ML090340728

Final Safety Analysis Report, Amendment 92, Sections 9.4, Air Conditioning, Heating, Cooling, and Ventilation Systems - 9.5.8 Diesel Generator Combustion Air Intake & Exhaust System

ML090340728
Person / Time
Site:	Watts Bar
Issue date:	12/18/2008
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
References
Download: ML090340728 (380)

Text

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

.1 Control Room Area Ventilation System

.1.1 Design Bases The Control Building heating, ventilating, air-conditioning, and air cleanup systems are designed to maintain temperature and humidity conditions throughout the building for the protection, operation, and maintenance and testing of plant controls, and for the safe, uninterrupted occupancy of the main control room habitability system (MCRHS) area during an accident and the subsequent recovery period. Refer to Section 6.4 for further information regarding control room habitability and definition of MCRHS area.

The main control room habitability zone (MCRHZ) is designed to maintain a positive pressure relative to the outdoors and to the adjacent areas at all times, except during a tornado warning, to minimize air inleakage.

The Control Building air-conditioned equipment areas and normally occupied personnel spaces are maintained in the range of 60°F minimum to 104°F maximum temperature during all modes of operation. The main control room (MCR) temperature and humidity controls are set at 75°F and 50% relative humidity, respectively, for comfort of the operators and protection of instruments during normal operation.

The Control Building outside air intakes are provided with radiation monitors, and smoke detectors. Indicators are provided with the radiation monitors. MCR common annunciation is provided. Isolation of the MCRHZ occurs automatically upon the actuation of a safety injection signal from either unit or upon indication of high radiation, or smoke concentrations in the outside air supply stream to the building. The Control Building HVAC outside air intakes can also be isolated by closing the tornado dampers.

The tornado dampers are closed manually from the MCR during a tornado warning to protect the Control Building from tornado depressurization effects.

Upon receipt of a signal for MCRHS area isolation, Control Room Isolation (CRI), the following conditions are automatically implemented:

(1) The Control Building emergency air cleanup fans operate to recirculate a portion of the MCRHS area air-conditioning system return air through the cleanup trains composed of HEPA filters and charcoal adsorbers.

(2) The Control Building emergency pressurizing air supply fan operates to supply a reduced stream of outside air to the MCR air-conditioning system to maintain the MCRHZ pressurized relative to outside and the adjacent areas.

This fresh air is routed through the emergency air cleanup trains.

(3) The control room electrical board rooms (ERB) air handling units continue to draw outside air to maintain the lower floor spaces at atmospheric pressure.

(4) The exhaust fan in the toilet rooms is stopped, and double isolation dampers are closed.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-1

(5) The spreading room supply and exhaust fans are stopped and the operating battery room exhaust fan continues to run.

(6) Double isolation dampers in the spreading room supply duct and isolation dampers in the exhaust duct close.

(7) The Auxiliary Building elevation 757 shutdown board rooms pressurizing air supply fans are automatically de-energized.

(8) Double isolation valves close to isolate the normal pressurizing supply to the MCRHZ.

MCRHZ isolation may be accomplished manually at any time by the control room operators.

The following building air-conditioning and ventilating system components are each provided with two 100% capacity units. Each meets the single failure criterion, and automatic switchover is assured if one of the units fails. These systems include the:

(1) MCR air-conditioning system, water chillers, air handling units, and piping.

(2) Control Building emergency air cleanup supply fans and filter assemblies.

(3) Control Building emergency pressurizing air supply fans.

The EBR air conditioning system is provided with two 100% capacity package water chillers and four 50% capacity air handling units with associated piping, valves, and controls. This system meets the single failure criterion, and automatic switchover is assured if one of the components fails.

Double isolation dampers are provided in the exhaust ducts from the toilet and locker rooms exhaust fan at elevation 755 to the outdoors, in the normal pressurizing fresh air supply duct to the MCR, and in the supply duct from the spreading room supply fan.

Two existing isolation valves, O-FCV-31-36 and O-FCV-31-37, in the fresh air supply duct to the spreading room remain closed and the outlet is blanked off.

Fresh air for control room emergency pressurizing is taken from the outdoors from either of two intakes. One is the emergency air intake, located on the east end of the Control Building roof at elevation 775 and the other is connected to the fresh air intake on the roof at the west end of the Control Building. Both intakes are isolated during a tornado warning.

All essential air-conditioning equipment, ventilating equipment, isolation dampers, and ducts are designed to withstand the safe shutdown earthquake (SSE). Nonessential components are seismically designed to the extent that they will not affect system operation if they should fail due to a seismic event. All air-conditioning and essential ventilating equipment are protected from the effects of a design basis tornado (Section 3.3.2), by isolation dampers located at all external openings to the Control Building. A AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

concrete hood located over the air intake provides additional protection from the effects of tornado generated missiles.

All air conditioning equipment necessary to ensure main control room habitability in the event of a flood is located in the Auxiliary and Control Buildings at elevations where the equipment remains functional during flooding up to the design basis flood elevation. The EBR air conditioning system is not required during a flood.

Piping which could be a source of pipe whip (i.e., high energy lines) does not pass through areas containing essential control building air conditioning or air cleanup equipment. The equipment is also separated from and protected from potential sources of missiles and jet impingement which could adversely affect operation of the system.

System and component quality group classification for the Control Building heating, ventilating, air conditioning and air cleanup systems is commensurate with the importance to safety of the function performed by the systems. For further discussion of quality group classification refer to Section 3.2.2.

.1.2 System Description The Control Building heating, ventilating, air-conditioning, and air cleanup systems are shown on Figures 9.4-1, 9.4-2, and 9.4-3 and the logic and control on Figures 9.4-4, 9.4-4a, 9.4-5, 9.4-6, 9.4-7, 9.4-9, and 9.4-10 and consist of the following systems:

(1) Main control room air-conditioning system (2) Electrical board room air-conditioning system.

(3) Control Building emergency air cleanup system.

(4) Control Building emergency pressurizing system.

(5) Battery room ventilating system.

(6) Miscellaneous ventilating systems.

The MCR air-conditioning system water chillers are located in the Auxiliary Building at elevation 737.0. The associated air handling units are located in the Control Building in the mechanical equipment room at elevation 755.0. The area served by this system includes the MCR, the relay room, the DPSO engineers shop, Control Building offices, the technical support center (TSC), conference rooms, kitchen, toilets, locker rooms, and the mechanical equipment room at elevation 755.0.

The EBR air-conditioning system water chillers are located in the Control Building in the east mechanical equipment room at elevation 692.0. The associated air handling units are located in the west mechanical equipment room at elevation 692.0. Rooms served by this system include the battery board rooms, battery rooms, battery room exhaust fan room, the communications room, the secondary alarm station at elevation 692.0, and the computer and auxiliary instrument rooms at elevation 708.0.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-3

The communications room located on elevation 692.0 has two nonsafety-related air conditioning units to supplement the electric board room air conditioning system. The units receive cooling water from the raw service water system. The units are provided with local controls.

The MCR air conditioning system is provided with two 100% capacity package water chillers, two 100% capacity fan-coil type air handling units, and associated pumps, piping, ductwork, and controls.

The EBR air conditioning system is provided with two 100% capacity package water chillers, four 50% capacity fan-coil type air handling units, and associated pumps, piping, ductwork, and controls.

Approximately 36,000 cfm of conditioned air is supplied by either of the MCR air handling units to the MCR, and other rooms on elevation 755.0. Fresh air is drawn in from the air intake to replace that mechanically exhausted to the outdoors plus makeup for leakage in order to pressurize the MCRHZ.

Approximately 36,400 cfm of conditioned air is supplied by either set of EBR air handling units to the rooms on elevation 692.0 and elevation 708.0. Fresh air is drawn in by the air handling units to replace that mechanically exhausted to the outdoors to maintain atmospheric pressure at these floors.

During normal and CRI operating modes, all air, fresh and recirculated, is filtered by passing through an air handling unit containing a bank of filters. Filters associated with an inactive air handling unit are available for servicing.

During normal operations, all fresh air supplied to the air conditioning systems is maintained above 60°F by a thermostatically controlled duct heater. Additional electric heaters are located in air supply ducts serving the battery board rooms at elevation 692.0; the auxiliary instrument and computer rooms at elevation 708.0; and the relay room, TSC, Control Building offices, conference rooms, toilets, locker room and kitchen at elevation 755.0. The above heaters are each thermostatically controlled to maintain room design conditions.

During normal operation, air is exhausted from the Control Building by the toilet and locker room exhaust fan, a spreading room exhaust fan, and a battery room exhaust fan. The spreading room supply fan transfers air from the mechanical equipment room on Elevation 755.0 to the spreading room. The makeup air and pressurizing air is drawn into the Control Building by the operating MCR and EBR air handling units. The air supply quantity is manually preadjusted by balancing dampers, as required, to maintain a minimum 1/8-inch positive static pressure in the main control room and atmospheric pressure in the remainder of the building, except the spreading room which is manually preset at a slight negative pressure relative to outdoors.

During accident conditions, double isolation valves automatically close to terminate the normal supply of fresh air to the MCRHZ. The EBR air handling units continue to draw a measured quantity of outside air to maintain the lower floors at approximately atmospheric pressure.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

In the event of a single active failure which causes the MCRHZ pressure to drop below 1/8-inch water gage positive pressure, any of the four differential pressure indicating switches activate an alarm in the MCR. The control room operator provides corrective action in the normal operating mode and has the option of starting the standby air handling unit. If there is a single failure during the isolation mode, the differential pressure switches automatically start the standby emergency pressurizing fan and its associated air cleanup unit to maintain the pressure in the MCRHZ. The switches also activate an alarm in the MCR.

The Control Building emergency air cleanup system is located within the mechanical equipment room at elevation 755. This system is provided with two 100% capacity emergency air cleanup fans, and two 100% capacity air cleanup filter assemblies arranged in two parallel 100% capacity fan-filter trains. Refer to Section 6.5 for further information related to the emergency air cleanup units.

The emergency air cleanup system automatically operates upon an accident signal or upon indication of high radiation or smoke concentrations in the building fresh air supply. This system can also be manually started from the MCR at any time. During an accident, both of the emergency air cleanup supply fans are started. Controls are provided to permit the control room operators to shut down either one of the air cleanup units and to keep it as a backup. The backup unit automatically starts in the event the operating unit fails.

During air cleanup system operation, a portion of the MCR air conditioning system return air is continuously routed through one or both of the air cleanup units and then to the system return air plenum. The cleaned air is thus recirculated to the MCR by the air-conditioning system. The system may be manually operated from the MCR at any time as required for periodic testing in accordance with the technical specifications filter testing program.

The Control Building emergency air cleanup fans are ESF equipment and are connected to separate divisions of the emergency power system.

The MCRHZ is pressurized with cleaned outdoor air during operation of the control room emergency air cleanup system. The minimum positive 1/8-inch positive pressure of the MCRHS area relative to the outdoors and adjoining spaces minimizes the inleakage of unprocessed air during the emergency mode. Section 6.4.3 discusses the three modes of system operation. The control room emergency pressurization system is provided with two 100% capacity emergency pressurizing air supply fans located within the mechanical equipment room elevation 755. The fresh or pressurizing air is taken from either of two air intakes, one from the Control Building roof at Elevation 775 near the east end of the building and the other from the fresh air intake at the west end of the building. Each fan is duct-connected to an intake hood to provide two separate 100% capacity air supply systems. Air from each emergency intake is ducted to the associated emergency pressurizing fan. A cross-connection is provided just upstream of the fans (refer to Figure 9.4-1) which allows either emergency pressurization fan to draw air from either emergency air intake if necessary. The manual damper in the cross connection is normally in the locked closed position. The damper, which is CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-5

accessible from within the habitability area, is opened only if one of the emergency pressurizing fans has failed and contamination of the air intake associated with the non-failed fan is great enough to require air to be drawn from the other emergency intake. Determination of contamination level is discussed in Section 6.4.3.

Emergency pressurization air supply discharges to the control room air-conditioning system return air upstream of the air cleanup filter assembly trains. The emergency pressurizing fans are the vaneaxial type with a capacity to deliver 711 cfm. These fans (one redundant) are ESF equipment and are connected to separate divisions of the emergency power system.

Both emergency pressurizing fans are started by the same accident signal that starts the air cleanup units. The capability is provided to place either of the operating air cleanup units and the associated emergency pressurizing fans in the standby mode.

The standby components start automatically in the event of a failure of the operating air cleanup unit or its emergency pressurizing fan.

The battery rooms ventilation system consists of two 100% capacity and one reduced capacity exhaust fans. The fans are located on the elevation 692.0 floor with the two 100% capacity fans located near the west end of the building and the other fan located in the east mechanical equipment room.

Fire dampers provided in each room's air exhaust duct and air supply opening operate to isolate the room upon high temperature due to fire.

The battery room ventilation system is required to operate at all times except during the design basis flood and during a 72-hour period following a fire. A standby fan automatically starts upon failure of the operating fan to produce airflow. The battery room fans are ESF equipment and are connected to the emergency power system.

The reduced capacity exhaust fan C-B is normally unpowered, but can be manually started if needed to control hydrogen in the battery rooms.

The spreading room is ventilated by one of two 100% capacity exhaust fans (one being on manual standby) located at the east end of the spreading room at elevation 729.0. One spreading room supply fan, located in the mechanical equipment room at elevation 755.0, supplies air from the mechanical equipment room. Because the spreading room is maintained at a slight negative pressure during normal operation, some air enters via leakage from the MCR and the electrical board room areas.

The spreading room supply and exhaust fans are nonsafety-related and are not connected to the emergency power system. During control room isolation, the spreading room fans are automatically shut off and isolation dampers closed.

The mechanical equipment room at elevation 755.0 is normally ventilated by the passage of air-conditioning system supply air from the system air handling unit.

The mechanical equipment room at elevation 692.0 is ventilated at all times with air supplied by the EBR air-conditioning system supply and with air drawn through the room to the air-conditioning return air duct.

AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

The kitchen, toilet, and locker rooms at elevation 755.0 are ventilated by exhausting a portion of the control room conditioned air through the rooms. The toilet and locker room exhaust fan is located in the elevation 755.0 mechanical equipment room and discharges directly to the outdoors.

The toilet and locker rooms exhaust fan is nonsafety-related and is not connected to the emergency power system. During control room isolation the toilet and locker room exhaust fan is automatically shut down, and double isolation dampers close.

Dampers used to isolate the MCR habitability area from the outside and from portions of the ventilation systems serving other areas of the Control Building are low leakage type dampers. They are heavy-duty dampers provided with resilient seals along the blade edges. These dampers close following detection of high levels of radiation, concentrations of smoke, or receipt of an isolation signal. Refer to Section 6.4 for further information regarding damper leakage.

.1.3 Safety Evaluation The Control Building air-conditioning systems are engineered safety features (ESF).

Each pair of full-capacity (one redundant) water chillers and each redundant set of air handling units are served from separate trains of the emergency power system and from coordinated separate loops of the ERCW. Upon loss of offsite power, emergency power to the main control room and electrical board room chiller packages is automatically reestablished in sequence by the diesel generator in accordance with FSAR Table 8.3-3. The failure modes and effects analysis presented in Table 9.4-7 verifies the capability of the system to maintain acceptable environmental conditions within the Control Building during any mode of system operation following any single active failure.

All MCR equipment operates normally at an ambient temperature of 75°F. Abnormal excursions of short duration (8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or less) to 104°F maximum and 60°F minimum may occur without adverse effects on the equipment. At sustained temperatures above 104°F or below 60°F, failure rates for control room equipment may tend to rise somewhat and some instrumentation inaccuracies may arise. The full-capacity air-conditioning system redundancy discussed above, however, reduces the probability of over-temperature operations to acceptably small values. Loss of ventilation problems are discussed further in Section 3.11.4.

The air cleanup equipment installed to purify air supplied to the MCR habitability zone during emergencies is classified as an ESF air cleanup system. Good general agreement with Regulatory Guide 1.52 standards for air cleanup equipment is achieved. Details on this compliance are given in Table 6.5-4.

Each of the Control Building emergency air cleanup units consists of a bank of HEPA filter cells and a bank of carbon absorber modules. Test connections and appropriate instrumentation are also provided for each air cleanup unit. For further details refer to Section 6.4.4.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-7

One Control Building air-conditioning system filter bank is provided on the air intake on each of the system air handling units. Each filter cell is rated for an initial resistance of 0.40 inch water gauge when clean, and filtering media should be replaced with new media upon an increase in resistance to 1.0 inch water gauge.

For discussions on radioactivity dose levels and detection of airborne contaminants, refer to Section 12.4 and 12.3.4.

Tornado dampers are provided to isolate the Control Building HVAC outside air intakes during a tornado warning. The isolation is provided upon damper closure during either normal system operation or Control Room Isolation. The loss of MCRHZ pressurization during this time will not result in contaminated air leaking into the MCRHZ since a LOCA is not postulated concurrent with a tornado.

The only heating, ventilating, and air conditioning required in the Control Building in the event of a flood above plant grade is for the elevation 755.0 rooms, including the MCR.

The equipment used for this function includes the MCR air handling units, and the duct heater in the Control Building air supply duct. This equipment is located in the mechanical equipment room at floor elevation 755 of the Control Building and is consequently unaffected by the design basis flood. The water chillers serving the main control room air handling units are located in the Auxiliary Building at floor elevation 737 and are functional for floods up to the design basis flood level. Refer to Section 2.4.14 for additional discussion of the plant flood protection plan.

.1.4 Tests and Inspection The Control Building air-conditioning systems are in continuous operation and are accessible for periodic inspection. The system is tested initially as part of the preoperational test program (Chapter 14.0). After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation.

The building emergency pressurizing air supply fans and air cleanup assemblies are tested periodically. Details of the testing program for the air cleanup units are included in Section 6.5.

Details of the radiation monitors are included in Section 11.4.

The battery rooms ventilating system is in continuous operation. The exhaust fans are accessible for periodic inspection.

The air-conditioning system filter cells have their filtering media replaced when high differential pressure is observed.

.2 Fuel Handling Area Ventilation System

.2.1 Design Bases The fuel handling area ventilation system, a subsystem of the Auxiliary Building ventilating system, serves the fuel-handling area at elevation 757, the penetration AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

rooms at elevation 757 and elevation 782, and the fuel, waste, and cask handling areas at elevation 729 and elevation 692.

The system is designed to: (1) maintain acceptable environmental conditions for personnel access, operation, inspection, maintenance, and testing, (2) protect mechanical and electrical equipment and controls, and (3) limit the release of radioactivity to the environment during all weather conditions. The environmental control system is designed to maintain building temperatures between 60°F minimum and 104°F maximum.

During accident conditions, the fuel handling area ventilation system is shut down and all environmental control is handled by the Auxiliary Building gas treatment system (ABGTS), described in Section 6.2.3.

All ductwork, dampers, and grilles of the fuel handling area ventilation system essential to operation of the ABGTS are designed to Seismic Category I and Safety Class 2b requirements. Each fan is provided with a primary circuit breaker and a shunt trip isolation switch which is tripped by a signal of the opposite train from that for the primary circuit breaker to ensure that power is isolated from the fan. All other system components, including exhaust fans and remaining ductwork and dampers, are designed to Seismic Category I(L) requirements.

To control airborne activity, ventilation air is supplied to clean areas, then routed to areas of progressively greater contamination potential. The fuel handling area is maintained at a slightly negative pressure to limit outleakage, and can be physically isolated from the outdoors in case of radiological contamination. To assure that the desired airflow is maintained under all conditions, the exhaust fans can be connected to an emergency power source.

Air utilized to ventilate the fuel handling area, waste packaging, and cask shipping area is exhausted through the fuel handling area exhaust fans. An exhaust duct system from the waste packaging area and cask loading area is connected to a duct system around the periphery of the spent fuel pit and fuel transfer canal. Thus, exhaust air from the fuel handling area passes across the spent fuel pit forming an air curtain across the pool.

Exhaust is provided by two 100% capacity fuel handling area exhaust fans. During normal operation one fan is in operation with the other on standby. Both fans discharge to the Auxiliary Building exhaust stack.

An inlet damper furnished with each fuel handling area exhaust fan is used to regulate the volume of air exhausted as required to maintain a 1/4 inch negative pressure within the building. These dampers are automatically operated by static pressure controllers.

During periods of high radiation in the fuel handling area or upon initiation of a containment isolation signal, or for high air temperature at the supply intake the Auxiliary Building supply and exhaust fans and the fuel handling exhaust fans are automatically stopped and low leakage dampers located in the ducts that penetrate the Auxiliary Building are closed. An isolation barrier is thus formed between the building CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-9

and the outdoor environment, and the Auxiliary Building gas treatment system is placed in service (see Section 6.2.3). The Auxiliary Building gas treatment system maintains the Auxiliary Building secondary containment enclosure less than a 1/4-inch water gauge negative pressure during these high radiation or accident periods. The two 100% capacity gas treatment system air cleanup trains are automatically energized. Such operations divert a reduced quantity of building air through the air cleanup units and discharge it into the Shield Building exhaust vent. This vent is located within the annulus space of the Reactor Building and extends to the top of the Reactor Building.

The fuel-handling area ventilation system is located completely within Seismic Category I structures and all safety-related components are fully protected from floods and tornado-missile damage.

.2.2 System Description The fuel-handling area ventilation system is shown on Figure 9.48, on logic Figures 9.49 and 9.4-10, and on control Figures 9.4-11 and 9.4-17.

The fuel-handling area is supplied with outdoor air from the Auxiliary Building general ventilation air supply and exhaust system, described in Section 9.4.3. All supply air is passed through filters having a nominal efficiency of 85% based on the NBS atmospheric dust spot test. It is then ducted to clean areas of the fuel-handling area from where it flows to areas of progressively greater contamination potential before being exhausted through a duct system by the exhaust fans. The fuel-handling area exhaust fans are rated to 60,000 ft3/min and these fans are capable of being connected to emergency power.

The cask decontamination area on elevation 729 is ventilated by a separate supply fan which circulate air through the area when the decontamination room is in use. This air flow assures an acceptable environment for motor reliability and preservation.

The supply fan provides 199 ft3/min of ventilation air from the fuel-handling area general spaces. Air from the decontamination room is exhausted to the fuel-handling area exhaust duct work by a 450 ft3/min exhaust fan. A moisture separator is located upstream of the exhaust fan to remove entrained water from the air stream.

.2.3 Safety Evaluation A fuel handling accident is detected by the two gamma radiation detectors mounted above the fuel pool, which are interconnected as shown in Figure 9.4-12. The high radiation signals via redundant trains will then shut off the fuel handling and Auxiliary Building general exhaust fans and start the ABGTS, as shown in Figures 9.4-9 and 9.4-10. To accomplish its safety function following a fuel handling accident, the fuel handling area ventilation system must accomplish the following functions:

(1) Isolate the normal ventilation pathways between the spent fuel pool and the environment.

0 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

(2) Filter the contaminants out of the air by the ABGTS before exhausting it to the environment.

The two redundant radiation monitors (safety-related) located above the spent fuel pit assure that the accident is promptly detected and that a high radiation signal is provided to each ventilation train, even if one monitor fails. In addition, the Auxiliary Building radiation monitor (non-safety related) which monitors the Auxiliary Building exhaust vent is also capable of providing a high radiation signal to the MCR.

A high radiation signal from either of the monitors located above the spent fuel pit causes the fuel handling area (FHA) and Auxiliary Building general exhaust fans to shut down and their associated dampers to close, as shown in Figures 9.4-9 and 9.4-10. Each of the two FHA exhaust fans have both train A and train B dampers, so failure of one train does not prevent isolation.

These two monitors also start the Auxiliary Building gas treatment system upon detection of a high radiation signal in the Auxiliary Building spent fuel pool area. See Section 6.2.3 for a further analysis of the ABGTS.

From the study of anticipated failure modes and the analysis of their associated effects, it has been determined that the safety-related portions of the system are capable of functioning in spite of the loss of any active component. See Tables 9.4-8, 9.4-8A, and 9.4-8B for a detailed failure modes and effects analysis (FMEA) on the Auxiliary Building (including fuel handling area) HVAC system.

The Auxiliary Building supply inlets are located near ground level on each side of the building. The inlet area is of sufficient size to limit the incoming air velocity to approximately 500 fpm.

During normal operation the fuel handling areas are continuously maintained at a slightly negative pressure relative to outdoors to minimize outleakage.

During periods of high radiation or upon initiation of a containment isolation signal, the Auxiliary Building secondary containment enclosure, which includes the fuel handling areas, is maintained at a nominal 1/4-inch water gauge negative pressure by the ABGTS. All releases to the environment during this time are through the air cleanup trains of the ABGTS. See Sections 9.4.3 and 6.2.3 for further information.

.2.4 Inspection and Testing The fuel handling area ventilation system is in continuous operation and is accessible for periodic inspection. The system is tested initially as part of the preoperational test program. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operational/functional integrity.

Details of the radiation monitors are included in Section 11.4.

See Section 6.2.3.4 for inspection and testing requirements for the ABGTS.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-11

.3 Auxiliary and Radwaste Area Ventilation System

.3.1 Design Bases The Auxiliary Building ventilating systems serve all areas of the Auxiliary Building including the fuel handling area (see Section 9.4.2) and the radwaste areas. Separate subsystems are utilized for the environmental control of the shutdown board rooms, auxiliary board rooms, and other miscellaneous rooms and laboratories. The ventilating systems also incorporate individual cubicle coolers to provide supplementary cooling to specific safety feature equipment.

The Auxiliary Building ventilating systems are designed to: (1) maintain acceptable environmental conditions for personnel access, operation, inspection, maintenance and testing, and for protection of mechanical and electrical equipment and controls, and (2) limit the release of radioactivity to the environment during all weather conditions.

The shutdown board, auxiliary control, and battery board rooms at elevation 757 and the auxiliary board and battery rooms at elevation 772 are cooled by mechanical refrigeration to maintain the room temperatures within the range for which the equipment is environmentally qualified, to ensure that equipment and components are not exposed to environmental conditions that could degrade the operability of safety-related equipment.

To control airborne activity, ventilation air is supplied to clean areas, then routed to areas of progressively greater contamination potential. Areas of the building which are subject to radioactive contamination are maintained at a slightly negative pressure to limit outleakage. In addition, the system has the capability of isolating the contaminated areas from the outdoors. All exhaust air is routed through a duct system, and is discharged past a radiation monitor and into the auxiliary building exhaust vent, except exhaust air from the shutdown board rooms, auxiliary control room, battery board rooms on elevation 757, and auxiliary board rooms, battery rooms, and transformer rooms on elevation 772.

Upon indication of high radiation in the fuel handling area of the Auxiliary Building, high temperature in the Auxiliary Building air intake(s), or upon an isolation signal from either reactor unit, the auxiliary building supply and exhaust fans are automatically stopped and low leakage dampers located in the ducts which penetrate the Auxiliary Building are closed to complete the isolation barrier. Two 100% capacity gas treatment system filter trains consisting of air heaters, prefilters, HEPA filters and carbon absorbers, are automatically energized and a reduced quantity of building exhaust is diverted through the filter trains and discharged into the shield building exhaust vent (see Section 6.2.3). The exhaust vent is located within the annulus space of the Reactor Building and extends to the top of the Reactor Building.

Upon indication of smoke in the Auxiliary Building air intake rooms (Units 1 and 2), the Auxiliary Building general ventilation air supply fans are automatically stopped and dampers closed.

2 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

The shutdown board room pressurizing supply fans, auxiliary board room pressurizing supply fans, shutdown transformer room exhaust fans, shutdown board room air handling units, auxiliary board room air handling units, air cooled condensing units, chillers, ABGTS fans and filter units, and associated ductwork are designed to Seismic Category I requirements. All other parts of this system, except as identified in Section 9.4.5.3.3, are designed to meet Seismic Category I(L) requirements.

For safety-related portions of the system, components are designed to assure that a single active failure cannot result in the loss of a safety-related function. This is accomplished by using 100% redundancy where required as described in the following sections. The Auxiliary Building is structurally designed to resist damage by missiles, either internally or externally produced. Specific design considerations for missile protection are also described in the following subsections.

.3.2 System Description The Auxiliary Building ventilation systems are shown on Figures 9.4-13, to 9.4-16, on logic Figures 9.4-9 and 9.4-10, and on control Figures 9.4-11 and 9.4-17. The auxiliary and radwaste area ventilation systems consist of the following subsystems:

(1) Building air supply and exhaust system (general ventilation)

(2) Building cooling system (chilled water)

(3) Safety features equipment coolers (4) Shutdown board room air-conditioning system (5) Auxiliary board room air-conditioning system (6) Shutdown transformer room ventilation system (7) Miscellaneous ventilation and air-conditioning system (8) Auxiliary board room ventilation system.

.3.2.1 Building Air Supply and Exhaust Systems (General Ventilation)

The building air supply system filters 100% of outdoor air through a bank of filters for each of two mechanical equipment rooms located at opposite ends of the building at elevation 737.0. The filters have a nominal efficiency of 85% based on the NBS atmospheric dust spot test.

During periods when the outdoor air temperature is below 40°F, hot water is supplied to the heating/cooling air intake coils to temper the incoming air. When outdoor air is above 60°F, chilled water is supplied to the heating/cooling air intake coils to increase the cooling capacity of ventilation air. Between outdoor air temperatures of 40-60°F, unconditioned air is supplied.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-13

The air supply system utilizes four 50% capacity supply fans, two being located in each of the two mechanical equipment rooms at elevation 737.0. During normal operation, one fan in each equipment room is in operation with the other fan in the standby mode.

Supply air is ducted to various clean or accessible areas of the Auxiliary Building from which it flows to areas of progressively greater contamination potential before being exhausted through a duct system by the building exhaust fans. In the event of a fuel-handling accident, radiation monitors in the vicinity of the spent fuel pool initiate an AB isolation signal which stops the building ventilation system and starts the ABGTS fans (see Section 9.4.2).

The building supply air is provided by centrifugal fans located downstream of the heating/cooling coils. Each fan is rated at 100,000 cfm at 4.0 inch water gauge static pressure. These fans are not engineered safety features. The building supply filters are composed of two parallel banks. Each filter bank is rated at 85% efficiency based on NBS atmospheric dust spot tests.

The general exhaust air from the Auxiliary Building is provided by four exhaust fans each rated at 50% of system capacity. These fans are controlled in blocks of two: one fan per unit is in operation with the remaining fan in the standby mode. These fans are located on the roof of the Auxiliary Building and discharge into the auxiliary building exhaust stack.

An inlet damper in series with each auxiliary building exhaust fan is used to regulate the volume of air exhausted as required to maintain 1/4-inch water gauge negative pressure within the building with respect to the outside environment. The inlet dampers are automatically operated by static pressure controllers.

Each of the centrifugal exhaust fans is rated at 84,000 cfm.

The isolation dampers and the ductwork between these dampers that make up part of the Auxiliary Building Secondary Containment Enclosure are designed to the requirements of Safety Class 2b and Seismic Category I. For the exhaust fans, the trip circuits for the primary circuit breaker and the shunt trip isolation switch arranged in series with the primary circuit breaker are designed as Class 1E. All other portions of this system are Seismic Category I(L).

.3.2.2 Building Cooling System (Chilled Water)

The purpose of the building cooling system is to supplement the general ventilation system and to maintain temperatures at less than the design maximum in the general spaces of the Auxiliary Building. The cooling system consists of two 100% capacity packaged water chillers, two 100% capacity primary loop circulating pumps, two 100%

capacity secondary loop circulating pumps, twelve heating/cooling coils, six fan-coil type air handling units, and associated piping, ductwork, and controls.

Primary and secondary chilled water circulating loops are designed for mixing supply and return water to obtain a variable coil inlet temperature to minimize unnecessary heat removal. A primary loop pump provides circulation of water through the water 4 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

chiller. The secondary loop pump circulates chilled water to air intake heating/cooling coils and also to the six air handling units located in various areas where ventilation air alone is not sufficient to maintain the maximum space temperature.

The chilled water system is designed for manual startup with automatic mixing of primary and secondary loop flows by means of thermostatically controlled two-way control valves. Flow to heating/cooling coils and to air handling units is individually controlled at each terminal unit by three-way modulating control valves. The seasonal changeover from heating to cooling or from cooling to heating is done by the manual operation of system changeover valves located in the mechanical equipment rooms on elevation 737.0.

.3.2.3 Safety Feature Equipment Coolers The safety feature equipment coolers are described in Section 9.4.5.3.

.3.2.4 Shutdown Board Room Air-Conditioning System Shutdown board rooms are located on elevation 757.0 of the Auxiliary Building with a firewall separating Units 1 and 2 equipment. The electrical boards for either unit can provide the service necessary for the safe shutdown of both plant units following an accident in either unit. Environmental control is maintained by four fan-coil units.

Environmental control for the auxiliary control room is maintained by the SDBR air-conditioning system. The four SDBR air-conditioning units are arranged so that each shutdown board room and battery board room is cooled by either of two redundant (train A or B) fan-coil units. Both of these units are located in the respective reactor unit's mechanical equipment room. The air distribution system is arranged such that the auxiliary control room is cooled by two fan-coil units of the same train (i.e.,

units A-A and B-A or units C-B and D-B) located in the two separate equipment rooms.

Four unit heaters provide heating as required to maintain the design ambient conditions. Each SDBR air-conditioning system is connected to an emergency power source as well as a source of cooling water that will be available under all conditions.

Upon loss of offsite power, emergency power to both SDBR air-conditioning system chillers is automatically re-established in sequence by the diesel generator in accordance with FSAR Table 8.3-3. One of the two redundant chillers is normally operating and the other is in standby. The standby chiller starts if the operating chiller fails. The SDBR air-conditioning system is designed to meet Safety Class 2b and Seismic Category I requirements.

Two 100% capacity pressurizing fans are each designed to maintain the SDBRs at a slight positive pressure with respect to the outdoors.

Each of the two air-conditioning units and each of the two pressurizing air supply fans serving one set of SDBRs are powered by different power trains.

Redundant tornado dampers are installed in the elevation 757 shutdown board room pressurizing supply fan ductwork which extends to elevation 772; this ductwork is designed for a pressure differential of 3 lb/inch2. In addition, ductwork penetrating the CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-15

elevation 757 personnel and equipment access rooms from the emergency gas treatment system and blowdown treatment rooms is designed for 3 lb/inch2. Thus, the elevation 757 electrical equipment areas are protected from tornado-induced depressurization.

.3.2.5 Auxiliary Board Rooms Air-Conditioning Systems The auxiliary building electrical boards, located on floor elevation 772.0, are separated into two subareas per unit corresponding to Train A and Train B emergency power.

Four separate air-conditioning systems are provided, one to serve each of the four board room subareas. Train B areas which contain both Train A and Train B electrical equipment are cooled by Train A and Train B air conditioning subsystems. Following an accident, the electrical boards in either subarea have the capability to support a safe shutdown of the unit. Because each subarea is served by attendant air-conditioning equipment sized to remove 100% of the heat produced by electrical equipment in that subarea, full redundancy is provided.

The Train A air-conditioning equipment located within the elevation 772.0 mechanical equipment room and the Train B air-conditioning equipment located on the roof above are provided structural protection from environmental hazards, including tornado missiles, and floods. The system is also designed to meet Safety Class 2b and Seismic Category I requirements.

Each board room air-conditioning system contains a refrigerant compressor, air-cooled condenser, fan-coil air handling unit with direct expansion cooling coils, two 100%

pressurizing air supply fans, air supply distribution system and control and safety devices.

Two 100%-capacity roof ventilator exhaust fans located on the roof of each of the four separate battery rooms on elevation 772.0 provide continuous ventilation to prevent the possible accumulation of dangerous hydrogen gas.

The two 100%-capacity pressurizing air supply fans per air-conditioning system serve a twofold purpose. One is to replace a portion of air-conditioning system air exhausted through the battery room and the other is to pressurize the electrical board room to prevent infiltration of contaminated air. The mixture of this makeup air and board room return air is conditioned upon passing through the air handling unit.

One pressurizing air supply fan and one battery room exhaust fan in each individual air-conditioning system are connected to Train A electric power, and the remaining fans are connected to Train B power. Control system interlocks provide simultaneous operation of the pressurizing air supply fan and battery room exhaust fan. The availability of this fan combination on either power train ensures continuous ventilation in each battery room regardless of operability of the direct-expansion air-conditioning equipment. In the event of air-conditioning system failure, pressurizing fan air is drawn through the normal board room supply ducts by the battery room exhaust fan.

Condensing unit cooling air for the Train A air-conditioning system of each plant unit is routed from intakes located on the roof at elevation 786, through the condenser, and 6 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

discharged through a roof-mounted exhaust housing. The Train B system condenser cooling air is drawn through an intake on the side of the equipment housing on the roof and is discharged through an exhaust opening atop the equipment housing.

Each Train A and each Train B room air conditioning system air handling unit is designed to maintain the room temperature within the range for which the equipment is environmentally qualified. The minimum temperature is 50°F for the board rooms and the battery rooms. The maximum temperature for each room is 104°F. This ensures that the equipment and components are not exposed to environmental conditions that could degrade the operability of safety-related equipment.

Dampers capable of withstanding pressure differentials between areas of the elevation 772.0 board rooms and mechanical equipment rooms and the outside environment under tornado conditions are located in the intake connections for each of the Train A air-cooled condensers. Each battery room exhaust fan has a damper capable of withstanding pressure differentials imposed by tornado conditions. The dampers are mounted below the fans at elevation 786.0. Small ventilation holes are provided in each damper frame between the exhaust fan and the damper to allow continuous venting of hydrogen gas even when the damper is closed. Each of these dampers is interlocked with its respective exhaust fan such that it will provide isolation of the fan when it is not operating. These dampers are locally operated and will automatically close when the exhaust fans are turned off upon tornado alert.

The fifth vital battery room exhaust fans also have dampers capable of withstanding pressure differentials imposed by tornado conditions. The dampers are mounted below the Elevation 786.0 between the ceiling and the in-line fan.

The fifth vital battery room is cooled by air which is drawn from the 480 Volt Board Room 1A through an opening in the common partition wall at the T Line and is exhausted directly to the outside. This configuration is similar to that of the four battery rooms discussed above, with the exception that the exhaust fans are in-line axial fans and are located in the room. The cooling system is designed to maintain temperatures in this room within the range of 50°F to 104°F, and for continuous venting of hydrogen gas.

.3.2.6 Shutdown Transformer Room Ventilating Systems The shutdown transformers, located on elevation 772.0, are divided into two subareas with seven transformers in each subarea. These subareas are further divided into two enclosed areas with Train A emergency power routed to one transformer grouping and Train B emergency power to the other.

Outside air enters each subarea through air intake structures located on the Auxiliary Building roof. Each roof-mounted exhaust ventilator is energized from the same train of the emergency power system that supplies power to the transformer for which it provides ventilation. Exceeding the temperature setpoints in a room automatically starts the exhaust fans, and open the air operated dampers in the two air intake structures. Manually starting the exhaust fans also opens the air-operated dampers in the two air intake structures.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-17

When the outside air temperature decreases, exhaust fans in the individual transformer rooms are deactivated in staged series as determined by thermostatic control. As the room temperature increases above the predetermined control point, all exhaust fans are again activated in staged series.

The shutdown transformer rooms' air is exhausted by electric motor-driven centrifugal-type roof ventilator fans.

The motor-operated air intake dampers have the capability of being remote/ manually powered to the open position without regard to thermostatic control as a tornado alert provision.

This ventilation system is designed to maintain the temperature in the transformer rooms within the range for which the equipment is environmentally qualified (32°F minimum and 104° maximum) to ensure that equipment and components are not exposed to environmental conditions that could degrade the operability of safety-related equipment.

The system is designed to meet Safety Class 2b and Seismic Category I requirements.

.3.2.7 Miscellaneous Ventilation and Air Conditioning Systems The control rod drive equipment room design temperature limits are maintained by two 100% capacity air-conditioning units located in each room. During normal operation, one of the air-conditioning units in each room is in operation with the other on standby.

Each unit is automatically controlled by a self-contained thermostat. Electric unit heaters are located in each room to maintain the rooms at no less than 60°F during cold weather.

The hot instrument shop's design temperature is maintained by a chilled water cooling coil which utilizes 100% makeup air to prevent the recirculation of any contaminants.

The hot instrument shop exhaust is provided by a lab exhaust hood which is connected to the general building exhaust duct system.

The sample room is ventilated by five lab hoods, each with an exhaust fan. Three fans are located on the Unit 1 side and two fans are located on the Unit 2 side. Air enters the sample room through doors with transfer grilles and back draft dampers. Each hood is provided with a separate exhaust fan and HEPA filter assembly. A differential pressure gauge is used to indicate the need for filter replacement. Each hood exhaust fan discharges into the general building exhaust system.

The additional equipment building for Unit 1 is served by three air-conditioning units.

The first cools the spaces on elevation 729.0, 740.5, and 752.0. The second cools elevation 763.5 and elevation 775.25. The third cools the equipment spaces on elevation 786.5. The Unit 1 additional equipment building air-conditioning units are each designed to cool the intake air with cooling water.

The additional equipment building for Unit 2 is served by one air-conditioning unit.

8 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

The reactor building steam valve rooms each have an independent ventilation system consisting of two roof mounted exhaust fans. The fans draw outside ventilation air for room cooling through a wall opening near the floor. Winter-time space temperature control is maintained by inlet vanes which modulate airflow in response to a wall mounted thermostat.

.3.3 Safety Evaluation Functional analyses and failure modes and effects analyses have shown that the auxiliary and radwaste area ventilation system has the capabilities needed for normal operations and for accident mitigation. These are described in the sections that follow.

.3.3.1 General Ventilation System A functional analysis of the general ventilation system shows that:

(1) Adequate ventilation is provided to achieve acceptable air flow patterns needed for airborne activity control. See Section 9.4.3.2.1.

(2) There are three different signals that will automatically cause the system to change from the normal operating mode to the accident mode. One of these is the Phase A containment isolation signal from either reactor unit. Another is the high temperature signal from the Auxiliary Building air intakes. The third signal is the high radiation signal from the fuel handling area radiation monitors. Either a Train A or a Train B signal from any of these sources will cause the system to change to the accident mode of operation.

(3) Ventilation fan operations cease and isolation dampers in the intake and exhaust ducting close in the accident mode of operation. Air flow patterns and air cleanup operations appropriate for accident mitigation during the accident mode of operation are established and maintained by the ABGTS.

See Section 6.2.3 for further information.

(4) Another signal, smoke detection signal from the Auxiliary Building air intake, will shut down the supply fans and close the fan isolation dampers.

The failure modes and effects analyses performed on safety related systems interfacing with the general ventilation system have shown that:

(5) During normal mode operations, substandard airflows are detected by a low flow sensor and this sensor signals the MCR for operators to start up the redundant fan(s). The redundant Auxiliary Building general ventilation fan is automatically started upon low flow detection of the operating fan.

(6) A failure of any one of the two radiation monitors above the spent fuel pool does not prevent a high radiation signal from being relayed to necessary isolation components.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-19

(7) A failure of the whole or any part of either Train A or Train B components to complete isolation does not prevent total isolation. Each supply and exhaust line to the environment is equipped with both Train A and Train B low leakage isolation dampers.

(8) Essential portions of the system remain functional after a seismic event because of their design to Seismic Category I requirements. Nonessential portions of the system and other systems located close to essential components and not designed to Seismic Category I standards are designed to Seismic Category I(L) standards to prevent their failure from precluding operation of essential system components.

(9) All essential isolation valves and their associated ductwork are located above the maximum flood level in a Seismic Category I building that is designed to resist damage by tornado missiles.

(10) A loss of offsite power causes closure of the isolation dampers by virtue of their fail-safe design (closed when unpowered). Preferred air flows will be maintained by the ABGTS.

.3.3.2 Building Cooling System This system serves no safety-related function. The air handling units and their associated piping, valves, ductwork, and dampers are all designed to Seismic Category I(L) requirements to prevent their failure from endangering safety-related equipment.

.3.3.3 Safety Feature Equipment Coolers This system is discussed in Section 9.4.5.3.

.3.3.4 Shutdown Board Room Air-Conditioning System A functional analysis of the shutdown board room air-conditioning system shows that:

(1) During all modes of operation, the system will maintain adequate air temperatures to assure optimum operation of the safety-related equipment it serves. See Section 9.4.3.2.4.

(2) There are redundant pressurizing air supply fans serving each of the two subareas to maintain a slightly positive pressure in the shutdown board areas to minimize contaminated inleakage.

The failure modes and effects analyses provided in Table 9.4-9 has shown that:

(1) During all operational modes, substandard cooling or pressurizing air flows are detected by local sensors and a corresponding warning is provided to the main control room.

0 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

(2) A failure of one air handling unit initiates the startup and loading of the standby redundant unit.

(3) The failure of one of the two pressurizing air supply fans serving each shutdown board area is detected by local sensors and a signal is provided to activate the standby redundant fan.

(4) Essential portions of the system are designed to Seismic Category I standards to assure that they remain functional after a seismic event.

Nonessential portions of this system and other systems located close to essential components are designed to Seismic Category I(L) requirements to prevent their failure from precluding operation of essential system components.

(5) All components of this system are located above the maximum probable flood level and are in a Seismic Category I building that is designed to resist damage by tornado missiles.

(6) Upon loss of offsite power, all essential functions of this system are powered by two trains of emergency electrical power.

.3.3.5 Auxiliary Board Rooms Air-Conditioning System A functional analysis of the auxiliary board rooms air-conditioning system shows that:

(1) During all modes of operation, the system maintains adequate air cooling to assure optimum operation of the safety-related equipment it serves. See Section 9.4.3.2.5.

(2) Two redundant pressurizing air supply fans serve each of the four subareas to maintain a slightly positive pressure in the subarea to minimize contaminated inleakage.

(3) The four battery rooms receive continuous ventilation air supplies to prevent any accumulation of hydrogen gas.

The failure modes and effects analysis in Table 9.4-5 has shown that:

(1) During all operations, substandard cooling or pressurizing air flows are detected by local sensors and a corresponding warning is provided in the main control room.

(2) Failure of the air handling unit serving one of the two subareas per plant unit does not prevent the remaining subarea and its air handling unit from accomplishing all the safety-related functions of the auxiliary board area for that unit. Essential Train A electrical equipment located in the Train B 480V board rooms is spot cooled by the Train A HVAC system, assuring it's operability should the Train B HVAC system fail.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-21

(3) The failure of one of the two pressurizing air supply fans serving each of the four auxiliary board subareas is detected by local sensors and a signal is provided to activate the standby redundant fan.

(4) A battery room exhaust fan failure causes automatic activation of the standby exhaust fan and activates an alarm in the MCR. If the air supply to a battery room from the corresponding air handling unit is lost, air is provided by the associated pressurizing air supply fan.

(5) Essential portions of the system are designed to Seismic Category I standards to assure that they remain functional after a seismic event.

Nonessential portions of this system and other systems located close to essential components are designed to Seismic Category I(L) requirements to prevent their failure from precluding operation of essential system components.

(6) All components of this system are located above the maximum probable flood level and are in a Seismic Category I building that is designed to resist damage by tornado missiles.

(7) Upon a loss of offsite power, all essential functions provided by this system are powered by two trains of emergency electrical power.

.3.3.6 Shutdown Transformer Room Ventilating System A functional analysis of the shutdown transformer room ventilating system shows that adequate ventilation air flow is provided to the transformer rooms to maintain environmental conditions conducive to optimum transformer operation.

The failure modes and effects analyses in Table 9.4-6 indicate that:

(1) Failure of one or more fans in each room is detected by temperature sensors located in the room. This failure warning allows operators to activate other available exhaust fans in the same room to replace the damaged unit(s).

(2) Loss of flow through one of the two intake structures serving each transformer room would be no safety concern since the second intake opening also opens (both intake structures open simultaneously).

(3) All required portions of this system are designed to Seismic Category I requirements to assure that they remain functional after a seismic event.

Other components, and systems, located close to this system are qualified to either Seismic Category I or I(L) standards; therefore, their failure can not preclude operation of this system.

2 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

(4) All components of this system are located above the maximum probable flood level and are in a Seismic Category I building that is designed to withstand the effects of tornado missiles. Where components are subject to tornado-generated missile damage, operator actions have been defined in the event of damage.

(5) In the event of a loss of offsite power, emergency electrical power is provided to the transformers and their associated exhaust fans. One of the two subareas serving each unit is provided with Train A power and the other with Train B power.

.3.3.7 Miscellaneous Ventilation and Air-Conditioning System These systems serve no safety-related functions; however, to guarantee proper operation of steam relief valves, the steam valve room exhaust fans modulate in response to a wall mounted thermostat to assure that room ambient temperatures do not fall below 80°F during the heating season. In the event extreme outside winter-time conditions still result in room temperatures falling below 80°F, the fans automatically shutdown. The air handling units, fans, and other system components are all designed to seismic Category I(L) requirements to prevent their failure from endangering safety related equipment.

.3.4 Inspection and Testing Requirements The auxiliary building environmental control systems are in continuous operation and are accessible for periodic inspection. See Section 14.2 for testing acceptance criteria.

The systems are tested initially as part of the preoperational test program. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation.

See Sections 6.2.3.4 and 9.4.5.3.4 for inspection and testing requirements of the ABGTS and the ESF coolers.

Details of the radiation monitors are discussed in Section 11.4.

.4 Turbine Building Area Ventilation System

.4.1 Design Bases The turbine building heating, cooling and ventilating systems are designed to maintain an acceptable building environment for the protection of plant equipment and controls; for the comfort and safety of operating personnel; and to allow personnel access for the operation, inspection, maintenance, and testing of mechanical and electrical equipment. The areas served by these systems are not considered potentially radioactive because the reactor is of the pressurized water type which does not normally produce radioactive steam. Potential sources of radioactivity were not, therefore, considered in establishing air flow paths, and the air flows are not monitored for radiation.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-23

The building's environmental control systems are designed to maintain building temperatures between a minimum of 50°F and a maximum of 110°F, by use of forced ventilation, mechanical cooling, and heating systems.

.4.2 System Description The building can be considered to contain four large rooms: El 755.0 turbine room, El 729.0 spaces, El 708.0 spaces, and elevation 685.5 spaces. See Figure 9.4-18.

Because the El 755.0 floor is predominantly concrete and thus isolated from the floors below, the turbine building ventilation is provided by two separate systems. One system serves El 755.0 spaces, and the other system provides ventilation for the spaces on El 729.0 and El 708.0. Because the El 708.0 floor is predominantly grating, air supplied to El 708.0 spaces also provides ventilation for spaces on El 685.5.

Both ventilation systems operate on the basis of mechanically supplying the required flow of outside air to spaces being ventilated, and exhausting the building air to outdoors.

Each supply and exhaust fan is provided with a motor operated damper designed to automatically close when the fan is stopped, in order to prevent air back flow. Outside air is distributed to areas of heat concentration either by duct distribution systems or by induction using the negative pressure caused by operation of roof exhaust fans, through strategically located air intake openings.

.4.2.1 Elevation 755.0 Ventilation The ventilation system for elevation 755.0 consists of two mechanical air supply systems, one on the north side and the other on the south, free-air-intake openings on the east and west walls, and exhaust fans on the elevation 820.0 roof. Total air exhausted is 570,000 cfm, whereas only 206,000 cfm is mechanically supplied through supply ducts. The remaining 364,000 cfm is drawn through the east and west free-air-intake openings by the negative pressure created by the operation of exhaust fans.

.4.2.2 Elevation 729.0 and Elevation 708.0 Ventilation The elevation 729.0 and elevation 708.0 ventilation system consists of two mechanical air supply systems, one on the north side and the other on the south, and exhaust fans on the elevation 755.0 roof. A total of 412,000 cfm is exhausted, and a total of 412,000 cfm outside air is supplied.

.4.2.3 Cold Weather Building Pressurization During cold weather, all supply and exhaust systems can be isolated by closing the motor operated dampers to conserve heat. However, the two supply fans serving north elevation 708.0 floor may be operated at half speed since two hot water heating coils located in the supply duct connected to each of these fans heat the incoming air. With no exhaust fan running, the operation of these two supply fans will pressurize the entire Turbine Building to prevent infiltration of cold outside air.

4 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

.4.2.4 Miscellaneous Ventilating Systems The three toilet rooms and three janitor's closets are each ventilated by roof-mounted, roof-ventilator type exhaust fans. Plant air enters each room through a louvered door and is exhausted into the main room.

The lubricating oil purification room at elevation 708.0 is ventilated by a centrifugal fan mounted on the room wall, which discharges to the outdoors by means of a duct routed to a basement exhaust housing. A fire damper, mounted in the exhaust opening, and the room firedoor are designed to shut off all airflow in case of fire.

The elevator machinery room at elevation 708.0 is ventilated by a wall-exhauster type fan. The lubricating oil dispensing room at elevation 708.0 is ventilated by a wall-exhauster type fan. A fire damper mounted in the exhaust opening and the room's firedoor are designed to shut off all airflow in case of fire.

.4.2.5 Coolers Fan-coil type raw water cooled cooling units have been installed throughout the Turbine Building to supplement the building ventilation system during peak cooling load conditions. Each cooling unit consists of a centrifugal fan and its motor, and a finned tube type water coil through which raw cooling water is circulated and over which air is passed and cooled.

Space coolers located on different elevations help prevent concentration of heat produced by various plant equipment by recirculating air in their immediate vicinities and so establishing the desired airflow patterns.

Pump coolers located in areas where miscellaneous turbine building pumps dissipate large amounts of heat, are each designed to remove heat produced by its pump to maintain maximum ambient temperature at 110°F.

.4.2.5.1 Space Coolers Space coolers are located on elevation 729.0, elevation 708.0, and elevation 685.5 floors. A thermostat located near the return airflow to each cooler controls a solenoid valve on the raw cooling water supply line to each coil and the cooler fan. The solenoid valve and the fan on each cooler are interlocked to operate together.

.4.2.5.2 Pump Coolers Pumps and the fans of the coolers assigned to them are interlocked to run simultaneously. However, raw cooling water to each cooling coil can be turned off and on manually to conserve water during off time. These coolers are not controlled thermostatically.

.4.2.6 Building Heating System The building heating system serves the Turbine Building and the air preheating coils belonging to the auxiliary building general ventilation system.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-25

The heating system is a high-temperature hot water, closed, forced-circulation loop.

The system consists of two 100% capacity water circulating pumps, two 70% capacity steam to water heat exchangers, tanks, heating coils, space and unit heaters, nitrogen pressurization, demineralized water makeup, chemical treatment, controls, and supply and return water distribution piping.

Steam is normally taken from the turbo-generator cold reheat cycle during operation of either unit, or is taken from the plant auxiliary boiler during plant shutdown or when both units are operating at less than 55% power. The heating system heat exchangers, pumps, and tanks are located at elevation 729.0 along the north end of Unit 2.

The heating system is designed to maintain the Turbine Building at a minimum temperature of 50°F with both units shutdown and a 13°F outdoor temperature. Heat is distributed by thermostatically controlled hot water unit and space heaters strategically located throughout the Turbine Building and by hot water heating coils mounted in the north elevation 708.0 air supply ducts. See Figures 9.4-19 and 9.4-20.

Fresh air may be supplied (136,000 cfm for plant) through the north elevation 708.0 air supply ducts. The hot water heating coils mounted in the ducts heat the incoming air.

The auxiliary building air preheating portion of the heating system consists of a secondary forced-circulation loop system for each plant unit containing two pumps and a 3-way temperature control valve. The valve is thermo-statically controlled to supply outdoor air heated to approximately 60°F.

.4.3 Safety Evaluation The turbine building ventilating and heating systems are designed to assure their reliable operation during normal plant operation and are not safety related. The free air intake dampers, located along the east and west walls of the elevation 755.0 turbine room are designed to close if a power failure occurs. There is no safety related equipment located in their immediate vicinity.

.4.4 Inspection and Testing Requirements The Turbine Building environmental control systems are in continuous operation and are accessible for periodic inspection.

.5 Engineered Safety Feature Ventilation Systems The function of the engineered safety features ventilation systems is to provide a suitable and controlled environment for engineered safety feature components during normal plant operation, during adverse environmental transients, and following design basis accidents.

.5.1 ERCW Intake Pumping Station

.5.1.1 Design Bases The essential raw cooling water (ERCW) and the high pressure fire protection (HPFP) pump area at Elevation 741 and the raw cooling water and cooling tower makeup pump 6 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

area at Elevation 728 are open to the outside environment and are therefore cooled by natural convection. The ERCW and HPFP pump area, the electrical equipment room, and the 100% redundant mechanical equipment rooms are the only areas containing safety-related equipment. The nature of the ventilation system in the ERCW and HPFP pump area provides assurance that a single active failure cannot result in loss of the ERCW and HPFP system functional performance capabilities.

The mechanical and electrical equipment rooms heating and ventilation systems are not safety-related. Their primary function is to maintain the room temperatures within the maximum and minimum design values during normal plant operation. Operator action is taken to periodically monitor the Intake Pumping Station mechanical and electrical equipment rooms space temperatures to ensure that the maximum and minimum design values are not exceeded.

The ERCW and HPFP pump areas may experience a maximum ambient air temperature of 120°F when the surrounding outside air is 95°F. Since they are exposed to the outside environment the pumps and their associated equipment are designed to withstand low ambient air temperatures.

Electrical and mechanical equipment rooms are individually ventilated during normal operation to limit the room temperatures to a maximum of 104°F when the entering outside air temperature is 95°F. Low temperature conditions are maintained approximately 50°F during normal operation by means of thermostatically controlled electric duct heaters and unit heaters and above 32°F during abnormal conditions by periodic temperature monitoring and providing supplemental heating, as necessary.

Because the intake pumping station contains no sources of potential radioactivity, there are no safety-related airflow directions that must be maintained and no required radiation monitors.

The intake pumping station is a Seismic Category I structure that is protected from the threats of tornado missiles and floods. A grid-type roof system is utilized to provide both missile protection and allow natural ventilation to the ERCW and HPFP pump area. The roof is composed of a series of horizontal 'I' beams rotated 45° about their longitudinal axes. The beams are supported by steel members which are in turn supported by concrete walls. The grillage is designed to meet Seismic Category I(L) requirements. The heating and ventilation equipment, ductwork, dampers, supply and exhaust fans, duct heater, and unit heater serving the electrical equipment and the mechanical equipment rooms meet Seismic Category I(L) requirements.

.5.1.2 System Description The intake pumping station heating and ventilating systems for the electrical and mechanical equipment areas are shown in Figure 9.4-21. The pump areas are cooled by natural convection.

The electrical equipment room and mechanical equipment rooms are individually ventilated by separate ventilation systems. Each system is provided with 100%

capacity supply and exhaust fans. The supply fan delivers air through a short vertical CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-27

duct which encases the duct heater, a motor operated isolation damper, and a discharge grille. Two electric unit heaters are provided in each room. The duct heater and the unit heaters are thermostatically controlled.

Periodic temperature monitoring is necessary to ensure that the equipment room temperatures are maintained within design limits. Equipment room space temperatures are monitored during all plant conditions. Ventilation fans are shut down during subfreezing outdoor temperatures, and portable electric heaters and power generators are utilized as necessary during potential loss of heating to prevent freezing conditions in the equipment rooms. Non-essential cooling loads are manually shut down as necessary to maintain the space temperatures within design limits if ventilation is not available.

.5.1.3 Safety Evaluation A failure modes and effects analysis has shown that the intake pumping station ventilation systems have the capabilities needed for normal operations, abnormal, and accident conditions. The intake pumping station ventilation systems are not classified as safety-related. However, operator actions are taken to periodically monitor room temperatures, provide supplementary heating, shutdown fans, or shed nonsafety-related heat loads, as necessary, to maintain room temperatures between the minimum and maximum design values. The systems are also designed to maintain their structural integrity during a seismic event to not damage safety-related equipment in their vicinity.

The analysis of the ventilation system shows that:

(1) Adequate flow-through ventilation is provided for the ERCW and HPFP pump area by natural convection during all credible environmental conditions.

(2) Adequate heating and forced air ventilation are provided to each mechanical equipment room and electrical equipment room to maintain acceptable temperatures during normal operation. Compensatory actions are taken during abnormal or accident conditions, as needed. See Section 9.4.5.1.2 and Table 9.4-2.

The failure modes and effects analysis, as shown in Table 9.4-2, indicates that:

(1) Natural ventilation in the ERCW pump area can be maintained during all environmental conditions, including tornadoes, earthquakes, and floods. A structural failure of the grillage roof will not prevent adequate ventilation air from reaching each operating pump.

(2) During normal operating conditions, the failure of supply or exhaust fans in a mechanical or electrical equipment room will not result in environmental degradation that will prevent the operation of any safety-related equipment, since the temperatures are monitored and operator actions are taken, as necessary.

8 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

.5.1.4 Inspection and Testing Requirements The ERCW intake pumping station ventilating and heating system is accessible for periodic inspection and testing.

.5.2 Diesel Generator Buildings

.5.2.1 Diesel Generator Building

.5.2.1.1 Design Bases The Diesel Generator Building ventilating system is required to operate to maintain plant safety in the event of a loss of offsite power due to a plant accident or natural disaster, including tornado, earthquake, flood, or fire.

The diesel units are redundant and are each served by a separate ventilation system consisting of two 50% capacity exhaust fans. Each ventilation system maintains a proper environment for the operation of safety-related components.

Each diesel engine room ventilation subsystem consists of two room exhaust fans and one generator and electrical panel cooling fan.

One diesel generator exhaust fan automatically starts upon diesel startup. The second exhaust fan starts when the upper setpoint of a temperature switch mounted in the air exhaust room is reached or on low flow of the first fan. The generator and electrical panel cooling fan can start along with either exhaust fan. The temperature switches mounted in the air exhaust room monitor the temperature of the air as it leaves the diesel generator room. Each switch may actuate its respective room exhaust fan upon detection of high diesel generator room temperature conditions or may deenergize its respective fan, as necessary, in order to maintain the diesel generator room exhaust temperature between 50°F and 120°F. All three fans automatically stop if the diesel generator room carbon dioxide fire suppression system is activated. Switches for manual operator action are provided to override the carbon dioxide system interlocks and start fans, open dampers to restore ventilation and fulfill the safety function if the carbon dioxide is activated by a failure in the carbon dioxide or fire detection systems.

The toilet room is ventilated by a manually controlled fan. The electrical board rooms, lube oil storage room, and fuel oil transfer room are ventilated by manually controlled fans at all times except when their respective carbon dioxide fire suppression systems are activated. The muffler rooms are ventilated as required to remove heat during warm weather. Muffler room exhaust fans are manually operated from hand switches located on the electrical board that serves the particular fan, or start along with the diesel when in the auto mode.

Fire dampers are provided in each air supply and exhaust opening to the diesel generator room, electrical board room, lube oil storage room, and oil-transfer room.

Motor-operated dampers located at the air intake to each diesel generator room are automatically opened whenever either of the exhaust fans starts. All fans except for the generator and electrical panel cooling fans are equipped with motor-operated CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-29

shutoff dampers which close when their associated fan is not operating. Similarly, all relief vents are provided with motor operated shutoff dampers except the electrical board room intake vents which are provided with fire dampers instead.

A backdraft damper is installed in the duct between the air intake room 1A-A and the carbon dioxide storage room in order to prevent carbon dioxide backflow into the diesel generator air intake room in the event of a carbon dioxide system rupture.

Each diesel generator unit room and electrical board rooms are separately ventilated in order to limit average room temperatures to a design maximum of 120°F and 110°F respectively when outdoor air entering the room is 95°F and the diesel generator is in operation. Remaining areas of the Diesel Generator Building are ventilated to maintain maximum air temperatures within design limits. Personnel comfort conditions are maintained as required during low outside temperatures by means of thermostatically controlled electric unit heaters. Battery areas are ventilated by the operation of the diesel generator room exhaust fans. There is not a separate battery area ventilation system. The diesels are started up and load-tested at least every 31 days. Whereas, the calculations show that it takes considerably longer for Hydrogen accumulation to reach the limit of 2% by volume. The diesel generator room exhaust fans are interlocked with the diesels; therefore, they are operated at least once every 31 days with the testing of their respective diesels. In addition, the exhaust fans operate whenever their room thermostats call for cooling, as described in Section 9.4.

The generator for each engine room is supplied with outside air and the electrical control panels within the engine rooms are forced ventilated to assure adequate cooling.

Because the Diesel Generator Building contains no sources of potential radioactivity, there are no safety-related airflow directions that must be maintained and no required radiation monitors.

The Diesel Generator Building is a Seismic Category I structure that is designed to withstand the effects of tornado missiles and flood. The diesel generator room exhaust fans, the generator and electrical panel cooling fans, electrical board room exhaust fans, and all associated ductwork, fittings and dampers are located within the building and are designed to meet Safety Class 2b and Seismic Category I requirements. The portions of these systems, located on the roof of the building, are protected against missile damage by missile shields. These fans, their associated controls, and motor-operated dampers are connected to emergency power. The use of concrete air intake and exhaust hoods provides additional protection from the effects of missiles.

.5.2.1.2 System Description The Diesel Generator Building heating and ventilating system is shown on Figures 9.4-22, -23, -24, -24A and 9.4-25. Two diesel generator room exhaust fans, and one electrical board room exhaust fan are located in the air exhaust room at elevation 760.5 for each of the four diesel generator units. These fans discharge to the outdoors. One generator and electrical panel cooling fan is located within each diesel generator room.

0 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

Fresh air is introduced through each air intake room and drawn to the corresponding diesel generator room. The generator and electrical panel cooling fan draws air from the room intake vicinity for distribution to the generator air intake and to the electrical panel. Following absorption of the heat load in the room the air is drawn into the air exhaust room by the room exhaust fan(s) and is discharged through the air exhaust hood.

Each battery area is ventilated by its respective diesel generator room exhaust fan (see Section 9.4.5.2.1.1 for a detailed description).

Each of the electrical board rooms is ventilated by a centrifugal exhaust fan which delivers a design flow rate of 2,850 ft3/min. The fan draws air into the board room through its associated electrical board room intake vent.

Other building exhaust fans provide individual ventilation for the lubricating oil storage room, fuel oil transfer room, carbon dioxide storage room, toilet room, and muffler rooms.

The thermostatically controlled electric unit heaters located within the diesel generator rooms are designed to maintain the 50°F minimum temperature. Electric unit heaters in the equipment access corridor, storage rooms, radiation shelter rooms, and toilet room are designed to maintain normal temperature within these areas at not less than 40°F.

Thermostats in the diesel generator air exhaust rooms are designed to automatically stop all operating diesel generator room exhaust fans upon a drop in room exhaust air temperature to below 60°F, and to automatically start the exhaust fans upon a room temperature rise to 80°F. The thermostats will also start the standby exhaust fan during diesel generator operation, when the room exhaust air temperature exceeds 80°F.

.5.2.1.3 Safety Evaluation A functional analysis and a failure modes and effects analysis have shown that the Diesel Generator Building ventilation system has the capabilities needed for normal operations and for accident mitigation. The functional analysis shows that:

(1) Adequate ventilation is provided to achieve acceptable airflow patterns and environmental conditions for optimum equipment operation during all operational modes. See Section 9.4.5.2.1.1.

(2) The battery area is adequately ventilated (except for system shutdown after a CO2 system actuation signal) to prevent hydrogen buildup in the diesel generator room.

The failure modes and effects analysis, as shown in Table 9.4-4, confirms that:

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-31

(1) During diesel generator operation, low air flows through the fans serving the diesel generator room and generator and electrical panels is detected by a flow sensor. The failure will annunciate in the MCR.

(2) The lack of a dedicated battery hood exhaust fan prevents forced air circulation past the batteries. However, during the monthly testing of the diesel generator, the diesel room exhaust fans start automatically and the dampers in the diesel room exhaust opening open for adequate airflow to pass through the diesel generator room to prevent a buildup of hydrogen gas above 2% by volume.

(3) A failure of an electrical board room exhaust fan, and the resulting heat buildup in the room to above 110°F, may cause loss of the associated diesel generator. The redundant train diesel generator provides power to safely shut down the unit.

(4) Essential portions of this system remain functional during and after a seismic event because of their design to Seismic Category I requirements.

Nonessential portions of this system and other systems located close to essential components are designed to Seismic Category I(L) requirements to prevent their failure from precluding operation of essential system components.

(5) During flooding conditions, all essential components of this system will remain functional because they are located above the maximum possible flood level.

(6) During tornadoes, the essential components of the system remain functional because they are located in a Seismic Category I structure that is designed to resist damage by tornado missiles. For tornado depressurization mitigation, intake, and exhaust dampers are opened to assist in pressure equalization.

(7) Upon loss of offsite power, each diesel generator provides emergency electrical power to its associated ventilation components. All are connected to their respective diesel generator engineered safety power supply, so operation of a diesel generator assure power to the corresponding fans.

.5.2.1.4 Tests and Inspections The diesel generator building ventilating and heating systems are accessible for periodic inspection. This system is tested initially as part of the preoperational test program. After maintenance or modification activities that affect a system function, testing is performed as necessary to reverify the system or component operation. See section 14.2 for testing acceptance criteria.

2 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

.5.2.2 Additional Diesel Generator Building (Not required Unit 1 operation)

.5.2.2.1 Design Bases The additional diesel generator building ventilating system is required to be operable to maintain the C-S D.G. operable when the C-S D.G. is substituted for any of the four original D.G. units. The diesel unit is served by an independent ventilation system.

Each subsystem of the ADGB ventilation system maintains a proper environment for the operation of safety-related components, and/or provides personnel comfort.

The additional diesel engine room ventilation subsystem consists of two room exhaust fans.

One diesel generator room exhaust fan automatically starts upon diesel startup. The second exhaust fan starts when the upper setpoint of a temperature switch mounted in the air exhaust room is reached, or on low flow of the first fan. The temperature switches mounted in the air exhaust room monitor the temperature of the air as it leaves the diesel generator room. These switches may actuate either room exhaust fan upon detection of high diesel generator room temperature conditions or may deenergize either fan, if necessary, in order to maintain the diesel generator room exhaust temperature between 50°F and 120°F.

The janitor closet is ventilated by a manually controlled exhaust fan. The 6.9kV board room, 480V Auxiliary Board Room and pipe gallery, fire protection room, corridor, fuel oil transfer pump room, fuel oil transfer room and transformer room are ventilated by manually controlled fans. The muffler room is ventilated as required to remove heat during warm weather. Muffler room exhaust fan is manually operated from hand switches located on the electrical board that serves the particular fan, or start along with the diesel when in the auto mode.

Three types of dampers are used in the diesel generator ventilation system. Fire dampers, provided in each air supply and exhaust openings to the 6.9kV board room, 480V auxiliary board room, pipe gallery, fire protection room, corridor, transformer room, and fuel oil transfer pump room, automatically close upon detection of a fire. The motor-operated damper located at the air intake to the additional diesel generator room is automatically opened whenever either of the exhaust fans starts. All fans except for the 480V auxiliary board room exhaust fan and fuel oil transfer room exhaust fan are equipped with motor operated shutoff dampers which close when their associated fan ceases operating.

The additional diesel generator room, the 480-volt board room and 6.9kV board room are ventilated to maintain room temperatures less than or equal to design maximum of 120°F when outdoor air entering the room is 95°F and the diesel generator is in operation. Remaining areas of the additional Diesel Generator Building are ventilated using the method of room volume changes. Minimum environmental temperatures are maintained as required during low outside temperature by means of thermostatically controlled electric unit heaters when the transformer and 6.9kV board room and the 480V auxiliary board room exhaust fans are shut down.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-33

Because the additional Diesel Generator Building contains no sources of potential radioactivity, there are no safety-related airflow directions that must be maintained and no required radiation monitors.

The additional Diesel Generator Building is a Seismic Category I structure that is designed to withstand the effects of tornado missiles and flood. The additional diesel generator room exhaust fans, the 480V auxiliary board room exhaust fan, transformer and 6.9 kV board room exhaust fan, and all associated ductwork, fittings, and dampers are located within the building and are designed to meet Safety Class 2b and Seismic Category I requirements. These fans, their associated controls, and motor-operated dampers are connected to emergency power. The use of concrete air intake and exhaust hoods provides additional protection from the effects of missiles. The 480V Auxiliary Board Room air intake vent, which is mounted on the roof of the building, is not protected against damage by tornado-generated missiles. However, provisions have been made for operator action to restore ventilation cooling to the board room in the event of a tornado warning when the Additional Diesel Generator Unit has been aligned to replace one of the four Diesel Generator Units.

.5.2.2.2 System Description The additional diesel generator building heating and ventilating systems are shown on Figures 9.4-22A through 9.4-22C. Two diesel generator room exhaust fans, one fuel oil transfer room exhaust fan, one transformer and 6.9kV room exhaust and one 480 V auxiliary board room exhaust fan are located in the air exhaust room at elevation 760.5 for the additional diesel generator unit. These fans discharge to the outdoors.

Fresh air is introduced through the air intake room and drawn into the corresponding diesel generator room. Following absorption of the heat load in the room the air is drawn into the air exhaust room by the room exhaust fan(s) and is discharged through the air exhaust hood.

The 480V auxiliary board room is ventilated by a centrifugal fan which draws air from the outside through the roof mounted air intake. The transformer and 6.9kV board rooms are ventilated by a centrifugal fan which draws air from the air intake room.

Other building exhaust fans provide individual ventilation for the janitor closet, fuel oil transfer pump room, and muffler room.

The thermostatically controlled electric unit heaters located within the diesel generator room are designed to maintain 50°F minimum temperature. Electric unit heaters located within the corridor, 480 V auxiliary board room, 6.9kV board room, pipe gallery, transformer room, and fire protection room are designed to maintain normal temperature within these areas at not less than 40°F.

Thermostats in the diesel generator air exhaust room are designed to automatically stop all operating diesel generator room fans upon a drop in room exhaust air temperature to below 60°F, and to automatically start the exhaust fans upon room temperature rise to 80°F. The thermostats also start the standby exhaust fan, during diesel generator operation, when the room exhaust air temperature reaches 80°F.

4 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

.5.2.2.3 Safety Evaluation A functional analysis and a failure modes and effects analysis have shown that the additional diesel generator building ventilation system has the capabilities needed for normal operations and for accident mitigation. The functional analysis shows that:

(1) Adequate ventilation is provided to achieve acceptable airflow patterns and environmental conditions for optimum equipment operation during all operational modes. See Section 9.4.5.2.2.1.

The failure modes and effects analysis, as shown in Table 9.4-4 indicates that:

(1) During diesel generator operation, low air flows through the fans serving the diesel generator room are detected by a flow sensor. The failure will annunciate in the MCR.

(2) A failure of an electrical board room exhaust fan, and the resulting heat buildup in the room to above 104°F, may cause loss of the respective diesel generator. The redundant train diesel generator provides power to safely shut down the unit.

(3) Essential portions of this system remain functional during and after a seismic event because of their design to Seismic Category I requirements.

Nonessential portions of this system and other systems located close to essential components are designed to Seismic Category I(L) standards to prevent their failure from precluding operation of essential system components.

(4) During flooding conditions, all essential components of this system remain functional because they are located above the maximum possible flood level.

(5) During tornadoes, all essential components of the system remain functional because they are in a Seismic Category I structure that is designed to resist damage by tornado missiles. The 480v Auxiliary Board Room air intake vent, which is mounted on the roof of the building, is not protected against damage by tornado-generated missiles. However, provisions have been made for operator action to restore ventilation cooling to the board room in the event of a tornado warning when the Additional Diesel Generator Unit has been aligned to replace one of the four Diesel Generator Units. During a tornado warning, the system intake and exhaust dampers are opened to assist in pressure equalization to prevent system damage due to tornado depressurization.

(6) When the additional diesel generator is substituted for any one of the normally aligned units it provides emergency electrical power to its associated ventilation components. All are connected to additional diesel generator engineered safety power supply, so operation of the additional diesel generator assures power to the corresponding fans.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-35

.5.2.2.4 Tests and Inspections The Additional Diesel Generator Building ventilating and heating systems are accessible for periodic inspection. This system is tested initially as part of the preoperational test program. After maintenance or modification activities that affect a system function, testing is performed, as necessary, to reverify the system or component operation.

.5.3 Auxiliary Building Safety Features Equipment Coolers

.5.3.1 Design Bases The auxiliary building safety features equipment coolers are designed to maintain acceptable environmental conditions for (1) personnel access, operation, inspection, maintenance and testing and (2) the protection of safety-related mechanical and electrical equipment and controls. The system utilizes fan/coil type safety-related air cooling units. Air cooling units are provided for the following rooms and areas:

(1) Residual heat removal pump room (2) Safety injection pump room (3) Containment spray pump room (4) Centrifugal charging pump room (5) Reciprocating charging pump room*

(6) Unit 1 auxiliary feedwater and component cooling water pumps area (7) Unit 2 auxiliary feedwater and boric acid transfer pumps area (8) Component cooling water booster and spent fuel pool pumps area (9) Emergency gas treatment system filter room (10) Elevation 692.0 penetration rooms (11) Elevation 713.0 penetration rooms (12) Elevation 737.0 penetration rooms (13) Pipe chases

• Not safety-related All air coolers listed above, except the reciprocating charging pump coolers (indicated with an asterisk), are engineered safety features equipment and are provided with coordinated emergency power and ERCW water sources (see Sections 8.3 and 9.2).

Pumps 1 through 5 in the above list are each located in a separate room with their corresponding cooler. Safety-related pump rooms are paired with a 100% redundant 6 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

room containing another pump/cooler set. Pumps and equipment listed in Items 6 through 13 are each provided with two 100% coolers in the room/area with one kept on standby. In addition to the above coolers, this system includes two 100%

emergency exhaust fans, one safety-related and the other nonsafety-related, in each turbine-driven auxiliary feedwater pump room. Each of these fans is capable of providing the required air flow in the room for the volume changes method of cooling.

Rooms and areas containing safety feature equipment are ventilated by airflows induced by the building ventilation exhaust subsystem during normal plant operation and when equipment is not required to operate. All air cooling units are thermostatically controlled to automatically operate upon room temperature rise above the setpoint. Air cooling units for pumps 1 through 4 will automatically start to provide the necessary additional cooling in the space whenever their associated pumps are operated. All other coolers for engineered safety feature equipment will automatically start on an Auxiliary Building isolation signal. A thermostat, located near the return airflow to each cooler, allows the cooler to remain in operation until the low limit temperature setpoint is reached. The cooling water valve and fan are interlocked to operate together for all coolers, except for the residual heat removal and centrifugal charging pump rooms, whose cooling water valves are electrically disconnected in the open position due to 100 CFR 50 Appendix R considerations.

The safety features equipment ventilation system is designed to maintain temperatures within the range for which the equipment is environmentally qualified, to ensure that equipment and components are not exposed to environmental conditions that could degrade the operability of safety-related equipment.

All components of this system, including air cooling units, fans, ductwork, dampers, valves, and grilles, are designed to meet Seismic Category I and Safety Class 2b requirements. The system is completely enclosed in a Seismic Category I structure that is designed against flood and tornado missile threats.

.5.3.2 System Description The Auxiliary Building safety feature coolers are shown on Figures 9.4-10, 9.4-13, 9.4-14, 9.4-16, 9.4-26, and 9.4-27. The individual coolers are listed below:

Number RHR Pump Room 4 Safety Injection Pump Room 4 Containment Spray Pump Room 4 Centrifugal Charging Pump Room 4 Reciprocating Charging Pump Room 2 Unit 1 Auxiliary Feedwater and Component 2 Cooling Water Pumps CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-37

Number Unit 2 Auxiliary Feedwater and Boric Acid 2 Treatment Pumps Emergency Gas Treatment Room 2 Component Cooling Water Booster and Spent 2 Fuel Pool Pumps Pipe Chases 4 Unit 1, elevation 692.0 Penetration Room 2 Unit 2, elevation 692.0 Penetration Room 2 Elevation 713.0 Penetration Rooms 4 Elevation 737.0 Penetration Rooms 4 The turbine-driven auxiliary feedwater pump rooms are normally cooled by the auxiliary building general ventilation system. For emergency ventilation, two roof ventilator type exhaust fans are located on the roof of each room, venting into the general spaces of the Auxiliary Building. One of the two fans per room is designed to operate on 115v, 60 Hz ac emergency power while the other is designed for 115V dc station vital battery power. The ac-powered fan is nonsafety-related and the dc-powered fan is safety-related. Both fans in each room are thermostatically controlled to automatically operate upon room temperature rise above 95°F. The dc powered fan also automatically runs upon pump start. Each fan is rated at 1200 cfm and designed to circulate a sufficient quantity of building air through their rooms to limit the maximum temperature rise to approximately 20°F above ambient.

.5.3.3 Safety Evaluation A functional analysis and failure modes and effects analysis have shown that the Auxiliary Building safety features coolers have the capabilities needed for normal operations and for accident mitigation. These are described in the paragraphs that follow.

A functional analysis of the system shows that:

(1) Adequate ventilation is provided during normal operations by the auxiliary building general ventilation system. When the applicable equipment is operating, the safety features equipment area and turbine-driven auxiliary feedwater pump room fans provide adequate temperature control to assure reliable equipment operation.

(2) The containment isolation Phase A signal, high radiation in the spent fuel pool area, and high air temperature in the Auxiliary Building air intake provide for a two-train isolation signal for the Auxiliary Building. Isolation of the general ventilation system, described in Section 9.4.3, results in the disruption of normal airflow patterns.

8 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

(3) After the building is isolated from the environment, airflow patterns and air cleanup operations appropriate for accident mitigation during the accident mode of operation are established and maintained by the ABGTS, as described in Section 6.2.3.

The failure modes and effects analysis, as shown in Table 9.4-3, indicates that:

(1) The safety-related radiation monitors in the Auxiliary Building refueling area provide redundant signals, for isolation of the Auxiliary Building.

(2) Each ESF pump space is cooled by an ESF cooler. During accident conditions, cooling of the safety features equipment is provided by the safety features equipment coolers. In the event of failure of one cooler, its corresponding redundant cooler is available to assume the required cooling load.

(3) During all modes of operation, a fan failure in the turbine-driven auxiliary feedwater pump room causes the thermostatically operated standby fan to assume the ventilation load.

(4) Failure of any portion of this system as the result of a seismic event is prevented by use of only Seismic Category I components in this system and Seismic Category I or I(L) components in nearby systems.

(5) During the accident mode of operations, emergency electrical power is provided to the ESF pumps and their corresponding coolers or fans. In the event one emergency power train fails, the essential safety-related functions of the system are accomplished by the redundant parts of the system powered by the remaining power train.

(6) Water is supplied to each cooler from the ERCW system described in Section 9.2.1. Failure of one ERCW supply train, and the resulting failure of the coolers supplied by that train, will not prevent the redundant coolers, supplied by a different ERCW train from supporting shutdown of the reactor unit.

.5.3.4 Inspection and Testing Requirements The Auxiliary Building safety features coolers are designed to be available for continuous operation and are accessible for periodic maintenance. The system is tested initially as part of the preoperational test program. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation. See Section 14.2 for testing acceptance criteria.

.6 Reactor Building Purge Ventilating System

.6.1 Design Bases The reactor building purge ventilating system is designed to maintain the environment in the primary and secondary containment within acceptable limits for equipment operation and for personnel access during inspection, testing, maintenance, and CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-39

refueling operations; and to provide a filtration path for any outleakage from the primary containment to limit the release of radioactivity to the environment.

The purge function of the reactor building purge ventilating system is not a safety-related function. However, the filtration units are required to provide a safety-related filtration path following a fuel-handling accident.

The design bases include provisions to:

(1) Supply fresh air for breathing and contamination control when the primary containment or annulus is occupied.

(2) Exhaust primary containment and annulus air to the outdoors whenever the purge air supply system is operated.

(3) Clean up containment exhaust during normal operation by routing the air through HEPA-carbon filter trains before release to the atmosphere to keep releases well below 10 CFR 20 limits and to comply with 10 CFR 50 Appendix I.

(4) Provide a reduced quantity of ventilating air to permit occupancy of the instrument room during reactor operation. The provisions for 1, 2, and 3 above will apply.

(5) Assure closure of primary and secondary containment isolation valves following accidents which result in the initiation of a containment ventilation isolation signal.

(6) Assure closure of the system air intake dampers, which form part of the ABSCE (see Section 6.2.3.2.1), upon receipt of a signal for Auxiliary Building isolation.

Items 5 and 6 above are safety-related functions.

The primary containment penetrations for the ventilation supply and exhaust subsystems are designed to primary containment structural standards. These are discussed in detail in Section 6.2.4.

The containment purge system is sized to maintain an acceptable working environment within the containment during all normal operations. The system has the capabilities to provide a filtration path for outleakage from the primary containment, and clean up containment atmosphere following a design basis accident.

The controls are designed to have simultaneous starting and stopping of the matching supply and exhaust equipment and to initiate an automatic shutdown and isolation upon receipt of the containment ventilation isolation signal.

In addition, purge air supply fans will shut down and the ABSCE isolation dampers in purge air supply ducts will close on an ABI signal.

0 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

The containment purge air exhaust cleanup equipment assures that activity released inside containment from a refueling accident or a LOCA and prior to containment isolation, is processed through both HEPA filters and carbon adsorbers before release to the atmosphere. Fuel handling operations inside the primary containment are constrained by the operability requirement for the containment purge air clean-up units contained in the plant technical specifications.

The primary containment purge ventilating system components are designed or qualified to meet Seismic Category I requirements, except all purge ductwork within the containment, up to the inboard isolation valves, and the supply air ductwork from the downstream flange of the ABSCE isolation dampers to the upstream flange of the Shield Building isolation valves, which are designed to meet Seismic Category I(L) requirements. The above safety-related equipment was purchased in compliance with Quality Assurance procedures.

The primary containment exhaust is monitored by redundant fast response radiation detectors which provide automatic containment purge system isolation upon detecting the setpoint radioactivity in the exhaust air stream. The containment purge isolation valves automatically close upon the actuation of a containment ventilation isolation signal whenever the primary containment is being purged during normal operation or upon manual actuation from the main control room.

The system air supply and exhaust ducts are routed through the secondary containment to several primary containment penetrations. Two air supply locations are provided for each of the upper and lower compartments and one for the instrument room. Air is supplied to areas of low potential radioactivity and is allowed to flow to the air pickup exhaust points in areas of higher potential radioactivity. The air pickup points, located to exhaust air from the lower compartment and instrument room, also provide an air sweep across the surface of the refueling canal.

.6.2 System Description The reactor building purge ventilating system is shown schematically in Figures 9.4-28 to 9.4-30. One complete and independent reactor building purge ventilating system is provided for each unit.

This ventilating system provides mechanical ventilation of the primary containment, the instrument room located within the containment, and the annulus or secondary containment located between the Containment and Shield Building. The system is designed to supply fresh air for breathing and contamination control to allow personnel access for maintenance and refueling operations. The exhaust air is filtered to limit the release of radioactivity to the environment.

During power operation, cooling of the reactor building upper compartment, lower compartment, and control rod drive mechanisms is accomplished by the air cooling systems discussed in Section 9.4.7. The annulus is normally maintained at a negative pressure by the annulus vacuum control subsystem of the emergency gas treatment system as discussed in Section 6.2.3.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-41

The containment upper and/or lower compartments are purged with fresh air by the reactor building purge system before occupancy. The annulus can be purged with fresh air during reactor shutdown or at times when the annulus vacuum control system of the emergency gas treatment system is shut down. The instrument room is purged with fresh air during operation of the reactor building purge system or is separately purged by the instrument room purge subsystem.

Each purge system consists of two trains, each designed to provide 50% of the capacity required for normal operation. Each train contains an air supply fan, an air exhaust fan, a cleanup filter unit, containment isolation valves, system air flow control valves, and all necessary ductwork. The system also includes single air supply distribution and air exhaust collection subsystems as well as an instrument room supply fan and an instrument room exhaust fan.

The purge air supply fans are located in the penetration room at elevation 737.0 in the Auxiliary Building. Filtered fresh air, heated when required, is taken from the Auxiliary Building air supply systems located in the mechanical equipment rooms at elevation 737.0. These centrifugal fans have a total system flowrate requirement of 22,949 ft3/min.

The filtered air is discharged to the outdoors by means of the Shield Building exhaust vent located in the annular space of the Reactor Building and extending through the roof of the Reactor Building. The purge air exhaust fans are centrifugal type and belt-driven, with a combined flow of 22,949 ft3/min. The air cleanup units are described in Section 6.5.1.

Annulus purging air is taken from system ducts and routed through the annulus. The air supply and exhaust duct openings are located approximately 180° apart for maximum ventilation.

To permit personnel access to the instrument room during reactor operation or during purge system shutdown, the room can be purged by the instrument room purge subsystem fans. These supply and exhaust fans are located alongside the main system supply and exhaust fans and use the main system ducts and one of the filter trains. Butterfly valves are positioned to allow only the instrument room to be served.

Each purge system containment penetration is provided with both inboard and outboard air-operated isolation butterfly valves designed for minimum leakage in their closed position. A similar type of valve is mounted in each purge supply and exhaust air opening for the annulus, and in each of the main supply and exhaust ducts located exterior to the Shield Building. The purge air supply line is provided with two air-operated isolation dampers in series for ABSCE isolation. Each of the above butterfly valves and the intake dampers are designed to fail closed and are normally closed during purge system shutdown. See Section 6.2.4 for more on the containment isolation system.

The single air supply duct serving the two purge air supply fans and the instrument room supply fan is provided with two isolation dampers. These dampers are air operated, normally closed, failed closed dampers which close automatically on receipt 2 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

of auxiliary building isolation or high radiation in refueling area signals. These dampers establish the boundary for the auxiliary building secondary containment enclosure.

See Section 6.2.3.

Since the annulus is maintained at a 5-inch water gauge negative pressure by the annulus vacuum control system, the annulus portion of the purge system ducts is maintained at the negative pressure by four 1/2-inch leakoffs. This arrangement is designed to prevent containment contamination leakage from escaping through the purge system ducts into the Auxiliary Building.

The purge function of the reactor building purge ventilation system is not a safety-related function. However, the filtration units are required to provide a safety-related filtration path following a fuel-handling accident. The primary containment isolation valves and intermediate piping of the RBPVS are designed in accordance with ANS safety class 2A; other portions are designated ANS safety class 2B except the purge fans, all purge ductwork within the containment, purge supply air ductwork from the ABSCE boundary, fire protection, and drain piping. The instrument room purge subsystem is not an engineered safety feature, and credit for a LOCA or a fuel-handling accident is not claimed.

Containment ventilation isolation signals automatically shut down the fan systems and isolate the purge systems by closing their respective dampers and butterfly valves.

Each primary containment purge system isolation butterfly valve is designed for fail safe closing within 4 seconds of receipt of a closure signal for penetrations X-4, X-5, X-6, X-7, X-9A, X-9B, X-10A, X-10B, X-11, and X-80. The purge containment isolation valve locations and descriptions are given in Table 6.2.4-1. Each valve is provided with an air cylinder valve operator, control air solenoid valve, and valve position indicating limit switches.

Smoke detectors, located in the Auxiliary Building air intake and the general ventilation supply ducts, shut down the purge air supply and the incore instrument room purge supply fans and their isolation dampers.

.6.3 Safety Evaluation Functional analyses and failure modes and effects analysis have shown that the reactor building purge ventilating system meets the containment isolation requirements. The filtration units and associated exhaust ductwork provide a safety-related filtration path following a fuel-handling accident.

A functional analysis of the system shows that:

(1) During normal operation, adequate fresh air is provided for breathing and for contamination control when the primary or secondary containment (annulus) is occupied.

(2) Primary and secondary containment exhaust air is cleaned up during normal operations and following a fuel handling accident.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-43

(3) Purge supply and exhaust fan operations cease and isolation dampers in the intake and exhaust ducting close when the system is in the accident mode of operation.

(4) Three signals automatically cause the system to change from the normal purge mode to the accident isolation mode. These signals, including the high radiation signal from the radiation monitors located in the purge air exhaust ductwork, initiate a containment ventilation isolation signal.

The failure modes and effects analyses show that:

(1) Two filtration exhaust paths are provided to assure that particulate releases are within 10CFR100 guidelines following a fuel-handling accident and prior to closure of the associated isolation valves.

(2) Each purge supply and exhaust line is equipped with two primary containment isolation valves, each connected to different control and power trains. Failure of one train does not prevent the remaining isolation valve from providing the required isolation capability.

(3) Essential portions of the system remain functional after a seismic event because of their design to Seismic Category I requirements. Nonessential portions of the system and other systems located close to essential components and not designed to Seismic Category I standards are designed to meet Seismic Category I(L) requirements to prevent their failure from precluding operation of essential safety-related equipment.

(4) All essential equipment is located above the maximum possible flood level in a Seismic Category I building that is designed to resist tornado missiles.

(5) A loss of offsite power causes closure of the isolation valves.

.6.4 Inspection and Testing Requirements Before power operation, tests are conducted to assure that the reactor building purge ventilation system performs as designed. The system is tested initially as part of the preoperational test program. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operation. Purge system containment penetration isolation valves are tested for inplace closing speed and leak tested in the closed position to comply with the requirements of 10 CFR 50, Appendix J. The inspection and testing of these valves is discussed in Section 6.2.4.

Details of the testing program for the air-cleanup units are included in Section 6.5.

Automatic shutdown and isolation of the primary and secondary containment ventilation purge systems upon containment isolation are confirmed periodically.

4 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

.7 Containment Air Cooling System

.7.1 Design Bases The containment air cooling systems are designed to maintain acceptable temperatures within the reactor building upper and lower compartments, reactor well, control rod drive mechanism (CRDM) shroud, and instrument room for the protection of equipment and controls during normal reactor operation and normal shutdown. The instrument room is mechanically cooled to permit personnel access during normal reactor operation.

The lower compartment air cooling system, together with operation of the CRDM air cooling system, is designed to maintain a maximum air temperature of 120°F in most lower compartment spaces during normal reactor operation. These spaces include the steam generator and pressurizer compartments, the space below the reactor vessel, the space around the reactor vessel, the spaces around the reactor vessel nozzles and supports and the upper reactor cavity well space around the CRDM shroud. Four 33-1/3% capacity fan coil assemblies are provided to allow three or less to operate during reactor normal operation with one or more on standby. During upset, emergency, and faulted plant conditions which result in the plant being in a hot standby condition for an extended period of time, a minimum of two lower compartment cooler fans operate to recirculate air in the lower compartment spaces. See Section 6.2.2.1 for detailed information.

The CRDM air cooling system is designed to operate during normal reactor operation in conjunction with the lower compartment air cooling system to maintain a maximum air temperature within the upper reactor cavity of 120°F and to route all of the reactor well air through the CRDM shroud to maintain a maximum air temperature of 185°F.

The CRDM air cooling system consists of four 50% capacity fan-coil assemblies combined into two subsystems. In each of the two subsystems one fan-coil assembly is normally operating, with the second in standby. Air drawn through the CRDM shroud is cooled by the active fan-coil assemblies to approximately 120°F and discharged into the lower compartment of the Reactor Building.

The lower compartment air cooling system manual dampers are adjusted to provide sufficient air flow through the reactor well to maintain a maximum air temperature of 120°F. When additional cooling in the lower compartment is required, an arrangement of dampers allows either or both standby CRDM fan-coil assemblies to operate to recirculate and supplement the lower compartment cooling system capacity.

The upper compartment air cooling system is designed to maintain the upper compartment at a maximum temperature of 110°F during normal reactor operation.

Four 33-1/3% capacity fan-coil assemblies are provided to allow three or less assemblies to operate with one or more on standby during normal reactor operation.

The reactor building instrument room is cooled during normal reactor operation and shutdown by either of two 100% capacity air conditioning systems. Each system is designed to automatically maintain the room air temperature at a maximum temperature of 75°F. Each system consists of a fan-coil unit located within the CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-45

instrument room, a water-chilling condensing unit and chilled water pump located in the Auxiliary Building, and the connecting chilled water piping, including containment penetration valves.

The heat sink for each lower compartment, upper compartment, and control rod drive mechanism air cooling fan-coil assembly, and for each instrument room air cooling system condensing unit, is the essential raw cooling water system.

The lower compartment cooling units and control rod drive mechanism air cooling fan-coil assemblies are energized from the emergency power system upon loss of offsite power; however, these components are not required to operate during LOCA conditions. Two of the four lower compartment cooling unit fans are required, but all four are started after 1.5 to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from the detection of a MSLB accident to recirculate air in the lower compartment dead-ended spaces. This is a safety function of the lower compartment cooling units' fans.

.7.2 System Description The containment air cooling system flow scheme is shown in Figure 9.4-28. The system's control scheme is shown in Figures 9.4-30 and 9.4-31 and the logic scheme in Figures 9.4-29 and 9.4-32 through 9.4-34. The containment air cooling system is composed of four subsystems as follows:

(1) Lower Compartment Air Cooling (2) Control Rod Drive Mechanisms (CRDM) Air Cooling (3) Upper Compartment Air Cooling (4) Reactor Building Instrument Room Air Cooling

.7.2.1 Lower Compartment Air Cooling System The four lower compartment air cooling fan-coil assemblies are located in two annular concrete chambers around the periphery of the lower compartment at floor elevation 716. Each fan-coil assembly consists of a plenum, eight air cooling coils, vaneaxial fan, backdraft damper, instruments, and controls.

These fan-coil assemblies are supplied water from the plant ERCW system. A cooling water throttling valve for each assembly is automatically controlled by a temperature indicating controller which utilizes an input from a thermocouple mounted in the assembly's return air supply and set to control the containment air temperature at 120°F (maximum). The ERCW system is described in Section 9.2.1.

Lower compartment air passes directly to each active fan-coil assembly where it is cooled and supplied through a common duct distribution system to the lower compartment spaces. The system is designed for three of the four fan-coil assemblies to operate together, with one on standby. The cooled air is supplied directly to each steam-generator compartment, pressurizer compartment, letdown heat exchanger room, main lower compartment space, and to the space below the reactor vessel.

6 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

The system is designed for two of four units to recirculate air through the lower containment and equipment compartments anytime there is a loss of normal containment cooling following any non-LOCA design basis event which results in a hot standby condition. The lower compartment cooling system is not required to operate after a LOCA. See Section 6.2.2.1 for detailed information.

.7.2.2 Control Rod Drive Mechanisms Air Cooling System The four CRDM air cooling fan-coil assemblies are located in the main lower compartment space at floor elevation 702.78. Each assembly consists of a plenum, three air cooling coils, two vaneaxial fans, in series, assembly isolating motor-operated damper, instruments, and controls. Each fan-coil assembly is designed to cool the CRDM shroud to 185°F with water from the plant ERCW system. A cooling water throttling valve for each assembly is automatically controlled by a temperature indicating controller which utilizes an input from a thermocouple mounted in the cooled air discharge to the lower compartment.

The four CRDM air cooling fan-coil assemblies are divided into two pairs. One fan-coil assembly in each pair is normally operated and the two normally operating assemblies together exhaust a total of 62,500 cfm of air from the CRDM shroud during normal reactor operation. Reactor well air exiting the shroud is cooled by the fan-coil assemblies and discharged into the lower compartment spaces.

.7.2.3 Upper Compartment Air Cooling System The four upper compartment air cooling fan-coil assemblies are located within the upper compartment at Elevation 801.69. Fan-coil assemblies consist of plenums, air cooling coils, vaneaxial fans, instruments, and controls. They are designed to maintain the upper compartment temperature at a maximum of 110°F with water from the plant ERCW system. A cooling water throttling valve for each assembly is automatically controlled by a temperature indicating controller which utilizes an input from a thermocouple mounted in the return air supply.

A portion of the upper containment air is continuously recirculated and cooled by the upper containment fan-coil assemblies. The system is designed for three of the four assemblies to operate together with one on standby.

.7.2.4 Reactor Building Instrument Room Air Cooling System The instrument room air cooling system consists of two 100% capacity air conditioning systems. Each system consists of a serviceable, packaged water chilling unit and chilled water pump located in the auxiliary building penetration room at elevation 692, a fan-coil unit with air supply duct located in the reactor building instrument room, connecting chilled water piping with double containment penetration isolation valves, and all necessary and customary control and indicating devices. Chiller condensers are cooled by ERCW.

The chilled water penetrations through the containment, numbered X64, X65, X66, and X67, are each provided with two isolation valves, one located inside and one located CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-47

outside containment for each penetration. These 2-inch valves are pneumatic-motor operated and are designed to fail closed.

.7.2.5 Controls and Instrumentation Operation of each fan-coil unit (lower compartment, upper compartment, CRDM, and instrument room) is indicated in the MCR. The upper compartment cooling system standby unit automatically starts when pressure differential to two of the four coolers is below the setpoint, or upon compartment high temperature signal. The lower compartment cooling system standby unit automatically starts when airflow is below the setpoint in two of the four fans. The CDRM cooling system standby unit automatically starts when the pressure differential is below the setpoint in any of the operating fans. The instrument room standby cooler automatically starts when airflow is below the setpoint in the operating cooler. Air temperature is continuously monitored to evaluate system performance for each of the four cooling systems. Safety-related temperature elements are mounted near the intake side air stream of each lower compartment cooler with direct read-out in the MCR. These temperature indicators are used by the operators as input for manual initiation of the air return fans and the containment spray system to maintain lower compartment temperature within limits during events in which the ERCW supplied coils are inoperable.

.7.3 Safety Evaluation The lower compartment cooling fans are operated to recirculate air through the lower containment and equipment compartments anytime there is a loss of normal containment cooling following any non-LOCA design basis event resulting in the reactor in a hot standby condition. This is a safety function. Otherwise, the containment air cooling systems are not required for maintenance of temperature limits within the primary containment in the event of an accident, and therefore, are not engineered safety features. However, the reactor containment penetration valves for the instrument room air-conditioning chilled water system have a Nuclear Safety Class designation in accordance with ANS Safety Class 2A.

The capability of assuring containment ambient temperature levels and the anticipated degradation of equipment performance if temperature levels are exceeded are discussed in Section 3.11.

To prevent damage to adjacent safety related equipment necessary for the plant safe shutdown, upper compartment and CRDM air cooling assemblies, instrument room fan-coil units, water cooled condenser portions of the instrument room water chillers, ductwork and duct supports, and chilled water piping and pipe supports are designed and installed to Seismic Category I(L) requirements, and the lower compartment cooling units (excluding cooling coils), fans, ductwork, and duct supports are designed to Seismic Category I requirements.

.7.4 Test and Inspection Requirements Air-cooling assemblies and their temperature-controlling devices which are located within the containment are tested prior to reactor operation and are generally accessible for inspection only during unit shutdown. The system is tested initially as 8 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

part of the preoperational test program. After maintenance or modification activities that affect a system function, testing is done to reverify the system or component operations. Instrument room fan-coil units, control devices, and containment-isolation chilled-water valves are accessible for periodic inspection. Water-chilling equipment, pumps, and all essential electrical starting and switchover controls located in the Auxiliary Building are available for periodic inspection.

Instrument room chilled-water containment-isolation valve testing and inspection requirements are discussed in Section 6.2.4.

.8 Condensate Demineralizer Waste Evaporator Building Environmental Control System (Not required for Unit 1 operation)

.8.1 Design Basis The Condensate Demineralizer Waste Evaporator Building (CDWEB) environmental control system (ECS) is designed to supply an acceptable ventilation airflow to the CDWEB continuously. Separate air conditioning systems provide the capability for heat removal as necessary. This ECS is designed to maintain building temperatures below 105°F when the outside temperature is 95°F.

The ventilation supply and exhaust systems maintain the building at a slight negative pressure.

Heat is supplied by electric space heaters where required. These heaters are designed to maintain the building at 50°F or higher. Heating requirements are based on an outside temperature of 15°F.

Supply and exhaust ductwork is designed in accordance with SMACNA Low Pressure Duct Standard.

Airflow is from areas of lower radioactivity potential to areas of greater radioactivity potential. Exhaust air is monitored for excessive radioactivity levels.

Fire dampers are used to prevent the spread of fire between the CDWEB and the waste package area of the Auxiliary Building.

.8.2 System Description The CDWEB ECS is shown on Figures 9.4-16 and 9.4-8.

Air induced by the CDWEB supply fan from the Waste Package Area supply duct is used for building ventilation. The ventilation air is supplied to areas of low radioactivity potential and migrates by naturally induced flow paths to progressively higher areas of contamination.

The CDWEB ventilation exhaust fan exhausts air from the area with highest contamination potential and directs it to the fuel handling area exhaust system where it is passed through a radiation monitoring station prior to its release to the atmosphere.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-49

The CDWEB utilizes one speed ventilation fans. The fans are manually controlled and operate continuously.

Additionally, separate air conditioning recirculation systems serve the potentially contaminated areas and the moderately contaminated areas.

.8.3 Safety Evaluation No nuclear safety-related systems or components are located in the CDWE Building.

Therefore a single failure within the environmental control system will not affect nuclear safety.

.8.4 Inspection and Testing Requirements The CDWEB ECS is tested initially to assure that design criteria have been met.

Continued satisfactory operation demonstrates the system capability.

.9 Postaccident Sampling Facility Environmental Control System

.9.1 Design Basis The postaccident sampling facility environmental control system (PASFECS) provides heating, and ventilation during normal plant operations and training activities. In addition, heating, ventilation, and control of airborne radiological contamination is provided during postaccident acquisition and testing of samples. This is accomplished through pressurization of the sampling areas by the ventilation system which induces air from areas of lesser to areas of greater contamination potential. The system is designed to maintain acceptable environmental conditions (60°F minimum and 104°F maximum). The PASFECS has redundant isolation capability in all ductwork which interfaces with the auxiliary building gas treatment system (ABGTS) or penetrates the auxiliary building secondary containment enclosure (ABSCE).

.9.2 System Description The PASFECS is shown on Figure 9.4-35 (Flow Diagram 47W866-15), Figure 9.4-36 (Logic Diagram 47W611-31-9), and Figure 9.4-37 (Control Diagram 47W610-31-9).

The PASFECS consists of a ventilation subsystem (PASFVS), a heating and cooling subsystem (PASFHCS), and a radiological gas treatment subsystem (PASFGTS).

.9.2.1 PASFVS During normal plant operation, ventilation air is supplied to the facility via the auxiliary building general ventilation system and an auxiliary supply fan. Exhaust air is ducted directly to the auxiliary building general ventilation system.

During postaccident conditions or sampling operations, the normal supply and exhaust systems are isolated and ventilation air is taken directly from the outside at a point on the roof of the unit 1 additional equipment building. Both the unit 1 and unit 2 systems share this common intake. A supply fan provides air to the sampling side of the facility in response to a differential pressure controller. Air is drawn from both the sample and valve gallery areas by the PASFGTS exhaust fan and routed to the exhaust duct 0 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

downstream of the ABGTS air cleanup unit. The sampling area is maintained at a positive pressure with respect to atmosphere while the valve gallery is kept at a negative pressure with respect to the sample side.

.9.2.2 PASFHCS In the normal mode of operation, supply air taken from the auxiliary building general ventilation system has already been tempered and no additional heating or cooling is required.

In the postaccident mode, incoming air is preheated in response to a duct mounted temperature switch. No cooling is provided in this mode.

.9.2.3 PASFGTS The radiological gas treatment subsystem consists of one HEPA/charcoal-type air cleanup unit located just upstream of the exhaust fan. Air supplied to the facility during postaccident conditions or sampling operations is processed through the air cleanup unit prior to being discharged to the atmosphere.

.9.3 Safety Evaluation The PASFECS is not a nuclear safety related system; however, the isolation valves and duct which interface with the ABGTS and ABSCE are designed to meet Seismic Category I requirements. These valves are also backed (by Class 1E power). All remaining portions of the system are designed to Category I(L) requirements.

.9.4 Inspection and Testing Requirements The PASFECS is pretested initially to assure that design criteria requirements have been met and periodically thereafter.

Air cleanup units are designed and tested per the requirements of NRC Regulatory Guide 1.140. Preoperational tests provide data for the initial balance of the system and verification of design flow rates. Manufactured components are tested in accordance with applicable standards for the components.

CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-51

Table 9.4-1 DELETED (DELETED) 2 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

TTS BAR (Page 1 of 7)

METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS ER ll components of Provide Total loss of Electrical Surveillance Total loss of None. See 1) Room e Intake Pumping heating during heating failure (Loss the heating Remarks. temperature is tation Ventilation the winter. of power) system verified once a shift.

ystem. Electrical resulting in quipment Room room 2) Supplemental nd Mechanical temperatures heating is provided quipment Rooms lower than if necessary to or B. design value. maintain the space temperatures above 32°F.

ER METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS WBNP-87

TTS BAR METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS ll components of Provide Loss of all Electrical Surveillance Room None. See 1) Room e Intake Pumping ventilation Supply and and/or temperatures Remarks temperature is tation Ventilation cooling during Exhaust Fans mechanical higher than verified once a shift.

ystem; Electrical the Summer concurrent with failure design value.

quipment Room operation of a 2) If the room r Mechanical Unit Heater temperatures are quipment Room A 0-HTR-30-715 above 104°F, r B or -716 in the Operator ensures Electrical that the duct heaters Equipment and unit heaters are Room "OFF" and that the supply and exhaust fans are operational.

If the fans are non-operable, non-essential loads are shed if necessary to maintain the room temperatures at less than 130°F.

WBNP-87

TTS BAR METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS ll components of Provide Operation of Electrical Surveillance Additional heat None. See 1) Room e Intake Pumping ventilation Supply and and/or added to the Remarks temperature is tation Ventilation cooling during Exhaust Fans, mechanical space. Room verified once a shift.

ystem; Electrical the Summer 0-FAN-30-714A failure temperature quipment Room & -714B, will be higher 2) If the room r Mechanical concurrent with than design temperatures are quipment Room A operation of value. above 104°F, r B Duct Heater 0- Operator ensures HTR-30-714 in that the duct heaters the Electrical and unit heaters are Equipment "OFF" and that the Room. Total supply and exhaust loss of fans are operational.

ventilation in the Mechanical Equipment Rooms.

WBNP-87

TTS BAR METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS ll components of Provide Loss of all Electrical Surveillance Room None. See 1) Room temperature e intake ventilation Supply and and/or temperatures Remarks is verified once a umping Station cooling during Exhaust Fans mechanical higher than shift.

entilation the Summer concurrent with failure design value.

ystem: Electrical operation of a 2) If the room quipment Room, Unit Heater temperatures are r Mechanical 0-HTR-30-710 above 104°F, quipment Room or -711 in Operator ensures or B Mechanical that the duct heaters Equipment and unit heaters are Room A "OFF" and that the supply and exhaust fans are operational.

If the fans are non-operable, non-essential loads are shed if necessary to maintain the room temperatures at less than 130°F.

WBNP-87

TTS BAR METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS ll components of Provide Operation of Electrical Surveillance Additional heat None. See 1) Room temperature e Intake ventilation Supply and and/or added to the Remarks is verified once a umping Station cooling during Exhaust Fans, mechanical space. Room shift.

entilation the Summer 0-FAN-30-708A failure temperature ystem; Electrical & -708B, will be higher 2) If the room quipment Room concurrent with than design temperatures are r Mechanical operation of value. above 104°F, quipment Room Duct Heater 0- Operator ensures or B HTR-30-708 in that the duct heaters Mechanical and unit heaters are Equipment "OFF" and that the Room A. Total supply and exhaust loss of fans are operational.

ventilation in the Electrical Equipment Room and Mechanical Equipment Room B.

WBNP-87

TTS BAR METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS ll components of Provide Loss of all Electrical Surveillance Room None. See 1) Room e intake ventilation Supply and and/or temperatures Remarks temperature is umping Station cooling during Exhaust Fans mechanical higher than verified once a shift.

entilation the Summer concurrent with failure design value.

ystem: Electrical operation of a 2) If the room quipment Room, Unit Heater temperatures are r Mechanical 0-HTR-30-712 above 104°F, quipment Room or -713 in Operator ensures or B Mechanical that the duct heaters Equipment and unit heaters are Room B "OFF" and that the supply and exhaust fans are operational.

If the fans are non-operable, non-essential loads are shed if necessary to maintain the room temperatures at less than 130°F.

WBNP-87

TTS BAR METHOD OF OMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON ENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS ll components of Provide Operation of Electrical Surveillance Additional heat None. See 1) Room e Intake ventilation Supply and and/or added to the Remarks temperature is umping Station cooling during Exhaust Fans, mechanical space. Room verified once a shift.

entilation the Summer 0-FAN-30-709A failure temperature ystem; Electrical & -709B, will be higher 2) If the room quipment Room concurrent with than design temperatures are r Mechanical operation of value. above 104°F, quipment Room Duct Heater 0- Operator ensures or B HTR-30-709 in that the duct heaters Mechanical and unit heaters are Equipment "OFF" and that the Room B. Total supply and exhaust loss of fans are operational.

ventilation in the Electrical Equipment Room and Mechanical Equipment Room A.

WBNP-87

TTS BAR WBNP-87 THIS PAGE INTENTIONALLY BLANK

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-PMCL-30-180- Provides Fails to start, Mechanical Status monitor light in Loss of cooling None. Train B 1. Train A and Train B pump/cooler sets are in A cooling air to fails while failure; Train A MCR for 1-FCV-67-176-A to SIP 1A-A SI Pump is not separate rooms. Review of schematics for the SI Pump 1A- running; power failure; fully open (1-ZS-67-176). room with the affected by the Train A and B coolers shows the trains to be Safety Injection A Room Spuriously auto-start signal Fan motor running light on potential for failure of Train independent. The cooler automatically starts Pump 1A-A stops. failure; MCC. loss of SIP 1A- A pump room upon high temperature on 1-TS-30-180-A or SI Cooler (Train A) Operator error A. cooler, and is Pump 1A-A start; and, manually by local (handswitch 100% handswitch 1-HS-30-180.

placed in wrong redundant to position) Train A pump. 2. The Cooler Fan and the flow control valve 1-FCV-67-176-A are interlocked to operate See Remark # together.

3.

3. Train B equipment is located in SIP Room 1B.

Failure of the Train A equipment, will not adversely impact Train B SI pump operation.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-PMCL-30-179- Provides Fails to start, Mechanical Status monitor light in Loss of cooling None. Train A 1. Train A and Train B pump/cooler sets are in B cooling air to fails while failure; Train B MCR for 1-FCV-67-182 to SIP 1B-B SI Pump is not separate rooms. Review of schematics for the SI Pump 1B- running; power failure; fully open (1-ZS-67-182). room with the affected by the Train A and B coolers shows the trains to be Safety Injection B Room Spuriously auto-start signal Fan motor running light on potential for failure of Train independent. The cooler automatically starts Pump 1B-B stops. failure; MCC. loss of SIP 1B- B pump room upon high temperature on 1-TS-30-179-B or SI Cooler (Train B) Operator error B. cooler, and is Pump 1B-B start; and, manually by local (handswitch 100% handswitch 1-HS-30-179.

placed in wrong redundant to position) Train B pump. 2. The Cooler Fan and the flow control valve 1-FCV-67-182 are interlocked to operate together.

See Remark #

3. 3. Train A equipment is located in SIP Room 1A.

Failure of the Train B equipment will not adversely impact Train A SI pump operation.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-176-A Provides Fails to open, Mechanical Status monitor light in Loss of cooling None. Train B 1-FCV-67-176-A flowpath for stuck closed failure; Opening MCR (1-ZS-67-176) water to SIP SI Pump is not FCV fails open on loss of power or air.

Essential Raw cooling water signal failure 1A-A pump affected by the Cooling Water from the room cooler failure of Train Flow Control ERCW with the A pump room Valve for the Header 1A to potential for cooler, and is Safety Injection the cooler for loss of SIP 1A- 100%

System Pump Pump 1A-A A. redundant to 1A-A Cooler. Train A pump.

1-FCV-67-182-B Provides Fails to open, Mechanical Status monitor light in Loss of cooling None. Train A 1-FCV-67-182-B flowpath for stuck closed failure; Opening MCR (1-ZS-67-182) water to SIP SI Pump is not FCV fails open on loss of power or air.

Essential Raw cooling water signal failure 1B-B pump affected by the Cooling Water from the room cooler failure of Train Flow Control ERCW with the B pump room Valve for the Header 1B to potential for cooler, and is Safety Injection the cooler for loss of SIP 1B- 100%

System Pump Pump 1B-B B. redundant to 1B-B Cooler. Train B pump.

1-PMCL-30-175- Provides Fails to start, Mechanical Fan motor running light on Loss of cooling None. Train A and Train B RHR pump/cooler sets are in A cooling air to fails while failure; Train A MCC. water to RHR Train B RHR separate rooms. Review of the schematics for RHR Pump running; Power failure; Pump 1A-A Pump is not the Train A and Train B coolers shows the trains Residual Heat 1A-A Room. Spuriously Auto-start Room cooler affected by the to be independent. The cooler is started Removal Pump stops. signal failure; with the failure of Train automatically upon high temperature at 1-TS 1A-A Cooler Operator error potential loss A Pump Room 175-A, or RHR Pump 1A-A start; Manually by (Train A). (handswitch of RHR Pump Cooler and is local handswitch 1-HS-30-175.

placed in wrong 1A-A. 100%

position). redundant to Train A Pump.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-PMCL-30-176- Provides Fails to start, Mechanical Fan motor running light on Loss of cooling None. Train A Train A and Train B RHR pump/cooler sets are in B cooling air to fails while failure; Train B MCC. to RHR Pump RHR Pump is separate rooms. Review of the schematics for RHR Pump running; power failure; 1B-B Room not affected by the Train A and Train B coolers shows the trains Residual Heat 1B-B Room Spuriously auto-start signal with the the failure of to be independent. The cooler started Removal Pump stops. failure; potential loss Train B Pump automatically upon high temperature at 1-TS 1B-B Cooler Operator error of RHR 1B-B. Room Cooler, 176-B or RHR Pump 1B-B start; Manually by (Train B) (handswitch and is 100% local handswitch 1-HS-30-176.

placed in wrong redundant to position) Train A pump.

1-FCV-67-188-A Provides See 'remarks' See 'remarks' See 'remarks' column. See 'remarks' See 'remarks' 1-FCV-67-188-A has been electrically flowpath for column column. column. column. disconnected due to App. 'R' interaction to keep Essential Raw cooling water the valve permanently open.

Cooling Water from the Flow Control ERCW Valve for the Header to Residual Heat the cooler for Removal System RHR Pump Pump 1A-A 1A-A.

Cooler.

1-FCV-67-190-B Provides See 'remarks' See 'remarks' See 'remarks' column See 'remarks' See 'remarks' 1-FCV-67-190-B has been electrically flowpath for column column column column disconnected due to App. 'R' interaction to keep Essential Raw cooling water the valve permanently open.

Cooling Water from the Flow Control ERCW Valve for the Header to Residual Heat the cooler for Removal System RHR Pump Pump 1B-B 1B-B.

Cooler.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-PMCL-30-177- Provides Fails to start, Mechanical Status monitor light in Loss of cooling None. Equipment includes fan and motor.

A cooling air to fails while failure; Train A MCR for 1-FCV-67-184-A to CSP 1A-A Train B Pump Train A and Train B CS pump/cooler sets are in CS Pump running; power failure; (1-ZS-67-184). Fan motor Room with the is not affected separate rooms. Review of the schematics for Containment 1A-A Room Spuriously Auto-start running light on MCC. potential for by the failure of the Train A and B coolers shows the trains to be Spray Pump 1A- stops. signal failure; loss of CSP Train A independent. The cooler is started automatically A Cooler (Train Operator error 1A-A. pump/cooler, upon high temperature at 1-TS-30-177-A or CS A) (handswitch and is 100% Pump 1A-A start; manually by local handswitch 1-placed in wrong redundant to HS-30-177.

position) Train A pump.

The cooler and the flow control valve 1-FCV 184-A are interlocked to operate together.

1-PMCL-30-178- Provides Fails to start, Mechanical Status monitor light in Loss of cooling None. Equipment includes fan and motor.

B cooling air to fails while failure; Train B MCR for 1-FCV-67-186-B to CSP 1B-B Train A Pump Train A and Train B CS pump/cooler sets are in CS Pump running; power failure; (1-ZS-67-186). Fan motor Room with the is not affected separate rooms. Review of schematics for the Containment 1B-B Room Spuriously Auto-start running light on MCC. potential for by the failure of Train A and B coolers shows the trains to be Spray Pump 1B- stops. signal failure; loss of CSP Train B independent. The cooler is started automatically B Cooler (Train Operator error 1B-B. pump/cooler, upon high temperature at 1-TS-30-178-B or CS B) (handswitch and is 100% Pump 1B-B start; manually by local handswitch 1-placed in wrong redundant to HS-30-178.

position) Train B pump.

The cooler and the flow control valve 1-FCV 186-B are interlocked to operate together.

1-FCV-67-184-A Provides Fails to open, Mechanical Status monitor light in Loss of cooling None. 1-FCV-67-184-A fails to the open position on loss flowpath for stuck closed. failure; Opening MCR (1-ZS-67-184). to CSP 1A-A Train B CS of power or air.

Essential Raw cooling water signal failure. room with the Pump is not Cooling Water from the potential for affected by the Flow Control ERCW loss of CSP failure of Train Valve for the Header to 1A-A. A pump room Containment the cooler for cooler, and is Spray System CS Pump 100%

WBNP-87 Pump 1A-A 1A-A. redundant to Cooler. Train A pump.

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-186-B Provides Fails to open, Mechanical Status monitor light in Loss of cooling None. 1-FCV-67-186-B fails to the open position on loss flowpath for stuck closed. failure; Opening MCR (1-ZS-67-186). to CSP 1B-B Train A CS of power or air.

Essential Raw cooling water signal failure. room with the Pump is not Cooling Water from the potential for affected by the Flow Control ERCW loss of CSP failure of Train Valve for the Header to 1B-B. B pump room Containment the cooler for cooler, and is Spray System CS Pump 100%

Pump 1B-B 1B-B. redundant to Cooler. Train B pump.

1-PMCL-30-183- Provides Fails to start, Mechanical Fan motor running light on Loss of cooling None. Equipment includes fan and motor.

A cooling air to fails while failure; Train A MCC. to CC pump Train B CC Train A and Train B pump/cooler sets are in CC Pump running; power failure; 1A-A Room pump is not separate rooms. Review of schematics for the Centrifugal 1A-A Room. Spuriously Auto-start with the affected by the train A and B coolers shows the trains to be Charging Pump stops. signal failure; potential for failure of Train independent. The cooler automatically starts 1A-A Cooler Operator error loss of CC A pump/cooler, upon high temperature at 1-TS-30-183-A, or (Train A). (handswitch Pump 1A-A. and is 100% pump 1A-A start; Manually by local handswitch 1-placed in wrong redundant to HS-30-183.

position). Train A pump.

1-PMCL- Provides Fails to start, Mechanical Fan motor running light on Loss of cooling None. Equipment includes fan and motor.

30-182-B cooling air to fails while failure; Train B MCC. to CC pump Train A CC Train A and Train B pump/cooler sets are in CC Pump running; power failure; 1B-B Room pump is not separate rooms. Review of schematics for the Centrifugal 1B-B Room Spuriously Auto-start with the affected by the Train A and B coolers shows the trains to be Charging Pump stops. signal failure; potential for failure of Train independent. The cooler automatically starts 1B-B Cooler Operator error loss of CC B pump/cooler, upon high temperature at 1-TS-30-182-B or (Train B). (handswitch pump 1B-B. and is 100% pump 1B-B start; Manually by local handswitch 1-placed in wrong redundant to HS-30-182.

position) Train B pump.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-168-A Provides See 'Remarks' See 'Remarks' See 'Remarks' column See 'Remarks' See 'Remarks' 1-FCV-67-168-A is electrically disconnected to flowpath for column column column column keep the valve permanently open.

Essential Raw cooling water Cooling water from the Flow Control ERCW Valve for the Header to centrifugal the cooler for Charging Pump CC Pump Room 1A-A 1A-A.

Cooler.

1-FCV-67-170-B Provides See 'Remarks' See 'Remarks' See 'Remarks' column See 'Remarks' See 'Remarks' 1-FCV-67-170-B is electrically disconnected to flowpath for column column column column keep the valve permanently open.

Essential Raw cooling water Cooling water from the Flow Control ERCW Valve for the Header to centrifugal the cooler for Charging Pump CC Pump Room 1B-B 1B-B.

Cooler.

1-PMCL-30-190 Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train A CCS and Aux. cooling air to fails while failure; Train A MCR for 1-FCV-67-162-A redundancy in The standby ABI signal or high temperature sensed by 1-TS-FW Pump Cooler the CCS and running; power failure; (1-ZS-67-162). Indicating providing Train B Cooler 30-190A-A. In standby mode, the cooler will start 1A-A. Aux. FW Spuriously Auto-standby light on MCC for fan motor cooling air for B-B is available upon high temperature at 1-TS-30-190B-A.

pumps stops. start signal running. CCS and Aux to start on high Cooler fan motor and 1-FSV-67-162-A are space. failure; FW pumps temperature interlocked to open 1-FCV-67-162-A for ERCW Operator error space. (1-TS supply on cooler start. Review of the schematics (handswitch 190B-A) and is for the coolers A-A and B-B shows their placed in wrong 100% independence.

position) redundant to WBNP-87 the Train A cooler.

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-PMCL-30-191- Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train B ABI A cooling air to fails while failure; Train B MCR for 1-FCV-67-164-B redundancy in The standby signal or high temperature sensed by 1-TS the CCS and running; power failure; (1-ZS-67-164). Indicating providing Train A Cooler 191A-B. In standby mode, the cooler will start CCS and Aux. Aux. FW Spuriously Auto-standby light on MCC for fan motor cooling air for A-A is available upon high temperature at 1-TS-30-191B-B.

FW Pump/Cooler pumps stops. start signal running. CCS and Aux. to start on high Cooler fan motor and 1-FSV-67-164-B are 1B-B space. failure; FW pumps temperature interlocked to open 1-FCV-67-164 for ERCW Operator error space. (1-TS Supply on cooler start. Review of the schematics (handswitch 191B-B) and is for the coolers A-A and B-B shows their placed in wrong 100% independence.

position) redundant to Train B cooler.

1-FCV-67-162-A Provides Fails to open, Mechanical Status monitor light in Loss of None. 1-FCV-67-162-A fails open on loss of power or flowpath for stuck closed. failure; Opening MCR (or 1-ZS-67-162). redundancy in Train B pump air.

Essential Raw cooling water signal failure. providing space cooler is Cooling Water from the cooling to CCS not affected by Flow Control ERCW and Aux FW the failure of Valve for the Header to Pump space. Train A pump CCS and Aux. the Cooler room cooler, FW Pump Cooler for Pump 1A- and is 100%

A. redundant to 1A-A. the train A pump space cooler.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-164-B Provides Fails to open, Mechanical Status monitor light in Loss of None. 1-FCV-67-164-B fails open on loss of power or flowpath for stuck closed. failure; Opening MCR (or 1-ZS-67-164). redundancy in Train A pump air.

Essential Raw cooling water signal failure. providing space cooler is Cooling Water from the cooling to CCS not affected by Flow Control ERCW and Aux FW the failure of Valve for the Header to Pump space. Train B pump CCS and Aux. the Cooler room cooler, FW Pump Cooler for Pump B- and is 100%

B-B. B. redundant to the Train B pump space cooler.

2-CLR-30-200-A Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train B ABI cooling air to fails while failure; Train A MCR for 2-FCV-67-336 (2- redundancy in The standby signal. In standby mode, the cooler will start upon EGTS Cooler 2A- the EGTS running; power failure; ZS-67-336). Fan motor providing Train high temperature at 2-TS-30-200A-A. Cooler fan A Room Spuriously Auto-standby running light on MCC. cooling air for B Cooler is motor and 2-FSV-67-336-A are interlocked to stops. start signal the EGTS available to open 2-FCV-67-336 for ERCW supply on cooler failure; Room. start on high start. Review of the schematics for the coolers A-Operator error temperature A nd B-B shows their independence.

(handswitch (2-TS placed in wrong 207A-B) and is position) 100%

redundant to Train A cooler.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 2-CLR-30-207-B Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train B ABI cooling air to fails while failure; Train B MCR for 2-FCV-67-338 (2- redundancy in The standby signal. In standby mode, the cooler will start upon EGTS Cooler A- the EGTS running; power failure; ZS-67-338). Fan motor providing Train A Cooler high temperature at 2-TS-30-207A-B. Cooler fan A Room Spuriously Auto-standby running light on MCC. cooling air for is available to motor and 2-FSV-67-338-B are interlocked to stops. start signal the EGTS start on high open 2-FCV-67-338 for ERCW supply on cooler failure; Room. temperature at start. Review of the schematics for the coolers A-Operator error 2-TS-30-200A- A and B-B shows their independence.

(handswitch A and is 100%

placed in wrong redundant to position) Train B cooler.

2-FCV-67-336 Provides Fails to open, Mechanical Status monitor light in Loss of None. 2-FCV-67-336 fails open on loss of power or air.

flowpath for stuck closed. failure; signal MCR (2-ZS-67-336) redundancy in Train B Pump Essential Raw cooling water failure. providing cooler is not Cooling Water from the cooling to affected by the Flow Control ERCW EGTS room. failure of Train Valve for the Header to A pump room EGTS Room the A-A cooler, and is Cooler A-A. cooler for the 100%

EGTS redundant to Rooms. the Train A pump room cooler.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 2-FCV-67-338 Provides Fails to open, Mechanical Status monitor light in Loss of None. 2-FCV-67-338 fails open on loss of power or air.

flowpath for stuck closed. failure; signal MCR (2-ZS-67-338). redundancy in Train A Pump Essential Raw cooling water failure. providing cooler is not Cooling Water from the cooling to affected by the Flow Control ERCW EGTS room. failure of Train Valve for the Header to B pump room EGTS Room the B-B cooler, and is Cooler B-B cooler for the 100%

EGTS redundant to Rooms. the Train B pump room cooler.

0-PMCL-30-192- Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train A ABI A cooling air to fails while failure; Train A MCR for 1-FCV-67-213-A redundancy in The standby signal or high temperature at 0-TS-30-192A-A. In the CCS TB running; power failure; (1-ZS-67-213) Fan motor providing Train B Cooler standby mode, the cooler will start upon high CCS TB Booster Booster and Spuriously Auto-standby running light on MCC. cooling air for A-A is available temperature at 0-TS-30-192B-A. Cooler fan and Spent Fuel Spent Fuel stops. start signal CCS TB to start on high motor and 1-FSV-67-213-A are interlocked to Pit Pump Cooler Pit Cooler failure; Booster and temperature open 1-FCV-67-213-A for ERCW supply on A-A Space. Operator error Spent Fuel Pit (0-TS cooler start. Review of the schematics for the (handswitch Cooler Space 193B-B) and is coolers A-A and B-B shows their independence.

placed in wrong 100%

position) redundant to the Train A cooler.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 0-PMCL-30-193- Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train B ABI B cooling air to fails while failure; Train B MCR for 1-FCV-67-215-B redundancy in The standby signal or high temperature at 0-TS-30-193A-B. In the CCS TB running; power failure; (1-ZS-67-215). Fan motor providing Train A Cooler standby mode, the cooler will start upon high CCS TB Booster Booster and Spuriously Auto-standby running light on MCC. cooling air for A-A is available temperature at 0-TS-30-193B-B. Cooler fan and Spent Fuel Spent Fuel stops. start signal CCS TB to start on high motor and 1-FSV-67-215-B are interlocked to Pit Cooler A-A Pit Cooler B- failure; Booster and temperature open 1-FCV-67-215-B for ERCW supply on B space. Operator error Spent Fuel Pit (1-TS cooler start. Review of the schematics for the (handswitch Cooler space. 192B-A) and is coolers A-A and B-B shows their independence.

placed in wrong 100%

position) redundant to the Train B cooler.

1-FCV-67-213-A Provides Fails to open, Mechanical Status monitor light in Loss of None. 1-FCV-67-213-A fails open on loss of power or flowpath for stuck closed. failure; Opening MCR (1-ZS-67-213) redundancy in Train B Pump air.

Essential Raw cooling water signal failure. providing area cooler is Cooling Water from the cooling air to not affected by Flow Control ERCW CCS TB the failure of Valve for the Header to Booster and Train A pump CCS TB Booster the Cooler A- Spent Fuel Pit room cooler, and Spent Fuel A. Coolers space. and is 100%

Pit Cooler A-A redundant to the Train A pump area cooler.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-215-B Provides Fails to open, Mechanical Status monitor light in Loss of None. 1-FCV-67-215-A fails open on loss of power or flowpath for stuck closed. failure; Opening MCR (1-ZS-67-215) redundancy in Train A Pump air.

Essential Raw cooling water signal failure. providing area cooler is Cooling Water from the cooling air to not affected by Flow Control ERCW CCS TB the failure of Valve for the Header to Booster and Train B pump CCS TB Booster the Cooler B- Spent Fuel Pit room cooler, and Spent Fuel B. Coolers space. and is 100%

Pit Cooler A-A redundant to the Train B pump area cooler.

0-BKD-31-2956 Provides Fails to open Mechanical Local position indicator Loss of None.

flowpath for (stuck closed). failure attachment on the damper redundancy in The standby CCS TB Booster cool air flow would indicate if damper providing Train B cooler and Spent Fuel from Cooler was stuck closed cooling air to will start upon Pit Pump Cooler A-A to room. high A-A Backdraft common temperature on Damper discharge 0-TS-30-193B-headers to B.

room.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks Protects Fails to Mechanical Local position indicator None None Potential loss of, or diminished, air cooling from standby backseat (stuck failure attachment on the damper both trains. The consequences of the diversion Cooler A-A open) when would indicate if damper of cooling air flow through standby cooler are from reverse Train B Cooler was stuck open. possible damage to the Train A motor and motor air flow from B-B is running. premature trip. Automatic switchover to the running standby Train A cooler, if it is experiencing cooler B-B. reverse rotation due to damper not backseating could, upon demand, fail the motor due to overload. Therefore neither train cooler would be available to perform the system function. For this reason, the damper will be periodically checked for correct position.

0-BKD-31-2957 Provides Fails to open Mechanical Local position indicator Loss of None.

flowpath for (stuck closed). failure attachment on the damper redundancy in The standby CCS TB Booster cool air flow would indicate if damper providing Train A cooler and Spent Fuel from Cooler was stuck closed. cooling air to will start upon Pit Pump Cooler B-B to room. high B-B Backdraft common temperature on Damper discharge 0-TS-30-192B-headers to A.

room.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks Protects Fails to Mechanical Local position indicator None None Potential loss of, or diminished, air cooling from standby backseat (stuck failure attachment on the damper both trains. The consequences of the diversion Cooler B-B open) when would indicate if damper of cooling air flow through standby cooler are from reverse Train A Cooler was stuck open. possible damage to the Train B motor and motor air flow from A-A is running. premature trip. Automatic switchover to the running standby Train B cooler, if it is experiencing cooler A-A. reverse rotation due to damper not backseating could, upon demand, fail the motor due to overload. Therefore neither train cooler would be available to perform the system function. For this reason, the damper will be periodically checked for correct position.

2-PMCL-30-184- Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train A ABI A cooling air to fails while failure; Train A MCR for 2-FCV-67-217 (2- redundancy in The standby signal or high temperature at 2-TS-30-184A-A. In the AFW and running; power failure; ZS-67-217). Fan motor providing Train B Cooler standby mode, the cooler will start upon high AFW and BAT BAT space Spuriously Auto-standby running light on MCC. cooling air for B-B is available temperature at 2-TS-30-184B-A. Cooler fan Cooler Fan A-A stops. start signal AFW and BAT to start on high motor and 2-FSV-67-217-A are interlocked to failure; Space temperature open 2-FCV-67-217 for ERCW supply on cooler Operator error (2-TS start. Review of the schematics for the coolers A-(handswitch 185B-B) and is A and B-B shows their independence.

placed in wrong 100%

position) redundant to train A cooler.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 2-PMCL-30-185- Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts upon Train B ABI B cooling air to fails while failure; Train B MCR for 2-FCV-67-219 (2- redundancy in The standby signal or high temperature at 2-TS-30-185A-B. In the AFW and running; power failure; ZS-67-219). Fan motor providing Train A Cooler standby mode, the cooler will start upon high AFW and BAT BAT space Spuriously Auto-standby running light on MCC. cooling air for A-A is available temperature at 2-TS-30-185B-B. Cooler fan Cooler Fan B-B stops. start signal AFW and BAT to start on high motor and 2-FSV-67-219-B are interlocked to failure; Space temperature open 1-FCV-67-219 for ERCW supply on cooler Operator error (2-TS start. Review of the schematics for the coolers A-(handswitch 184B-A) and is A and B-B shows their independence.

placed in wrong 100%

position) redundant to train A cooler.

2-FCV-67-217 Provides Fails to open, Mechanical Status monitor light in Loss of None. 2-FCV-67-217 fails open on loss of flowpath for stuck closed. failure; Opening MCR (2-ZS-67-217) redundancy in Train B Pump room cooler power or air.

Essential Raw cooling water signal failure. providing is not affected by the failure Cooling Water from the cooling to AFW of Train A pump room Flow Control ERCW and BAT cooler, and is 100%

Valve for the Header to Space. redundant to the Train A AFW and BAT the Cooler pump room cooler.

Cooler A-A for Pump A-A.

2-FCV-67-219 Provides Fails to open, Mechanical Status monitor light in Loss of None. 2-FCV-67-219 fails open on loss of flowpath for stuck closed. failure; Opening MCR (2-ZS-67-219) redundancy in Train A Pump room cooler power or air.

Essential Raw cooling water signal failure. providing is not affected by the failure Cooling Water from the cooling to AFW of Train B pump room Flow Control ERCW and BAT cooler, and is 100%

Valve for the Header to Space. redundant to the Train B AFW and BAT the Cooler pump room cooler.

Cooler B-B for Pump B-B.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 2-BKD-31-2952 Provides Fails to open Mechanical Local position indicator Loss of None.

flowpath for (stuck closed). failure attachment on the damper redundancy in The standby Train B cooler will start Aux FW and BAT cool air flow would indicate if damper providing upon high temperature on 2-TS Pump Cooler A-A from Cooler was stuck closed cooling air to 185B-B.

Backdraft A-A to room.

Damper common discharge header to room.

Protects Fails to Mechanical Local position indicator None None Potential loss of, or standby backseat (stuck failure attachment on the damper diminished, air cooling from Cooler A-A open) when would indicate if damper both trains. The from reverse Train B Cooler was stuck open. consequences of the diversion air flow from B-B is running. of cooling air flow through running standby cooler is possible cooler B-B. damage to the Train A motor and motor premature trip.

Automatic switchover to the standby Train A cooler, if it is experiencing reverse rotation due to damper not backseating could, upon demand, fail the motor due to overload. Therefore, neither train cooler would be available to perform the system function. For this reason, the damper will be periodically checked for correct position.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 2-BKD-31-2953 Provides Fails to open Mechanical Local position indicator Loss of None.

flowpath for (stuck closed). failure attachment on the damper redundancy in The standby Train A cooler will start Aux FW and BAT cool air flow would indicate if damper providing upon high temperature on 2-TS Pump Cooler B-B from Cooler was stuck closed cooling air to 184B-A.

Backdraft B-B to room.

Damper common discharge header to room.

Protects Fails to Mechanical Local position indicator None None Potential loss of, or standby backseat (stuck failure attachment on the damper diminished, air cooling from Cooler B-B open) when would indicate if damper both trains. The from reverse Train A Cooler was stuck open. consequences of the diversion air flow from A-A is running. of cooling air flow through running standby cooler is possible cooler A-A. damage to the Train B motor and motor premature trip.

Automatic switchover to the standby Train B cooler, if it is experiencing reverse rotation due to damper not backseating could, upon demand, fail the motor due to overload. Therefore, neither train cooler would be available to perform the system function. For this reason, the damper will be periodically checked for correct position.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-CLR-30-201 Provides Fails to start, Mechanical Status monitor light in Loss of None. The cooler automatically starts cooling air to fails while failure; Train A MCR for 1-FCV-67-342-A redundancy in The standby Train B Cooler Fan 1B-B is upon Train A ABI signal or Pipe Chase the pipe running; power failure; (1-ZS-67-342). Fan motor providing available to start on high temperature (1- high temperature at 1-TS Cooler Fan 1A-A chase. Spuriously Auto-standby running light on MCC. cooling air for TS-30-202B-B) and is 100% redundant 201A-A. In standby mode, the stops. start signal the Pipe to Train A cooler. cooler will start upon high failure; Chase. temperature at 1-TS-30-201B-Operator error A. Cooler fan motor and 1-(handswitch FSV-67-342-A are interlocked placed in wrong to open 1-FCV-67-342-A for position) ERCW supply on cooler start.

Review of the schematics for the coolers A-A nd B-B shows their independence.

1-CLR-30-202-B Provides Fails to start, Mechanical Status monitor light in Loss of None. The standby Train A Cooler Fan The cooler automatically starts cooling air to fails while failure; Train B MCR for 1-FCV-67-344-B redundancy in 1A-A is available to start on high upon Train B ABI signal or Pipe Chase the pipe running; power failure; (1-ZS-67-344). Fan motor providing temperature at 1-TS-30-201B-A and is high temperature at 1-TS Cooler Fan 1-B-B chase. Spuriously Auto-standby running light on MCC. cooling air for 100% redundant to Train B cooler. 202A-B. In standby mode, the stops. start signal the Pipe cooler will start upon high failure; Chase. temperature at 1-TS-30-202B-Operator error B. Cooler fan motor and 1-(handswitch FSV-67-344-B are interlocked placed in wrong to open 1-FCV-67-344-B for position) ERCW supply on cooler start.

Review of the schematics for the coolers A-A and B-B shows their independence.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-342-A Provides Fails to open, Mechanical Status monitor light in Loss of None. 1-FCV-67-342 fails open on loss of flowpath for stuck closed. failure; Opening MCR (1-ZS-67-342) redundancy in Train B Pump power or air.

Essential Raw cooling water signal failure. providing room cooler is Cooling Water from the cooling air to not affected by Flow Control ERCW the Pipe the failure of Valve for the Pipe Header to Chase. Train A pump Chase Cooler the Cooler room cooler, 1A-A 1A-A. and is 100%

redundant to the Train A pump room cooler.

1-FCV-67-344-B Provides Fails to open, Mechanical Status monitor light in Loss of None. 1-FCV-67-344 fails open on loss of flowpath for stuck closed. failure; Opening MCR (1-ZS-67-344) redundancy in Train A Pump power or air.

Essential Raw cooling water signal failure. providing room cooler is Cooling Water from the cooling air to not affected by Flow Control ERCW the Pipe the failure of Valve for the Pipe Header to Chase. Train B pump Chase Cooler the Cooler room cooler, 1B-B 1B-B. and is 100%

redundant to the Train B pump room cooler.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-BKD-31-2925 Provides Fails to open Mechanical Local position indicator Loss of None.

flowpath for (stuck closed). failure attachment on the damper redundancy in The standby Pipe Chase cool air flow would indicate if damper providing Train B cooler Cooler 1A-A from Cooler was stuck closed cooling air to will start upon Backdraft 1A-A to Pipe Pipe Chase. high Damper Chase temperature on Header. 1-TS-30-202B-B.

Protects Fails to Mechanical Local position indicator None None Potential loss of, or diminished, air standby backseat (stuck failure attachment on the damper cooling from both trains. The Cooler 1A-A open) when would indicate if damper consequences of the diversion of from reverse Train A Cooler was stuck open. cooling air flow through standby air flow from 1B-B is running. cooler is possible damage to the running Train A motor and motor premature cooler 1B-B. trip. Automatic switchover to the standby Train A cooler, if it is experiencing reverse rotation due to damper not backseating could, upon demand, fail the motor due to overload. Therefore, neither train cooler would be available to perform the system function. For this reason, the damper will be periodically checked for correct position.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-BKD-31-2927 Provides Fails to open Mechanical Local position indicator Loss of None.

flowpath for (stuck closed). failure attachment on the damper redundancy in The standby Pipe Chase cool air flow would indicate if damper providing Train A cooler Cooler 1B-B from Cooler was stuck closed cooling air to will start upon Backdraft 1B-B to Pipe Pipe Chase. high Damper Chase temperature on Header. 1-TS-30-201B-A.

Protects Fails to Mechanical Local position indicator None None Potential loss of, or diminished, air standby backseat (stuck failure attachment on the damper cooling from both trains. The Cooler 1B-B open) when would indicate if damper consequences of the diversion of from reverse Train B Cooler was stuck open. cooling air flow through standby air flow from 1A-A is running. cooler is possible damage to the running Train B motor and motor premature cooler 1A-A. trip. Automatic switchover to the standby Train B cooler, if it is experiencing reverse rotation due to damper not backseating could, upon demand, fail the motor due to overload. Therefore, neither train cooler would be available to perform the system function. For this reason, the damper will be periodically checked for correct position.

WBNP-87

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-CLR-30-186-A Provides Fails to start, Mechanical Status monitor light in Loss of cooling None. The cooler automatically starts upon cooling air to fails while failure; Train A MCR for 1-FCV-67-346-A to Penetration The standby Train A ABI signal or high Penetration Penetration running; power failure; fully open (1-ZS-67-346). Room (El 692) Train B Cooler temperature at 1-TS-30-186A-A. In Room Cooler Room (El Spuriously Auto-start Fan motor running light on with the B-B is available standby mode, the cooler will start Fan 1A-A (Train 692) stops. signal failure; MCC. potential for to start on high upon high temperature at 1-TS A) Operator error loss of room temperature 186B-A. Cooler fan motor and 1-(handswitch equipment. (1-TS FSV-67-346-A are interlocked to placed in wrong 187B-B) and is open 1-FCV-67-346-A for ERCW position) 100% supply on cooler start. Review of the redundant to schematics for the coolers A-A nd B-Train A cooler. B shows their independence.

1-CLR-30-187-B Provides Fails to start, Mechanical Status monitor light in Loss of cooling None. The The cooler automatically starts upon cooling air to fails while failure; Train B MCR for 1-FCV-67-348-B to Penetration standby Train Train B ABI signal or high Penetration Penetration running; power failure; fully open (1-ZS-67-348). Room (El 692) A Cooler A-A is temperature at 1-TS-30-187A-B. In Room Cooler Room (El Spuriously Auto-start Fan motor running light on with the available to standby mode, the cooler will start Fan 1B-B (Train 692) stops. signal failure; MCC. potential for start on high upon high temperature at 1-TS B). Operator error loss of room temperature at 187B-B. Cooler fan motor and 1-(handswitch equipment. 0-TS-30-186B- FSV-67-348-B are interlocked to placed in wrong A and is 100% open 1-FCV-67-348-B for ERCW position) redundant to supply on cooler start. Review of the Train B cooler. schematics for the coolers A-A nd B-B shows their independence.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-346-A Provides Fails to open, Mechanical failure; Opening Status Loss of None. 1-FCV-67-346-A fails open on loss flowpath for stuck closed. signal failure. monitor light redundancy in Train B Pump of power or air.

Essential Raw cooling water in MCR (1- providing room cooler is Cooling Water from the ZS-67-346) cooling to not affected by Flow Control ERCW Penetration the failure of Valve for the Header to Room (El. 692) Train A pump Penetration the Cooler space. room cooler, Room (El. 692) for the . and is 100%

Cooler 1A-A Penetration redundant to Room the Train A Space. pump room cooler.

1-FCV-67-348-B Provides Fails to open, Mechanical failure; Opening Status Loss of None. 1-FCV-67-348-B fails open on loss flowpath for stuck closed. signal failure. monitor light redundancy in Train A Pump of power or air.

Essential Raw cooling water in MCR (1- providing room cooler is Cooling Water from the ZS-67-348) cooling to not affected by Flow Control ERCW Penetration the failure of Valve for the Header to Room (El. 692) Train B pump Penetration the Cooler space. room cooler, Room (El. 692) for the and is 100%

Cooler 1B-B Penetration redundant to Room the Train B Space. pump room cooler.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-CLR-30-196 Provides Fails to start, Mechanical failure; Train A Status Loss of cooling None. The The cooler automatically starts upon cooling air to fails while power failure; Auto-start monitor light to Penetration standby Train Train A ABI signal or high Penetration Penetration running; signal failure; Operator error in MCR for Room (El 713) B Cooler B-B is temperature (1-TS-30-196A-A). In Room Cooler Room (El Spuriously (handswitch placed in wrong 1-FCV with the available to standby mode, the cooler will start Fan 1A-A (Train 713) stops. position) 350-A fully potential for start on high upon high temperature at 1-TS A). open (1-ZS- loss of room temperature 196B-A. Cooler fan motor and 1-67-350). equipment. (1-TS FSV-67-350-A are interlocked to Fan motor 197B-B) and is open 1-FCV-67-350-A for ERCW running light 100% supply on cooler start. Review of the on MCC. redundant to schematics for the coolers A-A and Train A cooler. B-B shows their independence.

1-CLR-30-197 Provides Fails to start, Mechanical failure; Train B Status Loss of cooling None. The The cooler automatically starts upon cooling air to fails while power failure; Auto-start monitor light to Penetration standby Train Train B ABI signal or high Penetration Penetration running; signal failure; Operator error in MCR for Room (El 713) A Cooler A-A is temperature at 1-TS-30-197A-B. In Room Cooler Room (el Spuriously (handswitch placed in wrong 1-FCV with the available to standby mode, the cooler will start Fan 1B-B (Train 713) stops. position) 352-B fully potential for start on high upon high temperature at 1-TS B). open (1-ZS- loss of room temperature 197B-B. Cooler fan motor and 1-67-352). equipment. (1-TS FSV-67-352-B are interlocked to Fan motor 196B-A) and is open 1-FCV-67-352-B for ERCW running light 100% supply on cooler start. Review of the on MCC. redundant to schematics for the coolers A-A and Train B cooler. B-B shows their independence.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-350-A Provides Fails to open, Mechanical failure; Opening Status Loss of None. 1-FCV-67-350 fails open on loss of flowpath for stuck closed. signal failure. monitor light redundancy in Train B Pump power or air.

Essential Raw cooling water in MCR (1- providing room cooler is Cooling Water from the ZS-67-350) cooling to not affected by Flow Control ERCW Penetration the failure of Valve for the Header to Room (El 713) Train A pump Penetration the Cooler Space room cooler, Room (El 713) for the and is 100%

Cooler 1A-A. Penetration redundant to Room the Train A Space. pump room cooler.

1-FCV-67-352-B Provides Fails to open, Mechanical failure; Opening Status Loss of None. 1-FCV-67-352 fails open on loss of flowpath for stuck closed. signal failure. monitor light redundancy in Train A Pump power or air.

Essential Raw cooling water in MCR (1- providing room cooler is Cooling Water from the ZS-67-352) cooling to not affected by Flow Control ERCW Penetration the failure of Valve for the Header to Room (El 713) Train B pump Penetration the Cooler Space. room cooler, Room (El 713) for the and is 100%

Cooler 1B-B Penetration redundant to Room the Train B Space. pump room cooler.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-CLR-30-194-A Provides Fails to start, Mechanical failure; Train A Status Loss of cooling None. The The cooler automatically starts upon cooling air to fails while power failure; Auto-start monitor light to Penetration standby Train Train A ABI signal or high Penetration Penetration running; signal failure; Operator error in MCR for Room (El 737) B Cooler B-B is temperature at 1-TS-30-194A-A. In Room Cooler Room (El Spuriously (handswitch placed in wrong 1-FCV with the available to standby mode, the cooler will start Fan 1A-A (Train 737) stops. position) 354-A fully potential for start on high upon high temperature at 1-TS A). open (1-ZS- loss of room temperature 194B-A. Cooler fan motor and 1-67-354). equipment. (1-TS FSV-67-354-A are interlocked to Fan motor 195B-B) and is open 1-FCV-67-354-A for ERCW running light 100% supply on cooler start. Review of the on MCC. redundant to schematics for the coolers A-A and Train A cooler. B-B shows their independence.

1-CLR-30-195-B Provides Fails to start, Mechanical failure; Train B Status Loss of cooling None. The The cooler automatically starts upon cooling air to fails while power failure; Auto-start monitor light to Penetration standby Train Train B ABI signal or high Penetration Penetration running; signal failure; Operator error in MCR for Room (el 737) A Cooler A-A is temperature at 1-TS-30-195A-B. In Room Cooler Room (el Spuriously (handswitch placed in wrong 1-FCV with the available to standby mode, the cooler will start Fan 1B-B (Train 737) stops. position) 356-B (1- potential for start on high upon high temperature at 1-TS B). ZS-67-356). loss of room temperature 195B-B. Cooler fan motor and 1-Fan motor equipment. (1-TS FSV-67-356-B are interlocked to running light 194B-A) and is open 1-FCV-67-356-B for ERCW on MCC. 100% supply on cooler start. Review of the redundant to schematics for the coolers A-A and Train B cooler. B-B shows their independence.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks 1-FCV-67-354-A Provides Fails to open, Mechanical failure; Opening Status Loss of None. 1-FCV-67-354-A fails open on loss flowpath for stuck closed. signal failure. monitor light redundancy in Train B Pump of power or air.

Essential Raw cooling water in MCR (1- providing room cooler is Cooling Water from the ZS-67-354) cooling to not affected by Flow Control ERCW Penetration the failure of Valve for the Header to Room (El 737) Train A pump Penetration the Cooler Space room cooler, Room (El 737) for the and is 100%

Cooler 1A-A. Penetration redundant to Room the Train A Space. pump room cooler.

1-FCV-67-356-B Provides Fails to open, Mechanical failure; Opening Status Loss of None. 1-FCV-67-356 fails open on loss of flowpath for stuck closed. signal failure. monitor light redundancy in Train A Pump power or air.

Essential Raw cooling water in MCR (1- providing room cooler is Cooling Water from the ZS-67-356) cooling to not affected by Flow Control ERCW Penetration the failure of Valve for the Header to Room (El 737) Train B pump Penetration the Cooler Space. room cooler, Room (El 737) for the and is 100%

Cooler 1B-B Penetration redundant to Room the Train B Space. pump room cooler.

WBNP-91

TTS BAR Potential Method of Effect on Effect on Component Function Failure Mode Cause Detection System Plant Remarks Backdraft Backseat to Fails to Mechanical Failure See Remark See Remark 1. Backdraft dampers 1-BKD Dampers stop flow of backseat (Stuck #2 #2 1790 and 1-BKD-31-5093 exist so 1-BKD-31-2998 hot air Open) that a backdraft damper is provided 1-BKD-31-2999 developed in every connection from the pipe 1-BKD-31-3000 due to a chase to an adjacent room, and 1-BKD-31-3001 HELB in the determined that the single failure of 1-BKD-31-3002 pipe chase a backdraft damper (to close), when 1-BKD-31-3003 from normal HVAC continues to operate, 1-BKD-31-3004 adjacent will not result in a severe 1-BKD-31-3005 rooms and environment in the room with the 1-BKD-31-3006 maintains a failed backdraft damper.

1-BKD-31-1790 mild 2. The ABI Signal does not 1-BKD-31-3078 environment automatically isolate the normal 1-BKD-31-5093 in rooms HVAC System during a HELB. As a 1-BKD-31-3088 adjacent to result, the HELB in the pipe chase 1-BKD-31-3087 pipe chase. will not result in isolation of normal 1-BKD-31-3080 HVAC. Thus, proper air flow is 1-BKD-31-4001 maintained.

As a result, the single failure of any of the listed backdraft dampers will have no effect on the system or the plant.

WBNP-90

TTS BAR VENTILATION (Sheet 1 of 2)

Method of Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1-FAN-30-214 Provides cooling Fails to start; Mechanical failure; No direct Loss of cooling See Remarks # 3 and 1. The dc fan is intended to to the TDAFW Fails while Temperature method of air/ventilation to the 4 mitigate the effects of station Turbine-driven Pump Room running; sensing failure; detection. TDAFW Pump Room blackout on the TDAFW Auxiliary Feedwater Spuriously TDAFW Pump start from the safety- Pump Room ventilation.

Pump Room stopped. signal failure. See Remark # 2 related dc fan. During DBEs the TDAFW Ventilation Fan provides backup to the two 125V Dc Loss of all 50% motor-driven AFW cooling/ventilation to pumps. As such its the TDAFW Pump operation during DBEs would Room during loss of imply a single failure to have all ac (LOAC). already occurred; therefore, postulation of the failure of this fan is not required.

2. Local temperature indication.

3. In the event of loss of all ac the TDAFW Pump cooling is entirely dependent on the dc fan.

4. The dc fan starts automatically by either TDAFW pump start, or high temperature sensed by 1-TS-30-214. It can also be started manually.

WBNP-87

TTS BAR Method of Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1-BKD-30-3035 Provides suction Spuriously closed Mechanical failure Local position Loss of See Remark #1 1. During the loss of all ac, there will be air flow path to indicators or cooling /ventilating no cooling/ventilating capability for Backdraft Damper the operating dc damper. for TDAFW Pump TDAFW Pump room, with the possibility exhaust fan Room from dc fan. for loss of the TDAFW Pump. A non-See Remark # 2 safety, non-seismic, non- 1E ac fan is present in the room. TDAFW is the backup for the motor-driven FW and is required to operate upon failure of motor-driven FW. Thus, postulation of this failure is not required.

WBNP-87

TTS BAR WBNP-91 TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS re damper in Air Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC take Room 0- between Air fire failure System need not to be 0-603 for Train Intake Room postulated as being A-A and Diesel concurrent with fire.30-604 for Train Gen Room A-A, 0-30-605 for ain 1B-B, and 0- Closed Mechanical Diesel Gen. None (See None Redundant train diesel 0-606 for Train during other (fusible link) Room exhaust Remarks) (See Remarks) generator system is B-B modes of failure fan low flow started by operator operation alarm in Main Control Room from fans air flow switches FS 447 or FS-30-451 for Train 1A-A, and FS-30-449 or FS-30-453 for Train 1B-B FS-30-448 or FS 452 for Train 2A-A FS-30-450 or FS-30-454 for Train 2B-B WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS otor-operated To prevent air Closed (see Mechanical Diesel Gen. Loss of None (See Redundant train diesel take dampers to flow when note in failure Room exh fan ventilation of Remarks) generator system is iesel Gen. Room associated remarks) low flow alarm in associated started by operator FC0-30-443-A diesel Spurious Dampers are Main Control safety train *If closed due to spurious r Train 1A-A, 1- generator CO2 system spring- Room. From air Diesel Gen CO2 system actuation C0-30-445-B for exhaust fans actuation loaded to flow switches FS- Room. operator can verify and ain 1B-B, are open upon 30-447 or FS reopen damper.

FCO-30-444-A deenergized power loss. 451 for Train 1A-r Train 2A-A, However, A, FS-30-449 or NOTE:

FCO-30-446-B CO2 FS-30-453 for These dampers to be r Train 2B-B actuation Train 1B-B open by handswitches 1-signal can FS-30-448, 452 HS-30-447B & 1-HS close them. for 2A-A and FS- 451B for Train 1A-A 1-30-450, 454 for HS-30-449B & 1-HS 2B-B. 453B for Train 1B-B, 2-HS 30-448B and 2-HS 452B, for Train 2A-A, 2-HS-30-450B,& 2-HS-30-454B for Train 2B-B and reset the temp.

switches 1-TS-30-447A, -

447B, -451A, and -451B for Train 1A-a, 1-TS 449A, -449B, -453A, & -

453B for Train 1B-B, 2-TS-30-448A, -448B, -

452A & -452B for Train 2A-A, 2-TS-30-450A, -

450B, -454A & -454B for Train 2B-B, when tornado watch or warning is WBNP-91 declared by National Weather Service for this area.

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS re barrier Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC etween Diesel between fire failure System need not to be enerator Room Diesel Gen postulated as being Air Exhaust Room and concurrent with fire.

oom 0-30-607 Air Intake r Train 1A-A, 0- Room 0-609 for Train Closed Mechanical Diesel Gen Loss of None Redundant train diesel B-B, 0-30-608 for during other (fusible link) Room exh fan ventilation of (See Remarks) generator system is ain 2A-A, 0 modes of failure low flow alarm in associated started by operator 10 for Train 2B-B operation Main Control safety train Room from fan Diesel Gen air flow switches Room.

FS-30-447 or FS-30-451 For Train 1A-A and FS-30-449 or FS-30-453 for Train 1B-B, FS-30-448 or FS 452 for Train 2A-A, and FS 450 or FS-30-454 for Train 2B-B WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS iesel Generator Provide Fails to Electrical, Diesel Gen Loss of None Redundant train diesel oom exhaust ventilation air start; stops Mechanical Room exh fan adequate generator system is ns 1-FAN *Spurious low flow alarm in ventilation for started by operator 47 C02 Main Control maintenance of *Operator can verify if not FAN-30-451 for system Room. (Refer to design result of fire, reopen fire ain 1A-A, 1- actuation Figure 9.4-25) temperature dampers and start AN-30-449 From air flow exhaust fans from FAN-30-453 for switches FS handswitches ain 1B-B, 2- 447 or FS-30-451 AN-30-448 2- for Train 1A-A AN-30-452 for FS-30-449 or FS-ain 2A-A, and 2- 30-453 for Train AN-30-450, 1B-B FAN-30-454 for ain 2B-B FS-30-448 or FS-30-452 for Train 2A-A, and FS 450 or FS-30-454 for Train 2B-B Surveillance Fails to stop Electrical Drop in DG None Redundant train diesel on low temp Room temp generator system is available.

WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS otor-operated To prevent air Closed Mechanical Diesel Gen Loss of proper None Redundant train diesel scharge flow when during Room exh fan ventilation (See Remarks) generator system is ampers of diesel associated associated Loss of low flow alarm in control for started by operator enerator room diesel exhaust fan power Main Control maintenance of xhaust fans generator operation (dampers fail Room environmental NOTE:

FCO-30-447 for exhaust fan (see note in as-is) From air flow required temp See Note in Remarks for an 1, is remarks) switches FS Item #2 FCO-30-451 for deenergized 447 or FS-30-451 an 2, for Train 1A-A, ain 1A-A and 1- and FS-30-449, CO-30-449 for or an 1 FS-30-453 FCO-30-453 for an 2,Train 1B-B, For Train 1B-B FCO-30-448 for and FS-30-448, an 1, FS-30-452; FCO-30-452 for for Train 2A-A an 2,Train 2A-A FS-30-450 FCO-30-450 for FS-30-454 an 1 , for Train 2B-B FCO-30-454 for an 2, Train 2B-B WBNP-91

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS re dampers of Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC lec. BD Rooms between fire failure System need not to be take vent 0 Elec. BD postulated as being 95 Room & concurrent with fire.30-596 outside 30-597 30-598 Closed Mechanical Surveillance & Loss of None Redundant train diesel during other failure Maintenance ventilation of (See Remarks) generator system is modes of associated started by operator operation (See Notes in Elec. BD Room Remarks) and rise of space temp.

(See Remarks) re dampers of Fire Barrier Open during Mechanical See Remarks See Remarks See Remarks Single failures of HVAC lec. BD Rooms between fire failure System need not to be xhaust 0-30-599 Elec. BD postulated as being 30-600 Rooms & Air concurrent with fire.30-601 Exh Rooms30-602 Closed Mechanical Surveillance & Loss of None Redundant train diesel during other failure Maintenance ventilation of (See Remarks) generator system is modes of associated started by operator operation (See Notes in Elec. BD Room Remarks for Item and rise of

1. 6) space temp.

(See Remarks)

WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS lectric BD Room Provide Fails to Electrical, Surveillance & Loss of None (See Redundant train diesel xhaust fans 1- ventilation air start; stops Mechanical Maintenance ventilation of Remarks) generator system is AN-30-459 for *Spurious associated started by operator ain 1A-A, 1- CO2 system Elec. BD Room *If failures resulted from AN-30-461 for actuation and rise of spurious actuation of the ain 1B-B, 2- (See Note in space temp CO2 system, operator AN-30-460 for Remarks for Item can verify and restart the ain 2A-A, 2- #6) fans from hand switches.

AN-30-462 for ain 2B-B Operates Operator during action not Decrease of None (See winter performed space temp. Remarks per site below freezing above) operating procedure (Section 2.2)

WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS otor-operated To prevent air Closed Mechanical Surveillance & Loss of None (See Redundant train diesel scharge damper flow when during Mechanical ventilation of Remarks) generator system is Elec. BD Room associated associated associated started by operator xhaust fans 1- Elec. BD exhaust fan Elec. BD Room CO-30-459 for Room operation and rise of ain 1A-A, 1- exhaust fan space temp.

CO-30-461 for is NOTE:

ain 1B-B, deenergiized These dampers are to be FCO-30-460 for open by handswitches 0-ain 2A-A, 2- HS-30-459B CO-30-462 for or 0-HS-30-459C for Train ain 2B-B 1A-A, and 0-HS-30-461B or 0-HS-30-461C for Train 1B-B, 0-HS-30-460B or 0-HS-30-460C for Train 2A-A and 0-HS-30-462B or 0-HS-30-462C for Train 2B-B when tornado watch or warning is declared by National weather service for this area.

WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS enerator & Provide Fails to Electrical Low air flow Loss of None Redundant train diesel lectrical Panels ventilation for start; stops Mechanical alarm in Main ventilation of (See Remarks) generator system is entilation fans 1- elec. panel & Control Room via associated started by operator AN-30-491 to generator air flow switches elec. panel & to r Train 1A-A, inlet FS-30-491 for generator inlet FAN-30-493 Train 1A-A, r train 1B-B, FS-30-493 for FAN-30-492 Train 1B-B, r Train 2A-A, FS-30-492 for FAN-30-494 Train 2A-A, r Train 2B-B FS-30-494 for Train 2B-B lters for elec Filter the Clogged Accumulation Surveillance & Rise of temp in None Redundant train diesel anel ventilation ventilation air of dirt Maintenance the elec panel (See Remarks) generator system is r supply supplied to due to reduced started by operator elec panel supply of vent FLT-30-491 for air ain 1A-A, FLT-30-493 for ain 1B-B, FLT-30-492 for ain 2A-A, FLT-30-494 for ain 2B-B WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS lass 1E AC Provide Loss or Electrical Indication and Loss of power None Redundant train diesel ower Class 1E AC inadequate alarms in Main to diesel (See Remarks) generator system is power to power Control Room generator available for the plant safe safety related building shutdown portions of ventilation the diesel system safety-generator related building equipment ventilation system lass 1E power to Provide Loss or Electrical Indication and Loss of control None Redundant train diesel strumentation Class 1E inadequate alarms in main of the diesel (See Remarks) generator system is nd control power to power control room generator available for the plant safe safety- ventilation shutdown.

FLT-30-491 for related system safety ain 1A-A portions of related FLT-30-493 for the diesel equipment ain 1B-B generator FLT-30-492 for building ain 2A-A ventilation FLT-30-494 for system ain 2B-B WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS on-safety Provide On during Spurious Surveillance & Increase of None. (See Redundant train diesel eaters heating summer failure Maintenance Diesel Gen. Remarks) generator system is HTR-30-471, during winter LOCA Room & Air available for the plant safe HTR-30-472 normal operation Exh. Room shutdown r Diesel Gen. operation temp. above A-A Room and environmental HTR-30-473, 1- design TR-30-474 for conditions iesel Gen. 1B-B Electrical Surveillance Same as above oom Off during None HTR-30-475, winter Drop in Diesel HTR-30-476 for conditions Gen Room esel gen. 2A-A temp oom and HTR-30-477, 2-TR-30-478 r diesel gen. 2B-Room onsafety heaters Provide On during Spurious Surveillance & Increase 480V None. (See Redundant train diesel heating summer failure Maintenance BD Room Remarks) generator system is HTR-30-487 for during winter LOCA (See Note in temp. above available for the plant safe 80V BD Room 1- normal operation Remarks for Item environmental shutdown

-A, operation #6) design HTR-30-489 conditions r 480V BD oom 1B-B, HTR-30-488 for Electrical 80V BD Room Off during A-A, winter Drop in 480V HTR-30-490 for operation board room B-B Room temp.

WBNP-89

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON DENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS onsafety heaters Provide Off during Electrical Surveillance & Decrease in None Minimum temperature in pipe heating winter Maintenance Pipe Gallery (See Remarks) gallery is calculated to be HTR-30-479 during winter operation Room temp 36.3oF.

HTR-30-480 normal below HTR-30-481 operation environmental HTR-30-482 for design e Pipe Gallery conditions oilet Room Provide Fails to Electrical Surveillance & Loss of None Maximum temperature in xhaust fan cooling and start; stops Mechanical Maintenance adequate corridor is calculated to be FAN-469 ventilation for ventilation for 120oF the toilet and maintenance of corridor design temp e:

efer to TVA Calculation No. EPM-RKK-121290, "Additional Diesel Generator Building Hydrogen Concentration and Dilution Ventilation."

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-AHU Provides cooling air Fails to run; Mechanical Annunciation of 480 Loss of capability to None; See Remarks 1. Failures of the cooling coil, fan, motor, 461-A supply to 480 V Board Fails while failure; Train A V Board Room 1A provide cooling air to 480 and filter are enveloped by the failure of the Room 1A Battery Room running power failure; HVAC System V Board Room 1A and AHU.

Air Handling I, and to Train A Control signal abnormal for 1-FS- Battery Board Room I Unit 1A-A for equipment in Board failure;31-460 closed on low and partial loss of cooling 2. The Condenser 1A-A and Compressor 480 V Board Room 1B, and Train B Temperature flow from AHU 1A-A to FVBR. 1A-A are interlocked to automatically stop Room 1A press fan, Fifth Vital control or start with the AHU 1A-A stop or start.

and Battery Battery Rm. (FVBR) sensing failure Indicating lights in Room I at 1-TS MCR (1-HS 3. Board Room 1B and Battery Room II (Train A) 441A; low flow 461A). Motor running provide the redundancy.

control light on MCC.

sensing failure 4. Operator actions are defined to deal at 1-FS No indication in MCR with loss of train A cooling 460; Operator of a low temperature error sensing failure other 5. Battery Room 1 and FVBR can be (handswitch 1- than indication that exhausted from the pressurizing fan supply HS-31-461B in the AHU is not air to provide hydrogen ventilation.

wrong running. Prepared calculations indicate that position) sufficient cooling is still available to assure Hardware the battery rooms remain below the related maximum temperature limits.

failures; i.e.,

motor burns out, fan drive belt failures, loss of refrigerant to the Cooling Coil, and/or restricted air flow path.

WBNP-92

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-ACU Provides cooling air Fails to run; Mechanical Annunciation of 480 Loss of capability to None; See Remarks 1. Failures of the cooling coil, fan, motor, 475-B supply to 480 V Board Fails while failure; Train B V Board Room 1B provide cooling air to 480 and filter are enveloped by the failure of the Room 1B Battery Room running power failure; HVAC System V Board Room 1B and AHU.

Air Handling II Control signal abnormal for 1-FS- Battery Board Room II Unit 1B-B for failure;31-476 closed on low 2. The Condenser 1B-B and Compressor 480 V Board Temperature flow from AHU 1B-B Battery Room II will 1B-B are interlocked to automatically stop Room 1B control continue to be ventilated. or start with the AHU 1B-B stop or start.

and Battery sensing failure Indicating lights in The pressurizing fan will Room II at 1-TS MCR (1-HS-31-475- supply air to the battery 3. Board Room 1A and Battery Room I (Train B) 447A; low flow A). Motor running room through the AHU provide the redundancy.

control light on MCC. duct.

sensing failure 4. Press. fans are not required to mitigate at 1-FS No indication in MCR The pressurizing fans the effects of a DBE.

476; Operator of a low temperature are cooled by the air they error sensing failure other supply.

(handswitch 1- than indication that HS-31-475B in the AHU is not wrong running.

position)

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-ACU Provides cooling air Fails to run; Mechanical Annunciation of 480 Loss of capability to None; See Remarks 1. Failures of the cooling coil, fan, motor, 461-A supply to 480 V Board Fails while failure; Train A V Board Room 2A provide cooling air to 480 and filter are enveloped by the failure of the Room 2A Battery Room running power failure; HVAC System V Board Room 2A and AHU.

Air Handling III, and to Train A Control signal abnormal for 2-FS- Battery Board Room III.

Unit 2A-A for equipment in Board failure;31-460 closed on low 2. The Condenser 2A-A and Compressor 480 V Board Room 2B, and Train B Temperature flow from AHU 2A-A Battery Room III will 2A-A are interlocked to automatically stop Room 2A press fan control continue to be ventilated. or start with the AHU 2A-A stop or start.

and Battery sensing failure Indicating lights in The pressurizing fan will Room at 2-TS MCR (2-HS-31-461- supply air to the battery 3. Board Room 2B and Battery Room IV III(Train A) 441A; low flow A). Motor running room through the AHU provide the redundancy.

control light on MCC. duct.

sensing failure 4. Press. fans are not required to mitigate at 2-FS No indication in MCR The pressurizing fans the effects of a DBE.

460; Operator of a low temperature are cooled by the air they error sensing failure other supply.

(handswitch 2- than indication that HS-31-461B in the AHU is not wrong running.

position)

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-ACU Provides cooling air Fails to run; Mechanical Annunciation of 480 Loss of capability to None, See Remarks 1. Failures of the cooling coil, fan, motor, 475-B supply to 480 V Board Fails while failure; Train B V Board Room 2B provide cooling air to 480 and filter are enveloped by the failure of the Room 2B Battery Room running power failure; HVAC System V Board Room 2B and AHU.

Air Handling IV Control signal abnormal for 2-FS- Battery Board Room IV Unit 2B-B for failure;31-476 closed on low 2. The Condenser 2B-B and Compressor 480 V Board Temperature flow from AHU 2B-B Battery Room IV will 2B-B are interlocked to automatically stop Room 2B control continue to be ventilated. or start with the AHU 2B-B stop or start.

and Battery sensing failure Indicating lights in The pressurizing fan will Room IV at 2-TS MCR (2-HS-31-461- supply air to the battery 3. Board Room 2A and Battery Room III (Train B) 447A; low flow A). Motor running room through the AHU provide the redundancy.

control light on MCC. duct.

sensing failure 4. Press. fans are not required to mitigate at 2-FS No indication in MCR The pressurizing fans the effects of a DBE.

476; Operator of a low temperature are cooled by the air they error sensing failure other supply.

(handswitch 2- than indication that HS-31-475B in the AHU is not wrong running.

position) 1-COND Provides refrigerant to Fails to run; Mechanical Motor running light Loss of cooling to 480 V None 1. Failure of the condenser envelopes 290-A AHU 1A-A Stops while failure; Train A on MCC Board Room 1A failure of its fan, coils and motor.

running power failure; The Battery Room I will Air Cooled Start signal be ventilated by the air 2. The condenser is interlocked to Condenser failure. supply from the automatically start or stop with the AHU Unit 1A-A Pressurizing Fan to and compressor start or stop.

provide Hydrogen ventilation. 3. The condenser is interlocked to automatically open 1-FSV-31-290 when running and close it when stopped.

4. Board Room 1B and Battery Room II WBNP-89 provide the redundancy.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-COND Provides refrigerant to Fails to run; Mechanical Motor running light Loss of cooling to 480 V None 1. Failure of the condenser envelopes 289-B AHU 1B-B Stops while failure; Train B on MCC Board Room 1B failure of its fan, coils and motor.

running power failure; The Battery Room II will Air Cooled Start signal be ventilated by the air 2. The condenser is interlocked to Condenser failure. supply from the automatically start or stop with the AHU Unit 1B-B Pressurizing Fan to and compressor start or stop.

provide Hydrogen ventilation. 3. The condenser is interlocked to automatically open 1-FSV-31-289 when running and close it when stopped.

4. Board Room 1A and Battery Room I provide the redundancy.

2-COND Provides refrigerant to Fails to run; Mechanical Motor running light Loss of cooling to 480 V None 1. Failure of the condenser envelopes 290-A AHU 2A-A Stops while failure; Train B on MCC Board Room 2A failure of its fan, coils and motor.

running power failure; The Battery Room III will Air Cooled Start signal be ventilated by the air 2. The condenser is interlocked to Condenser failure. supply from the automatically start or stop with the AHU Unit 2A-A Pressurizing Fan to and compressor start or stop.

provide Hydrogen ventilation. 3. The condenser is interlocked to automatically open 2-FSV-31-290 when running and close it when stopped.

4. Board Room 2B and Battery Room IV provide the redundancy.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-COND Provides refrigerant to Fails to run; Mechanical Motor running light Loss of cooling to 480 V None 1. Failure of the condenser envelopes 289-B AHU 2B-B Stops while failure; Train A on MCC Board Room 2B failure of its fan, coils and motor.

running power failure; The Battery Room IV will Air Cooled Start signal be ventilated by the air 2. The Condenser is interlocked to Condenser failure. supply from the automatically start or stop with the AHU Unit 2B-B Pressurizing Fan to and compressor start or stop.

provide Hydrogen ventilation. 3. The condenser is interlocked to automatically open 2-FSV-31-289 when running and close it when stopped.

4. Board Room 2A and Battery Room III provide the redundancy.

1-FCO Provides exhaust flow Fails to Mechanical Indicating lights in Loss of cooling in 480 V None 1. Interlocked with Condensing Unit 1A-A 290 path for Condensing Unit open (stuck failure MCR (1-ZS-31-290) Board Room 1A-A via 1-FSV-31-290 to automatically open on 1A-A closed) ACU start.

Exhaust Damper for 2. A review of the Control Air flow ACU 1A-A diagrams shows that nonsafety control air is supplied to both 1-FC0-31-290 and 289.

3. The exhaust damper is air operated and fails open upon loss of air or Train A power.

4. Board Room 1B and Battery Room II provide the redundancy.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FCO Provides exhaust flow Fails to Mechanical Indicating lights in Loss of cooling in 480 V None 1. Interlocked with Condensing Unit 1B-B 289 path for Condensing Unit open (stuck failure MCR (1-ZS-31-289) Board Room 1B-B via 1-FSV-31-289 to automatically open on 1B-B closed) ACU start.

Exhaust Damper for 2. A review of the Control Air flow ACU 1B-B diagrams shows that nonsafety control air is supplied to both 1-FC0-31-290 and 289.

3. The exhaust damper is air operated and fails open upon loss of air or Train B power.

4. Board Room 1A and Battery Room I provide the redundancy.

WBNP-91

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FCO Provides exhaust flow Fails to Mechanical Indicating lights in Loss of cooling None 1. Interlocked with Condensing Unit 2A-A 290 path for Condensing Unit open (stuck failure MCR (2-ZS-31-290) 480 V Board Room 2A-A via 2-FSV-31-290 to automatically open on 2A-A closed) ACU start.

Exhaust Damper for 2. A review of the Control Air flow ACU 2A-A diagrams shows that nonsafety control air is supplied to both 2-FC0-31-290 and 289.

3. The exhaust damper is air operated and fails open upon loss of air or Train A power.

4. Board Room 2B and Battery Room IV provide the redundancy.

2-FCO Provides exhaust flow Fails to Mechanical Indicating lights in Loss of cooling 480 V None 1. Interlocked with Condensing Unit 2B-B 289 path for Condensing Unit open (stuck failure MCR (2-HS-31-289 Board Room 2B-B via 2-FSV-31-289 to automatically open on 2B-B. closed). ACU start.

Exhaust Damper for 2. A review of the Control Air flow ACU 2B-B diagrams shows that non-safety control air is supplied to both 2-FCO-31-290 and 289.

3. The exhaust damper is air operated and fails open upon loss of air or Train B power.

4. Board Room 2A and Battery Room III provide the redundancy.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally mounted 462-A flow to 480 V Board start; Fails failure; Train A MCR (1-HS-31-462 pressurizing air supply to stop-start push button stations in Room 1A Battery Room while power failure; A). Locally, 1-HS 480 V Board Room 1A conjunction with auto-start switches in Pressurizing I and partial makeup air running Control signal 462B. ANN 19-9 low and Battery Room I and MCR.

Supply Fan to the Fifth Vital Battery failure; flow from Press. V 1A1-A (Train Room. Operator error Fans 2. Pressurizing Fan 1A1-A is interlocked A) (handswitch in Low flow on 1-FS with Battery Board Room I Exhaust Fan wrong 463-B will automatically 1A2-B and 480 V Room 1A Fan 1A2-B position) stop Fan 1A1-A and such that when Fan 1A1-A is in auto-Battery Board Room standby, low flow on either of the 1A2-B Exhaust fan 1A1-A and, Fans will start 1-FAN-31-462-A and stop 1-will automatically start FAN-31-463-B.

Fan 1A2-B and Battery Room Exhaust fan 1A2- 3. A review of the schematics establishes B. the separation and redundancy of the train A and B fans. The loss of nondivisional (See Remark #2.) train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 1A and Mechanical Equipment Room 1A. Battery room I will not be overpressurized without second failure.

Failure to Spurious low Indicating lights in None (See Remarks) stop when flow signal; MCR (1-HS Overpressurization of Train B fan Hot short in 462A). 480 V Board Room 1A.

starts. control wiring; WBNP-92 Operator error. (See 'Remarks')

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally mounted 463-B flow to 480 V Board start; Fails failure; Train B MCR (1-HS-31-463 pressurizing air supply to stop-start push button stations in Room 1A Battery Room while power failure; A). Locally, 1-HS 480 V Board Room 1A conjunction with auto-start switches in Pressurizing I and partial makeup air running Control signal 463B. ANN 19-9 low and Battery Room I and MCR.

Supply Fan to the Fifth Vital Battery failure; flow from Press. V 1A2-B (Train Room Operator error Fans 2. Pressurizing Fan 1A2-B is interlocked B) (handswitch in Low flow on 1-FS with Battery Board Room I Exhaust Fan wrong 462-A will automatically 1A1-A and 480 V Room 1A Fan 1A1-A position) stop Fan 1A2-B and such that when Fan 1A2-B is in auto-Battery Board Room standby, low flow of either of the 1A1-A Exhaust fan 1A2-B and, Fans will start 1-FAN-31-463B and stop 1-will automatically start FAN-31-462A.

Fan 1A1-A and Battery Room Exhaust fan 1A1- 3. A review of the schematics establishes A. the separation and redundancy of the Train A and B fans. The loss of nondivisional (See Remark #2.) train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 1A and Mechanical Equipment Room 1A. Battery room I will not be overpressurized without a second failure.

Failure to Spurious low Indicating lights in Overpressurization of None (See Remarks) stop when flow signal; MCR (1-HS 480 V Board Room 1A.

Train A fan Hot short in 463A).

starts. control wiring; (See 'Remarks')

WBNP-92 Operator error.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None (See Remarks) 1. Fan is controlled by locally mounted 478-A flow to 480 V Board start; Fails failure; Train B MCR (1-HS pressurizing air supply to stop-start push button stations in Room 1B Battery Room while power failure; 478A). Locally, 1-HS- 480 V Board Room 1B conjunction with auto-start switches in Pressurizing II and partial makeup air running Control signal 31-478B ANN 19-11 and Battery Room II MCR.

Supply Fan to the Fifth Vital Battery failure; low flow from Press.

1B1-A (Train Room Operator error Fans Low flow on 1-FS 2. Pressurizing Fan 1B1-A is interlocked A) (handswitch in 477-B will automatically with Battery Room I Exhaust Fan 1B-A and wrong stop Fan 1B1-A and 480 V Room 1B pressurizing Fan 1B2-B position) Battery Board Room such that when Fan 1B1-A is in auto-Exhaust fan 1B1-A and, standby, low flow on either of the 1B2-B will automatically start Fans will start 1-FAN-31-478-A and stop 1-Fan 1B2-B and Battery FAN-31-477-B.

Room Exhaust fan 1B2-B. 3. A review of the schematics establishes (See Remark #2.) the separation and redundancy of the Train A and B fans. The loss of nondivisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 1B and Mechanical Equipment Room 1B. Battery room I will not be overpressurized without second failure.

Overpressurization of Failure to Spurious low Indicating lights in 480 V Board Room 1B.

stop when flow signal; MCR (1-HS None (See Remarks)

Train B fan Hot short in 478A). (See 'Remarks')

starts. control wiring; WBNP-92 Operator error.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None (See 'Remarks') 1. Fan is controlled by locally mounted 477-B flow to 480 V Board start; Fails failure; Train B MCR (1-HS pressurizing air supply to stop-start push button stations in Room 1B and Battery while power failure; 477A). Locally, HS- 480 V Board Room 1B conjunction with auto-start switches in Pressurizing Room II and partial running Control signal 31-477B ANN 19-11 and Battery Room II MCR.

Supply Fan makeup air to the Fifth failure; low flow from Press.

1B2-B (Train Vital Battery Room Operator error Fans Low flow on 1-FS 2. Pressurizing Fan 1B2-B is interlocked B) (handswitch in 478-A will automatically with Battery Room II Exhaust Fan 1B2-B wrong stop Fan 1B2-B and and 480 V Room 1B pressurizing Fan 1B1-position) Battery Room Exhaust A such that when Fan 1B2-B is in auto-fan 1B2-B and, will standby, low flow on either of the 1B1-A automatically start Fan Fans will start 1-FAN-31-477-B and stop 1-1B1-A and Battery Room FAN-31-478-A.

Exhaust fan 1B1-A.

3. A review of the schematics establishes (See Remark #2.) the separation and redundancy of the Train A and B fans. The loss of non-divisional train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 1B and Mechanical Equipment Room 1B. Battery room II will not be overpressurized without a second failure.

Overpressurization of Failure to Spurious low Indicating lights in 480 V Board Room 1B. None (See 'Remarks')

stop when flow signal; MCR (1-HS Train A fan Hot short in 477A-B). (See 'Remarks')

starts. control wiring; WBNP-92 Operator error.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FAN Exhausts air from Fails to Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan 1A1-A 287-A Battery Room 1 to start; Fails failure; Train A for Damper 1-FCO- exhausting Battery Room such that the Exhaust Fan starts when the prevent hydrogen build- while power failure; 31-287-A closure. 1. Pressurizing Fan starts and stops when the Exhaust Fan up. running. spurious low Motor running light Pressurizing Fan stops.

1A1- A for flow signal. on MCC. On low flow from Battery pressurizing or Exhaust 2. A review of the schematics establishes Room 1 Fan 1A1-A, the Train B the independence of the Train A and B (Train A). Pressurizing Fan 1A2-B fans.

and the Exhaust Fan 1A2-B will automatically start. Damper 1-FCO-31-288-B will open.

1-FAN Exhausts air from Fails to Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan 1A2-B 288-B Battery Room 1 to start; Fails failure; Train B for damper 1-FCO- exhausting Battery Room such that the Exhaust Fan starts when the prevent hydrogen build- while power failure; 31-288-B closure. 1. Pressurizing Fan starts and stops when the Exhaust Fan up. running. spurious low Motor running light Pressurizing Fan stops.

1A2-B for flow signal. on MCC. On low flow from Battery Pressurizing or Exhaust 2. A review of the schematics establishes Room 1 Fan 1A2-B, the Train A the independence of the Train A and B (Train B). Pressurizing Fan 1A1-A fans.

and the Exhaust Fan 1A2-B will automatically start. Damper 1-FCO-31-287-A will open.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FAN Exhausts air from Fails to Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan 1B1-A 285-A Battery Room II to start; Fails failure; Train A for damper 1-FCO- exhausting Battery Room such that the Exhaust Fan starts and stops prevent hydrogen build- while power failure; 31-285-A closure. II. whtn the Pressurizing Fan starts.

Exhaust Fan up. running. spurious low Motor running light 1B1-A for flow signal. on MCC. On low flow from 2. A review of the schematics restablishes Battery II Pressurizing or Exhaust the independance of the Train A and B (Train A) Fan 1B1-A, the Train B fans.

Pressurizing Fan 1B2-B 1. Interlocked with Pressurizing Fan 1B2-B will automatically start. such that the Exhaust Fan starts when the Damper 1-FCO-31-286- Pressurizing Fan starts and stops when the A will open. Pressurizing Fan stops.

1-FAN Exhausts air from Fails to Mechanical Local indicating light Loss of redundancy in None.

2. A review of the schematics establishes 286-B Battery Room II to start; Fails failure; Train B for Damper 1-FCO- exhausting Battery Room the independence of the Train A and B prevent hydrogen build- while power failure; 31-286-B closure. II.

fans.

Exhaust Fan up. running. spurious low Motor running light 1B2-B for flow signal. on MCC. On low flow from Battery pressurizing or Exhaust Room II Fan 1B2-B, the Train A (Train B). Pressurizing Fan 1B1-A and the Exhaust Fan 1B1-A will automatically start. Damper 1-FCO-31-285-B will open.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None 1. Fan is controlled by locally mounted 462-A flow to 480 V Board start; Fails failure; Train A MCR (2-HS-31-462- pressurizing air supply to stop-start push button stations in Room 2A Battery Room while power failure; A). Locally, 2-HS 480 V Board Room 2A conjunction with auto-start switches in Pressurizing IV. running Control signal 462B. ANN 19-9 low and Battery Room IV MCR.

Supply Fan failure; flow from Press.

2A1-A (Train Operator error Fans Low flow on 2-FS 2. Pressurizing Fan 2A1-A is interlocked A) (handswitch in 463-B will automatically with Battery Board Room I Exhaust Fan wrong stop Fan 2A1-A and 2A2-B and 480 V Room 2A Fan 2A2-B position) Battery Board Room such that when Fan 2A1-A is in auto-Exhaust fan 2A1-A; and, standby, low flow on either of the 2A2-B will automatically start Fans will start 2-FAN-31-462-A and stop 2-Fan 2A2-B and Battery FAN-31-463-B.

Room Exhaust fan 2A2-B. 3. A review of the schematics establishes the separation and redundancy of the Train See Remark #2. A and B fans. The loss of non-division train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 2A and Mechanical Equipment Room 2A. Battery room IV will not be overpressurized without second failure.

Indicating lights in MCR (2-HS Failure to Spurious low 462A). Overpressurization of None stop when flow signal; 480 V Board Room 2A.

Train B fan Hot short in starts. control wiring; See 'Remarks' column WBNP-91 Operator error.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None 1. Fan is controlled by locally mounted 463-B flow to 480 V Board start; Fails failure; Train B MCR (2-HS-31-463- pressurizing air supply to stop-start push button stations in Room 2A Battery Room while power failure; A). Locally, 2-HS 480 V Board Room 2A conjunction with auto-start switches in Pressurizing IV. running Control signal 463B ANN 19-9 low and Battery Room IV MCR.

Supply Fan failure; flow from Press.

2A2-B (Train Operator error Fans Low flow on 2-FS 2. Pressurizing Fan 2A2-B is interlocked B) (handswitch in 462-A will automatically with Battery Board Room IV Exhaust Fan wrong stop Fan 2A2-B and 2A1-A and 480 V Room 2A Fan 2A1-A position) Battery Board Room such that when Fan 2A2-B is in auto-Exhaust fan 2A2-B and, standby, low flow on either of the 2A1-A will automatically start Fans will start 2-FAN-31-463-B and stop 2-Fan 2A1-A and Battery FAN-31-462-A.

Room Exhaust fan 2A1-A. 3. A review of the schematics establishes the separation and redundancy of the Train See Remark #2. A and B fans. The loss of non-division train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 2A and Mechanical Equipment Room 2A. Battery room IV will not be overpressurized without second failure.

Indicating lights in MCR (2-HS Failure to Spurious low 463A). Overpressurization of None stop when flow signal; 480 V Board Room 2A.

Train A fan Hot short in starts. control wiring; See 'Remarks' column WBNP-91 Operator error.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None 1. Fan is controlled by locally mounted 478-A flow to 480 V Board start; Fails failure; Train A MCR (2-HS-31-478- pressurizing air supply to stop-start push button stations in Room 2B Battery Room while power failure; A). Locally, 2-HS 480 V Board Room 2B conjunction with auto-start switches in Pressurizing III. running Control signal 478B. ANN 19-9 low and Battery Room III MCR.

Supply Fan failure; flow from Press.

2B1-A (Train Operator error Fans Low flow on 2-FS 2. Pressurizing Fan 2B1-A is interlocked A) (handswitch in 477-A will automatically with Battery Board Room III Exhaust Fan wrong stop Fan 2B1-A and 2B2-B and 480 V Room 2B Fan 2B2-B position) Battery Board Room such that when Fan 2B1-A is in auto-Exhaust fan 2B1-A and, standby, low flow on either of the 2B2-B will automatically start Fans will start 2-FAN-31-478-A Fan 2B2-B and Battery and stop 2-FAN-31-477-B.

Room Exhaust Fan 2B2-B. 3. A review of the schematics establishes the separation and redundancy of the train See Remark #2. A and B fans.

The loss of non-division train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 2B and Mechanical Equipment Room 2B. Battery room III will not be overpressurized without second Indicating lights in failure.

MCR (2-HS Failure to Spurious low 478A). Overpressurization of None stop when flow signal; 480 V Board Room 2B.

Train B fan Hot short in starts. control wiring; See 'Remarks' column WBNP-91 Operator error.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FAN Provides pressurizing air Fails to Mechanical Indicating lights in Loss of redundancy in None 1. Fan is controlled by locally mounted 477-B flow to 480 V Board start; Fails failure; Train B MCR (2-HS-31-477- pressurizing air supply to stop-start push button stations in Room 2B Battery Room while power failure; A). Locally, 2-HS 480 V Board Room 2B conjunction with auto-start switches in Pressurizing III. running Control signal 477-B. ANN 19-11 and Battery Room III MCR.

Supply Fan failure; low flow from Press.

2B2-B (Train Operator error Fans Low flow on 2-FS 2. Pressurizing Fan 2B2-B is interlocked B) (handswitch in 478-A will automatically with Battery Board Room III Exhaust Fan wrong stop Fan 2B2-B and 2B1-A and 480 V Room 2B Fan 2B1-A position) Battery Board Room such that when Fan 2B2-B is in auto-Exhaust fan 2B2-B and, standby, low flow on either of the 2B1-A will automatically start Fans will start 2-FAN-31-477-B Fan 2B1-A and Battery and stop 2-FAN-31-478-A.

Room Exhaust fan 2B1-A. 3. A review of the schematics establishes the separation and redundancy of the train See Remark #2. A and B fans. The loss of non-division train associated power supply for the separation relay will not prevent the switchover from a failed pressurizing fan to the standby fan.

Insignificant increase in air flow to 480 V Board Room 2B and Mechanical Equipment Room 2B. Battery room III will not be overpressurized without second failure.

Indicating lights in MCR (2-HS Failure to Spurious low 477A). Overpressurization of None stop when flow signal; 480 V Board Room 2A.

Train A fan Hot short starts. control wiring; See 'Remarks' column WBNP-91 Operator error.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FAN Exhausts air from Fails to Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan 2A1-A 287-A Battery Room IV to start; Fails failure; Train A for Damper 2-FCO- exhausting Battery Room such that the Exhaust Fan starts when the prevent hydrogen build- while power failure; 31-287-A closure. IV. Pressurizing Fan starts and stops when the Exhaust Fan up. running. spurious low Motor running light Pressurizing Fan stops.

2A1- A for flow signal. on MCC. On low flow from Battery Local indicating light pressurizing or Exhaust 2. A review of the schematics establishes Room IV for damper 2-FCO- Fan 2A1-A, the Train B the independence of the Train A and B (Train A). 31-288-A closure. Pressurizing Fan 2A2-B fans.

Motor running light and the Exhaust Fan on MCC. 2A2-B will automatically start. Damper 2-FCO-31-288-B will open.

2-FAN Exhausts air from Fails to Mechanical Loss of redundancy in None. 1. Interlocked with Pressurizing Fan 2A2-B 288-B Battery Room IV to start; Fails failure; Train B exhausting Battery Room such that the Exhaust Fan starts when the prevent hydrogen build- while power failure; IV. Pressurizing Fan starts and stops when the Exhaust Fan up. running. spurious low Pressurizing Fan stops.

2A2-B for flow signal. On low flow from Battery Pressurizing or Exhaust 2. A review of the schematics establishes Room IV Fan 2A1-B, the Train A the independence of the Train A and B (Train B). Pressurizing Fan 2A1-A fans.

and the Exhaust Fan 2A1-A will automatically start. Damper 2-FCO-31-287-A will open.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FAN Exhausts air from Fails to Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan 2B1-A 285-A Battery Room III to start; Fails failure; Train A for damper 2-FCO- exhausting Battery Room such that the Exhaust Fan starts when the prevent hydrogen build- while power failure; 31-285-A closure. III. Pressurizing Fan starts and stops when the Exhaust Fan up. running. spurious low Motor running light Pressurizing Fan stops.

2B1-A for flow signal. on MCC. On low flow from Battery III Pressurizing or Exhaust 2. A review of the schematics establishes (Train A). Fan 2B1-A, the Train B the independence of the Train A and B Pressurizing Fan 2B2-B fans.

and the Exhaust Fan 2B2-B will automatically start. Damper 2-FCO-31-286-A will open.

2-FAN Exhausts air from Fails to Mechanical Local indicating light Loss of redundancy in None. 1. Interlocked with Pressurizing Fan 2B2-B 286-B Battery Room III to start; Fails failure; Train B for Damper 2-FCO- exhausting Battery Room such that the Exhaust Fan starts when the prevent hydrogen build- while power failure; 31-286-A closure. III. Pressurizing Fan starts and stops when the Exhaust Fan up. running. spurious low Motor running light Pressurizing Fan stops.

2B2-B for flow signal. on MCC. On low flow from Battery pressurizing or Exhaust 2. A review of the schematics establishes Room III Fan 2B2-B, the Train A the independence of the Train A and B (Train B). Pressurizing Fan 2B1-A fans.

and the Exhaust Fan 2B1-A will automatically start. Damper 2-FCO-31-285-B will open.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FCO Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

287-A Exhaust Fan 1A1-A in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room I. short in control damper status lights I. Room I Exhaust Fan 1A1-A. A review of Tornado wiring; (1-ZS-31-287-A). the schematics establishes the Damper Operator error Low flow from 1A1-A independence of the control of the Damper (Exhaust (handswitch Fans 1-FCO-31-288-B.

Fan 1A1-A.) placed in will automatically stop wrong the fan from Train A, start position). Train B Press. Fan 1A2-B and Exhaust Fan 1A2-B which will open 1-FCO-31-288-B.

1-FCO Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

288-B Exhaust Fan 1A2-B in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room I. short in control damper status lights I. Room I Exhaust Fan 1A2-B. A review of Tornado wiring; (1-ZS-31-288-B). the schematics establishes the Damper Operator error Low flow from 1A2-B independence of the control of the Damper (Exhaust (handswitch Fans will automatically 1-FCO-31-287-A and 1-FCO-31-288-B.

Fan 1A2-B) placed in stop the fan from Train B, wrong start Train A Press. Fan position). 1A1-A and Exhaust Fan 1A1-A which will open 1-FCO-31-287-A.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-FCO Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

285-A Exhaust Fan 1B1-A in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room II. short in control damper status lights II. Room II Exhaust Fan 1B1-A. A review of Tornado wiring; (1-ZS-31-285-A). the schematics establishes the Damper Operator error Low flow from 1B1-A independence of the control of the Damper (Exhaust (handswitch Fans 1-FCO-31-286-B.

Fan 1B1-A) placed in will automatically stop wrong the fan from Train A, start position). Train B Press. Fan 1B2-B and Exhaust Fan 1B2-B which will open 1-FCO-31-286-B.

1-FCO Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

286-B Exhaust Fan 1B2-B in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room II. short in control damper status lights II. Room II Exhaust Fan 1B2-B. A review of Tornado wiring; (1-ZS-31-286-B). the schematics establishes the Damper Operator error Low flow from 1B2-B independence of the control of the Damper (Exhaust (handswitch Fans 1-FCO-31-285-A and 1-FCO-31-286-B.

Fan 1B2-B). placed in will automatically stop wrong the fan from Train B, start position). Train A Press. Fan 1B1-A and Exhaust Fan 1B1-A which will open 1-FCO-31-285-A.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FCO Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

287-A Exhaust Fan 2A1-A in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room IV. short in control damper status lights IV. Room IV Exhaust Fan 2A1-A. A review of Tornado wiring; (2-ZS-31-287-A). the schematics establishes the Damper Operator error Low flow from 2A1-A independence of the control of the Damper (Exhaust (handswitch Fans 2-FCO-31-287-A and 2-FCO-31-288-B.

Fan 2A1-A). placed in will automatically stop wrong the fan from Train A, start position). Train B Press. Fan 2A2-B and Exhaust Fan 2A2-B which will open 2-FCO-31-288-B.

2-FC0 Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

288-B Exhaust Fan 2A2-B in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room IV. short in control damper status lights IV. Room IV Exhaust Fan 2A2-B. A review of Tornado wiring; (2-ZS-31-288-B). the schematics establishes the Damper Operator error Low flow from 2A2-B independence of the control of the Damper (Exhaust (handswitch Fans 2-FCO-31-287-A and 2-FCO-31-288-B.

Fan 2A2-B. placed in will automatically stop wrong the fan from Train B, start position). Train A Press. Fan 2A1-A and Exhaust Fan 2A1-A which will open 2-FCO-31-287-A.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-FCO Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

285-A Exhaust Fan 2B1-A in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room III. short in control damper status lights III. Room III Exhaust Fan 2B1-A. A review of Tornado wiring; (2-ZS-31-285-A). the schematics establishes the Damper Operator error Low flow from 2B1-A independence of the control of the Damper (Exhaust (handswitch fans 2-FCO-31-285-A and 2-FCO-31-286-B.

Fan 2B1-A). placed in will automatically stop wrong the fan from Train A, start position). Train B Press. Fan 2B2-B and Exhaust Fan 2B2-B which will open 2-FCO-31-286-B.

2-FCO Provides air flow to Spuriously Mechanical Mechanical Loss of redundancy in None. Damper is motor operated, and fails as is.

286-B Exhaust Fan 2B2-B in closes. failure; Hot Equipment Room exhausting Battery Room Automatically controlled to open by Battery Battery Room III. short in control damper status lights III. Room III Exhaust Fan 2B2-B. A review of Tornado wiring; (2-ZS-31-286-B). the schematics establishes the Damper Operator error Low flow from 2B2-B independence of the control of the Damper (Exhaust (handswitch fans 2-FCO-31-285-A and 2-FCO-31-286-B.

Fan 2B2-B). placed in will automatically stop wrong the fan from Train B, start position). Train A Press. Fan 2B1-A and Exhaust Fan 2B1-A which will open 2-FCO-31-285-A.

0-FAN N/A N/A N/A N/A N/A Abandoned in place.

493A-A N/A Fifth Vital Battery Supply Fan WBNP-92 1A1-A.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 0-FC N/A N/A Abandoned in place.

487A N/A N/A N/A Battery Room V Intake Fan 1A1-A Hydramotor Controller.

0-FCO N/A Abandoned in place in closed position.

483-A N/A N/A N/A N/A N/A Tornado Damper for intake Fan 1A1-A Fifth Vital Battery Room.

WBNP-92

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 0-FAN Provides exhaust from Fails to run; Mechanical ANN 19-8 for low Loss of redundancy in None. (See 'Remarks') The fifth Vital Battery is housed in its own 493B-A Battery Room Fails while failure; Train A flow from intake fan exhausting Battery Room separate room, and functions as a spare to running. power failure; or exhaust fan from V. any of the four vital batteries during Fifth Vital Auto-start either train. periodic testing and maintenance or cell Battery signal failure. The Train B fan is failure during operation. The two trains of Room Motor running light available to provide the ventilation system are 100%

Exhaust Fan on MCC. exhausting of Battery redundant. o . Upon low flow from Train A 1B1-A. Room V, and will exhaust fan, the opposite train fans will automatically start on low start automatically and its dampers will flow sensed in Train A s open. Auto-start of the standby train is exhaust duct. independent of the other train. Schematic diagrams were reviewed and it was determined that control from the opposite train flow element does not violate separation of redundant train.

0-FCO Provides flow path for Fails to Mechanical Local control station Loss of redundancy in None. The Train B Damper is solenoid actuated to fail closed 485-A exhaust from Exhaust open (stuck failure; Train A indicating lights. providing exhaust exhaust fan and its upon loss of Train A power.

Fan 1B1-A closed); power failure; flowpath. associated dampers are Tornado Spuriously Operator error. automatically controlled to Interlocked to automatically open upon Damper for closes. start/open upon low flow exhaust Fan 1B1-A start.

exhaust Fan from the operating 1B1-A Fifth exhaust fan.

Vital Battery Room.

0-FAN Abandoned in place.

496A N/A N/A N/A N/A N/A N/A Fifth Vital Battery Room WBNP-92 supply Fan 1A2-B.

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 0-FC N/A Abandoned in place.

488A-B N/A N/A N/A N/A Battery Room V Intake Fan 1A2-B Hydramotor Controller.

0-FCO N/A Abandoned in place.

484-B N/A N/A N/A N/A N/A Tornado Damper for Intake Fan 1A2-B Fifth Vital Battery Room.

WBNP-92

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 0-FAN Provides exhaust form Fails to run; Mechanical ANN 19-8 for low Loss of redundancy in None. (See Remarks) The fifth Vital Battery is housed in its own 496B Battery Room V for Fails while failure; Train B flow from intake fan exhausting Battery Room separate room, and functions as a spare to ventilation. running. power failure; or exhaust fan from V. any of the four vital batteries during Fifth Vital Auto-start either train. periodic testing and maintenance or cell Battery signal failure. The Train A fan is failure during operation. The two trains of Room Motor running light available to provide the ventilation system are 100%

Exhaust Fan on MCC. exhausting of Battery redundant. . Upon low flow from Train B 1B2-B. Room V, and will exhaust fan, the opposite train fans will automatically start on low start automatically and its dampers will flow sensed in Train B open. Auto-start of the standby train is exhaust duct. independent of the other train. Schematic diagrams were reviewed and it was determined that control from the opposite train flow element does not violate separation of redundant train.

0-FCO Provides flowpath for Fails to Mechanical Local Control Station Loss of redundancy in None. The Train A Low flow switch FS-31-492-B turns on the 486-B exhaust from Exhaust open failure; Train B indicating lights providing exhaust exhaust fan and its redundant fan pair (supply/exhaust)

Fan 1B2-B. (stuck power failure; flowpath. associated damperis Tornado closed); Operator error. automatically controlled to Damper for Spuriously start/open upon low flow exhaust Fan closes. from the operating 1B2-B Fifth exhaust fan.

Vital Battery Room.

WBNP-92

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-BKD Prevents flow of air Fails to Mechanical Local position Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2502 through Pressurizing backseat. failure; indicators on to rooms served by the 1A2-B running in MCR. Local indication of Supply Fan 1A1-A when damper. fan. Bypass flow through damper status resulting from potential low Back Draft Fan 1A2-B is running. the standby unit is flow from fan(s).

Damper See Remark #1. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

1-BKD Prevents flow of air Fails to Mechanical Local position Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2503 through Pressurizing backseat. failure. indicators on to rooms served by the 1A1-A running in MCR. Local indication of Supply Fan 1A2-B when damper. fan. Bypass flow through damper status resulting from potential low Back Draft Fan 1A1-A is running. the standby unit is flow from fan(s).

Damper See Remark #1. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-BKD Prevents flow of air Fails to Mechanical See Remark #1. Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2502 through Pressurizing backseat. failure. to rooms served by the 2A2-B running in MCR. Local indication of Supply Fan 2A1-A when Local position fan. Bypass flow through damper status resulting from potential low Back Draft Fan 2A2-B is running. indicators on the standby unit is flow from fan(s).

Damper damper. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

2-BKD Prevents flow of air Fails to Mechanical Local position Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2503 through Pressurizing backseat. failure. indicators on to rooms served by the 2A1-A running in MCR. Local indication of Supply Fan 2A2-B when damper. fan. Bypass flow through damper status resulting from potential low Back Draft Fan 2A1-A is running. the standby unit is flow from fan(s).

Damper See Remark #1. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 1-BKD Prevents flow of air Fails to Mechanical Local position Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2520 through Pressurizing backseat. failure. indicators on to rooms served by the 1B2-B running in MCR. Local indication of Supply Fan 1B1-A when damper. fan. Bypass flow through damper status resulting from potential low Back Draft Fan 1B2-B is running. the standby unit is flow from fan(s).

Damper See Remark #1. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

1-BKD Prevents flow of air Fails to Mechanical Local position Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2521 through Pressurizing backseat. failure. indicators on to rooms served by the 1B1-A running in MCR. Local indication of Supply Fan 1B2-B when damper. fan. Bypass flow through damper status resulting from potential low Back Draft Fan 1B1-A is running. the standby unit is flow from fan(s).

Damper See Remark #1. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

WBNP-89

TTS BAR Failure Potential Method of Component Function Mode Cause Detection Effect on System Effect on Plant Remarks 2-BKD Prevents flow of air Fails to Mechanical Local position Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2520 through Pressurizing backseat. failure. indicators on to rooms served by the 2B2-B running in MCR. Local indication of Supply Fan 2B1-A when damper. fan. Bypass flow through damper status resulting from potential low Back Draft Fan 2B2-B is running. the standby unit is flow from fan(s).

Damper See Remark #1. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

2-BKD Prevents flow of air Fails to Mechanical Local position Loss of pressurizing air None. 1. ANN low flow. Indicating lights of Fan 2521 through Pressurizing backseat. failure. indicators on to rooms served by the 2B1-A running in MCR. Local indication of Supply Fan 2B2-B when damper. fan. Bypass flow through damper status resulting from potential low Back Draft Fan 2B1-A is running. the standby unit is flow from fan(s).

Damper See Remark #1. required to start but may fail as a result of motor 2. Plant operations has an administrative overload to overcome procedure to verify that the damper is the reverse rotation. closed following the shutdown of its This would result in the respective fan.

total loss of the pressurizing fan and its paired Battery Room exhaust fan and damper.

See Remark #2.

WBNP-89

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FAN-30-244F-A Exhausts air from Fails to run; Fails Mechanical failure; Motor running Loss of one of None. 1. The four (4) exhaust fans (3 safety- related) 480V Transformer while running. Train A power failure; light on MCC. four fans. in 480V Transformer Room 1A are interlocked Exhaust Fan Room 1A. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure.

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Any two of the three safety related fans can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is Control signal failure; Indicating controlled by a thermostat, all fans are stopped.

Spuriously runs. Temperature control lights on MCC In the event of spurious operation of one fan, sensing failure; Hot for fan motor None. None. the ambient room temperature will not cause short in control running. the transformers to operate at conditions below wiring. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FAN-30-244G-A Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one of None. 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train A power failure; light on MCC. four fans. in 480 V Transformer Room 1A are interlocked Exhaust Fan 1A. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure.

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is Control signal failure; Indicating controlled by a thermostat, all fans are stopped.

Spuriously runs. Temperature control lights on MCC In the event of spurious operation of one fan, sensing failure; Hot for fan motor None. None. the ambient room temperature will not cause short in control running. the transformers to operate at conditions below wiring. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FAN-30-244H-A Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one of None. 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train A power failure; light on MCC. four fans. in 480 V Transformer Room 1A are interlocked Exhaust Fan 1A. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room Temperature is indicated on Local Panel L-362.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is Control signal failure; Indicating controlled by a thermostat, all fans are stopped.

Spuriously runs. Temperature control lights on MCC In the event of spurious operation of one fan, sensing failure; Hot for fan motor None. None. the ambient room temperature will not cause short in control running. the transformers to operate at conditions below wiring. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FAN-30-244J Exhausts air from 480 Spuriously runs. Control signal failure; Indicating None. None. 1. This fan is electrically separate from the 1E V Transformer Room Temperature control lights on MCC circuit for the three safety-related fans.

Exhaust Fan 1A sensing failure; Hot for fan motor See Remark See (Non-safety) short in control running. #2. Remark #2. 2. In the event that the room temperature drops wiring. below its minimum temperature, which is controlled by a thermostat, all fans are stopped.

In the event of spurious operation of one fan, the ambient room temperature will not cause the transformers to operate at conditions below their design limit.

Mechanical failure; 1. The three (3) exhaust fans Train B power failure; Motor running None. (3 safety-related) in 480 V Transformer Room 1-FAN-30-248E-B Exhausts air from 480 Fails to run; Fails Temperature control light on MCC. Loss of one of 1B are interlocked to automatically start/stop in V Transformer Room while running. sensing failure; three fans. staged series by thermostatic control.

Exhaust Fan 1B. Control signal failure.

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Any two of the three safety related fans can provide adequate air to ventilate the room.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FAN-30-248E-B Spuriously runs. Control signal failure; Indicating None. None. 1. In the event that the room temperature drops (cont'd) Temperature control lights on MCC below its minimum temperature, which is sensing failure; Hot for fan motor controlled by a thermostat, all fans are stopped.

Exhaust Fan short in control running In the event of spurious operation of one fan, wiring. the ambient room temperature will not cause the transformers to operate at conditions below their design limit.

Mechanical failure; Train B power failure; Motor running 1. The three (3) exhaust fans (3 safety-related) 1-FAN-30-248F-B Exhausts air from 480 Fails to run; Fails Temperature control light on MCC. Loss of one of None. in 480 V Transformer Room 1B are interlocked V Transformer Room while running. sensing failure; three fans. to automatically start/stop in staged series by Exhaust Fan 1B. Control signal failure thermostatic control.

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FAN-30-248F-B Spuriously runs. Control signal failure; Indicating None. None. 1. In the event that the room temperature drops (cont'd) Temperature control lights on MCC below its minimum temperature, which is sensing failure; Hot for fan motor controlled by a thermostat, all fans are stopped.

Exhaust Fan short in control running In the event of spurious operation of one fan, wiring. the ambient room temperature will not cause the transformers to operate at conditions below their design limit.

Mechanical failure; Train B power failure; Motor running 1. The three (3) exhaust fans (3 safety-related)

Exhausts air from 480 Fails to run; Fails Temperature control light on MCC. Loss of one of None. in 480 V Transformer Room 1B are interlocked 1-FAN-30-248G-B V Transformer Room while running. sensing failure; three fans. to automatically start/stop in staged series by 1B. Control signal failure thermostatic control.

Exhaust Fan

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 1A and 1B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FAN-30-248G-B Spuriously runs. Control signal failure; Indicating None. None. 1. In the event that the room temperature drops (cont'd) Temperature control lights on MCC below its minimum temperature, which is sensing failure; Hot for fan motor controlled by a thermostat, all fans are stopped.

Exhaust Fan short in control running In the event of spurious operation of one fan, wiring. the ambient room temperature will not cause the transformers to operate at conditions below their design limit.

Mechanical failure; Auto-open signal MCR 1. Both intake dampers are interlocked to 1-FCO-30-244A Permits flow of air Spuriously closes; failure; Hot short in indicating Loss of None. automatically open when any of the four (4) and -244B supply from air intake Fails to open. control wiring. lights 1-ZS redundancy in exhaust fans are either automatically or to 480 V Transformer 244A and - intake air See manually started.

Intake Dampers Room 1A. 244B). supply. 100% Remark #3.

redundant 2. Dampers fail open upon loss of control air or intake damper Train A power to 1-FSB-30-244A and -244B.

can supply sufficient air. 3. 1-FSV-30-244A and -244B and the air pressure regulators, 1-PREG-30-244A and -

244B, that regulate the air pressure to these FSVs are Q-Listed as Quality- related, not safety-related. Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to close the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly WBNP-87 isolated in the 1E circuit.

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 1-FCO-30-248A Permits flow of air Spuriously closes; Mechanical failure; MCR Loss of None. 1. Both intake dampers are interlocked to and -248B supply from air intake Fails to open. Auto-open signal indicating redundancy in automatically open when any of the three (3) to 480 V Transformer failure; Hot short in lights intake air See exhaust fans are either automatically or Intake Dampers. Room 1B. control wiring. (1-ZS-30-248A supply. Remark #3. manually started.

and -248B).

100% 2. Dampers fail open upon loss of control air redundant loss or Train B power to 1-FSV-30-248A and -

intake damper 248B.

can supply sufficient air. 3. 1-FSV-30-248A and -248B and the air pressure regulators, 1-PREG-30-248A and -

248B, that regulate the air pressure to these FSVs are Q-Listed as Quality- related, not safety-related. Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to close the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly isolated in the 1E circuit.

Mechanical failure; Exhausts air from 480 Train A power failure; Motor running Loss of one of None. 1. The three (3) exhaust fans (3 safety-related) 2-FAN-30-250E-A V Transformer Room Fails to run; Fails Temperature control light on MCC. three fans. in 480 V Transformer Room 2A are interlocked 2A. while running. sensing failure; to automatically start/stop in staged series by Exhaust Fan Control signal failure thermostatic control, 2-TT-30-250.

WBNP-87

2. The inlet dampers are interlocked to automatically open when any fan is running.

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FAN-30-250E-A 3. Schematics have been reviewed and it was (cont'd) determined that rooms 2A and 2B, containing redundant electrical equipment, are Exhaust Fan independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is Spuriously runs. Control signal failure; Indicating None. None. controlled by a thermostat, all fans are stopped.

Temperature control lights on MCC In the event of spurious operation of one fan, sensing failure; Hot for fan motor the ambient room temperature will not cause short in control running. the transformers to operate at conditions below wiring. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FAN-30-250F-A Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one of None. 1. The three (3) exhaust fans (3 safety-related)

V Transformer Room while running. Train A power failure; light on MCC. three fans. in 480 V Transformer Room 2A are interlocked Exhaust Fan 2A. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is Control signal failure; Indicating controlled by a thermostat, all fans are stopped.

Spuriously runs. Temperature control lights on MCC None. In the event of spurious operation of one fan, sensing failure; Hot for fan motor None. the ambient room temperature will not cause short in control running. the transformers to operate at conditions below wiring. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FAN-30-250G-B Exhausts are from Fails to run; Fails Mechanical Failure; Motor running Loss of one of None. 1. The three (3) exhaust fans (3 safety-related) 480 V Transformer while running. Train A power failure; light on MCC. three fans. in 480 V Transformer Room 2A are interlocked Exhaust Fan Room 2A. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-368.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is Control signal failure; Indicating controlled by a thermostat, all fans are stopped.

Spuriously runs. Temperature control lights on MCC None. In the event of spurious operation on one fan, sensing failure; Hot for fan motor None. the ambient room temperature will not cause short in control running. the transformers to operate at conditions below wiring. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FAN-30-246F-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one of None. 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. three fans. in 480 V Transformer Room 2B are interlocked Exhaust Fan 2B. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control, 2-TT-30-246.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Any two of the three safety-related fan can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is controlled by a thermostat, all fans are stopped.

Control signal failure; Indicating In the event of spurious operation of one fan, Spuriously runs. Temperature control lights on MCC None. the ambient room temperature will not cause sensing failure; Hot for fan motor None. the transformers to operate at conditions below short in control wiring running. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FAN-30-246G-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one of None. 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. four fans. in 480 V Transformer Room 2B are interlocked Exhaust Fan 2B. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

1. In the event that the room temperature drops below its minimum temperature, which is Control signal failure; Indicating controlled by a thermostat, all fans are stopped.

Spuriously runs. Temperature control lights on MCC In the event of spurious operation of one fan, sensing failure; Hot for fan motor None. None. the ambient room temperature will not cause short in control running. the transformers to operate at conditions below wiring. their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FAN-30-246H-B Exhausts air from 480 Fails to run; Fails Mechanical failure; Motor running Loss of one of None. 1. The four (4) exhaust fans (3 safety-related)

V Transformer Room while running. Train B power failure; light on MCC. four fans. in 480 V Transformer Room 2B are interlocked Exhaust Fan 2B. Temperature control to automatically start/stop in staged series by sensing failure; thermostatic control.

Control signal failure

2. The inlet dampers are interlocked to automatically open when any fan is running.

3. Schematics have been reviewed and it was determined that rooms 2A and 2B, containing redundant electrical equipment, are independent of each other.

4. Room temperature is indicated on Local Panel L-362.

5. Any two of the three safety-related fans can provide adequate air to ventilate the room.

Spuriously runs. Control signal failure; Indicating None. None. 1. In the event that the room temperature drops Temperature control lights on MCC below its minimum temperature, which is sensing failure; Hot for fan motor controlled by a thermostat, all fans are stopped.

short in control running. In the event of spurious operation of one fan, wiring. the ambient room temperature will not cause the transformers to operate at conditions below their design limit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FAN-30-246J Exhausts air from 480 Spuriously runs. Control signal failure; Indicating None. None. 1. This fan is electrically separate from the 1E V Transformer Room Temperature control lights on MCC circuit for the three safety-related fans.

Exhaust Fan 2B sensing failure; Hot for fan motor See Remark See 2B4-B. short in control running. #2. Remark #2. 2. In the event that the room temperature drops (Non-safety) wiring. below its minimum temperature, which is controlled by a thermostat, all fans are stopped.

In the event of spurious operation of one fan, the ambient room temperature will not cause the transformers to operate at conditions below their design limit.

1. Both intake dampers are interlocked to Mechanical failure; automatically open when any of the four (4)

Auto-open signal MCR None. exhaust fans are either automatically or 2-FCO-30-246A Permits flow of air Spuriously closes; failure; Hot short in indicating Loss of manually started.

and -246B supply from air intake Fails to open. control wiring. lights redundancy in See to 480 V Transformer (2-ZS-30-246A intake air Remark #3. 2. Dampers fail open upon loss of control air or Intake Dampers Room 2B. and -246B). supply. Train B power to 2-FSV-30-246A and -246B.

100% 3. 2-FSV-30-246A and -246B and the air redundant pressure regulators, 1-PREG-30-246A and -

intake damper 246B, that regulate the air pressure to these can supply FSVs are Q-Listed as Quality- related, not sufficient air. safety-related.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to close the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly isolated in the 1E circuit.

WBNP-87

TTS BAR EFFECT COMPONENT FAILURE POTENTIAL METHOD OF EFFECT ON ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 2-FCO-30-250A Permits flow of air Spuriously closes: Mechanical failure; MCR Loss of None. 1. Both intake dampers are interlocked to and -250B supply from air intake Fails to open. Auto-open signal indicating redundancy in automatically open when any of the three (3) to 480V Transformer failure; Hot short in lights intake air See exhaust fans are either automatically or Intake Dampers. Room 2A. control wiring. (2-ZS-30-250A supply. Remark #3. manually started.

and -250B).

100% 2. Dampers fail open upon loss of control air or redundant Train A power to 1-FSV-30-250A and -250B.

intake damper can supply 3. 1-FSV-30-250A and -250B and the air sufficient air. pressure regulators, 1-PREG-30-250A and -

250B, that regulate the air pressure to these FSVs are Q-Listed as Quality- related, not safety-related.

Failure of the air regulators either by blockage or sticking full open will not impact the capability of the damper to open.

Failure of the solenoid to de-energize to closed the damper is included in the mechanical failure mode of the damper.

The nonsafety-related solenoid is properly isolated in the 1E circuit.

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Tornado Damper Isolation of Train A Fails to close -Mechanical Status indication in Control None. (See None Redundant Train B Tornado 0-FCO-31-32 supply air normal (west) during tornado failure Room via Limit Switch remarks.) Damper O-FCO-31-33 powered intake during tornado event -Electrical ZS-31-32 from Train B and installed in event failure series accomplished isolation during tornado event Tornado Damper Isolation of Train B Fails to close -Mechanical Status indication in Control None. (See None Redundant Train B Tornado 0-FCO-31-34 supply air normal (west) during tornado failure Room on Panel 1-M-9 via remarks.) Damper O-FCO-31-35 powered intake during tornado event -Electrical Limit Switch ZS-31-34 from Train B and installed in event failure series accomplished isolation during tornado event Tornado Damper Isolation of Train A Fails to close -Mechanical Status indication in Control None. (See None Redundant Train A Tornado 0-FCO-31-33 supply air normal (west) during tornado failure Room on Panel 1-M-9 via remarks.) Damper O-FCO-31-32 powered intake during tornado event -Electrical Limit Switch ZS-31-33 from Train A and installed in event failure series accomplished isolation during tornado event Tornado Damper Isolation of Train B Fails to close -Mechanical Status indication in Control None. (See None Redundant Train A Tornado 0-FCO-31-35 supply air normal (west) during tornado failure Room on Panel 1-M-9 via remarks) Damper O-FCO-31-33 powered intake during tornado event -Electrical Limit Switch ZS-31-35 from Train A and installed in event failure series accomplished isolation during tornado event solation Damper See remarks See remarks See remarks See remarks See remarks See remarks This isolation damper all controls 0-FCO-31-1 are disconnected and the damper is locked in fully open position solation Damper See remarks See remarks See remarks See remarks See remarks See remarks This isolation damper all controls 0-FCO-31-2 are disconnected and the damper is locked in fully open position Flow Control See remarks See remarks See remarks See remarks See remarks See remarks This flow control damper all Damper controls are disconnected and the WBNP-87 0-FCO-31-1A damper is locked in fully open position

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Flow Control See remarks See remarks See remarks See remarks See remarks See remarks This flow control damper all Damper controls are disconnected and the 0-FCO-31-2A damper is locked in fully open position Pressurization See remarks See remarks See remarks See remarks See remarks See remarks This pressurization fan is Fan A-A disconnected and abandoned in place Pressurization See remarks See remarks See remarks See remarks See remarks See remarks This pressurization fan is Fan B-B disconnected and abandoned in place Backdraft Damper See remarks See remarks See remarks See remarks See remarks See remarks This backdraft damper is locked in 0-31-2097 open position Backdraft Damper See remarks See remarks See remarks See remarks See remarks See remarks This backdraft damper is locked in 0-31-2098 open position solation Valve Isolates Main Control Open (during CRI) -Mechanical Status indication in Control None None Redundant safety Train B 0-FCV-31-3 Room Habitability Zone failure Room Panel 1-M-9 via See Remarks Isolation Valve installed in series (MCRHZ) from outside -Control Limit Switch ZS-31-3 will close to provide isolation makeup air supply failure solation Valve Isolates MCRHZ from Open (during CRI) -Mechanical Status indication in Control None None Redundant safety Train A 0-FCV-31-4 outside makeup air failure Room Panel 1-M-9 via (See Remarks) Isolation Valve installed in series supply -Control Limit Switch ZS-31-4 will close to provide isolation failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper To maintain fire barrier Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-3934 integrity between (see remarks need not to be postulated as Mechanical Equip. being concurrent with fire Room Floor El 755.0' and Spreading Room El. 729.0' during fire Fusible link failure Additional independent fusible link (see remarks) -Mechanical Surveillance and None (see None (see remarks) is to be installed (fusible Maintenance (see remarks) link failure) remarks) solation Valve See remarks See remarks See remarks See remarks See remarks See remarks This valve controls are 0-FCV-31-37 disconnected solation Valve See remarks See remarks See remarks See remarks See remarks See remarks This valve controls are 0-FCV-31-36 disconnected Fire Damper To maintain fire barrier Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-3938 integrity between (see remarks) need not to be postulated as Spreading Room El. being concurrent with fire 729.0' & Unit 1 Aux.

Instr. Room El. 708.0' during fire Fusible link failure Additional independent fusible link (see remarks) -Mechanical None. See remarks None. (See None (see remarks) is to be installed (fusible remarks) link failure) 0-XS-31-179 To detect smoke in the Spurious actuation -Electrical Surveillance See remarks None (see remarks) Upon activation of air intake Control Building of smoke detector failure smoke detectors a CRI is initiated.

Pressurization Fan Annunciation in MCR of Operator action will determine if Intake CRI signal the smoke detector activation was WBNP-87 spurious and if so return system to normal operation

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS 0-XS-31-183 To detect smoke in the Spurious actuation -Electrical Surveillance See remarks None (see remarks) Upon activation of air intake Control Building of smoke detector failure smoke detectors a CRI is initiated.

Pressurization Fan Annunciation in MCR of Operator action will determine if Intake CRI signal the smoke detector activation was spurious and if so return system to normal operation Fire Damper Maintain fire barrier Open during fire See remarks See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-3931 between Control Bldg. (see remarks need not to be postulated as roof and Main Control being concurrent with fire Room in case of fire on the roof at the east emergency air intake Closed during CRI Loss of Control Control Bldg. Press. Diff. switches

-Mechanical Loss of Control Room Room None 0-PDS-31-1A, 2A, -3A & -4A start (fusible Press. Diff. Common pressurization redundant Control Bldg.

link) Alarm through switches due to loss of emergency press. fan A-A with its 0-PDS-31-1B, -2B, 3B & - emergency outdoor air intake (west) 4B in Control Room press. fan air flow path through east emerg. air intake Tornado Damper Isolation of emergency Fails to close -Mechanical Status indication via Limit None. See None Redundant Train B Tornado 0-FCO-31-21 outdoor air intake for during Tornado failure Switch ZS-31-21 remarks Damper 0-FCO-31-22 powered Emergency Press Fan Event -Electrical from Train B and installed in B-B during Tornado failure series accomplishes isolation Event during Tornado Event Tornado Damper Isolation of east Fails to close -Mechanical Status indication via Limit None. See None Redundant Train A Tornado 0-FCO-31-22 emergency outdoor air during Tornado failure Switch ZS-31-22 remarks Damper 0-FCO-31-21 powered intake for Emergency Event -Electrical from Train A and installed in WBNP-87 Press Fan B-B during failure series accomplishes isolation Tornado Event during Tornado Event

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolates Emergency Closes during -Mechanical The Loss of Control Loss of air flow None (see remarks) Redundant Train B emerg. press.

0-FCV-31-6 Pressurization Fan A-A Emerg. Press. fan failure. Room Press. Diff. through Emerg. Fan B-B starts upon signal from from normal outdoor air A-A operation -Electrical Common Alarm through Press. Fan A-A the Control Room Press. Diff.

intake (west) supply air & aux. switches 0-PDIS-31-1A, - switches 0-PDI-31-1B, -2B, -3B control air 2A, -3A & -4A and status and -4B failure indication in Control Room on Panel 1-M-9 via Same as above Fails to close Limit Switch ZS-31-6 None (see remarks) during standby -Mechanical May reduce the operation failure The Loss of Control outside air Room Press. Diff. supply and Common Alarm through cause loss of switches 0-PDS-31-1A, - pressurization 2A, 3A & -4A and status indication in Control Room on Panel 1-M-9 via Limit Switch ZS-31-6 WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolates Emerg. Closes during -Mechanical The Loss of Control Loss of air flow None (see remarks) Redundant Train A emerg. press.

0-FCV-31-5 Pressurization Fan B-B Emerg. Press. Fan failure. Room Press. Diff. through Emerg. Fan A-A starts upon signal from from emerg. outdoor air B-B operation -Electrical Common Alarm through Press. Fan B-B the Control Room Press. Diff.

intake (east) supply air & aux. switches 0-PDS-31-1B, - switches 0-PDI-31-1A, -2A, -3A control air 2B, -3B & -4B and status and -4A failure indication in Control Room on Panel 1-M-9 via Same as above Fails to close Limit Switch ZS-31-5 None (see remarks) during standby -Mechanical May reduce the operation failure The Loss of Control outside air Room Press. Diff. supply and Common Alarm through cause loss of switches 0-PDS-31-1B, - pressurization 2B, 3B & -4B and status indication in Control Room via Limit Switch ZS-31-5 Control Bldg. Pressurize Main Control -Fail to start -Mechanical The Loss of Control Loss of Control None The Control Room Press. Diff.

Emergency Air Room Habitability Zone -Stops failure Room Press. Diff. Room Switches 0-PDS-31-1B, -2B, -3B Press. Fan A-A (MCRHZ) during CRI -Electric Common Alarm through pressurization and -4B start the Control Bldg.

failure Switches 0-PDS-31-1A, - due to loss of redundant Train B Emergency Air

-Control 2A, 3A & -4A in Control air flow path Press. Fan B-B failure Room through Train A Control Bldg. Pressurize Main Control -Fails to -Mechanical The Loss of Control Loss of Control None The Control Room Press. Diff.

Emergency Air Room Habitability Zone start failure Room Press. Diff. Room Switches 0-PDS-31-1A, -2B, -3A Press. Fan B-B (MCRHZ) during CRI -Stops -Electrical Common Alarm through pressurization and -4A start the Control Bldg.

failure switches 0-PDS-31-1B, - due to loss of redundant Train A Emergency Air

-Control 2B, 3B and 4B in Control air flow path Press. Fan A-A failure Room through Train B WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper To prevent a fire or Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-4608 smoke from entering the failure need not to be postulated as Control Bldg. being concurrent with fire Emergency Air Cleanup Unit A-A The Control Room Press. Diff.

Closed during CRI Switches 0-PDS-31-1B, -2B, -3B

-Mechanical Loss of Control Room Loss of air flow None and -4B start redundant Train B failure Press. Diff. Common through the Air Cleanup Unit with its Fan B-B.

(fusible Alarm through Switches Train A Air (Existing dual fusible link is left in link) 0-PDS-31-1A, -2A, 3A & - Cleanup Unit place) 4A in Control Room and loss of MCR pressurization Fire Damper To prevent a fire or Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system 0-ISD-31-3958 smoke from entering the failure need not to be postulated as Control Bldg. being concurrent with fire Emergency Air Cleanup Unit B-B The Control Room Press. Diff.

Closed during CRI None Switches 0-PDS-31-1A, -2A, -3A

-Mechanical Loss of Control Room Loss of air flow and -4A start redundant Train A failure Press. Diff. Common through the Air Cleanup Unit with its Fan A-A.

(fusible Alarm through Switches Train B Air (Existing dual fusible link is left in link) 0-PDS-31-1B, -2B, -3B & Cleanup Unit place)

-4B and loss of MCR pressurization WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolation of Emergency Closed during -Mechanical In Control Room Loss of Loss of air flow None. (See remarks) The Control Room Press. Diff.

FCO-31-8 Air Cleanup Unit A-A operation of failure Control Room Press. Diff. path for Switches 0-PDS-31-1B, -2B, -3B Emergency Air -Electrical Common Alarm through Emergency Air. and -4B start redundant Train B Cleanup Unit Fan & Aux Switches 0-PDS-31-1A, Cleanup Unit Fan B-B with its emerg. air A-A Control -2A, -3A and -4A and Fan A-A and cleanup unit Air Failure Damper Status Indication loss of MCR via Limit Switch ZS-31-8 pressurization Pressurization Air is still None. (See remarks) adequately filtered and Control

-Mechanical Damper Status Indication Air flow path is Room Pressurization is still Open during failure via Limit Switch ZS-31-8 open through maintained standby -Electrical Air Cleanup failure Unit during standby solation Damper Isolation of Emergency Closed during -Mechanical In Control Room Loss of Loss of air flow None (See remarks) The Control Room Press. Diff.

FCO-31-7 Air Cleanup Unit B-B operation of failure. Control Room Press. Diff. path for Switches 0-PDS-31-1A, -2A, -3A Emergency Air -Electrical Common Alarm through Emergency Air. and -4A start the Control Bldg.

Cleanup Unit Fan & Aux Switches 0-PDS-31-1B, Cleanup Unit redundant Train A Fan A-A with B-B Control -2B, -3B and -4B and Fan B-B and its emerg. air cleanup unit Air Failure Damper Status Indication loss of MCR via Limit Switch ZS-31-7 pressurization Pressurization Air is still adequately filtered and Control None (See remarks) Room Pressurization is still

-Mechanical Damper Status Indication Air flow path is maintained Open during failure via Limit Switch ZS-31-7 open through standby -Electrical Air Cleanup failure Unit during standby WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Control Bldg. Filters potentially Blocked -Dirty filters Loss of Control Room Reduced or no None. Control Room Press. Diff.

Emergency Air contaminated outside Press. Diff. common air flow through (See Remarks) Switches 0-PDS-31-1B, -2B, -3B Cleanup Unit A-A air prior to MCRHZ Alarm through Switches emergency air and during CRI 0-PDS-31-1A, -2A, -3A, cleanup unit -4B start redundant Train B and -4A and loss of Emerg. Air Cleanup Unit Fan B-B MCR pressurization Control Bldg. Filters potentially Blocked -Dirty filters Loss of Control Room Reduced or no None. (See remarks) Control Room Press. Diff.

Emergency Air contaminated outside Press. Diff. common air flow through Switches 0-PDS-31-1A, -2A, -3A Cleanup Unit B-B air prior to introducing it Alarm through Switches emergency air and into MCRHZ during CRI 0-PDS-31-1B, -2B, -3B, cleanup unit -4A start redundant Train A and and loss of Emerg. Air Cleanup Unit Fan A-A

-4B MCR pressurization Control Bldg. Draws recirc. and -Fails to start -Mechanical Loss of Control Room Loss of air flow None Control Room Press. Diff.

Emergency Air outside air through air -Stops failure Press. Diff. common path through Switches 0-PDS-31-1B, -2B, -3B Cleanup Unit A-A cleanup unit during CRI -Electrical Alarm through Switches Train A and loss and failure 0-PDS-31-1A, -2A, -3A, of MCR -4B start redundant Train B and pressurization Emerg. Air Cleanup Unit Fan B-B

-4A Control Bldg. Draws recirc. and -Fails to start -Mechanical Loss of Control Room Loss of air flow None Control Room Press. Diff.

Emergency Air outside air through air -Stops failure Press. Diff. common path through Switches 0-PDS-31-1A, -2A, -3A Cleanup Unit B-B cleanup unit during CRI -Electrical Alarm through Switches Train B and loss and failure 0-PDS-31-1B, -2B, -3B, of MCR -4A start redundant Train A and pressurization Emerg. Air Cleanup Unit Fan A-A

-4B WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier at the Open during fire -Mechanical See remarks See remarks See remarks Single failure of HVAC system 0-ISD-31-3935 Control Bldg. Emerg. Air failure need not to be postulated as Cleanup Unit (ACU) being concurrent with fire Fan A-A discharge.

(Prevents fire spreading downstream of the Fan The Control Room Press. Diff.

A-A) Switches 0-PDS-31-1B, -2B, Closed during CRI -Mechanical The Loss of Control Room Loss of air flow None. (See remarks) -3B, and -4B start Redundant failure. Press. Diff. Common through the Train B Emerg. Air Cleanup Unit (fusible Alarm through Switches Train A ACU with its Fan B-B link) 0-PDS-31-1A, -2A, -3A, and loss of and MCR

-4A pressurization Fire Damper Fire barrier at the Open during fire -Mechanical See remarks See remarks See remarks Single failure of HVAC system need not 0-ISD-31-3936 Control Bldg. Emerg. Air failure to be postulated as being concurrent Cleanup Unit (ACU) with fire Fan B-B discharge.

(Prevents fire spreading downstream of the Fan Closed during CRI B-B) -Mechanical The Loss of Control Room Loss of air flow None. (See remarks) The Control Room Press. Diff. Switches failure Press. Diff. Common through the 0-PDS-31-1A, -2A, (fusible Alarm through Switches Train B ACU -3A, and -4B start Redundant Train A link) 0-PDS-31-1B, -2B, and loss of Emerg. Air Cleanup Unit with its Fan A-

-3B, and -4b MCR A pressurization WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper 0- Fire barrier between Open during fire -Mechanical See remarks See remarks See remarks Single failures of HVAC system need XFD-31-75 Conference Room and failure not to be postulated as being Technical Support -Electrical concurrent with fire Center failure Close during other modes of operation -ETL Link Surveillance and May result in None (see remarks) These areas are not essential for safe failure Maintenance overheating of shutdown Technical Support Center Fire Damper 0- Fire barrier between Open during fire -Mechanical See Remarks See Remarks See remarks Single failures of HVAC system need XFD-31-83 Relay Room and Main failure not to be postulated as being Control Room -Electrical concurrent with fire failure Close during other modes of operation -ETL Link Surveillance and None. (See None. (See remarks) The transfer opening with fire Damper failure Maintenance remarks) 0-XFD-31-153 provides alternate return air flow path Fire Damper Fire barrier between Open during fire -Mechanical See Remarks See Remarks See remarks Single failures of HVAC system need 0-XFD-31-153 Relay Room and Main failure not to be postulated as being Control Room -Electrical concurrent with fire.

failure Close during other modes of operation -ETL Link Surveillance and None. (See None. (See remarks) This fire damper has two ETL failure Maintenance remarks)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper To prevent smoke or fire Open during fire. -Mechanical See remarks. See remarks. See remarks. Single failure of HVAC system need not 0-XFD-31-99 from the Shift Eng failure to be postulated as being concurrent Office and Conference -Electrical with fire.

Room from being failure introduced into the air recirculation system. Closed during None. (See remarks).

other modes of Surveillance and May result in These areas are not essential for safe operation. -ETL link Maintenance. overheating of shutdown.

failure. Shift Eng Office and Conference Room.

solation Damper Isolate Main Control Close during Air -Mechanical Annunciation in MCR of Loss of air flow None (see remarks). Redundant AHU B-B starts on low air 0-FCO-31-12 Room (MCR) Air Handling Unit A-A failure MCR Air Conditioning path through flow signal from AHU A-A via Flow Handling Unit (AHU) A- operation. -Electrical Safety train switchover, AHU A-A. Switch FS-31-84.

A during standby or failure via Switches O-PDS maintenance. 161, O-FS-31-84 & O-TS-31-88B Open during None (see remarks).

standby operation. -Mechanical Backdraft Damper 0-31-2105 prevents failure backflow.

-Electrical

-Auxiliary Control Air Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolate Main Control Close during Air -Mechanical Annunciation in MCR of Loss of air flow None (see remarks). Redundant AHU A-A starts on low air 0-FCO-31-11 Room (MCR) Air Handling Unit B-B failure MCR Air Conditioning path through flow signal from AHU A-A via Flow Handling Unit (AHU) B- operation. -Electrical Safety train switchover, AHU B-B. Switch FS-31-94.

B during standby or failure via Switches O-PDS maintenance. 186, O-FS-31-94 & O-TS-31-89B Open during None (see remarks).

standby operation. -Mechanical None (see Backdraft Damper 0-31-2104 prevents failure remarks). backflow.

-Electrical

-Auxiliary Control Air Failure Modulating Modulates the air flow Closed (coil -Mechanical Annunciation in MCR of Air bypasses None (see remarks). Temp. Switch TS-31-88B start the Damper 0-FCO- through cooling coil and section). failure MCR Air Conditioning the cooling coil redundant AHU B-B upon high return 31-82 bypass to maintain the -Control Air Safety train switchover, and increase of temp.

temperature at failure via Switches O-PDS space thermostat O-TE-31-82 161, O-FS-31-84 & O-TS- temperature.

(Ref. 5.18)[1] setpoint.31-88B None (see remarks).

Spurious -Control Space Temp. Switch TS-31-88B start the modulation. failure temperature is redundant AHU B-B upon high return not maintained temp.

at thermostat setting.

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Modulating Modulates the air flow Closed (coil -Mechanical Annunciation in MCR of Air bypasses None (see remarks). Temp. Switch TS-31-89B start the Damper through cooling coil and section). failure MCR Air Conditioning the cooling coil redundant AHU A-A upon high return 0-FC0-31-91 bypass to maintain the -Control Air Safety train switchover, and increase of temp.

temperature at failure via Switches O-PDS space thermostat O-TE-31-91 186, O-FS-31-94 & O-TS- temperature.

(Ref. 5.18)[1] setpoint.31-89B None (see remarks).

Spurious -Control Space Temp. Switch TS-31-89B start the modulation. failure temperature is redundant AHU A-A upon high return not maintained temp.

at thermostat setting.

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Main Control Filters the air Clogged -Accumulation Surveillance (PDI-31-87) Reduced Air None (see remarks) Surveillance (PDI-31-87) &

Room Air Handling of dirt and Maintenance (Ref. flow may result Maintenance of filters in accordance Unit A-A 5.18)[1] and Annunciation in rise of space with maintenance procedures. Either in MCR Air Conditioning temperature Temp. Switch 0-TS-31-88B or Flow Filter Cools the supply air to Cooling coil tube -Mechanical Safety Train Switchover None Switch O-FS-31-84 starts redundant Air maintain design break or crack failure via Switches O-PDIS Handling Unit B-B temperature in the 161, O-FS-31-84 & O-TS- Temperature MCRHZ -Steam Boiler 31-88B increase in the Redundant AHU B-B starts upon signal Cooling Coil failure MCRHZ from AHU A-A high temperature switch Provides moisture to No humidification -Steam Control Annunciation in MCR Air O-TS-31-88B maintain the design Valve closes conditioning Safety Train None (see remarks) relative humidity in -Mechanical Switchover via Switches Maintenance of the relative humidity is MCRHZ during normal failure O-PDIS-31-161, O-FS- Decrease of not required for safe shutdown of plant operation mode -Electrical 31-84 & O-TS-31-88B Relative Humidifier failure Humidity Humidification Moisture Indicator MI Control Valve fails -Mechanical 176 on Panel L-629 None MCR moisture level will not exceed Circulates the air open failure design requirements

-Electrical Moisture Indicator MI -Fails to failure 176 on Panel L-529 None Redundant AHU B-B starts upon signal start None (see remarks) from AHU A-A Air flow Switch FS-31-84

-Stops

-Mechanical Annunciation in MCR of failure MCR Air Conditioning Loss of air flow

-Electrical Safety Train Switchover through AHU A-Fan failure via Switches O-PDIS A When both AHU are operating the Fails to stop or, 161, O-PS-31-84 & O-TS- None (see remarks) common ductwork static pressure does starts31-88B not exceed 6 inches W.G. safety-related duct design pressure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS

-Electrical Annunciation in MCR of Increased failure MCR Air Conditioning pressure in duct Safety Train Switchover via Switches O-PDIS 161, O-FS-31-84 & O-TS-31-88B Main Control Room Air Handling Unit B-B Filter Filters the air Clogged -Accumulation Surveillance (PDI-31-97) Reduced Air None (see remarks) Surveillance (PDI-31-97) &

of dirt and Maintenance (Ref. flow may result Maintenance of filters in 5.18)[1] and Annunciation in rise of space accordance with maintenance in MCR Air Conditioning temperature procedures. Either Temp. Switch Safety Train Switchover O-FS-31-94 starts redundant Air via Switches O-PDIS Handling Unit A-A 186, O-FS-31-94 & O-TS-31-89B Temperature None Redundant AHU A-A starts upon Cooling Coil Cools the supply air to Cooling coil tube -Mechanical increase in the signal from AHU B-B high maintain design break or crack failure Annunciation in MCR Air MCRHZ temperature switch O-TS-31-88B temperature in the conditioning Safety Train MCRHZ Switchover via Switches O-PDIS-31-186, O-FS-31-94 & O-TS-31-89B WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Provides moisture to Moisture Indicator MI maintain the design 201 on Panel L-530 Maintenance of the relative humidity is relative humidity in No humidification Decrease of not required for safe shutdown of plant MCRHZ during normal Relative Humidifier operation mode -Steam Boiler Humidity None (see remarks) MCR moisture level will not exceed failure design requirements Circulates the air -Steam Control None Valve Moisture Indicator MI None Redundant AHU A-A starts upon signal Humidification closes 201 on Panel L-530 from AHU B-B Air flow Switch FS-31-94 Control Valve fails -Mechanical Loss of air flow open failure through AHU A- None (see remarks)

Fan -Electrical Annunciation in MCR of A

-Fails to failure MCR Air Conditioning start Safety Train Switchover

-Stops via Switches O-PDIS -Mechanical 186, O-PS-31-94 & O-TS- When both AHU are operating the failure 31-89B common ductwork static pressure does

-Electrical not exceed 6 inches W.G. safety-Fails to stop or, failure Annunciation in MCR of related duct design pressure starts MCR Air Conditioning Increased None (see remarks)

Safety Train Switchover pressure in duct

-Mechanical via Switches O-PDIS failure 186, O-FS-31-94 & O-TS-

-Electrical 31-89B failure

-Electrical WBNP-87 failure

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Backdraft Damper Prevent backflow from Fails to open - Mechanical Annunciation in MCR of Loss of flow None (See Remarks) Redundant AHU B-B start upon signal 0-BKD-31-2105 AHU B-B through Failure MCR Air Conditioning through from AHU A-A Air Flow AHU A-A when on Safety Train switchover AHU A-A Switch FS-31-84 standby via Switches 0-PDIS-31-161, 0-FS-31-84, and O-TS-31-88B None Isolation Damper 0-FCO-31-12 Fails to close None (See prevents the backflow (AHU A-A on - Mechanical Remarks)

Standby) Failure Backdraft Damper Prevent backflow from Fails to open - Mechanical Annunciation in MCR of Loss of air flow None (See Remarks) Redundant AHU A-A starts upon signal 0-BKD-31-2104 AHU A-A through Failure MCR Air Conditioning through from AHU B-B Air Flow Switch AHU B-B when on Safety Train switchover AHU B-B FS-31-94 standby via Switches O-PDIS-31-186, O-FS-31-94, and 0-TS-31-89B None Isolation Damper 0-FCO-31-11 Fails to Close None (See prevents the backflow (AHU B-B on - Mechanical Remarks)

Standby) Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper To prevent smoke Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system used to 0-XFD-31-98 spreading to Failure be postulated as being concurrent with Conference Room, Shift - Electrical fire Eng. Office, Lockers, Failure Toilet, and Kitchen None (See Remarks) This fire damper has two ETL links Close during other modes of operation Surveillance and None (See Maintenance Remarks)

- ETL Link Failure Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system used to 0-XFD-31-86 Relay Room and Main Failure be postulated as being concurrent with Control Room - Electrical fire Failure Close during other None (See Remarks) This fire damper has two ETL Links modes of operation Surveillance and None (See Maintenance Remarks)

- ETL Link Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Prevent fire spreading Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-4402 to Conference Room Failure not to be postulated as being concurrent with fire Close during other None (See Remarks) modes of operation Surveillance and Loss of supply Maintenance of the room design

- Fusible Link Maintenance air to room temperature is not essential to the Failure Control Building Safety Function Fire Damper Prevent fire spreading Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-4404 to NRC Office Failure not to be postulated as being concurrent with fire Close during other See Remarks modes of operation Surveillance and Loss of supply Maintenance of the room design

- Fusible Link Maintenance air to room temperature is not essential to the Failure Control Building Safety Function Fire Damper Fire barrier to Technical Open during fire -Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-76 Support Center (TSC) Failure not to be postulated as being concurrent with fire.

Close during other See Remarks modes for Surveillance and Loss of supply Maintenance of the room design operation -Fusible Link Maintenance air to the room temperature is not essential to the Failure Control Building Safety Function MCR Water Chiller Cooling of Chilled Water -Fails to -Mechanical Annuniciation in MCR of Increase in None Redundant MCR Air Conditioning Train A-A start Failure MCR Air Conditioning chilled water B is started by any of Switches 0-PDIS-

-Stops -Electrical Safety Train Switchover temperature 31-161, 0-FS-31-84 & 0-TS-31-88B Failure via Switches 0-PDIS 161, 0-FS-31-84 & 0-TS-31-88B WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS MCR Water Cooling of Chilled Water - Fails to start - Mechanical Annunciation in MCR of Increase in None Redundant MCR Air Conditioning Chiller B-B - Stops Failure MCR Air Conditioning chilled water Train A is started by any of Switches

- Electrical Safety Train switchover temperature 0-PDIS-31-186, 0-FS-31-94, and Failure via Switches 0-TS-31-88B 0-PDIS-31-186, 0-FS 94 and 0-TS-31-89B MCR Chilled Water Circulate the chilled - Fails to start - Mechanical Annunciation in MCR of Loss chilled None Redundant MCR Air Conditioning Circulation water - Stops Failure MCR Air Conditioning water flow Train B is started by any of Switches Pump A-A - Electrical Safety Train switchover 0-PDIS-31-161, 0-FS-31-84, and Failure via Switch 0-PDIS-31-161 0-TS-31-88B Redundant MCR Air Conditioning Train B is started by any of Switches Leakage through Annunciation in MCR of 0-PDIS-31-161, 0-FS-31-84, and seals MCR Air Conditioning Decrease of None 0-TS-31-88B Safety Train switchover water content in

- Mechanical via the system Failure Switches 0-PDIS-31-161, 0-FS-31-84, and 0-TS-31-88B WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS MCR Water Circulate the chilled - Fails to start - Mechanical Annunciation in MCR of Loss of chilled None Redundant MCR Air Conditioning Chiller B-B water - Stops Failure MCR Air Conditioning water flow Train A is started by any of Switches

- Electrical Safety Train switchover 0-PDIS-31-186, 0-FS-31-94, and Failure via Switch 0-PDIS-31-186 0-TS-31-89B Redundant MCR Air Conditioning Train A is started by any of Switches Leakage through Annunciation in MCR of Decrease of 0-PDIS-31-186, 0-FS-31-94, and seals MCR Air Conditioning water content in None 0-TS-31-89B Safety Train switchover the system

- Mechanical via Failure Switches 0-PDIS-31-186, 0-FS-31-94, and 0-TS-31-89B Check Valve Prevents reverse flow Stuck closed - Mechanical Annunciation in MCR of Loss of chilled None Redundant MCR Air Conditioning 0-CKV-31-2193 Failure MCR Air Conditioning water flow Train B is started by any of Switches Safety Train switchover 0-PDIS-31-161, 0-FS-31-84, and via 0-TS-31-88B Switches 0-PDIS-31-161, 0-FS-31-84, and 0-TS-31-88B The subsystem has only one pump.

Check valve is preventing backflow None during maintenance Stuck open None

- Mechanical Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Check Valve Prevents reverse flow Stuck closed - Mechanical Annunciation in MCR of Loss of chilled None Redundant MCR Air Conditioning 0-CKV-31-2235 Failure MCR Air Conditioning water flow Train B is started by any of Switches Safety Train Switchover 0-PDIS-31-186, 0-FS-31-94, and via Switches 0-TS-31-89B 0-PDIS-31-186, O-FS-31-94, and 0-TS-31-89B The subsystem has only one pump.

Check valve is preventing backflow None (See during maintenance Stuck open Remarks) None

- Mechanical Failure Chilled Water Provide chilled water Pipe break or crack - Mechanical Annunciation in MCR of Decrease of None Redundant MCR air conditioning Piping system flow path Failure MCR Air Conditioning water content in subsystems are started by any of the Safety Train switchover the system associated switches 0-PDIS-31-161, via 0-FS-31-84, and 0-TS-31-88B for Switches 0-PDIS-31-161, Train A and 0-PDIS-31-186, 0-FS-31-84, and 0-FS-31-96, and 0-TS-31-89B for 0-TS-31-88B for Train A Train B and 0-PDIS-31-186, 0-FS-31-94, and 0-TS-31-89B for Train B. None Chilled Water Provides shut-offs - Leakage - Mechanical Annunciation in MCR of Decrease of None Redundant MCR air conditioning System Manual Failure MCR Air Conditioning water content in subsystems are started by any of the Shut-off Valves Safety Train switchover the system associated switches 0-PDIS-31-161, via 0-FS-31-84, and 0-TS-31-88B for Switches 0-PDIS-31-161, Train A and 0-PDIS-31-186, 0-FS-31-84, and 0-FS-31-96, and 0-TS-31-89B for 0-TS-31-88B for Train A Train B and 0-PDIS-31-186, WBNP-87 0-FS-31-94, and 0-TS-31-89B for Train B.

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-3978 Central Alarm Station Failure not to be postulated as being Room and concurrent with fire Communications Room Additional independent fusible link is Closed during None (See Remarks) installed other modes of Surveillance and None (See operation - Fusible Link Maintenance Remarks)

Failure Fire Damper Fire barrier between Open during fire - Mechanical See Remarks None (See None (See Remarks) Single failures of HVAC system need 0-ISD-31-2037 Communications Room Failure Remarks) not to be postulated as being and Mechanical concurrent with fire Equipment Room 692.0-C10 Additional independent fusible link to be Closed during None (See Remarks) installed other modes of Surveillance and None (See operation - Fusible Link Maintenance Remarks)

Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Dampers (2) Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-2038 Communication Room Failure not to be postulated as being and and Mechanical concurrent with fire 0-ISD-31-3951 Equipment Room 692.0-C10 and Communication Room and corridor, respectively Additional independent fusible link is installed Closed during None (See Remarks) other modes of Surveillance and None (See operation - Fusible Link Maintenance Remarks)

Failure Fire Damper (2) Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-4617 corridor and Mechanical Failure not to be postulated as being and Equipment concurrent with fire 0-ISD-31-3941 Room 692.0-C2 Additional independent fusible link to be Closed during See Remarks installed other modes of Surveillance and None (See operation - Fusible Link Maintenance Remarks)

Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier and isolation Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 2-ISD-31-2058 between Unit 2 Auxiliary Failure not to be postulated as being Instrument Room and - Electrical concurrent with fire. See Item 69B for Computer Room Failure CO2 system spurious actuation Additional independent fusible link is installed Closed during None (See Remarks) other modes of Surveillance and None (See operation Maintenance Remarks)

- Fusible Link Failure Fire Damper Fire barrier between Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-3968 Computer Room and Failure not to be postulated as being Unit 1 Auxiliary concurrent with fire Instrument Room Fire damper has two independent fusible links installed Closed during None (See Remarks) other modes of Surveillance and None (See operation - Fusible Link Maintenance Remarks)

Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper (2) Fire barrier and isolation Open during fire - Mechanical See Remarks See Remarks See Remarks Same as above. See Item 69B for CO2 0-ISD-31-3957 between Computer Failure system spurious activation.

Room and Unit 1 - Electrical Auxiliary Instrument Failure Room Additional independent fusible link to be Closed during None (See Remarks) installed other modes of Surveillance and None (See operation Maintenance Remarks)

- Fusible Link Failure Fire Dampers (3) Isolation of the Unit 1 Open during fire - Mechanical See Remarks See Remarks See Remarks Same as above. See Item 69B for CO2 1-ISD-31-3958, Auxiliary Instrument Failure system spurious actuation 1-ISD-31-3959, Room - Electrical and 1-ISD- Failure 31-3961 Additional independent fusible link is Closed during None (See Remarks) installed other modes of None (See operation Remarks)

- Fusible Link Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Prevent spreading of Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-4297 fire Failure not to be postulated as being concurrent with fire Additional independent fusible link is installed Closed during None (See Remarks) other modes of Surveillance and None (See operation - Fusible Link Maintenance Remarks)

Failure Backdraft Damper See Remarks See Remarks See Remarks See Remarks See Remarks See Remarks This backdraft damper is not required 0-BKD-31-2086 since the air flow can be controlled by Bolancing Damper 0-31-2087 and is locked in open position WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper To maintain fire barrier Open during fire - Mechanical See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-3971 integrity between Unit 1 (See Remarks) Failure not to be postulated as being Auxiliary Instrument concurrent with fire Room Elev. 708.0 and Mechanical Equipment Room 692.0-C2, Elev. 692.0 This fire damper has two independent Fusible link failure None (See Remarks) fusible links (See Remarks) Surveillance and None (See Mechanical Maintenance Remarks)

(fusible link failure)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolate Electrical Board Close during AHUs - Mechanical Annunciation in MCR of Loss of air flow None Redundant Train B AHUs C-B and D-B 0-FCO-31-30 Room AHUs A-A and A-A and B-A Failure MCR Air Conditioning path through start on low air flow signal from AHUs B-B while on standby operation - Electrical Safety Train Switchover AHUs A-A and A-A and B-A Air Flow Switches Failure via Switches B-A FS-31-117 or FS-31-123 0-PDIS-31-211, 0-FS-31-117 and -123, and 0-TS-31-150B Backdraft dampers 0-31-2001A and 0-31-2001B prevents backflow Open when AHUs None (See None (See Remarks) are on standby Remarks)

- Mechanical Failure

- Electrical and Auxiliary Control Air Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolate Electrical Board Close during AHUs - Mechanical Annunciation in MCR of Loss of air flow None Redundant Train A AHUs A-A and B-A 0-FCO-31-31 Room AHUs C-B and C-B and D-B Failure MCR Air Conditioning path through start on low air flow signal from AHUs D-B while on standby operation - Electrical Safety Train Switchover AHUs C-B and C-B and D-B Air Flow Switches Failure via Switches D-B FS-31-126 or FS-31-154 0-PDIS-31-241, 0-FS-31-126 and -154, and 0-TS-31-157B Backdraft Dampers 0-31-3972 and 0-31-3973 prevents backflow Open when AHUs None (See None (See Remarks) are on standby Remarks)

- Mechanical Failure

- Electrical and Auxiliary Control Air Failure Modulating Modulates the air flow Open - Mechanical Annunciation in MCR of Air bypasses None (See Remarks) Temperature Switch TS-31-150B starts Dampers (2) through cooling coil and Failure MCR Air Conditioning the cooling coil the redundant AHUs upon Temp.

0-FCO-31-335 & bypass of AHU's A-A & - Control Air Safety Train and results in Element TE-31-150B sensing high 0-FCO-31-336 B-A to maintain the Failure Switchover[1] increase of return air temperature temperature at space thermostat setpoint temperature Same as above None (See Remarks)

Spurious modulation

- Control Space is not Failure maintained at set temperature WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Modulating Modulates air flow Open - Mechanical Annunciation in MCR of Air bypasses None (See Remarks) Temperature Switch TS-31-157B starts Dampers (2) through cooling coil and Failure MCR Air Conditioning the cooling coil the redundant AHUs upon Temp.

0-FCO-31-337 and bypasses of AHUs C-B - Control Air Safety Train Switchover and results in Element TE-31-157B sensing high 0-FCO-31-338 and D-B to maintain the Failure via Switches increase of return air temperature temperature at 0-PDIS-31-241, space thermostat setpoint 0-FS-31-126 and -154, temperature and 0-TS-31-157B Same as above None (See Remarks)

Spurious modulation

- Control Space is not Failure maintained at set temperature WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Electrical Board Filters the air Clogged Accumulation Surveillance PDI-31-121 Reduced air None (See Remarks) Surveillance (PDI-31-120 and -121)

Rooms (EBR) Air of dirt (Reference 5.19)[1] and flow and maintenance of filters in Handling Units Maintenance and accordance with maintenance AHU) A-A and Annunciation in MCR of procedures. Either Temp. Switch B-A EBR Air Conditioning 0-TS-31-150B of Flow Switches

- Filters Safety Train Switchover 0-FS-31-117 and -123 starts redundant via Switches AHUs C-B and D-B

- Cooling Coil Cools the supply air Cooling coil tube - Mechanical 0-PDIS-31-211, break or crack Failure 0-FS-31-117 and -123, Redundant AHUs C-B and D-B starts and 0-TS-31-150B None (See Remarks) upon signal from AHUs A-A and B-A

- Humidifier Provides moisture to No humidification - Steam Boiler Temperature High Temp Switch TS-31-150B maintain the design Failure Annunciation in MCR of increases in the Maintenance of the relative humidity is Relative Humidity in - Steam Control EBR Air Conditioning EBR space not required for safe shutdown of plant EBR spaces during Valve Safety Train Switchover normal operation mode Closes via Switches None

- Mechanical 0-PDIS-31-211, None (See

- Fan Circulates the air - Fails to Failure 0-FS-31-117 and -123, Remarks) start - Electrical and 0-TS-31-150B Redundant AHUs C-B and D-B starts

- Stops Failure upon signal from AHUs A-A or B-A Air Moisture Indicator Flow Switches FS-31-117 or FS-31-123 MI-31-231 on Local Panel L-523 When both AHUs are operating, the

- Fails to - Mechanical None (See Remarks) common ductwork static pressure does stop or Failure Annunciation in MCR of Loss of air flow not exceed 6 inches W.G.

start - Electrical EBR Air Conditioning through AHU safety-related duct design pressure Failure Safety Train Switchover via Switches O-PDIS-31-117 and -123 None (See Remarks) and 0-TS-31-150B Increased pressure in duct Electrical WBNP-87 Failure

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Annunciation in MCR of EBR Air Conditioning Safety Train Switchover via Switches 0-PDIS-31-211, O-FS-31-117 and

-123, and 0-TS-31-150B Backdraft Prevent backflow from Fails to open - Mechanical Failure Annunciation in Loss of air flow None (See Remarks) Redundant AHUs C-B and D-B starts Dampers (2) Train B AHUs through MCR of EBR Air through AHUs upon signal from AHUs A-A or B-A Air 0-BKD-31-2001A Train A air handling Conditioning Safety A-A and B-A Flow Switches FS-31-117 and and units when on standby Train Switchover via FS-31-123, respectively 0-BKD-31-2001B Switches 0-PDIS-31-211, 0-FS-31-117 and

-123, and 0-TS-31-150B Isolation Damper 0-FCO-31-30 prevents the backflow None (See None Fails to close - Mechanical Failure Remarks)

(AHUs A-A and B-A on standby)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Backdraft Prevent backflow from Fails to open - Mechanical Failure Annunciation in Loss of air flow None (See Remarks) Redundant AHUs A-A and B-A starts Dampers (2) Train A AHUs through MCR of EBR Air through AHUs upon signal from AHUs C-B or D-B Air 0-BKD-31-3972 Train B air handling Conditioning Safety A-A and B-A Flow Switches FS-31-126 and and units when on standby Train Switchover via FS-31-154, respectively 0-BKD-31-3973 Switches 0-PDIS-241, 0-FS-31-126 and

-154, and 0-TS-31-157B Isolation Damper 0-FCO-31-31 prevents the backflow None (See None Fails to close - Mechanical Failure Remarks)

(AHUs C-B and D-B on standby)

Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3942 Mechanical Equipment not to be postulated as being Room 692.0-C2 and concurrent with fire 250V Battery Room #1 Additional independent fusible link is Closed during other None (See Remarks) installed modes of operation - Mechanical Failure Surveillance and None (See Maintenance Remarks)

Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3943 250V Battery Room #1 not to be postulated as being and 250V Battery Board concurrent with fire Room #1 Additional independent fusible link is Closed during other None (See Remarks) installed WBNP-87 modes of operation - Fusible Link Surveillance and None (See Failure maintenance Remarks)

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3944 250V Battery Board not to be postulated as being Room #1 and 250V concurrent with fire Battery Board Room #2 Additional independent fusible link is Closed during other None (See Remarks) installed modes of operation - Fusible Link Surveillance and None (See Failure Maintenance Remarks)

Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3947 250V Battery Board not to be postulated as being Room #2 and 250V concurrent with fire Battery Room #2 Additional independent fusible link is Closed during other See Remarks installed modes of operation - Mechanical Failure Surveillance and None (See Maintenance Remarks)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3948 250V Battery Room #2 not to be postulated as being and 24V and 48V concurrent with fire Battery Room Closed during other See Remarks Additional independent fusible link is installed modes of operation - Fusible Link None (See None (See Failure Remarks) Remarks)

Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3949 24V and 48V Battery not to be postulated as being Room and 24V and 48V concurrent with fire Battery Board and Charge Room Additional independent fusible link is Closed during other See Remarks installed modes of operation - Mechanical Failure Surveillance and None (See Maintenance Remarks)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3950 24V and 48V Battery not to be postulated as being Board and Charge concurrent with fire Room and Central Alarm Station Room Additional independent fusible link is Closed during other See Remarks installed modes of operation - Fusible Link Surveillance and None (See Failure Maintenance Remarks)

Fire Dampers (2) Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3976 Central Alarm Station not to be postulated as being and 0-ISD Room and concurrent with fire 3977 Communication Room Additional independent fusible link is Closed during other See Remarks installed modes of operation - Mechanical Failure Surveillance and None (See Maintenance Remarks)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC systems need 0-ISD-31-3970 Unit 1 Auxiliary not to be postulated as being Instrument Room and concurrent with fire the Mechanical Equipment Room 692.0-C2 This fire damper has two independent Closed during other None (See Remarks) fusible links modes of operation - Mechanical Failure Surveillance and None (See Maintenance Remarks)

Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-3969 Unit 1 Auxiliary not to be postulated as being Instrument Room and concurrent with fire Computer Room Fire damper has two independent Closed during other None (See Remarks) fusible links installed modes of operation - Mechanical Failure Surveillance and None (See Maintenance Remarks)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Same as above. See Item 69B for CO2 2-ISD-31-3955 Computer Rooms and system spurious actuation Unit 2 Auxiliary Instrument Room Additional independent fusible link is Closed during other None (See Remarks) installed modes of operation - Fusible Link Surveillance and None (See Failure Maintenance Remarks)

Fire Damper Prevents spreading fire Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system need 0-ISD-31-4296 not to be postulated as being concurrent with fire Close during other None (See Remarks) Additional independent fusible link is modes of operation - Fusible Link Surveillance and None (See installed Failure Maintenance Remarks)

Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3956 Unit 1 Auxiliary need not to be postulated as Instrument Room and being concurrent with fire. See Computer Room Item 69B for CO2 system spurious failure Close during other None (See Remarks) Additional independent fusible modes of operation - Fusible Link Surveillance and None (See link is installed WBNP-87 Failure Maintenance Remarks)

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Provide isolation of Unit Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 1-ISD-31-3960 1 Auxiliary Instrument need not to be postulated as Room during CO2 fire being concurrent with fire. See extinguishing Item 69B for CO2 system spurious failure. This fire damper has CO2 actuator without fusible link See Item 69B for CO2 system spurious failure Fire Damper Provide isolation of Closed during a - Electrical Failure Annunciation in Loss of cooling None Plant can be shut down from 2-ISD-31-2058 Unit #1 and Unit #2 spurious actuation MCR following a in Unit #1 and Auxiliary Control Room 2-ISD-31-3955 Auxiliary Instrument of the CO2 system CO2 discharge Unit #2 Auxiliary 0-ISD-31-3956 Rooms and Computer Instrument 0-ISD-31-3657 Room during CO2 fire Rooms and 1-ISD-31-3958 extinguishing. Computer 1-ISD-31-3959 Room 1-ISD-31-3960 1-ISD-31-3961 Surveillance and Maintenance EBR Water Cooling of chilled water - Fails to start - Mechanical Failure Annunciation in Increase in None Redundant EBR air conditioning Chiller A-A MCR of EBR Air chilled water subsystem is started by any of

- Stops - Electrical Failure Conditioning Safety temperature Switches 0-PDIS-31-211, Train Switchover via 0-FS-31-117 and -123, and Switches 0-TS-31-150B 0-PDIS-31-211, 0-FS-31-117 and

-123, and O-TS-31-150B WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS EBR Water Chiller Cooling of chilled water - Fails to start - Mechanical Failure Annunciation in Increase in None Redundant EBR air conditioning B-B - Electrical Failure MCR of EBR air chilled water subsystem is started by any of

- Stops conditioning safety temperature Switches 0-PDIS-31-241, train switchover via 0-FS-31-126 and -156, and Switches 0-TS-31-157B 0-PDIS-31-241, 0-FS-31-126 and

-154, and 0-TS-31-157B EBR Chilled Water Circulate the chilled - Fails to start - Mechanical Failure Annunciation in Loss of chilled None Redundant EBR air conditioning Circ. Pump A-A water - Stops - Electrical Failure MCR of EBR air water flow Train B is started by any of conditioning safety Switches 0-PDIS-31-211, train switchover via 0-FS-31-117 and -123, and Switch 0-TS-31-150B 0-PDIS-31-211 Same as above Leakage through Decrease of seals - Mechanical Failure water content in None Annunciation in the system MCR of EBR air conditioning safety train switchover via Switches 0-PDIS-31-211, 0-FS-31-117 and

-123, and 0-TS-31-150B WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS EBR Chilled Water Circulate the chilled - Fails to start - Mechanical Failure Annunciation in Loss of chilled None Redundant EBR air conditioning Circ. Pump B-B water - Electrical Failure MCR of EBR air water flow Train A is started by any of

- Stops conditioning safety Switches 0-PDIS-31-241, train switchover via 0-FS-31-126 and -154, and Switch 0-TS-31-157B 0-PDIS-31-241 Same as above Leakage through Decrease of seals - Mechanical Failure water content in None Annunciation in the system MCR of EBR air conditioning safety train switchover via Switches 0-PDIS-31-241, 0-FS-31-126 and

-154, and 0-TS 157B Check Valve Prevent reverse flow Stuck closed - Mechanical Failure Annunciation in Loss of chilled None Redundant EBR air conditioning 0-CKV-31-2307 MCR of EBR air water flow Train B is started by any of conditioning safety Switches 0-PDIS-31-211, train switchover via 0-FS-31-117 and -123, and Switches 0-TS-31-150B 0-PDIS-31-211, 0-FS-31-117 and The subsystem has only one

-123, and None pump. Check valve prevents 0-TS-31-150B None backflow during maintenance Stuck open - Mechanical Failure WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Check Valve Prevent reserve flow Stuck closed - Mechanical Failure Annunciation in Decrease of None Redundant EBR air conditioning 0-CKV-31-2364 MCR of EBR air water content in Train A is started by any of conditioning safety the system switches 0-PDIS-31-241, train switchover via 0-FS-31-126 and -154, and Switches 0-PDI 0-TS-31-157B.

241, 0-PS-31-126 and -154 and 0-TS-31-157B The subsystem has only one pump. Check valve prevents Stuck open - Mechanical Failure None None backflow during maintenance.

Chilled Water Provide chilled water Pipe break or crack - Mechanical Failure Annunciation in Decrease of None Redundant EBR air conditioning Piping system flow path MCR of EBR air water content in subsystem is started by any of conditioning safety the system Switches 0-PDIS-31-177 and train switchover via -123, 0-TS-31-150B for Train A, Switches and 0-PDIS-31-241, 0-FS-31-126 0-PDIS-31-211, and -154, and 0-TS-31-157B for 0-FS-31-117 and Train B

-123, and 0-TS-31-150B for Train A, and 0-FS-31-241, 0-FS-31-126 and

-154, and 0-TS-31-157B for Train B.

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Chilled Water Provide Shut-Offs - Leakage - Mechanical Failure Annunciation in Decrease of None Redundant EBR Air Conditioning System manual MCR of EBR air water content in Subsystems are started by any of shut-off valves conditioning safety the system the associated Switches train switchover via 0-PDIS-31-211, 0-FS-31-117 and Switches -123, and 0-TS-31-150B for 0-PDIS-31-211, Train A, and 0-PDIS-31-241, 0-FS-31-117 and 0-FS-31-126 and -154, and

-123, and 0-TS-31-157B for Train B 0-TS-31-150B for Train A, and 0-PDIS-31-241, 0-FS-31-126 and

-154, 0-TS-31-157B for Train B Fire Dampers (3) Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2013 Battery Board Rooms need not to be postulated as 0-ISD-31-2018 and Corridor being concurrent with fire.

0-ISD-31-2029 Additional independent fusible Close during other None (See Remarks) link is installed.

modes of operation - Fusible Link Surveillance and None (See Failure Maintenance Remarks)

Fire Dampers (3) Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2010 Battery Rooms and need not to be postulated as 0-ISD-31-2021 Corridor being concurrent with fire.

0-ISD-31-2028 Additional independent fusible None (See Remarks) link is installed.

Close during other None (See WBNP-87 modes of operation - Fusible Link Surveillance and Remarks)

Failure Maintenance

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2024 24V and 48V Battery need not to be postulated as Room and 250V Battery being concurrent with fire.

Room #2 Additional independent fusible link is installed.

None (See Remarks)

Close during other None (See modes of operation - Fusible Link Surveillance and Remarks)

Failure Maintenance Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2019 250V Battery Room #2 need not to be postulated as and 250 Battery Board being concurrent with fire.

Room #2 Additional independent fusible Close during other None (See Remarks) link is installed.

modes of operation - Mechanical Failure Surveillance and None (See Maintenance Remarks)

Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3945 250V Battery Board need not to be postulated as Room #2 and 250V being concurrent with fire.

Battery Board Room #1 Additional independent fusible None (See Remarks) link is installed.

Close during other None (See modes of operation - Fusible Link Surveillance and Remarks)

Failure Maintenance WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2012 250V Battery Board need not to be postulated as Room #1 and 250V being concurrent with fire.

Battery Room #1 Additional independent fusible link is installed.

None (See Remarks)

Close during other None (See modes of operation - Fusible Link Surveillance and Remarks)

Failure Maintenance Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-2007 Battery Room #1 and need not to be postulated as Mechanical Equipment being concurrent with fire.

Room 692.0-C2 Additional independent fusible Close during other None (See Remarks) link is installed.

modes of operation - Fusible Link Surveillance and None (See Failure Maintenance Remarks)

Battery Room Battery rooms exhaust - Fails to start - Mechanical Failure Alarm in MCR via Loss of battery None (See Remarks) Redundant Battery Exhaust Fan Exhaust Fan A-A to prevent hydrogen -Stops - Electrical Failure Airflow Switch rooms exhaust B-B starts on Low Air Flow signal buildup 0-FS-31-402 from Fan A-A Air FLow Switch 0-FS-31-402 Battery Room Battery rooms exhaust - Fails to start - Mechanical Failure Alarm in MCR via Loss of battery None (See Remarks) Redundant Battery Exhaust Fan Exhaust Fan B-B to prevent hydrogen -Stops - Electrical Failure Airflow Switch rooms exhaust A-A starts on Low Air Flow signal buildup 0-FS-31-401 from Fan B-B Air Flow Switch 0-FS-31-401 WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Backdraft Damper Prevents backflow Fails to open - Mechanical Failure Alarms in MCR via Loss of airflow None (See Remarks) Redundant Battery Exhaust Fan 0-BKD-31-2163 Airflow Switch path through B-B starts on Low Air Flow signal 0-FS-31-402 Exhaust Fan from Fan A-A Air Flow Switch B-B 0-FS-31-402 None (See None Isolation Damper 0-FCO-31-28 Fails to close - Mechanical Failure Remarks) prevents backflow Backdraft Damper Prevents backflow Fails to open - Mechanical Failure Alarms in MCR via Loss of airflow None (See Remarks) Redundant Battery Exhaust Fan 0-BKD-31-2162 Airflow Switch path through A-A starts on Low Air Flow signal 0-FS-31-401 Exhaust Fan from Fan B-B Air Flow Switch B-B 0-FS-31-401 None (See None Isolation Damper 0-FCO-31-29 Fails to close - Mechanical Failure Remarks) prevents backflow solation Damper Isolates Fan A-A when Close during Fan - Mechanical Failure Alarm in MCR via Loss of Airflow None Redundant Battery Exhaust Fan 0-FC0-31-28 on standby A-A operation - Electrical Failure Airflow Switch 0-FS- Path through B-B starts on Low Air Flow signal 31-402 Exhaust Fan A- from Fan A-A Air Flow Switch 0-A FS-31-0-402.

Backdraft Damper 0-31-2163 will Open when Fan A- prevent backflow through fan.

A is on Standby - Mechanical Failure Damper Status None

- Electrical Failure Indication on Panel None (See 1-M-9 in MCR via Remarks)

Limit Switch ZS 28 WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolates Fan B-B when Close during Fan - Mechanical Failure Alarm in MCR via Loss of Airflow None Redundant Battery Exhaust Fan 0-FC0-31-29 on standby B-B operation - Electrical Failure Airflow Switch 0-FS- Path through A-A starts on Low Air Flow signal 31-401 Exhaust Fan A- from Fan B-B Air Flow Switch 0-Open when Fan B- A FS-31-0-401.

B is on Standby - Mechanical Failure Damper Status None

- Electrical Failure Indication on Panel None (See Backdraft Damper 0-31-2163 will 1-M-9 in MCR via Remarks) prevent backflow through fan.

Limit Switch ZS 29 Fire Damper Fire Barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3940 Mechanical Equipment need not to be postulated as Room 692.0-C2 and concurrent with fire.

Unit #1 Aux. Instr. Rm 708.0 C1 Close during other None (See Remarks) Additional independent fusible modes of operation - Fusible Link Surveillance and None (See link is installed Failure Maintenance Remarks)

Fire Damper Fire Barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3939 Unit #1 Aux. Instr. need not to be postulated as Room 708.0 C1 and concurrent with fire.

Spreading Room Close during other None (See Remarks) Additional independent fusible modes of operation - Fusible Link Surveillance and None (See link is installed Failure Maintenance Remarks)

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire Barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3932 Spreading Room and need not to be postulated as MCRHZ concurrent with fire.

Close during other None (See Remarks) Additional independent fusible modes of operation - Fusible Link Surveillance and None (See link is installed Failure Maintenance Remarks)

Tornado Damper Isolation during Tornado Fails to close - Mechanical Failure Status Indication in None (See None Redundant Tornado Damper 0-0-FC0-31-14 Event during Tornado - Electrical Failure Equip. Rm. via Limit Remarks) FC0-31-13 powered from Train B Event Switch ZS-31-14 and installed in series accomplishes isolation during Tornado Event Tornado Damper Isolation during Tornado Fails to close - Mechanical Failure Status Indication in None (See None Redundant Tornado Damper 0-0-FC0-31-13 Event during Tornado - Electrical Failure Equip. Rm. via Limit Remarks) FC0-31-14 powered from Train A Event Switch ZS-31-13 and installed in series accomplishes isolation during Tornado Event Spreading Room Supply of Ventilation Air Fails to Stop on - Electrical Failure None (See None Isolation Dampers 0-FC0-31-9 &

Supply Fan to Spreading Room CRI signal Remarks) 10 are closed during CRI and no air is supplied to Spreading Room Spreading Room Fan: Supply ventilation Failure of the - Mechanical Failure Surveillance and None (See None Amount of outleakage generated Supply Fan and air to spreading room nonsafety related - Electrical Failure Maintenance for fan. Remarks) by this failure will not increase the solation Damper dampers: Provide fan to stop Status indication in total MCRHZ outleakage beyond 0-FC0-31-10 or 0- isolation of MCRHZ concurrent with MCR on Panel 1-M- the maximum allowable make-up FC0-31-9 from spreading room failure of one of the 9 for dampers. air quantity. Therefore, the two dampers failing positive pressure of 1/8" wg to close on a CRI minimum is maintained even WBNP-87 signal under this failure condition

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolation of MCRHZ Open during CRI - Mechanical Failure Status Indication in None (See None Redundant Safety Train B 0-FC0-31-10 from Spreading Room - Electrical Failure MCR on Panel 1-M- Remarks) Isolation Valve 0-FC0-31-9 9 via Limit Switch installed in series will be closed ZS-31-10 during CRI to provide isolation solation Damper Isolation of MCRHZ Open during CRI - Mechanical Failure Status Indication in None (See None Redundant Safety Train A 0-FC0-31-9 from Spreading Room - Electrical Failure MCR on Panel 1-M- Remarks) Isolation Valve 0-FC0-31-10 9 via Limit Switch installed in series will be closed ZS-31-9 during CRI to provide isolation Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3933 Mechanical Equipment need not to be postulated as Room and Spreading being concurrent with fire Room None (See None (See Remarks)

Close - Mechanical Failure Surveillance and Remarks) Spreading Room ventilation is Maintenance isolated during CRI Spreading Room Exhaust of Spreading Fails to stop during - Electrical Failure None (See None (See Remarks) Isolation Dampers 0-FC0-31-9 Exhaust Fans (2- Room CRI Remarks) and 0-FC0-31-10 are closed 100%) A-A & B-B during CRI solation Dampers Isolation of Spreading Open during CRI - Mechanical Failure Status Indication in None (See None The fans are stopped during CRI 0-FC0-31-25 for Room from outside - Electrical Failure MCR on Panel 1-M- Remarks)

Fan A-A and 0- 9 via Limit Switches FC0-1-26 for Fan ZS-34-25 & ZS B-B 26 Backdraft Damper Prevent backflow to Open during CRI - Mechanical Failure Surveillance and None (See None Isolation Dampers 0-FC0-31-25 0-BKD-31-2152 Spreading Room Maintenance Remarks) and 0-FC0-31-26 are closed during CRI WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Fire Damper Fire barrier between Open during fire - Mechanical Failure See Remarks See Remarks See Remarks Single failures of HVAC system 0-ISD-31-3953 Spreading Room and need not to be postulated as Turbine Room being concurrent with fire Closed during other None modes of operation - Mechanical Failure Surveillance and None (See Spreading Room ventilation is Maintenance Remarks) isolated during CRI Tornado Damper Isolation during Tornado Fails to close - Mechanical Failure Status Indication in None (See None Redundant Tornado Damper 0-0-FC0-31-24 Event during Tornado - Electrical Failure Mech Equip Room Remarks) FC0-31-23 powered from Train A Train B) Event via Limit Switch ZS- and installed in series 31-24 accomplishes isolation during Tornado Event Tornado Damper Isolation during Tornado Fails to close - Mechanical Failure Status Indication in None (See None Redundant Tornado Damper 0-0-FC0-31-23 Event during Tornado - Electrical Failure Mech Equip Room Remarks) FC0-31-24 powered from Train B Train A) Event via Limit Switch ZS- and installed in series 31-23 accomplishes isolation during Tornado Event Toilet & Locker Provide exhaust of Fails to stop during - Electrical Failure Surveillance and None (See None Isolation Dampers 0-FC0-31-16 Room Exhaust toilets and lockers CRI Maintenance Remarks) and -17 will close during CRI and Fan prevent exhaust air flow during CRI Toilet & Locker Fan: Provides exhaust Failure of the - Mechanical Failure Maintenance for fan. None (See None Amount of outleakage generated Room Exhaust of toilets & lockers. nonsafety related - Electrical Failure Status indication in Remarks) by this failure will not increase the Fan & Isolation Dampers: Provide fan to stop MCR on Panel 1-M- total MCRHZ outleakage beyond Damper 0-FC0 isolation of MCRHZ concurrent with 9 for dampers the maximum allowable make-up 17 or 0-FC0-31-16 from outside during CRI failure of one of the air quantity. Therefore, the two dampers failing positive pressure of 1/8" wg to close on a CRI minimum is maintained even signal under this failure condition WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS solation Damper Isolation of MCRHZ Open during CRI - Mechanical Failure Status Indication in None (See None Redundant Safety Train B 0- FC0-31-17 during CRI from outside - Electrical Failure Control Room on Remarks) Isolation Damper 0-FC0-31-16 Panel 1-M-9 via will be closed during CRI Limit Switch ZS 17 Tornado Damper Isolation of MCRHZ Open during CRI - Mechanical Failure Status Indication in None (See None Redundant Safety Train A 0-FC0-31-16 during CRI from outside - Electrical Failure Control Room on Remarks) Isolation Damper 0-FCO-31-17 Panel 1-M-9 via will be closed during CRI Limit Switch ZS 16 Tornado Damper Isolation of MCRHZ Fails to close - Mechanical Failure Status Indication via None (See None Redundant Tornado Damper 0-0-FC0-31-18 during Tornado Event during Tornado - Electrical Failure Limit Switch ZS Remarks) FC0-31-15 powered from Train A Train B) Event 18 and installed in series accomplishes isolation during Tornado Event Tornado Damper Isolation of MCRHZ Fails to close - Mechanical Failure Status Indication via None (See Redundant Tornado Damper 0-0-FC0-31-15 during Tornado Event during Tornado - Electrical Failure Limit Switch ZS Remarks) FC0-31-18 powered from Train B Train A) Event 15 and installed in series accomplishes isolation during Tornado Event Emergency Power Provide power to the Power Train A fails - Mechanical Failure Alarm/indication in Loss of Train A None (See Remarks) Redundant Safety Train B Control o Train A Control Building HVAC (Diesel Generator MCR Control Building Building HVAC System with its System Train A Failure) HVAC Systems Train B electrical power is

- Electrical Failure available Emergency Power Provide power to the Power Train B fails - Mechanical Failure Alarm/indication in Loss of Train B None (See Remarks) Redundant Safety Train A Control o Train B Control Building HVAC (Diesel Generator MCR Control Building Building HVAC System with its System Train B Failure) HVAC Systems Train A electrical power is

- Electrical Failure available WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Auxiliary Control Provide safety related Loss of Auxiliary - Mechanical Failure Alarm/indication in Loss of Train A None (See Remarks) Redundant Safety Train B Control Air System Train A control air to Train A Air System Train A - Electrical Failure MCR Control Building Building HVAC System with its valves, dampers and HVAC Systems Train B electrical power is instruments available Auxiliary Control Provide safety related Loss of Auxiliary - Mechanical Failure Alarm/indication in Loss of Train B None (See Remarks) Redundant Safety Train A Control Air System Train B control air to Train B Air System Train B - Electrical Failure MCR Control Building Building HVAC System with its valves, dampers and HVAC Systems Train A electrical power is instruments available WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS Roof ventilators 1- Provide Turbine - Loss of power to - Electrical Surveillance and None (See None Loss of power to Board 1A stops FAN-30-912, -913, Building El 755' Board 1A maintenance Remarks) five roof ventilators and north 916, -917 & -918 ventilation supply Fan 1, and results in on Board 1A operation of 15 roof ventilators @

28,500 cfm each and north supply 1-FAN-30-909, - Fan 2 @ 68,000 cfm and 2 south 910, -911, & -915 supply fans @ 35,000 cfm each on Board 1B resulting in lower than atmospheric pressure (68,000 +

2-FAN-30-912, - 2x35,000 - 15X28,500 = -289,500 913, -916, -917 & - cfm) 918 on Board 2A 2-FAN-30-909, -

910, -911, -914, & - - Loss of power to 915 on Board 2B Board 1A Surveillance and None (See None Loss of power to Board 1B stops maintenance Remarks) five roof ventilators and south North El 755 supply Fan 1, and results in Supply Fan 1, 1- operation of 15 roof ventilators @

FAN-30-924 on 28,500 cfm each and 2 north Board 1A supply fan @ 68,000 cfm each and one South supply fan @

South El 755 35,000 cfm resulting in lower than Supply Fan 1, 1- atmospheric pressure (2x68,000 FAN-30-921 on cfm + 35,000 - 15X28,500 cfm = -

Board 1B - Loss of power to 256,500 cfm)

Board 1A North El 755 Surveillance and None (See None Supply Fan 2, 2- maintenance Remarks)

FAN-30-924 on Board 2A WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT ON IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM PLANT REMARKS South El 755 Loss of power to Board 1B and Supply Fan 2, 2- 2B stops 10 roof vents and 2 FAN-30-921 on south supply fans and results in Board 2B operation of 10 roof vents @

28,500 cfm each and 2 north supply fans @ 35,000 cfm each resulting in lower than atmospheric pressure (2x68,000 cfm 28,500 = -149,000 cfm) e:

efer to TVA Calculation No. PI-639.

WBNP-87

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 1-FAN-30-103 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 1A within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 1A-A and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers 1-FCO- supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 30-86, Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point

-87, -106 and - ABI signal. that one ABGTS filtration unit cannot 107. Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

WBNP-91

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 1-FAN-30-103 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation, the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 1A-A and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.One operating ABGTS filtration unit ABGTS Fan (handswitch placed ABGTS. can handle the additional in-leakage.

operates to in wrong position).

maintain a negative pressure For ABGTS Fan:

in the ABSCE Mechanical failure, relative to the train power failure, outside train signal failure.

environment.

2-FAN-30-105 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 2B within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 2B-B and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 2-FCO-30-21, - Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point 22, -108, ABI signal. that one ABGTS filtration unit cannot

-109. Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from WBNP-91 open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 2-FAN-30-105 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation. the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 2B-B and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.One operating ABGTS filtration unit ABGTS Fan (handswitch placed ABGTS. can handle the additional in-leakage.

operates to in wrong position).

maintain a negative pressure For ABGTS Fan:

in the ABSCE Mechanical failure, relative to the train power failure, outside train signal failure.

environment.

1-FAN-30-102 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 1B within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 1B-B and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 1-FCO-30-86, - Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point 87, -106 and -107 ABI signal. that one ABGTS filtration unit cannot Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from WBNP-91 open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 1-FAN-30-102 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation. the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 1B-B and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.One operating ABGTS filtration unit ABGTS Fan (handswitch placed ABGTS. can handle the additional in-leakage.

operates to in wrong position).

maintain a negative pressure For ABGTS Fan:

in the ABSCE Mechanical failure, relative to the train power failure, outside train signal failure.

environment.

2-FAN-30-104 Fan to stop and Fan fails to stop Fan: Spurious Indicating lights in Increased in-leakage None. See 1.Supply fan is not safety- related but is remain stopped and one damper operation, ABI or MCR for Fan 2A-A within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. fails to close RAD detection high running indicating General Supply Dampers to close during an ABI temperature signal lights in MCR for Potential loss of the 2.The fan and isolation dampers Fan 2A-A and and remain closed emergency. failure, hot short in damper. required negative separately receive independently trained associated during DBE's to control wiring. pressure level within the ABI or RAD detection signals.

isolation prevent flow of Operator error ABSCE. Potential loss of Dampers supply air to the (handswitch placed duct/damper pressure 3.If the additional in-leakage through the 2-FCO-30-21, - Aux. Bldg. after an in wrong position). integrity. fan/damper disturbs the system to a point 22, -108 and -109 ABI signal. that one ABGTS filtration unit cannot Damper: maintain the design negative pressure Mechanical failure, level, the standby ABGTS filtration unit control wiring or will start in order to handle the additional contact failures. in-leakage and to maintain the required Handswitch failure to negative pressure level.

spring return from WBNP-91 open to A-Auto. 4.Pressure differential across the duct/damper assembly is acceptable.

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 2-FAN-30-104 Supply fan to stop Supply fan fails For Supply Fan: Indicating lights in Increase in in-leakage None. See 1.Supply fan is not safety- related but is and to remain to stop; spurious operation. the MCR. within the ABSCE. Remarks. required to stop running during a DBE.

Aux. Bldg. stopped during spuriously ABI or RAD Therefore, the only failure having a General Supply DBE's. To prevent operates. One detection high Potential loss of the potential effect on the safety functions of Fan 2A-A and flow of supply air ABGTS fan fails temperature signal required negative the Aux. Bldg. HVAC system is spurious ABGTS Exhaust to the Aux. Bldg. to start or fails to failure, hot short in pressure level within the operation or failure to stop.

Fan A-A or B-B by stopping on an run. control wiring. ABSCE. Loss of ABI signal. Operator error redundancy in the 2.One operating ABGTS filtration unit ABGTS Fan (handswitch placed ABGTS. can handle the additional in-leakage.

operates to in wrong position).

maintain a negative pressure For ABGTS Fan:

in the ABSCE Mechanical failure, relative to the train power failure, outside train signal failure.

environment.

1-FAN-30-159 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, MCR for dampers. Remarks. required to stop runnin during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 1A-A and and remain closed (exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers isolation prevent flow of remark 1). open to A-Auto. separately receive independently trained Dampers unfiltered exhaust ABI or RAD detection signals.

1-FCO-30-160,- air from Aux. Bldg.

161 to outside, after an ABI signal.

WBNP-91

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 2-FAN-30-274 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, MCR for dampers. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 2A and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers prevent flow of remark 1). open to A-Auto. separately receive independently trained 2-FCO-30-271, - unfiltered exhaust ABI or RAD detection signals.

272 air from the Aux.

Bldg. to outside, after an ABI signal.

1-FAN-30-162 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, MCR for damper. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 1B and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers prevent flow of remarks). open to A-Auto. separately receive independently trained 1-FCO-30-166, - unfiltered exhaust ABI or RAD detection signals.

167 air from the Aux.

Bldg. to outside, after an ABI signal.

WBNP-91

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 2-FAN-30-278 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, the MCR. Remarks. required to stop running during a DBE.

Aux. Bldg. during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related General Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan 2B and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers prevent flow of remark 1). open to A-Auto. separately receive independently trained 2-FCO-30-275, - unfiltered exhaust ABI or RAD detection signals.

276 air from the Aux.

Bldg. to outside, after an ABI signal.

0-FAN-30-136 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, the MCR. Remarks. required to stop running during a DBE.

Fuel Handling during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related Area Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan A-A and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers 0-FCO- prevent flow of remark 1). open to A-Auto. separately receive independently trained 30-137, -138 unfiltered exhaust ABI or RAD detection signals.

air from the Aux.

Bldg. to outside, after an ABI signal.

WBNP-91

TTS BAR Component Method of Effect on Identification Function Failure Mode Potential Cause Detection Effect on System Plant Remarks 0-FAN-30-139 Fan to stop and One damper Damper: Indicating lights in None. See remarks. None. See 1.Exhaust fan is not safety- related but is remain stopped fails to close Mechanical failure, the MCR for damper. Remarks. required to stop running during a DBE.

Fuel Handling during DBE's. during an ABI control wiring or Fan motor is equipped with safety-related Area Exhaust Dampers to close emergency. contact failures. redundant breakers.

Fan B-B and and remain closed (Exhaust fan is Handswitch failure to associated during DBE's to shutdown see spring return from 2.The fan and isolation dampers dampers 0-FCO- prevent flow of Remark 1). open to A-Auto. separately receive independently trained 30-140, -141 unfiltered exhaust ABI or RAD detection signals.

air from the Aux.

Bldg. to outside, after an ABI signal.

WBNP-91

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks Auxiliary Building Deenergizes Signal fails. Train A vital ac bus MCR indiation of Loss of redundancy in None. Train A and Train B ABI Isolation (ABI) solenoid valves to failure; Relay VKA only one train of ABSCE isolation and initiating signals are derived signal Train A. close associated 1 failure; Train A ABGTS fan starting ESF coolers actuation. from independent (train dampers; stops AB initiating signal and one train of separated) qualified devices.

general ventilation (Phase A ABSCE dampers fans; starts various containment closing.

ESF room coolers. isolation, high rad in refueling area) failure.

Operator error, Unnecessary isolation Spurious signal. spurious initiating None. of ABSCE, initiation of None.

signal (initiating ESF coolers and signals listed startup of ABGTS.

above.)

Auxiliary Building Deenergizes Signal fails. Train B vital ac bus MCR indiation of Loss of redundancy in None. Train A and Train B ABI Isolation (ABI) solenoid valves to failure; Relay only one train of ABSCE isolation and initiating signals are derived signal Train B. close associated VKB1 failure; Train ABGTS fan starting ESF coolers actuation. from independent (train dampers; stops AB B initiating signal and one train of separated) qualified devices.

general ventilation (Phase A ABSCE dampers fans; starts various containment closing.

ESF room coolers. isolation, high rad in refueling area) failure.

Operator error, Unnecessary isolation Spurious signal. spurious initiating None. of ABSCE, initiation of None.

signal (initiating ESF coolers and WBNP-87 signals listed startup of ABGTS.

above.)

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks Train A Provides Class 1E Loss of or Diesel generator Alarm and indication Loss of redundancy in None.

Emergency diesel-backed inadequate failure; bus fault in MCR. safety-related HVAC Power. power supply to voltage. (Train A); Operator system. Redundant Train B active components error. HVAC system available.

of Train A of AB HVAC subsystems.

Train B Provides Class 1E Loss of or Diesel generator Alarm and indication Loss of redundancy in None.

Emergency diesel-backed inadequate failure; bus fault in MCR. safety-related HVAC Power. power supply to voltage (Train B); Operator system. Redundant Train A active components error. HVAC system available.

of Train B of AB HVAC subsystems.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks Intake opening Provides air supply Blockage Mechanical ----------------- Loss of Redundancy None Redundant openings are (one for each of intake to 480V Failure. Foreign in providing air supply. provided.

two dampers in Transformer Room Object.

each Transformer 1A, 1B, 2A, and Redundant intake Room). 2B. opening will supply sufficient air to the room.

Refrigerant Provides flowpath Leakage Cracks No direct indication Loss of effectiveness None Piping and Valves for refrigerant from of leakage. of one Chiller and for Chiller or Chiller to AHU and associated AHUs Condensing Unit back to Chiller. redundant loop.

Opposite Train Chiller and AHUs are independent and remain available.

1-ISD-31-3923 In the return air Spuriously Mechanical failure No direct indication Loss of Redundancy None 1.Damper closing is not a flowpath from pipe closes. of fusible link. of fusible link failure. in damper control mitigating function for any DBE Fire Damper chase to See Remark #2. and is considered in the Penetration Room Appendix R analysis.

at El. 713, and to Penetration Room 2.Fire Dampers 1-ISD-31-3923 at El. 692 and Pipe and 1-ISD-31-3925 are Chase Coolers. installed with redundant fusible links such that the single failure of one fusible link will not cause the failure of the fire damper to permit air flow.

3.Failure of 1-ISD-31-3923 to remain open envelopes the failure of 1-ISD-31-3925.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1-ISD-31-3801 In the supply air Spuriously Mechanical failure No direct indication Loss of redundancy in None 1.Damper closing is not a flowpath to pipe closes. of fusible link. of fusible link failure. damper control. mitigating function for any DBE Fire Damper chase from See Remark #2. and is considered in the Penetration Room Appendix R analysis.

at El. 692.

2.The Fire Damper 1-ISD-31-3801 is installed with redundant fusible links such that the single failure of one fusible link will not cause the failure of the fire damper to permit air flow.

0-ISD-31-4619 In the flowpath for Spuriously Mechanical failure No direct indication Loss of None 1.Damper closing is not a cooling air from closes. of fusible link. of damper closing. cooling/ventilating air mitigating function for any DBE Fire Damper AHU line coming to Train B 480V and is considered in the through the 6.9kV See Remark #3. Shutdown Board Appendix R analysis.

Shutdown Board Room 1B and Train A Room A into the Battery Board 2.Damper normally open.

480V Shutdown Room 1.

Board Room 1B, 3.Temperature variation in and then into the Possible temperature 6.9kV Shutdown Board Room Battery Board and presure deviation A will be detected at inlet to Room 1. from design conditions AHU indicated on L-551 or in 480V Shutdown L-537.

Board Room 1B, 6.9 kV Shutdown Board 4.The effect of the failure of Room A and Battery 0-ISD-31-4618, -2733, -4620, Board Room 1. or -4621 is enveloped by the failure of 0-ISD-31-4619.

5.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 0-ISD-31-4623 In the flowpath for Spuriously Mechanical failure No direct indication Loss of None 1.Damper closing is not a cooling air from closes. of fusible link. of damper closing. cooling/ventilating air mitigating function for any DBE Fire Damper AHU line coming to Train A 480V and is considered in the through the 6.9kV See Remark #3. Shutdown Board Appendix R analysis.

Shutdown Board Room 2A and Train B Room B into the Battery Board 2.Damper normally open.

480V Shutdown Room IV.

Board Room 2A, 3.A temperature variation in and then into the Possible temperature 6.9kV Shutdown Board Room Battery Board and pressure B will be detected at Inlet to Room IV. deviation from design AHU indicated on L-538 or conditions in 480V L-540.

Shutdown Board Room 2A, 6.9kV 4.The effect of the failure of Shutdown Board and 0-ISD-31-4622, -2785, -4624, Battery Room IV. or -4625 is enveloped by the failure of 0-ISD-31-4623.

5.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 0-ISD-31-2757 In the flowpath for Spuriously Mechanical failure No direct indication None. None 1.Damper closing is not a pressurizing the closes. of fusible link. of damper closing. mitigating function for any DBE Fire Damper 6.9kV Shutdown See Remark #4. See Remark #4. and is considered in the Board Room A See Remark #3. Appendix R analysis.

from Mechanical Equipment Room. 2.Fire damper is closed and latched.

3.No flow on discharge of fans detected.

4.The Pressurizing Fans are designed to stop during a DBE, and are not required to mitigate the effects of the DBE.

0-ISD-31-2814 In the flowpath for Spuriously Mechanical failure No direct indication None None 1.Damper closing is pressurizing the closes. of fusible link. of damper closing. not a mitigating function for Fire Damper 6.9kV Shutdown Remark #4. See Remark #4. any DBE and is considered in Board Room B See Remark #3. the Appendix R analysis.

from Mechanical Equipment Room. 2.Fire damper is closed and latched.

3.No flow on discharge of fans detected.

4.The Pressurizing Fans are designed to stop during a DBE, and are not required to mitigate the effects of the DBE.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 0-ISD-31-2720 In the flowpath for Spuriously Mechanical failure No direct indication Partial loss of cooling None 1.Damper closing is not a cooling air from closes. of fusible link. of damper closing. air to Auxiliary Control mitigating function for any DBE Fire Damper AHU line coming Room. and is considered in the through the 6.9kV Appendix R analysis.

Shutdown Board Room A to the 2.Damper normally open.

Auxiliary Control Room. 3.The effects of the failure of 0-ISD-31-2725, -2723, -2726,

-2721, or -2728 are enveloped by the effects of 0-ISD-31-2720 failure.

4.The Auxiliary Control Room functions as the alternate control room in the event that the main control room becomes uninhabitable from fire or release of gases from non-DBE.

5.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 0-ISD-31-2771 In the flowpath for Spuriously Mechanical failure No direct indication Partial loss of cooling None 1.Damper closing is not a cooling air from closes. of fusible link. of damper closing. air to Auxiliary Control mitigating function for any DBE Fire Damper AHU line coming Room. and is considered in the through the 6.9kV Appendix R analysis.

Shutdown Board Room B to the 2.Damper normally open.

Auxiliary Control Room. 3.The effects of the failure of 0-ISD-31-2777, -2779, -2774,

-2772, or -2775 are enveloped by the effects of 0-ISD-31-2771 failure.

4.The Auxiliary Control Room functions as the alternate control room in the event that the main control room becomes uninhabitable from fire or release of gases from non-DBE.

5.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 0-ISD-31-2713 In the flowpath for Spuriously Mechanical failure No direct indication Loss of pressurizing None 1.Damper closing is not a cooling air to closes. of fusible link. of damper closing. and cooling air to Train mitigating function for any DBE Fire Damper Battery Board B Battery Board Room and is considered in the Room II from AHU II. Appendix R analysis.

line coming through the 6.9kV 2.Normally open damper.

Shutdown Board Room A to the 3.The effects of the failure of Auxiliary Control 0-ISD-31-2715 are enveloped Room. by the effects of 0-ISD-31-2713 failure.

4.Fire damper has dual fusible links.

0-ISD-31-2780 In the flowpath for Spuriously Mechanical failure No direct indication Loss of pressurizing None 1.Damper closing is not a cooling air to closes. of fusible link. of damper closing. and cooling air to Train mitigating function for any DBE Fire Damper Battery Board B Battery Board Room and is considered in the Room III from AHU III. Appendix R analysis.

line coming through the 6.9kV 2.Damper normally open.

Shutdown Board Room B to the 3.The effects of the failure of Auxiliary Control 0-ISD-31-2782 are enveloped Room. by the effects of 0-ISD-31-2780 failure.

4.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 0-ISD-31-2759 In the flowpath for Spuriously Mechanical failure No direct indication Possible temperature None 1.Damper closing is not a air from 6.9kV closes. of fusible link. of damper closing. rise in 6.9kV mitigating function for any DBE Fire Damper Shutdown Board Shutdown Board and is considered in the Room A to AHU Room A. Pressure Appendix R analysis.

intake in rise in 6.9kV Mechanical Shutdown Board 2.Damper normally open.

Equipment Room. Room A.

3.Temperature rise in 6.9kV See Remark #3. Shutdown Board Room A detected at inlet to AHU indicated on L-551 or l-537.

4.Fire damper has dual fusible links.

0-ISD-31-2815 In the flowpath for Spuriously Mechanical failure No direct indication Possible temperature None 1.Damper closing is not a air flow from 6.9kV closes. of fusible link. of damper closing. rise in 6.9kV mitigating function for any DBE Fire Damper Shutdown Board Shutdown Board and is considered in the Room B to AHU Room B. Diminished Appendix R analysis.

intake in suction to AHU.

Mechanical Pressure rise to 6.9kV 2.Damper normally open.

Equipment Room. Shutdown Board Room B. 3.Temperature rise in 6.9kV Shutdown Board Room B See Remark #3. detected at inlet to AHU indicated on L-538 or l-540.

4.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1-ISD-31-2516 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room I can be None 1.Damper closing is not a AHU 1A-A closes. of fusible link. of damper closing. exhausted. mitigating function for any DBE Fire Damper discharge cooling and is considered in the air flow to 480V See Remark #3. Diminished air flow for Appendix R analysis.

Board Room 1A providing pressurizing and Battery Room and cooling air supply 2.Failure of this damper I. to the 480V Board envelopes the failures Room 1A and Battery 1-ISD-31-2525 or -2526.

Room I.

3.Indicating lights in MCR of See Remark #2. ACU and AHU 1A-A running (1-HS-31-461-A). Low flow from AHU 1A-A (1-FS-31-460-A) ANN 7-57.

4.Fire damper has dual fusible links.

2-ISD-31-2516 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room IV can None 1.Damper closing is not a AHU 2A-A closes. of fusible link. of damper closing. be exhausted. mitigating function for any DBE Fire Damper discharge cooling and is considered in the air flow to 480V See Remark #3. Diminished air flow for Appendix R analysis.

Board Room 2A providing pressurizing and Battery Room and cooling air supply 2.Failure of this damper IV. to the 480V Board envelopes the failures Room 2A and Battery 2-ISD-31-2525 or -2526.

Room IV.

3.Indicating lights in MCR of See Remark #2. ACU and AHU 2A-A running (2-HS-31-461-A). Low flow from AHU 2A-A (2-FS-31-460)

ANN 7-57.

WBNP-87 4.Fire damper has dual fusible links.

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1-ISD-31-2504 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room I can be None 1.Damper closing is not a Pressurizing Fans closes. of fusible link. of damper closing. exhausted. mitigating function for any DBE Fire Damper discharge air flow and is considered in the to 480V Board See Remark #2. Diminished air flow for Appendix R analysis.

Room 1A. providing pressurizing air to the 480V Board 2.Indicating lights in MCR of Room 1A. Pressurizing Fans running.

2-ISD-31-2504 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room IV can None 1.Damper closing is not a Fire Damper Pressurizing Fans closes. of the fusible link. of damper closing. be exhausted. mitigating function for any DBE discharge air flow and is considered in the to 480V Board See Remark #2. Diminished air flow for Appendix R analysis.

Room 2A. providing pressurizing air supply to the 480V 2.Indicating lights in MCR of Board Room 2A. Pressurizing Fans running.

1-ISD-31-2515 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room I can be None 1.Damper closing is not a suction air flow to closes. of fusible link. of damper closing. exhausted. mitigating function for any DBE Fire Damper AHU 1A-A for and is considered in the 480V Board Room See Remark #2. Loss of air flow for Appendix R analysis.

1A and Battery providing pressurizing Room I. air to the 480V Board 2.Indicating lights in MCR of Room 1A and Battery ACU and AHU 1A-A running Board Room I. (1-HS-31-461-A). Low flow from AHU 1A-A (1-FS-31-460).

3.Damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 2-ISD-31-2515 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room I can be None 1.Damper closing is not a suction air flow to closes. of fusible link. of damper closing. exhausted. mitigating function for any DBE Fire Damper AHU 2A-A for and is considered in the 480V Board Room See Remark #2. Loss of air flow for Appendix R analysis.

2A and Battery providing pressurizing Room IV. air to the 480V Board 2.Indicating lights in MCR of Room 2A and Battery ACU and AHU 2A-A running Board Room IV. (2-HS-31-461-A). Low flow from AHU 2A-A (2-FS-31-460).

3.Damper has dual fusible links.

1-ISD-31-2518 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room I can be None 1.Damper closing is not a AHU 1B-B closes. of fusible link. of damper closing. exhausted. mitigating function for any DBE Fire Damper discharge cooling and is considered in the air flow to 480V See Remark #3. Loss of air flow for Appendix R analysis.

Board Room 1B providing pressurizing and Battery and cooling air supply 2.Failure of this damper Room II. to the 480V Board envelopes the failure of Room 1B and Battery 1-ISD-31-2523.

Room II.

3.Indicating lights in MCR of See Remark #2. ACU and AHU 1B-B running (1-HS-31-475-B). Low flow from AHU 1B-B (1-FS-31-476)

ANN 7-92.

4.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 2-ISD-31-2518 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room III can None 1.Damper closing is not a AHU 2B-B closes. of fusible link. of damper closing. be exhausted. mitigating function for any DBE Fire Damper discharge cooling and is considered in the air flow to 480V See Remark #3. Diminished air flow for Appendix R analysis.

Board Room 2B providing pressurizing and Battery and cooling air supply 2.Failure of this damper Room III. to the 480V Board envelopes the failure of Room 2B and Battery 2-ISD-31-2523.

Room III.

3.Indicating lights in MCR of See Remark #2. ACU and AHU 2B-B running (2-HS-31-475-B). Low flow from AHU 2B-B (2-FS-31-476)

ANN 7-92.

4.Fire damper has dual fusible links.

1-ISD-31-2519 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room II can None 1.Damper closing is not a Pressurizing Fans closes. of fusible link. of damper closing. be exhausted. mitigating function for any DBE Fire Damper discharge air flow and is considered in the to 480V Board See Remark #2. Diminished air flow for Appendix R analysis.

Room 1B. providing pressurizing air supply to the 480V 2.Indicating lights in MCR of Board Room 1B. Pressurizing Fans running.

See Remark #2.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 2-ISD-31-2519 In the flow path for Spuriously Mechanical failure No direct indication Battery Room III can None 1.Damper closing is not a Pressurizing Fans closes. of the fusible link. of damper closing. be exhausted. mitigating function for any DBE Fire Damper discharge air flow and is considered in the to 480V Board See Remark #2. Diminished air flow for Appendix R analysis.

Room 2B. providing pressurizing air to the 480V Board 2.Indicating lights in MCR of Room 2B. Pressurizing Fans running.

1-ISD-31-2517 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room II can None 1.Damper closing is not a suction air flow to closes. of fusible link. of damper closing. be exhausted. mitigating function for any DBE Fire Damper AHU 1B-B for and is considered in the 480V Board Room See Remark #2. Loss of air flow for Appendix R analysis.

1B and Battery providing pressurizing Room II. air to the 480V Board 2.Indicating lights in MCR of Room 1B and Battery ACU and AHU 1B-B running Room II. (1-HS-31-475A). Low flow from AHU 1B-B (1-FS-31-476)

ANN 7-92.

3.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 2-ISD-31-2517 In the flowpath for Spuriously Mechanical failure No direct indication Battery Room III can None 1.Damper closing is not a suction air flow to closes. of fusible link. of damper closing. be exhausted. mitigating function for any DBE Fire Damper AHU 2B-B for and is considered in the 480V Board Room See Remark #2. Loss of air flow for Appendix R analysis.

2B. providing pressurizing and cooling air to the 2.Indicating lights in MCR of 480V Board Room 2B ACU and AHU 2B-B running and Battery Room III. (2-HS-31-475A). Low flow from AHU 2B-B (2-FS-31-476)

ANN 7-92.

3.Fire damper has dual fusible links.

1-ISD-31-3783 In the flowpath to Spuriously Mechanical failure No direct indication Loss of DC fan for None 1.Damper closing is not a TDAFW Pump closes. of fusible link. of failure in MCR. cooling TDAFW Pump mitigating function for any DBE Fire Damper Room dc Fan. Room. and is not within the scope of this FMEA.

2.The nonsafety ac fan is available to cool the TDAFW Pump Room.

3.During loss of all ac, there will be no cooling/ventilating capability for the TDAFW Pump Room and loss of the TDAFW pump is possible.

4.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks 1-ISD-31-3780 In the flowpath Spuriously Mechanical failure No direct indication Reduced air flow into None 1.Damper closing is not a from General Area closes. of fusible link. of failure in MCR. TDAFW below mitigating function for any DBE Fire Damper 692 to TDAFW adequate amounts for and is not within the scope of Pump Room. exhaust through the this FMEA.

two emergency exhaust fans. 2.Potentially diminished cooling/ventilating capability for the TDAFW Pump Room.

3.Fire damper has dual fusible links.

1-ISD-31-3967 In the air flow path Spuriously Mechanical failure No direct indication Reduced air flow into None 1.Damper closing is not a from General Area closes. of fusible link. of failure in MCR. TDAFW. mitigating function for any DBE Fire Damper 692 to TDAFW and is not within the scope of Pump Room. this FMEA.

2.With both emergency fans operating during a DBE, there exists the possibility of diminished capability to ventilate the TDAFW Pump Room.

3.Fire damper has dual fusible links.

WBNP-87

TTS BAR Method of

o. Component Function Failure Mode Potential Cause Detection Effect on System Effect on Plant Remarks Ductwork in the Provides Leakage Cracks ----------------- Minimal localized None Only small cracks are Auxiliary Building containment for air reduction of negative postulated due to seismic Gen. Vent and flow path and pressure and qualification of ductwork. Most A/C subsystems. controlled minimized effect on of air leaking from flow path distribution and temperature of areas. will enter the areas for which it exhausting of is intended.

cooling/ventilating air. Loss of fluid (air) is not a concern since the system is in the same fluid.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-CHR-31-36/2-A Provides Fails to start; Fails Mechanical failure; Annunciator of Loss of None 1.Equipment includes CW pump and chilled water while running. Train A power Shutdown Board Redundancy. motor and compressor and motor.

Chilled Water to Train A failure; Control Room HVAC System See Remark #3. 2.Control of the CWCP, 0-PMP Package A-A (Train A) AHUs. signal failure from A-A Abnormal. 36/1-A, and AHUs A-A and B-A is 0-PDIS-31-101-A; Indicating lights in interlocked with Chiller A-A.

0-FS-31-43-A; MCR (0-HS-31-400A). 3.The system design intent is such 0-FS-31-38-A; Compressor running that loss of one chiller results only in 0-TS-31-40B-A; and light on MCC. the loss of redundancy in providing O-TS-31-48B-A. chilled water for cooling Unit 1 and Unit 2 Shutdown Board Rooms. The redundant train chiller serves AHUs C-B and D-B. Chiller A-A will stop automatically and Chiller B-B will start automatically on:

Low DP at Circulating Water Cooling Pump for Chiller A-A.

T > Setpoint at air inlet to Train A AHUs.

Low air flow at AHU A-A or B-A.

4.A review of the schematics establishes the separation and redundancy of the train A and B units. The loss of nondivision train associated power supply for the separation relay will not prevent the switchover from a failed unit to the redundant unit.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-CHR-31-36/2-A Reduction of Loss of refrigerant; Inlet temperature Loss of None, See remark cooling capacity Chiller freeze up; indication on L-551 or redundancy in #3.

Chilled Water Control signal L-538 for AHU air cooling air flow.

Package A-A failure. intake in 6.9 kV (Train A) (cont'd) Shutdown Board See remark #3.

Room.

See remark #1.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-CHR-31-49/2-B Provides Fails to start; Fails Mechanical failure; Annunciation of Loss of None, See remark 1.Equipment includes CW pump &

chilled water while running Train B power Shutdown Board Redundancy #3 motor and compressor & motor.

Chilled Water Package to Train B failure; Control Room Hvac System 2.Control of the CWCP, 0-PMP B-B (Train B) AHUs. signal failure from B-B Abnormal. 49/1-B, and AHUs C-B and D-B is 0-PDIS-31-131-B, Indicating lights in interlocked with Chiller B-B.

0-FS-31-51-B, MCR (0-HS-31-49A). 3.The system design intent is such 0-FS-31-57-B, Compressor running that loss of one chiller results only in 0-TS-31-60B-B, light on MCC. the loww of redundancy in providing 0-TS-31-52B-B. chilled water for cooling Unit 1 and Unit 2 Shutdown Board Rooms. The redundant train dchiller seves AHUs A-A and B-A. Chiller B-B will stop automatically and Chiller A-A will start automatically on:

Low DP at Circulating Water Cooling Pump for Chiller B-B.

T > Setpoint at air inlet to Train B AHUs.

Low air flow at AHU C-B or D-B.

4.A review of the schematics establishes the separation and redundancy of the train A and B units. The loss of nondivision train associated power supply for the separation relay will not prevent the switchover from a failed unit to the redundant unit.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-CHR-31-49/2-B Reduction of Loss of refrigerant; Inlet temperature Loss of None, See remark cooling capacity. chiller freeze up; indication on L-540 or redundancy in #3.

Chilled Water Package Control signal L-537 for AHU air cooling air flow.

B-B (Train B) (cont'd) failure. intake in 6.9 kV Shutdown Board Room.

See remark #1.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-AHU-31-45 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Redundant Review of the schematics cooling air to while running. Train A power Shutdown Board redundancy in Train B Chiller B-B establishes that the AHUs A-A and Air Handling Unit A-A maintain failure. Room HVAC System cooling air to Unit and AHU C-B on C-B (on Unit 1 side) are (Train A) required A-A Abnormal. 1 side Shutdown Unit 1 side will independent.

temperatures Indicating lights in Board rooms. automatically start for Shutdown MCR (0-HS-31-400A- on: AHU A-A is interlocked to Board Rooms A). AHU A-A running automatically start on Chiller A-A safety-related light on MCC. $Low DP at start.

equipment on Circulating Water the Unit 1 Cooling Pump. Either train of AHUs (Train A AHUs side. A-A and B-A or Train B AHUs C-B

$Low Air flow at and D-B) is capable of providing AHU A-A cooling air to the Aux. Control Room.

or

$T > Setpoint at inlet to Train A AHU.

None (See Remarks)

When both Air Handling Units are Fails to stop or Electrical Failure Annunciation in the Increased operating the common ductwork starts while unit C- MCR. pressure in supply static pressure does not exceed 6 in.

B is operating. duct. wg. duct design pressure.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-AHU-31-44 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Review of the schematics cooling air to while running. Train A power Shutdown Board redundancy in Redundant Train B establishes that the AHUs B-A and Air Handling Unit B-A maintain failure Room HVAC System cooling air to Unit Chiller B-B and D-B (on Unit 2 side) are (Train A) required A-A Abnormal. 2 side Shutdown AHU D-B on Unit 2 independent.

temperatures Indicating lights in Board rooms. side will for Shutdown MCR (0-HS-31-400A- automatically start AHU B-A is interlocked to Board Rooms A). AHU B-A running on: automatically start on Chiller A-A Safety-related light on MCC. start.

equipment on $Low DP at the Unit 2 Circulating Water Either train of AHUs (Train A AHUs side. Cooling Pump. A-A and B-A or Train B AHUs C-B and D-B) is capable of providing

$Low Air flow at cooling air to the Aux. Control Room.

AHU B-A or

$T > Setpoint at inlet to Train A AHU.

None (See When both Air Handling Units are Remarks) operating, the common ductwork Fails to stop or Annunciation in the Increased static pressure does not exceed 6 in.

starts while unit D- Electrical Failure MCR. pressure in supply wg. duct design pressure.

B is operating. duct.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-AHU-31-55 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Review of the schematics cooling air to while running. Train B power Shutdown Board redundancy in Redundant Train A establishes that the AHUs A-A and Air Handling Unit C-B maintain failure. Room HVAC System cooling air to Unit Chiller A-A and C-B (on Unit 1 side) are (Train B) required B-B Abnormal. 1 side Shutdown AHU A-A on Unit 1 independent.

temperatures Indicating lights on Board rooms. side will for Shutdown MCR (0-HS-31-49A- automatically start AHU C-B is interlocked to Board Rooms B). AHU C-B running on: automatically start on Chiller B-B safety-related light on MCC. start.

equipment on $Low DP at the Unit 1 Circulating Water Either train of AHUs (Train A AHUs side. Cooling Pump. A-A and B-A or Train B AHUs C-B and D-B) is capable of providing

$Low Air flow at cooling air to the Aux. Control Room.

AHU C-B or

$T > Setpoint at inlet to Train B AHU.

None (See When both Air Handling Units are Remarks) operating, the common ductwork Fails to stop or Electrical Failure Annunciation in the Increased static pressure does not exceed 6 in.

starts while unit A- MCR. pressure in supply wg. duct design pressure.

A is operating. duct.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-AHU-31-61 Provides Fails to start; Fails Mechanical Failure; Annunciation of Loss of None. Review of the schematics cooling air to while running. Train B power Shutdown Board redundancy in Redundant Train A establishes that the AHUs B-A and Air Handling Unit D-B maintain failure Room HVAC System cooling air to Unit Chiller A-A and D-B (on Unit 2 side) are (Train B) required B-B Abnormal. 2 side Shutdown AHU A-A on Unit 2 independent.

temperatures Indicating lights in Board rooms and side will for Shutdown MCR (0-HS-31-49A- 480V Shutdown automatically start AHU D-B is interlocked to Board Rooms B). AHU D-B running Board Room Unit on: automatically start on Chiller B-B safety-related light on MCC. 2 side. start.

equipment on $Low DP at the Unit 2 Circulating Water Either train of AHUs (Train A AHUs side. Cooling Pump. A-A and B-A or Train B AHUs C-B and D-B) is capable of providing

$Low Air flow at cooling air to the Aux. Control Room.

AHU D-B or

$T > Setpoint at inlet to Train B AHU.

None (See When both Air Handling Units are Remarks) operating, the common ductwork Fails to stop or Annunciation in the Increased static pressure does not exceed 6 in.

starts while unit B- Electrical Failure MCR. pressure in supply wg. duct design pressure.

A is operating. duct.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-PMP-31-36/1-A Provides Fails to start; Fails Mechanical failure; Annunciator 2-113 for Loss of None. Control of 0-PMP-31-36/1-A is water to the while running. Train A power 0-PDIS-31-101-A. redundancy in Redundant Train B interlocked with Chiller A-A to Chilled Water Package Water Chiller failure; Control Indicating lights for 0- supplying cooling Chiller B-B will automatically start after chiller start.

A-A A-A loop. signal failure; start HS-31-400A in MCR. air to the automatically start Review of the control and schematic Cooling Water signal failure; Shutdown Board on Lo DP at the diagrams establishes the Circulating Pump operator error Chilled water Rooms of both pump and will redundancy and independence of (handswitch placed Temperature and units. provide cooling the Train A and Train B pumps.

in wrong position). Pressure indication on water to AHUs C-B L-541. and D-B.

Mechanical failure; Annunciator 2-120 for 0-PMP-31-49/1-B is interlocked to Train B power 0-PDIS-31-131-B. None. automatically start after Chiller B-B 0-PMP-31-49/1-B Fails to start; Fails failure; Control Indicator lights for 0- Redundant Train A start. Review of the control and Provides while running. signal failure; start HS-31-49A in MCR. Loss of Chiller A-A will schematic diagrams establishes the Chilled Water Package water for to signal failure; redundancy in automatically start redundancy and independence of B-B Cooling Water the Water operator error Chilled Water supplying cooling on Lo DP at the the Train A and Train B pumps.

Circulating Pump Chiller B-B (handswitch placed Temperature and air to the pump and will loop. in wrong position). Pressure indication on Shutdown Board provide cooling L-542. Rooms of both water to AHUs A-A units. and B-A.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks TCV-31-112 Provides Spuriously bypass Mechanical failure; See Remark #1. Potential loss of None. 1.Local indication on L-551 of inlet control of too much flow. Control Air failure; redundancy of Redundant Train B air temperature to AHU A-A.

Temperature Control water Sensor failure. Train A Chiller A-A Chiller B-B and Valve for AHU A-A. temperature and AHU A-A associated AHUs 2.Temp. rise in Shutdown rooms >

to AHU A-A resulting in air C-B and D-B can Setpoint will automatically cause from Chiller A- temperature rise in provide cooling air Train A Chiller with AHUs A-A and B-A by Shutdown Board supply. A to stop, and Train B with AHUs C-regulating the Room. B and D-B to start.

flow of chilled See Remark #2.

water to AHU. 3.The temperature control valves for the AHUs are served by the Aux. Air Supply. The trains are separate.

1.Local indication on L-538 of inlet air temperature to AHU B-A.

2.Temp. rise in Shutdown rooms >

Setpoint will automatically cause Train A Chiller with AHUs A-A and B-Potential loss of A to stop, and Train B with AHUs C-Mechanical failure; redundancy of B and D-B to start.

0-TCV-31-108 Provides Spuriously bypass Control Air failure; Train A Chiller A-A None.

control of too much flow. Sensor failure. See Remark #1. and AHU B-A Redundant Train B 3.The temperature control valves for Temperature Control water resulting in air Chiller B-B and the AHUs are served by the Aux. Air Valve for AHU B-A. temperature temperature rise in associated AHUs Supply. The trains are separate.

to AHU B-A Shutdown Board C-B and D-B can from Chiller A- Room. provide cooling air A by supply.

regulating the flow of chilled See Remark #2.

water to AHU.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-TCV-31-142 Provides Spuriously bypass Mechanical failure; See Remark #1. Potential loss of None. 1.Local indication on L-537 of inlet control of too much flow. Control Air failure; redundancy of Redundant Train A air temperature to AHU C-B.

Temperature Control water Sensor failure. Train B Chiller B-B Chiller A-A and Valve for AHU C-B. temperature and AHU C-B associated AHUs 2.Temp. rise in Shutdown rooms >

to AHU C-B resulting in air A-A and B-A can Setpoint will automatically cause from Chiller B- temperature rise in provide cooling air Train B Chiller with AHUs C-B and B by Shutdown Board supply. D-B to stop and Train A with AHUs regulating the Room. A-A and B-A to start.

flow of chilled See Remark #2.

water to AHU. 3.The temperature control valves for the AHUs are served by the Aux. Air Supply. The trains are separate.

1.Local indication on L-540 of inlet Potential loss of air temperatures to AHU D-B.

Mechanical failure; redundancy of 0-TCV-31-138 Provides Spuriously bypass Control Air failure; Train B Chiller B-B None. 2.Temp. rise in Shutdown rooms >

control of too much flow. Sensor failure. See Remark #1. and AHU D-B Redundant Train A Setpoint will automatically cause Temperature Control water resulting in air Chiller A-A and Train B Chiller with AHUs C-B and Valve for AHU D-B. temperature temperature rise in associated AHUs D-B to stop and Train A with AHUs to AHU D-B Shutdown Board A-A and B-A can A-A and B-A to start.

from Chiller B- Room. provide cooling air B by supply. 3.The temperature control valves for regulating the the AHUs are served by the Aux. Air flow of chilled See Remark #2. Supply. The trains are separate.

water to AHU.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2706 Prevents Fails to backseat Mechanical failure. See Remark #1. A) Loss of cooling None. 1.Indirect indication of functional backflow of air to room served failure of AHU; MCR indication of Backdraft Damper cooling air Local position by the AHU AHU A-A and B-A motors running; through indicators on the local indication on L-551 of high inlet standby AHU damper will indicate if B) Bypass flow temp. to AHU A-A.

C-B when damper is stuck open. through the AHU A-A is See Remark #2. standby unit can 2.Plant operations have an running. cause standby fan administrative procedure to verify to rotate in that the damper is closed following reverse. Due to the shutdown of its respective AHU.

loss of cooling to room. Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total 1.Normally opens when AHU is loss of cooling air running.

in the Shutdown Board Rooms 2.Indirect indication of functional See Remark #2. failure of AHU; local indication on L-Fails to open Mechanical failure. Loss of 537 of inlet temperature to AHU C-B.

Provides flow (Stuck closed) redundancy in None.

path for air when AHU C-B is cooling air flow Low flow from AHU flow from running (Train B) from Shutdown will automatically AHU. Board Room. initiate Train "A" chiller and AHUs.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2761 Prevents Fails to backseat. Mechanical failure. See Remark #1. A) Loss of cooling None. 1.Indirect indication of functional backflow of Local position air to room served failure of AHU; MCR indication of Backdraft Damper cooling air indicators on the by the AHU. AHU B-A and A-A motors running; through damper will indicate if local indication on L-538 of high inlet standby AHU damper is stuck open B) Bypass flow temperature to AHU B-A.

D-B when when the fan is idle. through the AHU B-A is standby unit can 2.Plant operations has an running. cause standby fan administrative procedure to verify to rotate in that the damper is closed following reverse. Due to the shutdown of its respective AHU.

loss of cooling to room, Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total loss of cooling air in the Shutdown Board Rooms.

Loss of redundancy in 1.Normally opens when AHU is cooling air flow None. running.

Provide flow Fails to open Mechanical failure See Remark #2. from Shutdown path for air (Stuck closed) board Room. Low flow from AHU 2.Indirect indication of functional flow from when AHU D-B is will automatically failure of AHU; local indication on L-WBNP-87 AHU. running (Train B) initiate Train "A" 540 of inlet temp. to AHU D-B.

Chiller and AHUs.

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2705 Prevents Fails to backseat. Mechanical failure. See Remark #1. A) Loss of cooling None. 1.Indirect indication of functional backflow of Local position air to room served failure of AHU; MCR indication of Backdraft Damper cooling air indicators on the by the AHU. AHU C-B and D-B motors running; through damper will indicate if local indication on L-537 of inlet standby AHU damper is stuck open. B) Bypass flow temperature to AHU C-B.

A-A when through the AHU C-B is standby unit can 2.Plant operations has an running. cause standby fan administrative procedure to verify to rotate in that the damper is closed following reverse. Due to the shutdown of its respective AHU.

loss of cooling to room, Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total loss of cooling air in the Shutdown Board Rooms.

Loss of redundancy in 1.Normally opens when AHU is cooling air flow None. running.

Provide flow Fails to open Mechanical failure. See Remark #2. from Shutdown path for air (Stuck closed) Board Room. Low flow from AHU 2.Indirect indication of functional flow from when AHU A-A is will automatically failure of AHU; local indication on L-WBNP-87 AHU. running. initiate Train B 551 of inlet temperature to AHU A-A.

Chiller and AHUs.

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2760 Prevents Fails to backseat. Mechanical failure. See Remark #1. A) Loss of cooling None. 1.Indirect indication of functional backflow of Local position air to room served failure of AHU; MCR indication of Backdraft Damper cooling air indicators on the by the AHU. AHU D-B and C-B motors running; through damper will indicate if local indication on L-540 of inlet standby AHU damper is stuck open. B) Bypass flow temperature to AHU D-B.

B-A when through the AHU D-B is standby unit can 2.Plant operations has an running. cause standby fan administrative procedure to verify to rotate in that the damper is closed following reverse. Due to the shutdown of its respective AHU.

loss of cooling to room, Standby unit is required to start but may fail as a result of motor overload to overcome the reverse rotation.

C) This would result in the total loss of cooling air in the Shutdown Board Rooms.

Loss of redundancy in 1.Normally opens when AHU is cooling air flow running.

Provide flow Fails to open Mechanical failure. See Remark #2. from Shutdown None.

path for air (Stuck closed) Board Room. Low flow from AHU 2.Indirect indication of functional flow from when AHU B-A is will automatically failure of AHU; local indication on L-WBNP-87 AHU. running. initiate Train "B" 538 of inlet temperature to AHU B-A.

chiller and AHUs.

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-FAN-31-62-A Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressur- while running. Train A power MCR (1-HS-31-62A) redundancy in required to mitigate the effects of a Pressurizing Air Supply ization to failure; Control and CISP indicating providing After trip due to loDBE.

Fan B-A maintain signal failure. lights in MCR pressurization to suction flow to Fan 6.9kV (1-HS-31-62A). 6.9 kV Shutdown A-A, the redundant 2.Fans can be restarted after reset Shutdown Board Room. Train B Fan D-B will after Phase A CIS from Unit 1.

Board Room automatically start. Review of the schematics at slightly See Remark #1. establishes the separation and positive independence of the Train A and pressure with Train B fans.

respect to atmosphere.

1.Fans can be stopped via HS-31-62 A or B.

See Remark #2.

Mechanical failure; 2.Over pressurization of 6.9 kV Fails to stop. Hot short in control Indicating lights in See Remark #2. Shutdown Board Room A.

wiring; Control MCR and CISP signal failure; CIS indicating lights in Differential pressure switches will Phase A Control MCR (1-HS-31-62A). alarm if the P is not adequate and signal failure. start standby CB emergency pressurizing fan during CRI mode.

CRI Control Room Isolation signal -

Train A fails.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-FAN-31-67-B Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressuri- while running. Train B power MCR and CISP redundancy in required to mitigate the effects of a Pressurizing Air Supply zation to failure; Control indicating lights in providing After trip due to loDBE.

Fan C-B maintain 6.9 signal failure. MCR (1-HS-31-67A). pressurization to suction flow to Fan kV Shutdown 6.9 kV Shutdown C-B, the redundant 2.Fan can be restarted after reset Board Room Board Room. Train A Fan A-A will after Phase A CIS from Unit 1.

at slightly automatically start. Review of the schematics positive See Remark #1. establishes the separation and pressure with independence of the Train A and respect to Train B fans.

atmosphere.

1.Fans can be stopped via HS-31-67 A or B.

See Remark #2.

Mechanical failure; 2.Over pressurization of 6.9 kV Fails to stop. Hot short in control Indicating lights in See Remark #2. Shutdown Board Room A.

wiring; Control MCR and CISP signal failure; CIS indicating lights in Differential pressure switches will Phase A Control MCR (1-HS-31-67A). alarm if the P is not adequate and signal failure. start standby CB emergency pressurizing fan during CRI mode.

CRI Control Room Isolation signal -

Train A fails.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-FAN-31-64-A Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressuri- while running. Train A power MCR and CISP redundancy in required to mitigate the effects of a Pressurizing Air Supply zation to failure; Control indicating lights in providing After trip due to loDBE.

Fan A-A maintain 6.9 signal failure. MCR (1-HS-31-64A). pressurization to suction flow to Fan kV Shutdown 6.9 kV Shutdown B-A, the redundant 2.Fan can be restarted after reset Board Room Board Room. Train B Fan C-B will after Phase A CIS from Unit 1.

at slightly automatically start. Review of the schematics positive See Remark #1. establishes the separation and pressure with independence of the Train A and respect to Train B fans.

atmosphere.

1.Fans can be stopped via HS-31-64 A r B.

See Remark #2.

Mechanical failure; 2.Over pressurization of 6.9 kV Fails to stop. Hot short in control Indicating lights in See Remark #2. Shutdown Board Room B. MCR wiring; Control MCR and CISP testing will ensure that there is no signal failure; CIS indicating lights in over pressurization with fans running Phase A Control MCR (1-HS-31-64A). at full capacity.

signal failure.

Differential pressure switches will CRI Control Room alarm if the P is not adequate and Isolation signal - start standby CB emergency Train A fails. pressurizing fan during CRI mode.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-FAN-31-68-B Provides Fails to start, fails Mechanical failure; Indicating lights in Loss of None. 1.The pressurizing fans are not pressur- while running. Train B power MCR and CISP redundancy in required to mitigate the effects of a Pressurizing Air Supply ization to failure; Control indicating lights in providing After trip due to loDBE.

Fan D-B maintain 6.9 signal failure. MCR (1-HS-31-68A). pressurization to suction flow to Fan kV Shutdown 6.9 kV Shutdown D-B, the redundant 2.Fan can be restarted after reset Board Room Board Room. Train A Fan B-A will after Phase A CIS from Unit 1.

at slightly automatically start. Review of the schematics positive See Remark #1. establishes the separation and pressure with independence of the Train A and respect to Train B fans.

atmosphere.

1.Fans can be stopped via HS-31-68 A or B.

See Remark #2.

Mechanical failure; 2.Over pressurization of 6.9 kV Fails to stop. Hot short in control Indicating lights in See Remark #2. Shutdown Board Room B. MCR wiring; Control MCR and CISP testing will ensure that there is no signal failure; CIS indicating lights in over-pressurization with fans running Phase A Control MCR (1-HS-31-68A). at full capacity.

signal failure.

Differential pressure switches will CRI Control Room alarm if the P is not adequate and Isolation signal - start standby CB emergency Train A fails. pressurizing fan during CRI mode.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2756 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan C-B airflow to (when Fan C-B is Local position C-B. Loss of powered and running (HS-31-67A) in Pressurizing running). indicators on damper. redundancy in Train A Fan A-A will MCR and CISP.

Fan C-B. providing supply the pressurizing air pressurizing air. 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Rooms. the effects of a DBE.

Lo flow at FS 66 will be detected and automatically start fan A-A.

See Remark #2.

1.MCR and CISP indication of Fan A) Loss of cooling A-A powered and running (HS Mechanical failure. See Remark #1. air to room served None. 64A).

Isolates idle Fails to backseat. Local position by the fan.

Fan C-B from indicators on damper. See Remarks #2. 2.The functioning of the Pressurizing running Fan Fans is not required for mitigating A-A. the effects of a DBE.

WBNP-87

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2755 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan B-A airflow to (When Fan B-A is Local position B-A. Loss of powered and running (HS-31-64A) in Backdraft Damper Pressurizing running). indicators on damper. redundancy in Train B Fan D-B will MCR and CISP.

Fan B-A. providing supply the pressurizing air pressurizing air. 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Rooms. Lo the effects of a DBE.

flow at FS-31-63 will be detected and automatically start fan D-B.

See Remark #2.

A) Loss of cooling 1.MCR and CISP indication of Fan air to room served C-B powered and running (HS Mechanical failure. See Remark #1. by the fan. None. 67A).

Isolates idle Fails to backseat. Local position Fan B-A from indicators on damper. See Remark #2. 2.The functioning of the Pressurizing running Fan Fans is not required for mitigating D-B. the effects of a DBE.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2812 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan A-A airflow to (When Fan BAA is Local position A-A. Loss of powered and running (HS-31-62A) in Backdraft Damper Pressurizing running). indicators on damper. redundancy in See Remark #2. MCR and CISP.

Fan A-A. providing pressurizing air 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Rooms. Lo the effects of a DBE.

flow on FS-31-65 will be detected and automatically start Fan C-B.

See Remark #2.

A) Loss of cooling 1.MCR and CISP indication of Fan air to room served C-B powered and running (HS Mechanical failure. See Remark #1. by the Fan. 67A).

Isolates idle Fails to backseat. Local position None.

Fan A-A from indicators on damper. 2.The functioning of the Pressurizing running Fan See Remark #2. Fans is not required for mitigating C-B. the effects of a DBE.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-BKD-31-2811 Permits Fails to open Mechanical failure. See Remark #1. No air flow to fan None. 1.Indicating lights of Fan D-B airflow to (when Fan D-B is Local position D-B. Loss of powered and running (HS-31-68A) in Backdraft Damper Pressurizing running). indicators on damper. redundancy in Train A Fan B-A will MCR and CISP.

Fan D-B. providing supply the pressurizing air pressurizing air. 2.The functioning of the Pressurizing flow to Shutdown Fans is not required for mitigating Board Room. Lo the effects of a DBE.

flow at FS-31-69 will be detected and automatically start fan B-A.

See Remark #2.

1.MCR and CISP indication of Fan A) Loss of cooling B-A powered and running (HS Mechanical failure. See Remark #1. air to room served None. 62A).

Isolates idle Fails to backseat. Local position by the Fan.

Fan D-B from indicators on damper. See Remark #2. 2.The functioning of the Pressurizing running Fan Fans is not required for mitigating B-A. the effects of DBE.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 1-FCO-31-291-A Provides Spuriously Closes Mechanical failure; Indicating lights in Loss of suction to None. 1.Fails as is. Normally open.

suction flow (no tornado). Operator error MCR (0-HS-31-34-A). Shutdown Board Tornado Damper Train path for the (handswitch placed Mechanical Room Press. fans See Remark #2. 2.Pressurizing fans are not required A Unit 1 6.9 kV in wrong position). Equipment Room on Unit 1 side. to mitigate the effects of a DBE.

Shutdown indication. Locally, Loss of Board Room 1-ZS-31-291 status pressurization of Pressurizing indication. 6.9 kV Shutdown Fans. Board Room A.

See Remark #2.

Indicating light in 1.The damper 1-FCO-31-291 serves Mechanical failure, MCR (0-HS-31-34-A). Loss of Train A both the Shutdown Board Room and Spuriously closes operator error Mechanical cooling and the Auxiliary Board Rooms Provides (no tornado). (handswitch placed Equipment Room pressurizing to 480 See Remark #2. subsystems as noted for this suction flow in wrong position). indication. Locally, V Board Room 1A function.

path for the 1-ZS-31-291 status and Battery Room Train A 480 V indication. 1. 2.480 V Board Room 1B and Battery Board Room Room II provide the redundancy.

Pressurizing See Remark #2.

Fan and AHU during non-tornado operations.

WBNP-91

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 2-FCO-31-291-A Provides Spuriously Closes Mechanical failure; Indicating lights in Loss of suction to None. 1.Fails as is. Normally open.

suction flow (no tornado) Operator error MCR (0-HS-31-32-A). Shutdown Board Tornado Damper Train path for the (handswitch placed Mechanical Room Press. fans See Remark #2.

A Unit 2 6.9 kV in wrong position). Equipment Room on Unit 2 side.

Shutdown indication. Locally, Loss of Board Rooms 2-ZS-31-291 status pressurization of Pressurizing indication. 6.9 kV Shutdown Fans. Board Room B.

See Remark #2.

Provides suction flow Indicating lights in path to the Mechanical failure; MCR (0-HS-31-32-A). Loss of Train A Train A 480 V Spuriously Closes Operator error Mechanical cooling and 1.The damper 2-FCO-31-291 serves Board Room (no tornado) (handswitch placed Equipment Room pressurizing to 480 See Remark #2. both the Shutdown Board Rooms Pressurizing in wrong position). indication. Locally, V Board Room 2A and the Auxiliary Board Rooms fan and AHU 2-ZS-31-291 status and Battery Room subsystems as noted for this during non- indication. IV. function.

tornado operations. See Remark #2. 2.Board Room 2B and Battery Room III provide the redundancy.

Provides Indicating light in suction flow MCR (0-HS-31-34-A). 1.Fails as is. Normally open.

path to the Mechanical failure; Mechanical Loss of suction to Shutdown Hot short in Equipment Room Shutdown Board 2.Pressurizing fans are not required Board Rooms Spuriously Closes electrical supply. indication. Locally, Room Press. fans to mitigate the effects of a DBE.

Pressurizing (no tornado) 0-ZS-31-276 status on Unit 1 side.

0-FCO-31-276-A Fans on the indication. Loss of None.

Unit 1 side pressurization Tornado Damper Train during non- function to 6.9 kV See Remark #2.

A tornado Shutdown Board WBNP-91 operations. Room A.

TTS BAR Component Function Failure Mode Potential Cause Method of Detection Effect on System Effect on Plant Remarks 0-FCO-31-275-B Provides Spuriously Closes Mechanical failure; Indicating lights in Loss of suction None. 1.Fails as is. Normally open. Motor suction flow (no tornado). Hot short in MCR (0-HS-31-35-B). due to Shutdown operated valve.

Tornado Damper Train path to the electrical supply. Mechanical Board Room See Remark #2.

B Shutdown Equipment Room Press. fans on Unit 2.Pressurizing fans are not required Board Rooms indication. Locally, 1 side. Loss of to mitigate the effects of a DBE.

Pressurizing 0-ZS-31-275 status pressurization Fans on the indication. function to 6.9 kV Unit 1 side Shutdown Board during non- Room A.

tornado operations. Indicating lights in 1.Fails as is. Normally open.

Mechanical failure; MCR 0-(HS-31-32-A). Loss of suction Provides Spuriously Closes Hot short in Mechanical due to Shutdown 2.Pressurizing fans are not required 0-FCO-31-278-A suction flow (no tornado) electrical supply. Equipment Room Board Room None. to mitigate the effects of a DBE.

path to the indication. Locally, Press. fans on Unit Tornado Damper Shutdown 0-ZS-31-278 status 2 side. Loss of See Remark #2.

Train A Board Rooms indication. pressurization Pressurizing function 60 6.9 kV Fans on the Shutdown Board Unit 2 side Room B.

during non- Indicating lights in 1.Fails as is. Normally open.

tornado MCR (0-HS-31-33-B).

operations. Mechanical failure; Mechanical Loss of suction 2.Pressurizing fans are not required Hot short in Equipment Room due to Shutdown to mitigate the effects of a DBE.

Provides Spuriously Closes electrical supply. indication. Locally, Board Room suction flow (no tornado) 0-ZS-31-277 status Pressurization 0-FCO-31-277-B path to the indication. fans on Unit 2 None.

Shutdown side. Loss of Tornado Damper Train Board Rooms pressurization See Remark #2.

B Pressurizing function to 6.9 kV Fans on the Shutdown Board Unit 2 side Room B.

WBNP-91 during non-tornado operations.

TTS BAR WBNP-91 THIS PAGE INTENTIONALLY BLANK

Table 9.4-10 Deleted by Amendment 56 CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-263

Table 9.4-11 Deleted by Amendment 56 64 AIR CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-1 Powerhouse, Control Building Units 1 & 2 Flow Diagram for Heating, Ventilating, and Air Conditioning Air Flow WBNP-91 9.4-265

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-2 Powerhouse Units 1 & 2 Flow Diagram for Air Conditioning Chilled Water WBNP-91 9.4-266

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-3 Powerhouse, Control Building Units 1 & 2 Flow Diagram for Air Conditioning Chilled Water WBNP-91 9.4-267

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-4 Powerhouse, Control Building Units 1 & 2 Electrical Control Diagram Air Conditioning 9.4-268

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-4a Control Building Units 1 & 2 Electrical Air Conditioning Control Diagram - Chilled Water WBNP-91 9.4-269

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-5 Control Building units 1 & 2 Electrical Air Conditioning Control Diagram - Chilled Water WBNP-91 9.4-270

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-6 Control Building Units 1 & 2 Electrical Logic Diagram Air Conditioning System WBNP-91 9.4-271

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-7 Control Building Units 1 & 2 Electrical Logic Diagram Ventilation System WBNP-91 9.4-272

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-8 Powerhouse Units 1 & 2 Auxiliary Building Flow Diagram, Heating, and Ventilating Air Flow WBNP-91 9.4-273

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-9 Auxiliary Building Units 1 & 2 Electrical Logic Diagram for Ventilation System 9.4-274

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-10 Auxiliary Building Units 1 & 2 Electrical Logic Diagram for Ventilation System 9.4-275

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-11 Powerhouse Units 1 & 2 for Containment Ventilation Sytem Control Diagram WBNP-91 9.4-276

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-12 Powerhouse Units 1 & 2 Electrical Control Diagram for Radiation Monitoring System WBNP-89 9.4-277

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-13 Powerhouse Units 1 & 2 Auxiliary Building Flow Diagram for Heating, Cooling, and Ventilating Air Flow WBNP-91 9.4-278

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-14 Auxiliary Building Units 1 & 2 Flow Diagram for Heating, Cooling, and Ventilating Air Flow WBNP-91 9.4-279

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-92 Figure 9.4-15 Powerhouse Units 1 & 2 Auxiliary Building Flow Diagram for Heating, Ventilation and Air Conditioning Air Flow 9.4-280

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-16 Powerhouse Units 1 & 2 Auxiliary Building & Additional Eqpt Bldg Flow Diagram for Heating, Cooling & Ventilating Air Flow WBNP-91 9.4-281

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-17 Powerhouse Units 1 & 2 Electrical Control Diagram for Containment Ventilating System 9.4-282

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-18 Turbine Building Units 1 & 2 and Control Flow Diagram for Heating and Ventilating Air Flow 9.4-283

WATTS BAR WBNP-89 Figure 9.4-19 Powerhouse Units 1 & 2 Flow Diagram Building Heating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-284

WATTS BAR WBNP-89 Figure 9.4-20 Powerhouse Unit 2 Flow Diagram Building Heating AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-285

Security Information Withheld under 10CFR 2.390(d)(1)

WATTS BAR WBNP-91

[e5]

Figure 9.4-21 Pumping Stations Units 1 & 2 Mechanical Heating and Ventilating SECURITY SENSITIVE

[s5]

AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-286

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-22 Diesel Generator Building Units 1 & 2 Flow and Control Diagram for Heating, Ventilating Air Flow WBNP-91 9.4-287

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-89 Figure 9.4-22a Additional Diesel Generator Building Units 1 & 2 Flow and Control Diagram for Heating and Ventilating Air Flow 9.4-288

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-22b Additional Diesel Generator Building Units 1 & 2 Electrical Logic Diagram for 5th Diesel Generator Ventilator System WBNP-89 9.4-289

Security Information Withheld under 10CFR 2.390(d)(1)

WATTS BAR WBNP-91

[e5]

Figure 9.4-22c Additional Diesel Generator Building Mechanical Heating and Ventilating SECURITY SENSITIVE

[s5]

AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-290

Security Information Withheld under 10CFR 2.390(d)(1)

WATTS BAR WBNP-91

[e5]

Figure 9.4-23 Diesel Generator Building Mechanical Heating and Ventilating SECURITY SENSITIVE

[s5]

AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-291

Security Information Withheld under 10CFR 2.390(d)(1)

WATTS BAR WBNP-91

[e5]

Figure 9.4-24 Diesel Generator Building Mechanical Heating and Ventilating SECURITY SENSITIVE

[s5]

AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-292

WATTS BAR WBNP-91 Figure 9.4-24a Diesel Generator Building Mechanical Heating and Ventilation AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-293

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-25 Diesel Building Units 1 & 2 Electrical Logic Diagram for Ventilation System WBNP-91 9.4-294

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-26 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilation System WBNP-91 9.4-295

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-27 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilation System WBNP-91 9.4-296

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-28 Reactor Building Units 1 & 2 Flow Diagram for Heating and Ventilation Air Flow 9.4-297

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-28a Powerhouse Reactor Building Unit 2 Flow Diagram Heating & Ventilation Air Flow WBNP-89 9.4-298

WATTS BAR WBNP-91 Figure 9.4-29 Powerhouse Unit 1 Electrical Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-299

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-30 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilating System WBNP-91 9.4-300

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-30 Powerhouse Unit 2 Electrical Control Diagram Containment Ventilating System (Sheet A)

WBNP-89 9.4-301

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-89 Figure 9.4-30 Powerhouse Unit 1 Electrical Control Diagram Containment Ventilating System (Sheet B) 9.4-302

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-31 Powerhouse Unit 1 Electrical Control Diagram for Containment Ventilating System 9.4-303

WATTS BAR WBNP-91 Figure 9.4-32 Powerhouse Unit 1 Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-304

WATTS BAR WBNP-91 Figure 9.4-33 Powerhouse Unit 1 Electrical Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-305

WATTS BAR WBNP-91 Figure 9.4-34 Powerhouse Unit 1 Electrical Logic Diagram for Ventilation System AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-306

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-35 Powerhouse Post-Accident Sampling System Unit 1 Flow Diagram for Heating, Ventilating and Air Conditioning Air Flow 9.4-307

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS Figure 9.4-36 Auxiliary Building Units 1 & 2 Electrical Post-Accident Sampling System Logic Diagram WBNP-91 9.4-308

WATTS BAR AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS WBNP-91 Figure 9.4-37 Auxiliary Building Units 1 & 2 Electrical Post-Accident Sampling Control Diagram 9.4-309

WATTS BAR WBNP-91 THIS PAGE INTENTIONALLY BLANK AIR CONDITIONING, HEATING, COOLING AND VENTILATION SYSTEMS 9.4-310

OTHER AUXILIARY SYSTEMS

.1 Fire Protection System The WBN Fire Protection Program is described in the WBN Fire Protection Report.[2][3][4][5] For interface with a auxiliary feedwater system, see Section 10.4.9.

.1.1 Deleted by Amendment 87

.1.2 Deleted by Amendment 87

.1.3 Deleted by Amendment 87

.1.4 Deleted by Amendment 87

.1.5 Deleted by Amendment 87

.2 Plant Communications System

.2.1 Design Bases Interplant and/or Offsite Systems The design basis for interplant and/or offsite communications is to provide dependable systems to ensure reliable service during normal plant operation and emergency conditions.

The primary interplant offsite communications systems are microwave radio, fiber optics circuits, telephone systems and radio systems.See Section 9.5.2.3 for a general description of each system.

Intraplant Communications The design basis for the intraplant communications is to provide sufficient equipment of various types such that the plant has adequate communications to start up, continue safe operation, or shutdown safely.

The primary intraplant communications systems are the TSS telephone system, intercomss, sound powered telephones, two-way VHF cellular radios, VHF radio paging, codes (code call is not used), alarms (accountability/evacuation and fire/medical), and paging.

See Section 9.5.2.2 for a general description of each system.

.2.2 General Description Intraplant Communications The plant communications systems are installed and maintained by TVA with the exception of the cellular radio system which is maintained by the cell radio provider.

The following paragraphs describe the basic functions of the intraplant communications systems.

ER AUXILIARY SYSTEMS 9.5-1

Telephone System Telephone Switching System (TSS) - A TSS is installed to provide primary 2-way voice communications and data transmission throughout the Watts Bar Nuclear Plant as well as access to offsite circuits. TThe Node 1 and Node 2 TSSs are powered from separate 48V dc systems. Each 48V system consists of battery chargers, a regulating power board, and a 48V battery. Each battery charger is capable of assuming the total load for its respective Node. The selected charger provides 48V dc to its TSS with the battery available as needed. Each battery is sized to carry the load at full capacity for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> without the chargers. The Node 1 chargers are powered by dual ac voltage sources supplied from train A and train B diesel-backed boards. The Node 2 chargers are powered by dual ac voltage sources. The main source is the construction sub-station, and the other is from the telephone diesel generator unit.

OTHER AUXILIARY SYSTEMS

Sound-Powered Telephone Systems WPlant Operation Systems - The primary purpose of these systems is to provide communications for maintenance and operations personnel. There are 7 separate systems provided for each unit.Backup Control Center System - The primary purpose of this sound powered system is to provide alternative communications between the auxiliary control room and other stations which must be manned to shutdown the reactor if the MCR is abandoned. This system consists of two completely redundant subsystems. Each subsystem is wired directly and independently of all other communications systems. Wiring routes avoid the spreading room, unit control rooms, and auxiliary instrument rooms. Sound-powered equipment and circuits are provided in the Diesel Generator Buildings, the 480V ac shutdown board rooms, the 6.9 kV ac shutdown board rooms, and the auxiliary control room.

Health Physics System - The primary purpose of this sound powered telephone system is to provide an alternate communications link between the health physics office and the MCR. A direct dedicated circuit is provided between the health physics office and the Unit control room (physically on the electrical control area desk).

Diesel Building to Main Control Room - The primary purpose of this sound powered telephone system is to provide an alternate communications link between the Diesel Generator Building and main control room. A direct dedicated circuit is provided between the shielded waiting room in the Diesel Generator Building and the MCR at the diesel generator control panel.

Closed-Circuit Television Portable closed circuit television systems are provided, when necessary, for remotely viewing radwaste packaging operation, refueling operations, area and equipment surveillance, and maintenance activities. Codes, Alarms, and Paging System The codes, alarms, and paging (CAP) system is one system that combines assembly and accountability alarm, fire and medical emergency alarm, and paging. Control logic, tone generation, and power and signal distribution equipment is located in the communications room with speakers with solid-state amplifier as end devices located throughout the plant. All alarms are controlled from the MCR. The assembly/accountability and paging alarms are also controllable from the auxiliary control room. Paging may be accessed from selected TSS telephones. Paging may also be accessed by paging handsets in the main and auxiliary control room.

The CAP system operational priority sequence is fixed by relay logic as follows:

(1) Site Assembly alarm (2) Fire and medical emergency alarm (3) Paging ER AUXILIARY SYSTEMS 9.5-3

Paging can be advanced to a higher priority in emergencies by using the evacuation alarm control unit cancel push button.

Design consideration has been given to increase system reliability with the following features provided:

(1) Redundant operating centers.

(2) Three separate tone generator units.

(3) Two physically separate power distribution networks with approximately half of the amplifier-speaker units in each area of the plant fed from each fuse panel via alarm-type fuses.

(4) Redundant chargers are used and can be switched into service as required.

(5) DC supervision of each individual audio pair.

(6) Isolation of evacuation alarm actuating devices.

(7) Electrical separation of amplified-speakers in each area into two circuits such that adequate coverage can be maintained in the event of one circuit failure.

Radio System Onsite Radio Paging System - The primary purpose of this system is to provide onsite paging of key plant personnel. This system, is accessible from the TSS telephone system.

Inplant VHF Radio System - The primary purpose of this system is to provide voice communications throughout the plant for plant operations and maintenance personnel.

This system consists of several repeaters, numerous remote control units, and portable VHF radios. One or more repeaters may be used by the fire brigade for communications during a fire emergency. Nuclear Security personnel also have access to these repeaters as an alternative to the Nuclear Security Radio System.

Inplant Cellular Radio System - The primary purpose of this system is to provide voice communications throughout the plant and owner controlled property for use by operations and maintenance personnel. The system consists of a cell site, remote interface unit (to interface with the inplant distributed antenna system), and cell radio/phones. Nuclear Security and Fire Operations also have access to this system.

.2.3 General Description Interplant System Microwave Radio Microwave circuit provides access to the power system control center (PSCC).

Redundant 24V dc-dc converters supplied from the 48V dc telephone power system are installed for the exclusive use of this microwave circuit.

OTHER AUXILIARY SYSTEMS

Fiber Optic Circuit The fiber optic circuit provides high speed digital communication connecting major communication centers and administrative offices through TVA. This fiber optic circuit is integrated into the 161kV insulated shield wire. Electro-optical interface and channel equipment are located in Telecommunications Node 2 Building.

Telephone System Commercial Telephone Service - Public telephone service is provided to all TSS telephones with proper class of service, to pay telephones, and to dedicated data circuits.

Emergency Notification System (ENS) - The primary purpose of this telephone circuit is to provide a direct circuit from Watts Bar Nuclear Plant to the NRC in the event of a serious emergency as well as ongoing information on plant system, status and parameters at the nuclear plant reactor. A dedicated telephone line that is independent of the public telephone switching network is provided for the NRC.

Health Physics Network (HPN) - The primary function of this telephone circuit is to report directly to the NRC on radiological and meteorological conditions as well as assessment of trends and the need for protective measures on-site and off-site. A dedicated telephone line that is independent of public telephone switching network is provided for the NRC.

Transmission & Power Supply - The primary purpose of this system is to provide communications for Transmission & Power Supply engineers, but it may also be used by plant operations personnel during emergencies. This system is capable of contacting local mobile units and other TVA power generating facilities.

Nuclear Security Radio - The primary purpose of this system is to provide effective communications between all Nuclear Security officers.

Emergency Radio Communication System - This system is integrated with inplant repeater system for coordination with field monitoring teams and other personnel.

Sheriffs' Radio - The primary purpose of this system is to provide communications between Nuclear Security officers and the Meigs and Rhea County sheriffs.

.2.4 Evaluation The following evaluation is intended to establish adequacy and redundancy of the plant communications systems design.

Interplant Systems There are four basic types of plant-to-offsite communications: microwave radio, fiber optics circuits, radio, and telephone systems. The availability of these systems during or after an emergency is enhanced by the fact that each enters the plant via different means.

ER AUXILIARY SYSTEMS 9.5-5

The redundancy of the communications systems is of further significance. The microwave and fiber optics equipment design employs redundancy both in the channelizing and in the RF circuitry. The microwave system is powered from a battery-battery charger system through parallel-connected, redundant dc-dc converters. Each charger is fed from two separate ac sources, and each battery is capable of operating its system for a minimum of three hours without chargers.

The major electronic portions of the microwave are housed in the communications room which is located in the Control Building (Node 1). This building is a Seismic Category I structure.

The commercial telephone lines are terminated in Bell Hut and extend to Node 1 and 2 and from there to instruments located throughout the plant via the TSS. Local central office lines are available in the control room in the event of the loss of the TSS.

The Transmission & Power Supply radio have no components in the communications room and, therefore, would not be affected by the total destruction of this room. The Nuclear Security and Sheriffs RCUs in the Secondary Alarm Station (SAS) would be affected by the total destruction of the communication room and would be inoperable.

Hand held radios would still be available to communicate from the SAS. The emergency radio communications system, however, depends on equipment in the communications room and would be inoperative.

All of the VHF radio systems are powered by battery- and/or diesel-backed ac sources and would remain operative following loss of offsite power.

Refer to Figure 9.5-19 for availability of interplant communications during various postulated conditions.

Intraplant System The automatic telephone equipment is one of the primary systems is designed so that failures in individual switches or lines do not interrupt service. However, such failures are annunciated and repairs are made promptly. The main (Node 1) switching equipment for this system is located in the communications room which is in a Seismic Category I building. Communication between TSS phones within seismic Category I buildings is through Node 1. In times of emergency, the TSS can be programmed to limit access only to key people to ensure that they will always have telephone service.

The codes, alarms (assembly/accountability) and paging system is designed for survivability with the following features:

(1) Duplicate operating locations: one in the main control room and the other in the auxiliary control room. Isolation of the duplicate controls is provided in the communications room.

OTHER AUXILIARY SYSTEMS

(2) Three tone generator consoles powered from two separate sources:

(a) The operating console is normally aligned to the A source.

(b) A standby console which automatically is inserted upon power failure of the operating console. The standby console is normally aligned to the B source. It may also be manually switched at any time.

(c) A third console which may be manually substituted for either of the other consoles.

(3) Plug-in features:

(a) The tone generators are solid-state plug-in devices.

(b) The amplifier in the speaker unit is solid-state, easily unplugged and replaced.

(4) The power-leads to each speaker-amplifier are fused and annunciated.

(5) The signal-leads to each speaker-amplifier are supervised with dc while idle.

Any occurrence which causes a short of the signal-leads will cause the fuse to blow and annunciate. The rest of the units will function normally with single or multiple open-circuited signal-leads to individual speaker-amplifiers.

(6) There are two sources of 24V dc power distributed to the speaker- amplifiers and approximately half in each area of the plant are supplied from each source. Each source is quite reliable since it is supplied from chargers which are backed up by batteries capable of supplying the load for three hours.

The failure of the TSS equipment will not impair the use of the paging equipment from the local stations located at the unit operator's desk or the auxiliary control room.

The sound-powered telephone systems are completely independent of power, each other, and all other systems provided. As long as a complete metallic path exists between instruments, communications can be maintained since the instruments supplied with these systems are very rugged and will successfully withstand high shocks, negligence, and abuse. If permanently installed wires are rendered unusable for any reason, a temporary pair of wires can be used with the sound-powered instruments.

Neither the Inplant VHF Radio System nor the Inplant Cellular Radio System have any components in the communications room and, therefore, would not be affected by the total destruction of this room. The Onsite Radio Paging System, however, depends on equipment located in the communications room and would be inoperative.

The Inplant VHF Radio System, the Cellular Radio System, and the Onsite Radio Paging System are powered by battery- and/or diesel-backed ac sources and would remain operative following loss of offsite power.

ER AUXILIARY SYSTEMS 9.5-7

Refer to Figure 9.5-19 for availability of intraplant communications during various postulated conditions.

.2.5 Inspection and Tests The two communication systems are covered by Special Performance Tests (SPT-251-02 and SPT-252-02):

(1) The sound-powered telephone systems provided for the backup control center, health physics office, and Diesel Building shielded room; OTHER AUXILIARY SYSTEMS

(2) The codes, alarms, and paging system.

All systems are carefully installed and checked for proper operation initially by construction forces. Routine maintenance is performed by operating personnel on a regular basis and includes such items as checking for proper switch operation, checking for proper operating levels, visual inspection, etc.

The most comprehensive testing, however, results from the heavy daily usage of the equipment and the subsequent reports of any of the users. Individual power failures in the equipment are annunciated.

.3 Lighting Systems

.3.1 Design Bases There are three basic lighting systems in the plant designated as follows: normal, standby, and emergency. These systems are designed in accordance with TVA design guides and standards which use the recommendations of the Illuminating Engineering Society of North America as their basis, and good engineering practice to provide the required illumination necessary for safe conduct of plant operations and under normal conditions to make the plant personnel as comfortable as possible.

The normal lighting system is designed to economically provide the amount and quality of illumination to meet normal plant operations and maintenance requirements.

The standby lighting system upon loss of the normal lighting system, provides adequate illumination for the safe shutdown of the reactor and the evacuation of personnel from vital areas of the plant if the need should occur. It forms an integral part of the normal lighting requirements but is fed from an entirely independent source.

The emergency lighting system is composed of two separate systems: (1) The 125V dc lighting system, which is designed to provide immediately the minimum illumination level in areas vital to the safe shutdown of the reactor for the period required for diesel loading or upon loss of ac auxiliary power for the duration of capacity of the 125V vital dc batteries and (2) an individual eight-hour battery pack network, which is used to supplement the 125V dc emergency lighting to provide emergency lighting in areas that must be manned for safe shutdown; and for access and egress to and from fire areas, which meet the requirements of 10CFR50, Appendix R, III.J. Other battery pack units are provided for building egress for personnel safety purposes.

ER AUXILIARY SYSTEMS 9.5-9

.3.2 Description of the Plant Lighting System All plant lighting systems have the following features in common: adequate capacity and rating for the operation of the loads connected to the systems, independent wiring and power supply, overcurrent protection for conductor and equipment using nonadjustable inverse time circuit breakers, copper conductor with 600-volt insulation run in metal raceways.

The insulated cable used inside the primary containment areas is resistant to nuclear radiation and chemical environmental conditions in this area.

0 OTHER AUXILIARY SYSTEMS

The plant lighting system consists of three basic schemes, the first of which is the normal lighting. This system is for general lighting of the plant: the major power supply is through two alternate feeders from the 6.9kV common boards A and B to selective and interrupter switch and 3-phase 6900-120/208-volt ac transformers, feeding a lighting board. These lighting boards are located in the Turbine and Auxiliary Buildings of the main plant. Other lighting boards in the Service Building, Office Buildings, gatehouse, etc., are fed from 480V boards through 3-phase 480-120/208V ac transformers. These lighting boards feed the normal lighting cabinets, designated by the prefix LC___, distributed throughout the main plant. In the MCR, alternate rows of fixtures or alternate fixtures are fed from different lighting boards to prevent total blackout in a particular area in case of failure of one of the other lighting boards or cabinets.

The second system is the standby lighting, which forms a part of the normal lighting requirements and is normally energized at all times. This system is fed from 480V Reactor MOV boards 1A2-A, 1B2-B, 2A2-A, and 2B2-B to 3-phase 480-120/208V ac transformers to each standby lighting cabinet, designated by the prefix LS___ . The Reactor MOV boards have a normal and alternate ac power supply and in event of their failure are fed from the standby diesel generators. The cable feeders to the standby cabinets located in the Seismic Category I structure are routed in redundant raceways and the fixtures are dispersed among the normal lighting fixtures.

The third lighting system is referred to as the emergency system. It consists of two systems as described in Section 9.5.3.1. The 125V dc emergency lighting system is electrically held in the off position until a power failure occurs on the associated standby lighting systems. Then the emergency lighting cabinets, designated by the prefix LD___, are automatically energized from the 125V dc vital battery boards. This system is an essential supporting auxiliary system for the ESF, and the cable feeders to the LD cabinets are routed on the redundant ESF cable tray system or in conduit.

The fixtures are incandescent type and are dispersed among the normal and standby fixtures with alternate emergency fixtures being fed from redundant power trained LD cabinets.

The individual eight-hour battery pack emergency lighting system is automatically held in the de-energized state until loss of the normal ac supply. A charger monitors battery voltage and charges on fast rate when necessary. Solid-state circuits continually monitor both ac and dc current. The transfer switch circuit instantly connects lamps to battery on ac failure and disconnects them when normal power is restored. In some cases, the lamp heads are mounted remote from the units to obtain adequate light distribution.

.3.3 Diesel Generator Building Lighting System The Diesel Generator Building lighting cabinets are fed through 480-208/120V 3-phase local lighting transformers, which in turn are fed from the diesel 480V auxiliary boards respectively. Each of these auxiliary boards has dual feeders from the 480V shutdown boards during normal operation. In the event of an ac power failure to the 480V shutdown boards, the diesel should start within the prescribed time to provide the 480V ac power requirements for the safe shutdown of the plant through the standby feeders ER AUXILIARY SYSTEMS 9.5-11

to the 480V shutdown boards, thus supplying power again to the Diesel Generator Building lighting transformers. Each diesel generator unit has a lighting cabinet which supplies the normal lighting for that unit. Low-level lighting required for maintenance or operating procedures and ingress/egress in the event of loss of normal lighting is supplied from fixtures with a self-contained battery and inverter charger and also individual eight-hour battery pack lighting units.

.3.4 Safety Related Functions of the Lighting Systems The lighting system is adequate for the operation and evacuation of the plant to the extent that the supports for the components of the system, that are located in areas of Seismic Category I structures containing safety-related equipment are qualified to prevent failure that could impair the functioning of any safety-related plant feature.

Lighting systems are classified as non-safety related. However, due to their functions, standby and emergency lighting systems shall be of a high reliability design so as to ensure necessary illumination in areas of the plant needed for operation of safe shutdown equipment and in access and egress routes thereto.

2 OTHER AUXILIARY SYSTEMS

.3.5 Inspection and Testing Requirements Following the complete installation of a lighting system, it will be tested and inspected and short circuits, grounding of potential conductors, other faults, etc. will be eliminated and damaged or nonoperable fixtures replaced or repaired. The operation of the lighting system shall be observed during the initial and periodic testing of the normal and alternate feeder systems and during the 125V dc emergency power tests to the various boards from which these emergency lighting systems are fed. Maintenance and relamping of the normal and standby lighting systems shall be according to routine plant operating procedures.

The 125V dc emergency lighting system shall be tested periodically by tripping the holding coil circuit fed from the LS standby cabinet, thus closing the feeder circuit to the LD emergency cabinet. A written record of dates and results of these tests shall be maintained by plant personnel responsible for these tests.

The individual eight-hour battery pack lighting units will be tested periodically to ensure that the lamps are operational in according with routine plant procedures.

.4 Diesel Generator Fuel Oil Storage and Transfer System

.4.1 Design Basis The diesel generator fuel oil system provides independent storage and transfer capacity to supply the four diesel generator units operating at continuous ratings with No. 2 Fuel Oil for a period of seven days without replacement.

References to the Fifth or Additional Diesel have been deleted in Sections 9.5.4 through 9.5.8. Figure 8.3-1A is retained for information.

The buildings are Seismic Category I structures and will withstand the affects of tornadoes, credible missiles, floods, rain, snow, or ice, as defined in Chapter 3, Section 3.3, 3.4, and 3.5.

The design code requirements for the system are as follows:

(1) Diesel Generator Building 7-day fuel oil storage tanks - Code for Unfired Pressure Vessels, ASME Section VIII. Division I.

(2) Piping from the 7-day fuel oil storage tanks to the interface with the skid-mounted diesel generator unit fuel oil piping - Boiler and Pressure Vessel Code, ASME Section III, Class 3 (Per NFPA Code 30-1973).

Skid mounted piping and components for the fuel oil system were designed, manufactured and installed in accordance with ANSI B31.1. This subsystem performs a primary safety function and is supported to Seismic Category I requirements. The scope of this work was done to meet 10CFR50, Appendix B quality assurance requirements. Future modifications performed on this subsystem piping are required to meet the intent of ASME Section III, Class 3.

ER AUXILIARY SYSTEMS 9.5-13

(3) Remaining piping, valves, pumps, and associated equipment - Power Piping Code, ANSI B31.1-1973.

The 7-day diesel fuel oil storage tanks are designed for embedment within the Diesel Generator Building foundation. The fuel oil day tanks are skid-mounted on the diesel generator units.

The diesel fuel oil system for the diesel generator units meets the single failure criterion. That portion of the system from the 7-day storage tanks to the diesel generator units meets Seismic Category I requirements. The remainder of the system within the Diesel Generator Building meets Seismic Category I (L) requirements.

.4.2 System Description The flow diagram of the diesel generator fuel oil system is shown in Figure 9.5-20. The control and logic diagrams are shown in Figures 9.5-21 and 9.5-22, respectively.

The diesel generator fuel oil system consists of four 7-day embedded storage tank assemblies, one assembly for each diesel generator unit, with their associated day tanks, pumps, valves, and piping. The 7-day tanks are embedded in the Diesel Generator Building substructure and have a capacity of approximately 70,248 gallons of fuel for each diesel generator unit. The fuel day tanks (one per diesel engine) are mounted to the diesel engine skid and were supplied by the diesel generator vendor.

These tanks have a capacity of approximately 550 gallons.

Level transmitters are provided on the 7-day storage tank assemblies to provide the following functions:

(1) Provide local fuel level indication.

(2) Annunciate an alarm in the MCR when the fuel level approaches a seven-day supply.

(3) Annunciate an alarm in the MCR on high level above the pump shut-off setting.

(4) Provide an interlock with the outside transfer pump at the yard storage tanks to shut off the pump automatically on high level of any of the four 7-day tanks which is being filled. Provide a high level interlock with the DG transfer pump in the DG Building when transferring fuel to fill any of the 7-day tanks from another 7-day tank within that building. Interlocks are not provided when using the DG transfer pump to transfer fuel to any other tanks.

A truck fill connection, condensate sump suction connection, and inspection dipstick gauge manholes are provided for each 7-day storage tank assembly. The vents to the atmosphere on all tank assemblies, with the exception of the skid-mounted day tanks, are provided with double fire screens to prevent an outside spark from entering the assemblies and igniting the gases within. The National Fire Code (NFC) does not require flame arrestors for Class 2 combustible liquid storage tank vents. Therefore, in order to facilitate the installation of missile protection devices, the skid mounted fuel 4 OTHER AUXILIARY SYSTEMS

oil day tank vent lines are not flame-proofed. However, the open vent lines are shielded from the atmosphere and equipped with bird screens. All tank connections and vents are above maximum flood elevation. That portion of the 7-day fuel oil tank vent above the roof level is encased in reinforced concrete for missile protection.

Two skid-mounted, electric motor driven, 15 gpm fuel oil transfer pumps, powered from the 480V diesel auxiliary boards (See Figure 8.3-32), are provided for each generating unit to transfer fuel from the 7-day storage tank assembly to the two skid-mounted day tanks of each generating unit. Each of these pumps supplies fuel to both day tanks.

Two sets of level switches are provided for each day tank and associated transfer pumps to maintain day tank level. An additional set of level switches provide both Main Control Room (MCR) and Auxiliary Control Room (ACR) alarms to indicate high and low fuel oil level in the day tanks.

From each day tank, fuel is supplied to the diesel injectors by a diesel engine driven pump. An electric motor-driven fuel pump is provided as a backup for the engine driven fuel pump. Separate suction and discharge lines serve each pump. Each pump has a suction strainer and dual element fuel filters are provided at each pump discharge. Additional filters at the inlet and outlet of each fuel injector protect the working parts of the injector. Pressure gauges are provided on both sides of the dual element fuel filters to provide a means of determining filter pressure drop. Pressure switches are provided between the fuel pumps and the dual element filters and between the final filters and the fuel injectors. The pressure switches provide ACR and MCR alarms on low pressure. Maintenance procedures call for periodic changing of filters and surveillance test runs verify the cleanliness of these filters.

Screens are provided in the suction lines of the Diesel Generator Building transfer pumps which transfer the fuel from the yard storage tank to the 7-day storage tanks.

The 7-day tanks are sloped to collect water and sediment at the low end and can be "dip leg" pumped as necessary. The fuel storage and transfer system is protected against the entry of rain water, and the day tanks and 7-day tanks are not harmed by flood waters.

Each shipment of No. 2 diesel fuel oil can be sampled prior to pumping to the yard tanks. Samples collected may be used for analyses to verify site specific criteria prior to offloading the tanker and to ensure contractual requirements are met if necessary.

Shipments of diesel fuel can be held in the yard tanks until the specified criteria are met and the fuel oil is transferred to one of the 7-day storage tanks or the fuel is burned in the auxiliary boilers. If necessary the fuel is discarded. Sampling and analyses of fuel oil that is transferred to or stored in the 7-day storage tanks is completed in accordance with Technical Specifications.

The 7-day storage tanks are inspected in accordance with the Technical Specifications.

ER AUXILIARY SYSTEMS 9.5-15

The methods for maintaining acceptable levels of fuel quality for the standby diesel generators at Watts Bar Nuclear Plant meet the guidelines set forth by NRC Regulatory Guide 1.137, Revision 1, except for pressure testing required by Section C1.e which was accepted by SER Supplement 5, Section 9.5.4.1 and exceptions to C2, given as follows:

(a) C2.a the reference year of ASTM D 975 used is 1990 or later revision instead of the year 1977 which is specified in the Regulatory Guide.

(b) C2.b methods for water and particle detection in fuel oil prior to transferring fuel oil to supply tank is specified in the Technical Specifications.

(c) C2.b analytical results to be completed after transfer of fuel to supply tanks are completed within time frames given in the Technical Specifications instead of the listed 2 weeks.

(d) C2.c fuel oil samples are collected using applicable ASTM method specified in the Technical Specifications instead of the listed ASTM D 270.

A transfer pump located adjacent to the yard fuel oil storage tanks provides the following functions:

(1) Transfer fuel oil from a tank truck to either of two yard fuel oil storage tanks.

(2) Transfer fuel oil from either yard fuel oil storage tank to the other.

(3) Transfer fuel oil from either yard fuel oil tank to any of the four7-day fuel oil storage tank assemblies.

(4) Reject fuel oil from either yard fuel oil tank through a reject connection in the yard.

Seismically qualified fuel oil transfer pumps are also located in the Diesel Generator Building.

The Diesel Generator Building fuel oil transfer pump allows fuel oil to be transferred from any one of the 7-day fuel oil storage tanks in the Diesel Generator Building to any other 7-day fuel oil storage tanks in the Diesel Generator Building or either yard storage tank.

.4.3 Safety Evaluation With a 7-day supply of diesel fuel in each tank assembly, and each assembly embedded in the concrete substructure of a Seismic Category I building and separated by 18 inches of concrete, the diesel generator units are assured of a sufficient fuel supply for any of the conditions discussed in Section 9.5.4.1. The diesel generator fuel oil tank assemblies, piping, and pumps are so arranged that malfunction or failure of either an active or passive component associated with the source of supply for any one 6 OTHER AUXILIARY SYSTEMS

diesel generator unit does not impair the ability of the other sources to supply fuel oil to the other units. Each diesel generator is aligned so as to be able to supply power to its own auxiliaries so that a single failure can not result in loss of more than one diesel generator unit. The system thus meets the requirements of the single failure criterion.

Automatic carbon dioxide fire protection is provided in the Diesel Building fuel oil transfer pump room and the four rooms housing the diesel generator units.

A corrosion allowance is provided in the design wall thickness for the Diesel Generator Building 7-day fuel oil storage tanks. The interiors of the tanks were coated for added corrosion protection. The fuel oil piping and fittings within the Diesel Generator Building have ample corrosion allowance, having been designed per the codes noted in Section 9.5.4.1, and will operate at a pressure considerably below the maximum allowable for the schedule of pipe and fittings used.

It is expected that additional fuel oil beyond that stored onsite can be procured and delivered to the plant site within a reasonable period of time since:

(1) The plant site is served by a railroad spur owned by TVA. The yard transfer pump is provided for transferring fuel oil from a tank car to either of the two fuel oil tanks in the yard, or directly to the diesel fuel oil storage tank assemblies.

(2) State Route 68 provides vehicle access to the site and intersects: State Route 58 and Interstate 75 (I-75) east of the site and State Route 29 (US 27) west of the site. State Routes 29 (US 27) and 58 pass within 10 miles of the site and I-75 within 30 miles of the site. These thoroughfares provide year round access (extreme weather conditions could interrupt traffic flow for short periods of time) to both Chattanooga and Knoxville. With access to both of these major cities it would be very unlikely that tanker truck deliveries would be interrupted for any significant period of time, even in periods of extreme weather conditions.

(3) If rail or road transportation is unavailable, barge or tanker delivery can be accepted at the dock area on the west bank of the Tennessee River near the plant site.

A failure modes and effects analysis for the diesel generator fuel oil storage and transfer subsystem is presented in Table 9.5-2.

.4.4 Tests and Inspections The engine-mounted, motor and engine-driven fuel oil transfer pumps and day tanks were functionally tested in the vendor's shop in accordance with the manufacturer's standards to verify the performance of the diesel generator units and accessories. The fuel oil transfer pumps in the yard and Diesel Generator Building were tested in the manufacturer's factory to verify their performance. The 7-day fuel oil storage tanks were tested with compressed air to 20 psig prior to shipment to the plant site.

ER AUXILIARY SYSTEMS 9.5-17

The entire diesel fuel oil system is flushed with oil and is functionally tested at the plant site in accordance with Chapter 14.0. The diesel fuel oil system will be periodically tested to satisfy the Technical Specifications.

.5 Diesel Generator Cooling Water System

.5.1 Design Bases A closed-loop circulating water cooling system is furnished for each engine of the four tandem diesel generator units housed within the Diesel Generator Building. The system maintains the temperature of the diesel engine within a safe operating range, under all load conditions, and maintains the coolant pre-heat during stand-by conditions. The heat sink for this system is the ERCW system which, flows through the tube side of the skid-mounted heat exchangers. See Section 9.2.1 for discussion of the ERCW system.

The diesel generator skid-mounted cooling water piping and components between the skid interface connection and the engine interface are vendor supplied, safety-related, ANSI B31.1, Seismic Category I with the exception of the cooling water heat exchangers which are ASME Section III, Class 3. All modifications to the skid-mounted diesel generator cooling water system piping are performed to meet the intent of ASME Section III, Class 3 (TVA Class C).

These buildings are designed to Seismic Category I requirements, and are designed to withstand the effects of tornadoes, credible missiles, hurricanes, floods, rain, snow, or ice as defined in Chapter 3 (Sections 3.3, 3.4, and 3.5).

.5.2 System Description Each cooling system includes a pump, heat exchanger expansion tank, and all accessories required for a cooling loop. (See Figure 9.5-23.)

To preclude long term corrosion or organic fouling the engine cooling water system requires de-ionized water with a corrosion inhibitor. The water chemistry is maintained in conformance with the engine manufacturer's recommendations, Electromotive Division of Generel Motors Corporation MI 1748. The closed-loop engine cooling water is circulated through the shell side of each skid-mounted heat exchanger by two diesel-engine shaft-driven pumps. Jacket water immersion heaters are provided for each engine to maintain the jacket water within the vendor recommended temperature range in order to reduce thermal stresses and assure the fast starting and load accepting capability of the diesel generator units in performing their required safety function.

Temperature switches are used to control the immersion heater and to annunciate on high or low jacket water temperature. For temperature switch set points, see Figure 9.5-23.

Jacket water flows through the lubrication oil cooler by thermosyphon action when the diesel generators are idle. An electric motor driven lubrication oil circulation pump, powered from the 480V diesel auxiliary board, is also provided for each engine to 8 OTHER AUXILIARY SYSTEMS

circulate the lubrication oil through the lubrication oil cooler, which is warmed by the engine jacket water, and return the oil to the engine sump. The jacket water immersion heaters are controlled by thermostats, and the lubrication oil circulation pumps run continuously when the engine is not running. This recirculation ensures the lube-oil temperature is maintained at 85°F (minimum) during the standby mode. (See Figures 8.3-33, -33A, -33B, -33C, and -35.)

Each diesel generator unit is provided with two closed engine cooling water loops (one for each engine), for which the heat sink is provided by the ERCW system. (Refer to Section 9.2.1). The ERCW flows through the tube side of the skid-mounted heat exchangers.

.5.3 Safety Evaluation The cooling water is supplied to the heat exchangers of each diesel generator unit through redundant headers of the ERCW system. The system isolation valves are so arranged as to provide the capability to isolate either cooling source in the event of a component malfunction or excessive leakage from the system. Refer to Figures 9.2-1 and 9.2-4A. These valves are powered from the 480V diesel auxiliary board and closure signals for these valves are manually initiated (See Figures 8.3-33, -33A, -33B,

-33C, and -35.) Therefore a malfunction (single failure of a component) or loss of one cooling water source can not jeopardize the function of a diesel generator unit. Both the non-skid-mounted air-start piping and fire protection piping located in the vicinity of the diesel generator cooling water system are designed to Seismic Category I(L) to ensure that no seismic event will degrade the functional capability of the diesel generator cooling water system. A failure modes and effects analysis for the diesel generator cooling water system is presented in Table 9.5-2.

.5.4 Tests and Inspections The ERCW system within the Diesel Generator Building is hydrostatically tested in accordance with the requirements of ASME Section III and is functionally tested in accordance with Chapter 14.0. System components are accessible for periodic inspections during operation.

The skid-mounted diesel generator cooling water system components are inspected and serviced as specified in the scheduled maintenance program for the Watts Bar Nuclear Plant diesel generator units.

.6 Diesel Generator Starting System

.6.1 Design Bases Each diesel engine is equipped with an independent pneumatic starting system to provide reliable, automatic starting of the engines. See Figure 9.5-24. The diesel starting air system components are housed with their respective diesel generator units within the diesel generator rooms in the Diesel Generator Building.

The supply headers from each air compressor to the isolation check valve on its skid-mounted accumulator are designed to Seismic Category I(L) requirements. The ER AUXILIARY SYSTEMS 9.5-19

supply headers from each loadless start device to the isolation check valve and the normally closed bypass valve at the skid-mounted accumulator are designed to Seismic Category I requirements.

The diesel generator skid-mounted starting air system piping and components are vendor supplied, safety-related, ANSI B31.1, Seismic Category I. All modifications to the skid-mounted starting air system piping are required to be performed to meet the intent of ASME Section III, Class 3 (TVA Class C).

.6.2 System Description Each diesel engine has two pairs of air starting motor units (hence, there are four pairs per diesel generator unit). A minimum of two pairs of air start motors are needed to start the diesel generator unit. A set of two skid-mounted air accumulators is provided for each diesel engine; four accumulators per diesel generator unit.

The accumulators are designed in accordance with the ASME Boiler and Pressure Vessel Code,Section VIII. Each set of accumulators is sized for a compressed air storage capacity sufficient to start the diesel generator unit five times without recharging. Each set of accumulators is equipped with pressure gauges, drains, shutoff valves, safety relief valves, check valves, instrumentation, and controls.

Two 480V ac motor-driven compressors supply compressed air to each of the two sets of accumulators for each diesel generator unit. Controls for the compressors have been designed for automatic start-stop operation. Manual test-start selector switches are also provided for each compressor. Pressure switches are provided on each air starting system for actuating low air pressure alarms both in the MCR and ACR (see Figure 9.5-25A, -25B, and -25C).

To prevent moisture and rust accumulation in the air starting system, a fully automatic heatless air dryer has been installed between the air compressor and the accumulators. The air dryer unit contains dual desiccant drying chambers which are alternately cycled through drying and regeneration cycles, a forced air after cooler, and associated cycle and fan controls. One chamber of the desiccant dryers is on stream at all times. Moisture traps are also located downstream of the dryers to collect any residual moisture. The two air storage systems for each diesel generator unit provide redundancy so that a single failure will not jeopardize the design starting capacity of the system.

0 OTHER AUXILIARY SYSTEMS

.6.3 Safety Evaluation All equipment necessary to start the diesels upon receipt of a start signal is Seismic Category I.

The diesel air start system is classified as quality group D. Section B of Regulatory Guide 1.26 discusses quality groups A through D and generally the types of equipment falling in each group. Section B also discusses systems and components not covered by groups A-D. Examples of these non-covered items are provided in Regulatory Guide 1.26 and include instrument and service air systems, auxiliary support systems and diesel engines. Part NA-1130,Section III of the ASME code states that drive system and other accessories are not part of the code. Regulatory Guide 1.26 states that non-covered items should be designed, fabricated, erected, and tested to quality standards commensurate with the safety functions performed. As a quality group D system, it is considered to meet quality standards commensurate with the safety function performed.

The piping for the air start system is designed to minimize rust accumulation in the system. Moisture is accumulated at the low points in the system and removed by administrative blowdown procedures. ASME Section III, Class 3 soft-seated check valves are provided downstream of the air accumulators. A strainer is also provided in the air start piping system upstream of the air start motors which prevents carry over of oil or rust, etc., to the motors. An oil mist type lubricator located in the air start system piping downstream of the line strainer and before the air start motors, provides lubrication for the motors. The typical arrangement for each engine is a strainer and lubricator for each pair of air start motors. The diesel starting air system is shown in Figures 9.5-25A, 25B, and 25C. A failure modes and effects analysis for the diesel generator starting air system is presented in Table 9.5-2.

.6.4 Tests and Inspections The entire diesel generator starting system is functionally tested in accordance with Chapter 14.0. The system is periodically tested to verify its ability to function as part of the diesel generator unit to satisfy the Technical Specification requirements. Under normal standby conditions, the diesel generator starting system is maintained and inspected at intervals as prescribed in the plant maintenance instructions for the diesel generator units.

.7 Diesel Engine Lubrication System

.7.1 Design Bases The diesel engine lubrication system for each diesel engine shown in Figure 9.5-26 (this figure depicts the diesel lube oil system for Diesel Generator 1A-A which is representative of the other three diesel generator sets), is a combination of four subsystems: the main lubricating subsystem, the piston cooling subsystem, and the scavenging oil subsystem and the motor-driven circulating pump, and soak back pump system.

ER AUXILIARY SYSTEMS 9.5-21

The main lubricating subsystem supplies oil under pressure to the various moving parts of the diesel engine. The piston cooling subsystem supplies oil for piston cooling and lubrication of the piston pin bearing surfaces. The scavenging oil subsystem supplies the other systems with cooled and filtered oil. Oil is drawn from the engine sump by the scavenging pump through a strainer in the strainer housing located on the front side of the engine. From the strainer the oil is pumped through oil filters and a cooler. The filters are located on the accessory racks of the engines. The oil is cooled in the lubricating oil cooler (as shown in Figure 9.5-27) by the closed circuit cooling water system in order to maintain proper oil temperature during engine operation.

During standby, the lube-oil temperature is maintained at 85°F or greater by the closed cooling-water system.

The required quality of oil is maintained by scheduled maintenance of strainers, separators, and filters and by oil changes in accordance with the engine manufacturer's owners group recommendation.

A crankcase pressure detector assembly is provided to cause the engine to shut down in case the normal negative crankcase pressure changes to a positive pressure. This is accomplished by relieving the oil pressure to the engine governor. The crankcase pressure detector shutdown device is operative only during diesel generator testing; see Section 8.3.1.1 under the heading, "Standby Diesel Generator Operation."

An overspeed mechanism is provided to shut down the engine by stopping the injection of fuel into the cylinders should the engine speed become excessive.

The piping and components for the skid-mounted diesel engine lubrication system are vendor supplied, safety-related, ANSI B31.1, Seismic Category I. All modifications to the skid-mounted diesel engine lubrication system are performed to meet the intent of ASME Section III, Class 3 (TVA Class C).

2 OTHER AUXILIARY SYSTEMS

.7.2 System Description The system is a combination of four separate systems. The four systems are the main lube oil system, piston cooling system, scavenging oil system, and the motor-driven circulating pump and soak-back pump system. Each system has its own pump. The main lube oil pump and piston cooling oil pump, although individual pumps, are both contained in one housing and are driven from a common shaft and are the helical gear type. The main lubricating, piston cooling, and scavenging oil pumps are driven from the accessory gear train at the front of the engine. The auxiliary system has a circulating oil pump and a soak-back oil pump driven from electric motors mounted on the side of engine base. All pumps are mounted on the engines, skid, or Diesel Generator Building floor.

The main lube oil system supplies oil under pressure to the majority of the engine moving parts. The piston cooling system supplies oil for piston cooling lubrication of the piston pin bearing. The scavenging oil system supplies the other systems with cooled, filtered oil.

In the operation of these systems, oil is drawn from the engine sump by the scavenging oil pump through a strainer in the strainer housing. From the strainer, the oil is pumped through the oil filter and the lube oil cooler. The cooler absorbs heat from the jacket water to maintain proper operating temperature during standby operation. The oil then flows to the strainer housing to supply the main lubricating and piston cooling pumps.

After being pumped through the engine, the oil returns to the engine sump to be recirculated.

To enhance the reliability of and to minimize wear due to automatic fast starting, each DG has an auxiliary lube oil system driven by two electric motors. The motors drive two pumps, each of which has a separate function. A soak-back pump draws oil from the engine sump and pumps it through the accessory rack-mounted auxiliary turbocharger lube oil filter and through the head of the engine-mounted turbocharger oil filter into the turbocharger bearing area. The auxiliary turbocharger oil filter purifies the oil supplied to the turbocharger. A relief valve allows oil to be bypassed to the circulating pump system when the outlet pressure exceeds 75 psig.

The soak-back system has a two-fold job. It prelubes the turbocharger bearing area so that the bearing will be fully lubricated when the engine receives a start signal requiring rated speed and application of rated load within a matter of seconds. It also removes residual heat from the turbocharger bearing area upon engine shutdown.

ER AUXILIARY SYSTEMS 9.5-23

The lube oil circulating pump draws oil from the engine sump and pumps it through a check valve, in-line wye strainer, main lube oil filter, lube oil cooler, and returns it to the engine sump through the strainer housing.

This system also serves to continuously prelube the lower portion of the engine. The main engine oil galley stays full and the camshaft area is supplied through a separate exterior line. The pump operates continuously.

The water jacket immersion heater heats the engine cooling water which circulates through the lube oil cooler. As the oil is circulated through the cooler (operating as a heater) it is warmed.

A backup DC lube oil pump provides lube oil to the turbocharger in case the AC pump fails.

Low lube oil pressure alarms are located in the MCR and in the ACR. Lube oil low alarm pressure varies with engine operating conditions.At rated speed, the engine shuts down if lube oil pressure drops below setpoint during non-accident conditions.

There are no other interlocks on this system.

4 OTHER AUXILIARY SYSTEMS

.7.3 Safety Evaluation Each engine crankcase sump contains a sufficient volume of lubricating oil, ample for at least 7 days of diesel generator unit full' load operation without requiring replenishment. The established oil consumption rate is 0.83 gallons per hour. An additional standby oil reserve is stored within the plant's power stores to replenish the engines for longer periods of operation and to "top off" the engines after their periodic test operations as specified in the Technical Specifications. A failure modes and effects analysis for the diesel generator lube oil system is presented in Table 9.5-2.

.7.4 Test and Inspections The diesel generator lubricating oil system is functionally tested in accordance with Chapter 14.0. The diesel generator lubricating oil system components are inspected and serviced as specified in the scheduled maintenance program for the Watts Bar diesel generator units. The inspection and service of the lubricating oil systems include visual checking for, and the correction of, oil leakage. This program sets overall standards and testing instructions to qualify the lubricating oil for use in the diesel generator engines.

.8 Diesel Generator Combustion Air Intake and Exhaust System

.8.1 Design Bases Each diesel engine associated with each of the tandem diesel generator units is equipped with an independent combustion air intake and exhaust subsystem. The four subsystems for the plant are housed in physically separated rooms within the Diesel Generator Building. Each of the four diesel generator subsystems has a dedicated air intake and exhaust system.The Diesel Generator Building is designed to Seismic Category I requirements, and is designed to withstand the effects of tornadoes, credible missiles, hurricanes, floods, rain, snow, and ice as defined in Sections 3.3, 3.4, and 3.5. The combustion air intake and exhaust piping, filters, and silencers are so arranged in the individual rooms for each diesel generator unit that a malfunction or failure of any system component associated with any single unit will not impair the operation of the remaining three units. The air intake and exhaust systems thus meets the requirements of the single failure criterion. The piping and components for the diesel generator combustion air intake and exhaust system are designed in accordance with ANSI B31.1, Seismic Category I.

.8.2 System Descriptions The general arrangement of the diesel generator combustion air intake and exhaust systems is shown in Figure 8.3-1. The flow diagrams are shown in Figures 9.5-29 and 9.5-30. Each diesel generator combustion intake and exhaust subsystem includes but not limited to an air intake filter, air intake silencers, and piping of the air intake subsystem from the air intake to its connection to the engine; and an exhaust silencer and piping of the exhaust subsystem from its connection to the engine to a point just above the Diesel Generator Building roof level where the exhaust exits to the atmosphere. As shown in Figure 8.3-1, the major components of the diesel generator combustion air and exhaust system are housed within the Diesel Generator Building ER AUXILIARY SYSTEMS 9.5-25

which provides protection from missiles, snow, and ice. That portion of the exhaust subsystems exposed above the roof level is short and below the parapet level to reduce the vulnerability to tornado missiles. Drain holes are provided at appropriate points to expel any rainfall that enters the exhaust piping.

.8.3 Safety Evaluation The diesel generator combustion air intake and exhaust systems are designed to function before, during, and after a SSE, to ensure that a seismic event will not degrade the combustion air intake and exhaust systems to the point that the function of a diesel generator unit is jeopardized.

An analysis of diesel generator exhaust recirculation utilizing a model developed by Halitsky[1] for transverse jet plumes, established that the exhaust plume will be carried well above the level of the air intakes and thus will not degrade the intake air. The diesel generator units can withstand a concentration of 20% carbon dioxide (by volume) in the intake air stream and continue to function at rated, full-load power. The redundancy and separation of the four intake and exhaust subsystems are discussed in Section 9.5.8.1. The protection against missiles, snow, rainfall, and ice are discussed in Section 9.5.8.2.

A failure modes and effects analysis for the Diesel Generator Building ventilation intake and exhaust subsystems is presented in Table 9.4-4. A failure modes and effects analysis for the diesel generator combustion air intake and exhaust systems is presented in Table 9.5-2.

6 OTHER AUXILIARY SYSTEMS

.8.4 Tests and Inspection After installation the entire diesel generator combustion air intake and exhaust system is functionally tested on the plant site in accordance with Chapter 14.0.

Each diesel generator combustion air intake and exhaust subsystem is periodically tested to verify its ability to function as part of the diesel generator unit testing in accordance with Technical Specifications.

Under normal standby conditions, the diesel generator combustion air intake subsystem is inspected at intervals as prescribed in the plant maintenance instructions for the diesel generator units. These inspections include the air intake filter oil level, oil viscosity, and sludge accumulation.

The diesel generator combustion air exhaust silencer has a continuous drain to remove any water which may accumulate due to condensation or rain.

REFERENCE (1) James Halitzky, 'A Method for Estimating Concentrations in Transverse Jet Plunes.' Air and Water Pollution Int. J., Pergamon Press. 1966, Vol. 10, pp.

821-843 (2) Letter to NRC dated February 5, 1992, "Watts Bar Nuclear Plant (WBN) -

Submittal of TVA Fire Protection Report."

(3) Letter to NRC dated June 15, 1995, "Watts Bar Nuclear Plant (WBN) - Fire Protection Report (FPR) Revision (TAC M63648)."

(4) Letter to NRC dated September 28, 1995, "Watts Bar Nuclear Plant (WBN) -

Submittal of Fire Protection Report (FPR) Revision 4 (TAC M63648)."

(5) Letter to NRC dated October 1995, "Watts Bar Nuclear Plant (WBN) -

Submittal of Fire Protection Report (FPR) Revision 5 (TAC M63648)"

ER AUXILIARY SYSTEMS 9.5-27

Table 9.5-1 Deleted by Amendment 52 8 OTHER AUXILIARY SYSTEMS

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS Fuel oil system Forward fuel to Delivers insufficient Passive failures such Control room None: None 1. Fuel oil systems of each diesel generator from 7-day tank injectors of respective quantity of fuel to as tank ruptures or indication of Remaining set are completely independent of each forward to engine engines. engines. piping leaks, clogging failure of diesel three diesel other.

on any one of four of strainers or generator set to generators diesel generator injectors. See Note 2 start or shuts furnish 100% 2. Due to redundant pumps and valving sets in standby in Remarks. down. standby power arrangements within each DG FO system, service. required by single active failures that disable the system Also, failure of plant. are not credible.

instrumentation to provide proper signal to pumps and controls.

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS Starting air system Crank engine to start Either one of two sets Active failure of any Control room None; None Each one of two engines in a diesel from diesel diesel generator set. of cranking systems one pneumatic valve indication of Duplicate air generator set includes a cranking system generator skid- fails to crank engines. or air start motor that failure of diesel start system on independent of its mate or of the other mounted air would prevent all four generator to other engine in diesel generator sets.

accumulator inlet air motors of one of start. the diesel check valve two engines to generator set is forward to the air engage and crank capable of starting motors on diesel generator set, providing 100%

any one of eight or passive failure due cranking power engines in standby to leakage of air from for both service. the accumulator or engines in the piping in one of the diesel two cranking generator set.

systems.

Also, failure of instrumentation to provide start signal or failure providing a false signal.

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS Lube oil system of Lubricate engine Insufficient lube oil Failure of any one Control room None; None Lube oil system of each individual engine is any one of eight wearing surfaces and flow or oil temperature pump or passive indication of Remaining separate and independent of all others.

engines in standby maintain proper exceeds limits. failure such as shutdown of three diesel service. piston temperature of system leakage or affected diesel generator sets respective engine. filter clogging. generator set. are capable of furnishing 100% of the required plant standby power.

None; Remaining Provide cooling for Control room three diesel Jacket cooling lube oil coolers, Fails to maintain Active failure of indication of generator sets Jacket cooling water system of each water system and cylinder liner and correct engine either pump, high engine are capable of None individual engine is separate and heat exchanger of heads and temperature. thermostatic control coolant furnishing independent of all others.

any one of eight turbocharger valve or immersion temperature in 100% standby engines in standby aftercoolers of water heater, or affected engine power required service. respective engine. passive failure of requiring by plant.

piping or heat shutdown of exchanger pressure diesel generator boundary. set.

WBNP-87

TTS BAR METHOD OF COMPONENT FAILURE POTENTIAL FAILURE EFFECT ON EFFECT IDENTIFICATION FUNCTION MODE CAUSE DETECTION SYSTEM ON PLANT REMARKS Combustion air Direct filtered air to Insufficient or Passive failure of Control room None; None Combustion air intake system of each intake system from turbocharger. unfiltered air flow to either filter silencer or indication of Remaining individual engine is separate and intake filter through respective engine. flexible connection engine three diesel independent of all others.

silencer and flexible that would either misfunction or generator sets connection up to restrict air flow or shut down. are capable of turbocharger inlet induct unfiltered air furnishing on any one of eight into engine. 100% of engines in standby standby power service. required by plant.

Exhaust system from turbocharger Passive failure of None; through expansion Restricts flow. silencer. Remaining joint and silencer Provide path for Control room three diesel on any one of eight exhaust. indication of generator sets None Exhaust system on each individual engine is engines in service. engine are capable of separate and independent of all others.

malfunction or furnishing shut down. 100% of standby power required by plant.

WBNP-87

WATTS BAR WBNP-87 Figure 9.5-1 Deleted by Amendment 87 Other Auxiliary Systems 9.5-33

WATTS BAR WBNP-87 Figure 9.5-2 Deleted by Amendment 87 Other Auxiliary Systems 9.5-34

WATTS BAR WBNP-87 Figure 9.5-3 Deleted by Amendment 87 Other Auxiliary Systems 9.5-35

WATTS BAR WBNP-87 Figure 9.5-4 Deleted by Amendment 87 Other Auxiliary Systems 9.5-36

WATTS BAR WBNP-87 Figure 9.5-5 Deleted by Amendment 87 Other Auxiliary Systems 9.5-37

WATTS BAR WBNP-87 Figure 9.5-6 Deleted by Amendment 87 Other Auxiliary Systems 9.5-38

WATTS BAR WBNP-87 Figure 9.5-7 Deleted by Amendment 87 Other Auxiliary Systems 9.5-39

WATTS BAR WBNP-87 Figure 9.5-8 Deleted by Amendment 87 Other Auxiliary Systems 9.5-40

WATTS BAR WBNP-87 Figure 9.5-9 Deleted by Amendment 87 Other Auxiliary Systems 9.5-41

WATTS BAR WBNP-87 Figure 9.5-10 Deleted by Amendment 87 Other Auxiliary Systems 9.5-42

WATTS BAR WBNP-87 Figure 9.5-11 Deleted by Amendment 87 Other Auxiliary Systems 9.5-43

WATTS BAR WBNP-87 Figure 9.5-12 Deleted by Amendment 87 Other Auxiliary Systems 9.5-44

WATTS BAR WBNP-87 Figure 9.5-13 Deleted by Amendment 87 Other Auxiliary Systems 9.5-45

WATTS BAR WBNP-87 Figure 9.5-14 Deleted by Amendment 87 Other Auxiliary Systems 9.5-46

WATTS BAR WBNP-87 Figure 9.5-15 Deleted by Amendment 87 Other Auxiliary Systems 9.5-47

Security Information Withheld under 10CFR 2.390(d)(1)

WATTS BAR WBNP-87

[e5]

Figure 9.5-16 Watts Bar Nuclear Plant - Plant-to-Offsite Communications SECURITY SENSITIVE

[s5]

Other Auxiliary Systems 9.5-48

Security Information Withheld under 10CFR 2.390(d)(1)

WATTS BAR WBNP-90

[e5]

SECURITY SENSITIVE Figure 9.5-17 Watts Bar Nuclear Plant - Intraplant Communications

[s5]

Other Auxiliary Systems 9.5-49

WATTS BAR WBNP-90 Figure 9.5-18 Deleted Other Auxiliary Systems 9.5-50

WATTS BAR Other Auxiliary Systems Figure 9.5-19 Watts Bar Nuclear Plant-Communications Equipment Availability WBNP-63 9.5-51

WATTS BAR Other Auxiliary Systems Figure 9.5-20 Yard, Powerhouse, and Diesel Generator Building Units 1 & 2 Flow Diagram Fuel Oil Atomizing Air & Steam WBNP-89 9.5-52

WATTS BAR Other Auxiliary Systems Figure 9.5-20a Additional Dsl Gen Bldg Units 1 & 2 Flow Diagram Fuel Oil Atomizing Air & Steam WBNP-89 9.5-53

WATTS BAR Other Auxiliary Systems Figure 9.5-20b Diesel Generator Building Unit 2 Flow Diagram Fuel Oil Atomizing Air & Steam WBNP-89 9.5-54

WATTS BAR Other Auxiliary Systems Figure 9.5-21 Powerhouse Units 1 & 2 Electrical Control Diagram for Fuel Oil System WBNP-89 9.5-55

WATTS BAR Other Auxiliary Systems WBNP-89 Figure 9.5-22 Powerhouse Units 1 & 2 Electrical Logic Diagram for Fuel Oil System 9.5-56

WATTS BAR Other Auxiliary Systems Figure 9.5-23 Schematic Diagram -Jacket Water System With Heat Exchanger WBNP-70 9.5-57

WATTS BAR Other Auxiliary Systems Figure 9.5-24 Diesel Generator Building Unit 1 Flow Diagram for Diesel Starting Air System WBNP-89 9.5-58

WATTS BAR Other Auxiliary Systems Figure 9.5-24a Additional Diesel Gen Bldg Unit 1 & 2 Flow Diagram Diesel Starting Air System WBNP-89 9.5-59

WATTS BAR WBNP-88 Figure 9.5-25 Deleted by Amendment 88 Other Auxiliary Systems 9.5-60

WATTS BAR Other Auxiliary Systems Figure 9.5-25a Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG 1B-B WBNP-88 9.5-61

WATTS BAR Other Auxiliary Systems Figure 9.5-25b Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG 2A-A WBNP-88 9.5-62

WATTS BAR Other Auxiliary Systems Figure 9.5-25c Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG 2B-B WBNP-88 9.5-63

WATTS BAR Other Auxiliary Systems WBNP-88 Figure 9.5-25d Diesel Generator Building Unit 1 Electrical Control Diagram Dsl Stg Air Sys DG OC-S 9.5-64

WATTS BAR Other Auxiliary Systems WBNP-57 Figure 9.5-26 Schematic Diagram Lube Oil System 9.5-65

WATTS BAR Other Auxiliary Systems Figure 9.5-27 Diesel Engine Lubrication System WBNP-57 9.5-66

WATTS BAR WBNP-41 Figure 9.5-28 Deleted by Amendment 41 Other Auxiliary Systems 9.5-67

WATTS BAR Other Auxiliary Systems Figure 9.5-29 Diesel Air Intake Piping Schematic WBNP-41 9.5-68

WATTS BAR Other Auxiliary Systems WBNP-41 9.5-69 Figure 9.5-30 Diesel Exhaust System Piping Schematic

WATTS BAR WBNP-87 Figure 9.5-31 Deleted by Amendment 87 Watts Bar FSAR Section 9.0 Auxiliary Systems Other Auxiliary Systems 9.5-70