?<:6th-11'I&WATI,II,:>62dQr..S*.......'SPPJNC:o,.."."T(')"*_,Nr""Ni.O"...........'TOU)'-"l"'l"'i>lDP"Otl">lT'Otil=:.J'iii..,IAU.lIIUMtyon..PUMP....0*P'lI\I!F,&V,Cf;I'.1'('rl"ti"UijSTEAIoI*,'l'CTIUc;o;11.0,"'1..I;calt,.7M"t.ClWU"ltUI!.)fhi_W\I.,]IXlNTMI.,.,..1'"1>101>".POft,1l0N1<,4-,<:'11/ilIHIGoHLEVELo!II.cc.A\.,gAB!VACUUMClIlMP......A<:'l'1,,,.'1i-.Jl1l:'o;DI..EN.OIO!S:N£iH.IU:O)INiYII'SUPPlln'.lKN'tCAAl'Il!Illl,\l.UillU'l:L,fMl'u!LOCALIJJPOSITll:NSWitCHIj......'NT.....N03tON"...c;l'i1.IN..."l"1c....<'I.lU.T:l\.OC"."1..*PO"<.1110"""'"1(,ONn:o.'WN,III'*.P.Mln>lv[\....*"lIT......'*.,....::...........,......\'_ITlONIN"!\UTl;)'/o..c.srA,RlER1'Z*IiVlss.".I.""",<,el..I,,-,cl..r"'/?-S1,Sl)L"TlOtO1""P',0;.lNI'TI"T'iO'"LT1.I1l&\t,lESVP'l!I'lVI5C<<Y*"III.V(_+I'ltF0.-*(T,'P)l!Pll'50ITlllN$W1TCH-'Aura"tllNTIlCT15W,Hi*....uT':iVAI..YEFA,L,CLO!iEp0.......IRLINEOR.I\INI'JCLATIDN,\0rYP1C"LFORADFDUE.lJE5ltCIlZUPEA"'j'!i&IVl!.wlllNSClLUlOIO...........P1LQ'1".....AI.\II:Dt*fNeftGIZEDc!elM''''I1/11I_SITION1m,tS:RII011.F'ILIOI"I'tRt...T1.....Iji\IN'Thf7IDH\:..p,OILU'ltL1-UWSTrAM"iIlI'P\.Y"Uto.'\IS"0T\l9,'t.1Mf:1"10I"Oc5I(MD-ZZt:lZ);4/'1'f'S/3oS",jIIN"IVVN-rIPD$J7/4>""Jilell!/.\\=--',/PfltMIMI...l!.WMEfiWilEN£NERGI1.EO-Il'l1l*..aT..........<IE/If."&.IIII.RGoIUDUlCAI..IOtLrA.><l\IOIL.U'Il:l..I*!!t.1i\/Al.vEeN01'AIR*.:>UMP150UiJONVAtU,I,OrozrTY?IC;':"FORAllrot"If'/;nC'1'tV!.......£'1"'",...n*'''I",ZIWARTAUXIL1...I\YOILPUMPi1:::V.7 COMPANYREPORTn'!:"')0VL,\jLi\UInA"!:"I\R"0'"uu,i\jL..;-;1OOANEAIlNotDIIPt"IOWAELECTRICLIGHTANDPOWERUPDATEDFINALSAFETYANALYSISL"INJECTIONSYSTEM0..;;;3:....-_-,-L/9Ll.'oIALV£FULLYDI"F.NVAt..VEFUlLYOI'fNICONrRCl,.'nvI\1j'CLO:'E"IPOSITION'R.or)'rOT!t.,p..........,....,JilJ,iYCFV11:1!i'.ir,'"IHl"CIJN1T1A.,.IOt.lCONT,RDLiW,SJGAlALtNC\AiE*!IiIclI,---sunOl<1:1""'&.c:a/('SEALINNOT.REQ'0QNFe"lWHENLCWLEIIEl,.SlGN/ll..t5pJ.E5un0.,.REViR!ol..,6n...,vier.....LOCALIll"............?IEDA.."tyONfLE,"<,-...Sif;"."...._..."....\.,-.1..\1,;10"T,IJol1(,..e'F'QILloAOfrQlI'Z.4!1)roMP.e"RDMCONDENSATE'T1o.NKVALVEMilHOTtt.tS'IIIEIIC.TO'\""ATl!'lLI:VlLL'SDL.TOTli!IP"fUREIlNE.ItU"BI!,AU_TICTltlP4£ehtOTl!:nIl"TUR61NEilltlPc.oNTIaOL------_-;=====;--'WI(."-nJlte,IIoI"LP(ONTRGLIAI'OFEN",.O'!tlTICMRM!>(F!1l-l1"TURl!oll.ll;;E::.......V!l>T1ZONYPI::I,!p;"""".'II...Pi,DoC.CDM'TAC.TOR,2.PUMPl)lSCHAA&;,VALVEMOF006(np.FORD1SCIolAR.£VA.LVEMQFOO7)NOn2.Sirtr,.TM;.....I(,£I.I£RATCR\\!,,'"/,*..r'rl<.OL1..Utl,."',!I"-='x.!S!e<;><>!,jIo::....C.'rROlo,"IC1:lIoIT1lOUDI4-i\..OC.Al..itt'-----------7>,JR6iNEaPEEOCOI>JTQOL,---_IIioIPC;!'LOWI*!Itlat'!J1..!iiiIco,.,7FWL:OW.,1II'!lTOPPOSITJIlN1;'1'1"AII!I'-'---'hC",,*}o'.7'ANK;CND£N:..;'",*,..UMPTO,"veT/ONII-"....'f,.;"J£IIHI.:!ow....\py-,qi.,POFLOWI'!,OW"i::G:'<\LI-----1oJ"""UlAA1"1..0.....8V"......'!A....-:'t>.:eoT-.":'"...'"'-,........:;IR",!,!G."""I)I)1>1T,."o<1!L"V£.L.HIGHIHKI,i./D,£4-"';'(3)j.._*v.......I,,,,,,I.'ONOrN5ATt.!HiGHjUl'ALi*!j,i'OSITlOU-----_.Ij'll.l LEGENDLWL-LOWWATERLEVELHOP-HIGHDRYWELLPRESSUREADS-AUTOMATICDEPRESSURIZATIONSYSTEMCSP_ANYCORESPRAYPUMPRUNNINGLPCIP_ANYLPCIPUMPRUNNINGLRP-LOWREACTORPRESSUREDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORT-__TOCSPUMPBACTUATIONDEVICESTHISFIGUREILLUSTRATESTHEECCSACTUATIONLOGICINSIMPLIFIEDFORMANDDEFINESTERMSUSEDINSUBSECTION7.4.2.SWITCHIDENTIFICATIONINHPCIANDADSISTYPICALOFALLSYSTEMSSHOWN,NOTES,1.CORESPRAYr--------.L..._III----------,I-_TOCSPUMPA........TOCSAI.....I.A_C:..T__U_A__T_IO:..N:..D:..E_V__I.:.CE:::.S:..I__I__ACTUATIONDEVICESL-.J---lII-lI-__TOCSBIIACTUATIONDEVICES..........---'------------:-L-_-.=.-_.1--JCORESPRAYr--LTRIPSYSTEMA_1"'---I-Q-Lw-L--11HDPIBRHDPILWLLWLHOPHOPL_deBUSAdeBUSB........TOEACHADSVALVE------------,1II-,I--..}TOLPCIPUMPSB&0_I...ACTUATIONDEVICES_...TOLPCIB&0IIACTUATIONDEVICESI'------------------'LPCITRIPSYSTEMA1,IIL---i'--r::"--,I--}TOLPCIPUMPSA&CI-....!e..ACTUATIONOEVICES-...TOLPCIA&CIACTUATIONDEVICESIl----Il1""1""---HPCITRIP1SYSTEMII..J_______TRIPSYSTEMLWJIIldeBUSBWITHCSPLPCIPIAUTOMATICBBOR0TRANSFERTODCTIMERBUSAI_______--.JHDPRHOPHOPLWLRLWLLWLLPCIr----------_LIdeBUSBILWLLWLIL.::...........r-------tLWLTdeBUSAALPCIPCSPA,ORCAAORCAITIMERI_L_TOEACHADSVALVE......TOLOOPSELECTION{...LOGIC...TOLOOPSELECTIONj......LOGICI......TypicalECCSTripSystemActuationLogicFigure7.3-11Revision3-6/85 CENTERPOWERCOMPANYANALYSISREPORT82'1-1010at1&1030E.'ll-1oDlOMHOSoODUANEARNOLDENERGYIOWAELECTRICLIGHT&UPDATEDFINALSAFETYFtE:rEf1P'1!7D()l;,l1tmlit.-HUtlEN\:SYSTE'MP&ID".------2.HUO.URl!It'U..EFiSTS'!r'MHD-----------::'l.A'ESIOOJoLwDIIOvALfW-------&....tCQtSPRotTsySTEM".1.10-----&*-&*--LCJR'tS'I'STtMDES.Sf'E(;..--&*-*---O.'111lt.1FCD-----------1.ReICs'I's1r1"-rll;o-**&*----E1.llXol-&*--*--------9.-*I$'TSTE.':P"ID*--,---------1D.ELEC-.[OUPS£P.S..,.:5.---CoreSpraySystem!:t'Jlli..11."I'HI:SnfO!ASOR.Mo'II5H:MII$Y$1t"!I.[II'f:R,t,Tl'\IG.Ant."'ILf'MWAJUi:L[\/[L011N'liM1IN:5SLIt[51GN.lU..13ASMo,,,'1"PUIIJIIIN2fP:l"LMJllIUA.R't'POolER:.LJ:.1tn;PI.JoPSL[.-:'01"1STARTSDEUoYC.o[]C)lt15TS'rCMD"stAll'TSiS$fC..D*l."'rroOl..'5'l'5TU4IOF'EId"onE"MAC.T-QRt£WPM:SS.P(AIoI.sm'U)1:c:*oP£'N$Al"TflIlIl'UC'I'OIlUIV1"R£.'S5.F'ERI'I.F"1)05AS"I'STEM1-0f'ENS"rrDIRE.rcf1:lf1A'JPfI£$$FllO'1'lFOj,,,I.S'\"S"I'EMr-tl...D5l:Sff"aI'tJj-NG'g.£,LAYrD15I'l5TSTOIn-(;\.OKSI.()p£N*I<<Jn£'UYrO:3-1s'T'fl't'Dt'1CL.O$[S"fTERH.CII'ESTABLlllm:'l'"..QIt--I'lUiMlIT91UEbf!!;!:I(RTlIIlEtI£lJiT,"001f"1lIS(c..(,00:1-1'11$[1:..:5.M::!iEQLDIC[,A5.alC)lTION,..-E....IsvsTbl:IIPOI'(;ti'1M.C.1l-DtIolllr.lF"l"DIfIYFMSfll:31AB(kItlIJcMlDVAI..."I£fot)4.AF004e.IlIIIJNUISOl.;vll1.vtSFl;I05..e.........:lUl..llotlll'oILLUf"00l."rDD1BPlW:TECTIVETI\IP!!l4...W*trltE..,.5IIol.U.I3IErA(jol"OIHE/!tNTlt1A101oF'OWEFi:S.BUt6,**e;tMl'DE.,H!.r""TI[III'NlHl(iRSU$--.Ssptc.I.Ai,L.....r'JIMSTRtJIlHf5Aft(PRtFI,;E.DBY'NO.1E.:2:IICtTtt:.lIWlSENOlO).s.fOR'LOtAH'Ji....,orIlr.lST1lLJClfl5!ifttl!:IMS"'l.[lATA.IN".[IIPl.rORtAttLntSTA',KNi.,'5tt1'&IO'SFGI'I[)II'lIiIoL.'I't*...t111K>LiGHtS.-0PAoctSS'NstR\KNtAfIOO.10.11'-is'fO1)Ita;M1IICII-(;11.TN(can:S>RJo'l'S'I'STENl!I:DtSIGNEDI!N1IIT'l"lRi:.f.Lg.J£._S.."STEM.,-ro\..1Ci.t41iI)l'JWloI£M()It.JMANUAL.,Cfl/OPENSPlt,o,)'OUTBoARDVALVEMO\'004,0,CDR'E....PRA."'I'iN"'O"..g*v......v'"MQWOT"E,.lI,t.t'3*2-f'(};j17l(l,v.:;;.......1([(INPaS.I,L5rOttl.a-NO'l.0"I£U-NOHDTOS"(S,TUo'tIII!et.F'OID"£.O6....,.....'lEiCF'-lleveRS''cO",nCTOR42-..C.Ol<ESPRAYPUMPCOOIANOU52:f3MINIMUMFLOWBYPASSVALVEMOF031A"lOT!!Z.43OPENCLOSEAIRCIRCUITElR.EAKER52'"=::j::.POSfnON'AuTOSTARrSPR'....R"ETUR"TO<....\I'm*FRO,",'STOP",START"TRIPr-------,..----,.....I"IIII,1IL.JDIE§@LGF*CLOSECLOSE,-,..------,UCiCUIRESCO'"C,IDr;i:N'fIOf"SWlltoH82.1.1t03lA1"'th.....O.,...c8:t'..lORetl-NJ3,1)TO,"3E1.....IV,Io:IL_OPENT*PAt.v,LVEMe11="015....T"ROTTUNG"NPE(NOT!;S2f3"EVERSIN"COlioT"CToR....2if-,..-y-P.COOIS!2P05lTlOUSW.....C.L051:'-QPE:U'MAJVTU\lB)c.OlJTAC,T5l<<"'I'LO<::....eNII]PIlMP5lJc..TlCNVALVEMelFOOIAT"(PIC.__LVALVEMeF03&#lo.p,(DTti5t.t'3.Figure7.3-12,Sheet1APED-E21-007(1)Sheet1Rev.7Revision86/90 VAlVlNOTFULLVOPEN..,.,..w'"aN',I"oS-/",_.VALVENOTFUU"OPENICLOSEREVERSINGll.l..jI--*I/.:.::;;;;;..\-t;M<<."""'......,,""'",..._n,.,--.....-NPTICLPII£F.I...".PEM...""'....:WHENS*."'GoNALLPIT]...""=,,$.......I,\,CR/ALIGHTONWHENSULEDISEM"'INUltTI\..Ri:SnLPCOUTIUlt..1iW.'U*Close'POllino....REVERSINGCONTACTOR42*'-fd'"n3A)TESTBY-PASSVAL.VEMOFOlSB("''-3')THROTTLINGT'YPE(NOTe",:;-)COt.lTFlOLS.....PoS.TIOUDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTIICLOSEjSJ1:::;.,-;:;;;:\r-=....'"IOPENjR.EVERSING>CONTAcroR42..<<ICO.HItD....IN*OPE*PO$,T,ONI1V-"L.VEUMITFIlU.VCLOSEOL1M.SW,.,,,'"COI\'EfoPRAY'N&O..JlDV"LVIo:1Il08**\PER_.<$_v£_'<E"""N_...s""""."'"'v.'-VALVENUr'Ftll.L1"OI'£,18-\"""'-"':\PEINW"ILlCLOS,"&*,sw.I-'NI',I{n.-",,.R.s"SEAL'"sn.RTVAlvES#II.WN"-""-,,,,"NH.{diCONTROLSW.IN*oPEN"POSITtONRM5CR.--1.;*""",n.",.$'0'''u<>.#_....ro_WEN'""'''",.-.""",T,,"<-,,""-'./N"pENCLOSEIOPENCOJilT.....CTOR42...coI'"'LOHTflOL'5w.IN'OPEN"POSITION2PQS'T101JMAlI.1TA'\JE\)COIJTACTSI<£'I'LOCI<*Ol'E..-PoS,T'OIJrTIPliMPSUCTIONVALVEMOFOOl!;T,\,PICALfORIIALVEMOFOS8BNOTE3e-/\\--#,.$',oII,-"""-;#'w"-,,,,""S"T,oNi:*P""moN..>_"'"")I--"T:-'"'1_S'_r<"oW"""__.....""0",s_"""".:r*2'""'0*,.."8",.*z,.,.OPENCLOSEF!.'EVERSIN6CONTACTOR42."MINIMUMI'"LOWBYPASSVALVEMOFD31b'MO*21<!Y)NOn:"3r.;;;;;;;O:;",=CORESf-ft""OUTBOA.RDVALV!MDI'"OO'\f,NOTE"?>1--------------------------------1CoreSpraySystemFigure7.3-12.Sheet2APED-E21-007(lA)Sheet2Rev1Revision8-6/90

.. ,. f 5W\1"C.. '::oWI"TC:I-I. Kl::'"fLOC.. 'N "'Q1='E.,.,..

• ION CONTROl... sw I IN "O"I!:N' f>OSITION '"' '" HtJ'TI$ /6. ISJI' -'fA.II'rS "'""'"' /NDft:lrl VRLVE NSI11'1tMI WIMN nJNNUM* SWITCH M IN 61HMG MN.D 67" P"A!M T"/!H .. THE cl WilL-' NOr NNt: .,..,_N, ?W/S /S TYP. Mllt*JI'IIII ** -M*-1'1/S M"0-,1;1111t4D -11111*,11 N**.s'*IJiioll -MII*/'1/L IIIIIJ-FII-60 NIIJ"'It,...IB -NII-1'1+1 llf0-.Feti7B -/>IU/J-I'P * .I" ,.,._,.,. -Me*/H'I -Nit:I*/'Ptl. /tiD*,I*M -MII*/'IIIS .WII-.#Wl7B * /lrfll*l'lll' ... Milt*F*&U -lfll*lt** Mllt*N24B -MII*I'Ifo 1/N*Itllf!.H--MO*/U& /'#11..,..488 -+rllt*lf.ll Nk!*M+111f-N"I*If.J'f 1Vf*-H6BB *MD*I1'f-T ceo&A-"*l.&'P.S t.-ID"-11'-&&* C"ID&-'1 -I'III*IU7 * ___ ... _____ ...,. .... _...,__ .. __ lB. THE OUTPUT RELAYS FOR PDS4S4l-DS4&H ARE ENABLED WHEN A HlGH DRYWELL PRESSURE AND A REACTOR LDW-LOW LEVEL ODNDlTlDN EKlST. I 'ONTROI. sw I IN KCL05E "051TION '"' ' l'liRMIMohll!. WHILe.tLO'IINC!I (VALVE LIMIT SW \ PERMISSIVE WHILE OPENING W. WHILE CLOSLNIO ..... lliNI!II:'(,LII/6 Ci.&
• P 5/C"TI N VAl.; &. 1"0 TVJIIc;,t,L* FOJit SIIUiOIIWNCOOLihLICo SIJtTlON VAI.Yil" IILO l!llCEPT A.'il NOT£0, P!.JMP sJNcH "' " VALVE SYIITCH O"EN I CL05E 1\C 1\!:V[RSLNGo CONTMTOR 42. SUCTLOt.J FROM :.uePR['SSIQN PQQL NQTE 3 SYSTEM I (NOT£ S) I I VA!,YE FO?.OA RI4R SV.STiMI INITIAT£D .,tt*x Cl'l TVI'It:AL I'D/II. .SYSTEM X FOP... TYI'It:At PaR. t:OOI B,C.,l) 1:00/II,.C,D lfHA,6/IJ, £11* '1(11) " TYPICI\L Ff>ll. COOil.l!l,e,D ............ PIIIJI*GOO!I -*COD!I PIIIJI*CODIC -*CDDID "1!!!1! ...... ...... ""'"" ron* /"IIIlA UIIT caa1* nu: , .. , .. , .. IT*!FTS m.-.:.. !TIIFI"SM .... O(LA* STJIITS llfl£0. ITAIITS IS S/R. IIUT D'"' v*lW: r-* CLOI£9 IUVICE W.T£11 ........ COO*A, C, I. 0, SJlll' lT _l,_ eJ 'M'l 9" ln!IW'! puvl pwR --coou -*cOQio ..aJ.m
• SRIIIEJC! IIIII! *s COCliTIOII * !II:RVICE PIIIJI!
• SAllE Jl CtllllTI!>>> A O!ETTIIt:CIE!.U Of"'U I. U-l CIIITIIDL !l'l'III"GI THIOTTLIC T"fl't: 110 ¥*Lwt:l UU.U. IE DESIIJt:D Tit li.LO\III.ILIIIL"! Til. ST-.J at llf'f D£!1111:0 3. Z WITH :IM,F/11.1* 8' c #IU ow THIS ;z ,lrH .si/Jr,/Jt-a.o IIN8 ,l!EIIIU'"7".6 .sHI"r.ll"ti/Rt lJ/IG.It:8 /LolllliiWN 4Y IJ,U'/11111;4 (&..U.. !, 'IIIILIAR'I' llt""ll I DlYII:ICI Alii: NOT BillioN C11 T\4( tiM"IIQl DI<GIIAM DICEPt-IQDSI TO CL.AII111"T THE IIIWII'Dt:NTS, 6, IIDTI'o'E FIW!:R rCR IYS"TIOI I PIN'S !IIIAL.L. DfiiGIN*Tr P"IUII A DlfJtiiDI'T MII&!NCY K. U THI!IIllll: 11M'S liT II, IID'L"IW: I'!MII rct1 w*LIIIL"S IN 111111 mlniiS IH.OLL IE fa AUI:IIIATE DIE_.,. SllUIC£5, FCII OMR VALVE! IN EACH S'tiT(M ""'-l OIUGIN.OTt r101 THE !Mill 1115 f"OII !Y$UM I J, ftQI/5 LIGHTS IIIM.L. o,! FOL.LMt /6) ¥/oLVEio !OM:£11011 f"OII CLOSED 1"01111011 ,..,, l """ -It REDCINf"OIII'IM'-IN;. I, TIMI!C IIEYIWI fii'LL. 10./UST"'I..: nD1 a TC FIJLL SCALE, '1/LI. SC&L.E 511.\I.L K AT Lu.sT 1-1/lL T\ICI lllltATtR T1tM1, SPECtrliD" nl'l: SEnlta, g, A\.L t!JJI-I IIISTIU4DITI ... PIIErl.lm II'F til, l.lll£3, -* 10, TtE TaUII PRUSUII: .. ITQIES IIIE fUt DNt OUT or T\10 TWICE LOGIC, *11111 II' LOGIC-IICCT 2, E-l, II, 101'1 LGCUIOI' AI(] lDE"'LrltaTION INSTRl.I'IENT!I S<:E INnRI.OI:NT Da14 9f£tT LISTED .. L I'IIR EaCH INSTIUilNT. It-THE CIRCUlT roll MEidl CET[(;llllll .... YAI,Y£ 1£LECTlQN lS TO IE SO THAT F"OII.I/IIE Qf 0 IIMiLl DEYIIZ aR CIRCUli TO F"L/NCTION ON till-WILL !tOT PRE'IENT CO!IIIECT IEL,Et"IION Cf LOOP <OR INJECTIQo. LJ.
• 14, THE R[SIOOAL HEAT R[IIOYAI. IIIALL liE OESIGHEil IN attDI.:lANCE WITH REf, 10, l5. NOTES CONTINUED AT lA-51 A, .. A<W<J" MI"J_....,., I, RE$1GU'L MOAT REMOYOL * * * * * * * * * * -£11*1010 7, LCXOHC SI'MICII.S-------* --*---------?lol,-1010 J, NI/CLEAII!IIlllill 11'!1 PliO * * * * * * * * * * * *--* 4, 8011.U 11'!1 TCO --* * * * * * * * * * * * * -IITI*IOJO lo C<JA( SI'RAY 5YIP6\0 ---------*---*--*[l!*IQJil 1, R[C,RC, fLOW CCINTIIGI. 11'!1 PliO * * * * * * * * --* * -llal-10!0 7. lf'tl S'IIF"CD * * *-* * * * * * * * * * * * * * * *-t*L*IOJO I, IIC:ItS'iSFtO *********************UI*IOJO I. IW:.tTCII liEC/IIC, -'"U ""ID * * * * * * * * *--* * * -1131-1010 10. iU:tTRltll. iQUIPICNT !tP.liiATIOI'I f(ll SAfE.G/JA/11 SYS *
• II I'ISTW FtO-----------11111-1010 """" *
• SWITCM;tA/1 LlE'IItE 11JNtTION N!,M/U U!AS 9P[t, CJ7,1, DUANE ARNOLD ENERGY CENTER NEXTERA ENERGY DUANE ARNOLD, LLC UPDATED FINAL SAFETY ANALYSIS REPORT RESIDUAL HEAT REMOVAL SYSTEM FIGURE 7.3-13 SHEET REVISION 22 -05/13 _j ---------------------------------------------------------------------------------------

SYSTEM..REMOVALHEATRESIDUALDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTI.\l;MTa":WMIMU_AllIAWIlING'CUM.aD",JITI.,.,."MWR9WH'90IN"V'!:h't"(FORV/ILVe.HUMUI.'!or.-.:TAILCIf)II*"....l1li-".,ISYSTEM:a.rlf."".Ift;A6C.ifCUTAtU.IWIt"JWH#",rO't!I"'.Ii-/T.,AN"./"aNS.'..III-I""M*/93JNor"IH$-J'OPENAt"WVElt.1\lNlO41.IruMeSUCTIONFROM'yePRrnioNpOOLVALVerotA'I.....e-",.,)/lCMO_,#DD'DC,.,D-,D+.I,...ouI'A4r1Td4116)IOPENI'E'oIE.'&olN6CO"'TAl:.'Ul'"41.'"!lit!ruMP'S.U:"TUIHv_yl.1'09..'(DJT"l'PIu.lo"OR.ve.TION............SMo1'OO66(D)heU'"It,!MOUD.I"'O,"""l0""=.,.Oil.',,\IIP'".",'f::'UlAkf...uC",C'II'-"""Ie-UPOR....ctrlfIJ1.64c.'"JWlLE;sw"'1_N.J-flr-SMO-lUIII$-I.,CI5-1&0,.,.-/'91&$*''U:1--IU.1/$.Uic>C,J.lit/"STlflr--.fill1tt0*/l1l0",.,11*'00",""0_0**0:J.....$1\1'*'S,.,,4r***,1417'0-"IT"'-"",'lIN.r.'*AiI"'-"s7>>lr',FIGURE7.3-13SH.IAAPED-Ell-00CJ<IA>REV.1REVISION15-5/00 IU!F 7-11 FC2 Pl'ai'CR.M!.D 11'1" THI& SI!'T OF" swm::HE& [l..ii-I.IOil '"'"' l TWO L.E\IIil. TlliP POi..,Tfl I I _j S'IS'TeM I ..,.. 111.-.llol'fo\IW*D CONTIICn ON'tLo ' *rn.oc* CONTQ1SN IN 'OPEN' "'"'"""-"" IN'CJ..OSE' PO'a!TION """"ION RM. 00 OM* ' j j \SUE 1DIQU'i WIIU.E OPiNING. ...... _.,. -I OPEN I 01..0!£ I .. 'l!o!i!IMC§" WAJSL "f'5D' l!ftL!I* MQ "PlJo\ WH!.t..l -,------_," LOOP SELEfTIS!N LEV£!. DUANE ARNOLD ENERGY CENTER NEXTERA ENERGY DUANE ARNOLD, LLC UPDATED FINAL SAFETY ANALYSIS REPORT RESIDUAL HEAT REMOVAL SYSTEM FIGURE 7.3-13 SHEET 2 REVISION 22 -05/13 ' I _______________________________________________________________________________________ __j SVSTEMII cqr.rr+thfMfNT !f'A!'!!!' MOFOM.lTII!li!ZrTI.It.!Go T1'1'f.J T'I'PICAI.. PCR DUANE ARNOLD ENERGY CENTER NEXTERA ENERGY DUANE ARNOLD,LLC UPDATED FINAL SAFETY ANALYSIS REPORT RESIDUAL HEAT REMOVAL SYSTEM FIGURE 7.3-13 SHEET 2A r",,.Il(lVEME/</T,f1}TY"£CCII,'lNG,CA.'C-R$'1"5ItDISCH"!E"OEIIHl(,Hli"',"-Oil.""""'OUa,a<";<I,,'3tlS"*Ol)"rtWU"AILUUSH,3IIREVISIONII-4/94REVE1U.INc;.CONTAe-TOIi:4<'..'"]Ol'LNFIGURE",e."TUou>'Nl;:o1U!.\/E.NT\UlJ..VE....0-"ATYrorORlLHEATREMOVALSYSTEMDUANEARNOLDENERGYCENTERIQWAELECTRICLIGHTANDPOWERCOMPANYFINALSAFETYANALYSISREPORTAPED-E1H'l0g<3>REV.12.1"PSPCN&,Q-lQCcr&"-..rr.0l"I'MOFtllQ...,.....TSt*u.W)/Emwrn.IN:iI!Yf'El["ON2.talEf*,0-'3POSlTIOW_*OPE""**...:;PSlIWG"lETCONTJIl:lLIi>N!g&:........--lU*OPeN"1""CLott!'Ii'OtlITION***'",<LPR.,,*PiRMlllrllV'i\Wllf:.NIj,)olOTPel'tMlftlWf..-NN4U1OQPtN_S'I'T,...,)-""'"IcrtnJOCItIA*>GT\QoIowVl'!iOIC07ao1\Il0'JI\wi:lOIUIlT'O\.,lRMSCRZ:PC)SfIlOtJ'5W'CLMF"'t<fl.PROCESSS"'...."I.!N!i:VI\LIfESOl.VALVE""01"1'\1'"YPl"ORFQSO'"i__Tps....e!i'RR:I!!U.SIIJENLfl-.uJErTYPRR$tOE1Lam.n....JOI'IH'tttJlPUMPMINf\.QWI'I"PlIo.'U.......Utl,.,01:007....(NOTE&)<.S'O,mow...........W1It,lNT.t.II.IEl)toUT""CT&G'I'lOCK""'-!:-----N'""",,,IN'C,L.Q;E'..,mON""'-........*_1l.Et:!.O\lNt!>,I""""t""'"i>Gj..PIC-WIn-.STIO..TION"""""'":I...,;oJ"",""""'"'0r"--"""'ONI'U.!Ptrol;NOTK1<l;'(.H,)""""-'-=..,m<';";::0I"".-.........."ir=--I"""<lCaL2.e'lOl'l>Ul\Iilli{==!NG-'-'"""""UM.:l..f.l:,."-.I=u;I_'TWOJaNEQ&INQ,CCN1'llCTOIl.Z_1Il:eggl"@*MEA.TI.'PW'!"BCO!Jt9!!flmv{) ',,"leN,.MO.....,n,..'l.I'LvaWITtlI"OllTlOMIWlfe..'eMfN't}NCI1I110RESIDUALHEATREMOVALSYSTEMDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORT!'Df_1I1...£NlfII.........r.;;;;;;;:-;:"_'lllOt.TIOI.l'1WI'IIM.IT",,1oJlC'I)C.)l.lT....CLon.----spaettjMP'Tsa..'I:tWI!C!:W:WgKl1W-"",on'IN!'!'lI"WALy')rMtl*...,)FIGURE7.3-13SH.3AAPED-El1-009<3A>REV.1REVISION14-11/98 PUMPADISCHARGEVALVEASUCTIONVALVEBPUMPBDISCHARGEVALVEB61'3REACTORVESSELI:IIIIIIL---t;4-JLPCISL:__-_JINJECTION.l...[....INJECTIONVALVEB_.VALVEASUCTIONVALVEADUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTLPCIBreakDetectionLogicComponentArrangementFigure7.3-14 FCF*2.3SXIl4c.A(DIJANEARNOLC)J.mILNIl*M'_sErDkIVEMOtORHIGHSWITCHGEAR*DEVIC'EFUHCTlllflNUMBERANSISPECCJ7:I;IIti1=PUMPTRIpI1I&.H,5WIR;.r1G,D.P'I-f.."UXILIARYRELAYS,s.....ntffESETCARE!tOTSlillWNEltCEPT'ft:1t£"E(ISsAIlYTOCUR,lfY,THEFUNCTIONt.rHISDEYItESEIlSESWHENTH£plJIoIPHASSUllEDAWDFUMtTlC*SArtERSEtTIMEDtUyTOOPENTHE""SEAL-IN".I!UHstERVDlTAaESUPPl'I'TOTHEYOLTA,EUGtltJ,fORAtIDINHIBITTHEIHeWLETESEQUl:NCE.J..SHEETFIGURE7.3-15FeDREACTORRECIRCULATIONSYSTEM--@DUANEARNOLDENERGYCENTERNEXTERAENERGYDUANEARNOLD,LLCUPDATEDFINALSAFETYANALYSISREPORTI1'LITEM1110.REACTORRECIROJLADONSYSDEStGNSPECREACTORRECIRCULATIONSYSP&.IDB31-101l'1NUCL£U1ID1lDl.5UTEI<lSIt£51llUillHUTRrMllYAlSYS.TDllOlleIUCTOIlttttl.c:ULATlONS'rSTEHElUIDI"--B3HQJO"t,I5M(t,)'Jt.rwtlicrl&llJeLalv-1AIl,,-C71-001I!ECt/tI'.VLlTIQKp""",prli'ff'Ce."TIMJ.*-MIlloOI'J(.cIf.$'l)II4t4FIl;:LDTR.IP7,REFERENCEDOCUMENTSREMOVEIJ'fIlETRIPSIGNALSCAUSETHEDEVICETOH4INTAtMATAVA1.UEEQIIAL10THESLIPWHiCHISPAESEllTAT"Ie:TIMETilE:'n\IPSIGNAl..w,lo,SNa.WIl:C1l.DSl01""MOO!orCONTROLIELECTltltlLIfrDItMlLlt,EtCJ:5H.....\.I..AL'SO<:jI,(}SrSLIPTOBEMllMfltllfEOATTNtSAMEV"lUE,tr;-Z1ot.JOTttlIJtEC'I'IDtiS1.3"S.6.TR.IPGENE.R,6,'TORLOCKOUTRELAYa;.Ci'if@-----4-"POSITION"PULL-TO-UXKfiTCP:,*NOIllM...C,*!oT.....T*SPR\NGRlT'URNiC'FROMr.oTlotDllllll;,.\Owt.M/GSE.TDRl\IEMOTORBREAKERAPED-B31-014<l>REV.11REVISION20 MANUALRE'iO.ETPBlOCAlMjr:.DRIVE:UCTORc/'05EOPO;'OEAl-RESTARTLOCKOUTDEVICE"A'1."LUBEOILCO!JTP.oL'!JWPUMP'Wi.'"1>.'1.."If-lRUt.<IJIII.lGoiCO'M',j"_\Wl-lE.ULUBE:otLPUMP"A'2."OTRUhllHIJG'""OPERNEIRESETAUXILIARYDEVICEI,pISEEf.lOTE5jI'<I"'IV[",,"TEP.Q9E.COND'i>1LPPa;.\TIO\.l'!oW5PRII-1GR(fUQUTO"1-10RUAI"jAfTERLOW-'.IJW\c.m.lTROLSWCOlJimL51'1.LUet;OiL"C"itJ.'C"If.'.'!'>TOP'PRESSURE:P05IT\OIJ"LOC.!!,L/oM',.,,iOW:>TI\RTIS:OPIoCMOTOi<STARTER..LOCALIAUXI-UAi<YLUBEDIL"C'("0"fOR'.'i.TelCIRCULIl.TlNGL.UBEPUMP"A'l."SEENOTE:.*WflaJWBEOILOII'A'!>"NOT\l;.UlJl.IllJt,'"'CODEVICE!CMlll'UXS'N,j'At"IlJ.IID'0'M"ICl!o,1:7,,ISTARTIIIACMOTOR':lTARTER4,.ILOCALj;\CONTROL$-WLOCJ<<)IJTOEVlCE;'oU'lN"At.'R!:1l0l'O$lnON"..'M',jj"SW1t,"IIl....l'll"."/>Il."IhI'AUTO'I.DCKOUTC£VICE:'/:.7."I'lESH'M',"j"jPERMISSJVE'l5l'.COI,ID'J,RESTARTLOCKOUTDEVICE"AI"ILU8!OILCOl>llll.OI.PUMP'AIA!'11.1R.Ut.ll.JlIJG-RE'!IET"PO'blllOlJA,"'"',j"PLRM1\:lIVEWHE>.!WmtOIl.PI,lMP"AI'"IOPERATEIRESETIAUXILIARYOEVICEL-'='->lM5)("COW"tROl.'AI'\1>1"AUTO"I'O'!IITIONl.OCKOUTC':.'\tE:'AI"OEIiIC(CPRoM'>'citCal<n,.OLOf,W,"1\1"11-1CIRCULATUJGLUSEPUMPA\NSEE:NOTE3__STOPAc'5TA.RTER4t*IlOCALIH,IRE\!llp-RlI..J:;C\{OtJTDEVICE\;':'f!'LPI;,,NAU10","'COj.,lTROL'loW11-1"aTAR!'P05lTIO>.lACMOTORSTARTE.RCIR.CULAT1IJGWBE.1UIvIP"A3SEE>JoTE.FIGURE7.3-15SH.2FCD.REACTORRECIRCULATIONSYSTEMDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTS'N'!>TC?-RE'3U<0RM';X"'(P£RMI'nII/EWHr:I.lWilE01\.LPLUBEOilPUI.AP",0..:1"R\.JlJlJlllGCOIJTROLSW""'!t'IIJIOSTOp*RE!lET"PCF.llTlOI..\ISTOPAPED-B31-014<2>REV.1REVISION12-10/95 LPCI(RHR)'l.LPGI(RWR)IINITIA,TeoIIAllrSIGI-lALSOeRIVEDIFROMlPC.1(RIlR)':>'iS.---UseeREI'".4rIL_NOTE"FeD,ReactorRecirculationSystemFigure7.3-15,Sheet3Ill.-DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORT;]i\)jOlO,.JLij::.LQioLOCKOUTBU'POWERA.VAlLI\.I'lLI'.LIGHTOFFVAWEISI'UlL'((LQ,>EOlM.slll.()<1JIll:,/0c:<.r:JnL:':.."TYPICA.LFOREACHVALVELIGHTOFFW"ENVALVEIS"'tiLL'"OPEIoJ.lM-';,;WOIol\NllJ/EPPC1"-1r:"i'Or;>/.'RPCl'iZo;AKEIZc.L.o,,;:;q,<;;'l.""0W&'i!.,7";H.7AREC.IRC.ULATIOtJFLOW(IJllMrl'1\.lGCOIoJDrTlOIo.lLPCR41'*LPGEJJERATORFIELDBRE....KERCLO';oEFORAOOlTlOIJAl_AlARMSEEREF'Z.52'*5WGRE/D,'&3[-1&(4.H',5IOAf'a)1='O';;"'.BONLYOIL>-IISI-IH.Mf'.VALVES2.,:>BQNLVlUB!.OILLOW1!lREAKERC\.ll':£LPFO'!>18l=O?l:z.e'0'TYPICALFORSET'6"AUXILIARYlUBEOILPJMP'C'StART4t,*LOCAL.('1."l.OCM.CiRCULATINGLUBEPUMP'AI',HARtREVERSINGA.CMOTOR(4?)lr.SUCTIONV"l".VEPUMPDISCHARGE,,"lVEf>UMPDI""HARGGVALVEITUMPSUCTIONvALVEPUMPDISCHARGE"VA.I.VEPUMPDiSCHARGEBYPASSVALliEOPENIFVALVI!NOTFIJI-LVO?EIoJUA&.:!I1A(lULVGI"'JERATOFl;lOCKOUTRel.AYTRIPPEDCIRCUUTlIJGLUBEPU\.AP'A1'STOP42.'*lOCAlSlOG>>-LPSHt,M&YPFORCIRCUlAT1\.lGW8E.PUMPS'At'"AWESAR.eSHOWt>.lFORBOTHRECIRCULATlOtJSIo'-\(FUNCTIONISTYPICALIOCRe"c.HVALVEASItJ01Clmm)VALVE.:;'I,.:!l&&.:!lIBOlJLYCIRCUL"TILUBEPUMP"Al"'"LPTRE5TART{...o'WfuELP/CR'\.T'l'PFORCIRCULAT\\Je,PUMP':!APED-831-014(3)Issue9Rev9Revision7-6/89 MAINSTEAMLINEAMAINSTEAMLINEBMAINSTEAMLINECMAINSTEAMLINEDc:"C)D:>:3::t>:t>OJ-iDfT1fT1C::>Dr:t>V>fT12:rt.,.,nfT1CD-iOJz;0:t>3:t>;0.,.,rrnz0<Cl::>V>rrcCD:t>D..,.,.,'"CD:cfT1:cfT1......<Cl-i-iZ.:::r-<fT1WRO;0I.,.,:t>'"Z"-<en0::;::t>0r:>:nn-<fT1fT1:::rV>;0ZOJ.....-i::>::>V>nfT1CD0;0;03:VIfT1"":t>02:;0-<-idPISAAdPISBAdPISCAIdPISDAdPISABdPISBBdPISCBdPISDBdPISACdPISBCdPISCCIdPISDCdPISADdPISBDdPISCDdPISDD ISOLATIONSIGNALSIIIIIIr------------------IIIIIIIIIIVENTSTEAMLINETOTURBINESADVENTAD1---hS'-i);Q--ff---,HA/SREACTORr-----------.------,1ill---H!IIIIIIIIIIiIIII:III:IORYWELLWALLIIIIII:IIIIIIIIIIIII::IISOLATIONSIGNALSII....----4------------..DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTYPicalArrangementforMainSteamLineBreakDetectionbyFlowMeasurementFigure7.3-17 B//0-r-----------lAUTOH--tr----------IISOLATION:IrSIGNALIIIrIIII../"n1.-o---IIII_.........,.-IIIIIIIIIIIIIIIIIIII.....,....L.":/PSL"I!:I/PSL":,,)1I/IIIAIIIII/dPIS";:/dPIS"IIIIIIIIr-?'........-.I1/PSL"I:1/PSL"-,1'1'"IIII0TEST0r.J00'00'0'0<;0STANO-BY:]rIC/,C',IoC/'c/'CACiIIIIIIMOMOIIL__-4.---]l____...___.JILI'"'"-'"II\../""-/I.---IC0....A...."">>-....A-......I..........DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTypicalElbowFlowSensingArrangementFigure7.3-18 wf-.."..0=>'""-\J------,nIIIUJIziiiI'"=>If-I0LJ11/'\:I:+-"J1"-/II<<In\1/":I:..II\"./'-':rIIz0",T<nUJ0UJ"f-"'<<..",f-zUJ>('LJ\V;1;<<<<"Zf-,.wUJw0f-0'"wZW>-0<<"-'"0f-V"-DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTypica1HPCIorRCICHighExhaustPressure,DetectionArrangementFigure7.3-19----II-----'---L.-><----<-'"'-------ozOV;<<<----1'-----""III"I1""':"l<:'"'1+-0-III EMERGENCYAREAVENTAIROUTLETVENTA.IRINLETIr----------,NO,CAT,OHIr--------------------------tINDICATION:i-----------------------IIIIIN024IIIII:,..------}INDICATIONIIIIIIr--IIIIIIII,..-------ffiTS-!---------,---------!-ffiSIN601I,IN602IIIItA.1IjIAIIIIIIii:.A*III_A.,II,...IIIIIIIIIITI@E:ISOUTION:@E"028N029I:"030BBBIIIIJIIIJI'1IIIIIL-!---------,--------!-ffi:28,IIIBIIIBI1III'-JIL.JIIIIIII,tISOLATIONSIGNALDUANEARNOLDENERGYCENTERIESUTILITIES,INC.UPDATEDFINALSAFETYANALYSISREPORTHPCIorRCICRoomTemperatureDetectorArrangementFigure7.3-20ReVlSlon1411/98 --Ir---IIr----==]I,f-I--,,,:,,,>",,Ui'"f=Ui>Ui,,0_0....Z",Z,,"Ui""'Z'"UJOUiOzXoXUJUiUiUJ0...."'....UJ"I""'UJZUJ0",'"Z,,,,,,,-I--,,I--'II.....-L--I--z,..,,,"2z!...JC)0-9...Jr--Jw(()I-0<<:1-:513I-0,,'"-t_JrGJim+-@),-___J[}--ID--{[]...J"0ii:>-....,I1IDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTReactorWaterCleanupBreakDetectionbyDifferentialFlowMeasurementFigure7.3-21 rTYPICALOF10r...1---,II:QE:IIIIIictJ:IYIL.__!...._-IIIISOLATION>SIGNALy;LTYPICALOF6ivENTiU:-TiON------VENTILATION""INLETOUTLETI:88:IIIIIIIIIlOTSJIIL__---IIIAL1-1IIISOLATIONAZGNAL>'VIDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHTANDPOWERCOMPANYUPDATEDFINALSAFETYANAlYSISREPORTReactorWaterCleanupBreakDetectionbyHighAmbientandHighDifferentialTemperatureMeasurementFigure7.3-22Revision11-4(94 UFSAR/DAEC - 1 7.4-1 Revision 23 - 5/15 7.4 SYSTEMS REQUIRED FOR SAFE SHUTDOWN

7.

4.1 DESCRIPTION

The following functions required for safe shutdown of the DAEC are performed by the systems listed:

Hot Shutdown

1. Reactor trip capability - reactor scram system.

2. Reactor coolant makeup

a. RCIC system.

b. HPCI system.

3. Reactor pressure control - two safety relief valves (automatic and manual operation).

4. Decay heat removal and suppression pool cooling

a. RHR system.

b. RHR service water system.

5. Process monitoring

a. Reactor vessel level and pressure.

b. Suppression pool temperature.

6. Support - onsite electric power source and distribution system.

Cold Shutdown

The same as for hot shutdown with the addition of the RHR system in the shutdown cooling mode.

7.4.1.1 Reactor Trip System

The reactor trip system is described in Section 7.2.

7.4.1.2 Reactor Core Isolation Cooling System

The RCIC system is described in Section 5.4.6.

All components necessary for initiating operation of the RCIC system are completely independent of auxiliary ac power, plant service air, and external cooling water systems, UFSAR/DAEC - 1 7.4-2 Revision 23 - 5/15 requiring only dc power from the station battery to operate the valves and to operate the RCIC turbine control governor. The power source for the turbine-pump unit is the steam generated in the reactor vessel by the decay heat in the core. The steam is piped directly to the turbine and

the turbine exhaust is piped to the suppression pool.

The RCIC system turbine-pump unit is located in a shielded area to assure that personnel

access areas are not restricted during RCIC system operation. The turbine controls (see Figure 5.4-11) provide for automatic shutdown of the RCIC system turbine upon receipt of the following signals:

1. Reactor vessel high water level - indicating that core cooling requirements are satisfied.

2. Turbine overspeed - to prevent damage to the turbine and turbine casing.

3. Pump low suction pressure to prevent damage to the turbine-pump unit due to loss of cooling water.

4. Turbine high exhaust pressure - indicating turbine or turbine control malfunction.

5. Automatic isolation signal - indicating RCIC steamline rupture.

Since the steam supply line to the RCIC system turbine is a primary containment boundary, certain signals automatically isolate this line causing shutdown of the RCIC system turbine. Automatic shutdown of the steam supply (see Figure 5.4-9) is described in this chapter.

The RCIC system turbine has two devices for controlling power: a speed governor which limits turbine speed to its maximum operating level and a control governor with automatic speed set point control which is positioned by a demand signal from a flow controller to maintain

constant flow over the pressure range of RCIC operation. The RCIC system turbine control valve is positioned by the control device which requires the lower turbine speed.

The RCIC turbine exhaust high pressure trip is set at 50 psig (nominal). This pressure level permits operation of the RCIC during hypothetical small-break loss-of-coolant accidents when high pressures could exist in the primary containment.

The turbine-pump suction is normally lined up to the condensate storage tank. The

backup supply of cooling water is the suppression pool. Provisions have been incorporated into the RCIC system logic to provide for automatic water supply transfer (switchover). The sensors used for the switchover are the safety-grade condensate storage tank low-water-level elements. These sensors and their associated circuitry meet the criteria of IEEE Standard 279-1971, Sections 4.9 and 4.10. The logic of the switchover is such that the condensate storage suction

valve is not closed until the suppression pool suction valves are fully open.

UFSAR/DAEC - 1 7.4-3 Revision 23 - 5/15 The RCIC system is also equipped with an automatic reset switch. The system will restart automatically on a reactor vessel low water level signal after it has been terminated by a reactor vessel high water level signal. The automatic reset of the RCIC system as well as the automatic RCIC suction switchover (from condensate storage tank to suppression pool) are in compliance with NUREG-0737, Items II.K.3.13 and II.K.3.22 requirements.

Evaluation of the reliability of the instrumentation for the RCIC system shows that no failure of an initiating sensor either prevents or falsely starts the system.

7.4.1.3 High-Pressure Coolant Injection System

The HPCI system is described in Section 7.3.1 and 6.3.2.

7.4.1.4 Safety Relief Valves

The safety relief valves are described in Sections 5.2.2, 5.4.13 and 7.3.1.1.1.

7.4.1.5 Residual Heat Removal System

The RHR system is described in Section 5.4.7.

7.4.2 PLANT

SHUTDOWN FROM OUTSIDE THE CONTROL ROOM 7.4.2.1 Description

7.4.2.1.1 General

The capability exists for plant shutdown from outside the main control room in the event that the control room becomes uninhabitable. If the control room becomes uninhabitable due to fire, the central and local remote shutdown panels of the alternate shutdown capability system (ASCS) are utilized to achieve and maintain Safe and Stable conditions. The alternate shutdown capability system consists of one central remote and four local remote shutdown panels. The five remote shutdown panels (RSP) contain isol ation, transfer, and control switches for existing equipment required for safe shutdown of the plant. Alternative ventilation is also provided for the Division II switchgear room in the event that the control building HVAC system which also cools the Division II switchgear room is lost or must be shutdown due to the control room fire. An alternative procedure for plant shutdown is available in the event the control room must be abandoned for some reason other than fire. However, a control room habitability study has indicated that a control room fire is the only event postulated to cause abandonment of the control room. 2013-013 UFSAR/DAEC - 1 7.4-4 Revision 23 - 5/15 Communications between the central and local remote shutdown panels are provided by the plant paging system and a sound-powered communications system. The sound-powered communications system connects the five remote shutdown panels together and can be connected to the plant sound-powered communications system by a jumper located near the central remote shutdown panel.

At all times when not in use or being maintained, all remote shutdown panels shall be locked. They shall be visually checked The alternate shutdown capability system was designed and installed to meet the requirements of 10 CFR 50, Appendix R, Section III.G. The DAEC submitted the alternate shutdown capability system design to the NRC by Reference 1. Transition to NFPA 805 evaluated and credited use of the Remote Shutdown Panel System relying on the Appendix R design. Reference 3.

7.4.2.1.2 Hot Standby

In the event that temporary evacuation of the control room is required due to fire, the operators can establish and maintain the reactor in a hot standby condition from outside the control room by using controls located at the central and local remote shutdown panels. Other controls at appropriate switchgear and motor control centers are also available if needed for backup. These controls may be used as needed for various functions after reactor trip.

The reactor must be in a tripped condition to initiate hot standby. Procedurally, this will be accomplished by initiating manual reactor scram prior to evacuating the control room. Scram capability also exists outside the control room through manual tripping of the power range monitor power supplies.

7.4.2.1.3 Cold Shutdown

After hot standby conditions have been achieved, the plant can be brought to cold shutdown from outside the control room by using instrumentation and controls on the central remote shutdown panel in conjunction with local control stations and local manual actions. All of the cold shutdown systems are operated under administrative control from the central remote shutdown panel and are coordinated in sequence to achieve and maintain cold shutdown during the shutdown time period.

Control room fire damage could cause control fuses to blow prior to transfer of control to the Alternate Shutdown Capability System. Backup fuses, provided in response to IE 2013-013 2013-013 UFSAR/DAEC - 1 7.4-5 Revision 23 - 5/15 Information Notice 85-09, are installed in the control room circuits that have fuses for equipment required to achieve and maintain cold shutdown from outside of the control room. The backup fuses will be manually transferred into their respective control circuits by operator actions Backup fuses for The remaining backup fuses are located in six remote shutdown fuse panels. (See Table 7.4-5 for panel locations.)

7.4.2.2 Analysis

7.4.2.2.1 NRC General Design Criterion 19

In accordance with NRC General Design Criterion (GDC) 19, the capability of establishing a hot standby condition and maintaining the reactor in a safe status in that mode is

considered an essential function. The controls and indications necessary for this function are identified in Tables 7.4-2, 7.4-3, and 7.4-4. To ensure availability of the central and local remote shutdown panels after abandonment of the control room, the following design features have been

utilized:

1. The central remote shutdown panel, including all safety-related instrumentation mounted on it, is designed to withstand the safe shutdown earthquake with no less of safety-related functions. The local remote shutdown

panels are also designed to withstand the safe shutdown earthquake with no loss

of safety functions.

2. Independence of the controls outside the control room from those inside the control room is provided by the use of transfer switches on the remote

shutdown panels. The associated instrumentation indicators are independent as they are wired through transfer switches and can be isolated from control room instrumentation.

In addition to establishing and maintaining hot standby, GDC 19 requires the capability to achieve and maintain cold shutdown of the reactor through use of suitable procedures. Controls and indicators provided on the central and local remote shutdown panels are used in accordance with DAEC procedures to achieve and maintain cold shutdown.

7.4.2.2.2 IEEE-279-1971

The single-failure criterion is only applicable to remote shutdown events other than fire that cause the control room to be abandoned. 2 Since transfer switches and wiring in the remote shutdown panels interface with and are parts of divisional safety-related circuitry, precautions have been taken to maintain divisional separation in the remote shutdown panels.

The design of the alternate shutdown capability system does not alter the function or method of operation of any safe shutdown system; it only adds control stations outside the control room from which operation of one division of safe shutdown equipment is possible. The transfer switches on the remote shutdown panels isolate certain safe shutdown systems from UFSAR/DAEC - 1 7.4-6 Revision 23 - 5/15 main control room circuitry and transfer control to the alternate shutdown capability system. Power supplies and trip circuitry have been selected to be compatible with the existing plant equipment and to provide a level of accuracy and response similar to those bypassed components in the control room. Indicator legends and ranges have been selected to be consistent with existing control room instrumentation. Instruments which are not Class 1E, are isolated from Class 1E circuitry by Class 1E transfer switches during normal plant operation and are only used in case of alternative shutdown. The instrumentation located in the alternate shutdown capability system is shown on plant layout drawings, piping and instrumentation diagrams, and schematic drawings.

Physical separation of redundant channels, division of safety-related control instrumentation, protective circuits, devices, or components, and physical separation of safety-

related and non-safety-related channels or divisions in any one section is provided within each remote shutdown panel such that not credible single event can prevent proper functioning of the protection system.

Safety-related Class 1E cables within remote shutdown panels are separated from cables

of redundant divisions and nondivisional cables. Barriers are provided where separation between different groups of devices and wiring is 6 in. or less.

During normal plant operation, the isolation and transfer switches are set in the "Normal" position. In this position, the plant is controlled from the control room. Control from remote

shutdown panels is not possible unless the isolation and transfer switches are set to the "Emergency" position. No control from the control room is possible with isolation and transfer switches set in the "Emergency" position because connections from the control room are opened by the switch. Therefore, no short circuit, open circuit, or fault to ground of control room cabling due to fire will affect local control once the switch is in the "Emergency" position.

UFSAR/DAEC - 1 7.4-7 Revision 23 - 5/15 REFERENCES FOR SECTION 7.4

1. Letter from L. D. Root, Iowa Electric, to H. Denton, NRC,

Subject:

Fire Protection and Alternate Safe Shutdown Capability, dated June 22, 1982.

2. U.S. Nuclear Regulatory Commission, "B ranch Technical Position CMEB 9.5-1, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, NUREG-0800, July 1981.

3. Safety Evaluation by the Office of Nuclear Reactor Regulation Transition to a Risk-Informed, Performance-Based Fire Protection Program In Accordance With 10 CFR 50.48(c) Amendment No. 286 to Renewed Facility Operating License No. DPR-49 Nextera Energy Duane Arnold, LLC Duane Arnold Energy Center Docket No. 50-331, 9/10/2013, (ML13210A449).

2013-013

° °

°

°

+/- +/-

+/-+/-

+/-

+/-

+/-

UFSAR/DAEC-1 T7.6-1 Revision 23 - 05/15 Table 7.6-1 SRM TRIPS AND ALARMS Trip Function Nominal Setpoint Trip Action SRM upscale (Hi) alarm 10 5 c/s Rod block, amber light, annunicator. Detector retraction permissive (SRM downscale) 10 2 c/s Annuciator, green light. Rod block when below preset limit

with IRM range switches on first

two ranges and detector not in

full-in position. SRM period 50 sec Annuciator, amber light.

SRM bypassed Manual switch White light.

SRM downscale 3 c/s Annunciator, white light, rod block. SRM upscale (Hi-Hi) trip 5x10 5 c/s Red light, scram in initial loading connection. SRM inoperative - - Annuciator, amber light rod block. Note: Rod block, annuciator, and lights operational in REFUEL and STARTUP modes. c/s = counts/sec UFSAR/DAEC-1 T7.6-2 Revision 23 - 05/15 Table 7.6-2 IRM TRIPS AND ALARMS Trip Function Nominal Setpoint Trip Action IRM upscale (Hi-Hi) trip 120/125 Scram, annunciator, red lights.

IRM upscale (Hi) alarm 108/125(1) Rod block , annunciator, amber light. IRM downscale 5/125 Rod block (except on most sensitive scale), annunciator, white light. IRM bypassed Manual switch White light.

IRM inoperative - - Scram, annunicator, red light.

Note: Scram, rod block, annuciator, and lights operational in REFUEL and STARTUP modes. (1) Represents the maximum setting. The setpoint may be set lower for better operational control. UFSAR/DAEC-1 T7.6-3 Revision 23 - 05/15 Table 7.6-3 LPRM TRIPS AND ALARMS Trip Function Setpoint Trip Action LPRM downscale 3/125 White light and annunciator LPRM upscale 100/125 Amber light and annunciator LPRM bypass Manual switch White light and APRM averaging compensation 2015-002 2015-002 2015-002 UFSAR/DAEC-1 T7.6-4 Revision 23 - 05/15 Table 7.6-4 APRM TRIPS AND ALARMS Trip Function Adjustable Range Nominal Setpoint Action APRM downscale (RUN mode) 2% to full scale 5% rated thermal power Rod block, annunciator, white

light. APRM upscale (Hi) alarm (RUN mode) Varied with recirculation drive

flow (W d), intercept, and slope

adjustable. Two Loop: 0.55 W d 108% rated thermal power (maximum) +

53.6% Single Loop: 0.55 W d + 46.5% Rod block, annunciator, amber

light. APRM upscale (Hi-

Hi) trip (RUN mode) 2% to full scale varied with

recirculation drive

flow (W d) intercept and slope

adjustable. 0.55 W d + 65.4% 120% rated thermal power (maximum)

(0.55 W d + 58.2% for SLO) Scram, annunciator, red light. APRM inoperative Calibrate switch or too few inputs Not in operate mode or if less than 13

LRPM inputs for

APRMs E, F, or 9

for APRMs A, B, C, D Scram, annunciator, red light, rod block. APRM bypass Manual switch - - White light

APRM upscale (Hi) alarm (not in RUN mode) Up to 27% power (Startup) 12% rated thermal power Rod block, annunciator, amber

light. APRM upscale (Hi-

Hi) trip (not in RUN mode). Up to 30% power 15% rated thermal power Scram, annunciator, red light. UFSAR/DAEC-1 T7.6-5 Revision 23 - 05/15 Table 7.6-5 Page 1 of 3 REFUELING INTERLOCK EFFECTIVENESS Situation Refueling Platform Position Refueling TMH Platform FMH Hoists FG Control Rods Mode Switch Attempt Result

1. Not near core UL UL UL All rods in Refuel Move refueling platform over core No restrictions 2. Not near core UL UL UL All rods in Refuel Withdraw rods Cannot withdraw more than one rod

3. Not near core UL UL UL One rod withdrawn Refuel Move refueling platform over core No restrictions 4. Not near core Any hoist loaded or not fully up.

FG One or more rod withdrawn Refuel Move refueling platform over core Platform stopped before over core 4.a Not near core UL UL UL One or more rod withdrawn Refuel Move refueling platform over core Platform stopped before over core and raise power to hoist interrupted 4.b Not near core UL L UL One or more rod withdrawn Refuel Move refueling platform over core Platform stopped before over core and raise power to hoist interrupted Key: TMH = trolley-mounted hoist FMH = frame-mounted hoist FG = fuel grapple UL = unloaded L = fuel loaded UFSAR/DAEC-1 T7.6-6 Revision 23 - 05/15 Table 7.6-5 Page 2 of 3 REFUELING INTERLOCK EFFECTIVENESS Situation Refueling Platform Position Refueling TMH Platform FMH Hoists FG Control Rods Mode Switch Attempt Result

5. Not near core UL UL UL More than one rod withdrawn Refuel Move refueling platform over core Platform stopped before over core 6. Over core UL UL UL All rods in Refuel Withdraw rods Cannot withdraw more than one rod

7. Over core Any hoist loaded or FG not fully up All rods in Refuel Withdraw rods Rod block

8. Not near core UL UL UL All rods in Refuel Withdraw rods Rod block 9. Not near core UL UL UL All rods in Refuel Operate service platform hoist No restrictions 10. Not near core UL UL UL One rod withdrawn Refuel Operate service platform hoist Hoist operation prevented 11. Not near core UL UL UL All rods in Startup Move refueling platform over core Platform stopped before over core 12. Not near core UL UL UL All rods in Startup Operate service platform hoist No restrictions Key: TMH = trolley-mounted hoist FMH = frame-mounted hoist FG = fuel grapple UL = unloaded L = fuel loaded UFSAR/DAEC-1 T7.6-7 Revision 23 - 05/15 Table 7.6-5 Page 3 of 3 REFUELING INTERLOCK EFFECTIVENESS Situation Refueling Platform Position Refueling TMH Platform FMH Hoists FG Control Rods Mode Switch Attempt Result

13. Not near core UL UL UL One rod withdrawn Startup Operate service platform hoist Hoist operation prevented 14. Not near core UL UL UL All rods in Startup Withdraw rods Rod block 15. Not near core UL UL UL All rods in Startup Withdraw rods No restrictions 16. Over core UL UL UL All rods in Startup Withdraw rods Rod block

17. Any Any condition Any condition, reactor not at

power Startup Turn mode switch to run Scram Key: TMH = trolley-mounted hoist FMH = frame-mounted hoist FG = fuel grapple UL = unloaded L = fuel loaded UFSAR/DAEC-1 T7.6-8 Revision 23 - 5/15 Table 7.6-6 Deleted UFSAR/DAEC-1 T7.6-9 Revision 23 - 5/15 Table 7.6-7 Deleted

UFSAR/DAEC-1 T7.6-10 Revision 23 - 5/15 Table 7.6-8 Sheet 1 of 3 REACTOR VESSEL INSTRUMENTATION SPECIFICATIONS a Measured Variable Sensor/ Instrument Type Normal Range Accuracy b Trip Setting Reactor vessel surface temperature Thermocouple 0-600°F ANSI C96.1 - - Reactor vessel top head surface temperature Thermocouple 0-600°F ANSI C96.1 - - Reactor vessel top head flange surface temperature Thermocouple 0-600°F ANSI C96.1 - - Reactor vessel surface temperature Temperature recorder 0-600°F ANSI C96.1 - - Reactor vessel flange and vessel wall temperature Temperature recorder 0-600°F ANSI C96.1 - -

a Other instruments measuring reactor vessel variables are discussed in sections of the Safety Analysis Report where the systems using the instruments are described. b Accuracy is in percent of full scale. UFSAR/DAEC-1 T7.6-11 Revision 23 - 5/15 Table 7.6-8 Sheet 2 of 3 REACTOR VESSEL INSTRUMENTATION SPECIFICATIONS a Measured Variable Sensor/ Instrument Type Normal Range Accuracy b Trip Setting Specially Calibrated Jet Pump

Flow Rate Flow Transmitter 0-4.6 MLB/HR +/-0.5 % - - Specially Calibrated Jet Pump

Flow Rate Flow Recorder 0-4.6 MLB/HR +/-2.0 % - - Jet Pump Differential Pressure Flow Transmitter 0-30 PSID +/-0.5 % - - Jet Pump Differential Pressure Flow Recorder 0-30 PSID +/-2.0 % - - Jet Pump Flow Rate (Loops) Flow Recorder 0-36.8 MLB/HR +/-2.0% - - Total Core Flow Flow/Differential Pressure Recorder 0-60 MLB/HR +/-2.0 % - - Core Plate D/P Differential Pressure Transmitter 0-30 PSID +/-0.5 % - - Core Plate D/P Flow/Differential Pressure Recorder 0-30 PSID +/-2.0% - - Reactor Vessel Downcomer to Core Inlet Plenum Differential

Pressure Differential Pressure Transmitter 0-60 PSID +/-0.5 % - - Reactor Vessel Downcomer to Core Inlet Plenum Differential

Pressure Flow Recorder 0-60 PSID +/-2.0 % - - a Other instruments measuring reactor vessel variables are discussed in sections of the Safety Analysis Report where the systems using the instruments are described. bAccuracy is in percent full scale. Accuracy listed is minimum required. UFSAR/DAEC-1 T7.6-12 Revision 23 - 5/15 Table 7.6-8 Sheet 3 of 3 REACTOR VESSEL INSTRUMENTATION SPECIFICATIONS a Measured Variable Sensor/ Instrument Type Normal Range Accuracy b Trip Setting Reactor vessel pressure Pressure indicators 0-1500 psig +/-2% - - Reactor vessel flange leak

detection piping internal pressure Pressure switch 0-1500 psig +/-2% 600 psi

a Other instruments measuring reactor vessel variables are discussed in sections of the Safety Analysis Report where the systems using the instruments are described. b Accuracy is in percent of full scale.

TABLEIBfZJvESsel-ce*03o,lCi:>'!3ao**o,M-41o**52*33*,f--00-..*,0,,,,,,,25*,0,t;.*ts*,,00,r'8*n,0,.(i>n,,0*"8,0**,0*40'"8_'mA\Il:::t!.SMClJMMVTIP"""0::--'-JCAARVINGswsJSl/FFlXAS1:E'tEClOI'V0'LeJEl.'C'LEVEL-+--IH'a"LEVELHXLEVEL-...,1(0'53*Z4*33*3300-"1",-25TABLE11\IIIIITOFI.ON.....I1lNrf:.c,,::,'fJ>,RTOFAJ)WLNIT'KUNITe,""'"CHN\INgL'A'"LI,,L_,-c:",;"';:,"""ICHANNEt:cL,,L"",Yf;,TcH"";I::>'(P/I.';;S',W1!l4S",'8!'ABCTIPINDEXINGMECHANI5M5---"TABLE2.-.s5IGNMENTOF'TIPlNOE'JCINGMe:H"'NI5oVlroms"10FoW'ERRANGEtXITEC:TOR/SJr.'sSHEET2FIGURE7.6-1lI}ISOl..J{fEOSlGNAL.{g-lOWESfAl.X:"TICNIE."'-"OT,-,me"<£VEL""""'-lEDNEUTRONMONITORINGSYSTEMDUANEARNOLDENERGYCENTERNEXTERAENERGYDUANEARNOLD,LLCUPDATEDFINALSAFETYANALYSISREPORTFLOWUNIT(TVPlCAlDF'qFlOVoNrn;N(>1"E7RODBLOCKMONITOROf>'1.ReMS)LOCALmWERRANGEMONITORflVPKAI..OF'-REACTORPROTECTIONSYSTEMTRIPSYSTEM'",11'-+11-----------REACTORPROTEC.T10NSYSTEM"TRIPSYSTEM*S--I,-(FoRI'OWEQASS1GNMENTSSS'J.'S4EETI)(FoRf'CN.IERSEESI-lE£TI)AVERAGEFUNERRANGEMJNllDR0(TYPICAl.Ol"L...-AOlOlo:<OMV000IZS%PWRTRIPSTRIPSTRtl'STRIPS""""'-E"""""",li..JPSCALE1."lO'NNSCALE:'li""""'"MARMAlARMfM'PS&lRlPA!,.ARM'!RIPeN;';;""APl'l1VlAI.AAMAl.ARMONCHuavet.ONLEVa.ONUNELONlE\IELONlEVEl...1X:I'M'IO'IllEVELONLE\el..DETAIL'CDETI\IL"D'DETAIL'E"DETI\ILFIlFORFUNCTIONII.l..USE01'"TRIPS>ONTHESE:OEVlc.esseeREF'ERENCE4----------------------------',POWERRANGENEUTRONMqlIJPBING(IN$.TRtNe.tTSPAIlT01=K!<OSUNLESSarHERMSENOTED)APED-C51-003<2>REV,14REVISION20-08/09

.Jl-SUJ>Ii:ozo0:UJZUJ"-11,----iJ"'.::,--------.--------,-DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTDetectorDriveSystemSchematicFigure7.6-3 TRACTVEL-HI)LOCALRIODMETER'1REMOTEPERIODJRECORDERREMOTEoMETERDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTIUUMODULEINTERLOCKSCAL\"REACTORCONTAINMENT(AFISSIO-N-c51B0OPERATIONALOPERATIONALAMPLIFIERNO.1AMPLIFIERNO.1PULSESIPULSEHEIGHTLOGSIDETECTORI:PRE-AMPLIFIER10)105OISCRIMINATORINTEGRATORPERI'/*,,-LCPSCPSL.-r-J.CALIBRATEe-SIGNAL.GENERATOR!CALIBRATELOCAL,LrE",IDETECTORDRIVEFIXEDRAMPSI.VARIABLERAMPREMOTE-..:.00--LCRRECORDERIREMOTELCRMETERcrBIOLOGICALJ-REMOTECOMSHIELD:,DRIVESHAFTILOCALLAMPPERIO,.I}TRIPFI...TRIPFOUTPUTII.PERIODTRIPSETMOTORMODULELOCALLAMPITRIPRESETI}TRIPE<IITRIPEOUTPUTI/UPSCALE(HITRIPSETLEVEL_LOCALLAMP--}TRIP0/--r!-lTRIP0OUTPUTUPSCALE(HI)TRIPSETLEVELREMOTELOCALLAMPDRIVECONTROL}TRIPC<ITRIPCOUTPUTI/DETECTORRE+r-rTRIPSET(DOWNSCALE)_LOCALLAMP+14V}TRIPB+14V+15V<ITRIPBOUTPUT-14V-14VI/DOWNSCALEVOLTAGE-15VPRE-REGULATORH.V.TRIPSETALARMONLECOMCOMREGULATORCOMPOWERSUPPLYLOCALLAMP}TRIPASITRIPAOUTPUTREF04<lMINSTRUMENTOPEN0INOPERAfiVEFunctionalBlockDiagramofSRMChannelFigure7.6-4 '-"""NOlliM_INT£AMEDlATE***.,:......-:-.:l;"lIlIl>>\II_1ilQCIo<lNrtOA:l!RM-M..,QC$VoN:.Gt>.<>>->,-':14LPQM-ux:Al.R4NOO:TIP_TIlA'vem.",,",-...MOC._""Ul.'flPl,..£"'...."VI".....Il\ClIt'A"IIlDI'1QN-'OQoIo4::wt>T$:lrIII.m_-;l.c:o..rt'AOl.llClO.tA....-NOPC.D-'"'-----c;.....c'Z-.lOaQa.IIaJCU!I>Aeo:uIIR...-,..----ea-1O/lIO4,AIiiAC'IlOA*"",so..*--...----C711o("7l-1OOII>ClJTPIJTI:I£lIIINt.RIIIC.*----QWt9it*4QD__,1:-..tI'.....!lo...--C'StCOlO"""h1/1I'II'I&r"olI:ll,G:'..ltcu_.'II..._z.tus;w:rr.8.lltI:SlIUT4.""'.wi.,5.IUtWll'Oltlol*.0/11I:OAInu:Jl...UlWlU$lllIfIltNl'"I>:tt:.G.t:=m:::::;:::U:::1._fGII'.>>ft:/ltDl'P_M<l1.......JoIe-l!HUP$UUAUadG'4lnlS.Igg/>d.NIIAACNU>>Un'OIi---..............._"rroAUt(e",__Fa.....-.*GeRe.FROb",,""DRAWA\.liY"nllt.FUWC,"TIOloI'\t$WAL.'WIlI\"C'Tm'l>P4)""TGjlo,..,AO",U-.TIlo.IpaOGIU""...--..."....."""""""",.OORf/;CoRenAI..ASIMONrfllJPKIUALI\Q:MDI'tAL.AAMQNlN6lR1NllRliAP'Jl\E!'DTINl..lJWEfSTAANCiSPQ&ITlON.I(l;NtAOl,.RClDPliA,,!lTl'l/ll)IlIHTMII1S8IFPM:SfilNTPi:f"l'HI1lo",FIGUREZIJEUTRONMONITORIt-lGSYS.EMTRIPREACTORPRO'ECTIONSYSTEMTRIP';;Y$TEMA(nPICld..FORTRIPa-)(l1lllI&e.l'NT#THIlloRl:iNT((}....aT""'£1<0'"'0FOllPR:O"I'ti:-"fU:Uol'FellC()t,l....0""'',DUANEARNOLDENERGYCENTER.IESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTNEUTRDNMONITORINGSYSTEM-FeDSlII.lAt.",,,,,,l\Il!.\,v.A,C,OOIlDAl11'OIIfiGURE3_...........,........(oNrrw.l.QoItDINGONL....)l'!!f..I\CtORPA011IiICJ'Il)N9t6TltI>>iW&11tMA-(fVPiC.N..FOR"JRIPS'IfoTt;/<lB""')r---............61N'"Rt..N'""">ONftl/olleHANNIl'-I,.'i>":niP:till'S-vreEREF4SH2,e*2---1I.."""'"_Tl&IN""'-'".".""0...eUlIPONI..£v£L"""=l$lVEWHEN/O.lJTOI'"*I..tPI""'I$\IVll:t.'t',L__\lIHEIolA.lIl10NOT,,(lOP"IIlG..I**U"C.......---","'IPO...1!tOJ>IlQlItiItEIloCTOANEVTIlCNe..-O!>!>\""f"flTRlPONto*"""""",FIGURE7.6-5APED-C51-002<1>REV.6REVISION15-5/00 SRMIRMLPRMAPRMOPERATIONlO12"c1011,x:::>-J....Z00::I-1010:::><oJz-J""'"0::<oJ::I-109<oJc.:>""0::<oJ>""lO8-Fl-Tu""0::I-<oJa:.I-0::<oJ.Q.T.b..--t.c.:>*J!iz52I-""I-<oJU::""0::-I-<oJ0::..---Q.:::>=1-I-0::""l-v>'"u.JI-0::u.Jv>i!!O>--J-J::>...100100.1.01SOURCEDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTRangesofNeutronMonitoringSystemFigure7.6-6 VOLTAGEPREAMPLIFIERMEANSQUAREANALOG17.I\IICOM+15V-15VILOWLEVELHIGHLEVELiAMPLIFIERANDATTENUATORINVERTERIOPERATIONALAMPLIFIER.<Ilrl/l-IOPERATEAND__---..1----1,CALIBRATESWITCH'VL---'piRREMOTERECORDERDETECTORDRIVECALIBRATEANDDIODELOGICUNITCOMREMOTEMETEROPERATEAND1---CALIBRATESWITCHREFLOCALLAMPLOCALLAMPLOCALLAMP-}TRIPCOUTPUTUPSCALE(HI)ALARMONLEVEL}TRIPDOUTPUTUPSCALE(HI*HI)TRIPONLEVELf----TRIPCTRIPDL.,LJTRIPSETL-----'I[/'-f--'TRIPSETL---'TRIPRESETRANGESWITCHREMOTEDRIVECONTROLIIiiL__-}TRIPBOUTPUTDOWN*SCALEALARMONLEVELLOCALLAMPTRIPBMODULEINTERLOCKSTRIPA}TRIPAOUTPUTrnrL-----r=='-f-_-_-_-_-_-_-_-_-__I_NS_T_RU_M_EN_T_IN_O_PE_R_AT_I_VE1DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPOATEDFINALSAFETYANALYSISREPORT--rTRIPSETL---'OPERATEANDCALIBRATESWITCHREF--l+15-15+24V+20VII+15V-24V-20VVOLTAGE-15VH.V.PRE*REGULATORREGULATORCOMPOWERSUPPLYCOMCOMFunctionalBlockDiagramofIRMChannelFigure7.6-7 IBUSA14VdcIlS4AS4A14Ar---....,c---'--I'--IIuIuuoOz00-oOzI"'0,,,is'"°°'"10'"°'"0'"\ZuZuZuZu"'"'I"'"'"'"'"'"'I"'I"'"'"'I.J.L,.JL,lL14I\>!"..4B'f11B?KIB"I1A\""IA"KIAK4A1KI1AK4AKl1BK1BK4BIBUSB14VdcS4B14B1S4BS4B...----,-'--uuuuoOzoOzoOzoOz"'0"'0"'0"'00'"0'"0'"°'"ZuZuZuZu"'"'"'"'"'wWww"'"'w,..!.L17KI1C"..K\2C"KIC"K4C"KI10"KID'K40"KI10"KID"KKICK4C40IKICKIDKIDKI1CKI10KI10K4C7K4DK4D"/K4CKICKI8K48Kl1BKI1CKI8K48r--:I--jIKIAIKIAI;Kl1AIK11AIK4AIK4AI>IL--1LEGEND:KIA,B,C,0-INDPERAnVETRIPTOREACTORPROTECTIONSYSTEMK4A,B,C,0-UPSCALETRIPS4A,B-BYPASSSWITCHNOTE:TRIPCONTACTSARESHOWNINNORMAl.OPERATIONPOSITION;BYPASSSWITCHCONTACTSSHOWNINUNBVPASSEDPOSITIONDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTypicalIRMCircuitArrangementforReactorProtectionSystemInputFigure7.6-8

LEGEND:l]JBUFFER(ISOLATEDSIGNAL)ITJlOWAUCTIONi.e..,SELECTLOWESTlEVELSIGNALillCOMPARATOR----INDICATESSEPARATION'FLOWINSTRUMENTATION----------------DRIVINGFLOH(lOOP"S")""DRIVHIGFLOW-----FLOWINSTRUMENTATION(LOOFLOWELEMENT51=r--'!_TI,-IuIPRIMARYCONTAINMENT7..I....1-++----l--+----,,--+--f--2'c',II,::sr:,,IIIIIIIIFLOWLIMITINGII'-rrFIr------=-=-t!P/I)&f?U:--=-0--I,II,,,ll_Df-CA.LlI!FLOWUNIT'01--roFLOWUNIT"B'LOOPAiI-*---'L"O"O''''--'looo-,,,,--;'1lOOPA2LOOIPLB2TOFLOWUNITnc,,_])"A';*r-r-Ir-f---@-II:POWER---Gill--If.,.-'::f.ASUPPLYIISUPPlIr--i!J."F:1--_1IJ"D'--Eil-(iOTAl!-i--10011IUNIT"C"....-::!'Cf-@-SUPPL,¥SUPPl=-BI---"8"(TOTAL"CO<"8"L......Q(TOTALI_*!FROMFLOWmmA--""'__::JIIITOeRDSELECTRELAY----T-------'11VERTICALBOARDHllP616IIITOCONTROLRODpos-hi...__iRODSElEC__:INFORMATIONSYS.HllP615L_BYPASSRSMCHANNEL"A"OR"6"-.,.J.,-Lr-.,---,--,-t.,:Jl,---rq::rIi--I.:c.I--APRMCHANNELEAPRMCHANNElCAPRMCHANNElAlPRMGROUP1....grK1"iTg..R"i"'1II__lEVELIBlEVEllPRMSMATRIXIClEVELLPR!1SLREF.FROMAPRMCHAN.-A---AlT.REF.fROMAPRMCHAN.[RSMCHANNELBDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORT1-1REACTORPROTECTIONSYSTEMTRIPSYSTEM"B"----\,-ALEVELLPRMS_.1.L-"III______JII_________...l--_Hl1-P60SI:L*"-L.L_ALEVELLPRMS_11-----REACTORPROTECTIONSYS.TRIPSYSTEM"A"I(2)ALLB,CAND0LEVELLPRMSARESHAREDBYBOTHRBMCHANNELAANDCHANNELBSELECT!1ATRIX\POWERBIASPOWERBIASIFlowandRBMInstrumentationFigure7.6-12Revision4-6/86 APRMF13-211LI'IIM'SS4AAPRMo9-20LPRM'SS4ABUSB120VACAPRMB9-20LPRM'SS4A4TOREACTORPROTECTIONSYSTEM\ILEGENDS3A.S4A-BYPASSSWITCHVKl-UPSCALETRIPK3-DOWNSCALETRIPK14-INOPERATIVETRIPIBUSA120VACIi----,II9-20I9-20-,LPRM'SILPRM'SLPRM'SIIIIIIIIAPRMIAPRMAPRMAICE"",:'-IK14i<<K14IL_TRIPcOnTACTSARESHOWNINNORMALOPERATIONPOSITION,BYPASSSWITcHESSHOWNINUNII'fPASSEDPOSITIONNOTE:1.APRMDOWNSCALETRIPCONTACTJUMPERED.,----,INOTE1IIIIIgIIiILwzz<<'"u"'coOJco0MH:J':J'""'():J'r1,.,to;00gPC"i:J'COHHZ:;.tlZMM".l,;::g):c<UlC'.S"t<:J'"'e7J"OHUl"'Zti,,7J:J'H0(j)""1t't'HeMH0-'OH"'""z"'HMMZIUl:J':J'UlMHZ7Jw:J'G)"'zt'HOG)Z3:MUl""HMH3:UlZ"ZO"'co""7J0e"'M7J"'co607J7J"'0-7J(j)<1C'<nC'o"H'"HHoH 6i-----L----:---F--E-C-B------0------2_---...-NOTE:!'"CURVESA,B,C,D,Ee;F-REFERTOTHESIXCHANNEL.SOF100908070PERCENTPOWER6050'0DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTAPRMTrackingReductioninPowerbyFlowControlFigure7.6-14Revision4-6/86 32ADBCE1.00.2-4L-..J....l........L...J-l-.---IoNOTE:CURVESA,B,C,D,E,61FREFERTOTHESIXCHANNEl.SOFAPRM.DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTAPRMTrackingWithOn-LimitsControlRodWithdrawalFigure7.6-15Revision4-6/86

REACTORCORECROSSCALIBRATIONCONTAINMENTPENETRATIONtELECTRICALSIGNALSITOCONTROLROOM)VALVECONTAINMENTPENETRATIONTOPURGESYSTEMIIIIIII-lSHEARVALVEBALLVALVECHAMBERSHIELDDRIVEMECHANISMIII\-----l----III1---IL__DUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTraversingIncoreProbeSubsystemBlockDiagramFigure7.6-18 &-,..,.--(P50YPIOZ.8.SLITITE/'IIIf:,LENGTHWISEANDFITOVERCABLEOFITEMz..9.SHRINKITEM11INPLACEAS0.UI"ANIUrt-2'?SCO/VTAI'1INATIONWITIfINDETECTOIf'ELEHENTSHALt:..NOTEXCEED1.8X10-8GRAMS*7,ELECTROLYTICALLYETCHITEM10INAREA.5f!OWNUSINGMATERIAL"PERP50YPI07.NOTES:I.BEFOREASSE/'-ISLvCLEAN/TE/'-I.3ANDITEMqPE,f>272A(,,90'1.2./lPPLVLU6'RICANT,PERIT£M7.3.M?{,UBRICI9NTCOI9T/NG.q.A!>SE/'16'LVSHALLCONFO/f'MTOTHEREG/V/REMENTSOF22/159/.3.S./lSSEI'1,gLV.VPTOCONNECTOR,SlfrtLC.P/iSSFREELvTtl/ROUGHATESTFIXTURE.258"'.000LN/!Xq.OO:!:.O?LO/VG.-.00/CDZREFIIf2\SOLDER0@5ECTIONA-!iENC.ARGED/7,SEENOTE9NOTEfIIItSE.ENOTE:3rISFT-O.o;:rIFT-O..00;1rr2:.,SEENOTEz...10,SEEN0TI:8/\If1IJ[fJJ,I...-_---JDA*50MIN.ISB:t.ODS.I38:t.ODSDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTTraversingIncoreProbeAssemblyFigure7.6-19APED-C51-55(2)Rev.5Revision9-6/91

ProbeFunctionalDiagramENERGYCEN.TERLIGHT&POWERCOMPANYSAFETYANALYSISREPORTFigure7.6-21TraversingIncoreControlDUANEARNOLDIOWAELECTRICUPDATEDFINAL,'T**Mro*s<>N"",(;JW't["),oT2.Intheeventthatpowerislost,thefollowingactionwillbeinitiatedafterpowerisrestored.A.Inautomaticmodedetectorreturnsto"DODO"viC!!automaticmodepath,Detectormustthenbereturnedtochambershieldto--reprogramdetector.B.Inmanualmodemustrestartviamanualswitchinreverseandreturntochambershieldtoreprogramdetector.3.Thedurationofthebe"Suchthal-itcomputer.4I"'<'1<:.\-.oIAC.l-\1"l\;,"TI"GU'Da'TUBI;"'""01<;",,,,,,,,,,.COMMANO,I/I'i.C.8....EO'L__"ROMI'QIM6AVCCt>lTI>JNMI1NT'-A1'ON""-1:",:;""",,oo.TIItNn>tlrlM<;OClE1OPmet::AlOOT"!'OMJ:',N01E"IrrVRNCl;'tmfoH'EW1O\ol!-N"ONT,"I,.".,."vs:tSE",,,....,TRAVERSE""=='"t.J:)oNsPEEDl.IlYHIR""'G"\.MANLALHIGHSPEED""iSEl...IECT"TZCNENt>D*TE(.TOR...,,.,,..SPEEC<Ili<AU1DIv1A'T"l(TRAvERSEAPED-C51-2(7)-5Rev5Revision1-6/83

RPSSIGNALSCHANNEl.ACHANNEl.BRPSSIGNALSREACTORANYOF3SRVANYOF3SRVREACTORPRESSUREOPENSOROPENSORPRESSURECHANNELBCHANNEl.ASCRAMARMEDARMEDSCRAMLWSEPARATiONSEPARATIONRElAYRELAYr11<27..(K27Blr--,REACTORREACTORREACTORREACTORPRESSUREPRESSUREPRESSUREPERMISSIVEPERMISSiVePRESSURESCRAM1056Psi9SCRAM1tARMING*ARMINGRESl!T-SEAL-IN-RELAYRELAYi-SEAL-INr-RESETIK2lIAI(K2QB)llARMINGARMINGALARMALARMPRESSURESW1TCH-PRESSURESWITCHPRESSURESlMTCMPRESSUReSWITCHSEALINPERMlSSlVEFe-OPENPERMISSNEOPENPERMISSIVE-SEAL-INPERMISSIVECt.ClSE.906CLOSE,1030CLOSE.1035CLOSE.910REOPEN.890REOPEN.1015REOPEN,1020REOPEN.891/5oPENICLOSEOPENICLOSE<-SEAL-INf-RELAYRELAYFo-SEAL*INf-J1K21A)U<21BJ!!CLOSEAT9001OPENAT1020OPENAT102&ICLOSEAT905SOLENOIDENERGiZeSOLENOIDENERGIZETOOPI!NTOOP...{Allsettingsarenominalvalues}DUANEARNOLDENERGYCENTERIESUTILITIES,INC.UPDATEDFINALSAFETYANALYSISREPORTSafety/ReliefValveLow-LowSetFunctionFigure7.6-31Revision17-10/03 UFSAR/DAEC-1 7.7-1 Revision 13 - 4/97

7.7 CONTROL

SYSTEMS NOT REQUIRED FOR SAFETY

This section discusses control systems whose functions are not essential for the safety of the plant. These systems are the feedwater control system, the turbine-generator controls, the reactor manual control system, and the process computer system.

7.7.1 FEEDWATER

SYSTEM CONTROL AND INSTRUMENTATION

7.7.1.1 Power Generation Objective

The power generation objective of the feedwater control system is to maintain a preestablished water level in the reactor vessel during normal plant operation.

7.7.1.2 Power Generation Design Basis

The feedwater control system regulates the feedwater flow (1) to maintain adequate water level in the reactor vessel according to the requirements of the system operators and (2) to

prevent the exposure of the reactor core over the power range of the reactor.

7.7.1.3 System Description

During normal plant operation, the feedwater control system automatically regulates feedwater flow into the reactor vessel. The system can be manually operated. The feedwater control system includes the two main feedwater control valves and one feedwater startup control

valve.

The feedwater flow control instrumentation measures the water level in the reactor vessel, the feedwater flow rate into the reactor vessel, and the steam flow rate from the reactor vessel. During normal operation, these three measurements are used in controlling feedwater

flow.

The optimum reactor vessel water level is determined by the requirements of the steam separators. The separators limit water carry-over in the steam going to the turbines and limit steam carry-under in water returning to the core. The water level in the reactor vessel is normally maintained within +/- 2 in. of the optimum level during normal operation. This control capability is achieved by comparing feedwater flow to the reactor vessel with the steam flow from the reactor vessel to provide an anticipatory level error signal. The feedwater flow is regulated by adjusting the feedwater control valves to deliver the required flow to the reactor

vessel. UFSAR/DAEC-1 7.7-2 Revision 13 - 4/97 7.7.1.3.1 Reactor Vessel Water Level Measurement

Reactor vessel water level is measured by three identical, independent sensing instrument loops (Figure 7.7-1). A differential-pressure transmitter senses the difference between the pressure caused by a constant reference column of water and the pressure caused by the variable height of water in the reactor vessel. The differential-pressure transmitter is installed on lines that serve other systems (see Section 7.6.4). A total of three level differential pressure transmitters to each transmits a level signal to a level indicator and a level switch. Two of the level signals are selectable and the selected level signal is used to provide the level control function to the level controller. The selected signal also feeds a computer point, a level switch and a recorder. The signal of the non-selectable third level differential pressure transmitter only feeds an indicator and a level switch. three pressure transmitters feed three reactor vessel pressure indicators, respectively, in the control room. Signals from two of the three pressure transmitters are selectable and the selected signal is fed to a recorder and a computer point in the control room. The level signal from two of the three sensing systems can be selected by the operator as the signal to be used for feedwater flow control. The selected water level and the reactor vessel pressure signals are continually recorded in the control room.

7.7.1.3.2 Steam Flow Measurement

Steam flow is sensed at each main steam line flow restrictor by a differential-pressure transmitter equipped with square root functions. Signals from these differential-pressure transmitters are added to provide a linear signal proportional to the total steam flow rate. Individual steam line flow signals are indicated in the control room. The total steam flow signal is used for feedwater flow control, and is also recorded in the control room. 7.7.1.3.3 Feedwater Flow Measurement

Feedwater flow is sensed at a flow element in each feedwater line by differential-pressure transmitters. Each feedwater signal is linearized by square root converters. Then the individual mass flow signals are summed to provide a total mass flow signal for the feedwater flow control system. The total feedwater mass flow signal is also recorded in the control room.

In order to increase the reliability of feedwater flow indication, redundant flow measuring devices are installed on a local instrument rack in the turbine building.

The feedwater flow control system is a three-element control system. The three inputs are vessel level, feedwater flow and steam flow. The latter two constitute a flow mismatch that provides level error anticipation. UFSAR/DAEC-1 7.7-3 Revision 13 - 4/97 7.7.1.3.4 Feedwater Control Signal

The level controller and the bias manual/automatic transfer stations produce the final feedwater control signal, either manually or automatically.

The level controller includes proportional integral derivative (PID) function, manual automatic transfer function, single or three element select function and automatic set point set function when the controller is in automatic mode. Besides the three bargraph indications, level, set point and output, the controller also includes a digital indication which can display numerical indication for various parameters. Associated with the level controller is a set point set down switch which when initiated will change the set point to a predetermined value when the controller is in the automatic mode. Input to the controller is derived from one of two sources. The single-element source is the reactor water level only. The three-element source includes measurements of steam flow, feedwater flow, and reactor water level.

The selection of automatic or manual control can be made at the level controller, or at one of three bias manual/automatic stations (one for each feedwater control valve, main and startup). Each bias manual/automatic transfer station is a manual controller with a transfer switch and output indicator. When the system is controlled by the level controller, the bias manual/automatic transfer switch bypasses the transfer station, and the level controller signal goes to the main feedwater control valves and to the feedwater startup control valve. For manual control, the transfer switching blocks the level controller automatic signal, and the operator

provides the feedwater control signal at either the level controller or at one of the three bias manual/automatic transfer stations.

Normal Automatic Operation

The feedwater control system uses the three-element control signal to maintain reactor vessel water level within a small margin of optimum water level during plant load changes. This signal is obtained as follows. The total steam flow signal and the total feedwater flow signal are fed into a proportional amplifier. The output from this amplifier reflects the mismatch between

its input signals. The output is designated as the steam flow/feedwater flow mismatch signal. When steam flow exceeds feedwater flow, the amplifier output is increased from its normal value. The reverse is also true. This amplifier output is fed to a second proportional amplifier, which also receives the reactor vessel water level signal. The reactor vessel water level signal is biased with the steam flow/feedwater flow mismatch signal to produce the three-element control signal. This signal is fed to the level controller through a converter and signal isolator. The controller compares the input signal against the setpoint and provides the final control signal to the main feedwater control valves and the feedwater startup control valve. UFSAR/DAEC-1 7.7-4 Revision 19 - 9/07 The setpoint of the master controller can be changed to a predetermined level by a manual push button at the operators discretion, and the controller will control the reactor level at that predetermined level automatically if the controller is in the Automatic Mode. The setpoint transfer function will not be in effect when the controller is in Manual Mode. This function is primarily designed to provide a convenient setpoint change for the operator during the execution of IPOI 5, immediate actions in response to a SCRAM.

Optional Automatic Operation

A single-element control signal (reactor vessel water level) can be used to replace the above three-element signal. In such cases, the operator switches the controller input to the "1 element" signal. The reactor level signal is fed to the level controller through a dynamic compensator and a converter and signal isolator. Reactor water level is then controlled by the

reactor level signal in accordance with the controller setpoint.

Auxiliary Functions

Alarms are provided for high and low reactor water level and for high pressure. A loss of power signal to the feedwater control valve, Manual/Auto (M/A) stations, and the feedwater

startup control valve, or a loss of service air supply to the feedwater startup control valve, or a

loss of service air supply to the valves will cause the valves to lock up as is. Both power failure

and low air pressure are annunciated. The feedwater startup control valve has annunciation in the control room for 90% or greater open. This annunciation indicates that the startup valve is approaching maximum flow and that action should be taken to transfer to one of the feedwater control valves. The level control system provides interlocks and control functions to other systems. When one out of two reactor feed pum ps is lost and coincident or subsequent low water level exists, the recirculation pumps begin to run back to 45% speed. The runback initially helps moderate the level drop. Water level in the downcomer region doesn't recover fast enough and a reactor scram occurs when level reaches the Level 3 trip point. Reactor recirculation flow is also limited on sustained low feedwater flow to ensure that adequate net positive suction head will be provided for the recirculation system.

Two-out-of-three narrow range vessel water level signals at the Hi trip setpoint will cause the feed pumps to trip. Controls to reset the trip are located on panel The Reactor Feed Pumps (RFPs) High RPV Level Trip Defeat override may be used in support of the Emergency Operating Procedures (EOPs) in lieu of jumpers and lifted leads. This defeat allows restoration of the feed pumps for flooding above the normal level either in support of RPV Flooding Contingency or the Primary Containment Flooding Contingency. The single key-lock switch has an amber light and individually annunciates on front panel when taken to override. UFSAR/DAEC-1 7.7-5 Revision 13 - 4/97 7.7.1.4 Inspection and Testing

All feedwater flow control system components can be tested and inspected according to the recommendations of the manufacturers. This can be done before plant operation and during scheduled shutdowns. Reactor vessel water level indications from the two water-level sensing systems can be compared during normal operation to detect instrument malfunctions. Steam mass flow rate and feedwater mass flow rate can be compared during constant load operation to detect inconsistencies in their signals. The level controller can be tested while the feedwater control system is being controlled by the bias manual/automatic transfer stations.

7.7.2 TURBINE-GENERATOR INSTRUMENTATION AND CONTROL SYSTEMS

7.7.2.1 Power Generation Objective

The power generation objectives of the turbine-generator instrumentation and control systems are the following:

1. To assist in the efficient production of electric power.

2. To limit the NSS shutoff system pressure, temperature, and flow excursions.

7.7.2.2 Power Generation Design Basis

7.7.2.2.1 Electrohydraulic Control (EHC), and Turbine Supervisory Instrumentation (TSI) Controls

The EHC and TSI control system is designed to provide adequate indications, analog records, warnings, and automatic control to maintain steam pressure and thus reactor pressure within preestablished limits during normal plant operation and all anticipated load maneuvers. Within the EHC system there are several subsystems which control the automatic responses of the EHC system. These subsystems are: Pressure Control Unit Bypass Control Unit Speed and Acceleration Control Unit Valve Flow Control Unit Load Control Unit UFSAR/DAEC-1 7.7-6 Revision 13 - 4/97 Within the TSI system there are several subsystems such as: Vibration Phase Angle Differential Expansion Thrust Bearing Rotor Expansion Temperature 7.7.2.2.2 Main Condenser Instrumentation and Control

1. Condenser instrumentation is designed to warn operating personnel of high condenser temperatures and pressures. These limits are set to indicate to operating personnel that trouble is developing in the condensing system, hence warning of loss of the condenser

as a reactor heat sink.

2. Condenser instrumentation and control is designed to automatically trip the turbine upon increasing pressure in the low-pressure turbine exhaust hoods.

3. Condenser controls are designed to automatically make up and remove water from the condenser hotwell to maintain a nearly constant hotwell water level during startup, normal operation, and minor load excursions. This provides net positive suction head to the condensate pump.

4. Condenser instrumentation is designed to provide control room operators with an analog indication of hotwell level as well as high-level and low-level alarms.

7.7.2.2.3 Condensate System Instrumentation and Control

1. The condensate system instrumentation is designed to provide operating personnel in the control room with an indication of the status of the condensate system with respect to pressure, temperatures, and flow conditions. Abnormal conditions for these items are alarmed.

2. The condensate system controls are designed to maintain a preestablished minimum flow through the condensate pumps, inter and after condenser of the steam jet air ejector, and

gland seal condenser.

7.7.2.2.4 Condensate Demineralizer Instrumentation

1. The condensate demineralizer instrumentation is designed to provide a record and indication of the water purity entering the reactor to operating personnel in the control room.

UFSAR/DAEC-1 7.7-7 Revision 13 - 4/97 2. The condensate demineralizer instrumentation is designed to warn control room operating personnel of abnormal changes in water purity levels and demineralizer system

troubles.

7.7.2.3 System Description

7.7.2.3.1 Electrohydraulic Control (EHC)

The Pressure and Bypass Control Units function together to limit the rate of change in main steam pressure during reactor startup and maintain a constant pressure during turbine startup, normal load-carrying conditions, and minor system load excursions.

Under normal load-carrying conditions, the initial pressure regulator controls the turbine steam control valves to maintain a preestablished main steam pressure. Hence, unit load is

varied or held constant by either reactor contro l rod position or regulation of the reactor coolant recirculation flow, or both. Under these conditions, the turbine-generator follows the reactor

power output. If reactor power is increased or decreased, the turbine-generator output increases

or decreases accordingly.

During reactor and main steam line warmup and pressurization, the turbine bypass valves are under automatic control through the EHC system. After the main steam lines are at rated pressure, the turbine bypass valves are adjusted to pass from 10% to 20% of rated steam flow. At this time, the turbine steam admission valves are opened to roll the turbine. As the turbine steam flow increases, the EHC system automatically decreases the amount of bypass.

The load limit control unit, the maximum combined flow limit, and the speed control unit signal for any unit can override the pressure control unit of the steam admission valves. The adjustable load set control unit is set by the control room operator. Guidelines for the use of load limit is controlled by plant procedures. In the event reactor power exceeds the set load limit, the EHC system releases the excess flow through the turbine bypass. The speed and acceleration control unit overrides the pressure control unit in the event of turbine overspeed. Again, the excess flow is automatically bypassed to the condenser. The adjustable maximum combined flow limit assumes control of the admission valves when the combined flow of the admission valves and turbine bypass valves reaches the setting of the limiter that is adjustable from 50% to

150%.

Because of the importance of the pressure c ontrol unit to turbine-generator operation and its effect on reactor pressure, there are two redundant circuits within the pressure control unit. One normally controls, with the other having a set-point of several psi lower. Should the controlling pressure regulator fail the second regulator assumes control at its setpoint. In the event that the controlling initial pressure regulator fails in a manner to decrease main steam pressure thus opening the admission valves, the steam flow or load increases to the lower of the maximum combined flow limit or load limit as discussed in the previous paragraphs. If the reactor cannot respond to this increased flow, main steam pressure will be reduced. When main steam UFSAR/DAEC-1 7.7-8 Revision 14 - 11/98 pressure decreases further, primary containment isolation and nuclear steam supply system (see Section 7.3.1.1.1) automatically closes the main steam isolation valves, thus causing the reactor control rods to scram.

The turbine stop valves are equipped with limit switches that open when the valves are moved from their fully open position. These switches provide a scram signal to the reactor protection system (see Section 7.2). There are provisions within the EHC system to allow periodic functional testing of the stop and control valves without causing a scram signal as the valves are individually cycled. Stop and control valve cycling may be performed while in three main steam line operation as long as appropriate limitations on reactor power are in place. End-of-cycle testing is performed on the stop valves.

7.7.2.3.2 Low Main Condenser Vacuum Trip

The condenser vacuum trip devices that signal turbine stop valve closure upon low condenser vacuum are shown in Figure 10.3-1. Two sets of switches are redundant to each other with each set providing a turbine trip. The redundant sets of switches sense condenser vacuum through redundant instrument lines from separate pressure taps on the condenser. These

switches are configured in a one out of two, take n twice trip logic. Because of the redundancy and logic, the trip system has a high degree of inherent reliability.

The analysis of abnormal operational transients starting in Chapter 15 analyzes specifically the "loss of condenser vacuum" as an event resulting in a nuclear pressure increase. The sudden loss of condenser vacuum represents the event "turbine trip from high power without bypass" and is also analyzed in Chapter 15.

If the turbine stop valves failed to close following a loss of condenser vacuum, the

reactor pressure transient would be less severe than the analysis shows because the heat sink loss

would be gradual.

The event, "loss of condenser vacuum" is not considered a serious (safety-related) event in itself and need not conform to the requirements of IEEE-279. However, the sudden loss of heat sink by closure of the stop valves and bypass valves that result from loss of vacuum is

considered significant and that portion of the circuit does conform to the requirements of IEEE-279.

However, four additional low vacuum trip switches have been added for purposes of closing the main steam isolation valves in the event that condenser vacuum is reduced to a value

low enough to suggest lack of response of the turbine stop valves to the closure signals described above. These signals will be active in all modes of operation. These switches can be manually bypassed when the reactor mode switch is not in the "Run" position and the stop valves show

closed by position indication. UFSAR/DAEC-1 7.7-9 Revision 14 - 11/98 Four keylock switches are provided to allow bypass of the High Back Pressure MSIV isolation as directed by Emergency Operating Procedures for situations where loss of vacuum was caused by MSIV closure. Opening the MSIVs will provide the steam necessary to re-establish vacuum, however the defeat is not intended as a means of keeping the main condenser available irrespective of its ability to maintain a vacuum.

7.7.3 REACTOR

MANUAL CONTROL SYSTEM

7.7.3.1 Power Generation Objective

The objective of the reactor manual control system is to provide the operator with the means to make changes in nuclear reactivity so that reactor power level and power distribution can be controlled. The system allows the operator to manipulate control rods.

7.7.3.2 Safety Design Bases

1. The circuitry provided for the manipulation of control rods is designed so that no single failure can negate the effectiveness of a reactor scram.

2. The repair, replacement, or adjustment of any failed or malfunctioning component does not require that any element needed for reactor scram be bypassed unless a bypass is normally allowed.

7.7.3.3 Power Generation Design Bases

1. The reactor manual control system is designed to inhibit control rod withdrawal following erroneous control rod manipulations so that RPS action (scram) is not required.

2. The reactor manual control system is designed to inhibit control rod withdrawal in time to prevent local fuel damage as a result of erroneous control rod manipulation.

3. The reactor manual control system is designed to inhibit rod movement whenever such movement would result in operationally undesirable core reactivity conditions or whenever instrumentation (due to failure) is incapable of monitoring the core response to rod movement.

4. To limit the potential for inadvertent rod withdrawals leading to RPS action, the reactor manual control system is designed in such a way that deliberate operator action is

required to effect a continuous rod withdrawal.

5. To provide the operator with the means to achieve prescribed control rod patterns, information pertinent to the position and motion of the control rods is available in the main control room.

UFSAR/DAEC-1 7.7-10 Revision 14 - 11/98 7.7.3.4 System Description

The reactor manual control system consists of the electrical circuitry, switches, indicators, and alarm devices provided for operational manipulation of the control rods and the surveillance of associated equipment. This system includes the interlocks that inhibit rod movement (rod blocks) under certain conditions. The reactor manual control system does not include any of the circuitry or devices used to automatically or manually scram the reactor; these devices are discussed in Section 7.2. Neither the mechanical devices of the control rod drives (CRDs) nor the CRD hydraulic system are included in the reactor manual control system. These mechanical components are described in Section 4.6.

7.7.3.5 General Operation

Figures 7.7-2 and 3.9-5 show the functional arrangement of devices for the control of components in the CRD hydraulic system. Although the figure also shows the arrangement of scram devices, these devices are not part of the reactor manual control system.

Control rod movement is accomplished by admitting water under pressure from a CRD water pump into the appropriate end of the CRD cylinder. The pressurized water forces the piston, which is attached by a connecting rod to the control rod, to move. Three modes of

control rod operation are used: insert, withdraw, and settle. Four solenoid-operated valves are associated with each control rod to accomplish the actions required for the various operational modes. The valves control the path that the CRD water takes to the cylinder. The reactor manual control system controls the valves.

Two of the four solenoid-operated valves for a control rod are electrically connected to the insert bus. When the insert bus is energized and when a control rod has been selected for movement, the two insert valves for the selected rod open, allowing the CRD water to take the path that results in control rod insertion. Of the two remaining solenoid-operated valves for a

control rod, one is electrically connected to the withdraw bus, and the other is connected to the

settle bus. The withdraw valve that connects the insert drive water supply line to the exhaust water header is one that is connected to the withdraw bus. The remaining withdraw valve is connected to the withdraw bus. When both the withdraw bus and the settle bus are energized and when a control rod has been selected for movement, both withdraw valves for the selected

rod open, allowing CRD water to take the path that results in control rod withdrawal.

The settle mode is provided to ensure that the CRD index tube is engaged promptly by the collet fingers after the completion of either an insert or withdraw cycle. During the settle mode, the withdraw valve connected to the settle bus is opened or remains open while the other

three solenoid-operated valves are closed. During an insert cycle, the settle action vents the pressure from the bottom of the CRD piston to the exhaust header, thus gradually reducing the

differential pressure across the drive piston of the selected rod. During a withdraw cycle, the settle action again vents the bottom of the CRD piston to the exhaust header while the withdraw UFSAR/DAEC-1 7.7-11 Revision 14 - 11/98 drive water supply is shut off. This also allows a gradual reduction in the differential pressure across the CRD piston. After the control rod has slowed down, the collet fingers engage the

index tube and lock the rod in position. See Figure 7.7-2, Sheet 1, for valve sequence and timing.

The arrangement of control rod selection push buttons and circuitry permits the selection of only one control rod at a time for movement. A rod is selected for movement by depressing a button for the desired rod on the reactor control benchboard in the control room. This benchboard is shown in Figure 7.7-3. The direction in which the selected rod moves is determined by the position of a switch, called the "rod movement" switch, which is also located

on the reactor control benchboard. This switch has "rod-in" and "rod-out-notch" positions and

returns by spring action to the "off" position. The rod selection circuitry is arranged so that a rod

selection is sustained until either another rod is selected or separate action is taken to revert the selection circuitry to a no-rod-selected condition. Initiating movement of the selected rod prevents the selection of any other rod until the movement cycle of the selected rod has been completed. Reversion to the no-rod-selected condition is not possible (except for loss of control circuit power) until any moving rod has completed the movement cycle.

7.7.3.5.1 Insert Cycle

The following is a description of the detailed operation of the reactor manual control system during an insert cycle, provided that the rod worth minimizer is permissive. The cycle is described in terms of the insert, withdraw, and settle buses. The response of a selected rod when

the various buses are energized has been explai ned previously. Figure 7.7-2, Sheets 3 and 4, can be used to follow the sequence of an insert cycle.

A three-position rod movement switch is pr ovided on the reactor control benchboard. The switch has a "rod-in" position, a "rod-out-notch" position, and an "off" position. The switch returns by spring action to the "off" position. With a control rod selected for movement, placing the rod movement switch in the "rod-in" position and then releasing the switch energizes the insert bus for a limited amount of time. Just before the insert bus is deenergized, the settle bus is automatically energized and remains energized for a limited period of time after the insert bus is deenergized. The insert bus time setting and rate of drive water flow provided by the CRD hydraulic system determines the distance traveled by a rod. The timer setting results in a one-

notch (6 in.) insertion of the selected rod for each momentary application of a rod-in signal from the rod movement switch. Continuous insertion of a selected control rod is possible by holding the rod movement switch in the "rod- in" position.

A second switch can be used to initiate the insertion of a selected control rod. This

switch is the "rod-out-notch-override," (R ONOR) switch. The RONOR switch has three positions: "emergency in," "notch override" and "off." The switch returns to the "off" position by spring action. By holding the RONOR switch in the "emergency in" position, the insert bus

is continuously energized, causing a continuous insertion of the selected control rod. UFSAR/DAEC-1 7.7-12 Revision 14 - 11/98 7.7.3.5.2 Withdraw Cycle

The following is a description of the detailed operation of the reactor manual control system during a withdraw cycle. The cycle is described in terms of the insert, withdraw, and settle buses. The response of a selected rod when the various buses are energized has been

explained previously. Figure 7.7-2, Sheets 3 and 4, can be used to follow the sequence of a

withdraw cycle.

With a control rod selected for movement, placing the rod movement switch in the "rod-out-notch" position energizes the insert bus for a short period of time. Energizing the insert bus

at the beginning of the withdrawal cycle is necessary to allow the collet fingers to disengage the index tube. When the insert bus in deenergized, the withdraw and settle buses are energized for a controlled period of time. The withdraw bus is deenergized before the settle bus, which, when deenergized completes the withdraw cycle. This withdraw cycle is the same whether the rod movement switch is held continuously in the "rod-out-notch" position or released. The timers

that control the withdraw cycle are set so that the rod travels one notch (6 in.) per cycle. (Provisions are included to prevent further control rod motion in the event of timer failure.) A selected control rod can be continuously withdrawn if the rod movement switch is held in the "rod-out-notch" position at the same time that the RONOR switch is held in the "notch-override" position. With both switches held in these positions, the withdraw bus is continuously

energized.

7.7.3.6 Control Rod Drive Hydraulic System Control

Two motor-operated pressure control valves, one air-operated control valve, and two solenoid-operated stabilizing valves are included in the CRD hydraulic system to maintain smooth and regulated system operation (see Section 3.9.4).

The motor-operated pressure control valves are positioned by manipulating switches in the control room. The switches for these valves are located close to the pressure indicators that respond to the pressure changes caused by movements of the valves. The air-operated flow control valve is automatically positioned in response to signals from an upstream flow-measuring device. The stabilizing valves are automatically controlled by the action of the energized insert and withdraw buses. The control scheme is shown in Figure 7.7-2, Sheets 2, 3, and 4. The two drive water pumps are controlled by switches in the main control room. Each pump automatically stops upon indication of low suction pressure with a nominal 15 second time

delay (Figure 7.7-2, Sheet 2).

7.7.3.7 Rod Block Interlocks

7.7.3.7.1 General

Figure 7.7-2, Sheets 3, 4, and 5, shows the rod block interlocks used in the reactor manual UFSAR/DAEC-1 7.7-13 Revision 14 - 11/98 control system. Figure 7.7-2, Sheets 3 and 4, shows the general functional arrangement of the interlocks, and Figure 7.7-2, Sheet 5, shows the r od-blocking functions that originate in the neutron monitoring system in greater detail. For a discussion of the neutron monitoring system

see Section 7.6.1.

To achieve an operationally desirable performance objective where most failures of individual components would be easily detectable or do not disable the rod movement inhibiting functions, the rod block logic circuits are energized when control rod movement is allowed.

Each logic circuit receives input trip signals from a number of trip channels, and each logic circuit can provide a separate rod block signal to inhibit rod withdrawal.

The rod block circuitry is effective in pr eventing rod withdrawal, if required, during both normal (notch) withdrawal and continuous withdraw al. If a rod block signal is received during a rod withdrawal, the control rod is automatically stopped at the next notch position, even if a

continuous rod withdrawal is in progress.

The components used to initiate rod blocks in combination with refueling operations provide rod block trip signals to these same rod block circuits. These refueling rod blocks are described in Section 7.6.2.

7.7.3.7.2 Rod Block Functions

The following discussion describes the vari ous rod block functions and explains the intent of each function. The instruments used to sense the conditions for which a rod block is

provided are discussed later. Figure 7.7-2 Sheet 5, and Figure 7.6-5 show the rod block initiation functions. Figure 7.6-5 also shows the rod block functions initiated in the neutron monitoring system. The channel A and B annunciating r od block control and nonannunciating rod block control shown at the lower right of Figure 7.7-2, Sheet 5, initiate rod blocks in the reactor manual control system as indicated in Figure 7.7-2, Sheets 3 and 4. The rod block functions provided specifically for refueling situations are described in Section 7.6.2.

1. With the mode switch in SHUTDOWN, no control rod can be withdrawn. This enforces compliance with the intent of the SHUTDOWN mode.

2. The circuitry is arranged to initiate a rod block regardless of the position of the mode switch for the following conditions:

a. Any APRM upscale rod block alarm. The purpose of this rod block function is to avoid conditions that would require RPS action if allowed to proceed. The APRM upscale rod block alarm setting is selected to initiate a rod block before the APRM high neutron flux scram setting is reached.

UFSAR/DAEC-1 7.7-14 Revision 14 - 11/98 b. Any APRM inoperative alarm. This ensures that no control rod is withdrawn unless the average power range neutron monitoring channels are either in service

or properly bypassed.

c. Either RBM upscale alarm. This function is provided to stop the erroneous withdrawal of a single worst-case control rod so that local fuel damage does not result. Although local fuel damage poses no significant threat in terms of radioactive material released from the nuclear system, the alarm setting is selected so that no local fuel damage results from a single control rod withdrawal error

during power range operation.

d. Either RBM inoperative alarm. This ensures that no control rod is withdrawn unless the RBM channels are in service or properly bypassed.

e. Any recirculation flow converter upscale or inoperative alarm. This ensures that no control rod is withdrawn unless the recirculation flow converters, which are

necessary for the proper operation of the APRM, are operable. The upscale nominal trip setting is 110%. f. Recirculation flow converter comparable alarm. This ensures that no control rod is withdrawn unless the difference between the outputs of the flow converters is within limits and the comparators are in service. The nominal trip setting is 10% flow deviation.

g. Scram discharge volume high water level. This ensures that no control rod is withdrawn unless enough capacity is available in the scram discharge volume to accommodate a scram. The setting is selected to initiate a rod block well in advance of that level which produces a scram. The nominal trip setting is 24 gallons.

h. Scram discharge volume high-level scram trip bypassed. This ensures that no control rod is withdrawn while the scram discharge volume high-water-level scram function is out of service.

i. The RWM microcomputer system can initiate a rod withdrawal block and a rod insert block. The purpose of this function is to reinforce procedural controls that limit the reactivity worth of control rods under low-power conditions. The rod block trip settings are based on the allowable control rod worth limits established

for the design basis rod drop accident. Adherence to prescribed control rod patterns is the normal method by which this reactivity restriction is observed. Additional information on the RWM function is available in Section 7.7.7. UFSAR/DAEC-1 7.7-15 Revision 13 - 4/97

j. Rod position information system malfunction. This ensures that no control rod can be withdrawn unless the rod position information system is in service.

k. Rod movement timer switch malfunction during withdrawal. This ensures that no control rod can be withdrawn unless the timer is in service.

3. With the mode switch in RUN, the following conditions initiate a rod block:

a. Any APRM downscale alarm. This ensures that no control rod is withdrawn during power range operation unless the average power range neutron monitoring

channels are operating properly or are correctly bypassed. All unbypassed average power range monitors must be onscale during reactor operation in the RUN mode.

b. Either RBM downscale alarm. This ensures that no control rod is withdrawn during power range operation unless the RBM channels are operating properly or are correctly bypassed. Unbypassed rod block monitors must be onscale during reactor operations in the RUN mode. The rod block monitors are automatically

bypassed when reactor power is less than 30%.

4. With the mode switch in STARTUP or REFUEL, the following conditions initiate a rod block: a. Any SRM detector not fully inserted into the core when the SRM count level is below the retract permit level and any IRM range switch on either of the two

lowest ranges. This ensures that no control rod is withdrawn unless all SRM detectors are properly inserted when they must be relied on to provide the operator with neutron flux level information.

b. Any SRM upscale level alarm. This ensures that no control rod is withdrawn unless the SRM detectors are properly retr acted during a reactor startup. The rod block setting is selected at the upper end of the range over which the source range monitor is designed to detect and measure neutron flux.

c. Any SRM downscale alarm. This ensures that no control rod is withdrawn unless the SRM count rate is above the minimum prescribed for low neutron flux level monitoring.

d. Any SRM inoperative alarm. This ensures that no control rod is withdrawn during low neutron flux level operations unless proper neutron monitoring

capability is available in that all SRM channels are in service or properly

bypassed. UFSAR/DAEC-1 7.7-16 Revision 13 - 4/97 e. Any IRM detector not fully inserted into the core. This ensures that no control rod is withdrawn during low neutron fl ux level operations unless proper neutron monitoring capability is available in that all IRM detectors are properly located.

f. Any IRM upscale alarm. This ensures that no control rod is withdrawn unless the intermediate range neutron monitoring equipment is properly upranged during a

reactor startup. This rod block also provides a means to stop rod withdrawal in time to avoid conditions requiring RPS action (scram) in the event that a rod withdrawal error is made during low neutron flux level operations.

g. Any IRM downscale alarm except when range switch is on the lowest range. This ensures that no control rod is withdrawn during low neutron flux level operations unless the neutron flux is being properly monitored. This rod block prevents the continuation of a reactor startup if the operator upranges the intermediate range monitor too far for the exiting flux level; thus, the rod block ensures that the intermediate range monitor is onscale if control rods are to be withdrawn.

h. Any IRM inoperative alarm. This ensures that no control rod is withdrawn during low neutron flux level operations unless proper neutron monitoring

capability is available in that all IRM channels are in service or properly

bypassed.

7.7.3.7.3 Rod Block Bypasses

To permit continued power operation during the repair or calibration of equipment for selected functions that provide rod block interlocks, a limited number of manual bypasses are permitted as follows:

1. One SRM channel.

2. Two IRM channels (one on either bus A or bus B).

3. Two APRM channels (one on either bus A or bus B).

4. One RBM channel.

The permissible IRM and APRM bypasses are arranged in the same way as in the reactor protection system. The intermediate range monitors are arranged as two groups of equal numbers of channels. One instrument powered from each RPS bus may be bypassed. The groups are chosen so that adequate monitoring of the core is maintained with one channel bypassed in each group. The same type of grouping and bypass arrangement is used for the average power range monitor. UFSAR/DAEC-1 7.7-17 Revision 13 - 4/97 These bypasses are effected by positioning switches in the main control room. A light in the control room indicates the bypassed condition.

An automatic bypass of the SRM detector position rod block is effected as the neutron flux increases beyond a preset low level on the SRM instrumentation. The bypass allows the detectors to be partially or completely withdrawn as a reactor startup is continued.

An automatic bypass of the RBM rod block occurs whenever the power level is below

30% of rated core power or whenever a peripheral control rod is selected. Either of these two conditions indicates that local fuel damage is not threatened and that RBM action is not required.

The RWM rod block function was originally automatically bypassed when reactor power

increased above a preselected value in the power range. At the DAEC, rod worth control is now enforced at all power levels. The RWM may be manually bypassed for maintenance at any time.

7.7.3.7.4 Arrangement of Rod Block Trip Channels

The grouping of neutron monitoring equipment used in the rod block circuitry (APRM, IRM, SRM, and RBM) is different than that used in the Reactor Protection System. One half of the total number of average power range monitors, intermediate range monitors, source range monitors, and rod block monitors provides inputs to one of the rod block logic circuits, and the remaining half provides inputs to the other logi c circuit. One recirculation flow converter provides a rod block signal to one logic circuit; the remaining converter provides an input to the other logic circuit. The flow converter comparat or provides trip signals to each flow converter trip circuit.

Scram discharge volume high water level signals are provided as inputs into one of the two rod block logic circuits. Both rod block logic circuits sense when the high water level scram trip for the scram discharge volume is bypassed.

The rod withdrawal block from the RWM trip affects both rod block logic circuits. The rod insert block from the RWM function preven ts energizing the insert bus for both notch insertion and continuous insertion.

The APRM and RBM rod block settings in the RUN mode are varied as a function of recirculation flow and core thermal power, respectively. The APRM rod block setting in the STARTUP mode is a fixed value. Analyses show that the settings selected are sufficient to avoid both RPS action and local fuel damage as a result of a single control rod withdrawal error. Mechanical switches in the SRM and IRM detector drive systems provide the position signals

used to indicate that a detector is not fully inserted. Additional detail on all the neutron monitoring system trip channels is available in Section 7.6.1. The rod block from scram discharge volume high water level uses one nonindicating float switch installed on the scram discharge volume; a second float switch provides a control room annunciation of increasing level. UFSAR/DAEC-1 7.7-18 Revision 14 - 11/98 7.7.3.8 Control Rod Information Displays

The operator has three different displays of control rod position:

1. Rod status display.

2. Four rod display.

3. Rod Worth Minimizer display.

These displays serve the following purposes:

1. Provide the operator with a continuously available, easily understood presentation of each control rod's status.

2. Provide continuously available, easily discernible warning of an abnormal condition.

3. Present numerical rod position for each rod.

4. Log all control rod positions on a routine basis.

The rod status display is located on a control board in the main control room. It provides the following continuously available information for each individual rod:

1. Rod position, fully inserted (green).

2. Rod position, fully withdrawn (red).

3. Rod identification (coordinate position of selected rod, white).

4. Accumulator trouble (amber).

5. Rod scram (blue).

6. Rod drift (red).

Also dispersed throughout the display in locations representative of the physical location

of LPRM strings in the core are LPRM lights as follows:

1. LPRM low flux level (white).

2. LPRM high flux level (amber).

UFSAR/DAEC-1 7.7-19 Revision 15 - 5/00 A separate four rod display includes the LPRM values for each of the detector arrays surrounding the rod selected (Figures 7.7-3 and 7.7-4). Since each detector array contains 4 sensors in a vertical column and there can be a maximum of 4 detector arrays surrounding a rod, 16 meters are installed. Between the LPRM indicators are four rod position modules. These four modules will display rod position in two digits and rod selected status (white light, off or

on) for the four rods located within the LPRM detector arrays being displayed. The rod position digital range is from with representing the fully in position and fully out; each even increment, for example, The four rod display allows the operator to easily focus his attention on the core volume of concern during rod movements.

Control rod position information is obtained from reed switches in the control rod drive that open or close during rod movement. Reed switches are provided at each 3-in. increment of

piston travel. Since a notch is 6 in., indication is available for each half-notch of rod travel. The reed switches located at the half-notch positions for each rod are used to indicate rod drift. Both a rod selected for movement and the rods not selected for movement are monitored for drift. A drifting rod is indicated by an alarm and red light in the main control room. The rod drift condition is also monitored by the Plant Process Computer and Rod Worth Minimizer.

Reed switches are also provided at locations that are beyond the limits of normal rod movement. If the rod drive piston moves to these overtravel positions, an alarm is sounded in the control room. The overtravel alarm provides a means to verify that the drive-to-rod coupling is intact, because with the coupling in its normal condition, the drive cannot be physically withdrawn to the overtravel position. Coupling integrity can be checked by attempting to withdraw the drive to the overtravel position and observing that no over travel alarm occurs.

The Plant Process Computer system receives position indication from the Rod Worth Minimizer microcomputer and can display and print all rod positions in a prearranged sequence. The user may order a computer display or printout at any time. The display and printout depict

the rod positions in an array corresponding to the other displays and actual core location . The display and printout are always in the same order; if there is an unavailable input, the display and printout will signify it by while indicates the rod is fully withdrawn.

All displays are essentially independent of one another. Signals for the rod status display are hard wired from the rod position information system cabinet buffer outputs, so that a signal failure of other parts of the rod position information system cabinet will not affect this display. Likewise, the computer could conceivably fail and the rod status and rod position displays will continue to function normally.

The following control room lights are provided to allow the operator to know the conditions of the CRD hydraulic system and the control circuitry (Figure 7.7-2, Sheets 1 and 2): UFSAR/DAEC-1 7.7-20 Revision 13 - 4/97 1. Stabilizing valve selector switch position.

2. Insert bus energized.

3. Withdraw bus energized.

4. Settle bus energized.

5. Withdrawal not permissive.

6. Notch override.

7. Pressure control valve position.

8. Flow control valve position.

9. Drive water pump low suction pressure (alarm only).

10. Drive water filter high differential pressure (alarm only).

11. Charging water (to accumulator) low pressure (alarm only).

12. Control rod drive temperature.

13. Scram discharge volume not drained (alarm only).

14. Scram valve pilot air header low pressure (alarm only).

7.7.3.9 Safety Evaluation

The circuitry described for the reactor manual control system is completely independent of the circuitry controlling the scram valves. This separation of the scram and normal rod control functions prevents failures in the reactor manual control circuitry from affecting the scram circuitry. The scram circuitry is discussed in Section 7.2. Because each control rod is

controlled as an individual unit, a failure that results in the energizing of any of the insert or

withdraw solenoid valves can affect only one control rod. The effectiveness of a reactor scram is not impaired by the malfunctioning of any one control rod. No single failure in the reactor manual control system can result in the prevention of a reactor scram. Repair, adjustment, or maintenance of reactor manual control system components does not affect the scram circuitry.

UFSAR/DAEC-1 7.7-21 Revision 18 - 10/05 7.7.3.10 Inspection and Testing

The reactor manual control system can be routinely checked for proper operation by manipulating control rods using the various methods of control. Detailed testing and calibration can be performed by using standard test and calibration procedures for the various components of the reactor manual control circuitry.

7.7.4 PLANT

PROCESS COMPUTER SYSTEM

7.7.4.1 Power Generation Objective

The objectives of the Plant Process Computer system (PPC) are to provide the safety parameter display system functions (discussed in section 7.7.6), to perform frequent calculations of reactor thermal power and related parameters, to provide information to the core monitoring system so that a quick and accurate determination of core thermal performance can be performed; and to improve data collection and processing, accounting, alarming and logging functions. An auxiliary function of the PPC is to transmit plant data to remote locations, including the Technical Support Center and the Emergency Operations Facility.

7.7.4.2 Power Generation Design Bases

1. The PPC system is designed to periodically determine the reactor thermal power output.

2. The PPC provides near-continuous monitoring of the core operating level and appropriate alarms based on established core operating limits to aid the operator in ensuring that the core is operating within acceptable limits at all times, especially during periods of power

level changes.

3. The PPC provides information to the core monitoring software such that the three-dimensional power density and isotopic concentration data for each fuel bundle in the core may be calculated.

4. The PPC receives control rod information from the Rod Worth Minimizer (RWM) for display and printout of control rod patterns to aid the operator in adhering to procedural restrictions of control rod manipulation. The PPC also receives RWM status information.

5. The PPC provides status alarm logging of se lected contact-actuated status changes for nuclear systems alarm inputs to aid in general operation of the plant.

UFSAR/DAEC-1 7.7-22 Revision 21 - 5/11

6. The PPC provides post-scram analysis l ogging of the sequence of contact-actuated changes for alarm inputs on reactor scram trip devices and logging of stored data before and after a reactor scram for selected analog inputs.

7. The PPC normally receives power from 480-V load center 1B6. If power from this source is not available, the system is powered by the TSC/PPC standby generator, or 480-

V Panel 1L66.

7.7.4.3 Safety Objective

The PPC has no safety objective.

7.7.4.4 Safety Design Basis

The PPC has no safety design basis.

7.7.4.5 Computer System Components

7.7.4.5.1 Central Processor

The central processor performs various calculations and provides for general input/output (I/O) device control and buffered transmission between I/O devices and memory.

The processor uses interrupt capability to respond rapidly to important process functions and to operate at optimum speed.

Capability is provided to maintain real time using an internal clock (date, hours, minutes, seconds, tenths, hundredths). The PPC VAX has a battery backed-up clock. Therefore, even in the event of a processor shutdown, the clock will automatically continue to provide the correct time.

7.7.4.5.2 Bulk Memory Subsystem

Bulk memory consists of hard disks and is used for the storage of the software programs, data, and other important information. Capability is provided for file protection; to protect against information destruction caused by an inadvertent attempt to write over the files or by a system power failure. UFSAR/DAEC-1 7.7-23 Revision 18 - 10/05 7.7.4.5.3 Peripheral I/O Subsystem

The peripheral I/O equipment used to read programming data into and out of the computer consists of a magnetic tape unit, I/O, general use, and alarm printers, and color CRTs. The magnetic tape unit and I/O printer are located in the Data Acquisition Center. The on-demand and alarm printers are located in the main control room.

7.7.4.5.4 Data Acquisition Subsystem (DAS) Hardware

Data Acquisition Subsystem (DAS) hardware is located in A High Speed Serial Processor (HSSP) interfaces with Intelligent Remote Control Units (IRCUs) in Division I and II, non-divisional, and meteorological DAS chasses. The IRCUs function as the interface between the DAS input/output circuits and the PPC. They control DAS functions and provide data requested by the PPC VAX programs. The IRCUs and the PPC processor perform scanning, time tagging, sequence of events, error checking, and other signal processing functions. The PPC has the capability to time tag events with a resolution of at least one millisecond.

The Plant Process Computer is electronically isolated from the DAS. Fiber optic communication links are used to provide input to the PPC VAX from the DAS.

7.7.4.5.5 CRT Color Terminals

During routine operation, the operator uses CRT color terminals located in the main control room to enter information into the computer and for requesting various special functions from it.

7.7.4.6 Reactor Core Performance Function

7.7.4.6.1 Power Distribution Evaluation

The local power density of every six inch segment for every fuel assembly is calculated using plant inputs of pressure, temperature, flow, LPRM levels, control rod positions, and the calculated fuel exposure. Total core thermal power is calculated from a reactor heat balance. Iterative computational methods are used to establish a compatible relationship between the core

coolant flow and core power distribution. The results are subsequently interpreted as local power at specified axial segments for each fuel bundle in the core.

UFSAR/DAEC-1 7.7-24 Revision 20 - 8/09 The core distribution calculation sequence is completed periodically and on demand. Subsequent to executing the program, the computer prints a periodic log.

7.7.4.6.2 Core Monitoring

Each LPRM reading is scanned once per second. This information, combined with heat balance information, allows for periodic and automatic monitoring of core thermal limits. These computations are accurate periodic power distribution calculations.

7.7.4.6.3 LPRM Calibration

Flux level and position data from the TIP equipment are read into the computer. The computer evaluates the data and determines gain adjustment factors by which the LPRM amplifier gains can be altered to compensate for exposure-induced sensitivity loss. The LPRM amplifier gains are not to be physically altered except immediately prior to and/or as part of a whole core calibration using the TIP subsystem. The gain adjustment factor computations help

to indicate to the operator when such a calibration procedure is necessary.

7.7.4.6.4 Fuel Exposure

Using the power distribution data, a distribution of fuel exposure increments from the time of a previous power distribution calculation is determined and is used to update the distribution of cumulative fuel exposure. Each fuel bundle is identified by batch and location, and its exposure is stored for each of the axial segments used in the power distribution calculation. These data are printed out on demand by the operator.

7.7.4.6.5 Control Rod Exposure

Exposure increments are determined periodically for each one-quarter length section of each control rod. The corresponding cumulative exposure totals are periodically updated and printed out on demand by the operator.

UFSAR/DAEC-1 7.7-25 Revision 18 - 10/05 7.7.4.6.6 LPRM Exposure

The exposure increment of each local power range monitor is determined periodically and is used to update both the cumulative ion chamber exposures and the correction factors for exposure-dependent LPRM sensitivity loss. These data are printed out on demand by the

operator.

7.7.4.6.7 Isotopic Composition of Exposed Fuel

The computer provides online capability to determine isotopic composition for each fuel bundle in the core. This evaluation consists of computing the weight of one neptunium, three uranium, and five plutonium isotopes as well as the total uranium and total plutonium content. The method of analysis consists of relating the computed fuel exposure and average void fraction for the fuel to computer-stored isotopic characteristics applicable to the specific fuel type.

7.7.4.6.8 Stability Monitoring

In response to Generic Letter 94-02 (Reference 1), an on-line stability monitoring system was installed following Refuel Outage 14. This stability monitoring is accomplished via use of the SOLOMON system and provides operators with a means of detecting when stability margin

is degrading. Per Reference 2, operation within the "buffer zone" as shown on the power flow map included in the Core Operating Limits Report (COLR) in not allowed when SOLOMON is

inoperable.

7.7.4.7 Plant Process Computer System Software

7.7.4.7.1 Data Acquisition and Processing Software

The data acquisition and processing software scans the plant instrumentation to gather data from plant data systems; supports signal processing such as ranging, span and zero adjustments; and makes the data available for subsequent data storage and processing by the

PPC. The software controls the processing associated with the following types of field

inputs/outputs;

1. Analog inputs

2. Digital inputs

3. Sequence-Of-Events (SOE) inputs

4. Pulse inputs UFSAR/DAEC-1 7.7-26 Revision 15 - 5/00 5. Digital outputs

6. Analog outputs

The software provides six different scan cl asses (i.e., scan frequencies) for assigning point scan/processing frequency for analog points. All digital points are in the one second scan class. Additionally, the software provides for alarming of analog and digital points, limit checking of values, and quality code determination.

The alarm CRT displays all analog point alarms generated by the system. The alarm list is divided into an unacknowledged alarm section and an acknowledged alarm section. A white line separates the two sections. Alarm lines in each area are sorted first by priority and then chronologically. When there are no unacknowledged alarms, the white line will not appear.

The alarm logs are hard-copy records of the alarm CRT displays and are typed by the alarm printer located underneath the common console in the main control room.

Alarm printouts are used to inform the operator of computer system malfunctions, plant system operation exceeding acceptable limits, and potentially off-normal, or failed input sensors.

7.7.4.7.2 Balance of Plant (BOP) Software

7.7.4.7.2.1 Man-Machine Interface (MMI)

The Balance Of Plant (BOP) Software provides a man-machine interface (MMI) to the Plant Process Computer programs and the pro cess data base. The BOP software provides capability for data display, data storage, and report generation. The information is available through hierarchically structured menus and is designed to operate under all normal plant operating conditions. The user uses the following touchscreen menus for accessing the data

display, storage, and reporting functions:

1. Master Menu

2. Plant Process Computer Operations Menu

3. Group Menu

4. DGS Demandable Function Menu

5. BOP Reporting Menu

6. Data Trending and Plotting Menu UFSAR/DAEC-1 7.7-27 Revision 15 - 5/00 7. Maintenance Menu

8. Utilities Menu

The log and reporting menus will provide capability for data display, data storage, and report generation. The information will be available through various Balance Of Plant software modules.

7.7.4.7.2.2 NSSS/BOP Post-Trip Logging

The Plant Process Computer (PPC) and the plant strip chart recorders support the re-

construction of the sequence of events following a reactor trip. The PPC software is capable of accessing 4096 analog and digital input points, many of which are time sequenced on the alarm printer. The alarm printer provides time signatures (typically 2 milliseconds) for important data points, depending on the alarm point priority, sequencing, and computer scan class. Low priority computer inputs are stored in the computer during periods of maximum printer demand and may be printed out at a later time.

The NSSS/BOP Post-trip Log consists of the following:

Values for the nuclear steam supply system variables are provided for several key parameters before and after a scram. These parameters include core thermal power, total core flow, reactor water level, reactor pressure, etc.

Values for the balance of plant variables are provided by the computer before and after a scram. The selected variables include turbine-generator parameters, feedwater system parameters, and condenser parameters.

The operator's choice for the sampling rate for the post-trip log is from one to sixty seconds in one second increments. The pre-trip time window is 0 to 20 minutes and the post-trip time window is 0 to 20 minutes with the restriction that the total time window for the NSSS/BOP Post-trip Log shall not be greater than 20 minutes.

The strip chart recorders provide a continuous, analog record of such information as neutron flux, recirculation pump flow, emergency core cooling system parameters, feedwater and condensate system parameters, containment parameters, radiation monitoring, ventilation system parameters, and turbine-generator variables.

7.7.4.8 Inspection and Testing

The process computer system is self checking. It performs diagnostic checks to determine the operability of certain portions of the system hardware, and it performs internal programming checks to verify that input signals and selected program computations are either within specific limits or within reasonable bounds. UFSAR/DAEC-1 7.7-28 Revision 20 - 8/09

7.7.5 RECIRCULATION

FLOW CONTROL SYSTEM

7.7.5.1 Power Generation Objective

The power generation objective of the recirculation flow control system is to control reactor power level, over a limited range, by controlli ng the flow rate of the reactor recirculating water.

7.7.5.2 Power Generation Design Bases

1. The recirculation flow control system is de signed to allow variation of the recirculation flow rate.

2. The recirculation flow control system is designed to allow manual recirculation flow adjustment, so that manual control of reactor power level and load following are possible.

7.7.5.3 Safety Design Bases

The recirculation flow control system functions so that no abnormal operational transient resulting from a malfunction in the recirculation flow control system can result in damaging the fuel or exceeding the nuclear system pressure limits.

7.7.5.4 System Description

7.7.5.4.1 General

Reactor recirculation flow is changed by adjusting the speed of the two reactor recirculation pumps. The recirculation flow control system controls the power supplied to the recirculation pump motors. By adjusting the frequency of the electrical power supplied to the recirculation pump motors, the recirculation flow control system can manually affect changes in reactor power level. The reactor recirculation flow control system can control recirculation pump speed over a nominal range of 330 RPM to 1710 RPM. Minimum speed is set by the scoop tube positioner electrical stops. When the reactor is operating in a desired control rod pattern, flow adjustments can smoothly change reactor power over a power range of about 50%, without movement of the control rods.

An increase in recirculation flow temporarily reduces the void content of the moderator by increasing the flow of coolant through the core. The additional neutron moderation increases the reactivity of the core, which causes the reactor power level to increase. The increased steam generation rate increases the steam volume in the core with a consequent negative reactivity

effect, and a new steady-state power level is established. When recirculation flow is reduced, the power level is reduced in the reverse manner. UFSAR/DAEC-1 7.7-29 Revision 20 - 8/09 Figure 7.7-6 illustrates how the recirculation flow control system operates.

Each recirculation pump motor has its own motor-generator (M-G) set for a power supply. A variable speed converter is provided between the M-G set motor and generator. To change the speed of the reactor recirculation pumps, the variable speed converter varies the generator speed, which changes the frequency supplied to the pump motor to give the desired pump speed. The recirculation flow control system uses demand signals supplied by manual adjustment of the speed controllers.

The speed controller signal adjusts its M-G set variable speed converter as follows: The controller demand signal is compared with the setpoint. The speed controller differential signal causes adjustment of the speed converter, resulting in a change of the generator speed until the setpoint equals the controller demand signal.

7.7.5.4.2 Motor-Generator Set

Each M-G set supplies power to its associated recirculating pump motor. Each of the two M-G sets and its controls are identical; therefore, only one description is given of the M-G set. The M-G set can continuously supply power to the pump motor at any speed between approximately 19% and 96% of drive motor speed. The M-G set is capable of starting the pump and accelerating it from standstill to the desired operating speed when the pump motor thrust bearing is fully loaded by reactor pressure acting on the pump shaft.

The main components of the M-G set are a drive motor, a generator, and a variable speed

converter with an actuation device to adjust the converter speed.

During restoration from Single Loop Operati on, after startup of the idle recirculation pump, the discharge valve of the lower speed pump may not be opened unless the speed of the faster pump is less than 50% of its rated speed. This is to restrict reactor vessel internals vibration to within acceptable limits.

An investigation has been conducted to determine the consequence of a postulated case of simultaneous loss of both recirculation M-G set fields. Since this occurrence is not reasonably expected during the plant life, neither can it result from a single operator error or a single equipment malfunction; therefore, this postulation cannot be classified as an abnormal operational transient as defined in Chapter 15. Nevertheless, an analysis was performed, and the thermal hydraulic effect from this postulated event resulted in greater MCHFR than that for a postulated single recirculation pump shaft seizure. (Note: MCHFR is the historical fuel thermal limit. The current limit used is the Minimum Critical Power Ratio (MCPR) as described in

Chapter 4.) UFSAR/DAEC-1 7.7-30 Revision 20 - 8/09 Drive Motor

The drive motor is an ac induction motor that drives the input shaft of the variable speed converter. The motor can operate under electric supply variations of 5% of rated frequency or 10% of rated voltage. The ac power for each drive motor is supplied from a different bus.

Generator The variable frequency generator is driven by the output shaft of the variable speed converter. During normal operation, the generator exciter is powered by the drive motor. The excitation of the generator is provided from an auxiliary source during pump startup.

Variable Speed Converter and Actuation Device

The variable speed converter transfers power from the drive motor to the generator. The variable speed converter actuator automatically ad justs the slip between the converter input shaft and output shaft as a function of the signal from th e speed controller. If the speed controller is lost, or if the actuator electrical power supply is interrupted, the actuator causes the speed converter slip to remain "as is." Manual reset of the actuation device is required to return the speed converter to normal operation.

7.7.5.4.3 Speed Control Components

The speed control system controls the variable speed converters of both M-G sets. The M-G sets are individually manually controlled. The control system components for each M-G set are the following: a speed indicating controller, a generator tachometer, and a V/I converter .

Speed Indicating Controller (one for each M-G set)

The speed indicating controller transmits the signal that adjusts the M-G set variable speed converter. The speed indicating controller receives a signal from the V/I converter to monitor the generator speed. The speed converter adjusts the demand signal according to the magnitude and duration in the difference between the demand signa l and the desired setpoint. A zero difference between the setpoint and the demand signal will result in a steady generator speed. The recirculation speed setpoint is manually controlled via operator adjustment of the

speed indicating controller.

The speed indicating controller has four indicators, three bar graphs and a digital meter.

The three bar graphs will continuously display the M-G set scoop tube position setpoint and controller output to assist the operator. The digital meter on the speed indicating controller can be used to display any of the variables: position, speed, setpoint and controller output.

UFSAR/DAEC-1 7.7-31 Revision 20 - 8/09 Start-up Signal

The speed indicating controller generates a start-up signal that adjusts the variable speed converter so that a proper amount of power can be delivered from the M-G set to start and accelerate the pump motor to the minimum continuous operating speed.

Limiters The speed indicating controller will 1imit the output if either the recirculation pump discharge valve is not fully open or total feedwater flow is less than 20% of rated. This limited output signal will reduce the generator speed to the minimum speed. This limiting action is to prevent pump overheating should the discharge valve be closed and protect the recirculation pump against possible cavitation due to low feed water flow.

The speed indicating controller will limit the output in the event of shutdown of any one feedwater pump and the reactor vessel level is below the point at which vessel low-level alarm is initiated. The limited signal will cause a reduction of generator and recirculation pump speed so that

resultant reactor power reduction is not within the capabilities of the feedwater system. This limiting action doesn't allow vessel level to recover fast enough and a reactor scram occurs when

level reaches the Level 3 trip point.

Failure Alarm

If the speed indicating controller were to fail or upon loss of the feedback signal to the recirculation speed controller, a normally energized contact in the speed indicating controller will actuate an alarm in the control room and acts to prevent any change of slip within the

variable speed converter.

Deviation Signal The deviation between the slip device controller's (scoop tube actuator) actual position and the demand signal to that device is compared in the speed controller. If a large positive deviation is sensed at the positioner between demand and actual position, the scoop tube will lock. Together, this limits the amount of recirculation pump speed change can result from mismatches between the demanded speed signal and the actual slip device position.

Generator Tachometer (one for each M-G set)

The generator tachometer is directly connected to the generator shaft and supplies the feedback signal to the V/I converter. The V/I converter supplies a monitor signal to the speed indicating controller. UFSAR/DAEC-1 7.7-32 Revision 15 - 5/00 7.7.5.4.4 Safety Evaluation

The recirculation flow control system is designed so that coupling is maintained between an M-G set drive motor and its generator even if the ac power or a speed controller signal fails. This ensures that the drive motor inertia contributes to power supplied to the recirculation pump

during the coastdown of the M-G set after loss of ac power and that the generator continues to be driven if the speed controller signal is lost.

Transient analyses described in the Accident Analyses section (Chapter 15) show that no malfunction in the recirculation flow control system can cause a transient sufficient to damage the fuel barrier or exceed the nuclear system pressure limits, as required by the safety design

basis.

A topical report, NEDO-10677, has been prepared by General Electric for the Enrico Fermi 2 and Browns Ferry class reactors describing the probable consequences from recirculation pump overspeed in a typical BWR. This report was submitted to the AEC in

October 1972.

The report states basically that in the unlikely event that a break occurs in the recirculation line, the pump impeller may act as a hydraulic turbine causing the pump and motor to overspeed and become potential sources of missiles. See Section 3.5.1.2.1.

7.7.5.4.5 Inspection and Testing

The M-G set speed controller functions during normal power operation. Any abnormal operation of this component can be detected during operation. The components that do not continually function during normal operation can be tested and inspected for calibration and operability during scheduled plant shutdowns. All the recirculation flow control system components are tested and inspected according to normal plant practices, recommendations of the component manufacturers and operating hist ory. This can be done during scheduled shutdowns.

7.7.6 SAFETY

PARAMETER DISPLAY SYSTEM

7.7.6.1 Power Generation Objective

The objective of the safety parameter display system (SPDS) is to provide a concise display of critical plant variables to the control room personnel to aid them in rapidly and reliably determining the safety status of the plant. The SPDS will be operated during normal plant operations, as well as during abnormal and emergency conditions. The principal purpose and function of the SPDS is to aid the control room personnel during abnormal and emergency conditions in determining the safety status of the plant.

UFSAR/DAEC-1 7.7-33 Revision 14 - 11/98 7.7.6.2 Power Generation Design Bases

1. The SPDS will continuously display real-time information in the control room from which the plant safety status can be readily and reliably assessed by control room

personnel.

2. The SPDS is not a safety system and it will perform no active safety function. The existing control room instrumentation will provide the operators with the information necessary for safe reactor operation under normal, transient, and accident conditions.

The SPDS will be used in addition to the existing instrumentation and will serve to aid and augment it. No emergency action will be taken based on the SPDS data alone.

3. The graphic design of the displays and the location of the SPDS terminal in the control room was human-factor engineered in accordance with the criteria of NUREG-0696 and

NUREG-0700.

4. The SPDS is designed to operate continuously during all reactor operating modes, i.e.,

a. Startup/hot standby.

b. Run.

c. Shutdown.

d. Refuel.

Reactor mode switch position is indicated on all SPDS displays.

5. The SPDS is designed to obtain a minimum availability of 98% with a goal of 99%

availability during plant operation and 80% during cold shutdown. Availability calculations use the definitions and methodology prescribed in Section 1.5 of

NUREG-0696. To help achieve this reliability goal, the TSC/PPC standby generator provides standby power to the SPDS/PPC in the event the normal plant supply and

alternate power supply are lost.

6. The SPDS is a major subsystem of the DAEC Plant Process Computer (PPC). The PPC/SPDS data acquisition subsystem (DAS) interfaces with class 1E systems and the plant effluent monitoring system to acquire appropriate plant data. The PPC/SPDS is designed so that it can be operated, functionally tested, and calibrated without impacting the normal operation of Class IE equipment.

UFSAR/DAEC-1 7.7-34 Revision 20 - 8/09

7. The DAS is designed to accommodate approximately 1100 inputs and has the capability for expansion to 2000 total inputs without requiring changeout of the base system DAS

hardware.

8. The DAS is designed to accommodate both digital and analog inputs and outputs.

7.7.6.3 System Description

The SPDS consists of three subsystems: a data acquisition subsystem (DAS), a host processor subsystem, and a display terminal.

7.7.6.3.1 Data Acquisition Subsystem (DAS)

The DAS encompasses signal acquisition, analog-to-digital conversion, digital input/output, and communications with the host processor subsystem. The DAS interfaces with

safety-related and non-safety-related signals and provides the required Class 1E electrical

isolation and physical separation.

Six cabinets (Division I, Division II, and 4 nondivisional) mounted at remote and separate locations are configured to handle fi eld input signals. The Division I and Division II portions of the DAS are Class 1E qualified ha rdware and will interface with safety-related signals. The nondivisional cabinet did not contai n Class 1E qualified hardware and interface only with non-safety-related signals. Electrical isolation between the safety-related signals and the SPDS is accomplished by the use of fiber optic cable extending between the Division I and Division II cabinets and the host processor. The DAS acquires data from existing plant sensors and instrumentation, converts the signals from analog to digital, and transmits the digital data to the host processor subsystem.

7.7.6.3.2 Host Processor Subsystem

The host processor subsystem consists of program load facilities, a host processor, sufficient resident memory to support the pro cessing needs of the PPC and SPDS, input/output device controllers, data storage facilities, and SPDS Display terminals. Communication controllers and modems required for communication and data transmission to and from the host processor subsystem and communication protocol and error-checking software are included.

The PPC/SPDS software package provides for data acquisition, calculations, alarms, historical data retention, user interaction, and display. The host processor is a Digital Equipment Corporation VAX computer. UFSAR/DAEC-1 7.7-35 Revision 20 - 8/09 7.7.6.3.3 SPDS Display Terminal Each SPDS display terminal includes the hardware and software necessary for accepting, formatting, and generating displays. Several SPDS display terminals are located in the Control Room and function to provide information to the personnel in the Control Room and communications with the SPDS. The terminal consists of a PC and monitor, with a keyboard/mouse interface for display requests. Each SPDS display terminal contains its own microprocessor and user memory to store operational background displays.

There are three levels of display. A single top level (level 1) display provides an

overview of plant safety status and contains five safety parameter blocks along with analog (vertical bar graph) and digital values for critical variables. The display presents a continuous indication of individual plant safety parameters.

There are five level 2 displays, one for each of the five safety parameters, that provide detailed information regarding the status of each parameter. These displays contain 30-min trend information for selected variables and status information (real-time digital values) for all variables associated with each safety parameter. The current values of trended variables are also

displayed as vertical bar graphs along with digital values.

The level 3 displays are X-Y plots of two variables, for example:

1. TORUS LOAD LIMIT (torus level versus reactor pressure vessel pressure).

2. HEAT CAPACITY TEMPERATURE LIMIT (torus temperature versus reactor pressure vessel pressure).

Additional SPDS display terminals are located in the computer room and at other locations at the DAEC for display generation and/or modification, updating software, and display formatting. The Control Room terminal takes priority over all other display terminals in the system.

7.7.6.4 Safety Parameters and Associated Variables

7.7.6.4.1 Safety Parameters

Safety parameters are the quantitative and qualitative measures displayed by the SPDS to indicate the accomplishment or maintenance of critical safety functions. Information needed to assess the status of the plant safety parameters is obtained by the measurement of key plant variables. The safety parameters utilized by the SPDS to assess the maintenance or UFSAR/DAEC-1 7.7-36 Revision 20 - 8/09 accomplishment of the critical safety functions as required by NUREG-0737, Supplement 1, Section 4, are:

1. Reactivity control.

2. Reactor core cooling and heat removal.

3. Reactor coolant system integrity.

4. Containment conditions.

5. Radiation control.

7.7.6.4.2 Key Plant Variables

The key plant variables to be monitored in order to assess the status of each of the five safety parameters listed in Section 7.7.6.4.1 are listed in Table 7.7-1. The analog ranges of the displayed variables are listed in Table 7.7-2. In general, the ranges monitored by the SPDS are identical to those ranges monitored by existing control room instrumentation. All ranges

displayed by the SPDS are adequate to cover plant responses analyzed in Chapter 15.

7.7.6.5 Emergency Operating Procedure Graphs

The Emergency Operating Procedure (EOPs) contain X-Y type graphs used to manually plot two plant variables. The SPDS aids the operator by displaying equivalent graphs and automatically plotting a time series of data points on each graph. The SPDS determines when

the plotted point is in an undesirable region of the graph and provides a visual alarm indication.

7.7.7 ROD WORTH MINIMIZER (RWM) MICROCOMPUTER SYSTEM

7.7.7.1 Description

The RWM microcomputer system is a stand-alone microprocessor based system which provides the operator with an effective backup control rod monitoring routine that enforces adherence to established startup, shutdown, and low power level control rod procedures (see Section 7.7.7). The RWM microcomputer prevents the operator from establishing control rod patterns that are not consistent with prestored RWM sequences by initiating appropriate rod

withdrawal block and rod insert block interlock signals to the reactor manual control system rod block circuitry (Figure 7.7-2, Sheet 5). The RWM sequences stored in the microcomputer memory are based on control rod withdrawal procedures designed to limit (and thereby minimize) individual control rod worths to acceptable levels as determined by the design-basis

rod drop accident. UFSAR/DAEC-1 7.7-37 Revision 14 - 11/98 The RWM function does not interfere with normal reactor operation, and in the event of a system failure does not itself cause rod patterns to be established. The RWM function may be

bypassed and its block function disabled only by specific procedural control initiated by the

operator, in accordance with the DAEC Technical Specifications.

7.7.7.2 Rod Worth Minimizer Inputs

The following operator and sensor inputs are used by the rod worth minimizer:

1. Sequence

The operator can select any one of four permissible sequences to be enforced by the computer.

The operator is permitted to switch from sequence Al to A2 to Bl to B2 in any order when all rods are in and whenever the reactor is operating above the low power level

setpoint.

2. Bypass/Operate/Test Mode

A key-lock switch is provided to permit the operator to test or apply permissives to RWM rod block functions at any time during plant operation.

3. Control Rod Selected

This input is binary coded identification of the control rod selected by the operator.

4. Control Rod Position

This input is binary coded identification of all control rod positions.

5. Control Rod Drive Selected and Driving The RWM uses this input to annunciate rod movements when a rod is moving and is driven beyond insert and withdraw limits. Rod insert and withdraw blocks are applied whenever a rod is at its insert or withdraw limit, respectively. When a rod is being inserted and reaches a notch position less than or equal to its insert limit minus two, an annunciator output signal is generated at control room panel When a rod is being withdrawn and reaches a notch position equal to or greater than its withdraw limit plus one, an annunciator output signal is generated at control room panel

6. Control Rod Drift

UFSAR/DAEC-1 7.7-38 Revision 14 - 11/98 The RWM program recognizes a position change of any control rod using the control rod drift signal input.

7. Reactor Power Level Feedwater flow and steam flow signals are used to implement two digital inputs to permit program control of the RWM function. These two inputs, the low power setpoint and the low power alarm setpoint, were originally used to disable the RWM function at power levels above the intended service range of the RWM function. However, at the DAEC, rod worth control is now enforced at all power levels.

7.7.7.3 Rod Worth Minimizer Outputs

Isolated contact outputs to plant instrumentation provide RWM block functions to the reactor control system to permit or inhibit wit hdrawal, or insertion of a control rod. These actions do not affect any normal instrumentation displays associated with the selection of a

control rod (Figure 7.7-2, Sheet 5).

7.7.7.4 Rod Worth Minimizer Indications

The RWM control panel provides the following indications:

1. Insert Error Control rod coordinate identification for up to three rods causing insert errors.

2. Withdrawal Error Control rod coordinate identification for up to two rods causing withdrawal errors.

3. Latched Step Identification of the RWM sequence step number currently enforced by the microcomputer.

4. Latched Sequence Indication of the RWM sequence (Al, A2, Bl or B2) currently being enforced by the microcomputer.

5. RWM Bypass Indication that the rod worth minimizer is manually bypassed.

UFSAR/DAEC-1 7.7-39 Revision 14 - 11/98 6. Insertion Block Indication that an insertion block is in effect for the selected control rod.

7. Withdrawal Block Indication that a withdrawal block is in effect for the selected control rod.

7.7.7.5 Design Objective

The Rod Worth Minimizer Microcomputer supplements procedural requirements for the control of rod worth during control rod manipula tions when reactor startup or shutdown is in process.

7.7.7.6 Design Basis

The Rod Worth Minimizer Microcomputer provi des inputs to the rod block circuitry to supplement and aid in the enforcement of procedural restrictions on preprogrammed control rod manipulations, which are designed to limit rod worth to the values assumed in the plant safety

analyses.

7.7.7.7 Safety Evaluation

As described in the references cited in Chapter 15, discussion of the control rod drop accident, the maximum rod worth below 10% power assumed was 0.025 k. The RWM operates to maintain the maximum rod worth below 0.01 k. At power levels above 10% of rated power, the maximum rod worth possible was assumed in the control rod drop accident cases; thus, no rod worth control is required above 10% of ra ted power. However, at the DAEC, rod worth control is enforced at all power levels. Should the RWM be inoperative for any reason, the reactor operator can maintain acceptable rod worth by simply adhering to prescribed control rod patterns and sequences when below 10% of rated power. Also, whenever the RWM becomes inoperable during reactor startup or shutdown, a second reactor operator or other qualified member to the technical staff shall verify that the acceptable rod patterns and sequences are being adhered to.

7.7.7.8 Inspection and Testing

The Rod Worth Minimizer system is self checking. It performs diagnostic checks to determine the operability of certain portions of the system hardware, and it performs internal programming checks to verify that input signals and selected program computations are either within specific limits or within reasonable bounds. The Rod Worth Minimizer computer on-line diagnostic test shall be successfully performed. UFSAR/DAEC-1 7.7-40 Revision 15 - 11/98 7.7.7.9 Diagnostics Available for RWM 7.7.7.9.1 RWM Failure Detection

The software system determines the integrity of the RWM system hardware and software. The system performs various tests at the time of initialization. All errors and failures detected by the tests are reported by illuminating messages on the RWM Operator's Display. The RWM also sends messages to the Plant Process Computer.

7.7.7.9.2 RWM Computer Stall Indication

The RWM computer closes and opens a contact output to retrigger a stall timer at least once every 0.1 seconds. The stall alarm open/close contact is connected to the plant annunciator system. UFSAR/DAEC-1 7.7-41 Revision 15 - 5/00 REFERENCES FOR SECTION 7.7

1. NRC Generic Letter 94-02, "Long-Term Solutions and Upgrades of Interim Operating Recommendations for Thermal-Hydraulic Instabilities in Boiling Water Reactors," dated July 11, 1994.

2. Amendment No. 215 to Facility Operating License No. DPR-49 Duane Arnold Energy Center, dated August 7, 1996.

UFSAR/DAEC - 1 T7.7-1 Revision 13 - 5/97 Table 7.7-1 Sheet 1 of 5 SAFETY PARAMETER DISPLAY SYSTEM SAFETY PARAMETERS AND ASSOCIATED KEY PLANT VARIABLES Safety Parameter Variables Reactivity control Source range monitor power Average power range monitor power Average power range monitor bypass switch position

Source range monitor power position Scram signal All-rods-in indication Standby liquid control tank level Standby liquid control system discharge header pressure

Automatic depressurization system Train A times initiation Train A time to activation Train B timer initiation Train B time to activation Safety/relief valve position Reactor vessel water level Reactor vessel pressure Total core flow

UFSAR/DAEC - 1 T7.7-2 Revision 13 - 5/97 Table 7.7-1 Sheet 2 of 5 SAFETY PARAMETER DISPLAY SYSTEM SAFETY PARAMETERS AND ASSOCIATED KEY PLANT VARIABLES Safety Parameter Variables

Reactivity control (continued) Torus water temperature Reactor core cooling Reactor vessel water level Average power range monitor power Average power range monitor bypass switch position

Total core flow Safety/relief valve position RCIC flow RCIC injection valve position HPCI flow HPCI injection valve position

Core Spray Loop A flow Loop B flow Loop A injection valve position Loop B injection valve position LPCI

Loop A flow

UFSAR/DAEC - 1 T7.7-3 Revision 13 - 5/97 Table 7.7-1 Sheet 3 of 5 SAFETY PARAMETER DISPLAY SYSTEM SAFETY PARAMETERS AND ASSOCIATED KEY PLANT VARIABLES Safety Parameter Variables

Reactor core cooling (continued) Loop B flow Loop A injection valve position Loop B injection valve position Feedwater flow Reactor vessel pressure Condensate storage tanks level Torus water level Reactor coolant system integrity Drywell pressure Drywell temperature Reactor vessel pressure Reactor vessel water level Main steam isolation valves position Safety/relief and safety valves position Automatic depressurization system Train A timer initiated Train A time to activation Train B timer initiated Train B time to activation

UFSAR/DAEC - 1 T7.7-4 Revision 13 - 5/97 Table 7.7-1 Sheet 4 of 5 SAFETY PARAMETER DISPLAY SYSTEM SAFETY PARAMETERS AND ASSOCIATED KEY PLANT VARIABLES Safety Parameter Variables

Reactor coolant system integrity (continued) Leakage rate to drywell flow sump Leakage rate to equipment drain sump

Containment conditions Drywell pressure

Drywell temperature

Torus water level

Torus water temperature

Main steam isolation valves position

Safety/relief valve position

Safety valve position

Drywell O 2 concentration

Torus O 2 concentration

Drywell H 2 concentration

Torus H 2 concentration

isolation valve group initiation and isolation valve group number

Radioactivity control Offgas stack activity

Reactor building exhaust ventilation activity

Turbine building exhaust ventilation activity

Containment high-range radiation level

UFSAR/DAEC - 1 T7.7-5 Revision 13 - 5/97 Table 7.7-1 Sheet 5 of 5 SAFETY PARAMETER DISPLAY SYSTEM SAFETY PARAMETERS AND ASSOCIATED KEY PLANT VARIABLES Safety Parameter Variables

Radioactivity control (continued) Reactor building closed cooling water activity

Residual heat removal heat exchanger service water outlet activity

General service water activity

Post-treatment offgas activity

Pretreatment offgas activity

UFSAR/DAEC - 1 T7.7-6 Revision 20 - 8/09 Table 7.7-2 Sheet 1 of 2 SAFETY PARAMETER DISPLAY SYSTEM KEY PLANT VARIABLES RANGES DISPLAYED VARIABLE DISPLAYED RANGE Reactor power (APRMs) 0% to 125% Reactor power (SRMs) 0 to 10 6 cps Reactor vessel water level a -100 in. to 218 in. Drywell pressure -5 to 250 psig Drywell temperature 0 to 350 ûF Drywell O 2 concentration 0 to 20% Drywell H 2 concentration 0 to 10% Torus O 2 concentration 0 to 20% Torus H 2 concentration 0 to 10% Torus water temperature 50 ûF to 250ûF Torus water level 1.5 to 30 ft. RCIC flow 0 to 500 gpm HPCI flow 0 to 3500 gpm Residual heat removal flow (LPCI) 0 to 15,000 gpm Core spray flow (loops A and B) 0 to 5000 gpm Feedwater flow (loops A and B) 0 to 5 x 10 6 lbm/hr (for each loop) Total core flow 0 to 60 x 10 6 lbm/hr Condensate storage tanks level 0 to 24 ft. Standby liquid control tank level 0 to 100% (82.5 in.) Standby liquid control system pressure 0 to 1800 psig Leakage rate to drywell floor sump 0 to 120 gpm Leakage rate to equipment drain sump 0 to 120 gpm a Zero is referenced to top of active fuel

UFSAR/DAEC - 1 T7.7-7 Revision 13 - 5/97 Table 7.7-2 Sheet 2 of 2 SAFETY PARAMETER DISPLAY SYSTEM KEY PLANT VARIABLES RANGES DISPLAYED VARIABLE DISPLAYED RANGE Automatic depressurization system train A time 0 to 120 sec Automatic depressurization system train B time 0 to 120 sec Containment radiation monitor 1 to 10 7 R/hr Reactor building exhaust

ventilation activity 10-7 to 10 5 Ci/cm 3 Station Offgas stack activity 10 -7 to 10 5 Ci/cm 3 Reactor building closed cooling water activity c 0.1 to 10 6 cps RHR heat exchanger service

water outlet activity 0.1 to 10 6 cps Turbine building exhaust

ventilation activity 10-7 to 10 5 Ci/cm 3 Offgas system pretreatment activity 0.1 to 10 6 cps Offgas system post-treatment

activity 0.1 to 10 6 cps General service water activity 0.1 to 10 6 cps

c cps represents counts per second

6/89RodDriveSystemFCD,Contro1HydraulicRevision7Figure7.7-2,SheetIDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORT-SlilTCHGEARDEY'c.:,,-"CTlc""lJ"ec*.,eU.(\'.'.,,00'"'-'RTH=',IN:;("00PLlSITL,""jC,'R,"T'CN,<STD",INpuTTOc",.:ruTER"NeUT"ON*AVF.:R'G("",,"ER'.>.'NIToR""0SLCeK=RAN.>£:*lPRM""'t.THeROOCII!CU1TSHAL.LTO'"'T,A.ONLYONEROOMAYBE,ELE:OWH*T1"EB.\MENIS'NITlArW,'HE::O:L<;(;T,,)0-;0SHAI,lBoSoALWTO'",IIB,r';'::T',0moTHORROOTHE::<'_0I"OO:"TFORlQS.Sor">r").I.EACHROO,AsITOoo.tll'IITHORA"",jPASSESATOP1\10P05lTIOIlS"'TCHoSARECAL""'":'1,0T'*\,:E:l"'AWlHoEiOTT<>>-IT'n'GPOSITIONS'"E*'.,m_ORA"""&O[SCO""E(T:.""T'."(3"E*'REOlV10ED'NToco!)(ORICfll'OSI1IOO5.ASTHEROOTRA"ELSO'IORI,",,',"'CHAllSIGNALISl.EACH."sY5TE..,EUCTION,-,:flllTIPLE",-",'eER3ro;"JE..Qi<;faOC"".ENTS,1.IlODORIYEHYD5Y5TCM-1.'0_-CIl-l'1l01.'N,0CI1-IOloJ.rEE"",TERCONTRO!.lED'cllCtR0,-1-,10......:;."FEEownER,VS,"[c.r'lCRC11-40\,.CONTROLROODRIVE"">1)SYSO(S'<>"sorcCll-"O\O6.PROCCS5C-"'-'PUTUSYSIN°'JT\)V1T(fI'REQUIReMENTS-C':'RC"7-"'1')7.*a.lOGICSWOOL5Ml-1030ceoC51-le',"\0.REAcro.'EO__*_C71-1H.I.SY'Y'LS_.A41-IOH;_ji'-.C:>HT<O..------0""*,."-""'Fel',*1,",'_II"'";01'1*-<11"'11,1'Il*,r,"1-.]2,'1XII';,*GI'.11"FU2*o"l.\1""AGl'.1',Ci:"*"".x".f\[IIt.'*1.00.15+0.35-0.150.4+0.1-0.41.5'0.57.3*1.0IIIIt.O*1.0I,+0.1I.,-0.4I1.t+0.1J;;'-0.4I,._--III5.0*1.57*,e.cIIIIAYAIL-'8lLIWIGi[All.IU5TMEII1"lSEClKI51ROO&LEeTEDMD\lRIVIUO0.4+/-G.29.0+a.,-0.1COl'll.WlTMllllAWCON1l!CILOlIllATIGN+1.50+0.15-O.GO7.3*0.5t.l.0.11.3+Q.2-o.Q0*.,*0.151.5.0.2CQIfI1NLOlUS1_IITCCl'lT"OllI)I,IIIATlOfl+5.05.8i1.3+0.1-0.0POWERAVAILABLEIIIISELEC1'EOROD"",nSELECT(""'"-'"WITK.JRAW'""'"PERMISSIvEPERMISSlVE!'£RMISSlVESHa,He5H3.HIOUT,NO"TCHCWERRICESW)l"MOSt,lYeWHEN11'11RMS"I1ORI""SWITCH)15&IVEWHEN3\oIITtH'>$l"lERVALFRCtlCONTROLTOROOIIITHDllAlfCOl'ITIlOlIlOOWlTMllllAlfCQOlTRGlTIl<<:OEU.YTGUIllAT'"<;QlIT1lOLS£nLECOflTROLtt:nu:CQN1lII:ILS£UCTINSERYCONTllGI.CNGTCIl1M)SElECTWlTKlllAW*CONTllGl.lNG,,,,GIlTITlIO£OELATYGIlI)IlIN!I(lITCGMTIilILSIGNALRMSCF!SELECTCONTRGL(<;QlITINUllUSOf,IT]5wlTCHlliGOVERLAPINSeRTCONTROl""-'SETTLEWl<TROLIIIIf.--FOSITlONIINl=ORM.....TlON--.l5VSIEMIIIA"eROTaf'.(NoNROO)1.OIBLPo34lNLATO-lCONTFO..,IJ:l(DWITHDR/lo.WCCNTROL--"'mECON'----.R:DINa:RTCCNTRO\..SETTLECQN.TROl..----P0'5IT10l>lINDICATORODD-10,1().SWITCHESRODROODRll'T'ALARMDRIFT(I-",k"(.....YROD)CIBC,7PO&ITIOI.JIlJOlCATQR_.DISCONN"CTSWITCHIIIIIIIIIII__J---POSITlOtJIt-lDlCATOR"",EVEN-t-lQ.SWlTl;HE:Sl200TIO:NUNIT:'(10SIT'S)[1806nlillJ[18'17'l-RODGROUPlPRMS,GNAL.AND(ONto<.OLRODPOSITIONDISPU\YSELECTPI">RODSELECTED(ONLYONEROI))PSCRMl551VEWHEl>I"'ELECTEDRODENI'IBL£D,-IJPOSITIOt-lIl.lOlCATORBACK:\EATSWlreH(FULLOUT)WHOLECORIOlPl?MTRIPAi'lOC.Ot-lTRO,_ROOST,HUSO,SPUIY,ru:l:"'iI-I'"l'1]CIB01"'a/Ilr'0-:II'){'6"TYPI:LtI..VIIt\'!:!J.I!!JUPT04-KOD5t,"II'l.PRi'1'1I'lYRM'/,tt18YPAS5IIBVPASSIROO'A/IIII1II,__1'__,l(uNTROlIWOIIIIIIPOSITltlNII.I.IIr-L....L---,TYPICALFORIIILPk'MSIGNIILIUPTO'l-I'!0DSIlfVRMU'£RSIIILJIIT'(P\CAL!'"D'SC'P111I'"LPRMSII_____L_r---i--,IIIIIIIILCONTROLRODl=I()!QlTlONlNOK.ATORPR:lBE(TVPFORRCO)(ReF5\I),--lieteeROOSRODSllJINCli.ACH.B9-Ib-6I.8').:;,Hb*81.CS,E9.JIl8',C7,£9SI-l5*82JII..IP051TlmJllJl)lCATORINroERTEDISWIrCHE3L--I-'--..RPISNEXTROO-t--r-"'"'cow""'-\\I'---1Sf<1,ClarcLOCK-----,IL.._,_---lRPl5SCANAPED-CII-004(1)Issue8Rev8I-t--II:II,1---1,IIIIIIIL'E--1RPISIOP!SMALFUNCTIONSI-ra'OISH4-F,\f8TABLE1:FUNCTIONSOFCONTROLROOTIMING 6/89Sheet2Revision7RodDriveSystemFigure7.7-2,FCD,ControlHydraulicDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORT-"5O....ENOIDISDE-ENERGIZED[iVt'J,'-cIDI5C.H\OL*I5ClLATIONVALVE(A,CSO!JRMlffi\IEWHEN5CLENOIDISENERGIZEDRMSCRSOLENOIDENERC:>IZEDFOOBo',LOCAL2.POSlTIaNSWITCH'ISOLATENORMALMAINTAINEOCONTACTTESTIN'loc:t.ATE'F051TION[FOOS-B]DISCH"0..ISOLATIONVALVE(AC5CL\(IN,ERT)czRM1SSlII£SOLENOIDIS""""""'"0BOTHDIRECTIONS=,wIN'OPEN'IN'CLOSE'FOSITIONFOSITIONCROM'Ix!*,P8'lMIS$IVE"==EI'CTWHEN'h'LVENOTFULLYOPENJ=ULLyCLOSEO,UM'"!IPERMI5$IVE:IFPERMISSIVEI\(WHeNVALVEIS{OPeN'l'OI'<<:lUESNWHENVALVE:NeT",,{Fl.LLYCLOSEDINOPEN01INCLOSEISF=ULLYOPEN'0;;ON=eN",wIVAL-Vii:.,P'_V"1II<>'ENIc=eIA..c.RE\lER54NGMOTOR"!>TARTER42*_...FOC;;;-D]DI§CH\Q..ISCLATIONVAL\IE(A.c.SOL)WHENSOLI:NC"l>1$$NERGI'l-ED)l<EF.IZS/olurMISSIIJEWHENSOLENOIDISENERGIZED)!!StASlLIZE;RSTA8lUZEFl)VI'loLVEw..V"'"-.VESEL(SWIN.....*)("!>WIN'B'!OOSlTlONPOSITION'M',RM8xIIjVALVE()PENII';O'-"NOIDOPeNI[W:f<GIZEDWliENENERGIZE:DF007A-IIU>C"-LOC"'-I<.:.\</<;),>j'),/R.,"-"I,"'I:'NOFAIR":1,'1":"FOil_A1-),,'tL__","",;;:C".L==--J[FOil.8]DISCH\/OWMEC'R>\INVf>L\lEBIt<SERIESkilT/{FoIO-,{JLFOII-BiN;c.f'RIESWlnl,L"N/-A]DISCHARGE'vOLUMEVENT&DRAINVALVESREFI(5HO'NNFORCONDITION)TO01>lE"P,"OTSU"REF.IVN.-VESELSNIN"S"N/I'-"'JI./Nli)lFERMISSlvEBUSISNOTENER(;lZEO(Wlllit.'",AW)REFlREACTORPROTsysrl;MTRI,'R£F.10"B"DUWYGJ1ED!'JDTESLTHIS"";,=,,"'"--",,,-T--S,,<10-z*.'""",',,-,rr1>>..J"'-'"_ClF,/"-'--'"ANDu'l>A'N15TY,",-A.LFDR'F'A'.IIf'CJOTESTSWPERMISSlYEWHENNORMA.Ll>WITCHQ'lALT,.R/'IAT5RODII'{:rECT!ON(,.,I>I)VIl.I.Wf.INITIIITE.£>MDIl/erEc.TlOf{VALve1:"mATo.'",mo,"sou#o,.WUEHPlLDTWifE/(WNENPILOTSOLENOIDI:>VI/LVE501..£#011)ISSot.E1fOIn/5VALVEDf.:EHliRt:;,IZ-EDSV-/Bt.3LoCAL.IDELOC.ALAJ.I!ililLATEROPINT,\LTE8!1!lTERollIN.",,,WCR,,STABILIZERVA.L.veSWIN'B"P051TKlNRMSXSCRAMV....LVEPILOTAIRHEADERpaNOlaLCIU>I...11.'>VDCREFIDRIVEWATERN'tOII'LOCAL.VALVEsa...S,WIN'A."",",T"""lS5IVESOLENOIDWHENPlLOTWHEN''",,"Y=.,----1"",""",0.t:E-ENERl:.IZEDrFIIOBLOCAl..ENERGIZEDFORSETPOINTseEREF5REFINSTRUWENTAIRYUMY"'-VENOTF\JLLYO"eNDRIVEWATEl'lPUMP'l&:soc..liON!..OWFRESSP0011'.UXA.L.FERMI5SlveWH'"SOl.8"K)IDIS....RG2EO(SHOWNFC:il"l.SCRAMCONDITION)CHAAGING>WA_HIGI-IPRESSCRvUMVALVE.NOTFULLY""""0TvPFCRCRDHVQ5YQMO"003iFoOS"SOLENOIDP.ILOTVALVEFIIOALOCAl..B/>CK-L.f'SCRAMVAL\IE(D.C.GOL)PERMISSIVEWf.,lENSOLENOIDf(;CE-e>ERG"'"VALVENOTFULL'"o::llveWATERFILTERHIGHOFF"PRESSfo'b\LOCAL'M,'I.\T'-'i"UM"C)l)J"I'JNooIS)115voc,,RCR,,OSCHVOLUoIENOTc:R./lolNED13FLVALveNO'"'-<.LyCLoseoLIMCNPiPFORFLOWCONTVAl.VESAOF002AIFooeBElOTHDIRECTIONSCO'<TROL&N"""""'-&NCRlVEWATERIN'START"IN"SJ(p"POSITIONICNlDNPReSS"""CROMOXos"""'-NODIA':f"",CRROCR,,,,STARTI,=IAIRCIRCUITBREAKER".CONTROLRODDRIVESCRAMFUNCTIONIssue9Rev9REAC1(ll(PROTS\'STfMTRIPREI""10SY',TFM"A"TL-F3J\RM',FFERMISSIVE"'CEN<>OPERMISSI'JESOU;;:NOIDPERIIo'ilS51VEWHEN}MEN"COTWHEN5Cll.SNOIOISv.......)JESOLENOIDISVALVEsa...eNOID\SENERGIZEO:<;l-117l.OCJ>LENERGIZEDSOL-liBu=.OE-""""'=OPIlOT&.RAMVI>J...YEPILOTOCRAMVAL\iE(A.C.SOL)(A..CSOL)'OPEN,,CRI;ROPERATEDV"'-l;"iIIIItOPENONlOGSOFPOSITIONP05ITICNOFENONlOS'SOFAIRSWITCH..WITCHAIRCV-127LOCAl.:'1-12&LOCAL.L,a9AC<.::UMULATORDETECTORLn,"}.9I..OC.AL,IL1--IFERMIS51VEWHENINORMALSNITCHONIAPED-Cll-004(2),0,'>"""'<::L'MULATORlOWDETECTOR.I,,(AjCR'T'tlCCUMULA'lQRn:oJBLE.INDlCATIONSREF.IACCUi><lL'l..ATQRTROUe.lEINOIC....TlCNS(l>PEACHACCUMULATOR),_J-ISCH'/'!{)T (ROO""OVE!'4NTe;ct.lTR:l\.&N)FERM'S!;IVl!'o'<l-ENF'lOD'...S....1'CHiSON_.*X{ROOMOVEMCONTMlSWIPERM,.\$IVEWHENRooOUTNOTCHSW'TCH15NOrONeM'<a.EcTB"DaD5CG<TL'O-.SH'-Ell,*"J::(flnooVTNClTtl-IO\IERRiOESWIPlORMi"'",,"EWHENEMEROONCVROOiNSW,TCH15!'OTON",,",5",HiD(TIMERTPiiTSN'TCHlFe'lMiSStVl:i.wHEN""-SET"'WiTCHLSNOT"",TrMe;,MAJ,..Fl.NCT'ON(H.04SELB:.TED;;,:;0ENASLEDENERGYCENTER&POWERCOMPANYANALYSISREPORTDUANEARNOLDIOWAELECTRICLIGHTUPDATEDFINALSAFETYAPED-Cll-4(3)-4Rev6CRDHydraulicSystem-FCDFigure7.7-2,Sheet3Revision1-6/83 (1000OUTN::l"rCH<).I'eRIDESW)FEl<M'>;"'V""wr<EN,*,NI:.VIO:XlINSNiTCH,CNRMS.FIXlM<).IEMENT&H)WHiiN--R(DINSWITCH,ISONOM"'ERTCONTROLMIJL_r_JSI-lI'TA6Lt:1"CR,..--f£J,NOHHOVHRRIOE)(51!1,e'lCON-TR::lLSWIPERMISSIVEWHeNROOCUTNQTt;HSWIlU-l'SONI""'"(ReOOOTNOTCH0VE1'lR1Cl;sw)PERM'SSIVEWHeNNaTc.HOVERRIOESWITCHISONWNT!NUOUSWMTF'l.OLO.O';,",BSIiOD"5H3,(5(I<oDa.rrNOTCHoyERRLDE;;Wl-!!iN5Iv\Ef;!.GENCYROO,'"5WITCl-l"'crTON(,846CENTERPOWERCOMPANYANALYSISREPORTDUANEARNOLDENERGYIOWAELECTRICLIGHT&UPDATEDFINALSAFETYCONTROLAPED-Cll-4(4)-4Rev6CRDHydraulicSystemFCDFigure7.7-2,Sheet4Revision1-6/83 ,.("'FUELMODE""1&9il,H3SH3,1<.4GlTiONINDIC.ATOR""""(INSERTS'NnCHES\jew>NNEI..6PERMISSIve)WHEN""-I..I:IXlSAREIN(REACTORS'iSMODESW)PERMISSIVEI'lEFUEI.SNITO-lISCNRMSXREF.IvCI-lANNEl..6FlERJELNlOOEJ-ONERODCC!t'>lTRQLB"",H59-\3-HI,HS,51-1(;,FE,K'ISV'SMODEsw}PERMI$SIVEWHENSTART-uPORRlN$WITCH)5CN\RMSXREEIDCHANNELA."EFUELMODE"""'"ISR/RMISSIVEFOSITIONINDIC.Al'OR""""(INSERTSWrrC.HES)(ReK."TCRSV5MOOEawlR;:RMISSlve'M-ENREFlS..$WITCHISONRMSXREF:10CHANNEl.ARE!=LEI.f\hJOEONEROOCONT"O..B:'I,F(2,H3(FlEAC.Ta=IS'I'SM:Xl6.SW)F*RM1S$l\lEWHeNSTART*uPOR.RUNSWITCI-I15ONI,WlSXDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTxPEF<MISS1Vl:WHENSCRAMDI$CHARGVOLUMEHIG"TO<IP-ISNOTB\'PA5E-DRM'REF.10__I-,_:-cj,_",-"C.,--5H3-05ANNUNCIATINGSH4"BIRODROOou,BLOCK(,IID50xPERNlISSIVER'EF.IQI"cl,\"S;;IVEWileN.sCRAMOISCHA.RgEVOLUMEWATERLEva15LOWl<>13ELOCHREFI"AC,'---5-13*05ANNUNI.IHINGRODGLOCKlONHiQl_PERMISS,vEOl5CHI\i<GEVOLUMEHIGHUVE:'_TRIP13NurBYPA5SEDRM'DISCHARGEVOLUMEWAHf-I.LEVELRODBl'OCKClIDOIl<MCli.}nCII-2f-{+,<"Ji)PEFIMISsIVIiWHEI'I$"I!AMWJ'lTpt<owIREFREF.1000(REACTORS>lSMOOESW)PERMI&O\IE'M-IENRLNSWITCHI'"ONIPMbXI<EF"RMSPEf'lMIS5I\lEWHEN.sER>lICEt-lOIS1"NOTFlELlD"OEtl"""',"""'".1(ReACTOR5'(5MODESW)WilENSHUTDOWN,R£fUE'.01,RUNSW,ISON,;,YO5W)LORSTA,RT-UP-,w1-,nNREF"",(RePCOOR5'<'5MODESWIFERMlSliI>..E.WHENhl..NSWITCHISONREF"AA,FCD,ControlRodDriveHydraulicSystemFigure7.7-2,Sheet5APED-CII-004(5)Rev7Revision76/89 Il.NNEI".&1/,/HS'lAU....coE.AREINSHlol-l'"""'"AV/Io,ILAElLSII1CI-I.GtNNI'iLA/F'iR'Jol!>61Vl{WHliNWl-laNAll.MO...Nl"eOI-ClI&'TROOliIIN1StU,HI."""'"liNRliFIJl!I..__LL(PLATFORMI!RltGEI'"NO"!'OVERo:::Al!!!ARE/'I,!Mo.N"TE)I1<l16'TC£NT'IO-ILOCALIDUANEARNOLDENERGYCENTERIESUTILITIESUPDATEDFINALSAFETYANALYSISREPORTRMl:\SIWWi-E'JReFUB."""--RMSXREF.10XI<EF:10...""'"Pl!RMllO&lV.'M-lIiNsr-r*uPfMlli>ON'M'R..A.Tl"CIRM'5--"""_............"""!lI'E1'(XlQ:lNno.tI>l'>I!llMlf>6IV1:(F;IliJtCl'ORl!NSfVlOCEPERMI$SIVIl'M-lEN!>HUT.RMGXREF10"""-"L'NW""'.CRDHYDRAULICSYSTEM-FCDFIGURE7,7-2SH.6APED-CI1-12H214<6>REV.7REVISION16-11/01 p,IPERMISSIVEWHENAlJl(ILIAIlYSIGNAL.::RESENT5H5,JZ"J:"'"RWMRODINSeRTPERMISSIVEECHOseLec.,EO000ENAElL.EDPERMISSIVEjIRwM'NS"-RTISHO,EIICD"lTRDLSH4,E8,F12..JISHI,E2,_1._,III'"0'"IFOSITIONISWITCHESISHI,AZL__.JREF7POSITIONOFSELECTEDORSCANNEDCDNTROLROOPRWMR'<OCoRAM?'NSEOT"",,""Cy:.:R/<.IlISSIYE.ELlf---------,!IIIRWMPRXoRAMCONTROLPERMISSIVEjCONTROLF<ODPOSITIONWWF'l=RMLSSIVEe'U;[lllS2.RwMROOWITHDRAWPEI'<MIS5I'vEECHORMSXI.,RvvMWITHDRAW16H5'BIOI=,,"T{INIERLOCKPERMISSIVERWMPROGRAMPQWNtl,W'l0INit.NGAGEDE:llli\WNISEQUeNCESeLECT'PBI'ERMISSIV<WHENSHUTDoWNMARGINSfLEcr,;WITCHONI"'SHUTDOWNMARGINSELECTe,OWM_AMKSEQUENCE'S'c"""'"_---,'_O_....JRWMBYPIISSPERMISSIVE<;WHEN.......WHENi'lYPA';S)R5','IITC",.:;0',PRESENT7PM';X03.,IRWMSEQUENCESELECTI'BI-'"RMISSIVEWHEN,EQU"NCE"B"SELI:crSWITcHONPI>CR&ROOPATTERN'2EQUENCE:"S"SELECTC\1I48,,'"CUTRjT)..,/-§7'"1--------,III'dEEQiJENCE"CR""p,,""A'RWMSEQUENCESELoCTSOLfC,TPBICRSEQUENCE;0;SELECTCW4-7J"OQI(RIROOGROUPlOENTIFICATIONN-NPERMISSIVEWHENAL!XILIARVSIGNALISNOTREFJLSFEEDWA,TERCONTROLSV5TEMLOWFOIN'ERLEVELALARM('9'04-,SEQUENCESt-lUT()()';\Jl\l7I"S*I-------p,MAR:.INE4,E",E8,E",CRCR.H7,HIO,HI3b".,RWMPRJGRAM..M7K)4---,-----'----,--------------'-,,--(EoRR"lRE12.PERMISSIVEPERMISSIVESEQJENCE'"ERROR/"-'"R,*REF:3Gf-"---jjIII(STEAMFLOWMORE.THAN"LARMSETTINGJ8,JII,J14FEEDWA,TEI:lFLOWMORETH/>NTRIPSETTINC.*STEAMP\..OWMORE:THANTRIP$TTINC.AREF]Fe;:EDWA,TER+L----isYSTEMLOWPOWERLEVELINTEFllOCI<.(1,5HT,HIO,HI3,,_--@BUFFERFAJLiS<E,,COMFUT"ERDC,AVAlLAeLEFORINPUT/OUTPUTelMS_MINPuT/OUTP\JT""',,",,o"_"""."'I\LRWf,,',2YPA,SP""M".'31'i'O,>Qf<'IALSWITCH15ONEll>,IMPR.ov"MfiNT-t/oTDJI£"-I_MWrTHC!RA,WCON'TI':lOLN:lTPERMISSIVE,o,,CRHoDE"...15.......pal>_"",,_""'DMoV/iJ"EJ{r-RM._"£so;.'""'OnE_"'''''SW.30"t""_.o<..LS""'.p",,,,_5Eu,e......."CSUJa.IC;GROUPCON7ROL------>BLooX-----..-----.M'*",/B"S*(}.UE"UHeTFull"A","'./lSyp"sS""--0cR'8"II""BY""'S"l>--0<-""WITHCA<>WERRORCOOR"DlNATE:X'1.-'i'iJ"ClQCRII"ISERTERRORNOINATEX)(-WJ"ooCR.INSERTNOZCOORDI"NATEXX-yyJ60QDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDATEDFINALSAFETYANALYSISREPORTFCD,ControlRodDriveHydraulicSystemFigure7.7-2,Sheet7APED-CII-004(7)Issue7Rev7Revision76/89

tUFSAR/DAEC-1-tPREr:S,,-._...1--_--.INITIALPRESSUREREGULATORTURBINEBYPASSVALVESTURBINEGEN.TYPICALFOREACHLOOPM-INDUCTIONMOTORG-ACGENERATORC-ADJUSTABLESPEEDCOUPLINGRECIRCULATIONFLOWCONTROLCOMPONENTSDUANEARNOLDENERGYCENTERIOWAELECTRICLIGHT&POWERCOMPANYUPDAtEDFINALSAFETYANALYSISREPORTRecirculationFlowControlIllustrationFigure7.7-6Revision7-6/89}}