ML14113A091

From kanterella
Jump to navigation Jump to search
Updated Final Safety Analysis Report, Revision 20, Chapter 7.0, Instrumentation and Control Systems
ML14113A091
Person / Time
Site: LaSalle  Constellation icon.png
Issue date: 04/11/2014
From:
Exelon Generation Co
To:
Office of Nuclear Material Safety and Safeguards, Office of Nuclear Reactor Regulation
Shared Package
ML14113A099 List:
References
RS-14-128
Download: ML14113A091 (642)
v • d • e


Text

{{#Wiki_filter:LSCS-UFSAR 7.0-i REV. 15, APRIL 2004 CHAPTER 7.0 - INSTRUMENTATION AND CONTROL SYSTEMS TABLE OF CONTENTS Page

7.0 Instrumentation

and Controls 7.1-1

7.1 Introduction

7.1-1 7.1.1 Identification of Safety-Related Systems 7.1-1

7.1.2 General

Description of Individual Systems 7.1-2 7.1.3 Independence of Redundant Safety-Related Systems 7.1-6 7.1.3.1 Mechanical Systems and Equipment 7.1-7 7.1.3.2 Electrical Systems and Equipment 7.1-7 7.1.3.3 Mechanical Systems Separation Criteria 7.1-8 7.1.3.3.1 General 7.1-8 7.1.3.3.2 System Separation Requirements 7.1-9 7.1.3.3.3 Physical Separation Requirements 7.1-10 7.1.3.4 Electrical Systems Separation Criteria 7.1-10 7.1.3.4.1 General 7.1-10 7.1.3.4.2 System Separation Requirements 7.1-12 7.1.3.4.2.1 Reactor Protection System (RPS) 7.1-12 7.1.3.4.2.2 Emergency Core Cooling System (ECCS) and Nuclear Steam Supply Shutoff System (NSSS) 7.1-13 7.1.3.4.3 Physical Separation Requirements 7.1-14 7.1.4 Physical Identification of Safety-Related Equipment 7.1-19 7.1.5 Conformance to IEEE Criteria 7.1-19

7.1.6 Conformance

to Regulatory Guides 7.1-19

7.2 Reactor

Protection System 7.2-1 7.2.1 Design Bases 7.2-1 7.2.1.1 Safety Design Bases 7.2-1 7.2.1.2 Power Generation Design Bases 7.2-3

7.2.2 System

Description 7.2-3 7.2.2.1 General 7.2-3 7.2.2.2 Power Sources 7.2-3 7.2.2.3 Logic 7.2-4 7.2.2.4 Initiating Signals and Circuits 7.2-5 7.2.2.4.1 Neutron Monitoring System Trip 7.2-5 7.2.2.4.2 Nuclear System High Pressure 7.2-6 7.2.2.4.3 Reactor Vessel Low Water Level 7.2-6 7.2.2.4.4 Turbine Stop Valve Closure 7.2-7 7.2.2.4.5 Turbine Control Valve Fast Closure 7.2-8 7.2.2.4.6 Main Steam Isolation Valve Closure 7.2-9 7.2.2.4.7 Scram Discharge Volume High Water Level 7.2-10 7.2.2.4.8 Drywell High Pressure 7.2-11

7.2.2.4.9 Deleted 7.2.2.4.10 CRD Low Charging Pressure 7.2-11 7.2.2.4.11 Manual Scram 7.2-12 7.2.2.4.12 MODE Switch in Shutdown 7.2-12 7.2.2.5 Scram Operating Bypasses 7.2-12 7.2.2.5.1 Neutron Monitoring System 7.2-12

LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-ii REV. 15, APRIL 2004 7.2.2.5.2 Turbine Stop Valve 7.2-13 7.2.2.5.3 Main Steam Isolation Valves 7.2-13 7.2.2.5.4 Scram Discharge Volume Level 7.2-13 7.2.2.5.5 CRD Low Charging Pressure 7.2-13 7.2.2.5.6 Mode Switch in Shutdown 7.2-13 7.2.2.6 Interlocks 7.2-13 7.2.2.7 Redundancy and Diversity 7.2-13 7.2.2.8 Actuated Devices 7.2-14 7.2.2.9 Separation 7.2-14 7.2.2.10 Testability 7.2-15

7.2.2.11 Environmental Considerations 7.2-16 7.2.2.12 Operational Considerations 7.2-17 7.2.2.13 Design Basis Information 7.2-18 7.2.2.14 Final System Drawings 7.2-19

7.2.3 Analysis

7.2-19 7.2.3.1 Conformance to Design Basis Requirements 7.2-19 7.2.3.2 Specific Requirements Conformance 7.2-23 7.2.3.3 Regulatory Guides 7.2-23 7.2.3.4 Regulatory Requirements 7.2-24

7.3 Engineered

Safety Feature Systems 7.3-1 7.3.1 Emergency Core Cooling Systems Instrumentation and Control 7.3-1 7.3.1.1 Design Bases 7.3-1 7.3.1.2 System Description 7.3-1 7.3.1.2.1 High-Pressure Core Spray (HPCS) Instrumentation and Controls 7.3-2 7.3.1.2.1.1 Power Sources 7.3-2 7.3.1.2.1.2 Equipment Design 7.3-2 7.3.1.2.1.3 Initiating Circuits 7.3-3 7.3.1.2.1.4 Logic and Sequencing 7.3-4 7.3.1.2.1.5 Bypasses and Interlocks 7.3-4 7.3.1.2.1.6 Redundancy and Diversity 7.3-5 7.3.1.2.1.7 Actuated Devices 7.3-5 7.3.1.2.1.8 Separation 7.3-5 7.3.1.2.1.9 Testability 7.3-6

7.3.1.2.1.10 Environmental Considerations 7.3-6 7.3.1.2.1.11 Operational Considerations 7.3-7 7.3.1.2.2 Automatic Depressurization System (ADS) Instrumentation and Controls 7.3-7 7.3.1.2.2.1 Equipment Design 7.3-7 7.3.1.2.2.2 Initiating Circuits 7.3-8 7.3.1.2.2.3 Logic and Sequencing 7.3-9 7.3.1.2.2.4 Bypasses and Interlocks 7.3-10 7.3.1.2.2.5 Redundancy/Diversity 7.3-10 7.3.1.2.2.6 Actuated Devices 7.3-10 7.3.1.2.2.7 Testability 7.3-11

7.3.1.2.2.8 Environmental Considerations 7.3-11 7.3.1.2.2.9 Operational Considerations 7.3-11 7.3.1.2.2.10 Low-Low Setpoint Relief Logic 7.3-12 7.3.1.2.2.11 Low-Low Setpoint Relief Logic Testability 7.3-13 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-iii REV. 13 7.3.1.2.3 Low-Pressure Core Spray (LPCS) Instrumentation and Controls 7.3-14 7.3.1.2.3.1 Equipment Design 7.3-14 7.3.1.2.3.2 Initiating Circuits 7.3-14 7.3.1.2.3.3 Logic and Sequencing 7.3-14 7.3.1.2.3.4 Bypasses and Interlocks 7.3-15

7.3.1.2.3.5 Redundancy and Diversity 7.3-15 7.3.1.2.3.6 Actuated Devices 7.3-15 7.3.1.2.3.7 Separation 7.3-16 7.3.1.2.3.8 Testability 7.3-16

7.3.1.2.3.9 Environmental Considerations 7.3-16 7.3.1.2.3.10 Operational Considerations 7.3-17 7.3.1.2.4 Low-Pressure Coolant Injection (LPCI) Instrumentation and Controls 7.3-17 7.3.1.2.4.1 Equipment Design 7.3-17 7.3.1.2.4.2 Initiating Circuits 7.3-18 7.3.1.2.4.3 Logic and Sequencing 7.3-18 7.3.1.2.4.4 Bypasses and Interlocks 7.3-19

7.3.1.2.4.5 Redundancy and Diversity 7.3-20 7.3.1.2.4.6 Actuated Devices 7.3-20 7.3.1.2.4.7 Separation 7.3-21 7.3.1.2.4.8 Testability 7.3-21

7.3.1.2.4.9 Environmental Considerations 7.3-21 7.3.1.2.4.10 Operational Considerations 7.3-22 7.3.1.2.5 Low-Pressure Systems Interlocks 7.3-23 7.3.1.2.6 Design-Basis Information 7.3-24 7.3.1.2.7 Final System Drawings 7.3-25 7.3.1.3 Analysis 7.3-25 7.3.1.3.1 General Functional Requirement Conformance 7.3-25 7.3.1.3.2 Specific Requirements Conformance 7.3-29 7.3.1.3.2.1 Regulatory Guides 7.3-29

7.3.1.3.2.2 1OCFR50 Appendix A 7.3-29 7.3.1.3.2.3 IEEE Criteria 7.3-29 7.3.2 Primary Containment and Reactor Vessel Isolation Control Instrumentation and Control 7.3-29 7.3.2.1 Design Bases 7.3-29 7.3.2.2 System Description 7.3-32 7.3.2.2.1 Power Sources 7.3-33 7.3.2.2.2 Equipment Design 7.3-33 7.3.2.2.3 Initiating Circuits 7.3-33 7.3.2.2.3.1 Reactor Vessel Low Water Level 7.3-35

7.3.2.2.3.2 Deleted 7.3.2.2.3.3 Main Steamline Space High Temperature and Differential Temperature 7.3-36 7.3.2.2.3.4 Main Steamline High Flow 7.3-37 7.3.2.2.3.5 Low Steam Pressure at Turbine Inlet 7.3-38 7.3.2.2.3.6 Drywell High Pressure 7.3-38 7.3.2.2.3.7 Reactor Building Ventilation Exhaust Plenum Monitor Subsystem 7.3-39 7.3.2.2.3.8 Reactor Water Cleanup System High Differential Flow 7.3-39 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-iv REV. 13 7.3.2.2.3.9 Reactor Water Cleanup System Area High Temperature and Differential Temperature 7.3-39 7.3.2.2.3.10 Deleted 7.3-39 7.3.2.2.3.11 Main Steamline Leak Detection Description 7.3-39 7.3.2.2.3.12 Turbine Condenser Vacuum Trip 7.3-40 7.3.2.2.3.13 Residual Heat Removal System High Flow 7.3-40 7.3.2.2.4 Logic 7.3-40 7.3.2.2.5 Bypasses and Interlocks 7.3-42 7.3.2.2.6 Redundancy and Diversity 7.3-42 7.3.2.2.7 Actuated Devices 7.3-42 7.3.2.2.8 Separation 7.3-42 7.3.2.2.9 Testability 7.3-43

7.3.2.2.10 Environmental Considerations 7.3-43 7.3.2.2.11 Operational Considerations 7.3-44 7.3.2.2.12 Design Basis Information 7.3-45 7.3.2.2.13 Final System Drawings 7.3-45 7.3.2.3 Analysis 7.3-45 7.3.2.3.1 General Functional Requirements Conformance 7.3-45 7.3.2.3.2 Specific Requirements Conformance 7.3-46 7.3.2.3.2.1 IEEE Criteria 7.3-46 7.3.2.3.2.1 Conformance to 10CFR50 Appendix A 7.3-46 7.3.2.3.2.3 Regulatory Guide Conformance 7.3-47 7.3.3 Core Standby Cooling System (CSCS) Equipment Cooling Water System (ECWS) Instrumentation and Controls 7.3-47 7.3.3.1 Safety Design Bases 7.3-47 7.3.3.2 Power Generation Design Bases 7.3-47 7.3.3.3 System Description 7.3-47 7.3.3.3.1 Instrumentation and Controls 7.3-47 7.3.3.3.2 Equipment Design and Logic 7.3-48

7.3.3.3.3 Environmental Considerations 7.3-48 7.3.3.3.4 Final System Drawings 7.3-48 7.3.4 Main Control Room and Auxiliary Electric Equipment (AEE) Room Heating, Ventilating and Air-Conditioning Systems Instrumentation and Controls 7.3-48 7.3.4.1 Safety Design Bases 7.3-49 7.3.4.2 Power-Generation Design Bases 7.3-50 7.3.4.3 System Description 7.3-50 7.3.4.3.1 Power Supply 7.3-51 7.3.4.3.2 Initiating Circuits, Logic, and Sequencing 7.3-51 7.3.4.3.3 Bypasses and Interlocks 7.3-52 7.3.4.3.4 Redundancy/Diversity 7.3-53 7.3.4.3.5 Actuated Devices 7.3-53 7.3.4.3.6 Separation 7.3-53 7.3.4.3.7 Testability 7.3-54

7.3.4.3.8 Environmental Considerations 7.3-54 7.3.4.3.9 Operational Considerations 7.3-54 7.3.4.3.10 Operating Bypasses 7.3-54 7.3.4.3.11 Outdoor Air Intake Radiation Protection Portion of the Control Room and Auxiliary Electric Equipment Room HVAC Systems 7.3-54 7.3.4.3.12 Deleted 7.3-55 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-v REV. 13 7.3.4.3.13 Ionization Detection Portion of Control Room and Auxiliary Electric Equipment Room HVAC Systems 7.3-55 7.3.4.3.14 Outdoor Air Intake Ammonia Protection Portion of Control Room and the Auxiliary Electric Equipment Room HVAC Systems 7.3-56 7.3.4.3.15 Final System Drawings 7.3-57 7.3.4.4 Analysis 7.3-57

7.3.5 Combustible

Gas Control System Instrumentation and Controls 7.3-57 7.3.5.1 Safety Design Bases 7.3-57 7.3.5.2 System Description 7.3-58 7.3.5.2.1 Power Sources 7.3-59 7.3.5.2.2 Initiating Circuits 7.3-59 7.3.5.2.3 Logic and Sequencing 7.3-59 7.3.5.2.4 Redundancy and Diversity 7.3-59 7.3.5.2.5 Actuated Devices 7.3-59 7.3.5.2.6 Separation 7.3-60 7.3.5.2.7 Testability 7.3-60

7.3.5.2.8 Environmental Considerations 7.3-60 7.3.5.2.9 Operational Considerations 7.3-60 7.3.5.2.10 Operating Bypasses 7.3-60 7.3.5.2.11 Final System Drawings 7.3-61

7.3.6 Standby

Power System Instrumentation and Controls 7.3-61 7.3.6.1 Design Basis 7.3-61 7.3.6.2 Description 7.3-61 7.3.6.3 Analysis 7.3-68

7.3.7 Reactor

Building Ventilation and Pressure Control System 7.3-69 7.3.7.1 Design Bases 7.3-69 7.3.7.2 Description 7.3-69 7.3.7.3 Analysis 7.3-69

7.3.8 Standby

Gas Treatment System Instrumentation and Controls 7.3-69 7.3.8.1 Design Bases 7.3-69 7.3.8.2 System Description 7.3-70 7.3.8.2.1 Power Sources 7.3-71 7.3.8.2.2 Initiating Circuits, Logic, and Sequencing 7.3-71 7.3.8.2.3 Bypasses and Interlocks 7.3-72 7.3.8.2.4 Redundancy and Diversity 7.3-73 7.3.8.2.5 Actuated Devices 7.3-73 7.3.8.2.6 Separation 7.3-73 7.3.8.2.7 Testability 7.3-73

7.3.8.2.8 Environmental Considerations 7.3-73 7.3.8.2.9 Operational Considerations 7.3-73 7.3.8.2.10 Operating Bypasses 7.3-74 7.3.8.2.11 Final System Drawings 7.3-74 7.3.8.3 Analysis 7.3-74 7.3.9 RHR/Containment Spray Cooling System Instrumentation and Controls 7.3-75 7.3.9.1 System Description 7.3-75 7.3.9.1.1 Power Sources 7.3-75 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-vi REV. 13 7.3.9.1.2 Equipment Design 7.3-76 7.3.9.1.3 Initiating Circuits 7.3-76 7.3.9.1.4 Logic and Sequencing 7.3-77 7.3.9.1.5 Bypasses and Interlocks 7.3-77 7.3.9.1.6 Redundancy and Diversity 7.3-77 7.3.9.1.7 Actuated Devices 7.3-77 7.3.9.1.8 Electrical Separation 7.3-77 7.3.9.1.9 Testability 7.3-77

7.3.9.1.10 Environmental Considerations 7.3-78 7.3.9.1.11 Operational Considerations 7.3-78 7.3.9.1.11.1 General Information 7.3-78 7.3.9.1.11.2 Reactor Operator Information 7.3-78 7.3.9.1.11.3 Setpoints 7.3-78 7.3.9.2 Analysis 7.3-78 7.3.9.2.1 General Functional Requirement Conformance 7.3-78 7.3.9.2.2 Conformance to Industry Codes and Standards 7.3-78

7.4 Systems

Required for Safe Shutdown 7.4-1 7.4.1 Reactor Core Isolation Cooling System Instrumentation and Controls 7.4-1 7.4.1.1 Design Bases 7.4-1 7.4.1.2 System Description 7.4-1 7.4.1.2.1 Power Sources 7.4-2 7.4.1.2.2 Equipment Design 7.4-2 7.4.1.2.3 Initiating Circuits 7.4-3 7.4.1.2.3.1 Shutdown Initiation 7.4-3 7.4.1.2.4 Bypasses and Interlocks 7.4-4 7.4.1.2.5 Redundancy 7.4-5 7.4.1.2.6 Actuated Devices 7.4-5 7.4.1.2.7 Separation 7.4-7 7.4.1.2.8 Testability 7.4-7

7.4.1.2.9 Environmental Considerations 7.4-7 7.4.1.2.10 Operational Considerations 7.4-7 7.4.1.3 Analysis 7.4-9 7.4.1.3.1 General Functional Requirement Conformance 7.4-9 7.4.1.3.2 Specific Requirement Conformance 7.4-9 7.4.1.3.3 10CFR50 Appendix A 7.4-9 7.4.1.3.4 NRC Regulatory Guides 7.4-10

7.4.2 Standby

Liquid Control (SBLC) System Instrumentation and Controls 7.4-10 7.4.2.1 Design Bases 7.4-10 7.4.2.2 System Description 7.4-10 7.4.2.2.1 Power Sources 7.4-11 7.4.2.2.2 Initiating Circuits 7.4-11 7.4.2.2.3 Logic/Sequencing 7.4-11 7.4.2.2.4 Bypasses/Interlocks 7.4-11 7.4.2.2.5 Redundancy/Diversity 7.4-12 7.4.2.2.6 Actuated Devices 7.4-12 7.4.2.2.7 Testability 7.4-12

7.4.2.2.8 Environmental Considerations 7.4-12 7.4.2.2.9 Operational Considerations 7.4-12 7.4.2.3 Analysis 7.4-14 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-vii REV. 20, APRIL 2014

7.4.3 Reactor

Shutdown Cooling (RHR) Instrumentation and Controls 7.4-14 7.4.3.1 Design Bases 7.4-14 7.4.3.2 System Description 7.4-15 7.4.3.2.1 Equipment Design 7.4-15 7.4.3.2.2 Initiating Circuits 7.4-16 7.4.3.2.3 Bypasses/Interlocks 7.4-16 7.4.3.2.4 Redundancy 7.4-16 7.4.3.2.5 Actuated Devices 7.4-16 7.4.3.2.6 Separation 7.4-16 7.4.3.2.7 Testability 7.4-17

7.4.3.2.8 Environmental Considerations 7.4-17 7.4.3.2.9 Operational Considerations 7.4-17 7.4.3.3 Analysis 7.4-17

7.4.4 Shutdown

Outside the Control Room 7.4-18 7.4.4.1 Conditions Assumed to Exist as the Main Control Room Becomes Inaccessible 7.4-18 7.4.4.2 Description 7.4-19 7.4.4.3 Procedure for Reactor Shutdown from Outside the Control Room 7.4-19 7.4.4.4 Analysis 7.4-21 7.5 Safety-Related Display Instrumentation 7.5-1 7.5.1 General 7.5-1 7.5.2 Post Accident Tracking 7.5-1 7.5.2.1 Reactor and Primary Containment Process Instrumentation 7.5-2 7.5.2.1.1 Reactor Water Level 7.5-2 7.5.2.1.2 Reactor Pressure 7.5-2 7.5.2.1.3 Containment Pressure 7.5-2 7.5.2.1.4 Suppression Pool Water Level 7.5-3 7.5.2.1.5 Containment Temperature 7.5-3 7.5.2.2 Post-Accident Primary Containment Atmosphere Monitoring System Instrumentation and Controls 7.5-4 7.5.2.2.1 Design Bases 7.5-4 7.5.2.2.2 Description 7.5-6 7.5.2.2.2.1 Drywell Hydrogen and Oxygen Monitoring Subsystem 7.5-6 7.5.2.2.2.2 Drywell Gross Gamma Monitoring 7.5-8 7.5.2.3 Primary Containment Integrity 7.5-9 7.5.3 Shutdown, Isolation, and Core Cooling Indication 7.5-9

7.5.4 Analysis

7.5-11 7.5.4.1 General 7.5-11 7.5.4.2 Accident Conditions 7.5-12

7.6 Other

Instrumentation Required For Safety 7.6-1 7.6.1 Process Radiation Monitoring System Instrumentation and Controls 7.6-1 7.6.1.1 Main Steamline Radiation Monitoring Subsystem 7.6-1 7.6.1.2 Reactor Building Vent Exhaust Plenum Radiation Monitoring Subsystem 7.6-2 7.6.1.2.1 Design Bases 7.6-2 7.6.1.2.1.1 Safety Design Bases 7.6-2 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-viii REV. 15, APRIL 2004 7.6.1.2.1.2 Power Generation Design Bases 7.6-2 7.6.1.2.2 System Description 7.6-2 7.6.1.2.3 Analysis 7.6-3 7.6.1.2.3.1 General Functional Requirement Conformance 7.6-3 7.6.1.2.3.2 Specific Requirement Conformance 7.6-4 7.6.1.2.3.3 Regulatory Guides 7.6-4 7.6.1.2.3.4 10CFR50 Appendix A 7.6-4 7.6.1.3 Fuel Pool Ventilation Exhaust Plenum Radiation Monitoring Subsystem 7.6-5 7.6.1.3.1 Design Bases 7.6-5 7.6.1.3.1.1 Safety Design Bases 7.6-5 7.6.1.3.1.2 Power Generation Design Bases 7.6-5 7.6.1.3.2 Description 7.6-5 7.6.1.3.3 Analysis 7.6-6

7.6.2 Reactor

Coolant Pressure Boundary Leakage Detection 7.6-6 7.6.2.1 Design Bases 7.6-6 7.6.2.1.1 Safety Design Bases 7.6-6 7.6.2.1.2 Power Generation Design Basis 7.6-6 7.6.2.2 General System Description 7.6-6 7.6.2.2.1 Power Sources 7.6-7 7.6.2.2.2 Equipment Design 7.6-7 7.6.2.2.3 Main Steamline Leak Detection 7.6-7 7.6.2.2.4 RCIC System Leak Detection 7.6-9 7.6.2.2.5 RHR System Leak Detection 7.6-10 7.6.2.2.6 Reactor Water Cleanup System Leak Detection 7.6-11 7.6.2.2.7 Testability 7.6-12 7.6.2.2.8 Environmental Considerations 7.6-13 7.6.2.3 Analysis 7.6-13 7.6.2.3.1 General Functional Requirement Conformance 7.6-13 7.6.2.3.2 Specific Requirement Conformance 7.6-14 7.6.2.3.3 Regulatory Guides 7.6-14 7.6.2.3.4 10CFR50 Appendix A 7.6-14

7.6.3 Neutron

Monitoring System Instrumentation and Controls 7.6-15 7.6.3.1 General System Description 7.6-15 7.6.3.1.1 Power Source 7.6-16 7.6.3.2 Intermediate Range Monitor Subsystem 7.6-16 7.6.3.2.1 Design Bases 7.6-16 7.6.3.2.1.1 Safety Design Bases 7.6-16 7.6.3.2.1.2 Power Generation Design Bases 7.6-16 7.6.3.2.2 System Description 7.6-17 7.6.3.2.3 Analysis 7.6-19 7.6.3.2.3.1 General Functional Requirement Conformance 7.6-19 7.6.3.2.3.2 Specific Requirement Conformance 7.6-20 7.6.3.2.3.3 Regulatory Guides 7.6-20 7.6.3.2.3.4 10CFR50 Appendix A 7.6-20 7.6.3.3 Average Power Range Monitor Subsystem 7.6-20 7.6.3.3.1 Design Bases 7.6-20 7.6.3.3.1.1 Safety Design Bases 7.6-20 7.6.3.3.1.2 Power Generation Design Bases 7.6-21 7.6.3.3.2 System Description 7.6-21 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-ix REV. 19, APRIL 2012 7.6.3.3.3 Analysis 7.6-23 7.6.3.3.3.1 General Functional Requirement Conformance 7.6-23 7.6.3.3.3.2 Specific Requirement Conformance 7.6-23 7.6.3.3.3.3 Compliance with 10CFR50 Criteria 13,19,20,21,22, 23, 24, and 29 7.6-24 7.6.3.4 Oscillation Power Range Monitor Subsystem 7.6-24 7.6.3.4.1 Design Basis 7.6-24 7.6.3.4.1.1 Safety Design Basis 7.6-24 7.6.3.4.1.2 Power Generation Design Basis 7.6-26 7.6.3.4.2 System Description 7.6-26 7.6.3.4.3 Analysis 7.6-29 7.6.3.4.3.1 Conformance to Functional Requirements 7.6-29 7.6.3.4.3.2 Regulatory Guides 7.6-29 7.6.3.4.3.3 General Design Criteria 7.6-29

7.6.4 Recirculation

Pump Trip 7.6-29 7.6.4.1 System Description 7.6-29 7.6.4.2 Analysis 7.6-29 7.6.4.2.1 General Functional Requirements Conformance 7.6-29 7.6.4.2.2 Specific Requirement Conformance 7.6-30 7.6.4.2.3 Regulatory Guides 7.6-30

7.6.5 Alternate

Rod Insertion (ARI) System Controls and Instrumentation 7.6-30 7.6.5.1 Safety Design Bases 7.6-31 7.6.5.2 Equipment Design 7.6-33 7.6.5.3 Theory of Operation 7.6-34 7.6.5.4 Alternate Rod Insertion System Operator Information 7.6-34 7.6.5.5 Power Supply 7.6-35 7.6.5.6 Cabling and Wiring 7.6-35 7.6.5.7 Testability 7.6-35 7.6.5.8 Redundancy and Diversity 7.6-36 7.6.5.9 Environment Considerations 7.6-36

7.6.6 References

7.6-36

7.7 Control

Systems Not Required for Safety 7.7-1 7.7.1 Reactor Vessel Power Generation Instrumentation and Controls 7.7-2 7.7.1.1 Design Basis 7.7-2 7.7.1.2 System Description 7.7-3 7.7.1.2.1 Power Sources 7.7-3 7.7.1.2.2 Equipment Design 7.7-3

7.7.1.2.3 Environmental Considerations 7.7-7 7.7.1.2.4 Operational Considerations 7.7-7 7.7.1.3 Analysis 7.7-9 7.7.2 Rod Control Management System 7.7-9 7.7.2.1 Design Bases 7.7-9 7.7.2.1.1 General 7.7-9 7.7.2.1.2 DELETED 7.7-10 7.7.2.2 System Description 7.7-10 7.7.2.2.1 General 7.7-10 7.7.2.2.2 Rod Movement Controls Systems 7.7-11 7.7.2.2.2.1 Rod Drive Control System 7.7-11 7.7.2.2.2.2 Control Rod Drive Hydraulic System Control 7.7-14 7.7.2.2.2.3 Rod Position Information System 7.7-15 7.7.2.2.2.4 Power Supplies 7.7-17 7.7.2.2.2.5 Inspection and Testing 7.7-17

7.7.2.2.2.6 Environmental Considerations 7.7-17 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-x REV. 19, APRIL 2012 7.7.2.2.2.7 Operational Considerations 7.7-18 7.7.2.2.3 Rod Block Trip Instrumentation and Control System 7.7-19 7.7.2.2.3.1 Power Supply 7.7-19 7.7.2.2.3.2 Grouping of Channels 7.7-19 7.7.2.2.3.3 Rod Block Functions 7.7-20 7.7.2.2.3.4 Rod Block Bypasses 7.7-24 7.7.2.2.3.5 Rod Block Interlocks 7.7-25 7.7.2.2.3.6 Redundancy 7.7-25 7.7.2.2.4 DELETED 7.7-25 7.7.2.2.4.1 DELETED 7.7-25 7.7.2.2.4.2 DELETED 7.7-25 7.7.2.2.4.3 DELETED 7.7-25 7.7.2.2.4.4 DELETED 7.7-25 7.7.2.2.4.5 DELETED 7.7-25 7.7.2.3 Analysis 7.7-25 7.7.2.3.1 Rod Movement Controls 7.7-25 7.7.2.3.1.1 General Functional Requirement Conformance 7.7-26 7.7.2.3.1.2 Specific Requirements 7.7-27 7.7.2.3.2 DELETED 7.7-27 7.7.2.3.2.1 DELETED 7.7-27 7.7.2.3.2.2 DELETED 7.7-27

7.7.3 Recirculation

Flow Control System Instrumentation 7.7-27 7.7.3.1 Design Bases 7.7-27 7.7.3.1.1 Safety Design Basis 7.7-27 7.7.3.1.2 Power Generation Design Bases 7.7-27 7.7.3.2 Description 7.7-28 7.7.3.2.1 Power Sources 7.7-28 7.7.3.2.2 Equipment Design 7.7-28

7.7.3.2.3 Environmental Considerations 7.7-33 7.7.3.2.4 Operational Considerations 7.7-33 7.7.3.3 Analysis 7.7-35 7.7.3.3.1 General Functional Requirement Conformance 7.7-35 7.7.3.3.2 DELETED 7.7-36 7.7.4 Feedwater Control System Instrumentation and Controls 7.7-36 7.7.4.1 Design Bases 7.7-36 7.7.4.2 System Description 7.7-36 7.7.4.2.1 Power Sources 7.7-38 7.7.4.2.2 Equipment Design 7.7-38

7.7.4.2.3 Environmental Considerations 7.7-41 7.7.4.2.4 Operational Considerations 7.7-41 7.7.4.3 Analysis 7.7-41 7.7.4.3.1 General Functional Requirement Conformance 7.7-41 7.7.4.3.2 Specific Regulatory Requirement Conformance 7.7-42 7.7.5 Pressure Regulator and Turbine-Generator Instrumentation and Control 7.7-42 7.7.5.1 Power Generation Design Bases 7.7-42 7.7.5.2 System Description 7.7-43 7.7.5.2.1 Power Sources 7.7-43 7.7.5.2.2 Equipment Design 7.7-44 7.7.5.2.3 Environmental Considerations 7.7-47 7.7.5.2.4 Operational Considerations 7.7-47 7.7.5.3 Analysis 7.7-47 7.7.5.3.1 Power Generation Design Base Conformance 7.7-48 7.7.5.3.2 Specific Requirement Conformance 7.7-48 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-xi REV. 15, APRIL 2004 7.7.6 Neutron Monitoring System Instrumentation and Controls 7.7-48 7.7.6.1 Source Range Monitor Subsystem 7.7-49 7.7.6.1.1 Design Bases 7.7-49 7.7.6.1.2 Description 7.7-50 7.7.6.1.3 Analysis 7.7-52 7.7.6.2 Local Power Range Monitor Subsystem 7.7-52 7.7.6.2.1 Design Bases 7.7-52 7.7.6.2.2 System Description 7.7-53 7.7.6.2.3 Analysis 7.7-56 7.7.6.3 Rod Block Monitor Subsystem 7.7-56 7.7.6.3.1 Design Bases 7.7-56 7.7.6.3.2 Description 7.7-57 7.7.6.3.3 Analysis 7.7-59 7.7.6.4 Traversing Incore Probe Subsystem 7.7-60 7.7.6.4.1 Design Bases 7.7-60 7.7.6.4.2 System Description 7.7-60 7.7.6.4.3 Analysis 7.7-61

7.7.7 Process

Computer System Instrumentation and Controls 7.7-62 7.7.7.1 Design Basis 7.7-62 7.7.7.1.1 Safety Design Bases 7.7-62 7.7.7.1.2 Power Generation Design Bases 7.7-62 7.7.7.2 System Description 7.7-62 7.7.7.2.1 Power Sources 7.7-63 7.7.7.2.2 Instrument Monitoring and Processing Equipment Design 7.7-63 7.7.7.2.3 Rod Worth Minimizer Equipment Design 7.7-64

7.7.7.2.4 Environmental Considerations 7.7-67 7.7.7.2.5 Reactor Calculations 7.7-67 7.7.7.3 Analysis 7.7-68

7.7.8 Reactor

Water Cleanup (RWCU) System Instrumentation and Controls 7.7-68 7.7.8.1 Design Bases 7.7-68 7.7.8.2 System Description 7.7-68 7.7.8.2.1 Power Sources 7.7-68 7.7.8.2.2 Equipment Design 7.7-68

7.7.8.2.3 Environmental Considerations 7.7-69 7.7.8.2.4 Operational Considerations 7.7-70 7.7.8.3 Analysis 7.7-70 7.7.9 Area Radiation Monitoring System Instrumentation 7.7-71 7.7.9.1 Design Basis 7.7-71 7.7.9.1.1 Safety Design Bases 7.7-71 7.7.9.1.2 Power Generation Design Bases 7.7-71 7.7.9.2 System Description 7.7-71 7.7.9.2.1 Power Sources 7.7-71 7.7.9.2.2 Equipment Design 7.7-71

7.7.9.2.3 Environmental Considerations 7.7-72 7.7.9.2.4 Operational Considerations 7.7-72 7.7.9.3 Analysis 7.7-73 7.7.10 Gaseous Radwaste System Instrumentation and Controls 7.7-73 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-xii REV. 19, APRIL 2012 7.7.10.1 Design Bases 7.7-73 7.7.10.2 System Description 7.7-73 7.7.10.2.1 Power Source 7.7-74 7.7.10.2.2 Equipment Design 7.7-74

7.7.10.2.3 Environmental Considerations 7.7-77 7.7.10.2.4 Operational Considerations 7.7-77 7.7.10.2.5 Setpoints 7.7-78 7.7.10.3 Analysis 7.7-78 7.7.11 Liquid Radwaste System Instrumentation and Control 7.7-78 7.7.11.1 Design Bases 7.7-78 7.7.11.2 System Description 7.7-78 7.7.11.2.1 Power Sources 7.7-79 7.7.11.2.2 Equipment Design 7.7-79

7.7.11.2.3 Environmental Considerations 7.7-80 7.7.11.2.4 Operational Considerations 7.7-80 7.7.11.3 Analysis 7.7-81 7.7.12 Spent Fuel Pool Cooling and Cleanup System Instrumentation and Controls 7.7-81 7.7.12.1 Design Bases 7.7-81 7.7.12.2 System Description 7.7-81 7.7.12.2.1 Power Sources 7.7-81 7.7.12.2.2 Equipment Design 7.7-82

7.7.12.2.3 Environmental Considerations 7.7-82 7.7.12.2.4 Operational Considerations 7.7-82 7.7.12.3 Analysis 7.7-82 7.7.13 Refueling Interlocks System Instrumentation and Controls 7.7-83 7.7.13.1 Design Bases 7.7-83 7.7.13.2 System Description 7.7-83 7.7.13.2.1 Power Sources 7.7-83 7.7.13.2.2 Equipment Design 7.7-84 7.7.13.2.3 Bypasses and Interlocks 7.7-85 7.7.13.2.4 Redundancy 7.7-85 7.7.13.2.5 Testability 7.7-85 7.7.13.2.6 Environmental Considerations 7.7-86 7.7.13.2.7 Operational Considerations 7.7-86 7.7.13.3 Analysis 7.7-86 7.7.13.3.1 Conformance to Functional Requirements 7.7-86 7.7.13.3.2 Specific Requirements Conformance 7.7-87 7.7.14 Process Radiation Monitoring System Instrumentation and Controls 7.7-87 7.7.14.1 Air Ejector Off-Gas Radiation Monitor and Sampler Subsystem 7.7-88 7.7.14.1.1 Design Bases 7.7-88 7.7.14.1.1.1 Safety Design Bases 7.7-88 7.7.14.1.1.2 Power Generation Design Bases 7.7-89 7.7.14.1.2 System Description 7.7-89 7.7.14.1.2.1 Power Sources 7.7-89 7.7.14.1.2.2 Equipment Design 7.7-90 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-xiii REV. 19, APRIL 2012 7.7.14.1.2.3 Testability 7.7-91 7.7.14.1.2.4 Environmental Considerations 7.7-91 7.7.14.1.2.5 Operational Considerations 7.7-91 7.7.14.1.3 Analysis 7.7-91 7.7.14.2 Stack Radiation Monitoring System 7.7-92 7.7.14.2.1 Design Bases 7.7-92 7.7.14.2.1.1 Safety Design Bases 7.7-92 7.7.14.2.1.2 Power Generation Design Bases 7.7-92 7.7.14.2.2 System Description 7.7-93 7.7.14.2.2.1 Power Sources 7.7-93 7.7.14.2.2.2 Equipment Design 7.7-93

7.7.14.2.2.3 Environmental Considerations 7.7-94 7.7.14.2.2.4 Operational Considerations 7.7-94 7.7.14.2.3 Analysis 7.7-94 7.7.14.3 Process Liquid Radiation Monitoring Subsystems 7.7-94 7.7.14.3.1 Design Bases 7.7-94 7.7.14.3.1.1 Safety Design Bases 7.7-94 7.7.14.3.1.2 Power Generation Design Basis 7.7-95 7.7.14.3.2 System Description 7.7-95 7.7.14.3.2.1 Power Sources 7.7-95 7.7.14.3.2.2 Equipment Design 7.7-95

7.7.14.3.2.3 Environmental Considerations 7.7-96 7.7.14.3.2.4 Operational Considerations 7.7-96 7.7.14.3.3 Analysis 7.7-96 7.7.14.4 Carbon Bed Vault Radiation Monitoring Subsystem 7.7-97 7.7.14.4.1 Design Bases 7.7-97 7.7.14.4.2 System Description 7.7-97 7.7.14.4.2.1 Power Sources 7.7-97 7.7.14.4.2.2 Equipment Design 7.7-97

7.7.14.4.2.3 Environmental Considerations 7.7-98 7.7.14.4.2.4 Operational Considerations 7.7-98 7.7.14.4.3 Analysis 7.7-98 7.7.14.5 Main Steam Radiation Monitoring Subsystem 7.7-98 7.7.14.5.1 Design Basis 7.7-98 7.7.14.5.2 Power Generation Design Basis 7.7-99 7.7.14.5.3 System Description 7.7-99 7.7.14.5.3.1 Subsystem Identification 7.7-99 7.7.14.5.3.2 Power Sources 7.7-99 7.7.14.5.3.3 Equipment Design 7.7-99

7.7.14.5.3.4 Redundancy and Diversity 7.7-100 7.7.14.5.3.5 Testability 7.7-100

7.7.14.5.3.6 Environmental Considerations 7.7-100 7.7.14.5.3.7 Operational Considerations 7.7-100 7.7.14.5.4 Analysis 7.7-100 7.7.15 Leak Detection System Instrumentation and Controls 7.7-100 7.7.15.1 Design Basis 7.7-100 7.7.15.2 System Description 7.7-101 7.7.15.2.1 Power Sources 7.7-101 7.7.15.2.2 Equipment Design 7.7-101 7.7.15.2.3 Recirculation Pump Leak Detection 7.7-102 7.7.15.2.4 Spent Fuel Pool System Leak Detection 7.7-103 7.7.15.2.5 Drywell and Reactor Building Leak Detection 7.7-103 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-xiv REV. 15, APRIL 2004 7.7.15.2.6 Safety/Relief Valve Leak Detection 7.7-104 7.7.15.2.7 Reactor Vessel Head Seal Ring Leak Detection 7.7-104 7.7.15.2.8 Sump Monitoring System 7.7-104 7.7.15.2.9 Testability 7.7-105 7.7.15.2.10 Environmental Considerations 7.7-106 7.7.15.3 Analysis 7.7-106 7.7.15.3.1 General Functional Requirement Conformance 7.7-106 7.7.15.3.2 Specific Requirement Conformance 7.7-106 7.7.16 Additional Analysis 7.7-107 7.7.17 References 7.7-108

7.8 Status

Displays 7.8-1 7.8.1 Engineered Safety Features Display 7.8-1

7.8.2 Safety

Parameter Display System 7.8-2 7.8.2.1 General 7.8-2 7.8.2.2 Description 7.8-3 7.8.2.2.1 Primary Display 7.8-3 7.8.2.2.2 Safety Parameters and Associated Displays 7.8-4 7.8.2.2.2.1 Core Cooling 7.8-4 7.8.2.2.2.2 Reactivity Control 7.8-5 7.8.2.2.2.3 Reactor Coolant System Integrity 7.8-6 7.8.2.2.2.4 Containment Integrity 7.8-8 7.8.2.2.2.5 Radioactive Effluents 7.8-9 7.8.2.3 Alarms and Messages 7.8-10 7.8.2.3.1 Audible Alarms 7.8-10 7.8.2.3.2 Error Messages 7.8-11

7.A Analysis of Conformance of Instrumentation and Control Systems with IEEE Criteria 7.A.1-1 7.A.1 Introduction 7.A.1-1 7.A.2 Reactor Protection System 7.A.2-1 7.A.2.1 Criteria for Protecting Systems for Nuclear Power Generating Stations (IEEE 279-1971) 7.A.2-1 7.A.2.1.1 Scram Discharge Volume High Water Level Scram 7.A.2-1 7.A.2.1.2 Main Steamline Isolation Valve Closure Scram Trip 7.A.2-5 7.A.2.1.3 Turbine Stop Valve Closure Scram 7.A.2-11 7.A.2.1.4 Turbine Control Valve Fast Closure Scram 7.A.2-16 7.A.2.1.5 Reactor Vessel Low Water Level Scram Trip 7.A.2-20 7.A.2.1.6 Main Steamline High Radiation Scram Trip (Deleted) 7.A.2-24 7.A.2.1.7 Neutron Monitoring System Scram Trip 7.A.2-24 7.A.2.1.8 Drywell High-Pressure Scram 7.A.2-29 7.A.2.1.9 Reactor Vessel High Pressure Scram 7.A.2-33 7.A.2.1.10 CRD Low Charging Pressure Scram 7.A.2-37 7.A.2.1.11 Manual Pushbutton Scram 7.A.2-40 7.A.2.1.12 Reactor System Mode Switch 7.A.2-43 7.A.2.1.13 Scram Discharge Volume High Water Level Trip Bypass 7.A.2-47 7.A.2.1.14 Main Steamline Isolation Valve Closure Trip Bypass 7.A.2-51 7.A.2.1.15 Turbine Stop Valve and Control Valve Trip Bypass 7.A.2-54 7.A.2.1.16 Neutron Monitoring System Trip Bypass 7.A.2-58 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-xv REV. 13 7.A.2.1.17 RPS Trip Logic, Trip Actuators, and Trip Actuator Logic 7.A.2-58 7.A.2.1.18 Reactor Protection System Reset Switch 7.A.2-62 7.A.2.1.19 Alternate Rod Insertion System 7.A.2-65 7.A.2.2 Criteria for Class 1E Electric Systems (IEEE 308-1971). 7.A.2-71 7.A.2.3 General Guide for Qualifying Class 1 Electric Equipment (IEEE 323-1971) 7.A.2-72 7.A.2.4 Periodic Testing of Protection Systems (IEEE 338-1971) 7.A.2-72 7.A.2.5 Seismic Qualification of Class 1 Electric Equipment (IEEE 344-1971) 7.A.2-72 7.A.2.6 Application of the Single-Failure Criterion to Nuclear Power Generating Station Protection Systems (IEEE 379-1972) 7.A.2-72

7.A.3 Engineered Safety Features Systems 7.A.3-1 7.A.3.1 Emergency Core Cooling Systems 7.A.3-1 7.A.3.1.1 IEEE 279-1971 Criteria for Protection Systems for Nuclear Power Generating Stations 7.A.3-1 7.A.3.1.1.1 LPCI 7.A.3-1 7.A.3.1.1.2 LPCS 7.A.3-10 7.A.3.1.1.3 Automatic Depressurization System (ADS) 7.A.3-18 7.A.3.1.1.4 High-Pressure Core Spray (HPCS) 7.A.3-27 7.A.3.1.2 IEEE 308-1971 (IEEE Standard Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations) 7.A.3-34 7.A.3.1.3 IEEE 323-1971 (Trial Use Standard: General Guide for Qualifying Class 1 Electric Equipment for Nuclear Power Generating Stations) 7.A.3-35 7.A.3.1.4 IEEE 338-1971 (Trial-Use Criteria for Periodic Testing of Nuclear Power Generating Station Protection Systems) 7.A.3-35 7.A.3.1.5 IEEE 344-1971 (Guide for Seismic Qualification of Class 1E Electrical Equipment of Nuclear Power Generating Stations) 7.A.3-35 7.A.3.1.6 IEEE 379-1972 7.A.3-35 7.A.3.2 Primary Containment and Reactor Vessel Isolation Instrumentation and Controls 7.A.3-35 7.A.3.2.1 Conformance to IEEE 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations 7.A.3-35 7.A.3.2.2 Conformance to IEEE 338-1971 7.A.3-45 7.A.3.2.3 Conformance to IEEE 344-1971 7.A.3-45 7.A.3.2.4 Conformance to IEEE 323-1971 7.A.3-45 7.A.3.2.5 Conformance to IEEE 379-1972 7.A.3-45 7.A.3.3 Main Control Room and Auxiliary Electric Equipment (AEE) Room Atmospheric Control Systems 7.A.3-45 7.A.3.3.1 Specific Conformance of the Instrumentation and Control to IEEE 279-1971 7.A.3-46 7.A.3.4 Containment Spray Cooling System-Instrumentation and Controls 7.A.3-48 7.A.3.4.1 IEEE 279-1971 7.A.3-48 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-xvi REV. 13 7.A.3.4.1.1 General Function al Requirement (IEEE 297-1971, Paragraph 4.1) 7.A.3-49 7.A.3.4.1.2 Single-Failure Criterion (IEEE 279-1971, Paragraph 4.2) 7.A.3-51 7.A.3.4.1.3 Quality Components (IEEE 279-1971, Paragraph 4.3) 7.A.3-52 7.A.3.4.1.4 Equipment Qu alification (IEEE 279-1971, Paragraph 4.4) 7.A.3-53 7.A.3.4.1.5 Channel Integrity (IEEE 279-1971, Paragraph 4.5) 7.A.3-53 7.A.3.4.1.6 Channel Independence (IEEE 279-1971, Paragraph 4.6) 7.A.3-53 7.A.3.4.1.7 Control and Protec tion Interaction (IEEE 279-1971, Paragraph 4.7) 7.A.3-53 7.A.3.4.1.8 Derivation of System Inputs (IEEE 279-1971, Paragraph 4.8) 7.A.3-54 7.A.3.4.1.9 Capability for Sensor Checks (IEEE 279-1971, Paragraph 4.9) 7.A.3-54 7.A.3.4.1.10 Capability for Test and Calibration (IEEE 279-1971, Paragraph 4.10) 7.A.3-54 7.A.3.4.1.11 Channel Bypass or Removal from Operation (IEEE 279-1971, Paragraph 4.11) 7.A.3-54 7.A.3.4.1.12 Operation Bypasses (IEEE 279-1971, Paragraph 4.12) 7.A.3-55 7.A.3.4.1.13 Indication of Bypasses (IEEE 279-1971, Paragraph 4.13) 7.A.3-55 7.A.3.4.1.14 Access to Means for Bypassing (IEEE 279-1971, Paragraph 4.14) 7.A.3-55 7.A.3.4.1.15 Multiple Tr ip Settings (IEEE 279-1971, Paragraph 4.15) 7.A.3-55 7.A.3.4.1.16 Completion of Protection Action Once It Is Initiated (IEEE 279-1971, Paragraph 4.16) 7.A.3-55 7.A.3.4.1.17 Manual Actuation (IEEE 279-1971, Paragraph 4.17) 7.A.3-56 7.A.3.4.1.18 Access to Setpo int Adjustment (IEEE 279-1971, Paragraph 4.18) 7.A.3-56 7.A.3.4.1.19 Identification of Protective Actions (IEEE 279-1971, Paragraph 4.19) 7.A.3-56 7.A.3.4.1.20 Informatio n Readout (IEEE 279-1971, Paragraph 4.20) 7.A.3-56 7.A.3.4.1.21 System Repair (IEEE 279-1971, Paragraph 4.21) 7.A.3-56 7.A.3.4.1.22 Identification (IEEE 279-1971, Paragraph 4.22) 7.A.3-57 7.A.3.4.2 IEEE 308-1971 7.A.3-57 7.A.3.4.3 IEEE 379-1972 7.A.3-57 7.A.4 Systems Required for Safe Shutdown 7.A.4-1 7.A.4.1 Reactor Core Isolation Cooling System Instrumentation and Controls 7.A.4-1 7.A.4.1.1 IEEE 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations 7.A.4-1 7.A.4.1.2 IEEE 323-1971, Trial-Us e Standard-General Guide for Qualifying Class I Electric Equipment for Nuclear Power Generating Stations 7.A.4-6 7.A.4.1.3 IEEE 338-1971, Trial-Us e Criteria for Periodic Testing of Nuclear Power Generating Station Protection Systems 7.A.4-7 LSCS-UFSAR TABLE OF CONTENTS (Cont'd) Page 7.0-xvii REV. 13 7.A.4.1.4 IEEE 344-1971, Guide for Seismic Qualification of Class I Electric Equipment for Nuclear Power Generating Stations 7.A.4-7

7.A.5 Other Instrumentation Systems Required for Safety 7.A.5-1 7.A.5.1 Main Steamline Radiation Monitoring Subsystem 7.A.5-1 7.A.5.1.1 Specific Requirement Conformance 7.A.5-1 7.A.5.2 Reactor Building Ventilation Exhaust Plenum Radiation Monitoring 7.A.5-1 7.A.5.2.1 Specific Requirement Conformance 7.A.5-1 7.A.5.3 Recirculation Pump Trip System 7.A.5-5 7.A.5.3.1 Specific Requirements Conformance 7.A.5-5 7.A.5.4 Leak Detection System 7.A.5-9 7.A.5.4.1 Specific Requirement Conformance 7.A.5-9 7.A.5.5 Intermediate Range Monitor Subsystem 7.A.5-9 7.A.5.5.1 Specific Requirement Conformance 7.A.5-9 7.A.5.6 Average Power Range Monitor Subsystem 7.A.5-10 7.A.5.6.1 Specific Requirement Conformance 7.A.5-10

LSCS-UFSAR 7.0-xviii REV. 15, APRIL 2004 CHAPTER 7.0 - INSTRUMENTATION AND CONTROL SYSTEMS

LIST OF TABLES

NUMBER TITLE 7.1-1 System Classification 7.1-2 Codes and Standards Applicability Matrix 7.1-3 Reactor Protection System Codes and Standards 7.1-4 Containment and Reactor Vessel Isolation Control System Codes and Standards 7.1-5 High-Pressure ECCS (HPCS, ADS A, ADS B NETWORK) Codes and Standards 7.1-6 HPCS and Low Pressure ECCS (LPCS, RHR A, RHR B NETWORK) Codes and Standards 7.1-7 Process Radiation Monitoring Codes and Standards 7.1-8 Leak Detection System Codes and Standards 7.1-9 Reactor Protection System and Deenergize-to-Operate Sensor Suffix Letters and Division Allocation 7.1-10 Four-Division Grouping of the Neutron Monitoring System Utilizing Four, Six, or Eight Drywell

Penetrations 7.1-11 Emergency Core Cooling System Standby Cooling and RCIC Sensor Suffix Letters and Division Allocation

Energize-to-Operate 7.1-12 System and Subsystem Separation 7.2-1 Reactor Protection System Instrument Limits 7.2-2 Channels Required for Functional Performance of RPS: Startup Mode 7.2-3 Channels Required for Functional Performance of RPS: Run Mode 7.3-1 ECCS Instrumentation Limits 7.3-2 Primary Containment, Se condary Containment, and Reactor Vessel Isolation Instrument Limits 7.3-3 Process Radiation System Instrumentation Setpoints 7.3-4 [Deleted] 7.3-5 Control Rod Block Instrumentation Limits 7.3-6 Trip Channel Required for Primary Containment and Reactor Vessel Isolation Control System 7.3-7 Trip Channels Required for Functional Performance of HPCS System 7.3-8 Trip Channels Required for Functional Performance of Automatic Depressurization System 7.3-9 Trip Channels Required for Functional Performance of LPCI "B" and "C" 7.3-10 Trip Channels Required for Functional Performance of LPCS System and LPCI "A" 7.3-11 Instrument Specifications for Primary Containment and Reactor Vessel Isolation Control System 7.4-1 Reactor Core Isolation Cooling Instrument Limits 7.4-2 Reactor Shutdown Cooling Bypasses and Interlocks 7.5-1 Position Indication for Reg. Guide 1.97 PCIV's LSCS-UFSAR LIST OF TABLES (Cont'd)

NUMBER TITLE 7.0-xix REV. 18, APRIL 2010 7.6-1 IRM Trips 7.6-2 APRM System Trips 7.6-3 ARI System Instrumentation Specifications and Setpoints 7.6-4 OPRM System Trips 7.7-1 DELETED 7.7-2 Gaseous Radwaste Process Instruments 7.7-3 Area Radiation Monitors 7.7-4 SRM System Trips 7.7-5 LPRM System Trips 7.7-6 RBM System Trips 7.7-7 Refueling Interlock Effectiveness 7.7-8 Process Radiation Monitoring Systems Characteristics 7.7-9 Matrix of Non-safety Control Systems Affected by HELB Events LSCS-UFSAR 7.0-xx REV. 15, APRIL 2004 CHAPTER 7.0 - INSTRUMENTATION AND CONTROL SYSTEMS

LIST OF FIGURES AND DRAWINGS

FIGURES NUMBER TITLE 7.1-1 Schematic Arrangement of RPV Nozzles for ECCS and Instruments 7.1-2 RPS Separation Concept 7.1-3 Emergency Core Cooling Systems (ECCS) Separation Scheme 7.1-4 NSSS Separation Concept 7.1-5 Main Steamline Isolation Separation Concept 7.1-6 RCIC Sensor Separation Scheme 7.2-1 Reactor Protection System IED 7.2-2 Reactor Protection System Scram Functions 7.2-3 Actuators and Actuator Logics (Schematic) 7.2-4 Logics in One Trip System (Schematic) 7.2-5 Relationship Between Neutron Monitoring System and Reactor Protection System 7.2-6 Configuration for Turbine Stop Valve Closure Reactor Trip 7.2-7 Configuration for Main Steamline Isolation Reactor Trip 7.2-8 Block Diagram - RPS Protective Circuit Electrical Protection Assembly (EPA) 7.3-1 Piping Arrangement 7.3-2 ECCS-Mechanical and Instrumentation Network Models 7.3-3 Emergency Core Cooling System (ECCS) Separation Scheme 7.3-4 Initiation Logic - RHR B and C, HPCS, and RCIC 7.3-5 Auto Depressurization System - Elementary Diagram 7.3-6 Initiation Logic - ADS, LPCS, RHR A 7.3-7 Leak Detection System IED 7.3-8 Vessel Penetrations for Nuclear Instrumentation 7.3-9 Isolation Control System for Main Steamline Isolation Valves 7.3-10 Isolation Control System Using Motor-Operated Valves 7.3-11 Main Steamline Isolation Valve (Schematic) 7.3-12 Control Room Panels 7.3-13 Vent and Purge Isolation Valve (Schematic) 7.5-1 Reactor Control Benchboard Panel Arrangement 7.5-2 Reactor Core Cooling Benchboard Panel Arrangement 7.5-3 Reactor Water Cleanup and Recirculation Benchboard Panel Arrangement 7.6-1 Area Temperature Monitoring System Block Diagram 7.6-2 Neutron Monitoring System IED 7.6-3 SRM/IRM Neutron Monitoring Unit

LSCS-UFSAR 7.0-xxi REV. 18, APRIL 2010 LIST OF FIGURES (Cont'd)

NUMBER TITLE 7.6-4 Detector Drive System Schematic 7.6-5 Functional Block Diagram of IRM Channel 7.6-6 APRM Circuit Arrangement for Reactor Protection System Input 7.6-7 Ranges of Neutron Monitoring System 7.6-8 Control Rod Withdrawal Error from Cold Condition 7.6-9 Normalized Flux Distribution for Rod Withdrawal Error 7.6-10 APRM Tracking with Reduction in Power by Flow Control 7.6-11 APRM Tracking with On-Limits Control Rod Withdrawal 7.6-12 OPRM Interconnection Block Diagram 7.7-1 Reactor Vessel Water Level Ranges 7.7-2 DELETED 7.7-2a Rod Control Management System 7.7-3 DELETED 7.7-4 Eleven-Wire Position Probe 7.7-5 DELETED 7.7-5A Configuration of the RRFC System 7.7-5B RRFC System Control Algorithm Overview 7.7-5C Principal Configuration of the RWLC System 7.7-5D RWLC System Control Algorithm Overview 7.7-6 Simplified Diagram of Turbine Pressure and Speed/Load

Control Requirements 7.7-7 Traversing Incore Probe Assembly 7.7-8 Area Radiation Block Diagram 7.7-9 Functional Block Diagram of SRM Channel 7.7-10 Power Range Monitor Detector Assembly Location 7.7-11 Assignment of LPRM Input to RBM System 7.7-12 RBM Response to Control Rod Motion (Channels A and C) 7.7-13 RBM Response to Control Rod Motion (Channels B and D) 7.7-14 Recirculation Pump Leak Detection Diagram 7.7-15 Sump Leak Detection Timer

7.8-1 SPDS Primary Display

DRAWINGS CITED IN THIS CHAPTER*

  • The listed drawings are included as "General References" only; i.e., refer to the drawings to obtain additional detail or to obtain background information. These drawings are not part of the UFSAR. They are controlled by the Controlled

Documents Program.

DRAWING* SUBJECT

M-55 Main Steam System P&ID, Unit 1 M-87 CSCS - Equipment Cooling Water System P&ID, Unit 1 M-89 Standby Gas Treatment System P&ID, Units 1 & 2 M-93 Nuclear Boiler and Reactor Recirculation System P&ID, Unit 1 M-94 Low-Pressure Core Spray System P&ID, Unit 1 LSCS-UFSAR 7.0-xxii REV. 14, APRIL 2002 DRAWINGS CITED IN THIS CHAPTER*(Cont'd) DRAWING* SUBJECT M-95 High-Pressure Core Spray P&ID, Unit 1 M-96 Residual Heat Removal System P&ID, Unit 1 M-97 Reactor Water Cleanup System P&ID, Unit 1 M-99 Standby Liquid Control System P&ID, Unit 1 M-100 Control Rod Hydraulic System P&ID, Unit 1 M-101 Reactor Core Isolation Cooling System P&ID, Unit 1 M-116 Main Steam System P&ID, Unit 2 M-130 Containment Combustible Gas Control System P&ID M-134 CSCS - Equipment Cooling Water System P&ID, Unit 2 M-139 Nuclear Boiler and Reactor Recirculation System P&ID, Unit 2 M-140 Low-Pressure Core Spray System P&ID, Unit 2 M-141 High-Pressure Core Spray P&ID, Unit 2 M-142 Residual Heat Removal System P&ID, Unit 2 M-143 Reactor Water Cleanup System P&ID, Unit 2 M-145 Standby Liquid Control System P&ID, Unit 2 M-146 Control Rod Hydraulic System P&ID, Unit 2 M-147 Reactor Core Isolation Cooling System P&ID, Unit 2 M-153 Process and Effluent Radiation Monitoring System P&ID M-155 Leak Detection System P&ID, Unit 1 M-156 Containment Monitoring System P&ID, Unit 1 M-157 Leak Detection System P&ID, Unit 2 M-158 Containment Monitoring System P&ID, Unit 2 M-311 Drywell Piping Plan El. 777'-11", Unit 1 M-327 Drywell Piping, Upper Section 'L-L', Unit 1 M-333 Drywell Piping, Upper 'M-M', Unit 1 M-1443 Control Room/Auxiliary Electrical Equipment Rooms Air Conditioning System P&ID M-1468 Control Room/Auxiliary Electrical Equipment Rooms HVAC System Refrigerant Piping P&ID M-3443 Control Room/Auxiliary Electrical Equipment Rooms HVAC System C & I Details 1E-1(2)-4201 Schematic Diagram - Auto Depressurization Sys. NB 1E-1(2)-4206 Schematic Diagram - Reactor Manual Control System RD 1E-1(2)-4215 Schematic Diagram - Reactor Protection System RP 1E-1(2)-4601 Front Elevation Reactor Core Cooling Benchboard 1E-1(2)-4602 Front Elevation Reactor Water Cleanup and Recirculation Benchboard 1E-1(2)-4603 Front Elevation Reactor Control Benchboard LSCS-UFSAR 7.0-xxiii REV. 14, APRIL 2002 THE FOLLOWING CROSS REFERENCE IS PROVIDED FOR INFORMATION

  • The listed drawings are included as "General References" only; i.e., refer to the drawings to obtain additional detail or to obtain background information.

These drawings are not part of the UFSAR. They are controlled by the Controlled Documents Program. DRAWING* CORRESPONDING NUMBER GE DRAWING* NUMBER SUBJECT 1E-X-4216 Series 115D6268TD RPS MG Set Control 1E-X-4000 Series 731E302AA HPCS-One Line Diagram 1E-X-4205 Series 761E792TD Reactor Recirculation System 1E-X-4214 Series 807E151TD Remote Shutdown System 1E-X-4203 Series & 807E152TD Nuclear Steam Supply Shutoff 1E-X-4232 Series System 1E-X-4200 Series 807E153TD Nuclear Boiler Process Instrumentation System 1E-X-4224 Series 807E154TD Leak Detection System 1E-X-4201 Series 807E155TD Automatic Depressurization System (ADS) 1E-X-4202 Series 807E156TD Jet Pump Instrumentation System 1E-X-4206 Series 807E158TD Reactor Manuel Control System 1E-X-4207 Series 807E159TD Control Rod Drive-Hydraulic System 1E-X-4208 Series 807E160TD Feedwater Control System 1E-X-4209 Series 807E161TD Standby Liquid Control System(SLC) 1E-X-4210 Series 807E162TD NMS-Startup Range 1E-X-4211 Series 807E163TD NMS-Power Range 1E-X-4212 Series 807E164TD Neutron Monitoring System (NMS)- Startup Range Detector Drive Control 1E-X-4213 Series 807E165TD NMS-Traversing Incore Probe 1E-X-4215-Series 807E168TD Reactor Protection System (RPS) 1E-X-4481 Series & 807E168TD Process Radiation Monitoring System 1E-X-4218 Series 1E-X-4480 Series & 807E169TD Area Radiation Monitoring System 1E-X-4219 Series Unit 1 1E-X-4220 Series 807E170TD Residual Heat Removal system(RHR)

LSCS-UFSAR DRAWINGS (Cont'd) NUMBER TITLE 7.0-xxiv REV. 14, APRIL 2002 THE FOLLOWING CROSS REFERENCE IS PROVIDED FOR INFORMATION (Cont'd) DRAWING* CORRESPONDING NUMBER GE DRAWING* NUMBER SUBJECT 1E-X-4221 Series 807E171TD Low-Pressure Core Spray System(LPCS) 1E-X-4222 Series 807E172TD High-Pressure Core Spray System (HPCS) 1E-X-4226 Series 807E173TD Reactor Core Isolation Cooling System RCIC) 1E-X-4228 Series 807E175TD Reactor Water Cleanup System(RWCU) 1E-X-4223 Series 807E183TD HPCS-Power Supply 1E-X-4229 Series 828E155TD Off-Gas System 1E-X-4206 Series 828E230 Reactor Manual Control System 1E-X-4225 Series 851E708TD Main Steamline Isolation Valve Leakage Control System(MSIV-LCS)

LSCS-UFSAR 7.1-1 REV. 18, APRIL 2010 CHAPTER 7.0 - INSTRUMENTATION AND CONTROLS

7.1 INTRODUCTION

This chapter presents details of the safety-related and power generation control and instrumentation systems in the plant. It identifies the safety classifications applicable to instrument and control syst ems, and it also delineates applicable criteria and discusses physical and electrical independence of safety-related instrumentation and control systems.

7.1.1 IDENTIFICATION

OF SAFETY-RELATED SYSTEMS Instrumentation and control systems may be classified as either power generation systems or safety systems, depending on their function. Some portions of a system may have a safety function, while other portions of the same system may be classified as power generation. The systems presented in Chapter 7.0 have also been grouped according to the NRC Standard Format for Safety Analysis Reports, Revision 2; namely, Reactor Trip System, Engineered Safety Feature Systems, Safe Shutdown Systems, Safety-Related Display Instrumentation, Other Systems Required for Safety, and Control Systems Not Required for Safety. Many systems, however, have safety design bases and power generation design bases. Safety systems provide actions necessary to protect the integrity of radioactive material barriers and/or prevent the release of radioactive material. These systems may be components, subsystems, systems, or groups of systems. These are distinct from the engineered safety systems, which have the sole function of mitigating the consequences of an accident. Power generation systems are not required to protect the integrity of radioactive material barriers and/or prevent the release of radioactive material. The instrumentation and control portions of these systems may, by their actions, prevent the plant from exceeding preset limits, which would cause action of the safety systems. In order to visualize the relationship between safety systems, power generation systems, and the Standard Format classifications, see Table 7.1-1. Table 7.1-1 lists safety-related instrumentation, control, and supporting systems. The safety design basis states in functional terms the unique design requirements that establish limits for the operation of the system. The general functional LSCS-UFSAR 7.1-2 REV. 13 requirements portion of the safety design basis includes those requirements which have been determined to be sufficient to ensure the adequacy and reliability of the system from a safety viewpoin

t. Many of these have been introduced into various codes, safety criteria, an d regulatory requirements.

The control and instrumentation supplied systems have been examined with respect to specific safety regulatory requiremen ts applicable to the instrumentation and controls. These requiremen ts consist of all applicabl e industry codes, 10 CFR 50 Appendix A (General Design Criteria), 10 CFR 50 Appendix B (Quality Assurance Criteria), and NRC Regulatory Guides. The specific safety requirements applicable to the instrumentation and control for each system are listed in Table 7.1-2. The RPS, PCRVICS, ECCS, process radiation monitoring system, and leak detection systems have been reduced to the subsystem level and the applicable requirements specified. This information is contained in Tables 7.1-3 through 7.1-8.

7.1.2 GENERAL

DESCRIPTION OF INDIVIDUAL SYSTEMS

a. The reactor protection system instrumentation and controls initiate an automatic reactor shutdown (scram) if monitored system variables exceed preestablished limits. This action prevents fuel damage, limits system pressure, and thus restricts the release of radioactive material.
b. The primary containment and reactor vessel isolation control system (PCRVICS) instrumentation and controls initiate closure

of various automatic isolation valves if monitored system variables exceed preestablished limits. This action limits the loss of coolant from the reactor vessel and minimizes the release of radioactive materials from either the reactor vessel or the primary containment. The nuclear steam supply shutoff system is a subsystem of PCRVICS.

c. The emergency core cooling systems instrumentation and control provides initiation and control of specific core cooling systems such as high-pressure core spray system, automatic depressurization system, low-pressure core spray system, and the low-pressure coolant injection system.
d. The neutron monitoring system instrumentation and controls use incore neutron detectors to monitor core neutron flux. The neutron monitoring system provides signals to the RPS to shut down the reactor when an overpower condition is detected. High average neutron flux is used as the overpower indicator during LSCS-UFSAR 7.1-3 REV. 18, APRIL 2010 power operation. Intermediate range detectors are used as overpower indicators during startup and shutdown. The neutron monitoring system also provides power level indication during planned operation.

The neutron monitoring system consists of the following seven major subsystems:

1. source range monitor (SRM) subsystem, 2. intermediate range monitor (IRM) subsystem, 3. local power range monitor (LPRM) subsystem, 4. average power range monitor (APRM) subsystem, 5. oscillation power range monitor (OPRM) subsystem, 6. rod block monitor (RBM) subsystem, and 7. traversing incore probe (TIP) subsystem.
e. The refueling interlocks instrumentation and controls serve as a backup to procedural control on core reactivity during refueling operation.
f. The rod control management system instrumentation and controls allow the operator to manipulate control rods and determine their positions. Vari ous interlocks are provided in the control circuitry to prevent multiple operator errors or equipment malfunctions from requiring the action of the reactor protection system.

The rod control management system includes the rod worth minimizer programming, which supplements procedural requirements for limiting the rod worth by restricting the control rod movements to pre-established patterns during startup and shutdown.

g. (deleted)
h. The reactor vessel instrumentation monitors and transmits information concerning key reactor vessel operating variables.
i. The recirculation flow control system instrumentation and controls regulate the reactor recirculation pumps and valve position to vary the coolant flow rate through the core. The system permits manual control.

LSCS-UFSAR 7.1-3a REV. 18, APRIL 2010

j. The feedwater system instrumentation and controls regulate the feedwater system flow rate so that proper reactor vessel water level is maintained. The system is arranged to permit single-element operation (reactor vessel water level only), three-element operation (level, main st eam flow, feedwater flow), or manual operation.

LSCS-UFSAR 7.1-4 REV. 13

k. The pressure regulator and turbine-generator instrumentation and controls work together to allow proper generator and reactor response to load demand changes. To maintain constant turbine inlet pressure, the pressure regulator adjusts the turbine control valves or turbine bypass valves. The turbine-generator controls act to maintain constant turbine speed, and the turbine-generator speed-load controls respond to load or speed changes by adjusting the reactor recirculation flow control system and the pressure regulator setpoint. If the generator electrical load is lost, the turbine-generator sp eed-load controls initiate rapid closure of the turbine control valves (coincident with fast opening of the bypass valves) to prevent excessive turbine overspeed.
l. The process radiation monitoring system instrumentation and controls for process liquid and gas lines provide sufficient control for knowledgeable radioactive material release from the site.

The main steamline radiation monitors detect gross release of fission products from the fuel and provide an alarm in the control room. The process radiation monitoring system consists of seven major subsystems:

1. main steamline radiation monitoring subsystem,
2. air ejector off-gas radiation monitor and sampler (off-gas pretreatment radiation monitor) subsystem, 3. off-gas vent pipe radiation monitoring (off-gas post-treatment monitor) subsystem, 4. process liquid radiation monitoring subsystem,
5. carbon bed vault radiation monitor subsystem, 6. reactor building ventilation exhaust plenum radiation monitoring subsystem, and
7. station vent stack exhaust sampling subsystem.
m. The area radiation monitoring system instrumentation provides gamma-sensitive detectors throughout the plant whose outputs are recorded on multipoint recorders.

LSCS-UFSAR 7.1-5 REV. 18, APRIL 2010 n. The process computer performs several calculations to optimize plant performance. The rod worth minimizer supplements procedural requirements for limiting the rod worth by restricting certain control rod manipulations during reactor startup and shutdown. The rod worth minimizer is integrated into the rod control management system.

o. The reactor building ventilation and pressure control system senses abnormal pressure and radiation levels in the ECCS pump rooms and initiates the pressure control system.
p. The main control room and auxiliary electric equipment room heating, ventilating and air conditioning systems instrumentation and control system senses abnormal radiation levels in the control room and initiates changes in the sources of circulating air.
q. The CSCS equipment cooling water system (CSCS-ECWS) instrumentation and controls initiate and monitor cooling water flow to vital equipment during abnormal conditions and unit

shutdown.

r. The post-LOCA hydrogen recombiner system instrumentation and controls monitor and provide means for controlling the hydrogen concentration in the primary containment following a postulated LOCA. The hydrogen recombining function of the hydrogen recombiners is abandoned in place.
s. The reactor core isolation cooling system instrumentation and controls provide makeup water to the reactor vessel in the event the reactor becomes isolated from the main condensers during plant operation by a closure of the main steamline isolation valves. t. The standby liquid control system instrumentation and controls provide manual initiation of a redundant reactivity control system which can shut the reactor down from rated power to the cold condition in the event that all withdrawn control rods cannot be inserted to achieve reactor shutdown.
u. The primary containment atmosphere monitoring system instrumentation senses abnormal gamma radiation, oxygen, and hydrogen concentration in the containment and initiates alarms in the control room.

LSCS-UFSAR 7.1-5a REV. 18, APRIL 2010

v. The radwaste system instrumentation and controls support manual processing and disposing of the radioactive process LSCS-UFSAR 7.1-6 REV. 13 wastes generated during power operation. The radwaste control system includes liquid radwaste and gaseous radwaste subsystems.
w. The reactor water cleanup system instrumentation and controls provide manual initiation of system equipment to maintain high water purity and reduce concentrations of fission products in the reactor water.
x. The standby power systems instrumentation and controls monitor all important standby power parameters and annunciate abnormal conditions within the system.
y. The leak-detection system instrumentation and controls use various temperature, pressure, level, and flow sensors to detect, annunciate, and isolate (in cert ain cases) water and steam leakages in selected reactor systems.
z. The reactor shutdown cooling system (RHR) instrumentation and controls provide manual initia tion of cooling to remove the decay and sensible heat from the reactor vessel so that the reactor can be refueled and serviced.

aa. The fuel pool cooling and cleanup system instrumentation senses abnormal water temperatures. ab. The standby gas treatment system instrumentation and controls automatically line up airflow from various sources to the treatment filters. ac. The alternate rod insertion (ARI) system instrumentation and controls initiate an automatic reactor scram if monitored system variables exceed preestablished limits. The ARI function is to exhaust the scram valve pilot air header through valves different from the reactor protection system-initiated scram valves, therein providing an alternate means of initiating control rod insertion.

7.1.3 Independence

of Redundant Safety-Related Systems This section defines separation criteria for safety and safety-related mechanical and electrical equipment. Safety-related equipment to which the criteria apply are those necessary to mitigate the effects of abnormal operational transients or accidents. The objective of the criteria is to delineate the separation requirements LSCS-UFSAR 7.1-7 REV. 13 necessary to achieve true independence of safety-related functions compatible with the redundant equipment provided. The subsections to follow individually a ddress mechanical and electrical equipment separation. The specific systems and equipment to which the criteria apply are listed followed by the corresponding criteria.

7.1.3.1. Mechanical Systems and Equipment The affected mechanical systems and related equipment (i.e., piping, valves, pumps, and heat exchangers) include: ECCS a. low-pressure coolant injection (LPCI) system (subsystem of RHR),

b. low-pressure core spray (LPCS) system,
c. high-pressure core spray (HPCS) system, and
d. automatic depressurization (ADS) system.

Other a. reactor core isolation cooling (RCIC) system,

b. core standby cooling system equipment cooling water (CSCS-ECWS) system, and
c. portions of the supporting systems for the previous systems which are required to enable the main system to perform its safety function.

7.1.3.2 Electrical Systems and Equipment The affected electrical systems and equipment, including supporting systems, are described in the following:

a. Reactor protection system (RPS)

The overall complex of instrument channels, power supplies, trip system, trip actuators and all wiring involved in generating a reactor scram trip signal. LSCS-UFSAR 7.1-8 REV. 13

b. Nuclear steam supply shutoff system (NSSSS)

The instrument channels (except those common to RPS), power supplies, trip systems, manual controls and interconnecting wiring involved in generating a NSSSS

function. Instrument channels for the isolation functions which are shared with the reactor protection system are considered a part of the RP S as far as segregation is concerned.

c. Emergency core cooling system (ECCS)

This includes that combination of systems which takes automatic action to provide the cooling necessary to limit or prevent melting of fuel cladding in the event of a design-basis reactor accident. These systems include:

1. low-pressure core spray (LPCS) system, 2. automatic depressurization system (ADS), 3. high-pressure core spray (HPCS) system, and
4. residual heat removal (RHR) system.
d. Reactor core isolation cooling (RCIC) system This system maintains adequate core cooling in the event of reactor isolation accompanie d by a loss of feedwater.

This system is not an ECCS. The steam supply valves for this system are part of the NSSSS. 7.1.3.3 Mechanical Syst ems Separation Criteria 7.1.3.3.1 General

a. Separation of the affected mechanical systems and equipment (Subsection 7.1.3.1) shall be accomplished so that the substance and intent of 10 CFR 50 are fulfilled.
b. Consideration is given to the redundant and diverse requirements of the affected systems.

LSCS-UFSAR 7.1-9 REV. 13

c. Consideration is given to the type, size, and orientation of possible breaks of the reactor coolant pressure boundary specified in Subsection 3.6.2.2.
d. The protection afforded by the ECCS network satisfies the single-failure criterion. A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be part of the single failure. Fluid systems are considered to be designed against an assumed single failure if a single failure of any active component (assuming passive components function properly) does not result in a loss of capability of the system to perform its safety function.
e. The affected mechanical systems and equipment along with their associated structures are appropriately separated so that they are adequately protected against:
1. the LOCA dynamic effects outlined in Section 3.6, 2. missiles as defined in Section 3.5, and
3. fires capable of damaging redundant mechanical safety equipment.

The need for and the adequacy of separation are determined in conjunction with the criteria specified in Sections 3.5 and 3.6. 7.1.3.3.2 System Separation Requirements

a. Piping for a redundant safety sy stem is run independently of its counterpart. Supports, restraints, and mechanical components of redundant piping of the same system are not shared in common, unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions.
b. Entrance penetrations to the containment are separated so that damage to or failure of one branch of a system shall not render its redundant counterpart(s) inoperable.

LSCS-UFSAR 7.1-10 REV. 13 7.1.3.3.3 Physical Separation Requirements

a. Mechanical equipment and piping, including control safety conduit and tubing for the emerge ncy core cooling systems, are separated so that no single credi ble event is capable of disabling sufficient equipment to prevent reactor shutdown, removal of decay heat from the core, or isolation of the containment.
b. The ADS system is separated from the HPCS system such that no break location within the norm ally pressurized portion of the HPCS influent line is located within jet impingement or pipe movement damage distance of any component considered essential to the operation of the ADS.
c. The ECCS shall be separated into three functional groups:
1. HPCS, 2. LPCS + one LPCI with RHR heat exchanger and 100% service water, and
3. two LPCI pumps with one RHR heat exchanger and 100% service water.
d. The equipment in each group is separated from that in the other two groups by the maximum practical distance. In addition, the distance between the HPCS and the RCIC (which is not an

ECCS) is maximized (Figure 7.1-1). The HPCS is in ESF division 3 and the RCIC is in ESF division 1.

e. Separation barriers are constructed between the functional groups as required to assure that environmental disturbances (such as fire, pipe rupture phenomena, falling objects, etc.) affecting one functional group will not affect the remaining

groups. In addition, separation barriers are provided as required to assure that such di sturbances do not affect both the RCIC and HPCS. 7.1.3.4 Electrical Systems Separation Criteria 7.1.3.4.1 General Major electrical equipment comprising the sy stems listed in Subsection 7.1.3.2 shall be identified so that two facts are ph ysically apparent to the operating and maintenance personnel: first, that the equipment is part of the RPS or ESF LSCS-UFSAR 7.1-11 REV. 13 equipment; and second, the grouping (or division) of enforced segregation with which the equipment is associated. Panel and division markers are compatible with this objective. Electrical system separation criteria for non-GE furnished equipment is considered in Su bsections 8.3.1.3 and 8.3.1.4.

a. Panels and racks Panels and racks associated with the RPS or ESF shall be labeled with marker plates which are conspicuously different from those for other similar panels; the difference may be in color, shape, or color of engr aving-fill. The marker plates include identification of the proper division of the equipment included. The colors of panel and division markers are compatible if color coding is us ed as the primary mechanism of differentiation between divisions.
b. Junction or pull boxes Junction and/or pull boxes enclosing wiring for the RPS or ESF have identification similar to and compatible with the panels

and racks.

c. Cables Cables external to cabinets and/or panels for the RPS or ESF are marked to distinguish them from other cables and identify their separation division as applicable. This identification requirement does not apply to individual conductors.
d. Raceways Those trays or conduits which carry RPS or ESF wiring are identified at entrance points of each room through which they pass (and exit points unless the room is small enough to facilitate convenient following of cable) with a permanent marker identifying their division. Non-ESF cables routed with ESF cables assume the ESF cables divisional identification for extended routing and must not subsequently be routed with a different ESF division.
e. Sensory Equipment Grouping and Designation Letters Redundant sensory equipment for RPS or ESF is identified by suffix letters in accordance with Table 7.1-9 for the RPS, Table 7.1-10 for the neutron monitoring system, and LSCS-UFSAR 7.1-12 REV. 13 Table 7.1-11 for ECCS and RCIC.

These tables also show the allocation of sensors to their separated divisions. 7.1.3.4.2 System Separation Requirements 7.1.3.4.2.1 Reactor Protection System (RPS) The following general rules apply to both RPS and NSSSS wiring associated with RPS:

a. RPS cable in raceways outside of the main protection system cabinets may not be run with other wiring and is conspicuously identified to facilitate auditing. Undervessel neutron

monitoring cables are not placed in any enclosure which unduly restricts their flexibility. Ne utron monitoring cables (SRM, IRM, OPRM and APRM) may be run in the same raceway provided that the four-divisional separation is maintained.

b. Wiring to duplicate sensors on a common process tap are run in separate raceways to its separate destinations in order to meet the single-failure criterion.
c. Wiring for sensors of more than one variable in the same trip channel may be run in the same raceway.
d. Wires from both RPS trip system trip actuators to a single group of scram solenoids may be run in a single raceway, however, a

single raceway shall not contain wi res to more than one group of scram solenoids. Wiring for tw o solenoids on the same control rod may be run in the same raceway.

e. Cables through the primary containment penetrations are so grouped that failure of all cabling in a single penetration cannot prevent a scram. (This applie s specifically to the neutron monitoring cables and the main steam isolation valve position switch cables.)
f. Power supplies to systems which deenergize to operate (so called "fail-safe" power supplies) are routed in accordance with Subsection 8.3.1.4.2.2. Ther efore, the protection system flywheel motor-generator (MG) sets and load circuit breakers are not required to comply with these separation requirements even though the load circuits go to separated panels.

LSCS-UFSAR 7.1-13 REV. 13 g. The RPS has a minimum of four independent input instrument channels for each measured variable. The four separate conduits for the four sensors for a specific variable may (in some cases) be combined into two groupings or divisions for routing purposes if desired by combining divisions IA and IB and IIA and IIB shown in Table 7.1-9 and Figure 7.1-2. However, in no case shall the total disabling of equipment within a single division be capable of preventing a required scram action under permitted bypass conditions.

h. The RPS wiring is run and/or protected such that no common source of potentially damaging energy (e.g., electrical fire in non-RPS wireways, malfunction or misoperation of plant equipment, pipe rupture, etc.) could reasonably result in loss of ability to scram when required.

7.1.3.4.2.2 Emergency Core Cooling System (ECCS) and Nuclear Steam Supply

Shutoff System (NSSSS)

a. Separation is such that no single failure can prevent operation of an engineered safeguard function. Redundant (even dissimilar) systems may be requ ired to perform the required function to satisfy the single failure criterion. Figures 7.1-2, 7.1-3, 7.1-4, 7.1-5, and 7.1-6 and Table 7.1-12 illustrate equipment separation into divisions and the allowable interconnections through isolating devices.
b. The inboard/outboard NSSSS and MSL isolation valves are backups for each other, so they must be independent of and protected from each other to the extent that no single failure can prevent the operation of at least one of an inboard/outboard pair of shutoff valves. Figure 7.

1-5 illustrates the MSL isolation valve separation concept.

c. Isolation valve circuits require special attention because of their function in limiting the consequenc es of a pipe break outside the primary containment. Isolation valve control and power circuits shall be protected from the pipe lines that they are responsible for isolating as follows:
1. Essential isolation valve wiring in the vicinity of the outboard valve (or downstream of the valve) is run in rigid conduit and routed such as to take advantage of the mechanical protection afforded by the valve operator or LSCS-UFSAR 7.1-14 REV. 13 other available structural barriers not susceptible to disabling damage from the pipe line break. Additional mechanical protection (barriers) is interposed as necessary between wiring and potential sources of disabling mechanical damage consequential to a break downstream of the outboard valve.
2. Isolation valve control and/or power wiring run in a raceway with other cables is protected from secondary effects of damage to those cables which might result from a pipe break in a line requiring isolation (i.e., short circuits which might overheat cables in an ESF raceway).
3. Motor-operated valves which have mechanical check valve backup for their isolation function are included in the division which embraces the system in which the valves are located rather than adhering strictly to the inboard/outboard divisional classification. The testable check valve cable is run in the same division with the cables for the motor-operated valve in the same line. The testable feature, related control switches, and position indicating lights associated with the ECCS testable check valves, have been eliminated. The cables have been de-terminated and left in place.

7.1.3.4.3 Physical Separation Requirements

a. Electrical Divisions Electrical equipment and wiring for the ESF is segregated into separate divisions designated 1, 2 and 3, so that no single credible event is capable of disabling sufficient equipment to prevent reactor shutdown, removal of decay heat from the core, or to prevent isolation of the containment in the event of a design-basis accident. Separation requirements apply to control power and motive power for all systems concerned. These minimum requirements and guide lines are to be applied with good engineering judgment as an aid to prudent and conservative layout of electrical equipment and raceways throughout the plant. Refer to Subsection 8.3.1.4 for detailed separation arrangement.

LSCS-UFSAR 7.1-15 REV. 13 b. Mechanical Damage Zone Arrangement and/or protective barriers are such that no locally generated force or missile can destroy redundant ESF functions. In the absence of confirming an alysis to support less stringent requirements, the following rules shall apply:

1. In rooms or compartments having heavy rotating machinery, such as the main turbine-generator or the reactor feed pumps, or in rooms containing high-pressure feedwater piping or high-pressure steamlines such as those between the reactor and the turbine, a minimum separation of 20 feet or a 6-inch-thick reinforced concrete wall is required between trays containing cables of different divisions.
2. Any switchgear associated with two redundant ESF's and located in a potential mechanical damage zone such as discussed above must have a minimum horizontal separation of 20 feet or must be separated by a protective wall equivalent to a 6-inch-thick reinforced concrete wall.
3. In any compartment containing an operating crane, such as the turbine building main floor and the region above the reactor pressure vessel, there must be a minimum horizontal separation of 20 feet or a 6-inch-thick reinforced concrete wall between trays containing cables from different divisions.
c. Fire Hazard Zone Arrangement of cabling is such as to eliminate, insofar as practical, any potential for fire da mage to cables and to separate the redundant divisions so that fire in one division will not propagate to another division. In the absence of confirming analysis to support less string ent requirements, the following general rules are followed:
1. Routing of cables for ESF control or power through rooms or spaces where there is potential for accumulation of large quantities (gallons) of o il or other combustible fluids through leakage or rupture of lube oil or cooling systems

should be avoided. Where such routing is unavoidable for practical reasons, see Sect ion 8.3.1.4.2.1 for raceway spearation criteria. LSCS-UFSAR 7.1-16 REV. 14, APRIL 2002

2. In any room or compartment in which the only source of fire is of an electrical nature, cable trays of different ESF divisions must have a minimum horizontal separation of 3 feet if no physical barrier exists between trays. If a horizontal separation of 3 feet is unattainable, a fire-

resistant barrier is required, extending at least 1 foot above (or to the ceiling) and 1 foot below (or to the floor) line-of-sight communication be tween the two trays. These trays are of the solid bottom type.

3. For ESF raceways in which the only source of fire is of an electrical nature, there is a minimum vertical separation

of 5 feet between horizontal cable trays stacked vertically one above the other; however, vertical stacking of trays from redundant divisions should be avoided wherever possible. In cases where cable trays are run stacked one above the other, and where the trays do not meet the 5-foot vertical separation requirement, the lower tray has a solid metal cover and the u pper tray has a solid metal bottom or other effective fire barrier.

4. In the case of crossover of one ESF cable tray over another (or over a panel) in which the only source of fire is of an electrical nature, there is a minimum vertical separation of 12 inches air space between trays with the bottom tray covered with a metal cover and the top tray

provided with a metal bottom for a distance of 5 feet on each side of the tray.

5. Any openings in floors for vertical runs of ESF cables are sealed with fireproof or self-extinguishing material.
d. Cable Spreading Room The minimum horizontal and vertical separation and/or barrier requirements in the cable spread ing room, provided that power leads are run in their own protective enclosure (i.e., conduit or equivalent), are as follows:
1. Where cables of different separation divisions approach the same or adjacent control panels with spacing less than the 3-feet minimum, at least one cable is run in metal (rigid or flexible) condui t to a point where 3 feet of separation exists.

LSCS-UFSAR 7.1-17 REV. 13

2. A minimum horizontal separati on of 1 foot exists between cable trays containing cables of different separation divisions if no physical barrier exists between trays. If a horizontal separation of less than 1 foot is not attainable, a fire-resistant barrier is required extending at least 1

foot above (or to the ceiling) and 1 foot below (or to the floor) line-of-sight communicati on between the two trays. These trays may be of the open bottom type (ladder type or expanded metal bottom type).

3. Vertical stacking of cable trays carrying cables of different divisions is avoided wherev er possible. There is a minimum vertical separation of 3 feet between horizontal trays running parallel one above the other. Where such vertical separation is unobtainable, the top trays have solid metal bottoms and the bottom trays have solid covers. Where not acceptable, a fire-resistant barrier is used between the trays.
4. In the case of crossing of a cable tray of one separation division over a tray of the other division, there is a minimum vertical separation of 1 inch of air space between trays, with the bottom tray covered with a metal cover and the top tray provided with a metal bottom for a distance of 1 foot on each side of the intersection.
e. Main Control Room Panels No single control panel (or local panel or instrument rack) includes wiring essential to the protective function of two systems which are backups for each other except as allowed by item 4 and item 5.
1. If two panels containing circuits of different separation divisions are less than 1 foot apart, there is a steel barrier between the two panels. Panel ends closed by steel end plates are considered to be acceptable barriers provided that terminal boards and wireways are spaced a minimum of 1 inch from the end plate.
2. Floor-to-floor panel fireproof barriers are provided between adjacent panels of different divisions and divisional equipment on the same panel.

LSCS-UFSAR 7.1-18 REV. 13

3. Penetration of separation barriers within a subdivided panel is permitted, provided that such penetrations are sealed or otherwise treated so that an electrical fire could not reasonably propagate from one section to the other and disable a protective function.
4. Where, for operational reasons, locating manual control switches on separate panels is considered to be prohibitively (or unduly) restrictive to manual operation of equipment, the switches may be located on the same panel provided no credible single event in the panel can disable both sets of redundant manual or automatic

controls. Wherever wiring of two different divisions exists in a single panel section, separate terminal boards must be provided, and spacing of terminal boards and wiring must be such as to preclu de the possibility of fire propagation from one division of wiring to another. One of a redundant pair of devices in close proximity within a single panel will be considered adequately separated from the other if the wiring to one of the devices has flameproof insulation and is totally enclosed in fire-resistant material including outgoing terminals at the control panel boundary as well as at the device itself. However, consideration shall be given to locating redundant switches on opposite sides of the barrier formed by the end closures of adjacent panels wherever operationally

acceptable.

5. Wiring for digital information outputs such as those to annunciators or data loggers may be run between sections of subdivided panels if interposing relays or equivalent isolation is provided to prevent interaction. For example, 125-Vdc annunciator circuits may be connected through

sensor relay contacts of more than one of the protection system panels to achieve an either-of-two alarm logic, but wiring for the annunciators shou ld be kept separate from the protective wiring by separate cabling or ducting.

f. Steam Leakage Zone Electrical equipment and raceways for systems listed in Subsection 7.1.3.2 are located away from steam leakage zones insofar as practical, or are designed for short-term exposure to the high temperature and humidity associated with a steam leak.

LSCS-UFSAR 7.1-19 REV. 14, APRIL 2002

g. Suppression Pool Swell Zone Any electrical equipment and/or raceways for ESF located in this zone must be designed to satisfactorily complete their function before being rendered inoperable due to exposure to the

environment created by the swell.

7.1.4 Physical

Identification of Safety-Related Equipment Physical identification of equipment asso ciated with the RPS, PCRVICS, ECCS and their auxiliary supporting systems is described in Subsection 7.1.3.4.1.

7.1.5 Conformance

to IEEE Criteria General conformance to IEEE criteria is discussed in attachment 7.A.1.

7.1.6 Conformance

to Regulatory Guides This subject is discussed in Appendix B.

LSCS-UFSAR TABLE 7.1-1 (SHEET 1 OF 2) TABLE 7.1-1 REV.16 - APRIL 2006 SYSTEM CLASSIFICATION BASIC SAFETY SYSTEMS Reactor protection system Primary containment and RV isolation control system Emergency core cooling systems High-pressure core spray Automatic depressurization system Low-pressure core spray Low-pressure coolant injection (RHR) Neutron monitoring system Intermediate range monitors (IRM) Average power range monitors (APRM) Leak detection systems Process radiation monitoring system Main steamline radiation monitoring Containment ventilation radiation monitoring AUXILIARY SUPPORTING SYSTEMS Standby power systems Standby gas treatment system CSCS equipment cooling water system Residual heat removal system (RHR)

Main control room atmospheric control system Reactor building ventilation and pressure control system Combustible gas control system Diesel-generator facilities ventilation system Switchgear heat removal system

ECCS equipment area cooling system OTHER SYSTEMS IMPORTANT TO SAFETY Reactor core isolation cooling system Standby liquid control system Reactor shutdown cooling (RHR) Reactor vessel instrumentation Low water level Vessel pressure

Refueling interlocks Neutron monitoring system Rod block monitor, source range monitor

LSCS-UFSAR TABLE 7.1-1 (SHEET 2 OF 2) TABLE 7.1-1 REV.18, APRIL 2010 Process radiation monitoring system Area radiation monitoring system Containment atmospheric monitoring system Leak detection system Safety-related display instrumentation Rod Control Management System Alternate rod insertion system POWER GENERATION SYSTEMS Reactor water cleanup system Reactor manual control system Recirculation flow control system Feedwater control system Pressure regulator and turbine generator Radwaste system Area radiation monitoring system Process computer

Neutron monitoring system Traversing incore probe (TIP) Process radiation monitoring system Spent fuel pool cooling and cleanup system Reactor vessel instrumentation

LSCS-UFSAR TABLE 7.1-2 (SHEET 1 OF 2) TABLE 7.1-2 REV. 18, APRIL 2010 CODES AND STANDARDS APPLICABILITY MATRIX RPS CRVICS ECCS NMS REFUELINTLK CRD/RCMSVESSELINSTFLOWCONTROLFEEDWATERI&CTURBGENI&CPROCESSRADAREARADHEALTHPHYSICS COMPUTER CSCS-ECWSCONTATMMSPCICI&CSTBYLIQUIDI&CRADWASTEI&CRCTRWATERCLEANUPI&CSTANDBYPWRI&CLEAKDETI&CRHRSHUTDOWNI&CFP&C I&CCOMBUSTIBLE GAS RECOMBINER I&C ALTERNATE ROD INSERTION I&C IEEE 279-1971 X X X APRM, IRM OPRM, (1) 11 2 3X 2XXX X X X X IEEE 308-1971 X XX X X IEEE 323-1971 X X X APRM, IRM X XXXX X X X X IEEE 338-1971 X X X APRM, IRM X XXX X X X X IEEE 344-1971 (5) X X X APRM, IRM X XXXX X X X X IEEE 379-1972 X X X APRM, IRM X X X X X X IEEE-381 OPRM IEEE 387-1972 X X RG 1.6 X X X RG 1.9 X RG 1.21 X X X RG 1.22 X X X APRM, IRM X X X X X X RG 1.29 X X X APRM, IRM X XXX X X X X RG 1.32 X X X RG 1.45 X RG 1.47 4 4 4 APRM, IRM 4 4 4 4 4 RG 1.53 X X X APRM, IRM X X X X X X RG 1.56 X RG 1.62 X X X X X X RG 1.66 LPRM GDC 10 OPRM GDC 12 OPRM GDC 13 X X X APRM, IRM X XXX X X X X GDC 17 X X GDC 18 X X GDC 19 X X X APRM, IRM X X X X X GDC 20 X X X APRM, IRM X X X X X GDC 21 X X X APRM, IRM X X X X X X GDC 22 X X X APRM, IRM X X X X X GDC 23 X X X APRM, IRM X X X X GDC 24 APRM, IRM, RBM X X X X X X GDC 26 X X X GDC 29 X X X APRM, IRM X X X X GDC 30 X X X GDC 34 X X X X X GDC 35 X X GDC 37 X X GDC 41 X GDC 43 X GDC 54 X GDC 61 X X X GDC 63 XX GDC 64 X X LSCS-UFSAR TABLE 7.1-2 (SHEET 2 OF 2) TABLE 7.1-2 REV. 18, APRIL 2010

(1) Interlock functions for Rod Withdrawal Block (RBM) are required to meet specific NRC requirements, rather than IEEE-279.

(2) The Rod Worth Minimizer is part of the RCMS microprocessor-based system.

(3) The Pressure Regulator and Turbine Control System is a non-safeguard process control system. However, RPS trip signals derived from: 

(a) Stop valve closure limit switches; (b) Control valve fast closure oil pressure switches; and (c) First-stage (flow) pressure switches are engineered to all applicable IEEE and safety criteria and descri bed under RPS description.

(4) Conformance to RG 1.47 per Applicant/AE interpretation due to promulgation of RG 1.47 after issuance of construction permit for LSCS.

(5) IEEE-344-1971 was the original design requirements for seismic qualification. All replacement/new components must m eet the requirements of IEEE-344-1975. See UFSAR section 3.10.

LSCS-UFSAR TABLE 7.1-3 TABLE 7.1-3 REV. 13 REACTOR PROTECTION SYSTEM CODES AND STANDARDS

SCRAM DISCHARGE VOLUME MSL ISOLATION

VALVE CLOSURE TURBINE STOP VALVE CLOSURE TURBINE CONTROL VALVE FAST

CLOSURE REACTOR LOW WATER LEVEL MSL HIGH RADIATION NEUTRON MONITORING SYSTEM IRM NEUTRON MONITORING SYSTEMAPRMDRYWELL HIGH PRESSURE REACTOR HIGH PRESSURE MANUAL SWITCH INPUTS BYPASS INPUTS TRIP LOGIC TRIP ACTUATOR OUTPUTS NEUTRON MONITORING SYSTEM OPRM IEEE 279-1971 X X X X X X X X X X X X X X IEEE 323-1971 X X X X X X X X X X X X X IEEE 338-1971 X X X X X X X X X X X X X IEEE 344-1971 X X X X X X X X X X X X X IEEE 379-1972 X X X X X X X X X X X X X RG 1.22 X RG 1.29 X X X X X X X X X X X X X RG 1.47 X X X X X X X X X X X X X RG 1.53 X X X X X X X X X X X X X RG 1.62 X GDC 10 X GDC 12 X GDC 13 X X X X X X X X X X X GDC 19 X GDC 20 X X X X X X X X X X X X GDC 21 X X X X X X X X X X X X X GDC 22 X X X X X X X X X X X X X GDC 23 X X X X X X X X X X X X X GDC 24 X X X X X X X X X X X X X GDC 29 X X X X X X X X X X X X X

Note: IEEE-344-1971 was the original design requirements for seismic qualification. All replacement/new components must meet the requirements of IEEE-344-1975. See UFSAR section 3.10.

LSCS-UFSAR TABLE 7.1-4 TABLE 7.1-4 REV.10 - APRIL 1994 CONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM CODES AND STANDARDS REACTOR LOW WATER LEVEL MSL HIGH RADIATION MSL HIGH FLOW MSL SPACE HIGH TEMPERATURE MSL SPACE HIGH DIFF TEMPERATURE REACTOR LOW PRESSURE DRYWELL HIGH PRESSURE PLANT EXHAUST VENT PLENUM MONITOR REACTOR WATER CLEANUP LOOP HIGH FLOW REACTOR WATER CLEANUP LOOP HIGHSPACE TEMPERATURE REACTOR WATER CLEANUP LOOP HIGHSPACEDIFFTEMPERATURE RHR SPACE HIGH TEMP MANUAL SWITCH INPUTS BYPASS INPUTS TRIP LOGIC TRIP ACTUATOR OUTPUTSMAIN CONDENSER LOW VACUUM IEEE 279-1971 X X X X X X X X X X X X X X X X IEEE 323-1971 X X X X X X X X X X X X X X X X IEEE 338-1971 X X X X X X X X X X X X X X X X IEEE 344-1971 X X X X X X X X X X X X X X X X IEEE 379-1972 X X X X X X X X X X X X X X X X RG 1.22 X RG 1.29 X X X X X X X X X X X X X X X X RG 1.47 X X X X X X X X X X X X X X X X RG 1.53 X X X X X X X X X X X X X X X X RG 1.62 X GDC 13 X X X X X X X X X X X X X GDC 19 X GDC 20 X X X X X X X X X X X X X X X GDC 21 X X X X X X X X X X X X X X X X GDC 22 X X X X X X X X X X X X X X X X GDC 23 X X X X X X X X X X X X X X X X GDC 24 X X X X X X X X X X X X X X X X GDC 29 X X X X X X X X X X X X X X X X GDC 34 X X

NOTE: IEEE-344-1971 was the original design requirements for seismic qualification. All replacement/new components must meet the requirements of IEEE-344-1975. See UFSAR section 3.10.

LSCS-UFSAR TABLE 7.1-5 TABLE 7.1-5 REV. 10 - APRIL 1994 HIGH-PRESSURE ECCS (HPCS, ADS A, ADS B NETWORK) CODES AND STANDARDS REACTOR LOW WATER LEVEL PRIMARY CONTAINMENT HIGH PRESSURE HPCS EMERG BUS VOLTAGE HPCS FLOW SUFFICIENT HPCS BATTERY VOLTAGE ADS A BATTERY VOLTAGE ADS A AC INTLK PERMISSIVE ADS A TIMER ADS B BATTERY VOLTAGE ADS B AC INTLK PERMISSIVE ADS B TIMER MANUAL SWITCH INPUTS BYPASS INPUTS TRIP LOGIC TRIP ACTUATOR OUTPUTS IEEE 279-1971 XN XN XN XN XN XN XN XN XN XN XN XN XN XN IEEE 308-1971 XN XN XN XN IEEE 323-1971 X X X X XN XN X X XN X X X X X IEEE 338-1971 X X X X XN XN X X XN X X X X X IEEE 344-1971 X X X X XN XN X X XN X X X X X IEEE 379-1972 XN XN XN XN XN XN XN XN XN XN XN XN XN XN IEEE 387-1972 XN RG 1.6 XN XN XN XN RG 1.22 X X X X X X X X X X X X X RG 1.29 X X X X XN XN X X XN X X X X RG 1.32 XN XN XN XN RG 1.47 X X X X X X X X X X X X X X RG 1.53 XN XN XN XN XN XN XN XN XN XN XN XN XN XN RG 1.62 XN GDC 13 X X X X X X X X X GDC 17 XN XN XN XN GDC 18 X XN XN XN GDC 19 X GDC 20 XN XN XN XN XN XN XN XN XN XN XN X XN GDC 21 XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 22 XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 23 XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 24 X X X X X X X X X X X X X X GDC 29 XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 35 XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 37 XN XN XN XN XN XN XN XN XN XN XN XN XN XN X = APPLICABLE

XN = APPLICABLE ON A NETWORK BASIS

NOTE: IEEE-344-1971 was the original design requirements for seismic qualification. All replacement/new components must meet the requirements of IEEE-344-1975. See UFSAR section 3.10.

LSCS-UFSAR TABLE 7.1-6 TABLE 7.1-6 REV.10 - APRIL 1994 HPCS AND LOW PRESSURE ECCS(LPCS, RHR A, RHR B NETWORK) CODES AND STANDARDS REACTOR LOW WATER LEVEL DRYWELL HIGH PRESSURE HPCS EMERGENCY BUS VOLTAGE HPCS FLOW SUFFICIENT HPCS BATTERY VOLTAGE LPCS/RHRA BATTERY VOLTAGE LPCH/RHRA EMERG BUS VOLTAGE LPCS/RHRA FLOW SUFFICIENT LPCS/RHRA INJECTION VALVE Rx PRESSURE RHRB/RHRC BATTERY VOLTAGE RHRB/RHRC EMERGENCY BUS VOLTAGE RHRB/RHRC FLOW SUFFICIENT RHRB/RHRC INJECTION VALVE Rx PRESSURE MANUAL SWITCH BYPASS INPUTS TRIP LOGIC TRIP ACTIVATOR OUTPUTS IEEE 279-1971 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN IEEE 308-1971 XN XN XN XN XN XN IEEE 323-1971 X X X X XN XN XN X X XN XN X X X X X IEEE 338-1971 X X X X XN XN XN X X XN XN X X X X X IEEE 344-1971 X X X X XN XN XN X X XN XN X X X X X IEEE 379-1972 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN RG 1.6 XN XN XN XN XN XN RG 1.22 X X X X X X X X X X X X X X X RG 1.29 X X X X XN XN XN X X XN XN X X X X X RG 1.32 XN XN XN XN XN XN RG 1.47 X X X X X X X X X X X X X X X X RG 1.53 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN RG 1.62 XN GDC 13 X X X X X X XN X X X XN X X GDC 17 XN XN XN XN XN XN GDC 18 X XN XN XN XN XN GDC 19 X X GDC 20 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 21 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 22 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 23 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 24 X X X X X X X X X X X X X X X X GDC 29 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 35 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN GDC 37 XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN XN X = APPLICABLE XN = APPLICABLE ON A NETWORK BASIS

NOTE: IEEE-344-1971 was the original design requirements for seismic qualification. All replacement/new components must meet the requirements of IEEE-344-1975. See UFSAR section 3.10.

LSCS-UFSAR TABLE 7.1-7 TABLE 7.1-7 REV.10 - APRIL 1994 PROCESS RADIATION MONITORING CODES AND STANDARDS MAIN STREAMLINE AIR EJECTOR OFF-GAS OFF-GAS VENT PIPE PROCESS LIQUID REACTOR BUILDING VENT

EXHAUST CARBON BED VAULT MONITOR STACK MONITOR - SAMPLERSIEEE 279-1971 X X IEEE 308-1971 IEEE 323-1971 X X IEEE 338-1971 X X IEEE 344-1971 X X IEEE 379-1972 X X RG 1.21 X X RG 1.22 X X RG 1.29 X X RG 1.47 X X RG 1.53 X X GDC 13 X X X X X X X GDC 20 X X X GDC 21 X X GDC 22 X X GDC 23 X X GDC 24 X X GDC 29 X X GDC 64 X X X X NOTE: IEEE-344-1971 was the original design requirements for seismic qualification. All replacement/new component must meet the requirements of IEEE-344-1975. See UFSAR section 3.10.

LSCS-UFSAR TABLE 7.1-8 TABLE 7.1-8 REV.10 - APRIL 1994 LEAK DETECTION SYSTEM CODES AND STANDARDS HIGH TEMPERATURE AND TEMPERATURE HIGH DIFFERENTIAL PRESSURE* LOW Rx WATER LEVEL HIGH PRESSURE HIGH FLOW SUMP FILL RATE* RECIRCULATION PUMP LEAK PRESSURE FLOW* SAFETY/RELIEF VALVE TEMPERATURE DRYWELL FISSION PRODUCT MONITOR* SYSTEMS AFFECTED MSL RCIC RHR RWC U MSL RCIC RHR MSL RCIC RHR RWCU ADS IEEE 279-1971 X X X X X IEEE 323-1971 X X X X X IEEE 338-1971 X X X X X IEEE 344-1971 X X X X X IEEE 379-1972 X X X X X RG 1.47 X X X X X RG 1.53 X X X X X RG 1.22 X X X X X RG 1.29 X X X X X RG 1.45 X X X GDC 13 X X X X X GDC 19 X X X X X GDC 20 X X X X X GDC 21 X X X X X GDC 22 X X X X X . GDC 23 X X X X X GDC 24 X X X X X GDC 29 X X X X X GDC 30 X X X X X X X X X GDC 33 X X X X X ** X GDC 34 X X X GDC 35 GDC 54 X X X X X . NOTE: IEEE-344-1971 was the original design requirements for seismic qualification. All replacement/new components must meet the requirem ents of IEEE-344-1975. See UFSAR section 3.10.

  • These contribute to drywell leak detection. ** Flow only.

LSCS-UFSAR TABLE 7.1-9 TABLE 7.1-9 REV. 14 - APRIL 2002 REACTOR PROTECTION SYSTEM AND DEENERGIZE-TO-OPERATE SENSOR SUFFIX LETTERS AND DIVISION ALLOCATION

  • TOTAL NUMBER OF SENSORS DIVISION IA DIVISION IB DIVISION IIA DIVISION IIB Trip Logic A1 Trip Logic B1 Trip Logic A2 Trip Logic B2 4 A B C D 8 A, E B,F C, G D, H 16 A, E, J, N B, F, K, P C, G, L, R D, H, M, S Part of Trip System A Part of Trip System B Part of Trip System A Part of Trip System B
  • This division does not apply to the six-channel APRM system, which must have a special four-group arrangement to allow for maintenance bypassing of a single channel in each protection system without violating the single-failure criteria (see Table 7.

1-10). LSCS-UFSAR TABLE 7.1-10 (SHEET 1 OF 2) TABLE 7.1-10 REV. 13 FOUR-DIVISION GROUPING OF THE NEUTRON MONITORING SYSTEM UTILIZING FOUR, SIX, OR EIGHT DRYWELL PENETRATIONS

  • DRYWELL PENETRATIONS Penetration designations, optional 8-penetration grouping E IRM E APRM E A IRM A APRM A B IRM B APRM B C IRM C APRM C G IRM G LPRM A D IRM D APRM D F IRM F APRM H IRM H LPRM B Penetration designations, optional 6-penetration grouping E IRM E APRM E LPRM B A IRM A APRM A B IRM B APRM B C IRM C and G APRM C D IRM D and H APRM D F IRM F APRM F LPRM A Penetration designations, standard 4-penetration grouping A IRM A and E APRME LPRM B (SRM A) B IRM B AND F APRM A and B (SRM B) C IRM C and G APRM C and D (SRM C) D IRM D and H APRM F LPRM A (SRM D) Wireway NA NB NC ND Neutron-monitoring channel APRM IRM E E A and E A B B and F C D C and G F F D and H OPRM E G** A B C D F H** RPS trip logic Al A2 A1 B1 A2 B2 B1 B2
  • See the notes at the end of this table for an amplification of the tabulated information. ** OPRM module G receives input from LPRM Group A, and OPRM module H receives input from LPRM Group B.

LSCS-UFSAR TABLE 7.1-10 (SHEET 2 OF 2) TABLE 7.1-10 REV. 0 - APRIL 1984 NOTES

1. Penetrations across the top of the tabl e for 4-, 6-, or 8-penetrati on groupings carry cables for neutron monitoring channels shown, and each channel serves RPS trip logic directly below it.
2. Horizontal zoning represents LPRM cable and amplifier distribution to APRM's from various penetrations, e.g., in the 4-penetration scheme, Penetration B carries cables for LPRM's going to APRM ch annels A and B (see Figure 7.1-2).
3. In the 8-penetration arrangement, Penetrations G and H carry only IRM's and spare LPRM cables.
4. Designations for penetrations and wireways are arbitrary and may be deviated from on any speci fic plant provided that an equivalent separation is maintained and adequate coordination is achieved between instrument supplier and balance-of-plant designer to avoid duplic ation or confusion.

LSCS-UFSAR TABLE 7.1-11 TABLE 7.1-11 REV. 0 - APRIL 1984

EMERGENCY CORE COOLING SYSTEM CORE STANDBY COOLING AND RCIC SENSOR SUFFIX LETTERS AND DIVISION ALLOCATION ENERGIZE-TO-OPERATE DIVISION I DIVISION II DIVISION III SENSOR SUFFIX LETTERS SENSOR SUFFIX LETTERS SENSOR SUFFIX LETTERS A, C B, D AC* B, D

  • Operate ECCS A Operate ECCS B directly and used for RCIC initiation through isolation devices
*Sensors A and C may utilize common process taps;   Sensors B and D may utilize common process taps.

LSCS-UFSAR TABLE 7.1-12 TABLE 7.1-12 REV. 0 - APRIL 1984 SYSTEM AND SUBSYSTEM SEPARATION DIVISION I DIVISION II DIVISION III Low-pressure core spray and RHR "A" RHR "B" and RHR "C" High-pressure Spray Automatic depressurization* "A" Automatic depressurization

  • "B" Outboard NSSSS valves* Inboard NSSSS valves Emergency equipment cooling water

A Emergency equipment cooling water B RCIC

  • The A and B circuits to each ADS valve inside the primary containment, are run in independent and separate rigid conduit.

LSCS-UFSAR TABLE 7.2-1 TABLE 7.2-1 REV. 18, APRIL 2010 SHEET 1 OF 2 REACTOR PROTECTION SYSTEM INSTRUMENT LIMITS FUNCTIONAL UNIT TRIP SETPOINT NOTE 1 ALLOWABLE VALUE NOTE 2 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY NOTE 1 CALIBRATION NOTE 1 DESIGN-BASIS ALLOWANCE NOTE 1 DEVICE RANGE (1) Intermediate Range Monitor Neutron Flux Upscale DB 2.0% to Full Scale (2) Average Power Range Monitor Neutron Flux Upscale (Not Run Mode) <25% N/A (2a) Average Power Range Monitor Fixed Neutron Flux Upscale (Run Mode) Note 1 N/A (3) Average Power Range Monitor Simulated Thermal Power Upscale Cycle PTAP or OPL-3 Note 4 N/A (4) Average Power Range Monitor Upscale (Run Mode) Cycle PTAP or OPL-3 Note 4 N/A (5) Reactor Vessel Pressure High Cycle PTAP or OPL-3 Note 4 200-1200 psi (6) Reactor Vessel Water Level Low Level #3 >1.2 in. Note 3 0-60 in. Note 3 (7) Main Steamline Isolation Valve - Closure 

 <15% closed PTAP or OPL-3 Note 4     (8) Deleted         (9) Drywell Pressure - High   <2.0 psig    0.2-6.0 psi (10) Scram Discharge Volume Level - High Level XMIR/SW*   Note 5    N/A 0.45 in.

LSCS-UFSAR TABLE 7.2-1 TABLE 7.2-1 REV. 18, APRIL 2010 SHEET 2 OF 2 REACTOR PROTECTION SYSTEM INSTRUMENT LIMITS FUNCTIONAL UNIT TRIP SETPOINT NOTE 1 ALLOWABLE VALUE NOTE 2 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY NOTE 1 CALIBRATION NOTE 1 DESIGN-BASIS ALLOWANCE NOTE 1 DEVICE RANGE (11) Turbine Stop Valve Closure <10% closed N/A (12) Turbine Control Valve - Fast Closure. Trip Oil Pressure - Low >400 psig N/A (13) CRD Low Charging Header Pressure Note 1 500-1500 psig (14) CRD Low Charging Header Pressure Delay Timer Note 1 1-30 min. Notes: 1. For Trip Setpoints, Analytic or Design Basis Limit, Accuracy, Calibration, and Design-Basis Allowance, refer to the applicable calculation, listed in Appendix D of Technical Requirement Manual. 2. See Technical Specifications for Allowable Values. 3. All reactor water levels are referenced to instrument zero at 527.5". Vessel Zero is the inside bottom of the RPV at centerline. 4. Refers to the cycle Principal Transient Analysis Parameters for Siemens analysis or the OPL-3 for GE Analysis methods. 5. With respect to instrument zero at elevation 765'6".

LSCS-UFSAR TABLE 7.2-2 TABLE 7.2-2 REV. 14 - APRIL 2002 CHANNELS REQUIRED FOR FUNCTIONAL PERFORMANCE OF RPS: STARTUP MODE

This table shows the normal and minimum number of channels required for the functional performance of the reactor protection system in the startup mode. The "normal" column lists the normal number of channels per trip system. The "minimum" column lists the minimum number of channels per uptripped trip system required to maintain functional performance, assuming the other trip system is tripped.

CHANNEL DESCRIPTION NORMAL MINIMUM

  • Neutron monitoring system (APRM) 3 2 Neutron monitoring system (IRM) 4 3 Nuclear system high pressure 2 2 Containment high pressure 2 2 Reactor vessel low water level 2 2 Scram discharge volume high water level 2 2 Manual scram 2 2 Each main steamline isolation valve position 2/valve 2/valve Low CRD Charging Water Header Pressure 2 2
  • During testing of sensors, the channel should be tripped when the initial state of the sensor is not essential to the test.

LSCS-UFSAR TABLE 7.2-3 TABLE 7.2-3 REV. 13 CHANNELS REQUIRED FOR FUNCTIONAL PERFORMANCE OF RPS: RUN MODE

This table shows the normal and minimum number of channels required for the functional performance of the reactor protection system in the run mode. The "normal " column lists the normal number of channels per trip system. The "minimum " column lists the minimum number of channels per untripped trip system required to maintain functional performance, assuming the other trip system is tripped.

CHANNEL DESCRIPTION NORMAL MINIMUM* Neutron monitoring system (APRM) 3 2 Nuclear system high pressure 2 2 Containment high pressure 2 2 Reactor vessel low water level 2 2 Scram discharge volume high water level 2 2 Manual scram 2 2 Each main steamline isolation valve position 2/valve 2/valve Each turbine stop valve position 2/valve 2/valve Turbine control valve fast closure 2 2 Turbine first stage pressure (bypass channel) 2 2 Neutron Monitoring System (OPRM) 2 2

  • During testing of sensors, the channel should be tripped when the initial state of the sensor is not essential to the test.

LSCS-UFSAR 7.3-1 REV. 13

7.3 Engineered

Safety Feature Systems

7.3.1 Emergency

Core Cooling Systems Instrumentation and Control 7.3.1.1 Design Bases

The emergency core cooling systems contro l and instrumentation shall be designed to meet the following safety design bases:

a. Automatically initiate and control the emergency core cooling systems to prevent fuel cladding temperatures from reaching 2200 °F. b. Respond to a need for emergency core cooling regardless of the physical location of the malfunction or break that causes the need. c. The following safety design bases are specified to limit dependence on operator judgment in times of stress:
1. The emergency core cooling systems shall respond automatically so that no action is required of plant operators within 10 minutes after a loss-of-coolant accident.
2. The performance of the emergency core cooling systems shall be indicated by control room instrumentation.
3. Facilities for manual control of the emergency core cooling systems shall be provided in the control room.

The controls and instrumentation for th e emergency core cooling systems are designed to conform to the regulatory re quirements shown on Tables 7.1-2, 7.1-5 and 7.1-6.

7.3.1.2 System Description The emergency core cooling system includes the following subsystems:

a. high-pressure core spray (HPCS) system, b. automatic depressurization (ADS) system, c. low-pressure core spray (LPCS) system, and

LSCS-UFSAR 7.3-2 REV. 13 d. low-pressure coolant injection (LPCI) mode of the residual heat removal (RHR) system. The purpose of ECCS instrumentation and controls is to initiate appropriate responses from the system to ensure that the fuel is adequately cooled in the event of a design-basis accident. The cooling pr ovided by the system restricts the release of radioactive materials from the fuel by preventing or limiting the extent of fuel damage following situations in which re actor coolant is lost from the nuclear system. The emergency core cooling systems instrumentation detects a need for core cooling systems operation, and the trip systems initiate the appropriate response. The ECCS piping arrangement around the reacto r vessel is shown in Figure 7.3-1. Successful core cooling for a specified line break accident, as follows, is depicted in Figure 7.3-2, for small line breaks:

a. The depressurization phase is accomplished by HPCS, ADS A, or ADS B. b. The low-pressure core coolin g phase is accomplished by LPCS, an two RHR pumps, or HPCS.

Similarly, the large break model uses the LPCS, HPCS, or the three RHR pumps for successful core cooling. 7.3.1.2.1 High-Pressure Core Spra y (HPCS) Instrumentation and Controls 7.3.1.2.1.1 Power Sources The instrumentation and control of the HPCS are powered by the 125-Vdc and 120-Vac Division 3 systems. The redundancy and separation of these systems are consistent with the redund ancy and separation of the ECCS instrumentation and control. Both of these systems are described in detail in Chapter 8.0. 7.3.1.2.1.2 Equipment Design The control and instrumentation components for the high-pressure core spray (HPCS) system are located outside the prim ary containment. Pressure switches and level transmitters used for HPCS initiation are located on racks in the reactor building. Cables connect the sensors to control circuitry in the relay logic cabinet. The system is arranged to allow a full flow functional test during normal reactor power operation; however, the controls are arranged so the system can operate automatically regardless of the test being conducted. The piping and LSCS-UFSAR 7.3-3 REV. 14, APRIL 2002 instrumentation diagram is shown in Drawing Nos. M-95 and M-141. The high-pressure core spray system operates as an isolated sy stem, independent of electrical connections to any other system except the normal a-c power supply. The HPCS system is designed to operate from normal offsite auxiliary power sources or from diesel generator 1B if of fsite power is not available. 7.3.1.2.1.3 Initiating Circuits Reactor low water level indicates that reactor coolant is being lost and that the fuel cladding temperature may be increasing. Drywell high-pressure indicates that a breach of the reactor coolant pressure boundary has occurred inside the drywell.

Reactor vessel low water level is monitored by an analog trip system consisting of four differential pressure transmitters and trip units. The transmitters measure the difference in water column heads between a static leg, which senses the constant head reference column created by a condensing chamber, and a variable leg, which senses actual water level changes in the vessel. Each transmitter sends an analog input signal to a trip unit. Instrumentation cables connect the transmitters to the trip units which are located in the relay logic cabinets. The logic is arranged in a one-out-of-two twice arrangement to assure that no single event can prevent HPCS initiation from reactor vessel low water level. The initiation logic for HPCS sensors is shown in Figure 7.3-4. Drywell pressure is monitored by four non-indicating pressure switches. Pipes that terminate outside the primary containment allow the switches to communicate with the drywell interior. Cables are routed from the switches to the relay logic cabinets. Each drywell high-pressure trip channel provides an input into the trip logic. The switches are electrically connected to a one-out-of-two twice circuit, so that no single channel can affect high drywell pr essure initiation of the HPCS. The HPCS controls automatically start th e HPCS diesel engine/generator set on receipt of a reactor vessel low water level signal or drywell high-pressure signal. The system reaches its design flow rate within 41 seconds. The controls then provides makeup water to the reactor vessel until the reactor high water level is reached, then the HPCS automatically stops flow by closing the injection valve. The controls are arranged to allow automatic or manual operation (see Subsection 7.3.1.2.1.4 for manual operatio n). The HPCS diesel generator provides power to the HPCS pump motor and the HPCS motor-operated valves if normal auxiliary power is lost. One AC operated pump suction valve is prov ided in the HPCS System. The valve lines up pump suction from the suppression pool. To position the valve a keylock LSCS-UFSAR 7.3-4 REV. 14, APRIL 2002 switch must be turned in the control room. Two level switches monitor the suppression pool high water level and eith er switch can provide an alarm in the control room to alert the operator. 7.3.1.2.1.4 Logic and Sequencing

Either reactor vessel low water level or high drywell pressure automatically starts the HPCS. Two reactor vessel low water level trip sett ings are used to initiate the ECCS. The first low water level setting, which is the higher of the two, initiates the HPCS. The second low water level setting, which is lower, initiates the LPCI, LPCS, and ADS. This setting also closes the main steamlin e isolation valves (see Subsection 7.3.2). The HPCS controls and instrumentation limits are listed in Table 7.3-1. The reactor vessel low water level setting for HPCS initiation is selected high enough to prevent excessive fuel cladding temperatu re and fuel failure, but low enough to avoid spurious HPCS startups. The drywell high-pressure setting is selected to be as low as possible without inducing spurious HPCS startup.

The HPCS control system logic can be reset if reactor water level has been restored even if the high drywell pressure condition persists. Following manual termination of pump operation HPCS will auto restart upon low reactor water level. However, auto restart is blocked on high drywell pressure unless drywell pressure decreases below the setpoint and again increases above the setpoint. A decrease in drywell pressure below trip level will remove all reset features and return HPCS logic to the original status. The HPCS pump is not stopped automatically by any reset. Pump stop requires operator action. 7.3.1.2.1.5 Bypasses and Interlocks A pump discharge bypass routes the pump discharge back to the suppression pool to prevent pump overheating at reduced HPCS pump flow. The bypass is controlled by an automatic motor-operated valve. At HPCS high flow, the bypass valve is closed; at low flow, the bypass valve is open ed. A flow switch measures the flow in the HPCS pump discharge pipeline. During test operation, the HPCS pump disc harge is routed to the suppression pool via a Motor-operated valve installed in th e test line. The piping arrangement is shown in Drawing Nos. M-95 an d M-141. On receipt of an HPCS initiation signal, the valve closes and will remain closed.

LSCS-UFSAR 7.3-5 REV. 13 7.3.1.2.1.6 Redundancy and Diversity The HPCS is actuated by redundant meas urements of either reactor vessel low water level or drywell high-pressure. Both of these conditions will result from a design-basis loss-of-coolant accident.

The HPCS system logic requires two independent water level measurements to concurrently indicate the high water leve l condition. When the high water level condition is reached following HPCS operation, these two signals are used to terminate further operation of the HPCS until such time as the low water level initiation setpoint is reached. Should th is latter condition reoccur, the HPCS will be initiated to restore water level within the reactor.

7.3.1.2.1.7 Actuated Devices All automatic valves in the HPCS system are equipped with remote-manual test capability. The entire system can be manually operated from the control room. Motor-operated valves are provided with limit switches to turn off the motor when the full open or closed positions are reached. Torque switches also control valve motor forces while the valves are seating. Thermal overload devices are used to trip motor-operated valves and to provide alarms. The HPCS valves must provide design flow rate within 41 seconds from receipt of the initiation signal. The operating time is the time required for the valve to travel from the fully closed to the full y open position, or vice versa. An a-c motor-operated HPCS pump discharge valve is provided in the pump discharge pipeline. The valve opens on receipt of the HPCS initiation signal. The pump discharge valve closes automatically on receipt of a reactor high water level signal. 7.3.1.2.1.8 Separation General Separation within the emergency core cooling system is such that no single occurrence can prevent core cooling when required. Control and instrumentation equipment wiring is segregated into three separate divisions designated l, 2, and 3 (Figure 7.3-3). Similar separation requirem ents are also maintained for the control and motive power required. System separation is as follows: LSCS-UFSAR 7.3-6 REV. 20, APRIL 2014 Division 1 Division 2 Division 3 Low-pressure core spray and RHR "A" RHR "B" and "C" High-pressure core spray

Automatic depres-Surization "A" Automatic depres-surization "B" Systems shown opposite each other are considered backup to each other. Control logic for all Division 1 systems is powe red by 125-Vdc bus A and for Division 2 system by l25-Vdc bus B. HPCS lo gic is powered by l25-Vdc bus C.

Specific HPCS is a Division 3 system (Figure 7.3-3). In order to maintain the required separation, HPCS logic relays, cabling, manual controls, and instrumentation are mounted so that separation from Divisions 1 and 2 is maintained. 7.3.1.2.1.9 Testability The high-pressure core spray instrumentation and control system is capable of being tested during normal unit operation to verify the operability of each system component. Testing of the initiation sensors which are located outside the drywell is accomplished by valving out the sensor s one at a time and applying a test pressure source. This verifies the operability of the sensor, instrument channel contacts as well as the trip setpoint. Adequate control room indications are provided. High-pressure core spray high water level sensors may be tested in a similar manner. Testing for functional operability of the control logic relays can be accomplished by use of plug-in test jacks and switches in conj unction with single sensor tests. Availability of other cont rol equipment is verified during manual testing of the system with the pump discharge returning to the suppression pool. While the plant is at power, water is not injected into the reactor vessel by the high-pressure core spray system during periodic testing. 7.3.1.2.1.10 Environmental Considerations The only HPCS control component located inside the drywell is the control mechanism for the testable check valve on the HPCS pump discharge line. The air operator is removed from check valve 2E 22-F005 and is replaced with a mechanism to pin the valve open for maintenance an d testing. All other HPCS control and instrumentation equipment is located outside the primary containment and is selected to meet the environmental considerations. The testable feature and related control and instrumentation equipment have been eliminated from the Division 1, Division 2, and Division 3, ECCS testable check valves. LSCS-UFSAR 7.3-7 REV. 15, APRIL 2004 7.3.1.2.1.11 Operational Considerations Under abnormal or accident conditions where the system is required, initiation and control are provided automatically for at least 10 minutes. At that time, operator action may be required. A detection system continuously confirms the integrity of the HPCS piping between the inside of the reactor vessel and the core shroud. A differential pressure switch measures the pressure difference between the top of the core support plate in a static channel and the inside of the core spray sparger pipe just outside the reactor vessel. If the HPCS sparger piping is sound, this pressure difference will be the small drop across the core resulting from in terchannel leakage. If integrity is lost, this differential pressure will also include the steam separator pressure drop. Increasing differential pressure initiates an alarm in the control room. Pressure in the HPCS pump suction pipeline is monitored by a pressure indica tor that is locally mounted to permit determination of suction head and pump performance. Numerous indications pertinent to the oper ation and condition of the HPCS system are available to the control room operator, as shown in Drawing Nos. M-95 and M-141. 7.3.1.2.2 Automatic Depressurization Sy stem (ADS) Instrumentation and Controls 7.3.1.2.2.1 Equipment Design Automatic relief valves are installed on the main steamlines inside the drywell. The valves can be actuated in three ways; they will relieve pressure by a pressure switch, or by mechanical actuation on high reactor pressure, or by actuation of an electric-pneumatic control system. The suppression pool provides a heat sink for steam relieved by these valves. Relief va lve operation may be controlled manually from the main control room to hold the desired reactor pressure. The depressurization by automatic blowdown is intended to reduce nuclear system pressure during a loss-of-coolant accident. The automatic depressurization system (see Figure 7.3-5) consists of redundant pressure and water level trip channels a rranged in separated logics that control separate solenoid-operated air pilots on ea ch valve. These pilot valves control the pneumatic pressure applied to an air cylin der operator. The operator controls the safety/relief valve. An accumulator is in cluded with the control equipment to store pneumatic energy for relief valve operation. For a description of the safety/relief valves and accumulators, refer to Section 5.2.2.4.2.1.

Cables from the sensors lead to two separate relay logic cabinets where the redundant logics are formed. Station batteries power the electrical control circuitry. The power supplies for the redundant control channels are separated to limit the LSCS-UFSAR 7.3-8 REV. 14, APRIL 2002 effects of electrical failures. Electrical elements in the control system energize to cause the relief valves to open. 7.3.1.2.2.2 Initiating Circuits Two ADS trip systems are provided, AD S A and ADS B (see Figure 7.3-6). Division 1 sensors for low reactor water level and high drywell pressure initiate ADS A, and Division 2 sensors initiate AD S B. The high drywell pressure signal can be automatically bypassed as described in Section 7.3.1.2.2.3. The relays of one logic are mounted in a different cabinet than the relays of the other logic. The reactor vessel low water level setting for the ADS is selected to depressurize the reactor vessel in time to allow adequate cooling of the fuel by the LPCI or LPCS system following a loss-of-coolant accident in which the HPCS fails to perform its function adequately. The drywell high-pressure setting is selected as low as possible without inducing spurious initiation of the automatic depressurization system. This provides timely depressuriza tion of the reactor vessel if the HPCS fails to start or fails after it successfully starts followi ng a loss-of-coolant accident. The low-pressure pump discharge pressure setting used as a permissive for depressurization is selected to assure that at least one of the three LPCI pumps or the LPCS pump has received electrical power, started, and is capable of delivering water into the vessel. The setting is high enough to assure that the pump will deliver at near rated flow without being so low as to provide an erroneous signal that the pump is actually running. The low-pressure pump discharge pressure pump permissive is not required for emergency manual initiation of the system. The pressure and level transmitters/trip units used to initiate one ADS logic are separated from those used to initiate th e other logic on the same ADS valve. Reactor vessel low water level is monitored by an analog trip system consisting of six differential pressure transmitters and trip units. The transmitters measure the difference in water column heads between a static leg, which senses the constant head reference column created by a conden sing chamber, and a variable leg, which senses actual water level changes in the vessel. The transmitters send an analog input signal to the trip units. Drywell high-pressure is detected by four pressure switches, which are located in the secondary containment. The level instruments are piped so that an instrument pipeline break will not inadvertently initiate auto blowdown. The drywell high-pressure signals are bypassed after a time delay as discussed in Section 7.3.1.2.2.3.

LSCS-UFSAR 7.3-9 REV. 14, APRIL 2002 An ADS initiation timer is used in each ADS logic. The time delay setting before actuation of the ADS is long enough that the HPCS has time to operate, yet not so long that the LPCI and LPCS systems are unabl e to cool the fuel adequately if the HPCS fails to start. An alarm in the control room is annunciated when either of the timers is timing. Resetting the ADS initiation signals recycles the timers.

7.3.1.2.2.3 Logic and Sequencing Three initiation signals are used for the ADS: reactor vessel low water level, drywell high-pressure, and confirmed reactor vessel low water level. Reactor vessel low water level indicates that the fuel is in danger of becoming uncovered. The second (lower) low water level initiates th e ADS. Drywell high-pressure indicates a breach in the reactor coolant pressure boundary inside the drywell. An ADS high drywell pressure bypass timer is started after receipt of RPV level 1 signal. The RPV level 1 signal also initiates a alarm that the bypass logic has been activated. After the ADS high drywell pressure bypass timer time delay, relay contacts bypass the high drywell signal, effecting the bypass. The ADS initiation timer is now started and after runout the ADS solenoid is energized provided that at least one low pressure pump in that divi sion is running. If the lo w water level signal clears, or the reset pushbutton is pressed, the timers are automatically reset. This logic will automate ADS initiation, if required, fo r events such as a break external to the drywell or a stuck open SRV. A manual inhibit switch is also provided in each division to allow the operator to inhibit the system without repeatedly pressing the reset button. This manual inhibit is annunciated in the main control room. Discharge pressure on any one of the three LPCI pumps or the LPCS pump is sufficient to give the permissive signal which permits automatic depressurization when the LPCI and LPCS systems are operable. The ADS instrument limits are listed in Table 7.3-1 After receipt of the initiation signals and after the delay provided by timers, each of the two solenoid pilot air valves are energized. This allows pneumatic pressure from the accumulator to act on the air cylinder operator. The air cylinder operator holds the relief valve open. Lights in the main control room indicate when a safety/relief valve is open or closed.

The ADS A trip system actuates the "A" so lenoid pilot valve on each ADS valve. Similarly, the ADS B trip system actuates the "B" solenoid pilot valve on each ADS valve. Actuation of either solenoid-pilot valve causes the ADS valve to open to provide depressurization. Manual reset circuits are provided for the ADS initiation signal and drywell high-pressure signals. Manually resetting the initiation signal recycles the delay timers. One control switch is available in the co ntrol room for each safety/relief valve associated with the ADS. These manual switches backup the automatic LSCS-UFSAR 7.3-10 REV. 14, APRIL 2002 depressurization function by activating a separate solenoid control valve on the safety/relief valves. The switch is a two-position type OPEN-AUTO. The OPEN position is for manual safety/relief valve operation. Manual opening of the relief valves provides a controlled nuclear syst em cooldown under conditions where the normal heat sink is not available. Va lve numbers B21-F013 H, K, and P can be operated from the remote shutdown panel. ADS valves can be operated from the individual ADS logic relay panels. 7.3.1.2.2.4 Bypasses and Interlocks It is possible for the operator to inhibit the ADS system with the manual inhibit switch. The operator would make this de cision based on an assessment of other plant conditions. ADS is interlocked with the LPCS and RHR by means of pressure switches located on the discharge of thes e pumps. These are the "AC interlocks". Although the AC interlocks are common to both automatic ADS initiation circuits, the independence of the automatic initiation trip circuits is not compromised because each of the logics is duplicated (ADS A and ADS B). For a failure of the ADS to occur, the AC interlocks for both trip circuits would have to fail. At least one of the three LPCI pumps or the LPCS pump must be capable of delivering water into the vessel for automatic ADS initiation to occur. The AC interlocks are not

associated with the manual ADS initiation circuits. 7.3.1.2.2.5 Redundancy/Diversity The ADS is initiated by high drywell pressure and low reactor vessel water level. The high drywell pressure signal can be automatically bypassed as described in Section 7.3.1.2.2.3. The initiating circuits for each of these parameters are redundant as verified by the circuit description of this section. Instrument limits are listed in Table 7.3-1 according to system functions 7.3.1.2.2.6 Actuated Devices All relief valves in the ADS are actuated by four methods:

a. automatic action resulting from the actuation of logic chains in either Division 1 or Division 2 trip system
b. manual action by the operator, c. pressure switch contacts closing as a result of high reactor pressure, and

LSCS-UFSAR 7.3-11 REV. 13 d. mechanical actuation as a result of high reactor pressure (higher than pressure in item c). ADS is a Division 1 (ADS A) and Division 2 (ADS B) system, except that only one set of relief valves is supplie

d. Each relief valve can be actuated by either of two solenoid pilot valves supplying air to the relief valve air piston operators. One of the solenoid pilot valves is operated by tr ip system A and the other by trip system B. Logic relays, manual controls, and instrumentation are mounted so that Division 1 and Division 2 separation is maintained. Separation from Division 3 is likewise maintained.

7.3.1.2.2.7 Testability

ADS has two complete trip systems, one in Di vision 1 and one in Division 2. Each trip system has two channels, both of which must operate to initiate ADS. One channel contains a timer to delay ADS to gi ve HPCS an opportunity to start. Four test jacks are provided, one for each channel. To preven t spurious actuation of ADS during testing, only one channel is actuated at a time. An alar m is provided if a test plug is inserted in both channels in a division at the same time. Operation of the test plug switch and the permissive co ntacts closes one of the two series relay contacts in the valve solenoid circuit. This causes a light to extingush indicating proper channel operation. Continuity of the solenoid electrical circuit is demonstrated by a set of indicating lamps which are "on" when solenoid continuity exists. Testing of the other channel is similar. Annunc iation is provided in the control room whenever a test plug is inserted in a jack to indicate to the operator that ADS is in a test status. Testing of ADS does not interfere with automatic operation if it is required by an initiation signal.

7.3.1.2.2.8 Environm ental Considerations The signal cables, solenoid valves, and safety/relief valve operators are the only control and instrumentation equipment for the ADS located inside the drywell. These items will operate in the most severe environment resulting from a design-basis loss-of-coolant accident (see Table 3.11-l). Gamma and neutron radiation is also considered in the selection of these items. Equipment located outside the drywell will also operate in normal and accident environments. 7.3.1.2.2.9 Operational Considerations The instrumentation and controls of the ADS are not required for normal plant operations. When automatic depressurization is required, it is initiated automatically by the circuits described in this section. No operator action is required for at least 10 minutes following initiation of the system.

LSCS-UFSAR 7.3-12 REV. 13 At LSCS Unit 1, an electromechanical lift indicating assembly is directly mounted atop the SRV. It has its own housing which mechanically mates to the valve bonnet. A reverse-spring-loaded actuator rod rides the end of the valve spindle rod to directly transmit valve motion relative to the valve seating surface. Valve position (fully open, intermediate or fully closed) is sensed by a spindle mounted, positive acting reed-switch arrangement.

Electrical outputs from the reed-switches are fed to the control room to remotely indicate SRV position there. Event annunc iation is also provided in the control room. Environmental and seismic qualification of the position sensor reed-switch arrangement was completed in October, 1985. This sensor is qualified to IEEE 323-1974 and IEEE 344-1975 standards. A new generation position indication system, which is an LVDT incorporated into a setpoint verification assembly, is installed on LSCS Unit 2 and were qualified in March, 1985. A confirmatory indication of SRV popping or long trend leakage is provided via temperature elements mounted in thermowells on each of the SRV blowdown pipes to the suppression pool. These indications are for back-up confirmation of the direct indicating SRV position read-outs. The temperature element is connected to a multipoint recorder in the control room to provide a means of detecting safety/relie f valve leakage during plant operation. When the temperature in any safety/relief valve discharge pipeline exceeds a preset value, an alarm is sounded in the control room. The alarm setting is high enough above normal rated power drywell ambient temperatures to avoid spurious alarms, yet low enough to give early indication of safety/relief valve leakage. Drawing Nos. M-93 (sheets 3 through 5), M-139 (sheets 3 through 5), M-55 (sheet 7), and M-116 (sheet 7) show other ADS alarms. 7.3.1.2.2.10 Low-Low Setpoint Relief Logic In order to reduce as far as practicabl e the number of relief valves that reopen following a reactor isolation event, seven safety relief valves are provided with lower opening and closing setpoints. These setpoints override the normal setpoints following the initial opening of the relief va lves and act to hold these valves open longer, thus preventing more than a sing le valve from reopening subsequently. This system logic is referred to as the low-low setpoint relief logic and functions to minimize the containment design load. This logic is armed when two or more valves are signaled to open from their normal relief pressure switches. At this time, the low-low set logic automatically seals itself into control of the seven selected valves and actuates the annunciator. This logic remains sealed in until manually reset by the operator. The schematic diagrams for the automatic depressurization system are shown in Drawings 1E 4201AA through AR and 1E-2-4201AA through LSCS-UFSAR 7.3-13 REV. 14, APRIL 2002 AR and contain logic for low-low set. Th is logic has been added as a product improvement to improve load margins and is not required to accommodate containment loads as defined by the NRC in NUREG-0487. The two lowest low-low set valves are th e same valves used for the lowest SRV pressure group. Since the valves will already have opened from their original pressure relief signals, the low-low set logic acts to hold them open past their normal reclose point until the pressure decreases to a predetermined "low-low" setpoint, likewise with the remaining five low-low set valves after they have first been opened at their original setpoints. T hus these valves remain open longer than the other safety/relief valves. This extended relief capacity assures that no more than one valve will reopen a second time. Also, the sealed-in logic provides the first two low-low set valves ("low" and "medium") with new reopening setpoints which are lower than their original S/R setpoints. The "medium" low-low set valve acts as a backup for the "low" low-low set valve, should it mechanically fail. The low-low set logic is designed with redundancy and single failure criteria, i.e., no single electrical failure will: (1) prevent any low-low set valve from opening, (2) cause inadvertent seal-in of low-low set logi c, or (3) cause more than one valve to open inadvertently or stick open.

The seven valves associated with low-lo w set are arranged in three independent secondary setpoint groups or ranges (low, medium, high). The "low" and "medium" pressure ranges consist of one valve ea ch, having both "reopen" and "reclose" setpoints independently and uniquely adjustable. These are set considerably lower than their normal SRV setpoints. The re maining five valves are individually controlled by new pressure switches which have an independently adjustable "reclose" setpoint. The normal SRV opening setpoints are retained for this valve group though reclose is extended in the low-low set operating mode. The pressure switches are arranged in two divisions for each low-low set valve. The single-failure criterion is thus met for this function. 7.3.1.2.2.11 Low-Low Setpoint Relief Logic Testability The SRV system has two low-low setpoint logics, one in Division 1 and one in Division 2. Either one can perform the low-low set function. Each valve has its own set of pressure switches. A keylock switch, which has a "Normal" and a "Test" position, is provided for each division. The key is removable only in the "Normal" position. When the key is inserted and switched to "test", an annunciator will alert the operator of the test status of that division. In the test mode, all of the valves remain responsive to the high reactor pressure signals should they occur. Indicator lights are switched in series with the solenoid coils on the low-low set valve to facilitate logic testing without actuating th e valves from the division under test. The annunciator will not clear until the ke y is returned to the "Normal" position. LSCS-UFSAR 7.3-14 REV. 14, APRIL 2002 7.3.1.2.3 Low-Pressure Core Spray (LPCS) Instrumentation and Controls 7.3.1.2.3.1 Equipment Design The low-pressure core spray (LPCS) system supplies sufficient cooling water to the reactor vessel to cool the core adequately following a design-basis loss-of-coolant accident. The LPCS includes one a-c pump, appropriate valves, and piping to route water from the suppression pool to the reactor vessel (see Drawing No. M-94 and M-140). Sensors and valve closing mechan isms for the LPCS system are located outside the primary containment. Cables fr om the sensors are routed to relay logic cabinets where the control circuitry is assembled. The LPCS pump and automatic valves are powered from an a-c bus that is capable of receiving standby power. Control power for the LPCS comes from a station battery. Control and motive power for the LPCS is from the same source as for LPCI Loop A. 7.3.1.2.3.2 Initiating Circuits Two reactor vessel low water level transmitters/trip units and two drywell high-pressure switches are electrically connected in a one-out-of-two twice arrangement so that no single event can prevent initiation of LPCS. Reactor vessel low water level is monitored by an analog trip system consisting of two differential pressure transmitters and trip units. The transmitters measure the difference in water column heads between a static leg, which senses the constant head reference column created by a conden sing chamber, and a variable leg, which senses actual water level changes in the vessel. The transmitters send an analog input signal to the trip units which are located in the relay logic cabinets. Drywell pressure is monitored by two noni ndicating pressure switches mounted on instrument racks outside the primary cont ainment. Pipes that terminate outside the primary containment allow the switches to communicate with the drywell interior. Cables are routed from the switches to the relay logic cabinets. Each drywell high-pressure trip channel provides an input into the initiation logic shown in Figure 7.3-6. Instrument limits are listed in Table 7.3-1 according to system functions. 7.3.1.2.3.3 Logic and Sequencing The LPCS initiation logic is depicted in Figure 7.3-6 in a one-out-of-two twice network using level and pressure sensors. The initiation signal will be generated when: LSCS-UFSAR 7.3-15 REV. 13 a. both level sensors are tripped, b. both pressure sensors are tripped, or

c. either of two other combinations of one level sensor and one pressure sensor is tripped.

Once an initiation signal is received by the LPCS control circuitry, the signal is sealed in until manually reset. 7.3.1.2.3.4 Bypasses and Interlocks A minimum flow bypass pipeline is provided to protect the main system pump from overheating at low flow rates. The pump routes water from the pump discharge to the suppression pool. A motor-operated va lve controls the flow through the bypass line. Low flow in the pump discharge line automatically opens th e bypass valve if the pump is running. The valve automatica lly closes when the pump discharge is above the low flow setting. Flow sensing is derived from a flow switch that senses the pressure differential across a flow element in the pump discharge line. Drawing Nos. M-94 and M-140 show the loca tion of the flow switch. Two pressure switches are installed in the pump discharge pipeline upstream of the pump discharge check valve. This pressure signal is used in the automatic depressurization system to indica te that the LPCS pump is running. 7.3.1.2.3.5 Redundancy and Diversity

The LPCS is actuated by either reactor vessel low water level and/or drywell high-pressure. Both of these conditions will result from a design-basis loss-of-coolant accident. As described in Subsection 7.3.1.2.3.3, if one low level instrument channel fails, the high drywell pressure instrument channels will initiate LPCS or a combination of low level and drywell pressure. LPCS is a single pump system but is backed up by LPCI A within ECCS Division l.

Division 1 systems (LPCS, LPCI A) and Di vision 2 systems (LPCI B, LPCI C) are provided further backup by the Division 3 HPCS. 7.3.1.2.3.6 Actuated Devices The LPCS pump can be controlled by a control room remote switch or by the automatic control system.

Motor-operated valves are provided with limit switches to turn off the motor when the full open or full close positions are reached. Torque switches are also provided to control valve motor forces when valves are closing. Thermal overload devices are LSCS-UFSAR 7.3-16 REV. 20, APRIL 2014 used to trip motor-operated valves and to provide alarms. All motor-operated valves have limit switches that provide co ntrol room indication of valve position. Each automatic valve can be operated from the control room. The LPCS system pump suction valve to the su ppression pool is normally open. To position the valve, a keylock switch must be turned in the control room. On receipt of an LPCS initiation signal, the LPCS test line valve is signaled to close (it is normally closed during operation) to ensure that the main system pump discharge is correctly routed. The LPCS injection valve opens upon receipt of an automatic injection signal if reactor pressure is below th e low pressure ECCS interloc k setpoint. This reactor low pressure interlock is prov ided by three pressure switches arranged in a one-out-of-two plus one-out-of-one logic arrangement for the LPCS. The injection valve may be opened manually (by remote manual switch) when the pressure between the LPCS injection valve and the LPCS check valve and Reactor pressure drops below the same setpoint. Control logic is pr ovided to allow throttling of the LPCS injection flow for long-term cooling purposes after an accident. 7.3.1.2.3.7 Separation LPCS is a Division 1 system. In order to maintain the required separation, LPCS logic relays, manual controls, cabling and instrumentation are mounted so that separation from Divisions 2 and 3 is maintained. 7.3.1.2.3.8 Testability

The LPCS is capable of being tested during normal operation. Pressure and low water level initiation sensors are individually valved out of service and subjected to a test pressure. This verifies the operability of the sensor, instrument channel contacts as well as the trip setpoint. Other control equipment is functionally tested during manual testing of each loop. Adeq uate indications in the form of panel lamps, annunciators, and printed computer ou tput are provided in the control room.

7.3.1.2.3.9 Environm ental Considerations The only control component pertinent to LPCS system operation that is located inside the primary containment is the control mechanism for the air-operated check valve on the LPCS injection line. The ai r operator is removed from check valve 2E21-F006 and is replaced with a mechanism to pin the valve open for maintenance and testing. Other equipment, located outs ide the primary containment, is selected in consideration of the normal and accident environments in which it must operate. LSCS-UFSAR 7.3-17 REV. 13 7.3.1.2.3.10 Operational Considerations When the LPCS is required for abnormal and accident conditions, it is initiated automatically, and no operator action is required. Sufficient temperature, flow, pressure, and valve position indications are available in the control room for the operator to accurately assess LPCS system operation. Valves have indications of full open and full closed positions. The pump has indications for pump running and pump stoppe

d. Alarm and indication devices are shown in Drawing No. M-94 and M-140.

7.3.1.2.4 Low-Pressure Coolant Inject ion (LPCI) Instrumentation and Controls

7.3.1.2.4.1 Equipment Design Low-pressure coolant injection (LPCI) is an operating mode of the residual heat removal (RHR) system. The RHR system and its operating modes are discussed in Chapter 6.0. Because the LPCI system is designed to provide water to the reactor vessel following the design-basis loss-of-coolant accident, the controls and instrumentation for it are discussed here.

Drawing Nos. M-96 and M-142 show the entire RHR system, including the equipment used for LPCI operation. Cont rol and instrumentation for the following equipment is essential:

a. three RHR main system pumps, b. pump suction valves, c. LPCI injection valves, d. vessel level transmitters/trip units
e. drywell pressure switches, and
f. vessel pressure switches.

The instrumentation to operate LPCI also positions appropriate valves in the RHR system. This ensures that the water pumped from the suppression pool by the main system pumps is routed directly to the reactor. These interlocking features are described in this subsection.

LPCI operation uses three pump loops, each loop with its own separate vessel injection nozzle. Drawing Nos. M-96 and M-142 show the locations of instruments, LSCS-UFSAR 7.3-18 REV. 14, April 2002 control equipment, and LPCI components. Components pertinent to LPCI operation are located outside the primary containment. Power for the LPCI system pumps is supplied from a-c buses that can receive standby a-c power. Two pumps are powered from one bus and the third pump from the other bus, which also powers the LPCS. Motive power for the automatic valves comes from the bus that powers the pumps for that loop. Control power for the LPCI components comes from the d-c buses. Trip channels for LPCI A are shown in Figure 7.3-6. Trip channels for LPCI B and LPCI C are shown in Figure 7.3-4. LPCI is arranged for automatic and remote-manual operation from the control room. 7.3.1.2.4.2 Initiating Circuits LPCI A LPCI A is initiated from the LPCS logic circuit s, described in Subsection 7.3.1.2.3.2. LPCI B and C

Reactor vessel low water level is monitored by two level transmitters mounted on instrument racks outside the primary containment that measure the difference in water column heads between a static leg, which senses the constant head reference column created by a condensing chamber, and a variable leg, which senses actual water level changes in the vessel. Each transmitter sends an input signal to an analog trip unit located in the relay logic cabinet. Instrumentation cables connect the level transmitters to the trip units.

Drywell pressure is monitored by two noni ndicating pressure switches mounted on instrument racks outside the primary containment. Pipes that terminate outside the primary containment allow the switches to communicate with the drywell interior. Cables are routed from the switches to th e relay logic cabinets. Each drywell high-pressure trip channel provides an input into the initiation logic shown in Figure 7.3-

4. The two level analog trip units and two pressure switches are electrically connected in a one-out-of-two twice arrangement so that no single event can prevent initiation of LPCI B and C.

Drawing Nos. M-96 and M-142 ca n be used to determine the schematic location of sensors. Instrument characteristics and limits are given in Table 7.3-1. 7.3.1.2.4.3 Logic and Sequencing The overall LPCI operating sequence following the receipt of an initiation signal is as follows: LSCS-UFSAR 7.3-19 REV. 13

a. The valves in the suction paths from the suppression pool are kept open and require no automatic action to line up suction.
b. If normal auxiliary power is available, the three LPCI system pumps start immediately, taking suction from the suppression pool. In the event the normal auxiliary power is lost, standby power sources become available, and one of the LPCI system pumps on one of the two buses st arts immediately. The other pump on each bus starts after a 5-second delay to limit the loading of the power sources.
c. Valves used in other RHR modes are automatically positioned so the water pumped from the suppression pool is routed correctly.
d. When nuclear system pressure has dropped to a value at which the LPCI system pumps are capable of injecting water into the vessel, the LPCI injection valves automatically open.
e. The LPCI loops then deliver water to the reactor vessel until vessel water level is adequate to provide core cooling.

After an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset. 7.3.1.2.4.4 Bypasses and Interlocks

To protect the main system pumps from overheating at low flow rates, a minimum flow bypass pipeline is provided that routes water from the pump discharge to the suppression pool. A motor-operated valve controls the condition of each bypass pipeline. The minimum flow bypass valve automatically opens on sensing low flow in the discharge lines from each pump, if the pump is running. The valve automatically closes when the flow from the associated pump is above the low flow setting. Flow indications are derived from flow switches that sense the pressure differential across a flow element in the pump discharge lines. Drawing Nos. M-96 and M-142 show the location of the flow sw itches. One switch is used for each pump. The valves that divert water for containment cooling cannot be opened by manual action (except for testing during normal operation) unless two conditions exist: the accident initiation and containment pressure signals must be present, indicating

the possible need for containment cooling, and the LPCI respective injection valves must be shut. LSCS-UFSAR 7.3-20 REV. 14, APRIL 2002 Two pressure switches are installed in each pump discharge pipeline to verify that pumps are operating following an initiation signal. The pressure signal is used in the automatic depressurization system to verify availability of low-pressure core cooling. 7.3.1.2.4.5 Redundancy and Diversity The LPCI is actuated by either reactor vessel low water level or drywell high-pressure. Both of these conditions will result from a design-basis loss-of-coolant accident. As described in Subsection 7.3.1.2.3.2, if one low level instrument channel fails, the high drywell pressure or a combination of low level and drywell pressure instrument channels will initiate LPCI.

LPCI A initiation logic is common to the LPCS and is separated from the initiation logic for LPCI B and LPCI C. Each initiati on logic uses the sa me one-out-of-two twice form; however, one trip system uses only Division 1 sensors (LPCI A), and the other trip system uses only Division 2 sensors (LPCI B, LPCI C). Each trip system consists of two level switches and two drywell high-pressure instrument channels connected into a one-out-of-two twice configuration.

7.3.1.2.4.6 Actuated Devices LPCI system pumps start immediately if normal auxiliary power is available or are delayed as described in Subsection 7.3.1.2. 4.3. The time delays are provided by timers (see Table 8.3-1). The delay times for the pumps to start when normal a-c power is not available include time for the start signal to develop after the actual reactor vessel low water level or drywell high-pressure occurs, time for the standby

power to become available, and a sequencing delay to prevent overloading the source of standby power. The total delay times from the time of the accident to the start of the main system pumps are: Pu mp A, 18 seconds; Pump B, 18 seconds; and Pump C, 13 seconds. If normal power is available, there is no delay time to all three pump motors. The operator can also control the pumps manually from the main control room. The main system pump motors are provided with overload protection. The overload relays maintain power on the motor as lo ng as possible without harming the motor or jeopardizing the emergency power system. All automatic valves used in the LPCI function are equipped with remote/manual test capability. The entire system can be operated from the control room. Motor-operated valves have limit switches to turn off the motor when the full open or full closed positions are reached. Torque swit ches are also provided to control valve motor forces when valves are closing. Thermal overload devices are used to trip motor-operated valves and to provide al arms. Valves that also have primary LSCS-UFSAR 7.3-21 REV. 14, APRIL 2002 containment and reactor vessel isolat ion requirements are described in Subsection 7.3.2. The LPCI system pump suction valves from the suppression pool are normally open. To reposition the valves, a keylock switch must be turned in the control room. On receipt of an LPCI initiation signal, certain RHR system valves (for example RHR test line valves) are signaled to close (although they are normally closed) to assure that the LPCI system pump discharge is correctly routed. Valves that, if not closed, would permit the main system pumps to take suction from the reactor recirculation loops, a lineup used during normal shutdown cooling system operation will close on a shutdown cooling isolation signal (Secti on 7.3.2). The RHR pump suction from the suppression pool must be manually realigned for LPCI operation if the system is operating in the shutdown cooling mode. Each LPCI injection valve opens upon receipt of an automatic injection signal if reactor pressure is below th e low-pressure ECCS interloc k setpoint. This reactor low-pressure interlock is prov ided by three pressure switches arranged in a one-out-of-two plus one-out-of-one logic arrangement for each LPCI loop. The respective injection valve may be opened manually (by remote manual switch) when the pressure between the LPCI injection valve and its check valve and Reactor pressure drops below the same setpoint. The control circuitry cancels the LPCI open signal to the heat exchanger bypass valves after these valves reach the full open position. The signal cancellation allows the operator to control the flow through the heat exchangers for other postaccident purposes. Cancelling the open signal does not cause the bypass valves to close. 7.3.1.2.4.7 Separation LPCI is a Division 1 (RHR A) and Division 2 (RHR B and C) sy stem. In order to maintain the required separation LPCI lo gic relays, manual controls, cabling, and instrumentation are mounted so that Divisions 1 and 2 separation is maintained. Separation from Division 3 is likewise maintained. 7.3.1.2.4.8 Testability The LPCI is capable of being tested during normal operation. Pressure and low water level initiation sensors are individually valved out of service and subjected to a test pressure. This verifies the operability of the sensor, instrument channel contacts as well as the trip setpoint. Other control equipment is functionally tested during manual testing of each loop. Adeq uate indications in the form of panel lamps and annunciators are prov ided in the control room. LSCS-UFSAR 7.3-21a REV. 20, APRIL 2014 7.3.1.2.4.9 Environm ental Considerations The only control components pertinent to LPCI operation that are inside the drywell are those controlling the air-operated test feature on check valves in the injection lines. These air operators are removed from check valves 2E12-F041A/B/C and are replaced with mechanisms to pin the valves open for maintenance and testing. Other equipment, located outside the primary containment, is selected in consideration of the normal and accident environments in which it must operate. LSCS-UFSAR 7.3-22 REV. 13 7.3.1.2.4.10 Operational Considerations The pumps, valves, piping, etc., used for the LPCI are used for other modes of the RHR. Initiation of the LPCI mode is automa tic, and no operator action is required for at least 10 minutes. The operator may control the RHR manually after initiation to use its capabilities in the ot her modes of the RHR if the core is being cooled by other emergency core cooling systems.

Sufficient temperature, flow, pressure, and valve position indications are available in the control room for the operator to accurately assess LPCI operation. Valves have indications of full open and full closed positions. Pumps have indications for pump running and pump stopped. Alarm and indications devices are shown in Drawing Nos. M-96 and M-142. LSCS-UFSAR 7.3-23 REV. 14, APRIL 2002 7.3.1.2.5 Low-Pressure Systems Interlocks The low-pressure systems which interface with the reactor coolant pressure boundary and the instrumentation which protects them from overpressurization are as follows: RHR System Type Valve Parameter Sensed Function Recirculation Suction MO MO E12-F009 E12-F008 Reactor pressure Reactor pressure Prevents valve from opening until reactor pressure is low Recirculation Discharge Check MO E12-F050 E12-F053 Reactor pressure Reactor pressure Prevents backflow Prevents valve from opening until reactor pressure is low Vessel discharge Check MO E12-F041 E12-F042 Reactor pressure Reactor pressure Prevents backflow Maintains valve closed until reactor pressure is low Head spray Check MO E12-F019 E12-F023 Reactor pressure Reactor pressure Prevents backflow Prevents valve opening until pressure is low LPCS system spray sparger Check MO E21-F006 E21-F005 Reactor pressure Reactor pressure Prevents backflow Maintains valve closed until reactor pressure is low

At least two valves are provided in series in each of these lines. The recirculation suction valves have independent and divers e interlocks to prevent the valves from being opened when the primary system pressure is above the subsystem design pressure. These valves also receive a signal to close when reactor pressure is above system pressure. The RHR system head spray motor-operat ed valve and RHR system recirculation discharge valves, 1(2)E12-F053, are interl ocked to prevent valve opening whenever the primary pressure is above the subsystem design pressure and automatically closes whenever the primary system pr essure exceeds the subsystem design pressure LSCS-UFSAR LU2000-017 7.3-24 REV. 14, APRIL 2002 Valve 1(2)E12 -F053A must operate for long-term cooling and has a shutdown cooling return check valve E12-F050 downstream. There is a relief valve E12-F025 that will handle the leakage of the closed check valve. The RHR system vessel discharge valve E12-F042 must operate for short-term cooling. This valve opens on low reactor pressure and must start opening above system design pressure to fulfill the flooding function. This valve is the fastest opening valve available and has a remote LPCI injection check valve downstream. The LPCS system sparger valve E2l-F005 must operate for core flooding. This valve opens on low reactor pressure and must st art opening above system design pressure to fulfill the flooding function. This valve is the fastest opening valve available and has a LPCS injection check valve downstream. Position indication is provided in the control room for the motor operated valves. 7.3.1.2.6 Design-Basis Information IEEE Standard 279-1971 defines the requiremen ts for design basis. Using the IEEE-279 format, the following subsecti ons fulfill this requirement: Conditions The generating station conditions which require protective action for PCRVICS and ECCS are identified in the technical specifications. Variables The generating station variables which require monitoring to provide protective actions are identified in the technical specifications. Number of Sensors and Location Minimum number of sensors and schematic locations required to monitor safety-related variables are identified in Tabl es 7.3-6 through 7.3-11 for minimum number and Figures 7.3-3, 7.3-6, 7.3-8, 7.3-9, and Drawing No. M-153, sheets 1 and 6. Operational Limits Prudent operational limits for each safety-related variable are shown in the technical specifications. Margin Between Operational Limits The margin between operational limits and the level determining the onset of unsafe conditions is given in th e technical specifications. LSCS-UFSAR 7.3-25 REV. 14, APRIL 2002 Levels Requiring Protective Action Levels requiring protective action are stated in the technical specifications. Range of Energy Supply and Environmental Conditions of Safety Systems

See Subsections 3.1. 2.1.4 and 7.3.6. Malfunctions, Accidents, and Other Unusual Events Which Could Cause Damage to Safety Systems See Subsection 7.3.1.3.2.

Minimum Performance Requirements See Tables 7.3-1, 7. 3-2, and 7.3-3. 7.3.1.2.7 Final System Drawings The final system drawings for the ECCS are shown on electrical schematics and the following referenced figures and drawings: RHR/LPCI F6.3-8, M-96, M-142

HPCS F7.3-4, M-95, M-141 LPCS F7.3-6, M-94, M-140 ADS F7.3-6, M-55, M-93, M-116, M-139

7.3.1.3 Analysis 7.3.1.3.1 General Function al Requirement Conformance Chapters 6.0 and 15.0 contain evaluations of individual and combined capabilities of the emergency cooling systems. For the entire range of nuclear process system break sizes, the cooling systems prevent fu el cladding temperatures from exceeding 2200°F since the capabilities of the individual emergency core cooling loops overlap. Instrumentation for the emergency core cooling systems must respond to the potential inadequacy of core cooling regard less of the location of a breach in the reactor coolant pressure boundary. Such a breach inside or outside the containment is sensed by reactor low water level. The reactor vessel low water level signal is the LSCS-UFSAR 7.3-26 REV. 13 only emergency core cooling system initiating function that is completely independent of breach location. Consequently, it can actuate HPCS, LPCS, and LPCI. The other major initiating function, drywell high-pressure, is provided because pressurization of the drywell will result fr om any significant nuclear system breach anywhere inside the drywell. Initiation of the automatic depressurization system, employs both reactor vessel low water level and drywell high pressure. The high drywell pressure will be bypassed after a time delay to automatically initiate ADS for events such as a breach outside the drywell.

An evaluation of emergency core cooling systems controls shows that no operator action is required to initiate the correct responses of the emergency core cooling systems. However, the control room oper ator can manually initiate every essential operation of the emergency core cooling systems. Alarms and indications in the control room allow the operator to interpret any situation that requires the emergency core cooling system and verify the responses of each system. This arrangement essentially eliminates safety dependence on operator judgment, and design of the emergency core cooling sy stems control equipment has appropriately limited response. The general control room panel arrangement is shown in Figure 7.3-12. The redundance of the control equipment for the emergency core cooling systems is consistent with the redundancy of the cooling systems themselves. The arrangement of the initiating signals for the emergency core cooling systems, as shown in Figures 7.3-4 and 7.3-6 is also consistent with the arrangement of the systems themselves. Each system, including its initiating sensors, is separated from the other systems within the network of emergency core cooling systems. No failure of a single initiating trip channel can prevent the start of the cooling systems or inadvertently initiate these same systems.

An evaluation of the control schemes for each emergency core cooling system component shows that no single control failure can prevent the combined cooling systems from providing the core with adequate cooling. In performing this evaluation the redundancy of components and cooling systems was considered. The minimum number of trip channels requir ed to maintain functional performance is given in Tables 7.3-7, 7. 3-8, 7.3-9, and 7.3-10. Determinations of these minimums considered the use and redundancy of sensors in control circuitry and the relative reliability of the controlled equipment in any individual cooling system.

LSCS-UFSAR 7.3-27 REV. 13 Because the control arrangement used for the automatic depressurization system is designed to avoid spurious actuation, the information in Table 7.3-8 is worth special consideration. The ADS relief valves are controlled by two trip systems. The conditions indicated by the table result in both trip systems always remaining capable of initiating automatic depressuriza tion. If an inoperable sensor is in the tripped state or if a synthetic trip signal is inserted in the control circuitry, automatic depressurization can be initiated when the other initiating signals are received. The prohibition against simult aneously inoperative reactor vessel low water level and drywell high-pressure trip channels in any one trip logic is necessary to prevent situations where a tr ip logic is continuously in the tripped condition. The trip channel conditions indicated in Table 7.3-8 avoid these undesirable situations.

The conditions represented by Tables 7.3-7, 7.3-8, 7.3-9, and 7.3-10 are a result of a functional analysis of each individual em ergency core cooling system. Because of the redundant methods of supplying cooling water to the fuel in a loss-of-coolant accident situation and because fuel cooling must be assured in such a situation, the minimum trip channel conditions in the re ferenced tables exceed those required operationally to assure core cooling capability.

The only protection devices that can interrupt planned emergency core cooling system operation are those that must act to prevent complete failure of the component or system. In no case can the action of a protective device prevent other redundant cooling systems from providing adequate cooling to the core. The locations of controls that adjust or interrupt operation of emergency core cooling systems components have been specified. Controls are located in the control room and are under supervision of the control room operator. The environmental capabilities of instrumentation for the emergency core cooling systems are discussed in the descriptions of the individual systems. Components that are located inside the drywell and are essential to emergency cooling system performance are designed to operate in the drywell environment resulting from a loss-of-coolant accident. Essential instruments located outside the drywell are also qualified for the environment in which they must perform their essential function. Special consideration has been given to the performance of reactor vessel water level sensors, pressure sensors, and condensing chambers during rapid depressurization of the nuclear system. This consideration is discussed in Section 7.5.

LSCS-UFSAR 7.3-28 REV. 13 Capability for emergency core cooling following the accident may be verified by observing the following indications:

a. annunciators for HPCS, LPCS, RHR, and ADS sensor initiation logic trips, b. flow and pressure indications for each emergency core cooling system, c. isolation valve position lights indicating open valves, d. injection valve position lights indicating either open or closed valves, e. ADS valve initiation circuit status by open/closed valve position indicator lamps, f. ADS valve position may be inferred from reactor pressure indications, g. process computer logging of trips in the emergency core cooling network, and
h. ADS valve discharge pipe temperature monitors and alarm. Access to safety equipment areas (rooms) is controlled by the industrial security door access control system, which utilizes card-reader entry and complete logging of access by individual name, authorization code, and time.

Access to switches and valves which could be used to disable safety equipment is restricted administratively. Switches are keylocked and keys are administratively controlled. The valves which are locally controllable are within safety equipment areas. Valves which are controlled in the control room have status lights and will cause an annunciation if they are placed in a condition that would disable safety equipment. 

"Emergency valves" for the NSSS equipment are located in the control room. Each safety system has manual system level in itiation capability by operating manual switches mounted on the control room benc hboards. The operator has direct, ready access to the switches. The switches requir e two distinct operator actions to initiate action (turning the collar and depressing the pushbutton).

A failure mode and effects analysis is provided and discussed in Section 6.3. LSCS-UFSAR 7.3-29 REV. 14, APRIL 2002 7.3.1.3.2 Specific Requirements Conformance 7.3.1.3.2.1 Regulatory Guides This topic is discussed in Appendix B. 7.3.1.3.2.2 10 CFR 50 Appendix A

a. Criterion No. 13 Conformance to this requirement is shown in Subsections 7.3.1.2.1, 7.3.1.2.2, 7.

3.1.2.3, and 7.3.1.2.4.

b. Criteria 17 and 18 Power supply ECCS loads are rigorously divided into Division 1, Division 2, and Division 3. Th e independence of these circuits prevents compromise and enhances inspection of safety-related power supply systems.
c. Criteria 9 through 24, 29, 35, and 37 Conformance to these criteria are shown in Subsections 7.3.1.2.1, 7.3.1.2.2, 7.

3.1.2.3, and 7.3.1.2.4. 7.3.1.3.2.3 IEEE Criteria

Compliance of the emergency core cooling system with IEEE criteria is presented in 7.A.3.1. 7.3.2 Primary Containment and Reactor Vessel Isolation Control Instrumentation and Control 7.3.2.1 Design Bases The following safety design bases have been implemented in the primary containment and reactor vessel isolation control system:

a. To limit the release of radioactive materials to the environs, the primary containment and reactor vessel isolation control system shall, with precision and reliabilit y, initiate timely isolation of penetrations through the primary containment whenever the values of monitored variables exceed preselected operational limits.

LSCS-UFSAR 7.3-30 REV. 13 b. To provide assurance that important variables are monitored with a precision sufficient to fulfill safety design basis a, the primary containment and reactor vessel isolation control system shall respond correctly to the sens ed variables over the expected design range of magnitudes and rates of change.

c. To provide assurance that important variables are monitored to fulfill safety design basis a, a sufficient number of sensors shall be provided for monitoring essential variables.
d. To provide assurance that conditions indicative of a failure of the reactor coolant pressure boundary are detected to fulfill safety design basis a, primary containment and reactor vessel

isolation control system inputs shall be derived from variables that are true, direct measures of operational conditions.

e. The time required to close the main steamline isolation valves shall be short so as to minimi ze the loss of coolant from a steamline break.
f. The time required to close the main steam valves shall not be so short that inadvertent isolation of steamlines causes a transient more severe than that resulting from closure of the turbine stop valves coincident with failure of the turbine bypass system. This ensures that the main steam isolation valve closure speed is compatible with the ability of the reactor protection system to protect the fuel assembly and reactor coolant pressure boundary.
g. To provide assurance that the closure of automatic isolation valves is initiated when required to fulfill safety design basis a, the following safety design bases are specified for the systems controlling automatic isolation valves:
1. No single failure, maintenance operation, calibration operation, or test to verify operational availability shall impair the functional ability of the isolation control system. 2. The system shall be designed so that the required number of sensors for any monitored variable exceeding the isolation setpoint will initiate automatic isolation.
3. Where a plant condition that requires isolation can be brought on by a failure or malfunction of a control or regulating system, and the same failure or malfunction LSCS-UFSAR 7.3-31 REV. 13 prevents action by one or more isolation control system channels designed to provide protection against the unsafe condition, the remaining portions of the isolation control system shall meet th e requirements of safety design bases a, b, c, and g.l.
4. The power supplies for the primary containment and reactor vessel isolation control system shall be arranged so that loss of one supply cannot prevent automatic isolation when required.
5. The system shall be designed so that, once initiated, automatic isolation action goes to completion. Return to

normal operation after isolation action shall require deliberate operator action.

6. There shall be sufficient electrical and physical separation of wiring and piping between trip channels monitoring the same essential variable to prevent environmental factors, electrical faults, and physical events from impairing the ability of the system to respond correctly.
7. Earthquake ground motions shall not impair the ability of the primary containment and reactor vessel isolation control system to initiate automatic isolation.
h. The following safety design basis is specified to assure that the isolation of main steamlines is accomplished:
1. The isolation valves in each of the main steamlines shall not rely on electrical power to achieve closure.
i. To reduce the probability that the operational reliability of the primary containment and reactor vessel isolation control system will be degraded by operator error, the following safety design bases are specified for automatic isolation valves:
1. Access to all trip settings, component calibration controls, test points, and other terminal points for equipment associated with essential monitored variables shall be under the control of plant operations supervisory

personnel.

2. The means for bypassing trip channels, trip logics, or system components shall be under the control of the LSCS-UFSAR 7.3-32 REV. 13 control room operator. If the ability to trip some essential part of the system has been bypassed, this fact shall be continuously indicated in the control room.
j. To provide the operator with a means to take action that is independent of the automatic isolation functions in the event of a failure of the reactor coolant pressure boundary, it shall be possible for the operator to manually initiate isolation of the primary containment and reactor vessel from the control room.
k. The following bases are specified to provide the operator with the means to assess the condition of the primary containment and reactor vessel isolation control system and to identify

conditions indicative of a gross failure of the reactor coolant pressure boundary:

1. The primary containment and reactor vessel isolation control system shall be designed to provide the operator with information pertinent to the status of the system.
2. Means shall be provided for prompt identification of trip channel and trip system responses.
l. It shall be possible to check the operational availability of each trip channel and trip logic during reactor operation.

The specific safety requirements met by the primary containment and reactor vessel isolation control system instrumentation an d controls are shown in Tables 7.1-2 and 7.1-4. 7.3.2.2 System Description The primary containment and reactor vessel isolation control system includes the sensors, channels, switches, and remote ly activated valve closing mechanisms associated with the valves, which, when closed, effect isolation of the primary containment, reactor vessel, or both. The purpose of the system is to prevent the release of significant amounts of radioactive materials from the fuel and reactor coolant pressure boundary by automatically isolating the appropriate pipelines that penetrate the primary containment. The power generation objectiv e of this system is to avoid spurious closure of particular isolation valves as a result of single failure. 7.3.2.2.1 Power Sources

LSCS-UFSAR 7.3-33 REV. 13 Power for the channels and logics of the isolation control system, except Group 4 and 2 Group (VP and WR), is supplied from the two electrical buses that supply the reactor protection system trip systems. Power for the channels of the isolation control system for Group 2 and Group 4 is supplied from the two electrical buses that supply the reactor protection system trip systems. Power for the isolation logic of the isolation control system for Grou p 2 (VP and WR) and Group 4 is supplied from two independent safety related 125 VDC buses. Each RPS bus has its own motor-generator set and can receive alte rnate power from the preferred power source. Each bus can be supplied from only one of its power sources at any given time. Motor-operated isolation valves receive power from emergency buses. Power for the operation of two valves in a line is supplied from separate or different sources. Table 8.1-1 lists the power supply for each isolation valve, and discussions of these power supplies are give n in Section 8.1 and 8.3. 7.3.2.2.2 Equipment Design Pipelines that penetrate the primary containment and directly communicate with the reactor vessel generally have two isolation valves, one inside the primary containment and one outside the primary containment. These automatic isolation valves are considered essential for pr otection against the gross release of radioactive material in the event of a breach in the reactor coolant pressure boundary. Power cables run in raceways from the electrical source to each motor-operated isolation valve. Solenoid valve power goes from its source to the control devices for the valve. The main steamline isolation valve controls include pneumatic piping and an accumulator for those valves that use air as the emergency motive power source. Pressure, temperature, and water level sensors are mounted on instrument racks in the secondary containment. Turbine stop valve position switch, control valve fast closure trip devices, and condenser vacuum switches are located in the turbine building on turbine equipment. Valve position switches are mounted on motor and air-operated valves. Switch es are encased to protect them from environmental conditions. Cables from each sensor are routed in conduits and cable trays to the control room. All signals transmitted to the control room are electrical; no pipe from the nuclear system penetrates the control room. The sensor cables and power supply cables are routed to cabinets in the control or electrical equipment rooms, where the logic arrangements of th e system are formed. The vent and purge valve solenoid valves are powered fr om the MCC from which the original limitorques were powered. 7.3.2.2.3 Initiating Circuits During normal plant operation, the isolation control system sensors and trip controls that are essential to safety are energized. When abnormal conditions are LSCS-UFSAR 7.3-34 REV. 14, APRIL 2002 sensed, trip channel sensor co ntacts open causing contacts in the trip logic to open and thereby initiating isolation. Loss of bo th power supplies also initiates isolation. Loss of instrument air pressu re will not prevent the clos ure of the vent and purge valves if a closure signal occurs. For the main steamline isolation valve contro l, four channels are provided for each measured variable. One channel of each va riable is connected to a particular logic in order to maintain channel independence and separation. One output of the inboard logic actuator is used to control one solenoid of the inboard and outboard valves of all four main steamlines, and one output of the outboard logic actuator is used to control the other solenoid of both inboard and outboard valves for all four main steamlines. Each main steamline isolation valve is fitt ed with two control solenoids. For each valve to close automatically, both of its solenoids must be deenergized. Each solenoid receives inputs from two logics, and a signal from either can cause deenergization of the solenoid. The main steamline drain valves and reac tor water sample valves also operate in pairs. The inboard valves close if both the MSIV inboard isolation logics are tripped. The inboard valves close if two of the main steamline isolation logics are tripped, and the outboard valves close if the other two logics are tripped. The reactor water cleanup system, residual heat removal system, and reactor water sample isolation valves are each controlled by two logic circuits, one for the inboard valve and a second for the outboard valve. The control system for the automatic isolatio n valves is designed to provide closure of valves in time to minimize the loss of coolant from the re actor and prevent the release of radioactive material from the co ntainment. A secondary design function is to prevent uncovering the fuel as a result of a break in those pipelines that the valve isolates and thereby restrict the releas e of radioactive material to levels below the guidelines of published regulations. Sensors providing inputs to the primary containment and reactor vessel isolatio n control system are not used for the automatic control of the process system, thereby achieving separation of the protection and process systems. Channels are physically and electrically separated to reduce the probability that a single physical event will prevent isolation. Redundant channels for one monitored variable provide inputs to different isolation trip systems. Tabl e 7.3-2 lists instrument characteristics. The isolation instrument limits of the primary containment, secondary containment, and reactor vessel isolation control system are listed in Table 7.3-2. The safety design bases of these isolation signals are discussed in the following paragraphs.

LSCS-UFSAR 7.3-35 REV. 13 7.3.2.2.3.1 Reactor Vessel Low Water Level A low water level in the reactor vessel could indicate that reactor coolant is being lost through a breach in the reactor coolant pressure boundary and that the core is in danger of becoming overheated as the reactor coolant inventory diminishes.

Reactor vessel low water level initiates clos ure of various valves. The closure of these valves is intended to isolate a breach in any of the pipelines in which the valves are contained, conserve reactor cool ant by closing off process lines, or prevent the escape of radioactive materials from the primary containment through process lines that communicate with the primary containment interior. Three reactor vessel low water level isolation trip settings are used to complete the

isolation of the containment and the reactor vessel. The first, and highest, (level 3) reactor vessel low water level isolation trip setting initiates closure of RHR isolation valves; the second reactor vessel low water level (level 2) initiates closure of valves in major process pipelines except the main steam, main steam drains and drywell instrument air lines. The main steam lines are left open to allow the removal of heat from the reactor core to the main cond enser. The third, and lowest (level 1) reactor vessel low water level, completes the isolation of the containment and pressure vessel by initiating closure of the main steam isolation valves, main steam line drain valves, and drywell instrument air valves. The first low water level setting (which is the RPS low water level scram setting) was selected to initiate isolation at the ear liest indication of a possible breach in the reactor coolant pressure boundary, yet far enough below normal operational levels to avoid spurious isolation. Isolation of the following pipelines is initiated when reactor vessel low water level falls to this first setting:

a. RHR reactor shutdown cooling supply, b. RHR reactor head spray, and
c. RHR shutdown cooling discharge to radwaste.

The second (and lower) of the reactor vessel low water level isolation settings (the same water level setting at which the HPCS and RCIC systems are placed in operation) was selected low enough to allo w the removal of heat from the reactor for a predetermined time following the scram and high enough to complete isolation in time for the operation of emergency core cooling systems in the event of a large break in the reactor coolant pressure boundary. Isolation of the following pipelines is initiated when the reactor vessel water level falls to this second setting:

a. reactor water sample line, b. reactor water cleanup, LSCS-UFSAR 7.3-36 REV. 13 c. drywell floor and equipment drains, d. containment monitoring, e. primary containment purge, f. reactor building closed cooling water system, g. primary containment chilled water, and h. recirculation flow cont rol valve hydraulic lines.

The third, and lowest (level 1) low reactor vessel low water level setting was selected to complete isolation of the containment and pressure vessel and to minimize the number of reactor vessel isolations. Isolation of the following pipelines is initiated when the reactor vessel water falls to this third setting:

a. All four main steamlines, b. Main steam drain lines, and
c. Drywell instrument air.

Reactor vessel low water level signals are initiated from eight differential pressure measuring instrument channels. They sense the difference between the pressure caused by a constant reference leg of wate r and the pressure caused by the actual water level in the vessel. There are three distinct groups of instrument channels. One group is used to indicate that water level has dropped to the first (higher) low water level isolation setting. The remaining second and third group indicate that water level has dropped to the second (lower) and third (lowest) low water level isolation setting.

Four pairs of instrument sensing lines, attached to taps above and below the water level on the reactor vessel, are required for the differential pressure measurement and terminate outside the drywell and inside the containment. They are physically separated from each other and tap off the reactor vessel at widely separated points. This arrangement assures that no single physical event can prevent isolation if it is required.

7.3.2.2.3.3 Main Steamline Space High Temperature and Differential Temperature High temperature in the space in which th e main steamlines are located outside of the primary containment could indicate a breach in a main steamline. Such a breach may also be indicated by high differential temperature between the outlet and inlet ventilation air for this steamline space. The automatic closure of various valves prevents the excessive loss of reactor coolant and the release of significant LSCS-UFSAR 7.3-37 REV. 14, APRIL 2002 amount of radioactive material from the reactor coolant pressure boundary. When high differential temperatures occur in the main steamline space, the following pipelines are isolated:

a. all four main steamlines, and
b. the main steamline drain.

The main steamline space high differential temperature trip is set to provide early indication of a steamline break. These trips are bypassed upon start-up of the reactor building ventilation syst em. (See Subsection 7.6.2.2.3) Ambient high temperature in the vicinity of the main steamlines is detected by dual element thermocouples located in the tunne

l. These temperature sensors provide temperature indication and alarm functions only. They do not initiate an isolation signal (See Subsection 7.6.2.2.3). Dual element thermocouples are also located at the inlet to the steam tunnel and at th e outlet to the steam tunnel. These thermocouples measure the temperature di fference through the steam tunnel. The temperature elements are located or shield ed so that they are sensitive to air temperature and not the radiated heat from hot equipment.

The main steamline space temperature detection system is designed to detect leaks of from 1% to 10% of rated steam flow. 7.3.2.2.3.4 Main Steamline High Flow Main steamline high flow could indicate a break in a main steamline. Automatic closure of various valves prevents excessive loss of reactor coolant and release of significant amounts of radioactive material from the reactor coolant pressure boundary. On detection of main steamlin e high flow, the following pipelines are isolated:

a. all four main steamlines, and
b. the main steamline drain.

The main steamline high flow trip settin g was selected high enough to permit isolation of one main steamline for test at reduced power without causing an automatic isolation of the other steamlines, yet low enough to permit early detection of a steamline break.

High flow in each main steamline is sensed by four differential pressure switches that sense the pressure difference across the flow element in that line.

LSCS-UFSAR 7.3-38 REV. 13 7.3.2.2.3.5 Low Steam Pressure at Turbine Inlet Low steam pressure at the turbine inlet, while the reactor is operating, could indicate a malfunction of the nuclear system pressure regulator in which the turbine control valves or turbine bypass valves become fully open causing rapid depressurization of the nuclear system. From part-load operating conditions, the rate of decrease of nuclear system saturation temperature could exceed the allowable rate of change of vessel tempera ture could exceed the allowable rate of change of vessel temperature. A rapid depressurization of the reactor vessel while the reactor is near full power could result in undesirable differential pressures across the channels around some fuel bundles of sufficient magnitude to cause mechanical deformation of channel walls. The occurence of such depressurizations without adequate preventive action could require thorough vessel analysis or core inspection prior to returning the reactor to power operation. To avoid these time-consuming requirements following a rapid depressurization, the steam pressure is monitored at the turbine inlet. Pressure falling below a preselected value with the reactor in the RUN mode initiates isolation of the following pipelines:

a. all four main steamlines, and
b. the main steam drain line.

The low steam pressure isolation setting was selected far enough below normal turbine inlet pressures to avoid spurious isolation, yet high enough to provide timely detection of a pressure regulator malfunction. Although this isolation function is not required to satisfy any of the safety design bases for this system, the discussion is included to complete the listing of isolation functions. Main steamline low pressure is sensed by four pressure switches that sense pressure downstream of the outboard main steamline isolation valves. The sensing point is located as close as possib le to the turbine stop valves. 7.3.2.2.3.6 Drywell High Pressure

High pressure in the drywell could indicate a breach of the reactor coolant pressure boundary inside the drywell. The automati c closure of various valves prevents the release of significant amounts of radioact ive material from the containment. On detection of high drywell pressure, the following pipelines are isolated:

a. drywell drains (discharge to radwaste), b. primary containment vent and purge dampers, c. drywell instrument nitorgen, LSCS-UFSAR 7.3-39 REV. 13 d. containment monitoring (non-post-accident portions), e. RHR shutdown cooling discharge to radwaste, f. recirculation FCV hydraulic lines, and
g. TIP withdrawal line.

The drywell high-pressure isolation setting was selected to be as low as possible without inducing spurious isolation trips. Drywell pressure is monitored by four non-indicating pressure switches that are mounted on instrument racks outside the primary containment. Instrument sensing lines that terminate in the reactor building connect the switches with the drywell interior. 7.3.2.2.3.7 Reactor Building Ventilati on Exhaust Plenum Monitor Subsystem The system initiates control signals in the event the radiation level exceeds a predetermined level to isolate the reacto r building vent system, to initiate the standby gas treatment system, and to close primary containment purge and vent valves. A more detailed discussion of the system is presented in Subsection 7.6.1.2. 7.3.2.2.3.8 Reactor Water Cleanup System High Differential Flow High differential flow in the reactor water cleanup system could indicate a breach of the nuclear system process barrier in the cleanup system. The cleanup system inlet flow is compared with the outlet flow. Higher flow from the vessel initiates isolation of the reactor water cleanup system. 7.3.2.2.3.9 Reactor Water Cleanup System Equipment Area High Temperature

and Differential Temperature High temperature in the area of the reac tor water cleanup system equipment could indicate a breach in the reactor coolant pressure boundary in the cleanup system. High equipment area temperature and high differential temperature in the area ventilation system initiates isolation of the reactor water cleanup system. 7.3.2.2.3.10 Deleted 7.3.2.2.3.11 Main Steamline Leak Detection Description The main steamlines are constantly monitored for leaks by the leak detection system (Figure 7.3-7 and Drawing Nos. M-155 and M-157). Steamline leaks will cause changes in at least one of the following monitored operating parameters: LSCS-UFSAR 7.3-40 REV. 13 sensed differential temperature, flow rate, or low water level in the reactor vessel. If a leak is detected, the detection system responds by triggering an annunciator and initiating a steamline isolation trip logic signal. Additional discussion is presented in Subsection 7.6.2.2.3. 7.3.2.2.3.12 Turbine Condenser Vacuum Trip In addition to the present turbine stop valve trip on low condenser vacuum instrumentation, which is a standard co mponent of the turbine system, a main steamline isolation valve trip in the low condenser vacuum instrumentation system will be provided and will meet the safety design basis of the nuclear steam supply shutoff and primary contai nment isolation systems.

The main turbine condenser low vacuum would indicate a leak in the condenser. Initiation of the automatic closure of vari ous Class A valves w ill prevent the excess loss of reactor coolant and the release of significant amounts of radioactive material from the nuclear system process barrier. Upon detection of turbine condenser low vacuum, the following lines are isolated:

a. all four main steamlines, and
b. the main steamline drain.

The turbine condenser low vacuum trip se tting was selected far enough above the normal operating vacuum to avoid spurious isolation, yet low enough to provide an isolation signal prior to the rupture of the condenser and subsequent loss of reactor coolant and release of radioactive material.

7.3.2.2.3.13 Residual Heat Removal System High Flow High flow in the RHR system could indicate a breach of the nuclear process barrier in the RHR system. High flow from the vessel initiates isolation of the RHR system. 7.3.2.2.4 Logic The basic logic arrangement is one in which an automatic isolation valve is controlled by two trip systems. Each trip system has two trip logics, each of which receives input signals from at least one trip channel for each monitored variable. Thus, two trip channels are required for each essential monitored variable to provide independent inputs to the trip logics of one trip system. A total of four trip channels for each essential monitored variable is required for the trip logics of both trip systems.

LSCS-UFSAR 7.3-41 REV. 13 The trip actuators associated with one trip logic provide inputs into each of the trip actuator logics for that trip system. Thus, either of th e two automatic trip logics associated with one trip system can produc e a trip. The logic is a one-out-of-two arrangement. To initiate valve closure the trip actuator logics of both trip systems must be tripped. The overall logic of th e system could thus be termed one-out-of-two taken twice.

This type of logic is used to control the main steamline isolation valves (MSIV). The four logic strings for this control are show n in Figure 7.3-9. The variables that initiate automatic closure of the MSIV's are:

a. low low low (level 1) reactor water level, b. high main steamline flow,
c. high main steamline tunnel temperature, d. high main steamline tunne l differential temperature, e. low turbine throttle pressure in RUN mode, f. main condenser low vacuum (bypassable when not in RUN mode and main turbine stop valves closed).

The logic actuator outputs used to cont rol the main steamline drain valves and reactor water sample valves could be termed two-out-of-two, applied to each valve. The logic strings for this control are shown in Figure 7.3-10. Other isolation valves are controlled by drywell high-pressure and reactor low water level signals. In this arrangement, two drywell pressure sensors are combined with two water level sensors to form a "hybri d" one-out-of-two twic e network. These same drywell pressure and water level logics are used with process radiation monitor upscale and inoperative signals to produce other isolation actions, including initiation of the standby gas treatment system. The reactor water cleanup isolation valves are controlled by two logics, using high flow, high area temperature, high area differential temperature, and low water level signals.

The trip signals to initiate an isolation from the main steam tunnel differential temperature sensors are bypassed upon star t-up of the reactor building ventilation system. LSCS-UFSAR 7.3-42 REV. 13 7.3.2.2.5 Bypasses and Interlocks An automatic bypass of the main steamline low-pressure signal is effected in the startup mode of operation (s ee Subsection 7.3.2.2.3.). Interlocks are provided from position switches on the drywell drain sumps to the radwaste system to turn off the drywell drain sump pumps if the isolation valves close. 7.3.2.2.6 Redundancy and Diversity The variables which initiate isolation are list ed in Subsection 7.3. 2.2.3. Also listed there are the number of initiating sensors and channels for the isolation valves. 7.3.2.2.7 Actuated Devices Subsection 6.2.4.2 itemizes the type of cl osing device provided for each isolation valve. To prevent the reactor vessel water level from falling below the top of the active fuel as a result of a pipeline break, the valve closing mechanisms are designed to meet the minimum closing rate s also specified in Subsection 6.2.4.2. The vent and purge isolation valves are spring closing, pneumatic, piston-operated butterfly valves. Loss of instrument air will not prevent the closure of the vent and purge valves if a closure signal occurs. This is a fail safe design. The control arrangement is shown in Figure 7.3-13. Closure of the valve is less than 10 seconds. Each valve is controlled by one 3-way ASCO direct acting solenoid valve, powered by AC. The main steamline isolat ion valves are spring-closing, pneumatic, piston-operated valves. They close on loss of pneumatic pressure to the valve operator. This is a fail-safe design. The control arrangement is shown in Figure 7.3-11. Closure time for the valves is ad justable between 3 and 10 seconds. Closure of each MSIV is piloted by two three-way, direct-acting, solenoid-operated pilot valves, both powered by a-c. In addition, there is one three-way solenoid valve which is provided for slow stroke testing. An accumulator located close to each isolation valve provides pneumatic pressure for valve closing in the event of failure of the normal air supply system. The sensor trip channel and trip logic relays for the instrumentation used in the systems described are high reliability relays. The relays are selected so that the continuous load will not exceed 50% of the continuous duty rating. Table 7.3-6 lists the minimum numbers of trip channels needed to ensure that the isolation control system retains its functional capabilities. 7.3.2.2.8 Separation Sensor devices are separated physically such that no single failur e (open, closure, or short) can prevent the safety action. By the use of conduit and separated cable trays the same criterion is met from the sensors to the logic cabinets in the control LSCS-UFSAR 7.3-43 REV. 13 room. The logic cabinets are so arranged that redundan t equipment and wiring are not present in the same bay of a cabinet. Redundant equipment and wiring may be present in control room bench boards, for separation is achieved by surrounding redundant wire and equipment in metal enca sements (a bay is defined by adequate fire barriers). From the logic cabinets to the isolation valves, separated cable trays or conduit are employed to complete ad herence to the single-failure criterion. 7.3.2.2.9 Testability The main steamline isolation valve instrumentation is capable of complete testing during power operation. The isolation signals include low reactor water level, high main steamline flow, high main stea mline tunnel temperature, low condenser vacuum, and low turbine pressure. The water level, turbine pressure, and steamline flow sensors are pressure or di fferential pressure type sensors which may be valved out of service one at a time and functionally tested using a test pressure source. The radiation measuring amplifier is provided with a test switch and internal test source by which trip availability may be verified. Functional operability of the temperature sw itches may be verified by applying a heat source to the locally mounted tempe rature sensing elements. Control room indications include annunciation, panel lights, and computer printout. The condition of each sensor is indicated by at least one of these methods in addition to annunciators common to sensors of one va riable. In addition, the functional availability of each isolation valve may be confirmed by completely or partially closing each valve individually at reduced power using test switches located in the control room.

The cleanup system isolation signals include low reactor water level, high equipment area ambient temperature and differential temperature, high differential flow, high temperature downstream of the nonregenerative heat exchanger, and standby liquid control system actuation. The water level sensor is of the differential pressure type and can be periodically tested by valving each sensor out of service and applying a test pressure. The temperature switches may be functionally tested by removing from service and applying a heat source to the temperature-sensing elements. The differential flow switches may be tested by applying a test input. The various trip actuations are annunciated in the control room. Also, valve indicator lights in the co ntrol room provide indication of cleanup isolation valve position. 7.3.2.2.10 Environmental Considerations

The physical and electrical arrangement of the primary containment and reactor vessel isolation control system was selected so that no single physical event will prevent achievement of isolation functions. Motor operators for valves inside the drywell are of the totally enclosed ty pe; those outside the containment have LSCS-UFSAR 7.3-44 REV. 13 weatherproof enclosures. Solenoid valves, whether used for direct valve isolation or as air pilots, are provided with watertight enclosures. All cables and operators are capable of operation in the most unfavorable ambient conditions anticipated. Temperature, pressure, humidity, and radiat ion are considered in the selection of equipment for the system. Cables used in high-radiation areas have radiation-resistant insulation. Shielded cables are used where necessary to eliminate interference from magnetic fields. Special consideration has been given to isolation requirements during a loss-of-coolant accident inside the drywell. Components of the primary containment and reactor vessel isolation control system that are located inside the drywell and that must operate during a loss-of-coolant accident are the cables, control mechanisms, and valve operators of isolation valves inside the drywell. These isolation components are required to be functional in a loss-of-coolant accident environment. Electrical cables are selected with insulation designed for this service. Closing mechanisms and valve operators are considered satisfactory for use in the isolation control system only after completion of environmental testing under loss-of-coolant accident conditions or submission of evidence from the manufacturer describing the results of suitable prior tests.

7.3.2.2.11 Operational Considerations The primary containment and reactor vessel isolation control system is not required for normal operation. This system is initiated automatically when one of the monitored variables exceeds preset limits. No operator action is required for at least 10 minutes.

All automatic isolation valves can be closed by manipulating switches in the main control room, thus providing the operator with control which is independent of the automatic isolation functions. In general, once isolation is initiated, the valve continues to close, even if the condition that caused isolation is restored to normal. The operator must manually operate (from the main control room) those pushbuttons which reset the isolation logic and also the switches and/or pushbuttons for individual valves that have been automatically closed in order to reopen them. With the exception of drywell equipment drain sump outlet and the return line valves and the drywell equipment drain sump outlet valves which are provided with manual override of their isolation logic (to enable taking reactor coolant sample with the high radiation sample system under post-accident conditions), th e operator cannot reopen any valves until the conditions that initiated isolation have cleared.

A trip of an isolation control system channel is annunciated in the main control room so that the operator is immediately in formed of the condition. The response of LSCS-UFSAR 7.3-45 REV. 14, APRIL 2002 isolation valves is indicated by OPEN/CLOSED lights. All motor-operated and air-operated isolation valves have OPEN/CLOSED lights. Inputs to annunciators, indicators, and th e process computer are arranged so that no malfunction of the annunciating, in dicating, or computing equipment can functionally disable the system. Direct signals from the isolation control system sensors are not used as inputs to annunciating or data logging equipment. Isolation is provided between the primary signal and the information output. 7.3.2.2.12 Design Basis Information See Subsection 7.3.1.2.6.

7.3.2.2.13 Final System Drawings The final system drawings for the PCRIVCS are shown in electrical schematics.

7.3.2.3 Analysis 7.3.2.3.1 General Function al Requirement Conformance The primary containment and reactor vessel isolation control instrumentation and control system is analyzed in this subsection. This system is described in Subsection 7.3.2, and that description is used as the basis for this analysis. The safety design bases and specific regulatory requirements of this system are also stated in Subsection 7.3.2. This analysis shows conf ormance to the requirements given in that subsection.

The primary containment and reactor vessel isolation control instrumentation and control systems, in conjunction with other safety systems, are designed to provide timely protection against the onset and consequences of th e gross release of radioactive materials from fuel and re actor coolant pressure boundaries. Chapter 15.0 identifies and evaluates postulated events that can result in gross failure of fuel and reactor coolant pressure boundaries. The consequences of such gross failures are described and evaluated. Chapter 15.0 also evaluates a gross breach in a main steamline outside the containment during operation at rated power. The evaluation shows that the main steamlines are automatically isolated in time to prevent the loss of coolant from being great enough to allow uncovering of the core. These results are true even if the longest closing time of the valve is assumed. The shortest possible main steamline valve closure time is 3 seconds. The transient resulting from a simultaneous closure of all main steam isolation valves in 3 seconds during reactor operation at rated power is discussed in Chapter 15.0. LSCS-UFSAR 7.3-46 REV. 13 7.3.2.3.2 Specific Requirements Conformance 7.3.2.3.2.1 IEEE Criteria Refer to 7.A.3.2.

7.3.2.3.2.2 Conformance to 10 CFR 50 Appendix A

a. Criterion 13 - The integrity of the reactor core and the reactor coolant pressure boundary is assured by monitoring the appropriate plant variables and closing various isolation valves.
b. Criterion 19 - Controls and instrumentation are provided in the control room.
c. Criterion 20 - Protection Sy stem Functions. The primary containment and reactor vessel isolation control system automatically isolates the ap propriate process lines. No operator action is required to effect an isolation.
d. Criterion 21 - Protection System Reliability and Testability. The high reliability relay and switch devices are arranged in two redundant divisions and maintained separately. Complete testing is covered in the di scussion on conformance to Regulatory Guides given in Appendix B.
e. Criterion 22 - Protection System Independence. Two redundant divisions are physically arranged so that no single failure can prevent an isolation. Functional diversity of sensed variables is utilized.
f. Criterion 23 - Protection System Failure Mode. The system logic and actuator signals are failsafe.

The motor-operated valves will fail as is on loss of power.

g. Criterion 24 - Separation of Pr otection and Control Systems.

The system has no control functions. The equipment is physically separated from the control system equipment to the extent that no single failure in the control system can prevent isolation.

h. Criterion 29 - Protection Against Anticipated Operational Occurrences. No anticipated operational occurrence will prevent an isolation.

LSCS-UFSAR 7.3-47 REV. 16, APRIL 2006

i. Criterion 34 - Isolation signals are provided for the shutdown cooling subsystem of the RHR System.

7.3.2.3.2.3 Regulatory Guide Conformance

This topic is discussed in Appendix B. 7.3.3 Core Standby Cooling System (CSCS)/Equipment Cooling Water System (ECWS) Instrumentation and Controls 7.3.3.1 Safety Design Bases

The CSCS/ECWS instrumentation and controls function to:

a. Provide adequate cooling water flow to the RHR heat exchangers, diesel-generator cool ers, CSCS area cooling coils, RHR pump seal coolers, and LPCS pump motor cooling coils.
b. Provide for containment flooding for postaccident recovery and emergency makeup water for fuel pool cooling.
c. Detect leakage of radioactivity by means of radiation monitors installed immediately downstream of cooled components containing radioactive fluids.

7.3.3.2 Power Generation Design Bases Since containment and core residual heat removal is not required during power generation, the system has no power generation design bases except to be available for operational testing without effect on plant operation. 7.3.3.3 System Description 7.3.3.3.1 Instrumentation and Controls The instrumentation and controls for the CSCS equipment cooling water system sense individual pump discharge pressures, strainer differential pressures, some subsystem flows, and all subsystem discharge temperatures except the LPCS Motor Cooler discharge temperature. The RHR heat exchanger parameters are present in the control room to aid the operator in ev aluating heat exchanger operation. In addition, the radiation level of the return flow to the lake from the RHR heat exchanger is also monitored. LSCS-UFSAR 7.3-48 REV. 14, APRIL 2002 Alarms of system malfunctions are also provided. The instrumentation and annunciation do not perform a safety function. The control functions are both safety-related and nonsafety-related. Power supply for all safety-related instru mentation is from Class 1E supplies. Power for control is provided by the same essential bus as the systems being controlled for safety-related functions. 7.3.3.3.2 Equipment Design and Logic Each pump can be started and stopped manually from the main control room during normal operation. The diesel-generator cooling water pumps are started automatically by diesel-generator start signals and continue to operate until the initiation signal is reset, when they can be turned off by a hand switch. The Division 1 diesel-generator cooling wate r pump is also starte d automatically by starting the LPCS pump in either Unit 1 or Unit 2. An alarm is activated on

automatic trip of these pumps. Logic The piping and instrumentation diagrams for the ECCS equipment cooling water system are illustrated in Drawing Nos. M-87 and M-134. Control redundancy is not required due to the fact that the services of each subsystem are redundant and independent from one another. Control circuits are divided into three divisions which are physically separate and powered from separate buses. 7.3.3.3.3 Environmental Considerations

The local instrumentation is designed to maintain a pressure boundary in the normal and accident environments in which it must operate. The remote controls are designed to remain functional during abnormal conditions. 7.3.3.3.4 Final System Drawings

The final system drawings for the CSCS/E CWS are shown in electrical schematics and Drawing Nos. M-87 and M-134. 7.3.4 Main Control Room and Auxiliary Electric Equipment (AEE) Room Heating, Ventilating, and Air/Condit ioning Systems Instrumentation and Controls

LSCS-UFSAR 7.3-49 REV. 14, APRIL 2002 7.3.4.1 Safety Design Bases

a. The system detects the presence of noxious gases in the minimum outside air intakes (ammonia, smoke), the Control Room main return ducts (smo ke), and the AEE room main return ducts (smoke).
b. The system controls are interlocked with the radiation monitoring system and intake air smoke detectors to isolate the normal outside makeup air to the control and AEE rooms and automatically route the outs ide makeup air for the HVAC system through one of the emergency filter trains to maintain control room and AEE room habitability. Ammonia Detectors

provide alarm only, no isolation occurs.)

c. The system operates in conjunction with ionization detection of combustion products in the control room and AEE room air return ducts and ammonia detectors in the minimum outside air intakes.
d. The system is capable of manual purging of the control room with 100% outside air.
e. Manual routing of the outside air return air mixture from the control room and AEE room through recirculation filters is required within four hours of a LOCA to ensure postaccident dose rates comply with GDC19.
f. No single failure, maintenance, calibration, or test operation prevents the functioning of the control room and AEE room HVAC system controls and instrumentation.
g. Any installed means of manual interruption of availability of the control room and AEE room HVAC systems are under control of

the operator or other supervisory personnel.

h. Loss of offsite electric power does not affect the normal functioning of controls and instrumentation.
i. The physical events accompanying a loss-of-coolant or fuel-handling accident do not prevent correct functioning of the controls and instrumentation.

LSCS-UFSAR 7.3-50 REV. 14, APRIL 2002 j. Seismic motions resulting fr om earthquake ground motion, missile, wind, and flood do not impair the operation of the controls and instrumentation.

k. The requirements of IEEE 279, 323, and 344 are met by the control room HVAC system instrumentation and controls.

Additionally, General Design Criteria 13, 19, 20 through 24, and 29 of 10 CFR 50, Appendix A, have been implemented in the design of this control system. 7.3.4.2 Power-Generation Design Bases

a. Control the temperature inside the control room and AEER between 65 °F and 85
°F and maintain the control room and AEER at approximately 1/8-inch water positive pressure with respect to the surrounding potentially contaminated areas.
b. Indicate temperatures and status of operating equipment, i.e., supply and return air fans, refrigeration unit, etc., on the main control board for the control room HVAC and on the auxiliary control panel for the AEE room HVAC.
c. Annunciate on the main control board any operating transients that require operators' attention. This includies high temperature, loss of airflow from supply and return air fans, loss of refrigeration unit, high pres sure drop across the supply air filters. d. Provide capability in the main control room to control and operate various components of the control room HVAC system manually from the main control room, and in the auxiliary building to control and operat e various components of the AEE room HVAC system manually.

7.3.4.3 System Description The controls and instrumentation for HVAC systems function to ensure the habitability under all station operating cond itions as described in Section 6.4 and Subsection 9.4.1.

LSCS-UFSAR 7.3-51 REV. 13 7.3.4.3.1 Power Supply The control room and AEE room HVAC syst ems are comprised of redundant supply air fans, return air fans, electric heating coils (not safety-related), refrigeration units, recirculation filters, and an emergenc y makeup air filter train consisting of electric heating coil, fan, and filters. Power supply for the various redundant components of each HVAC system is from separate essential a-c buses, which can receive standby a-c power. Control power for isolation dampers, controls, and instrumentation comes from the bus that powers the corresponding equipment train. 7.3.4.3.2 Initiating Circuits, Logic, and Sequencing

Various components of each redundant control room and AEE room HVAC system are initiated as described below:

a. The supply and return fans fo r the control room HVAC system are initiated manually by handswitches provided on the main control board. The supply and return fans for the AEE room HVAC system are initiated manually by handswitches provided on an auxiliary panel outside each AEE room.
b. The refrigeration unit condenser fans are provided with a control switch in the main control room for the control room HVAC system, and a control switch on an auxiliary panel outside the AEE room for its corresponding HVAC system.

While in the automatic mode, the refrigeration unit operates continuously with a built-in unloading system which is initiated by refrigerant suction pressure.

c. On any equipment malfunction alarm on the main control board, the redundant HVAC system is initiated manually.
d. The process radiation system detects high radiation signals from detectors which monitor air going to each of the two minimum outside air intakes and initiates the following simultaneous actions: 1. alarms the radiation levels for either intake in the main control room, 2. closes the normal path of makeup air supply to the control room and AEE room HVAC system, and

LSCS-UFSAR 7.3-52 REV. 14, APRIL 2002 3. initiates control action to cause outside air to be routed through an emergency makeup filter train.

e. When combustion products are detected in the minimum outside air intakes, the response is similar to the high radiation condition above. When combustion products are detected in the

control room or the AEE room return air ducts by the ionization smoke detectors, an alarm is annunciated in the main control room, and the corresponding system supply air is routed through the normally bypassed recirculation filters. In addition, if the quality of outside air is prop er, the operator can remote manually operate handswitches on the main control board for the control room HVAC and a control switch on an auxiliary

panel outside the AEE room for the corresponding HVAC system to place the recirculation filter on line, to open the maximum outside air intake dampers, fully open the exhaust damper, and close the recirculation air damper for purging the control room and AEE room air.

f. During normal station operating conditions, the ammonia detection system detects ammonia in either of two minimum outside air intakes and activates an alarm on the main control board. 7.3.4.3.3 Bypasses and Interlocks All of the isolation dampers in each control room and AEE room HVAC system equipment train are interlocked with the operation of the corresponding supply air and return air fans. Operation of any one of these fans opens all the corresponding isolation dampers. The supply air and return air fans are operated manually by handswitches.

The refrigeration machine start circuit is interlocked with the operation of the supply air fan. The operation of the refr igeration machine is further interlocked with safety protection cutouts such as low pressure and high pressure cutouts in the refrigerant circuit and an oil-failure switch in the compressor lubrication circuit. To guard against overheating, the electric heating coils are interlocked with supply air fan operation and a thermal cutout switch. Zone mixing dampers are controlled by temperature controllers in each zone. The refrigeration machines run continuously in conjunction with refrigerant suction pressure initiated unloading and the hot gas bypass system. The electric heating coils are controlled by thermostats placed in each area served by the control room and AEE room HVAC systems. LSCS-UFSAR 7.3-53 REV. 13 The operation of the emergency makeup air filter train is interlocked with the process radiation and ionization products of combustion monitors in the minimum outside air intakes. All of the isolation dampers in the outside air intakes and the emergency makeup

air filter train are appropriately interlocked to serve the required function. The electric heating coil for humidity control in the emergency makeup air filter train is interlocked with the correspondi ng emergency makeup air fan. 7.3.4.3.4 Redundancy/Diversity Instrumentation and controls for each redundant control room and AEE room HVAC system are completely in dependent of each other. 7.3.4.3.5 Actuated Devices The normal and emergency operation of each control room and AEE room HVAC system involves the following actuated devices:

a. supply air fan, b. return air fan, c. electric duct heating coils (normal only), d. refrigeration unit, e. emergency makeup air electric heating coil, f. emergency makeup air fan, g. corresponding isolation and control dampers , and
h. recirculating filters.

7.3.4.3.6 Separation The channels and logic circuits are physically and electrically separated to preclude the possibility that a single event will prevent operation of the control room and AEE room HVAC system. Electrical cables for instrumentation and control on each control room and AEE room HVAC system are routed separately.

LSCS-UFSAR 7.3-54 REV. 14, APRIL 2002 7.3.4.3.7 Testability Control and logic circuitry used for th e control room and AEE room HVAC system can be checked individually by applying test or calibration signals to the sensors and observing responses. Operation of each component of each redundant HVAC system is periodically rotated to permit online checking and testing of the performance of the total system. The automatic control circuitry for the emergency equipment is designed realign the appropriate automatic dampers to their emergency positions in response to an initiation signal. 7.3.4.3.8 Environmental Considerations Temperature, pressure, humidity, and radiation dosage are considered in the selection of various equipment, instrumentation, and controls for the control room

and AEE room HVAC system. These are des cribed in detail in Section 3.11 and Subsection 9.4.1. 7.3.4.3.9 Operational Considerations The control room and AEE room HVAC system is required during normal and abnormal station operating conditions. The automatic circuitry is designed to start the emergency equipment if the signal for its initiation is received as described in this section.

7.3.4.3.10 Operating Bypasses The control room and AEE room HVAC sy stems have no automatic operating bypasses. Manual bypasses are indicated in the control room via the ESF status indication panel as described in Section 7.8.

Manual bypasses consist of a "racking-out" fan breaker, opening starter feeder breakers at damper motor control centers, shutting isolation valves to instruments and sensors which actuate the subsystem and other operations meeting the three conditions given in Regulatory Guide 1.45. 7.3.4.3.11 Outdoor Air Intake Radiation Protection Portion of the Control Room and Auxiliary Electric Equipment Room HVAC Systems

a. The generating station condition which requires protective action is high levels of radioactivity which may be present and the subsequent initiation and use of the control room and AEE room emergency makeup filter eq uipment, recirculation filters, and the selection of the proper air intake to minimize exposure.

LSCS-UFSAR 7.3-55 REV. 14, APRIL 2002 b. The recirculation filters for the Control Room and AEER must be manually placed on line within four hours of any control room high radiation alarms.

c. The generating station variable which requires monitoring to provide action is the outdoor air activity levels near the intake

louvers. d. A minimum of two trip systems per intake are required. The radioactivity levels are to be sensed by monitors upstream of intake isolation dampers, where the air enters the intake louvers. e. The maximum radiation monitor time constant, for a one decade increase above the setpoint, is about 5 seconds. The time constant ensures that short duration changes in the count rate will not cause a response of the detector, thus preventing false trip actuations due to background noise. The radiation monitor time constant decreases exponentially with increasing radiation levels. 7.3.4.3.12 This Subsection has been deleted. 7.3.4.3.13 Ionization Detection Portion of Control Room and Auxiliary Electric Equipment Room HVAC Systems

a. The generating station condition which requires protective action is the presence of products of combustion in areas served by the control room and AEE room HVAC systems.
b. The generating station variable which requires monitoring to provide action is the product of combustion.
c. Duct-mounted ionization detectors are located in each minimum outside air intake duct and main return air duct.
d. The ionization detectors meet the requirements of NFPA 72E-1974 and are UL Listed. Expections to the standard are identified and justified.

LSCS-UFSAR 7.3-55a REV. 14, APRIL 2002

e. The installation and operat ion of the detectors meet the requirements of NFPA 90A-1975, Standard for the Installation of Air Conditioning and Ventilating Systems, with some exceptions. Exceptions to the standard are identified and justified.
f. Testing of the ionization detectors is performed periodically in accordance with the Fire Protection Program, station procedures and Technical Specification requirements, as applicable.

LSCS-UFSAR 7.3-56 REV. 14, APRIL 2002

g. The range of transient and steady-state electrical energy supply conditions throughout which the system must perform is described in Subsection 8.3.1.

The range of environmental conditions to which the ionization detectors are subjected is the same as the main control room. 7.3.4.3.14 Outdoor Air Intake Ammonia Protection Portion of Control Room and the Auxiliary Electric Equipment Room HVAC Systems

a. The detection of ammonia at the generating station is provided for the postulated occurrence in which ammonia is dispersed in the air outside the plant in sufficient concentration to affect operator action such that isolation of the ventilation air intakes is required.
b. Outdoor air ammonia concentration is monitored and high ammonia concentrations are annunciated in the control room.
c. The minimum number of sensors required to monitor outdoor air ammonia concentration is two ammonia sensors for each of two air intakes. The ammonia is sensed upstream of intake isolation dampers, where air enters the building.
d. The operational range of the ammonia detection system is from 0 to 75 ppm.
e. The normal operation ammonia concentration is expected to be 0 ppm. f. The ammonia detectors initiate a control room alarm if ammonia levels are detected in excess of the factory fixed alarm setpoint of approximately 12.5 ppm.
g. The ammonia detectors are not required to be seismically qualified or safety-related becaus e the function performed is not safety related. The instruments are high grade commercial products that provide detection of ammonia within the range of less than or equal to 75 ppm and operate in the range of environmental conditions where they are mounted.

LSCS-UFSAR 7.3-57 REV. 17, APRIL 2008 7.3.4.3.15 Final System Drawings The final system drawings for the main control room and AEE room HVAC systems are shown in electrical schematics an d Drawing Nos. M-1443, M-1468, and M-3443. 7.3.4.4 Analysis The control room and AEE room HVAC system analysis is presented in Subsection 9.4.1. The instrumentation and controls are described in Sections 6.4 and 9.4. The control room and AEE room HVAC system s are redundant systems, consisting of two equipment trains, the essential portions of which meet the requirements of IEEE 279-1971, Criteria for Nuclear Power Plant Protection Systems. Specific conformance of the instrumentation and control to IEEE 279-1971 is presented in Attachment 7.A.

7.3.5 Combustible

Gas Control System Instrumentation and Controls 7.3.5.1 Safety Design Bases

The hydrogen recombining function of th e hydrogen recombiners is abandoned in place. The valves that provide RHR coo ling water to the hydrogen recombiners are also abandoned in place in the closed posi tion. The blower an d associated piping are not abandoned and remain operational to maintain the drywell mixing function. The design basis information for the hydrogen recombination function remains for historical reference.

a. The combustible gas control system has the capability for monitoring and measuring the hydrogen concentration in the drywell and suppression chamber, mixing the atmosphere of both drywell and suppression chamber and controlling combustible gas concentrations in the primary containment without reliance on purging and without the release of radioactive material to the environment.
b. The primary systems for combustible gas control, including measuring and sampling, meet the design, quality assurance, redundancy, energy source, and instrumentation requirements for an engineered safety feature system. They will not introduce safety problems affecting containment integrity.
c. One recombiner package is prov ided per unit. Each recombiner has the capability of cross connection to the other unit in order to provide 100% redundancy. The units are located outside of LSCS-UFSAR 7.3-58 REV. 17, APRIL 2008 the primary containment in an accessible area during normal operation. They can be tested and/or inspected during normal plant operation or during shutdown conditions.
d. Combustible gas control system components are protected from postulated missiles and pipe whip as required to assure proper operation. The system is single failureproof for all active components.
e. The combustible gas control system will be activated after a LOCA in time to assure that the hydrogen concentration does not exceed 4 volume percent of hy drogen in either the drywell or wetwell atmospheres. In addition, the LSCS containment is

nitrogen inerted to an oxygen concentration of 4% by volume. This is below the combustible lim it of oxygen in hydrogen but still provides enough oxygen to re act with all the hydrogen that would be produced by the metal water reaction.

f. The combustible gas control systems are designed so that all components are Seismic Category I. The units are capable of cross-connection to provide redundancy and of withstanding the temperature and pressure transients resulting from a LOCA. All components subjected to containment atmosphere can withstand the humidity and radiation conditions in the containment following a LOCA.
g. The recombiner units are remotely operated from the main control room and the local control panel in the aux. electric equipment room. There are no local operating adjustments that need to be made on a unit operating in a post-LOCA environment. Therefore, no biological shielding is required.
h. As a backup to the combustible gas control system, capability is provided to control gas concentrations by purging the containment vent and purge system and containment atmosphere cleanup system.

7.3.5.2 System Description The hydrogen recombining function of th e hydrogen recombiners is abandoned in place. The valves that provide RHR coo ling water to the hydrogen recombiners are also abandoned in place in the closed posi tion. The blower an d associated piping are not abandoned and remain operational to maintain the drywell mixing function. The design basis information for the hydrogen recombination function remains for historical reference. LSCS-UFSAR 7.3-58a REV. 17, APRIL 2008 This system is described in Subsection 6.2.5. The containment atmospheric monitoring system is discus sed in Subsection 7.5.2. The combustible gas control (recombiner) system instrumentation and controls are described in the following subsections. LSCS-UFSAR 7.3-59 REV. 13 7.3.5.2.1 Power Sources The independent instrument and control subsystems use 120-Vac from electrical Division 2 of Unit 1 for System "A" an d 120-Vac from Division 2 of Unit 2 for System "B". System "A" 480-Vac is from Unit 1 Division 2 and System "B" 480-Vac is from Unit 2 Division 2. The containment isolation valves located in Unit 1 that allow System "B" to take suction from and discharge to Unit 1 containment are powered from Unit 1 Division 1. The containment isolation valves located in Unit 2 that allow System "A" to take suction from and discharge to Unit 2 containment are powered from Unit 2 Division 1. This arrangement is used to prevent the loss of a unit's Division 2 bus from preventing the opposite unit's combustible gas control system from being cross conne cted to the affected unit.

7.3.5.2.2 Initiating Circuits Since the use of this system will only be needed in the unlikely event of a LOCA where the hydrogen level in the drywell/containment approaches the established limits of concentration, there are no automatic initiating circuits in this system. The system is manually initiated by oper ating personnel in the control room and the aux. electric equipment room.

7.3.5.2.3 Logic and Sequencing Interlocks are provided in the control circuitry which compel the control room operator to start the system in proper sequence. The recombiner heaters are temperature controlled and monitored from the local control panel in AEER. Overtemperature trips are provided to shut off power to the heaters on high

temperature. Low process gas flow is annunciated on the local control panel. 7.3.5.2.4 Redundancy and Diversity Instrumentation and control for each redu ndant/combustible gas control system are completely independent of each other.

7.3.5.2.5 Actuated Devices All control valves, blowers, and heaters are initiated by manually operated control switches on the control room panels or the local control panel in the AEER. The valves are equipped with position limit switches, and the valve position is indicated on the respective control room panels by lights. The heater and blower operating status is also indicated by lights on the control room panels and the local control panel. LSCS-UFSAR 7.3-60 REV. 13 7.3.5.2.6 Separation The combustible gas control system is segregated into two independent systems. 7.3.5.2.7 Testability

The combustible gas recombiner instrument ation and control system can be tested during normal plant operation to verify the operability of the system. The control valves can be operated from the control room or local control panel to check operation. The blowers and heaters can be operated from the control room or local control panel. The flow control loops can be checked for operation and control with the blower running. The recombiner heat ers can be turned on from the control room or local control panel to check operation. Since this is a manually initiated system from the control room and the AEER, each redundant system is manually checked for system operability. Indication by lights provides information for operational check of the valves. The blower operation is checked by lights and flow instrumentation. 7.3.5.2.8 Environmental Considerations

The combustible gas recombiner system is located outside of the drywell/containment and will only be needed in the unlikely event of a LOCA where the established hydrogen level in the drywell/containment approaches the established upper limits of concentration. Components are qualified for the expected most severe environmental conditions at this location. 7.3.5.2.9 Operational Considerations The combustible gas recombiner system is no t required for normal plant operation. After a LOCA, several other subsystems will fi rst be started at different intervals. This system is initiated manually from the control room and the local control panel in the AEER. The recombiner is manually energized and after a period of about 1-1/2 hours the recombiner will be up to operating temperature. Each hydrogen recombiner package unit is skid mounted and is an integral package. The recombiner units are remotely started from independent control room panels and local control panels which are physically and electrically separated. 7.3.5.2.10 Operating Bypasses The combustible gas control system has no automatic operating bypasses. Manual bypasses are indicated in the control room via the ESF status indication panel as described in Section 7.8. Manual bypasses consist of "racking-out" fan breakers, opening starter feeder breakers at valve motor control centers, shutting isolation valves to instruments and sensors which control the subsystem, and other operations meeting the three conditions given in Regulatory Guide 1.47. LSCS-UFSAR 7.3-61 REV. 14, APRIL 2002 7.3.5.2.11 Final System Drawings The final system drawings for the Combus tible Gas Control System are shown in electrical schematics and Drawing No. M-130.

7.3.6 Standby

Power System Instrumentation and Controls 7.3.6.1 Design Basis Refer to Subsection 8.1.2 of this USFAR and to Table 1, "Design Basis Events" of IEEE 308-1971. 7.3.6.2 Description The standby a-c power system provides a se lf-contained source of electrical power which is not dependent on auxiliary transformer sources of supply and which is capable of supplying sufficient power for th ose electrical loads which are required for the simultaneous safe shutdown of both units, including the load in one unit which is required to combat a loss-of-coolant accident. The standby a-c power system produces a-c power at a voltage and frequency compatible with normal bus

requirements. The standby diesel generators are applied to the various plant buses so that the loss of any one of the diesel generators will not prevent the safe shutdown of either unit. The total system satisfies single-failure criteria. In the event that both sources of auxiliary power (system and unit auxiliary transformers) are lost for either one or both units, the auxiliaries essential to safe shutdown will be supplied by the corresponding diesel-driven generators. One diesel generator is permanently assigned to each of the three engineered safety features electrical system 4160-volt buses for each unit. Each diesel-generator system is housed in a separate room, which is provided with an independent source of ventilation air. The design of the rooms prevents the possibility that missiles, explosion, or fire from one diesel generator might affect its redundant counterpart.

Each diesel generator is designed and in stalled to provide a reliable source of redundant onsite-generated auxiliary powe

r. It is capable of supplying the engineered safety features loads assign ed to the engineered safety features electrical system bus which it feeds.

Each diesel generator with its associated au xiliaries is designed to meet the station Safety Class 1 design criteria.

LSCS-UFSAR 7.3-62 REV. 14, APRIL 2002 The diesel generators are so applied to th eir respective buses that the loss of one diesel generator cannot affect both of any two redundant buses as described in Subsection 8.3.1.1.2. Safe shutdown capability will therefore not be affected by such a diesel generator failure. For each diesel engine, the fuel oil system, air starting system, and generator output and excitation systems are equipped with instrumentation to monitor all important parameters and to annunc iate abnormal conditions. This instrumentation is described in the following. Following a manual start (by control switch), the following protective devices are in service during operation of the diesel generator, and their operation automatically shuts down the diesel generator when an out of tolerance condition exists:

a. mechanical
overspeed, low lube-oil pressure (with time delay), high jacket water temperature, and overcrank (with time delay).
b. electrical
reverse power relay, generator differential current relays, generator phase overcurrent relays, and loss of excitation.

DG-0, 1A, and 2A only: generator under frequency, generator neutral ground. Following an automatic start (by safety injection signal), the protective devices listed below are in service during emergenc y operation of the diesel generator. Their operation will automatically shut down the diesel generator when an out of tolerance condition exists.

LSCS-UFSAR 7.3-63 REV. 13 a. mechanical

overspeed.
b. electrical
generator differential relays.

When out of service, the diesel engine temperature is maintained by a thermostatically controlled heater. The following alarms are provided:

a. local (at diesel-g enerator location):

high crankcase pressure, lube oil low pressure, failure to start, lube oil high temperature, jacket water high temperature, and engine overspeed. D/G-0, 1A, and 2A only: fuel oil filter high differential pressure, generator overcurrent, lube oil filter restricted, engine generator trouble, lockout, engine generator trouble, low engine temperature, generator neutral ground, reverse power, underfrequency, undervoltage, LSCS-UFSAR 7.3-64 REV. 13 stator temperature high, generator loss of field, low circulating oil pressure,* and low soak back oil pressure*. D/G-1B and 2B only: starting air low pressure, engine low water level, engine tripped, low water temperature, high stator temperature, low oil temperature, low water pressure, battery charger failure, and d-c trouble. Note: When the DG is shutdown, the low lube oil pressure alarm will annunciate on low circulating or soak back oil pressure. b. main control room alarms

diesel-generator trouble, diesel-generator main feed breaker trip,
  • Alarm is only functional wh en the diesel is shutdown.

generator overload, and diesel oil storage tank level low. D/G-0, 1A, and 2A only: loss of d-c to engine panel, generator current-differential trip, failure to start, LSCS-UFSAR 7.3-65 REV. 13 exciter discharge trip, unit manual setup, air compressor breaker auto-trip, engine oil circulating pump auto-trip, not ready for auto-start, and voltage regulator selector switch in manual. D/G-1B and 2B only: generator ground, lockout trip, engine overspeed, engine running, engine trip, and HPCS system not ready for auto-start, HPCS protective relay power failure.

The following manual controls are provided:

a. local: diesel engine generator "START" and "STOP" pushbuttons, diesel engine generator "EMERGENCY STOP" and "RESET" pushbuttons, maintenance "CUT-OUT" switch (p revents starting of diesel while out of service for maintenance), governor control switch, generator voltage adjuster control switch, and auto-manual transfer swit ch (DG-0, 1A, and 2A only).

LSCS-UFSAR 7.3-66 REV. 13 b. main control room

diesel engine generator "START/STOP" control switch, engine governor control switch, and generator voltage adjuster control switch, and diesel engine generator "REM OTE-LOCAL" control (DG1B and 2B). The following instrumentation is provided:
a. local (at diesel-g enerator location):

generator wattmeter, generator varmeter, generator frequency meter, elapsed time meter, generator ammeter (with phase selector switch), generator watt-hour meter, engine starting air pressure gauge, engine lube oil pressure gauge, engine fuel oil pressure gauge, soakback lube oil pressure gauge, engine exhaust temperature, generator voltmeter (with phase selector switch), stator temperature monitor, fuel day tank level, engine tachometer, LSCS-UFSAR 7.3-67 REV. 14, APRIL 2002 lube oil temperature, cooling water temperature, crankcase pressure lube oil filter differential pressure, cooling water pressure, fuel temperature, and scavenging air pressure. D/G-0, 1A, and 2A only: fuel strainer differential pressure, and fuel filter differential pressure. D/G-1B and 2B only: exciter field voltmeter, exciter field ammeter, synchronizing lights, scope and voltmeters, water jacket pressure and motor driven fuel oil pump filter inlet pressure b. main control board: generator voltmeter (with phase selector switch), generator wattmeter, generator varmeter, generator ammeter, generator frequency meter, generator synchroscope (with "incoming" and "running" voltmeters), LSCS-UFSAR 7.3-68 REV. 14, APRIL 2002 generator synchronizing lights, and 4-KV ESF bus voltmeter. The following relays are provided:

over and under voltage relay (27.59DG) (DG-0, 1A, and 2A only), reverse power relay (32DG), under frequency relay (81) plus auxiliary relay (DG-0, 1A, and 2A only), diesel-generator differential relay (87), lockout relay (86), loss of field relay (40DG), overcurrent with voltage restraint relays (51V), overcurrent relay (51), and diesel-generator neutral overvoltage relay (59DG). 7.3.6.3 Analysis The general functional requirements for the standby power systems instrumentation and controls are discussed in Chapter 8.0. The following descriptive an alyses are also provided:

a. Compliance with NRC General Design Criterion 17, "Electric Power Systems", is described in Subsections 3.1.2.2.8 and 8.3.1.2. b. Compliance with NRC General Design Criterion 18, "Inspection and Testing of Electric Power Systems", is described in Subsections 3.1.2.

2.9 and 8.3.1.2.

c. Conformance with applicable regulatory guides is described in Appendix B.

LSCS-UFSAR 7.3-69 REV. 13 A planned quality assurance program covering design, fabrication, testing, purchase, shipment, installation, and storage of equipment for safety-related systems is described in Chapter 17.0.

7.3.7 Reactor

Building Ventilation and Pressure Control System

7.3.7.1 Design Bases

a. The ventilation pressure cont rol functions to hold the ECCS equipment sections of the reactor building at a negative pressure differential of 1/4-inch water gauge during all normal operating conditions.
b. The design leak rate from atmosphere to the reactor building is 100% of the reactor building volume per day at 1/4-inch water presssure differential.
c. If radioactivity is detected in the exhaust gas from the reactor building, the control system isolates the building and starts and directs the ventilation exhaust to the standby gas treatment

system. 7.3.7.2 Description This system is discussed in Section 9.4. 7.3.7.3 Analysis The safety analysis of this system and the associated instrumentation and controls is presented in Section 9.4.

7.3.8 Standby

Gas Treatment System Instrumentation and Controls 7.3.8.1 Design Bases The standby gas treatment system instrumentation and controls are designed to meet the following safety design bases:

a. The standby gas treatment system instrumentation and controls start the standby gas treatment sy stem to maintain the reactor building at negative pressure to a ssure infiltration and to filter the radioactive particulates and iodine from the influents in the case of a loss-of-coolant accide nt or fuel-handling accident.

LSCS-UFSAR 7.3-70 REV. 13 b. The standby gas treatment system responds automatically so that no action is required of station operators following a loss-of-coolant or fuel-handling accident.

c. The responses of the standby gas treatment system are indicated on the main control board.
d. Facilities for the manual control of the standby gas treatment system are provided in the control room.
e. No single failure, maintenance, calibration, or test operation prevents operation of the standby gas treatment system.
f. The standby gas treatment system flow can be manually adjusted at the local control panel located adjacent to the SGTS train. g. Loss of offsite electric power and instrument air does not affect the normal functioning of the SGTS.
h. The physical events accompanying a loss-of-coolant or fuel-handling accident do not prevent correct functioning of the instrumentation and controls.
i. Seismic motion resulting from earthquake ground motion, missile, wind, and flood does not impair the operation of the instrumentation and controls.
j. To assure availability of the standby gas treatment system, it is possible to test the response of the instrumentation and controls.
k. The requirements of IEEE 279, 308, 323, 338, and 344 are met by the standby gas treatment system instrumentation and controls. In addition, General Design Criteria 13, 19, 20

through 24, and 29 of 10 CFR 50, Appendix A have been implemented in the design of this control system. 7.3.8.2 System Description The instrumentation and controls of the standby gas treatment system (SGTS) are designed so that the SGTS functions to ma intain the reactor building at a negative pressure with respect to the outdoors on an SGTS initiation signal in order to

preclude leakage of radioactive particulates and gases directly to the outdoors, and to reduce radioactive particulates and gaseous concentration in the exhaust air from the reactor building before the air is exhausted to the outdoors. LSCS-UFSAR 7.3-71 REV. 13 The standby gas treatment system is desc ribed in detail in Subsection 6.5.1 and shown schematically in Drawing No. M-89. 7.3.8.2.1 Power Sources

Each SGTS equipment train has an SGTS fan, cooling fan, electric heating coil, and associated motor-operated isolation valves. Power supply for the various components of each SGTS equipment train is from separate essential a-c buses that can receive standby a-c power. Control power for isolation valves and controls comes from the bus that powers th e corresponding equipment train. The isolation dampers in the reactor building ventilation system supply and

exhaust duct headers are operated by air cylinders, with instrument air controlled by solenoid valves for each isolation valve. Each isolation damper is provided with spring-loaded closure upon failure of the instrument air supply. Each electric solenoid valve initiating the closure of each redundant isolation damper in the reactor building supply and exhaust ducts is powered from an independent essential power bus.

7.3.8.2.2 Initiating Circuits, Logic, and Sequencing The system is automatically started in resp onse to any one of the following signals:

a. high pressure in the drywell of either Unit 1 or Unit 2 (refer to Subsection 7.3.2 for details), b. low water level in the reactor vessel of either Unit 1 or Unit 2 (refer to Subsection 7.3.2 for details), c. high radiation in the fuel pool vent plenum of either Unit 1 or Unit 2 (refer to Subsection 7.6.2.2), or
d. high radiation in the reactor building ventilation exhaust plenum (refer to Subsecti on 7.6.2.2 for details).

If any one of the above signals is received, redundant relay circuitry automatically causes the following actions simultaneously:

a. initiation of reactor building isolation, b. shutdown of reactor building ventilation system, c. opening of proper standby gas treatment system isolation valves, and LSCS-UFSAR 7.3-72 REV. 14, APRIL 2002 d. startup of both standby gas tr eatment system equipment trains, causing annunciation of an alarm on the main control board.

The SGTS can also be operated manually from the main control board. When the trains have begun operating, the audible and visual alarms on the main control board warn the operator to shut down one of the trains. Separate handswitches located on the main control board for each of the equipment trains permit manual shutdown of one of the trains within 30 seconds. The isolation dampers in the reactor building ventilation system supply and exhaust ducts are air operated to open and spring return to close. These dampers are specified and tested to ensure maximum 10-second closure time and are operated by air cylinders, with instrument air controll ed by an air solenoid valve for each isolation valve. Since the dampers fail closed, air supply is not safety related. On loss of control power or control air, the dampers close, after which a manual reset switch must be activated before they can be opened again. Isolation valves in the standby gas treatment system fail in place on loss of electric power. All controls and instrumentation essential to the operation of the standby gas treatment system are designed to meet IEEE 279 criteria. The instrumentation is independently connected to logic trains that initiate independent and separate signals for system operation to prevent co nnecting redundant instrumentation trains to a common point. 7.3.8.2.3 Bypasses and Interlocks All the motorized isolation valves pertinent to an SGTS equipment train are

interlocked with the operation of the SGTS fan through a relay circuit. The SGTS cooling fan is interlocked not to operate wh en the SGTS fan is in operation. To protect against overheating, the electric heating coil for relative humidity control is interlocked with the SGTS fan operation. Air flow through each SGTS is controlled automatically with a corresponding modulating valve, and flow is indi cated on the main control board. On stopping of the SGTS fan, the SGTS cooling fan is automatically started and the proper isolation valves opened to dissipate the decay heat from the charcoal adsorber. Manual charcoal deluge valves are operated locally. The normally closed manual isolation valves upstream of the solenoid deluge valve, in all cases, require local actions to initiate water flow. The deluge system will spray the adsorber compartment and thereby precluding the chance of an adsorber fire. LSCS-UFSAR 7.3-73 REV. 13 7.3.8.2.4 Redundancy and Diversity Each standby gas treatment unit is automatically initiated by two independent trip logics. To initiate a standby gas treatment unit, both trip logics must be tripped. Instrumentation for each filter train with the system is completely independent of

the other. 7.3.8.2.5 Actuated Devices Initiation of the SGTS includes starting of the SGTS fan, energizing the electric heating, and opening the valves on the inlet and outlet sides of the SGTS equipment train. 7.3.8.2.6 Separation The channels and logic circuits are physically and electrically separated to preclude the possibility that a single event can prev ent operation of the SGTS. Electrical cables for instrumentation and control on each SGTS equipment train are routed separately.

7.3.8.2.7 Testability Control and logic circuitry used in the controls for the standby gas treatment system can be checked individually by applying test or calibration signals to the sensors and observing trip or control respon ses. Operation of the isolation valves and fans from manual switches verifies the ability of breakers and damper mechanisms to operate. The automatic control circuitry is designed to restore the standby gas treatment system to normal operation if a fuel-handling or loss-of-coolant accident occurs during a test. 7.3.8.2.8 Environmental Considerations Temperature, pressure, humidity, and radiation dosage are considered in the

selection of the various equipment, instrumentation, and controls for the standby gas treatment system. These are describe d in Section 3.11 and Subsection 6.5.1. 7.3.8.2.9 Operational Considerations During normal plant operations, the standby gas treatment system is operated only in the test mode. The automatic circuitry is designed to restore the standby gas treatment system to normal operation if a signal for initiation of the SGTS is received as described previously in this subsection.

LSCS-UFSAR 7.3-74 REV. 14, APRIL 2002 Each standby gas treatment equipment train is instrumented with local pressure drop indicators measuring differentials across filter banks. Local temperature indicators are provided as shown in Drawing No. M-89. A flow control valve on the inlet to each equipment train limits the airflow rate through the train to design value to permit high filtration efficienci es. This valve is responsive to a flow element and transmitter upstream of the valve.

7.3.8.2.10 Operating Bypasses The standby gas treatment system has no automatic operating bypasses. Manual bypasses are indicated in the control room via the ESF status indication panel as described in Section 7.8.

Manual bypasses consist of "racking-out" fan breakers, opening starter feeder breakers at valve motor control centers, shutting isolation valves to instruments and sensors which control the subsystem and other operations meeting the three conditions given in Regulatory Guide 1.47. 7.3.8.2.11 Final System Drawings

The final system drawings for the SGTS are shown in electrical schematics and Drawing No. M-89.

7.3.8.3 Analysis The standby gas treatment control system is designed to initiate action that provides timely protection against the co nsequences of the release of radioactive materials inside the secondary containment following any accident. Chapter 15.0 identifies and evaluates postulated events that can result in the release of fission products due to an accident. The conseque nces of such an accident are described and evaluated. Because essential variables are monitored by channels arranged for physical and electrical independence, and because a dual trip system arrangement is used to initiate the standby gas treatme nt system, no single failure, maintenance operation, calibration operation, or test can prevent the system from operating when required. The sensor circuitry and logics used in the standby gas treatment control system are not used in the control of any process system. Malfunction and failures in the controls of process systems thus have no direct effect on the standby gas treatment control system.

The various motive power supplies used fo r the standby gas treatment system logic circuitry and controls provide assurance that the required initiation can be effected in spite of loss of electric power or loss of instrument air. In no case does the loss of LSCS-UFSAR 7.3-75 REV. 13 a single power supply prevent initiation of the standby gas treatment system when it is required. All instruments, isolation valves, closing mechanisms, and cables of the standby gas treatment system can operate under the worst environmental conditions associated with postaccident operation. All active components of the SGTS instrumentation and controls can be tested and calibrated during plant operation. All sensors and associated equipment are designed to meet Seismic Category I requirements and are protected from fire, explosion, missiles, lightning, wind, and flood to preclude functional degradation of the system performance. Reactor building ventilation supply and exhaust air duct isolation valves are designed to fail closed, with a closure time not greater than 10 seconds. Inputs to annunciators and indicators are arranged so that no malfunction of the annunciating and indicating devices can fu nctionally disable the system. Direct signals from the standby gas treatment control system sensors are not used as inputs to annunciating or data-logging eq uipment. Isolation is provided between the primary signal and the information output.

All controls for interrupting any part of the system operation are located in the main control room or at a control statio n which is accessible if conditions may require use of the standby gas treatment sy stem. Any locally located controls have locks to prevent unauthorized operation. All instrumentation and controls essential to the operation of the standby gas treatment system meet IEEE 279 criteria. 7.3.9 RHR/Containment Spray Cooling System Instrumentation and Controls 7.3.9.1 System Description The containment spray cooling system is an operating mode of the residual heat removal system. It is designed to provide the capability of condensing steam in the suppression pool air volume and/or the dr ywell atmosphere and removing heat from the suppression pool water volume. The system is manually initiated when necessary. The RHR system is shown in P&ID Drawing Nos. M-96 and M-142.

7.3.9.1.1 Power Sources Power for the RHR system pumps is supplied from two a-c buses that can receive standby a-c power. Motive and control power for the two loops of containment spray LSCS-UFSAR 7.3-76 REV. 13 cooling instrumentation and control equipment are the same as that used for LPCI A and LPCI B loops. 7.3.9.1.2 Equipment Design Control and instrumentation for the following equipment is required for this mode

of operation:

a. two RHR main system pumps, b. pump suction valves, and
c. containment spray discharge valves.

Sensors needed for operation of the equipment are drywell pressure switches. The instrumentation for containment spray cooling operation assures that water will be routed from the suppression pool to the containment spray system for use in the drywell and/or wetwell air volumes.

Containment spray operation uses two pump l oops, each loop with its own separate discharge valve. All components pertinent to containment spray cooling operation are located outside of the dryw ell. The system can be op erated such that the spray can be directed to the drywell and/or the wetwell air volume. The containment spray cooling system is manually initiated from the main control room when a LOCA signal exists such that drywell pressure is above the setpoint and the injection valve is fully closed thus allowing the operator to act. 7.3.9.1.3 Initiating Circuits Containment Spray A Drywell pressure (permissive for manual in itiation) is monitored by two absolute pressure switches mounted in instrument racks outside the primary containment. Cables from these switches are routed to the control room relay logic cabinets. The two drywell pressure switches are electrically connected so that no single sensor failure can prevent initia tion of containment spray A.

Containment Spray B Initiation of containment spray B is identical to that of "A".

LSCS-UFSAR 7.3-77 REV. 13 7.3.9.1.4 Logic and Sequencing The operating sequence of containment spray following receipt of the necessary initiating signals is as follows:

a. The LPCI system pumps continue to operate.
b. Valves in other RHR modes are manually positioned or remain as positioned during LPCI. c. The RHR service water pumps are started manually. d. RHR service water discharge valves to the RHR heat exchanger are opened manually.

The containment spray system will continue to operate until the operator closes containment spray injection valves. The operator can then initiate another mode of RHR. 7.3.9.1.5 Bypasses and Interlocks No bypasses are provided for the containment spray system.

7.3.9.1.6 Redundancy and Diversity Redundancy is provided for the containment spray function by two separated divisional loops. Redundancy and divers ity of initiation permissive sensors is described in Subsection 7.3.9.1.3. 7.3.9.1.7 Actuated Devices The RHR A and RHR B loops are used for co ntainment spray. Therefore, the pump and valves are the same for LPCI and containment spray function except that each has its own discharge valve. See Subsecti on 7.3.1.2.4.6 for specific information. 7.3.9.1.8 Electrical Separation

Containment spray is a Division 1 (RHR A) and a Division 2 (RHR B) system. Manual controls, logic circuits, cabling, and instrumentation for containment spray are mounted so that Division 1 and Division 2 separation is maintained. 7.3.9.1.9 Testability The containment spray system is capable of being tested up to the last discharge valve during normal operation. Other control equipment is functionally tested during manual testing of each loop. Adequate indication in the form of panel lamps and annunciators are provided in the control room. LSCS-UFSAR 7.3-78 REV. 17, APRIL 2008 Testing for functional operability of the co ntrol logic relays can be accomplished by use of plug-in test jacks and switches in conjunction with si ngle sensor tests. 7.3.9.1.10 Environmental Considerations Refer to Section 3.11.

7.3.9.1.11 Operational Considerations 7.3.9.1.11.1 General Information Containment spray is a mode of the RHR and is not required during normal operation.

7.3.9.1.11.2 Reactor Operator Information Sufficient temperature, flow, pressure, and valve position indications are available in the control room for the operator to accurately assess containment spray operation. Alarms and indications are shown in Drawing Nos. M-96 and M-142.

7.3.9.1.11.3 Setpoints The suppression pool containment spray cooling system is manually operated. 7.3.9.2. Analysis 7.3.9.2.1 General Function al Requirement Conformance When the RHR system is in the containment spray cooling mode, the pumps take suction from the suppression pool, pass it through the RHR heat exchangers, and either return it to the suppression pool or inject it into the wetwell atmosphere. The hydrogen recombining function of th e hydrogen recombiners is abandoned in place. The valves that provide RHR coo ling water to the hydrogen recombiners are also abandoned in place in the closed posi tion. The following information for this function remains for historical reference. In the event the hydrogen recombiners are required to limit hydrogen concentration in the drywell, the RHR system provides water to the water-spray cooler in the recombiner to cool hot gases and condense the water vapor exiting the recombiner reaction chamber. The interface between the hydrogen recombiners and RHR system is described in subsec tion 6.2.5. Initiation of the containment spray mode of the RHR system is described in Subsection 7.3.9.1.3. 7.3.9.2.2 Conformance to Industry Codes and Standards Refer to 7.A.3.4. LSCS-UFSAR TABLE 7.3-1 (SHEET 1 OF 2) ECCS INSTRUMENTATION LIMITS TABLE 7.3-1 REV. 16, APRIL 2006 FUNCTIONAL UNIT Note 1 TRIP SETPOINT Note 2 ALLOWABLE VALUE Note 3 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY Note 2 CALIBRATIONNote 2 DESIGN-BASIS ALLOWABLENote 2 DEVICE RANGE (1) Reactor Water Level -Low, Level #2 >-97.9 Note 4 -150/0/+60 in.Note 4 (2) Drywell Pressure - High 

<2.0 psig     0.2-6.0 psi (3) Reactor Water Level -High, Level 8 Note 4    Note 2 Note 4     0-60 in. Note 4 (4) HPCS Discharge Pressure -High (Bypass) 20-180 psig (5) HPCS System Flow Rate -Low (Bypass)   Note 2    Note 2  (6) Drywell Pressure - High   <2.0 psig    0.2-6.0 psi (7) Reactor Water Level -Low, Level #1 
 >-161.5 in. Note 4    -150/0/160 in.Note 4 (8) ADS Timer   <120 seconds 40-120 sec. (9) Reactor Water Level - Low, Level 3 (confirmatory) Note 4    Note 2 Note 4     0-60 in. Note 4 (10) ADS Drywell Pressure Bypasss Timer   Note 2     1-30 min. (11) LPCS Pump Discharge   > 125 psig    10-340 psig LSCS-UFSAR TABLE 7.3-1 (SHEET 2 OF 2)

ECCS INSTRUMENTATION LIMITS TABLE 7.3-1 REV. 16, APRIL 2006 FUNCTIONAL UNIT Note 1 TRIP SETPOINT Note 2 ALLOWABLE VALUE Note 3 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY Note 2 CALIBRATIONNote 2 DESIGN-BASIS ALLOWABLENote 2 DEVICE RANGE (12) RHR (I.PCI Mode) Pump Discharge Pressure -High (Permissive) >100 psig 10-20 psig (13) Reactor Vessel Water Level >-161.5 in. Note 4 -150/0/160 in. Note 4 (14) Reactor Low Pressure Interlock, Injection Valve >450 psig <550 psig 0-1200 psig (15) Drywell Pressure - High <2.0 psig 0.2-6.0 psi (16) LPCS Pump Discharge Flow - Low (Bypass) Note 2 Note 2 (17) Drywell Pressure - High <2.0 psig 0.2-6.0 psi (18) Reactor Vessel Water Level -Low, Level #1 >-161.5 in. Note 4 -150/0/160 in. Note 4 (19) Reactor Low Pressure Interlock >450 psig <550 psig 0-1200 psig (20) LPCI Pump A and B Start -Time Delay Relays (1/Pump) Note 2 1.5-15 sec. (21) LPCI Pump Discharge Flow- Low (Bypass) (1/Pump) Note 2 Note 2 Notes: 1. The differential pressure sensors (level switches and P transmitters) are designed for one side pressurization capability of up to 2000 psig without damage to diaphragms. 2. For Trip Setpoints, Analytic or Design Basis Limit, Accuracy, Calibration, and Desi gn-Basis Allowance, refer to the applicab le calculation, listed in Appendix D of Technical Requirements Manual. 3. See Technical Specifications for Allowable Values. 4. All reactor water levels are referenced to instrument zero at 527.6". Vessel Zero is the inside bottom of the RPV at centerl ine. LSCS - UFSAR TABLE 7.3-2 (SHEET 1 OF 3) TABLE 7.3-2 REV. 16, APRIL 2006 PRIMARY CONTAINMENT, SECONDARY CONTAINMENT AND REACTOR VESSEL ISOLATION ACTUATION INSTRUMENT UNITS FUNCTIONAL UNIT Note 1 TRIP SETPOINT Note 2 ALLOWABLE VALUE Note 3 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY Not e 2 CALIBRATION Note 2 DESIGN-BASISALLOWABLE Note 2 DEVICE RANGE Reactor Core Isolation Cooling (1) RCIC Steamline Flow - High < 300% (< 191 in. wtr.) 300/0/+300 in. (1a) RCIC Steam Line Flow - Timer Note 2 Note 2 (2) RCIC Steam Supply Pressure -Low DB 10-240 psig (3) RCIC Pipe Routing Area Temperature - High Note 5 50-350°F (4) RCIC Pipe Routing Area Temperature - High Note 5 0-150°F (5) RCIC Turbine Exhaust Diaphragm Pressure - High DB 05-80 psig (6) RCIC Equipment Room Temperature - High /Note 5 50-350°F (7) RCIC Equipment Temperature - High /Note 5 0-150°F (7a) Drywell Pressure - High <2.0 psig 0.2 - 6 psig Shutdown Cooling Isolation (8) Reactor Vessel Water Level - Low, Level #3 <7.5 in Note 4 0-60 in. Note 4 LSCS - UFSAR TABLE 7.3-2 (SHEET 2 OF 3) TABLE 7.3-2 REV. 16, APRIL 2006 FUNCTIONAL UNIT Note 1 TRIP SETPOINT Note 2 ALLOWABLE VALUE Note 3 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY Note 2 CALIBRATION Note 2 DESIGN-BASISALLOWABLE Note 2 DEVICE RANGE (9) Reactor Steam Dome Loop A Pressure - High Loop B <161 psig <161 psig 10.0-240 psig 0-500 psig Reactor Water Cleanup System (10) Flow - High <104.5 gpm 1-100 gpm (10a) Differential Flow - Timer Note 2 (11) Pump and Valve Area Temperature -High Note 5 50-350°F (12) Pump Area Ventilation Temp. T-High Note 5 0-150°F (12a) Hx Equipment Area Temperature - High 50-350°F (12b) Hx Equipment Area T - High 0-150°F (12c) Holdup Pipe Area Temperature - High 50-350°F (12d) Holdup Pipe Area T - High 0-150°F (12e) F/D Valve Area Temperature - High 50-350°F (12f) F/D Valve Area T - High 0-150°F (12g) Flow - High (13) Reactor Vessel Water Level - Low, Level #2 

>-70 in. Note 4    -150/0/+60 in.

Note 4 Residual Heat Removal (14) RHR Flow - High <201 in. wtr. -10/0/+15 psid.

LSCS - UFSAR TABLE 7.3-2 (SHEET 3 OF 3) TABLE 7.3-2 REV. 16, APRIL 2006 FUNCTIONAL UNIT Note 1 TRIP SETPOINT Note 2 ALLOWABLE VALUE Note 3 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY Note 2 CALIBRATION Note 2 DESIGN-BASISALLOWABLE Note 2 DEVICE RANGE Primary Containment (15) Reactor Vessel Water Level Low, Level #3 

 >7.5 in. Note 4    0-60 in. Note 4 (16) Reactor Vessel Water Level Low, Level #2  
>-70 in. Note 4    -150/0/60 in.

Note 4 (17) Reactor Vessel Water Level Low, Level #1 

 >-149 in.

Note 4 -150/0/60 in. Note 4 (18) Drywell Pressure - High <2.0 psig 0.2-6.0 psi (19) Main Steamline Pressure - Low >825 psig 200-1200 psi (20) Main Steamline Flow - High <123 psid ** (21) Deleted (22) Main Steamline Temperature - High Note 5 0.0-150°F (23) Condenser Vacuum - Low 0.8-29.2 in. Hg (23a) Reactor Building Ventilation Exhaust Radiation - High Note 2 0.01-100 mR/hr (23b) Secondary Containment (24) Reactor Building Exhaust Rad - High 0.01-100 mR/hr (25) Drywell Pressure - High <2.0 psig 0.2-6.0 psi (26) Reactor Vessel Water Level Low, Level #2 

>-70 in. Note 4    -150 to 60 in.

Note 4 (27) Fuel Pool Vent Exhaust Rad - High Note 2 0.01-100 Mr/hr Notes: 1. The differential pressure sensors (level switches and P transmitters) are designed for one side pressurization capability of up to 2000 psig without damage to diaphragms. 2. For Trip Setpoints, Analytic or Design - Basis Limit, Accuracy, Calibration, and Design-Basis Allowance, refer to the applicable calculation, listed in Appendix D of Technical Requirements Manual (TRM). 3. See Technical Specifications or TRM, as applicable for Allowable Values. 4. All reactor water levels are referenced to instrument zero at 527.6". Vessel Zero is the inside bottom of the RPV at centerl ine 5. During preoperational testing, the trip setpoints were set at 40°F above space ambient temperature. Final setpoints were established based upon operational data after calibration of detectors and module TABLE 7.3-3 REV. 0 - APRIL 1984 LSCS - UFSAR TABLE 7.3-3 PROCESS RADIATION MONITORING SYSTEMS CHARACTERISTICS MONITORING SUBSYSTEM INSTRUMENT RANGE

  • INSTRUMEN T SCALE (DECADE LOG): TRIP PER UPSCALE CHANNEL DOWNSCAL E EXPECTED SENSITIVITY Main Steamline 1 to 10 6 mR/h 6 2 1 See Table 11.5-2 Air ejector off-gas (pretreat) 1 to 10 6 mR/h 6 1 1 (posttreat) 0.01 to 10 6 counts/sec** 5 3 1 Process liquid 10 to 10 6 counts/min** 5 1 1 Carbon bed vault 1.0 to 10 6 mR/h 6 1 1 Secondary Containment (Rx Bldg Exhaust Plenum) 0.01 to 100 mR/h 4 1 1 Secondary Containment (Refuel Exhaust) 0.01 to 100 mR/h 4 1 1
  • Range or measurements depends on items such as source geometry, background radiation, shielding, energy levels, and method of sampling. ** Readout depends on the pulse height discriminator setting.

LSCS - UFSAR TABLE 7.3-4 TABLE 7.3-4 REV. 14, APRIL 2002

This page intentionally left blank.

LSCS - UFSAR TABLE 7.3-5 SHEET 1 OF 2 TABLE 7.3-5 REV. 16, APRIL 2006 CONTROL ROD BLOCK INSTRUMENTATION LIMITS FUNCTIONAL UNIT TRIP SETPOINT Note 1 ALLOWABLE VALUE Note 2 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY Note 1 CALIBRATION Note 1 DESIGN-BASIS ALLOWANCE Note 1 DEVICE RANGE Average Power Range Monitor (1) Neutron Flux - Upscale (flow referenced) DB NA (2) Neutron Flux - Downscale DB NA (3) Neutron Flux - Upscale (Not Run Mode) DB NA Rod Block Monitor (4) Upscale <114% NA (5) Downscale DB NA Source Range Monitors (6) Upscale DB 10-1-10 6 cps (7) Downscale DB Intermediate Range Monitor (8) Upscale DB 2% to (9) Downscale DB Full Scale (10) Rod Worth Minimizer N/A N/A (11) Scram Discharge Volume Water Level - High N/A LSCS - UFSAR TABLE 7.3-5 SHEET 2 OF 2 TABLE 7.3-5 REV. 16, APRIL 2006 CONTROL ROD BLOCK INSTRUMENTATION LIMITS FUNCTIONAL UNIT TRIP SETPOINT Note 1 ALLOWABLE VALUE Note 2 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACY Note 1 CALIBRATION Note 1 DESIGN-BASIS ALLOWANCE Note 1 DEVICE RANGE (12) Recirculation Flow Unit - Upscale 0-100% (13) Recirculation Flow Unit - Comparator 0-100%

Notes: 1. For Trip Setpoints, Accuracy, Calibration, and Design-Basis Allowance, refer to the applicable calculation, listed in Appendix D of Technical Requirements Manual (TRM). 2. See Technical Specifications or TRM, as applicable for Allowable Values. 3. Deleted

LSCS - UFSAR TABLE 7.3-6 TABLE 7.3-6 REV. 14, APRIL 2002 TRIP CHANNEL REQUIRED FOR PRIMARY CONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM

  • TRIP CHANNEL DESCRIPTION NORMAL MINIMUM Reactor vessel low water level (first setting) 2 2 Reactor vessel low water level (second) setting) 2 2 Reactor vessel low water level (third setting) 2 2 Main steamline space high temperature 2 temp 2 differential temp 2 temp 2 differential temp Main steamline high flow 8 8 Main steamline low pressure 2 2 Drywell high pressure 2 2 Reactor building ventilation exhaust high radiation 2 2 Fuel pool ventilation exhaust high radiation 2 2 Main condenser low vacuum 2 2
  • This table shows the normal and minimum number of trip channels required for the functional performance of the containment and reactor vessel is olation control system. The "normal" column lists the normal number of trip channels per trip system. The "minimum" column lists the minimum number of trip channels per untripped trip system required to maintain functional performance. ** For operational specifics, see the Technical Specifications.

LSCS - UFSAR TABLE 7.3-7 TABLE 7.3-7 REV. 15, APRIL 2004 TRIP CHANNELS REQUIRED FOR FUNCTIONAL PERFORMANCE OF HPCS SYSTEM (This table shows in the right-hand column the minimum number of operable trip channels required to maintain functional performance of the HPCS system.) MINIMUM COMPONENT AFFECTED TRIP CHANNEL INSTRUMENT CHANNELS PROVIDED* OPERABLE CHANNELS** HPCS system

initiation Reactor vessel low water level - level 2 Differential Pressure Transmitter 4/trip system 2/untripped parallel pair HPCS system initiation Drywell high pressure Pressure switch 4/trip system 2/untripped parallel pair 1

  • For operational specifics, see Technical Specifications. ** The "Minimum Operable Channels" column lists the minimum number of trip channels per untripped trip system required to maintain functional performance.

LSCS - UFSAR TABLE 7.3-8 TABLE 7.3-8 REV. 14 - APRIL 2002 TRIP CHANNELS REQUIRED FOR FUNCTIONAL PERFORMANCE OF AUTOMATIC DEPRESSURIZATION SYSTEM

(This table shows in the right-hand column the minimum number of trip channels required to maintain functional performance of the automatic depressurization system.)

INITIATING FUNCTION INSTRUMENT CHANNELS PROVIDED 1 MINIMUM CHANNELS 1, 2 Reactor Vessel Low Water Level - level 1 Differential Pressure Transmitter 2/Trip System 2/Trip System Reactor Vessel Low Water Level - Level 3 Differential Pressure Transmitter 1/Trip System 1/Trip System Drywell High Pressure Pressure Switch 2/Trip System 2/Trip System LPCI/LPCS Permissive Pressure Switch 4/Trip System 4/Trip System Time Delay (Initiation) Timer 1/Trip System l/Trip System Time Delay (Hi Drywell Pressure Bypass) Timer 2/Trip System 2/Trip System

________________________

1 For operational specifics, see the Technical Specifications. 2 The "Minimum Channels" column lists the minimum number of trip channels per untripped trip system required to maintain functional performance.

LSCS - UFSAR TABLE 7.3-9 TABLE 7.3-9 REV. 14 - APRIL 2002 TRIP CHANNELS REQUIRED FOR FUNCTIONAL PERFORMANCE OF LPCI "B" AND "C"

(This table shows in the right-hand column the minimum number of trip channels required to maintain functional performance of the LPCI function for the B and C loops).

COMPONENT AFFECTED TRIP CHANNEL INSTRUMENT CHANNEL SPROVIDED 1 MINIMUM CHANNELS1, 2 LPCI initiation (B and C loops) Reactor vessel low water level Differential Pressure Transmitter 2/trip system 2/untripped parallel pair LPCI initiation (B and C loops) Drywell high pressure Pressure switch 2/trip system 2/untripped parallel pair Minimum flow bypass valves (B

and C loops) LPCI pumps discharge low flow Flow switch 1/pump 1/pump LPCI injection valves (B and C

loops) Valve pressure interlock Injection line pressure switch 1/valve 1/valve LPCI injection valves (B and C

loops) RPV low pressure interlock Reactor pressure switch 2/valve 1/valve ________________________

1 For operational specifics, see the Technical Specifications. 2 The "Minimum Channels" column lists the minimum number of trip channels per untripped trip system required to maintain functional performance.

LSCS - UFSAR TABLE 7.3-10 TABLE 7.3-10 REV. 14 - APRIL 2002 TRIP CHANNELS REQUIRED FOR FUNCTIONAL PERFORMANCE OF LPCS SYSTEM AND LPCI "A"

(This table shows in the right-hand column the minimum number of trip channels required to maintain functional performance of the LPCS system and LPCI "A".)

COMPONENT AFFECTED TRIP CHANNEL INSTRUMENT CHANNELS PROVIDED 1 MINIMUM CHANNELS 1LPCS and LPCI A initiation Reactor vessel water level Differential Pressure Transmitter 2/trip system 2/untripped parallel pair LPCS and LPCI A initiation Drywell high pressure Pressure switch 2/trip system 2/untripped parallel pair Minimum flow bypass valve(LPCS

and LPCI A) LPCS/LPCI A pumps discharge low flow Flow switch 1 pump 1 pump LPCS injection valve Valve pressure interlock Injection line pressure switch 1/valve 1/valve LPCS/LPCI A injection

valve RPV low pressure interlock Reactor pressure switch 2/valve 1/valve LPCI A injection valve Valve pressure interlock Injection line pressure switch 1/valve 1/valve

___________________ 1 For operational specifics, see the Technical Specifications. 2 The "Minimum Channels" column lists the minimum number of trip channels per untripped trip system required to maintain functional performance.

LSCS - UFSAR TABLE 7.3-11 TABLE 7.3-11 REV. 13 INSTRUMENT SPECIFICATIONS FOR PRIMARY CONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM MONITORING SUBSYSTEM INSTRUMENT RANGE INSTRUMEN T SCALE (DECADE LOG) TRIPS PER UPSCAL E CHANNEL DOWNSCA LE Secondary Containment (Rx Bldg Exhaust Plenum) 0.01 to 100 mR/h 4 1 1 Secondary Containment (Refuel Exhaust) 0.01 to 100 mR/h 4 1 1

LSCS-UFSAR 7.4-1 REV. 13

7.4 Systems

Required for Safe Shutdown

7.4.1 Reactor

Core Isolation Cooling System Instrumentation and Controls 7.4.1.1 Design Bases

The RCIC system is not a safety system, hence it has no safety design bases. RCIC is considered a safe shutdown system rather than an emergency core cooling system. RCIC instrumentation and controls are designed to meet the requirements listed in Table 7.1-2 with exceptions as described in Atta chment 7.A.4.1. The RCIC system functional de sign bases are as follows:

a. The system is capable of maintaining sufficient coolant in the reactor vessel in case of an isolation with a loss of main feedwater flow.
b. Provisions are made for automatic and remote manual operation of the system.
c. Components of the RCIC system are designed to satisfy Seismic Category I design requirements.
d. To provide a high degree of assurance that the system shall operate when necessary, the power supply for the system is from immediately available energy sources of high reliability.
e. To provide a high degree of assurance that the system shall operate when necessary, provision is made that periodic testing can be performed during unit operation.

7.4.1.2 System Description

The reactor core isolation cooling system consists of a turbine, pump, piping, valves, accessories, and instrumentation designed to add water inventory to the reactor vessel thus assuring continuity of core cooling. Reactor vessel water is maintained or supplemented by the RCIC during the following conditions:

a. Should the reactor vessel be isolated and yet maintained in the hot standby condition.
b. Should the reactor vessel by isolated and accompanied by a loss of normal coolant flow from the reactor feedwater system.

LSCS-UFSAR 7.4-2 REV. 14, APRIL 2002 c. Should a complete plant shutdo wn under conditions of loss of normal feedwater system be st arted before the reactor is depressurized to a level where the reactor shutdown cooling mode of the RHR system can be placed into operation. Electrical modules for the RCIC system are classified as Safety Class 2 and Seismic Category I. 7.4.1.2.1 Power Sources RCIC logic are powered from Division 1 an d Division 2 125-Vdc. All valves are powered from 250-Vdc Bus 121/221Y, except th e following: Inboard isolation valves E51-F063 and E51-F076 are powered fr om 480-Vac MCC Bus 136Y-2/236Y-2 and outboard isolation valve E51-F008 is powered from 480-Vac MCC, Bus 135X-1/235X-1. 7.4.1.2.2 Equipment Design When actuated, the RCIC system pumps wa ter from either the condensate storage tank or the suppression pool to the reactor vessel. The RCIC system includes one turbine-driven pump, one barometric condenser with a d-c vacuum pump, one vacuum d-c condensate pump, automatic valves, control devices for this equipment, sensors, and logic circuitry. The arrangement of equipment and control devices is shown in Drawing No

s. M-101 and M-147.

Pressure switches and level transmitters used in the RCIC system are located on instrument panels outside the drywell. The only operating components of the RCIC system that are located inside the drywell are one of the steamline isolation valves, the steamline warmup line isolation valve, and one of the two testable check valves on the pump discharge line. The inboard and outboard isolation valves are common to both the steamline feeding the RHR heat exchanger line and the steamline feeding the RCIC turbine. The rest of the RCIC system control and instrumentation components are located in

the reactor building. Cables connect the sensors to control circuitry in the main control room. Although the system is arranged to allow a full flow functional test of the system during normal reactor power operation, the test controls are arranged so that the system can operate automatically to fulfill its safety function regardless of the test being conducted.

LSCS-UFSAR 7.4-3 REV. 13 7.4.1.2.3 Initiating Circuits Reactor vessel low water level is monitored by an analog trip system consisting of four differential pressure transmitters and trip units. The transmitters measure the difference in water column heads between a static leg, which senses the constant head reference column created by a condensing chamber, and a variable leg, which senses actual water level changes in the vessel. The transmitters send an analog input signal to the trip units which are located in the relay logic cabinets. The pipelines for the transmitters are physically separated from each other and tap off the reactor vessel at widely separated points. The RCIC system is initiated only by low water level in a one-out-of-two twice logic.

The RCIC system is initiated automatically following a short time delay (not to exceed 3.0 seconds) after the receipt of a reactor vessel low water level signal and produces the design flow rate within 30 se conds. The controls then function to provide design makeup water flow to the reactor vessel until the amount of water delivered to the reactor vessel is adequate to restore vessel level, at which time the RCIC system automatically shuts down. The controls are arranged to allow remote-manual startup, operation, and shutdown.

The RCIC turbine governor limits the turb ine speed and adjusts the turbine steam control valve so that design pump discharge flow rate is obtained. The flow signal used for automatic control of the turbine is derived from a differential pressure measurement across a flow element in the RCIC system pump discharge line. 7.4.1.2.3.1 Shutdown Initiation The turbine is automatically shut down by closing the turbine trip and throttle valve if any of the following conditions are detected:

a. turbine overspeed, b. high turbine exhaust pressure, c. RCIC isolation signal from logic "A" or "B", d. low pump suction pressure, and
e. manual trip actuated by the operator.

Turbine overspeed indicates a malfunction of the turbine control mechanism. High turbine exhaust pressure indicates a condition that threatens the physical integrity of the exhaust line. Low pump suction pressure warns that cavitation and lack of cooling can cause damage to the pump which could place it out of service. A turbine LSCS-UFSAR 7.4-4 REV. 13 trip is initiated for these conditions so that if the causes of the abnormal conditions can be found and corrected, the system can be quickly restored to service. The trip settings are selected far enough from normal values so that a spurious turbine trip is unlikely, but not so far that damage occurs before the turbine is shut down. Turbine overspeed is detected by a standa rd turbine overspeed mechanical device. Two pressure switches are used to detect high turbine exhaust pressure; either switch can initiate turbine shutdown. One pressure switch is used to detect low RCIC system pump suction pressure. High water level in the reactor vessel indicates that the RCIC system has performed satisfactorily in providing makeup water to the reactor vessel. Further increase in level could result in RCIC sy stem turbine damage caused by gross carry-over of moisture. To prevent this, a high water level trip is used to initiate closure of steam supply valve, to shut off the steam to the turbine, and to halt RCIC operation. The system will automatically reinitiate if the water level decreases to the reactor low water level trip setpoint. Two level transmitters/trip units that sense differential pressure are arranged to require that both instrument channels must trip to initiate a turbine shutdown. 7.4.1.2.4 Bypasses and Interlocks To prevent the turbine pump from being damaged by overheating at reduced RCIC pump discharge flow, a pump discharge bypass is provided to route the water discharged from the pump back to the suppression pool. The bypass is controlled by an automatic, d-c motor-operated valve. At RCIC high flow, this valve is closed; conversely, at low flow, the valve is open ed. A flow switch that measures the pressure difference across a flow element in the RCIC pump discharge pipeline

provides the signals. To prevent the RCIC steam supply pipeline from filling up with water and cooling excessively, a condensate drain pot, steamline drain, and appropriate valves are provided in a drain pipeline arrangement just upstream of the turbine supply valve. The controls position valves so that during normal operation, steamline drainage is routed to the main condenser. Upon receipt of an RCIC initiation signal, the drainage path is isolated. The water level in the steamline drain condensate pot is controlled by a level switch and a direct acting solenoid valve which energizes to allow condensate to flow out of the drain pot. There are two test modes of operation. During Test Mode 1, the RCIC pump takes suction from the condensate storage tank and the RCIC pump discharge is routed to the condensate storage tank. Two d-c moto r-operated valves are installed in the pump discharge to condensate storage tank pipeline. The piping arrangement is shown in Drawing Nos. M-101-2 and M-147-2. Upon receipt of an RCIC initiation signal, the valves close and remain closed. The pump suction and discharge to condensate storage tank valves are interlocked closed if the suppression pool LSCS-UFSAR 7.4-5 REV. 13 suction valve is fully open. The suppression pool suction valve auto-opens on a low level signal in the CST. Numerous indications pertinent to the operation and condition of the RCIC are available to the control room operator. Drawing Nos. M-101 and M-147 show the various indications provided. During Test Mode 2, the RCIC pump takes suction from the suppression pool and the RCIC pump discharge is routed to the suppression pool. One d-c motor-operated valve and two manual gate valves are installed in the pump discharge to the suppression pool. The piping arrangem ent is shown in drawings M-101-2 and M-147-2. 7.4.1.2.5 Redundancy

The RCIC is actuated by reactor low water level. Four level sensors in a one-out-of-two twice circuit supply this signal. 7.4.1.2.6 Actuated Devices All automatic valves in the RCIC are equipped with remote-manual test capability, so that the entire system can be operat ed from the control room. All required components of the RCIC controls operate independently of a-c power. To assure that the RCIC can be brought to design flow rate within 30 seconds from the receipt of the initiation signal, the following maximum operating times for essential RCIC valves are provided by the valve operation mechanisms: RCIC turbine steam supply valve 15 seconds RCIC pump discharge valves 15 seconds RCIC pump minimum flow bypass valve 7 seconds The operating time is the time required for the valve to travel from the fully closed to the fully open position, or vice versa. The two RCIC steam supply line isolation valves are normally open and they are intended to isolate the RCIC steamline in the event of a break in that line. A normally closed d-c motor-operated valve is located in the turbine steam supply pipeline just upstream of the turbine stop valve. Upon receipt of an RCIC initiation signal this valve opens and remains open until closed by operator action from the control room. Two normally open isolation valves provided in the steam supply line to the turbine are controlled by a-c motors. These valves are normally open. The valves automatically close upon receipt of an RCIC isolation signal. The steamline warmup line isolation valve is also controlled by an a-c motor and will close automatically upon receipt of an RCIC isolation signal. LSCS-UFSAR 7.4-6 REV. 13 The instrumentation for isolation consists of the following: Outboard RCIC Turbine Isolation Valve

a. differential temperature sw itches-RHR (Unit 2) and RCIC equipment area ventilation air inlet and outlet high temperature;
b. ambient temperature switches-RHR (Unit 2) and RCIC equipment area high temperature;
c. differential temperature switch-RCIC pipe routing area ventilation air inlet and outlet high temperature;
d. ambient temperature switch-RCIC pipe routing area high temperature;
e. differential pressure switch es-RCIC or RHR/RCIC steamline high flow;
f. two pressure switches-RCIC turbine exhaust diaphragm high pressure, both switches must activate to isolate;
g. pressure switch-RCIC steam supply pressure low; and
h. manual isolation if the system has been initiated.

Inboard Valve Isolation Valve

a. A similar set of instrumentat ion causes the inboard valve to isolate except for the manual isolation feature.

Two pump suction valves are provided in the RCIC system. One valve lines up pump suction from the condensate storage tank, the other one from the suppression pool. The condensate storage tank is the preferred source. Both valves are operated by d-c motors. Upon receipt of an RCIC initiation signal, the condensate storage tank suction valve automatically opens. When the water level in the condensate storage tank falls below a pred etermined level, suction is automatically switched over to the suppression pool. Low water level signal causes the suppression pool suction valve to open, which in turn causes the valve from the condensate storage tank to close.

LSCS-UFSAR 7.4-7 REV. 13 One d-c motor-operated RCIC pump discha rge valve is provided in the pump discharge pipeline. This valve is arranged to open upon receipt of the RCIC initiation signal and closes automatically upon receipt of a turbine trip signal. 7.4.1.2.7 Separation

As in the emergency core cooling system, the RCIC system is separated into divisions designated 1 and 2, for both Units 1 and 2. The RCIC is a Division 1 system, but the inside steamline isolation valve, the steamline warmup line isolation valve, and the inside vacuum breaker isolation valve are in Division 2; therefore, part of the RCIC logic is treated as Division 2. The inboard and outboard steam supply line isolation valve and the steamline warmup line isolation valve are a-c powered valves. The rest of the valves are d-c powered valves. RCIC logic relays, instruments and manual controls are mounted so that separation from Division 2 is maintained. 7.4.1.2.8 Testability The RCIC may be tested to design flow duri ng normal plant operation. During Test Mode 1, water is drawn from the condensa te storage tank and discharged through a full flow test return line to the condensate storage tank. During Test Mode 2, water is drawn from the suppression pool and di scharged through a full flow test return line to the suppression pool. The discharge valve from the pump to the RPV line remains closed during both test modes and reactor operation remains undisturbed. Design of the control system is such that the RCIC system returns to the operating mode from test if system initiation is required.

7.4.1.2.9 Environmental Considerations The only RCIC/RHR control components located inside the drywell that must remain functional in the environment resulting from a loss-of-coolant accident are the control mechanisms for the inside isolation valve and the steamline warmup line isolation valve. The RCIC control and instrumentation equipment located outside the drywell is selected in consideration of the environments in which it must operate. Level sensing instrumentation used as the initiation for RCIC is discussed in Subsection 7.3.1. 7.4.1.2.10 Operational Considerations

General Information Core cooling is required in the event the reactor becomes isolated during normal operation from the main condensers by a closure of the main steamline isolation LSCS-UFSAR 7.4-8 REV. 14, APRIL 2002 valves. Cooling is necessary due to the core fission product decay heat. Steam is vented through the pressure relief/safety valves to the suppression pool. The RCIC system maintains reactor water level by pr oviding the makeup water. Initiation and control are automatic. Operator Information The following indications are provided in th e control room for operator information. Analog Indication

a. RCIC turbine-inlet pressure,
b. RCIC turbine-outlet pressure,
c. RCIC pump-suction pressure,
d. RCIC pump-discharge pressure,
e. RCIC pump-discharge flow, f. RCIC turbine-turbine speed, g. status by indicating lamps, h. position of all motor-operated valves, i. position of all solenoid-operated valves, j. turbine trip solenoid energized or deenergized, k. status of all sealed-in circuits, and
l. pump status.

Annunciators

a. Annunciators are provided as shown in the RCIC system P&ID, Drawing Nos. M-101 and M-147.

Setpoints Instrument limits for the RCIC system controls and instrumentation are listed in Table 7.4-1.

LSCS-UFSAR 7.4-9 REV. 13 The reactor vessel low water level setting for RCIC system initiation is selected high enough above the active fuel to start the RCIC system in time to prevent the core from uncovering. The water level setting is far enough below normal levels that spurious RCIC system startups are avoided. 7.4.1.3 Analysis The following are analyses which show how the RCIC system satisfies the design bases listed in Subsection s 7.4.1.1 and 7.4.1.2. 7.4.1.3.1 General Functional Requirement Conformance For events other than pipe breaks, the RCIC system has a makeup capacity sufficient to prevent the reactor vessel water level from decreasing to the level where the core is uncovered. To provide a high degree of assurance that the RCIC system will operate when necessary and in time to provide adequate inventory makeup, the power supply for the system is taken from energy sources of high reliability. Evaluation of instrumentation reliability for the RCIC syst em shows that no failure of a single initiating sensor can either prev ent or falsely start the system. A design flow functional test of the RCI C system can be performed during plant operation by taking suction from the demi neralized water in the condensate storage tank and discharging it through the full flow test return line back to the condensate storage tank. A design flow functional test of the RCIC system can also be performed during plant operation by taking suction from the suppression pool and discharging through the full flow test return line back to the suppression pool. During this test, the discharge valve to the reactor vessel remains closed, and reactor operation is not disturbed. The control system design provides automatic return from the test mode to the operating mode if system initiation is required during testing. 7.4.1.3.2 Specific Requirement Conformance Refer to 7.A.4.1. 7.4.1.3.3 10 CFR 50 Appendix A 10 CFR 50 Appendix A Requirements

a. Criterion 13 - Reference Subsec tions 7.4.1.2.3, 7.4.1.2.4, and 7.4.1.2.5;
b. Criterion 20 - Referenc e Subsection 7.4.1.2.7; LSCS-UFSAR 7.4-10 REV. 14, APRIL 2002
c. Criterion 21 - Reference Subsection 7.4.1.2.8;
d. Criterion 22 - Reference Subsection 7.4.1.2.6;
e. Criterion 29 - Reference Subsection 7.4.1.2.10;
f. Criterion 34 - Reference Subsection 7.4.1.2.2;
g. Criterion 37 - Reference Subsection 7.4.1.2.8; 7.4.1.3.4 NRC Regulatory Guides

Refer to Appendix B.

7.4.2. Standby

Liquid Control (S BLC) System Instrumentation and Controls 7.4.2.1 Design Bases

In accord with its safety design basis, this system is capable of shutting the reactor down from full power to cold shutdown and maintaining the reactor in a subcritical state at atmospheric temperature and pr essure conditions by pumping sodium pentaborate, a neutron absorber, into the reactor. The manual start controls of the SBLC system are interlocked with the reactor water cleanup system such that initiation of either standby liquid control channel will act to close the outboard RWCU system isolation valve. This isolation function prevents undesirable dilution or removal of neutron absorber from the reactor vessel during SBLC operation. The system instrumentation and control co mplies with the specific requirements shown in Table 7.1-2.

7.4.2.2 System Description Function The instrument and control system for the standby liquid control system is designed to inject liquid neutron moderator into the reactor and maintain this liquid chemical solution well above saturation temperature.

LSCS-UFSAR 7.4-11 REV. 13 Classification The standby liquid control system is a bac kup method of manually shutting down the reactor to cold subcritical conditions independent of the control rod system. Thus the system is considered a control system and not a safety system. The standby liquid control process equipment, instrumentation, and controls essential for injection of the neutron absorber solution into the reactor are designed to withstand Seismic Category I earthquake loads. Nonprocess equipment, instrumentation, and controls are designed to meet non-Seismic Category I requirements. 7.4.2.2.1 Power Sources

The power supply to one explosive valve, in jection pump, tank outlet valve, tank heater, and associated controls is fr om 480 volt AC ESF Motor Control Center 135Y-1 (Division 1). The power supply to th e other explosive valve, injection pump, tank outlet valve, tank heater, and asso ciated controls is from 480 volt AC ESF Motor Control Center 136Y-2 (Division 2). The power supply to the control room benchboard indicator lights and the level an d pressure transmitters is the 120 volt AC Distribution Panel at ESF Motor Control Center 136X-2 (Division 2).

7.4.2.2.2 Initiating Circuits The standby liquid control system (Drawing Nos. M-99 and M-145) is initiated in the control room by turning the appropriate keylocking switch to initiate either system A or system B. The key is removable in the center STOP position should the selected pump fail to start, the other ke y switch may be turned to actuate the alternate pump. 7.4.2.2.3 Logic/Sequencing When the standby liquid control system is initiated from the control room, both explosive valves fire and the tank discharge valves start to open immediately The pump that has been selected for injection will not start until one of the tank discharge valves is open or the test tank outlet valve is open. 7.4.2.2.4 Bypasses/Interlocks Either of the storage tank discharge valves or the test tank outlet valve must be open for the pump to run when initiated from the control room. These pump run interlocks are bypassed by the local pump run testing switch. The outside isolation valve of the reactor water cleanup system is automatically closed when the Standby Liquid Control System A or B is initiated from the control room. Additionally, when System A or B is initiated from the control room, the storage tank discharge valves will not automatically open if the test tank outlet valve is open. LSCS-UFSAR 7.4-12 REV. 13 7.4.2.2.5 Redundancy/Diversity Redundancy exists in duplicated pumps, explosive valves, storage tank outlet valves, and power supply as outlin ed in Subsection 7.4.2.2.1.

7.4.2.2.6 Actuated Devices When the standby liquid control system is initiated to inject neutron moderator into the reactor, the following devices are actuated:

a. One of the two injection pumps is started.
b. Each of the two explosive valves are fired.
c. Each of the two storage tank discharge valves is opened.

7.4.2.2.7 Testability The instrumentation and control system of the standby liquid control system is tested when the system test is performed. 7.4.2.2.8 Environmental Considerations The environmental considerations for the instrument and control portions of the standby liquid control system are the same as for the active mechanical components of the system. This is discussed in Section 3.11.

7.4.2.2.9 Operational Considerations Normal The standby liquid control system is manua lly initiated in the control room by turning the keylocking switch for either system A or system B to actuate the appropriate system. It will take between 50 and 125 minutes to complete the injection and for the storage tank level to indicate that the storage tank is dry. When the injection is completed, the system may be manually turned off by returning the keylocking switch to the STOP position. Operation Information

Indicators The following indications are provided in th e control room for operator information:

LSCS-UFSAR 7.4-13 REV. 13 Analog Indication

a. storage tank level,
b. system pressures, and
c. explosive valves continuity.

Indicating Lamps

a. pump status,
b. explosive valve open circuit,
c. position of injection line manual stop valve,
d. position of storage tank outlet valve, and
e. position of test tank discharge manual stop valve.

Annunciators The standby liquid control system control room annunciators indicate:

a. the loss of continuity of ei ther explosive valve primers,
b. standby liquid storage tank high or low temperature, and
c. standby liquid tank high and low level.

Local Indications The following indications are provided locally at the equipment for operator information:

Analog Indication

a. storage tank level,
b. system pressure, and
c. storage tank temperature.

Indicating Lamps

LSCS-UFSAR 7.4-14 REV. 16, APRIL 2006 a. storage tank high and low power heater status. Setpoints The standby liquid control has setpoints for the various instruments as follows:

a. The loss of continuity meter is set to activate the annunciator just below the trickle current that is observed when the primers of the explosive valves are new.
b. The high- and low-standby liquid temperature switch is set to activate the annunciator at temperatures of 110

°F and 70°F, respectively.

c. The high- and low-standby liquid storage tank level switch activates the annunciator prior to level exceeding the overflow limit or dropping below Technical Specification required limit.
d. The thermostatic controller is set to turn on the heater when the standby liquid temperature drops to 75

°F and to turn off the heater at 85 °F. 7.4.2.3 Analysis General Functional Requirement Conformance As required by General Design Criterio n 26 of 10 CFR 50 Appendix A, the standby liquid control provides the second independen t reactivity control system as qualified in Subsection 9.3.5.

7.4.3 Reactor

Shutdown Cooling (RHR) Instrumentation and Controls 7.4.3.1 Design Bases The reactor shutdown cooling mode function of the RHR system is designed to meet the following safety design bases:

a. Instrumentation and controls are provided that enable the system to remove the residual heat (decay heat and sensible heat) from the reactor vessel during normal shutdown.
b. Manual controls of the shutdown cooling system are provided in the control room area.

LSCS-UFSAR 7.4-15 REV. 15, APRIL 2004 c. Performance of the shutdown cooling system is indicated by control room instrumentation. The reactor shutdown cooling mode of the residual heat removal system (RHR) meets the following power generation design bases:

a. Provide cooling for the reactor during the shutdown operation when the vessel pressure is below approximately 135 psig.
b. Cool the reactor water to 125

°F which is practical for refueling and servicing operation.

c. Provide means for reactor head cooling by diverting part of the shutdown flow to a nozzle in the vessel head. This flow will condense the steam generated from the hot walls of the vessel while it is being flooded, thereby keeping system pressure down.

7.4.3.2 System Description The shutdown cooling mode of the RHR system including the reactor vessel head spray is used during a normal reactor shutdown and cooldown.

The initial phase of a normal nuclear syst em cooldown is accomplished by dumping steam from the reactor vessel to the main co ndenser which serves as the heat sink.

a. The reactor shutdown cooling system is capable of providing cooling for the reactor during shutdown operation after the vessel pressure is reduced to approximately 135 psig.
b. The system is capable of cooling the reactor water to a temperature at which reactor refueling and servicing can be accomplished.
c. Means are provided to divert part of the shutdown flow to a nozzle in the vessel head to condense the steam generated from the hot walls of the vessel wh ile it is being flooded.

The classification of this system is discussed in Section 3.2. The power sources for this system ar e discussed in Subsection 7.3.1. 7.4.3.2.1 Equipment Design The reactor water is cooled by taking suction from one of the recirculation loops; the water is pumped through the system heat exchanger and back to the reactor vessel LSCS-UFSAR 7.4-16 REV. 14, APRIL 2002 via the recirculation loop as shown in M-96 and M-142. Part of the flow can be diverted to a nozzle in the vessel head to provide for head cooling. The function of head cooling is to condense steam generated from the hot walls of the vessel while it is being flooded, thereby keeping system pressure down. During the initial phase of cooling the reactor, only a portion of the RHR system heat exchanger capacity is required. This allows the remaining portion of the RHR system with its heat exchanger, associated pumps, and valving to be available for the LPCI mode. The LPCI mode portion of the system is shifted to the shutdown mode after the reactor is depressurized so the proper cooling rate may be achieved with the lower reactor water inlet temperature. If it is necessary to provide additional fuel pool cooling, a means is provided for making a physical intertie between the sp ent fuel pool cooling system and the "B" RHR pump and heat exchanger. This increases the cooling capacity of the spent fuel pool cooling system to handle the heat load for this situation. 7.4.3.2.2 Initiating Circuits The reactor shutdown cooling system is initiated only by manual action.

7.4.3.2.3 Bypasses/Interlocks To prevent opening the shutdown cooling valves except under proper conditions, the interlocks are provided as shown in Table 7.4-2. The two RHR pumps used for shutdown cooling are interlocked to trip the pumps if the shutdown cooling valves and suction valves from the suppression pool are not properly positioned. 7.4.3.2.4 Redundancy There is redundancy in duplicated pumps, heat exchangers, valves, piping, and power supply. Only the suction line and valves from the recirculation line are shared. 7.4.3.2.5 Actuated Devices All valves in the shutdown cooling system are equipped with remote-manual switches in the control room. Further discussion can be found in Subsection 7.3.1. 7.4.3.2.6 Separation As described in Subsection 7.3.1.2.4.7, RH R A is a Division 1 system, and RHR B is a Division 2 system. In order to maintain the required separation, manual controls, LSCS-UFSAR 7.4-17 REV. 14, APRIL 2002 cabling, and instrumentation are routed and installed so that Division 1 and 2 separation is maintained. Separation from Division 3 is likewise maintained. The shared suction line from the reactor recirculation system is provided with a Division 2 isolation valve inside containment and a Division 1 isolation valve outside containment, in agreement with co ntainment isolation requirements. After the shared line branches to each pump suction, a motor-operat ed shutoff valve, assigned to the applicable division, is provided. These valves are located in areas compatible with their divisional assignments. Separation is therefore maintained. 7.4.3.2.7 Testability The shutdown cooling system pumps (RHR) may be tested to full capacity during normal plant operation. All valves in the system may be tested during normal plant operation from the remote switches in the control room. 7.4.3.2.8 Environmental Considerations The only shutdown cooling control component located inside the drywell that must remain functional in that environment is the control mechanism for the inboard

isolation shutdown cooling suction valv

e. The control and instrumentation equipment located outside the drywell is selected in consideration of the normal and accident environments in which it must operate.

7.4.3.2.9 Operational Considerations All controls for the shutdown cooling sy stem are located in the control room. Operator information is provided as desc ribed in the RHR discussion of the LPCI mode in Subsection 7.3.1.2.4.10.

7.4.3.3 Analysis General Functional Requirement Conformance

Capability is provided for orderly shutdown and cooldown of the reactor under normal conditions as discusse d in Subsection 7.4.3.2. Conformance to 10 CFR 50 Appendix A

a. Criterion 34 - Reference Subsection 7.4.3.2, and
b. Criterion 61 - Reference Subsection 7.4.3.2.

LSCS-UFSAR 7.4-18 REV. 13 No other regulatory requirements are ap plicable because this RHR subsystem is used only to cool the reactor core for removal of decay heat with the reactor fully shut down and at approximately 50 psia.

7.4.4. Shutdown

Outside the Control Room

It is possible to shut down the reactor from outside the main control room and bring the reactor to cold conditions in an orderly fashion, in compliance with General Design Criterion 19 of 10 CFR 50, Appendix A. 7.4.4.1 Conditions Assumed to Exist as the Main Control Room Becomes Inaccessible

a. The plant is operating initially at, or less than, design power.
b. Loss of offsite a-c power is considered unlikely but credible. The remote shutdown panel is powered from a Class 1E power system bus so backup a-c power is automatically supplied by the diesel generator in the event of loss of offsite power. Manual controls of the diesel generato r are also available locally.
c. A loss-of-coolant accident is not assumed, so that complete control of engineered safeguards systems from outside the control room shall not be required.
d. Plant personnel evacuate the control room.
e. The control room continues to be inaccessible for several hours.
f. The event that causes the control room to become inaccessible is assumed to be such that the operator can manually scram the reactor before leaving the main control room. If this is not practical, opening the output breakers of the RPS logic can be used as a backup means to achieve reactor shutdown.
g. The main turbine pressure regulators may be controlling reactor pressure via the bypass valves; however, it is assumed that this function is lost. Therefore, main steamline isolation is assumed to occur at a specified low turb ine inlet pressure and reactor pressure is relieved through the relief valves to the suppression pool. The feedwater system is al so assumed to be unavailable.
h. Reactor water is made up by the RCIC system when and if reactor level reaches RCIC initiation level.

LSCS-UFSAR 7.4-19 REV. 13 i. D-c power is supplied from at least one plant d-c power system for each essential system or equipment item in the remote shutdown system. 7.4.4.2 Description

a. The system provides remote control of those reactor systems needed to accomplish shutdown from outside the main control room to bring the reactor to a cold condition in an orderly fashion.
b. It provides an alternative to the normal main control room shutdown of the reactor when feedwater is unavailable and the normal turbine and condenser heat sinks are lost.
c. Automatic activation of relief valves and the reactor core isolation cooling (RCIC) system brings the reactor to a hot shutdown condition after scra m and isolation are achieved.

During this phase of shutdown, the suppression pool is cooled by operating the residual heat removal (RHR) system in the suppression pool cooling mode. Reactor pressure is controlled, and core decay and sensible heat is rejected to the suppression pool by relieving steam pressure through the relief valves. Reactor water inventory is maintained by the RCIC system.

d. Manual operation of the relief valves will cool the reactor and reduce its pressure at a controlled rate until reactor pressure becomes so low that the RCIC system will discontinue operation.

This condition is reached at 50 to 100 psig reactor pressure.

e. The RHR system then operates in the shutdown cooling mode using the RHR system heat exchanger in the reactor water circuit to bring the reactor to the cold, low-pressure condition.

7.4.4.3 Procedure for Reactor Shut down From Outside the Control Room

a. If evacuation becomes necessary, the operator will scram the reactor by depressing the scram switches at the main control room panel as he leaves the control room.
b. Under normal conditions the main turbine pressure regulator will control the reactor pressure while rejecting heat (steam) through the turbine bypass valves, and the feedwater control system will control water level.

LSCS-UFSAR 7.4-20 REV. 13 c. The operator then opens the ou tput breakers on feeders from reactor protection system bus A and bus B to reactor protection system trip logic channels A and B, respectively, as a backup means of scramming the reactor and closing the containment and reactor vessel isolation valves. The controls for this function are located on the reactor protection system power

distribution panel near the reactor protection system motor-generator sets in the auxiliary equipment room beneath the main control room.

d. The remainder of the procedure assumes that the automatic pressure regulator is not available from time zero and the main steamline isolation valves are closed.
e. The operator then uses transfer switches to transfer control to the remote shutdown panel.
f. Relief valves not used in the remote shutdown system may open automatically and cycle to control reactor pressure. Reactor water level starts to drop at a rate dependent on prior power

level and elapsed time from scram.

g. The operator starts the RCIC system manually before automatic initiation and monitors water level thereafter. The water level will continue to fall.
h. One relief valve is manually operated to maintain the desired reactor pressure.
i. The reactor water level reaches RCIC initiation setpoint level if the RCIC system was initiated at low level. This is well above the LPCS or RHR system initiation level. The level starts to rise as a result of RCIC system flow. Pressure relief is continued through one relief valve in manual intermittent

operation.

j. The water level is returned to normal by operation of the RCIC system. k. The operator can start reduction of reactor pressure by manually actuating two relief valves.
l. While activating these relief valves, the operator observes reactor water level, reactor temperature, and suppression pool temperature. The relief valves are closed as necessary to LSCS-UFSAR 7.4-21 REV. 13 maintain adequate level for core cooling. The reactor cooldown rate should not exceed 100

°F per hour.

m. The operator uses the RHR system with one pump and one heat exchanger and associated water systems to cool the suppression pool. n. The operator activates two relie f valves to maintain reduction of pressure to 250 psig while ob serving pool temperature.
o. Reactor pressure is reduced to 100 psig.
p. The operator then places the RHR system in the shutdown cooling mode and flushes the system for several minutes by pumping reactor water into the suppression pool.
q. Normal reactor water level is maintained.

The following GE supplied systems have controls and instrumentation located outside the control room:

a. reactor core isolation cooling (RCIC) system,
b. one residual heat remo val (RHR) system loop, and
c. nuclear boiler system instrumentation.

7.4.4.4 Analysis General Functional Requirement Conformance As required by General Design Criterion 19 of 10 CFR 50 Appendix A, capability is provided to shut down the reactor and bring it to a cold condition from outside the main control room. LSCS-UFSAR TABLE 7.4-1 REACTOR CORE ISOLATION COOLING INSTRUMENT LIMITS TABLE 7.4-1 REV. 16, APRIL 2006 RCIC FUNCTION Note I INSTRUMENT TRIP SETTINGS ALLOWABLE VALUE Note 3 ANALYTIC OR DESIGN-BASIS LIMIT ACCURACYNote 2 RANGE (1) Reactor Vessel High Water Level Differential Pressure Transmitter Note 2 Note 4 Note 2 Note 4 0-60 in. (2) Turbine Exhaust High Pressure Pressure Switch Note 5 Note 5 Note 5 Note 5 Note 5 (3) RCIC System Pump High Suction Pressure Pressure Switch 

 <99 psig  <psig  50-150 psig (4) RCIC System Pump Low Suction Pressure  Pressure Switch 
-20 in. Hg Note 7 N/A   +/- 2% -30 in. Hg/0/+0.5 psig (5) Reactor Vessel Low Water Level - Level 2 Note 6 Differential PressureTransmitter/Trip Unit  Note 2  Note 4 Note 2 Note 4   -150/0/+60 in. (6) RCIC System Steam Supply Low Pressure  Pressure Switch Note 5  Note 5  Note 5  Note 5  Note 5 (7) Turbine Overspeed Centrifugal Device 125% of rated speed N/A  +/- 2% 0-125% (8) Condensate Storage Tank Low Level Float Switch  Note 2    Note 2  N/A  Notes: 1. The differential pressu re sensors (level switches and AP transmitters) are designed for one side pressurization capability of up to 2000 psig without damage to diaphragms. 2. See the applicable calculation, listed in Appendix D of Technical Requirements Manual. 3. See Technical Specifications or the Technical Review Manual, as applicable, for Allowable Values. 4. All reactor water levels are referenced to instrument zero at 527.6", Vessel Zero is the inside bottom of the RPV at centerl ine. 5. See UFSAR Table 7.3-2 for RCIC Isolation Actuation Instrumentation Limits. 6. Incident detection circuitry instrumentation. 7. Approximate setting.

TABLE 7.4-2 REV. 1 - APRIL 1985 LSCS-UFSAR TABLE 7.4-2 REACTOR SHUTDOWN COOLING BYPASSES AND INTERLOCKS

VALVE FUNCTION REACTOR PRESSURE ISOLATION VALVE SHUTDOWN SUCTION MANUAL OPEN EXCEEDS SHUTDOWN CLOSURE SIGNAL LINE EXCESS FLOW Inboard suction Cannot open Cannot open Cannot open isolation Outboard suction Cannot open Cannot open Cannot open isolation Reactor injection Cannot open Cannot open Cannot open Head spray Cannot open Cannot open Cannot open Radwaste discharge Can open Cannot open Not Applicable inboard Radwaste discharge Can open Cannot open Not Applicable charge outboard VALVE FUNCTION 

. (Auto (A) close or   manual (M) close)  ___________________

Inboard suction Closes A and M Closes A and M Closes A and M isolation Outboard suction Closes A and M Closes A and M Closes A and M isolation

Reactor injection Closes A and M Closes A and M Closes A and M Head spray Closes A and M Closes A and M Closes A and M Radwaste discharge Closes M Closes A and M Not Applicable inboard Radwaste discharge Closes M Closes A and M Not Applicable outboard

LSCS-UFSAR 7.5-1 REV. 18, APRIL 2010 7.5 SAFETY-RELATED DISPLAY INSTRUMENTATION

7.5.1 General

This section describes the instrumentation which provides information to the operator to enable him to perform required safety functions. The indicators and recorders for normal plant process variables are described in Section 7.7 and are shown on the P&ID's for the various systems. Channel ranges and indicators are selected on the basis of giving the operator the necessary information to perform all the normal plant maneuvers and to be able to track all the process variables pertinent to safety during expected operational perturbations.

The ranges of indicators and recorders provided are capable of covering the extremes of process variables and provid e adequate information for all abnormal transient events. Some accidents may cause larger parameter excursions. Information readouts are designed to accommodate all credible acci dents from the standpoint of operator action, information, and event tracking re quirements, providing assurance that the requirements of all other credible events or incidents will be covered. Certain instruments have been designated as post-accident monitors, and as such have been determined to be in compliance with the intent of Reg. Guide 1.97 Rev. 2 as documented in Appendix B. 7.5.2 Post-Accident Tracking In accordance with Regulatory Guide 1.97, process variables used in post-accident monitoring are grouped into 5 ty pes: A, B, C, D, and E. Type A, those variables to be monitored that provide the primary information required to permit the control room operators to take the specific manually controlled actions for which no automatic control is provided and are required for safety systems to accomplish their safety function for design basis accident events. Primary information is information that is essential for the direct accomplishment of the specified safety functions; it does not include those variables that are associated with contingency actions that may also be identified in written procedures. Type B, those variables that provide information to indicate whether plant safety functions are being accomplished. Plant safety functions are (1) reactivity control (2) core cooling (3) maintaining reactor coolant system integrity, and (4) maintaining containment integrity (including radioactive

effluent control). LSCS-UFSAR 7.5-1a REV. 14, APRIL 2002 Type C, those variables that provide information to indicate the potential for being breached or the actual breach of the barriers to fission product releases. The barriers are (1) fuel cladding, (2) primary coolant pressure boundary, and (3) containment. Type D, those variables that provide information to indicate the operation of individual safety systems and other systems important to safety. These variables are to help the operator ma ke appropriate decisions in using the individual systems important to safety in mitigating the cause of an accident. Type E, those variables to be monitored as required for use in determining the magnitude of the release of radioactive materials and in continually assessing such releases. The five classifications are not mutually exclusive in that a given variable may be included in one or more types. Post-accident monitoring instruments are assigned to meet one of three design categories. These categories provide a graded approach to requirements depending on the importance to safety of the measurement of a specific variable. Category 1 variables are key type variables used to provide information or to monitor the applicable parameter. The qualification requirements are the most stringent, with requirements that the instrumentation should be environmentally qualified in accordance with Regulatory Guide 1.89 "Qualification of Class 1E Equipment for Nuclear Power Plants," and the seismic portion of qualification be in accordance with Regulatory Guide 1.100 "Seismic Qualification of Electrical Equipment for Nuclear Power Plants." Instrumentation shall continue to read within the required accuracy following but not necessarily during a seismic event. At least one instrumentation channel shall be qualified from a sensor to display and be a direct indicating or recording device. The instrumentation should be energized from station standby power sources and should be backed up by batteries where momentary interruption is not tolerable. Category 2 variables provide selective backup information and monitoring information of the performance of safety systems and the release of radioactive materials. The qualific ation requirements are not quite as stringent, but many of the same standards are recommended. Category 3 variables are instruments of high quality commercial grade.

LSCS-UFSAR 7.5-1b REV. 16, APRIL 2006 Type A, B, and C variables relate to the determination of the safety condition of the plant and provide the operator with the information to perform tasks needed to mitigate accidents. The following parameters have been identified as Type A or Category 1 variables for LaSalle:

1. Reactor Vessel Water Level
2. Reactor Steam Dome Pressure
3. Drywell Pressure
4. Suppression Pool Water Level;
5. Suppression Pool Water Temperature
6. Drywell Gross Gamma Radiation
7. Primary Containment Isolation Valve Position The instruments monitored by these vari ables meet the intent of Category 1 requirements per Regulatory Guide 1.97, or deviations from these requirements have been justified.

The design basis that all engineered safety features are to mitigate the accident event condition takes into consideration that no operator action or assistance may be assumed for the first 10 minutes of the event. This requirement therefore makes it mandatory that all protective actions necessary in the first 10 minutes be "automatic". Therefore, although conti nuous tracking of process variables is available, no operator action based on them is required. After 10 minutes, operator action is option al based on the information available.

The process instrumentation described below provides information to the operator after a loss-of-coolant accident for his use in monitoring reactor conditions within the drywell or containment integrity. The post-accident tracking process instrumentation for Type A and Category 1 variables is grouped as: 1) reactor and primary containment process instrumentation and 2) primary containment atmosphere monitoring system

instrumentation, and 3) prim ary containment integrity.

LSCS-UFSAR 7.5-2 REV. 18, APRIL 2010 7.5.2.1 Reactor and Primary Containment Process Instrumentation 7.5.2.1.1 Reactor Water Level Reactor vessel water level is a Type B Ca tegory 1 variable provided to support monitoring of core cooling and to verify operation of Emergency Core Cooling

Systems (ECCS). The wide range and fu el zone range water level instruments provide this function. The range of the re corded/indicated level is from the top of feedwater control range to a point just below the bottom of active fuel. Four wide-range water level signals are transmitted from four independent differential pressure transmitters and are recorded on two separate recorders and two separate indicators. One separate recorder input records the wide range level; the other records the reactor pressure on each of the two recorders. The differential pressure transmitters have one side connected to a condensing chamber reference leg and the other side connected directly to a vessel nozzle for the variable leg. The water level system is uncompensated for variation in reactor water density and is calibrated to be most accurate over the operational pressure and temperature range at which it is used. The range of the recorded/indicated level is from the top of the feedwater control range (just above the high level turbine trip point) down to a point near the top of the active fuel. The power sources for the four channels are the two instrument a-c buses (two channels per a-c bus) fed from the two Class 1E standby a-c buses. The recorders and indicators are seismically qualified, and are visible to the operator from the front of the panel on which they are mounted.

Two fuel zone-range water level signals are transmitted from two independent differential pressure transmitters and are indicated on one recorder and one indicator. The fuel zone water level transmitters share the reference legs of two of the wide range level transmitters and use the taps at the jet pump diffuser skirt for the variable leg. The range of the recorded/indicated level is from about four feet above the top of the active fuel to just belo w the bottom of active fuel. The zero of the instrument is the same as that of all other level instrumentation, and the instruments are calibrated to be accurate at 0 psig and saturated condition. Each fuel zone instrument channel is powered from a separate Class 1E power source (Divisions 1 and 2). The recorder and indicator are se ismically qualified and are visible to the operator from the front panel on which they are mounted. 7.5.2.1.2 Reactor Pressure

Reactor pressure is a Type A and Category 1 variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems. LSCS-UFSAR 7.5-2a REV. 15, APRIL 2004 Two reactor pressure signals are transmitted from two independent pressure transmitters and are recorded on two recorder input recorders. One recorder input records pressure; the other records the wide-range level. The range of recorded pressure covers the highest expected ATWS transient. Power so urces are as stated in the previous subsection.

7.5.2.1.3 Containment Pressure

a. Drywell Pressure Drywell pressure is a Type A and Category 1 variable provided to detect a breach of the reactor coolant pressure boundary and to verify ECCS functions that operate to maintain RCS integrity.

There are four drywell pressure monitoring channels, two wide-range channels and two narrow-ra nge channels. Together, they combine to cover a pressure range during reactor normal operation and following a loss-of-coolant accident. The combined range is -5 to 200 psig, which is three times the concrete containment design pressure of 45 psig. These recorders operate continuously during normal plant operations; they provide a continuous visual indication and yield a continuous recording. One set of wide- and narrow-range pressure instrumentation is powered from a Division 1 emergency a-c instrument bus, while the other set is powered by Division 2. Each transmitter has a readout on separate LSCS-UFSAR 7.5-3 REV. 14, APRIL 2002 recorders and indicators in the main control room. The recorders and indicators are seismically qualified and visible to the operator from the front of the panel on which they are mounted. b. Suppression Chamber Pressure Suppression chamber pressure is not a Regulatory Guide 1.97 variable, but does provide usef ul information on containment status. There are two suppression chamber pressure monitoring channels. Their purpose is to provide information to the operator to indicate suppression pool bypass phenomenon so that he may take action to prevent upward forces in the drywell floor from exceeding design limits. Each channel is powered from redundant Class 1E emergency instrument buses. They each have readouts on a main control room indicator. The indicator is seismically qualified and is visible to the operator from the front of the panel on which it is mounted. 7.5.2.1.4 Suppression Pool Water Level Suppression pool water level is a Type A an d Category 1 variable provided to detect a breach in reactor coolant pressure boundary. This variable is also used to verify and provide long term surveillance of the ECCS function. There are two suppression pool water level channels. Each has a range to cover all expected normal transients as well as post-LOCA conditions. The water level measurement system has the capability to measure water level over a 32-foot range from 14 feet above normal level down to the lowest ECCS suction point. Each channel is powered by separate Class 1E emergency instrument buses and has a readout on a separate recorder. Each recorder is seismically qualified and is visible to the operator from the front of the panel on which it is mounted. 7.5.2.1.5 Containment Temperature

a. Drywell Temperature Drywell temperature is a Type D Category 2 variable. There are four channels of drywell temperature monitoring. They have ranges adequate to cover normal through post-accident conditions. They are located so that they form two groups of two sensors to cover each half of the drywell. For example, the sensor in the northwest quadrant of the containment is LSCS-UFSAR 7.5-3a REV. 14, APRIL 2002 indicative of temperature from azimuths 315° to 135°, while the southeast sensor covers 135° to 315°. These two sensors are powered from one Class 1E redundant instrument bus, while the other two sensors are located in the other two quadrants in the drywell and are powered from a different Class 1E bus. These two temperature channels have readouts on separate seismically qualified recorders visible to the operator from the front of the panel on which they are located.

LSCS-UFSAR 7.5-4 REV. 14, APRIL 2002 b. Suppression Pool Temperature

1. Suppression Chamber Air Temperature Suppression chamber air temperature is not a Regulatory Guide 1.97 variable. There are two channels of suppression chamber air temperature. They have the same range requirements as the drywell temperature sensors. They are powered by redundant Class 1E instrument buses, and have readouts on the same two recorders as the drywell temperature monitoring channels.
2. Suppression Pool Water Temperature Suppression pool water temperature is a Type A and Category 1 variable provided to detect a condition that could potentially lead to a containment breach, and to verify the effectiveness of ECCS actions taken to prevent containment breach.

There are 28 channels of suppression pool water temperature measurement. They are separated into two sets of 14 sensors. These 14 sensors are distributed throughout the pool area so as to be able to redundantly detect a stuck-open safety/relief valve continuous discharge into the pool. Each set of 14 sensors is inputted to a seismically qualified computer based system. The computer based systems are po wered by redundant class 1E buses. Each computer based system drives a dedicated recorder which records the suppression pool water bulk temperature. In addition, the same suppression pool water bulk temperature signal is inputted to the plant process computer via a signal

isolation. 7.5.2.2 Post-Accident Primary Containment Atmosphere Monitoring System Instrumentation and Controls 7.5.2.2.1 Design Bases

IEEE Standard 279-1971 defines the requ irements for design bases. Subsection 7.2.2.13 meets this requirement. The following is a comparison of the design-basis requirements found in IEEE 279-1971 as they relate to the primary containment atmosphere monitoring system: LSCS-UFSAR 7.5-4a REV. 14, APRIL 2002

a. The generating station condition which requires protective action in the primary containment atmosphere monitoring system is hydrogen genera tion following a LOCA.
b. The generating station variable which requires monitoring to provide protective actions is hydrogen content in the primary containment atmosphere.

LSCS-UFSAR 7.5-5 REV. 13 c. Prudent operational limit for each safety-related variable is 4% hydrogen (by volume).

d. The margin between operational limits and the level determining the onset of unsafe conditions is shown in Subsection 6.2.5.
e. Levels requiring protective acti on are given in item d preceding.
f. For the range of energy supply and environmental conditions of safety systems, see Subsec tions 3.1.2.1.4 and 7.3.6.
g. Malfunctions, accidents, and other unusual events which could cause damage to safety systems are discussed in Subsections 7.2.3 and 7.3.1.3.

The system is designed to meet the following safety design bases:

a. The system can detect hydrogen and oxygen concentrations and any possible release of fission pr oducts from the fuel resulting from a loss-of-coolant accident.
b. The hydrogen and oxygen monitoring subsystems and the gross gamma monitoring subsystem display in the control room the hydrogen and oxygen concentrations and gross gamma radiation level inside the primary containment resulting from a loss-of-coolant accident and provide alarms at predetermined setpoints.
c. Limits are established on abnormal concentrations of hydrogen and oxygen so that corrective action can be taken before unacceptable results occur. The unacceptable results are as follows: 1. A threat of significant compromise to the primary containment structure.
2. A threat of significant compromise to the equipment inside the primary containment.

The containment atmosphere monitoring syst em is designed to meet the specific requirements listed in Table 7.1-2.

LSCS-UFSAR 7.5-6 REV. 20, APRIL 2014 7.5.2.2.2 Description The purpose of the containment atmosphere monitoring subsystem instrumentation and controls is to provide the signals necessary to indicate and alarm high hydrogen, high oxygen, or high gross ga mma radiation in the drywell following a loss-of-coolant accident (LOCA).

The gross gamma monitoring subsystem monitors the dose rate resulting from gross release of fission products from the fuel. The 120-Vac Division 1 and Division 2 buse s are the power sources for the primary containment atmosphere monitoring subsystem. The Division 1 channel is powered from the Division 1 bus, and the Division 2 channel is powered from the Division 2 bus. The H 2/O 2 monitoring system heat tracing for each division is energized from the same Class 1E electrical system division that supplies 120VAC power to the respective H 2/O 2 monitoring systems. Each channel provides a local measurement except for gross gamma monitoring system, and transmits the signal to the control room, where a permanent record is provided on seismically qualified recorders. Drawing Nos. M-156 and M-158 show the primary containment monitoring instrumentation and controls. This subsystem is designed in accordance with Seismic Category I requirements. The piping for this subsystem is designed in accordance with ASME Section III - 1974 Class 2 requirements, up to and includ ing the outboard isolation valves. The use of revised allowable stress valu es within the 2001 Edition through 2003 Addenda has been reconciled and is acceptable for design evaluations, modifications, repairs and replacements. The hydrogen and oxygen monitoring subsystems have been designed in accordance with IEEE 323-1974. 7.5.2.2.2.1 Drywell Hydrogen and Oxygen Monitoring Subsystem

Drywell hydrogen and oxygen concentration analyzers are Type C Category 3 and Type C Category 2 instruments, respectively, provided to detect high hydrogen or oxygen concentration conditions that repr esent a potential for containment breach. Initiating Circuits Both divisional H 2/O 2 monitoring systems heat tracing are energized during plant operation, shutdown and after an accident. During normal plant operation, the heat tracing is maintained at 300°F and the hot box located in the analyzer panel is maintained at 270°F to prevent sample condensation.

LSCS-UFSAR 7.5-6a REV. 14, ARPIL 2002 Two hydrogen and two oxygen sensors are mo unted directly in the reactor building, where drywell atmosphere samples are brought out, the measurement made, and an electrical signal is transmitted to the control room. The P&ID of these monitors is shown on the right-hand portio n of Drawing Nos. M-156 and M-158.

LSCS-UFSAR 7.5-7 REV. 15, APRIL 2004 The volume percent each of hydrogen and o xygen is recorded by two recorders in the control room. The millivolt signals ge nerated by the sensors are suitably conditioned and amplified by solid-state electronic modules for transmission to the control room. Two such units make up the total analyzer package. The hydrogen-monitoring system utilizes a thermal conductivity sensor design concept. The sensing element generates an electrical current that is directly proportional to the hydrogen in the drywell atmosphere sample. A self-contained sample temperature control unit ensures that the calibration of the sensor is maintained over the entire operational temperature range. Analyzer Electronics The analyzer electronics consists of an amplifier, power supply, divider, and recording channel. The amplifier and power supply consist of solid-state, highly reliable, proven circuits that are capabl e of meeting the system requirements. The amplifier takes the cell output sign al and provides a 4-20 mA signal for transmission to the control room. This volume percent hydrogen value is fed into the two-channel recorder. Redundancy The subsystem consists of redundant analyzer units. Separation Each of the redundant analyzer units is physically separated and is powered from a separate power bus. Hydrogen-Monitoring Test and Calibration Although the sensors are inherently stable over extended periods of time, a calibration capability is provided to guar antee greater accuracy. Sample gases can be introduced to the sample chamber by manual operation of valves from the calibration gas tanks. The calibration cycle is completed within 30 to 45 minutes from the time the calibration gas reaches the sensor assembly. Adjustments to the calibration signal are made remotely in the main control room.

System startup and calibration are relatively straightforward. Power will normally be maintained to electronic componen ts to eliminate warmup requirements. LSCS-UFSAR 7.5-8 REV. 15, APRIL 2004 Environmental Considerations The hydrogen/oxygen monitoring equipment is located in the reactor building and is designed to remain functional in the environment which results from a loss-of-coolant accident. See Section 3.11 for a description of the reactor building environments.

Operational Considerations The hydrogen/oxygen subsystem is automatica lly activated on the occurrence of a loss-of-coolant accident and remains in oper ation after initiation unless turned off with a handswitch. Continuous indication and recording will be functioning within 15 minutes after initiation. During normal operation, the system is maintained in the standby mode or analyze. The hydrogen concentration is recorded up to 10%, with an accuracy of +/-5% of the readout. The oxygen concentration is recorded up to 20%. An alarm is activated on high concentration. The individual H 2/O 2 monitoring system heat tracing circuits for each division are controlled by temperature controllers located in the respective divisional control panel. Each panel provides local indication of the following abnormal conditions: high temperature, low temperature, and loss of power. Indication of the heat tracing system trouble/loss of power to the panel is also provided in the control room. The heat tracing circuits are automatically controlled from their respective divisional control panel. 7.5.2.2.2.2 Drywell Gross Gamma Monitoring

Drywell gross gamma radiation is a Type E Category 1 variable provided to monitor for the potential of significant radiation re leases and to provide assessment for use by operators in determining the need to invoke site emergency plans. Initiating Subsystem Circuits Two gamma-sensitive instrumentation channels monitor the radiation in the drywell atmosphere. Two detectors are mounted in steel sleeves which protrude into the primary containment at diverse locations so as to view a larger segment of the containment atmosphere. Each instrument channel consists of a gamma-sensitive ion chamber and a log radiation mo nitor. Each log radiation monitor has an upscale trip circuit which is used to in itiate an alarm on high radiation. The output from each log radiation monitor is displayed on an eight-decade meter on the local panel and on separate recorders located in the control room. These detectors have a wide range so that the LSCS-UFSAR 7.5-8a REV. 14, APRIL 2002 monitors can follow the radiation increase from lower levels of radiation for personnel safety up to the maximum expected in a major accident. They are responsive to gamma photons which have en ergy levels of 60 KeV to 3.0 MeV. The lower energy gammas are slightly attenuated by the thin steel sleeves, but the amount of attenuation is less than a factor of four. For example, if the containment gamma radiation is 10 6 R/hr, and contains mostly Xe-133 with an energy level of LSCS-UFSAR 7.5-9 REV. 20, APRIL 2014 81.1 KeV, the detector will still respond to 2.5 x 10 5 R/hr. At higher energy levels, a larger percentage of the gamma radiation will reach the detector. Redundancy The subsystem utilizes a redundant instrumentation channel so that a single failure cannot prevent subsystem operation. Separation Each of the redundant pairs of gamma-sensitive instrumentation is physically separated from the other and is po wered from a separate power bus.

Inspection and Testing A built-in source of current is provided with each radiation monitor for test purposes to provide a point reading equivalent to 10 5 R/hr. In addition, the operability of each monitoring channel can be routinely verified by comparing the outputs of the channels at any time.

Environmental Considerations The gross gamma monitoring equipment readouts are in the control room. See Section 3.11 for a description of the reac tor building and control room environment. Operational Considerations

The gross gamma subsystem is operational at all times during normal and accident conditions except when taken out of servic e for calibration. Detectors are easily retrievable for replacement, maintenance, and located so as to minimize personnel exposure. This subsystem covers the range of 1 to 10 8 R/hr, which is greater than the dose rates in the H 2 and O 2 sample lines following the loss-of-coolant accident. 7.5.2.3 Primary Containment Integrity Primary Containment Isolation Valve (PCIV) position is a Type B Category 1 variable provided for verification of primary containment integrity. In the case of PCIV position, the important information is the isolation status of the containment penetration. Primary containment isolation valves that are remotely operated with control room indication needed for verifying containment integrity are applicable. PCIV's that are not included for this requirement of position indication includes check valves, relief valves, manual valves, CRD solenoid valves and excess flow check valves. Drywell vacuum breakers, which are provided with control room position indication, are not considered PCIVs and are not a part of this LSCS-UFSAR 7.5-9a REV. 20, APRIL 2014 requirement. Table 7.5-1 Position Indica tion for Reg. Guide 1.97 PCIV's lists the primary containment isolation valves that require position indication meeting the Reg. Guide 1.97 Category 1 requirements. Exceptions to the general guidance are listed in Table 7.5-1. 7.5.3 Shutdown, Isolation, and Core Cooling Indication The information furnished to the control room operator permits him to assess reactor shutdown, isolation, and availability of emergency core cooling following the postulated accident.

a. Operator verification that reactor shutdown has occurred may be made by observing one or more of the following indications:

LSCS-UFSAR 7.5-10 REV. 18, APRIL 2010 1. Control rod status on panel H13-P603, indicating each rod fully inserted.

2. Computer display of rod position.
3. Control rod scram pilot valve status indicating open valves. The power sources are RPS MG sets. See Drawings 1E-1-4215AJ and 1E-2-4215AJ. Note that the RPS MG sets are powered from motor control centers (MCC 135X-2, 235X-2, and MCC 136X-2, 236X-2) which are in turn powered by the emergency diesel generators on loss of offsite power.
4. Neutron monitoring power range channels and recorders downscale. The power sources are RPS MG sets (see Subsection 7.5.3.a.3) for monitoring channels and ESF power sources for the record ers which are ultimately powered by the emergency dies el generators on loss of offsite power.
5. Annunciators for reactor protection system variables and trip logic in the tripped state. The power source is d-c from a station battery.
b. The operator may verify reactor isolation by observing one or more of the following indications:
1. Isolation valve position lamps indicating valve closure.

See Subsection 7.5.2.3. The power source is the same as for the associated motor operator, except for valves

1(2)E12-F008. A separate power supply is furnished for the indicating lights for the valves 1(2)E12-F008.

2. Main steamline flow indication downscale. The power source is instrument a-c from one of the standby a-c buses.

LSCS-UFSAR 7.5-11 REV. 18, APRIL 2010 c. Operation of the emergency core cooling and the RCIC system following an accident may be verified by observing the following indications:

1. Flow and pressure indications for each emergency core cooling system and RCIC syst em. The power sources are independent and from the same standby buses as the driven equipment.
2. RCIC isolation valve position indicating open valves. The power source is from the same bus as the valve motive power. 3. Injection valve position lights indicating either open or closed valves. The power source is the same as the valve motor. 4. Relief valve position status by open or closed indicator lamps. The power source is 125 VDC from the Division I distribution panels 111Y (Unit 1) and 211Y (Unit 2).

7.5.4 Analysis

7.5.4.1 General The safety-related display instrumentation provides adequate information to allow the operator to make manual control actions permitted under normal, abnormal, transient, and accident conditions. Insofar as practical, instruments are select ed from those types which are qualifiable under IEEE 279-1971 and IEEE 323-1971. The reactor pressure transmitters are moun ted on two independent local panels and the reactor water level transmitters are mounted on six local panels (four wide range and two fuel zone rang e). The transmitters are designed to operate during normal operation, accident, and postaccide nt environmental conditions. The design criteria that the instruments must meet ar e discussed in Subsection 7.7.1. There are four complete and independent channels of wide-range reactor water level and two independent channels of fuel zone reactor water level and reactor vessel pressure. Each channel has its readout on a separate recorder or indicator. The recorders and indicators are located in the control room on the reactor core cooling benchboard One recorder is with the Division 1 systems and the other with the Division 2 systems. The design is adequa te to provide for accurate reactor water level and reactor pressure information during normal operation, abnormal, transient, and accident conditions. LSCS-UFSAR 7.5-12 REV. 15, APRIL 2004 Subsection 7.5.2 describes the basis for selecting ranges for instrumentation. Since abnormal, transient, or accident conditions monitoring requirements exceed those for normal operation, the normal ranges are covered adequately. Abnormal transient occurrences are not limiting from the point of view of instrument ranges and functional capability (see Subsection 7.5.4.2).

The variety of indications which may be utilized to verify that shutdown and isolation safety actions have been accomplis hed as required (see Subsection 7.5.3) are considered adequate to comply with the requirements of IEEE 279-1971. Conformance of the instrumentation system to Regulatory Guide 1.97 is given in Appendix B of the UFSAR. 7.5.4.2 Accident Conditions The DBA-LOCA is the most extreme operatio nal event. Information readouts are designed to accommodate this event from the standpoint of operator action, information, and event tracking requirements, and therefore cover all other design-basis events or incident requirements.

a. Initial Accident Event The design basis of all engineered safety features to mitigate an accident takes into consideration that "no operator action or assistance is required or recommended for the first ten (10) minutes of the event." This requirement makes it mandatory that all protective action necessary in the first 10 minutes be "automatic". Therefore, although continuous tracking of variables is available, no operator action based on them is intended.
b. Postaccident Tracking After 10 minutes, operator action is optional, therefore, the following information is available:

The following process instrumentation provides information to the operator after a DBA loss-of-coolant accident for his use in monitoring reactor conditions within the drywell.

1. Reactor Water Level and Pressure Vessel water level and pressure instrumentation described in Subsection 7.

5.4.1 above

is redundant, electrically independent, and is qualified to be operable LSCS-UFSAR 7.5-13 REV. 13 during and after a loss-of-coolan t accident. Power is from independent instrument buses powered from the two standby a-c buses. This instrumentation complies with the independence and redundancy requirements of IEEE 279-1971 and provides recorded and indicated outputs. All equipment can perform its required functions during

and following a seismic event.

2. Suppression Pool Water Level This instrumentation complies with the requirements of IEEE 279-1971 and provides recorded and indicated outputs. All equipment can perform its required function during and after the seismic event.
3. Drywell/Containment Pressure This instrumentation is redundant, electrically independent, and is qualified to be operable during and after a LOCA. Power is from independent buses, and the instrumentation complies with the requirements of IEEE 279-1971 and provides recorded outputs. All equipment can perform its required function during and after a seismic event.

The area of the suppression chamber above the water but below the drywell floor is monitored via a redundant pair of pressure transmitters to detect pressurization upward on the drywell floor due to the suppression pool bypass phenomena, in order to insure that design limits of the drywell floor are not exceeded. These transmitters feed redundant divisional indicato rs in the control room to provide instantaneous pressure readings to the operator. In addition, for the non-accident case, an alarm is

provided in the control room to call the operator's attention to these indicators if there is an abnormal pressure reading. The transmitters are qualified to IEEE 323-1971 standards, and each loop in the redundant pair is powered from emergency a-c power, which is capable of being powered by the diesel generators.

LSCS-UFSAR 7.5-14 REV. 18, APRIL 2010 4. Emergency Core Cooling Performance of emergency core cooling systems following an accident may be verified by observing redundant and independent indications as described in Subsection 7.5.3 item c and fully satisfies the need for operator verification of operation of the system.

5. Postaccident Tracking The various indications described in Subsection 7.5.3 provide adequate information regarding the status of the reactor vessel level and pressure to allow operators to make proper decisions regarding core and containment cooling operations; they also fully satisfy the need for postaccident surveillance of these variables.
c. Safe Shutdown Display The safe shutdown instrumentation is described in Subsection 7.5.3. It includes the computer display of control rod position information, the scram pilot valve status indication on control room panel H13P603, and the neutron monitoring

instruments on panel 608. Displays of this information are expected to remain operable for a sufficient time following an accident or loss of offsite powe r to indicate the attainment of safe reactor shutdown. Diversit y is provided to these safe shutdown indications because the information is fed into three separate systems, each with a separate power supply and indicating mode. The rod position information is recorded by the process computer which has an uninterruptible power supply. The Rod Position Indication System (RPIS) displays are part of the rod control management system (RCM S). The RCMS (including the RPIS displays) is powered from an uninterruptible supply, with the means to switch to an alternate power supply. The RPIS sensors which are powered from the uninterruptible power supply, will provide input informat ion to the process computer. The redundant scram pilot valve status lamps are powered from independent buses fed from th e motor-generator set of the Reactor Protection System (RPS) which has a backup. LSCS-UFSAR 7.5-15 REV. 18, APRIL 2010 The neutron monitoring instrumentation is arranged into four separate channels with ARM's, SRM's, and IRM's in each channel, with two redundant channels powered from the A bus and two redundant channels powered from the B bus of 24-Volt DC battery systems. Compliance with IEEE 279-1971 The rod status circuitry and the scram pilot valve status circuitry together meet the requirements of IEEE 279-1971. The neutron monitoring system is designed to meet all the

requirements of IEEE 279-1971 as a part of the reactor protection system. However, its RPS function is a "fail-safe" function, while safe shutdown display is not. Further, its RPS function terminates with the generation and maintenance of a shutdown signal. Taken in the aggregate, the neutron monitoring subsystem's redundancy, power switching capabilities, RPS capabilities, and expected time to failure under DBA environment conditions enable the neutron monitoring system to meet the functional requirements of IEEE 279-1971 as applicable to display instrumentation. LSCS - UFSAR Table 7.5-1 (SHEET 1 OF 7) TABLE 7.5-1 REV. 15, APRIL 2004 Position Indication for Reg. Guide 1.97 PCIV's Panel No. 1(2)H13-P601 Valve INBD MSIV INBD DRAIN INDICATION 1(2)B21-F016 Valve INBD MSIV INBD DRAIN INDICATION 1(2)B21-F019 Valve INBD MSIV INDICATION 1(2)B21-F022A Valve INBD MSIV INDICATION 1(2)B21-F022B Valve INBD MSIV INDICATION 1(2)B21-F022C Valve INBD MSIV INDICATION 1(2)B21-F022D Valve OTBD MSIV INDICATION 1(2)B21-F028A Valve OTBD MSIV INDICATION 1(2)B21-F028B Valve OTBD MSIV INDICATION 1(2)B21-F028C Valve OTBD MSIV INDICATION 1(2)B21-F028D Valve "A" FW HDR TEST CK VLV INDICATION 1(2)B21-F032A Valve "B" FW HDR TEST CK VLV INDICATION 1(2)B21-F032B Valve "A" FW HDR ISOL VLV INDICATION 1(2)B21-F065A Valve "B" FW HDR ISOL VLV INDICATION 1(2)B21-F065B Valve "A" OTBD MSIV DRAIN ISOL INDICATION 1(2)B21-F067A Valve "B" OTBD MSIV DRAIN ISOL INDICATION 1(2)B21-F067B Valve "C" OTBD MSIV DRAIN ISOL INDICATION 1(2)B21-F067C Valve "D" OTBD MSIV DRAIN ISOL INDICATION 1(2)B21-F067D Valve "A" RR SAMPLE INBD ISOL INDICATION 1(2)B33-F019 Valve "B" RR SAMPLE OTBD ISOL INDICATION 1(2)B33-F020 Valve "A" RHR PUMP SUCTION VLV INDICATION 1(2)E12-F004A Valve "B" RHR PUMP SUCTION VLV INDICATION 1(2)E12-F004B Valve "C" RHR PUMP SUCTION VLV INDICATION 1(2)E12-F004C Valve RHR SHTDN CLG SUCT OTBD ISOL INDICATION 1(2)E12-F008 Valve RHR SHTDN CLG SUCT INBD ISOL INDICATION 1(2)E12-F009 Valve "A" RHR DW SPRAY UPSTREAM ISOL INDICATION 1(2)E12-F016A Valve "B" RHR DW SPRAY UPSTREAM ISOL INDICATION 1(2)E12-F016B Valve "A" RHR DW SPRAY DWNSTRM ISOL INDICATION 1(2)E12-F017A Valve "B" RHR DW SPRAY DWNSTRM ISOL INDICATION 1(2)E12-F017B Valve "C" RHR TEST TO SP VLV INDICATION 1(2)E12-F021 Valve RHR HEAD SPRAY VLV INDICATION 1(2)E12-F023 Valve "A" RHR TEST TO SP VLV INDICATION 1(2)E12-F024A Valve "B" RHR TEST TO SP VLV INDICATION 1(2)E12-F024B Valve "A" RHR SP SPRAY ISOL INDICATION 1(2)E12-F027A Valve "B" RHR SP SPRAY ISOL INDICATION 1(2)E12-F027B Valve "A" RHR MIN FLOW VLV INDICATION 1(2)E12-F064A Valve "B" RHR MIN FLOW VLV INDICATION 1(2)E12-F064B Valve "C" RHR MIN FLOW VLV INDICATION 1(2)E12-F064C Valve "A" RHR LPCI INJ VLV INDICATION 1(2)E12-F042A Valve "B" RHR LPCI INJ VLV INDICATION 1(2)E12-F042B Valve "C" RHR LPCI INJ VLV INDICATION 1(2)E12-F042C LSCS - UFSAR Table 7.5-1 (SHEET 2 OF 7) TABLE 7.5-1 REV. 15, APRIL 2004 Valve "A" RHR SHTDN CLG RETURN ISOL INDICATION 1(2)E12-F053A Valve "B" RHR SHTDN CLG RETURN ISOL INDICATION 1(2)E12-F053B Valve "A" RHR SHTDN CLG RETURN CK BYP INDICATION 1(2)E12-F099A Valve "B" RHR SHTDN CLG RETURN CK BYP INDICATION 1(2)E12-F099B Valve LPCS PMP SUCT VLV INDICATION 1(2)E21-F001 Valve LPCS INJ VLV INDICATION 1(2)E21-F005 Valve LPCS MIN FLOW VLV INDICATION 1(2)E21-F011 Valve LPCS TEST TO SP VLV INDICATION 1(2)E21-F012 Valve HPCS INJECTION VLV INDICATION 1(2)E22-F004 Valve HPCS MIN FLOW VLV INDICATION 1(2)E22-F012 Valve HPCS PUMP SUCT FROM SP VLV INDICATION 1(2)E22-F015 Valve HPCS TEST TO SP VLV INDICATION 1(2)E22-F023 Valve RCIC STM OTBD ISOL VLV INDICATION 1(2)E51-F008

Valve RCIC PMP INJ VLV INDICATION 1(2)E51-F013 Valve RCIC PMP MIN FLOW VLV INDICATION 1(2)E51-F019 Valve RCIC UPSTREAM TEST VLV INDICATION 1(2)E51-F022 Valve RCIC PMP SUCT FROM SP VLV INDICATION 1(2)E51-F031 Valve RCIC TEST TO CST VLV INDICATION 1(2)E51-F059 Valve RCIC STM INBD ISOL VLV INDICATION 1(2)E51-F063 Valve RCIC TURB EXH ISOL VLV INDICATION 1(2)E51-F068 Valve BARO CNDSR VAC PMP DSCH VLV INDICATION 1(2)E51-F069 Valve RCIC STM INBD ISOL BYP VLV INDICATION 1(2)E51-F076 Valve RCIC TURB EXH VA C BKR DNSTM ISOL INDICATION 1(2)E51-F080 Valve RCIC TURB EXH VAC BKR UPSTM ISOL INDICATION 1(2)E51-F086 Valve RBCCW DW INLET OTBD ISOL VLV INDICATION 1(2)WR029 Valve RBCCW DW OUTLET OTBD ISOL VLV INDICATION 1(2)WR040 Valve RBCCW DW INLET INBD ISOL VLV INDICATION 1(2)WR179 Valve RBCCW DW OUTLET ISOL VLV INDICATION 1(2)WR180 Panel No. 1(2)H13-P602 Indicator "A" RR FCV HPU OTBD ISOL VLV (Note 1) 1(2)B33-R819 Indicator "A" RR FCV HPU INBD ISOL VLV (Note 1) 1(2)B33-R820 Indicator "B" RR FCV HPU OTBD ISOL VLV (Note 1) 1(2)B33-R821 Indicator "B" RR FCV HPU INBD ISOL VLV(Note 1) 1(2)B33-R822 Valve RWCU SUCT INBD ISOL VLV INDICATION 1(2)G33-F001 Valve RWCU SUCT OTBD ISOL VLV INDICATION 1(2)G33-F004 Valve RWCU RETURN DWNST ISOL VLV INDICATION 1(2)G33-F040

Panel No. 1(2)PM06J Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ026 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ027 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ029 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ030 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ031 LSCS - UFSAR Table 7.5-1 (SHEET 3 OF 7) TABLE 7.5-1 REV. 15, APRIL 2004 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ032 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ034 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ035 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ036 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ040 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ042 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ043 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ047 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ048 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ050 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ051 Valve MIMIC OR VALVE SWITCH INDICATION 1(2)VQ068 Valve "A" DW COOLER OTBD ISOL VLV INDICATION 1(2)VP053A Valve "B" DW COOLER OTBD ISOL VLV INDICATION 1(2)VP053B Valve "A" DW COOLER OTBD ISOL VLV INDICATION 1(2)VP063A Valve "B" DW COOLER OTBD ISOL VLV INDICATION 1(2)VP063B Valve "A" DW COOLER INBD ISOL VLV INDICATION 1(2)VP113A Valve "B" DW COOLER INBD ISOL VLV INDICATION 1(2)VP113B Valve "A" DW COOLER INBD ISOL VLV INDICATION 1(2)VP114A Valve "B" DW COOLER INBD ISOL VLV INDICATION 1(2)VP114B Panel No. 1(2)PM13J Valve DW PNEUMATICS SUCT UPSTRM ISOL INDICATION 1(2)IN001A Valve DW PNEUMATICS SUCT DNST RM ISOL INDICATION 1(2)IN001B Valve DW PNEUMATICS 100LB HDR ISOL INDICATION 1(2)IN017 Valve DW PNEUMATICS TIP INDX R PRG ISOL INDI CATION 1(2)IN031 Valve DW DRYER PRG OTLT DNSTM ISOL VLV INDICATION 1(2)IN074 Valve DW DRYER PRG OTLT UPSTM ISOL VLV INDICATION 1(2)IN075 Valve DW SUCT UPSTREAM ISOL INDICATION 1(2)CM017A Valve DW SUCT UPSTREAM ISOL INDICATION 1(2)CM017B Valve DW SUCT DOWNSTREAM ISOL INDICATION 1(2)CM018A Valve DW SUCT DOWNSTREAM ISOL INDICATION 1(2)CM018B Valve SUP CHBR RTN UPSTREAM ISOL INDICATION 1(2)CM019A Valve SUP CHBR RTN UPSTREAM ISOL INDICATION 1(2)CM019B Valve SUP CHBR RTN DOWNSTREAM ISOL INDICATION 1(2)CM020A Valve SUP CHBR RTN DOWNSTREAM ISOL INDICATION 1(2)CM020B Valve 1(2)PL75J SP SUCT UPSTREAM INDICATION 1(2)CM027 Valve 1(2)PL75J SP SUCT DOWNSTREAM INDICATION 1(2)CM028 Valve 1(2)PL75J DW SUCT UPSTREAM INDICATION 1(2)CM029 Valve 1(2)PL75J DW SUCT DOWNSTREAM INDICATION 1(2)CM030 Valve 24 POINT SAMPLE UPSTRM ISOL VLV INDICATION 1(2)CM031 Valve 24 POINT SAMPLE DWNSTRM ISOL VLV INDICATION 1(2)CM032 Valve 1(2)PL75J/15J SP UPSTREAM RTN INDICATION 1(2)CM033 Valve 1(2)PL75J/15J SP DOWNSTREAM RTN INDICATION 1(2)CM034 LSCS - UFSAR Table 7.5-1 (SHEET 4 OF 7) TABLE 7.5-1 REV. 15, APRIL 2004 Panel No. 1(2)PM16J Valve DW SUCT UPSTREAM ISOL INDICATION 1(2)HG001A Valve DW SUCT UPSTREAM ISOL INDICATION 1(2)HG001B Valve DW SUCT DOWNSTREAM ISOL INDICATION 1(2)HG002A Valve DW SUCT DOWNSTREAM ISOL INDICATION 1(2)HG002B Valve SP RETURN DOWNSTREAM ISOL INDICATION 1(2)HG005A Valve SP RETURN DOWNSTREAM ISOL INDICATION 1(2)HG005B Valve SP RETURN UPSTREAM ISOL INDICATION 1(2)HG006A Valve SP RETURN UPSTREAM ISOL INDICATION 1(2)HG006B Valve DWEDS PMPS SUCT UPSTRM ISOL VLV INDICATION 1(2)RE024 Valve DWEDS PMPS SUCT DNSTM ISOL VLV INDICATION 1(2)RE025 Valve DWEDS RECIRC DNSTM ISOL VLV INDICATION 1(2)RE026 Valve DWEDS RECIRC UPSTRM ISOL VLV INDICATION 1(2)RE029 Valve DWFDS PMPS SUCT UPSTRM ISOL VLV INDICATION 1(2)RF012 Valve DWFDS PMPS SUCT DNSTM ISOL VLV INDICATION 1(2)RF013 LSCS - UFSAR Table 7.5-1 (SHEET 5 OF 7) TABLE 7.5-1 REV. 15, APRIL 2004 Table 7.5-1 Position Indication for Reg. Guide 1.97 PCIV's

Note 1 1(2)B33-F338A,B 1(2)B33-F339A,B 1(2)B33-F340A,B 1(2)B33-F341A,B 1(2)B33-F342A,B 1(2)B33-F343A,B 1(2) B33-F344A,B 1(2)B33-F345A,B The Reactor Recirculation Hydraulic Flow Control Line Isolation Valves are solenoid operated valves with position indication for each valve provided in the Auxiliary Electric Equipment Room. Control Room indication of the valve position status is provided by indicating lights 1(2)B33R819 1(2)B33R 820 1(2)B33R821 1(2)B33R822. Each indicating light indicates that the position status of the group of valves associated with RR Hydraulic Flow control line penetration e.g. the position indicating light of the A Loop RR Flow Control Line Isolation Inboard is olation valves indicates closed when all four inboard isolation valv es associated with the A RR Control Lines are closed; otherwise the indicated position of the penetration is not clos ed (deenergized). A similar position indicating light is likewise provided for the A RR Hydraulic Line Outboard Isolation Valves, and the B RR Hydraulic Line Inboard Isolation Valves and Outboard Isolation Valves. The Control Room position indicating lights are considered Reg. Guide 1.97.

Exceptions to the general criteria: Note 2 (2)CM021B 1(2)CM022A 1(2)CM023B 1(2)CM024A 1(2)CM025A 1(2)CM026B POST-LOCA Containment Monitoring Isolation Valves are solenoid operated valves that automatically open during accident conditions. UFSAR Table 6.2-21 List of Containment Penetrations and Containment Valves indicates in Note 40 that the POST_LOCA valves are required to open and remain open following a LOCA to allow the containment to be sampled. The sample system constitutes a closed loop outside of containment and is tested in the Type A PC Integrity Test. Since the valves do not provide information related to Containment Integrity, they are not included as a Reg. Guide 1.97 Category B Variable for Primary Containment Integrity. Note 3 1(2)C41-F004A, 1(2)C41-F004B Position indication for the Sta ndby Liquid Control (SLC) squib valves is not classified as a Reg. Guide 1.97 variable. The containment penetration associated with the SLC has both an inboard and outboard check valve isola tion. The squib valves are closed unless the SLC system is manually initiated by the control room operator. Therefore the position of the squib valves is not required for the operator to ascertain containment integrity as indicated in Ta ble 1 of Reg. Guide 1.97. LSCS - UFSAR Table 7.5-1 (SHEET 6 OF 7) TABLE 7.5-1 REV. 15, APRIL 2004 Note 4 1(2)C51-J004

Position indication for the Traversing Incore Probe (TIP) system is not a Reg. Guide 1.97 variable. The TIP system is olation and ball valve position indication are classified as non-safety related. There are no specific regulatory or IEEE requirements for the TIP subsystem. UFSAR Table 6.2-21 Note 18 a nd UFSAR 7.7.6.4 describe the TIP system isolation and the backup explosive shear valves. The ball valve position indication is in the control room. A common pair of positi on indicating lights indicates the TIP ball valves closed when all five valves are closed. The TIP valves are not included as Reg. Guide 1.97 equipment for the same reason that the NRC did not require the valves to be safety related. The penetration is normally closed. A maximum of four valves may be opened at any one time to perform calibration and any one guide tube is used at most a few hours per year. If a TIP cable fails to withdraw or ball valve fails to close, the explosive shear valve is actuated.

Note 5 1(2)E12-F011A/B, 1(2)E12-F073A/B, 1(2)E12-F074A/B, 2E51-F064 RHR Steam Condensing Mode Valves, which have been administratively deactivated in the closed position during Unit operation Modes 1, 2 and 3, are not classified as Reg. Guide 1.97 indication. UFSAR 5.4.7.2.2.3 St eam Condensing Mode states that On-Site Review 92-37 was performed by LaSalle Station to delete the Steam Condensing Mode of Residual Heat Removal System Operation from use at LaSalle. The procedures governing Steam Condensing Mode Operation ha ve been deleted and a review of other procedures that operate the below listed valves, concluded that these valves are not required to operate in plant emergency proce dures. The active safety related function of the actuators has been deleted and the valves will only be opened in Operating Conditions 4, 5, and Defueled to support infrequent non-safety related functions.

Note 6 1(2)IN100, 1(2)IN101 Drywell pneumatics to ADS accumulator valves are not classified as Reg. Guide 1.97 indication. The drywell pneumatics to ADS accumulator valves have a similar safety function as that of the POST-LOCA containment monitoring isolation valves in that the safety function of the valves is in the ope n position and the valves are designed to fail open. The ADS drywell pneumatics valves provide instrument nitrogen from either the Instrument Nitrogen System or nitrogen bottle banks. The bottled nitrogen allows operation of the ADS valves following an accident via continuous supply to the two groups of ADS accumulators. The lines are continuously monitored for leakage by pressure instrumentation that alarms in the control room on low pressure. Since the function of the valves is to be open during an accident, the positi on indication of these valves is not required for Primary Containment Integrity status. LSCS - UFSAR Table 7.5-1 (SHEET 7 OF 7) TABLE 7.5-1 REV. 15, APRIL 2004 Note 7 1(2)CM085, 1(2)CM086, 1(2)CM089, 1(2)CM090 The High Radiation Sampling System (HRSS) Air Sampling Isolation Valves are solenoid operated valves that are normally closed and administratively deactivated by the removal of the control fuses.. The procedures, which control these valves, ensure that the valves are only opened under administrative controls within the constraints of the applicable Technical Specifications. As such, the valves are considered equivalent to locked or sealed closed manual valves. The valves are closed unless the use of the valves is authorized by the control room operator. Therefore the position of the valves is not required for the operator to ascertain containment integrity as indicated in Table 1 of Reg. Guide 1.97.

LSCS-UFSAR 7.6-1 REV. 15, APRIL 2004 7.6 OTHER INSTRUMENTATION REQUIRED FOR SAFETY This section discusses the instrumentation and control aspects of the following systems: a. Process Radiation Monitoring System.

1. Reactor Building Ventilation Exhaust Plenum Monitoring System. 2. Fuel Pool Vent Plenum Radiation Monitoring Subsystem.
b. Leak Detection System.
1. Main Steamline Leak Detection.
2. RCIC System Leak Detection.
3. RHR System Leak Detection.
4. Reactor Water Cleanup System Leak Detection.
c. Neutron Monitoring System.
1. Intermediate Range Monitor Subsystem.
2. Average Power Range Monitor Subsystem.
d. Recirculation Pump Trip System.

7.6.1 Process

Radiation Monitoring System Instrumentation and Controls A number of radiation monitors and monitoring subsystems are provided on process liquid and gas lines that may serve as discharge routes for radioactive materials. The safety-related subsystems include the following:

a. reactor building vent exhaust plenum radiation monitoring subsystem, and
b. fuel pool vent plenum radiation monitoring subsystem.

These subsystems are described individually in the following paragraphs. The non-safety-related radiation monitoring subsystems are discussed in Subsection 7.7.14.

7.6.1.1 Main Steamline Radiation Monitori ng Subsystem (See Subsection 7.7.14.5)

LSCS-UFSAR 7.6-2 REV. 13 7.6.1.2 Reactor Building Vent Exhaust Plenum Radiation Monitoring Subsystem 7.6.1.2.1 Design Bases 7.6.1.2.1.1 Safety Design Bases

The subsystem shall:

a. Provide the capability of detecting gamma radiation level in the reactor building vent exhaust plenum.
b. Initiate control signals in the event the radiation level exceeds a predetermined level to isolate the reactor building vent system, to initiate the standby gas treatment system, and to close primary containment purge and vent valves.
c. Provide alarms as the radiation level approaches the trip level for isolation or as the level has reached the trip level.

The subsystem instrumentation and controls conform to the specific regulatory requirements shown in T ables 7.1-2 and 7.1-7. 7.6.1.2.1.2 Power Generation Design Bases The subsystem provides an indication in the control room of the gross gamma radiation level and provides the recorder signal.

7.6.1.2.2 System Description Subsystem Identification The purpose of this subsystem is to indica te when excessive amounts of radioactive gases exist in the reactor building and to effect appropriate action so that the release of radioactive gases to the environs is controlled. Power Sources The 120-Vac RPS Buses A and B are the powe r sources for this subsystem. Two channels receive power from one RPS bus, and the other two channels receive power from the other RPS bus.

Equipment Design The reactor building ventilation exhaust plenum radiation monitoring subsystem is shown in Drawing No. M-153, sheets 1 and 6, and characteristics are given in Table 7.3-3. The subsystem consists of four independent channels. LSCS-UFSAR 7.6-3 REV. 15, APRIL 2004 Each channel includes a Geiger-Muller type detector and an indicator and trip unit. The four channels share two inputs on a recorder. All equipment except the detectors is located in the control room. The detectors are located in the vent

plenum. Each channel has two trips. The upscale trip indicates high radiation, and the downscale trip indicates instrument trouble. When the instrument is switched to "calibrate", it is considered to be inoper ative. Any one trip sounds an alarm in the control room. Two upscale trips, two inoper ative trips, or one upscale trip and one inoperative trip on either set of channels will shut down the containment ventilation system, start the standby gas tr eatment system, and initiate closure of the various containment pu rge and exhaust paths. Testability The monitors are readily accessible for in spection, calibration, and testing. The reactor building vent exhaust plenum radiation monitoring subsystem and the response of the plant ventilation systems and standby gas treatment system are routinely tested. Operation of the dete ctors can be verified through use of a portable gamma source. Environmental Considerations The environmental considerations are given in Section 3.11. Operational Considerations The reactor building vent exhaust plenum radiation monitoring subsystem is designed to function under all operating conditions. It is designed to withstand the environment which would accompany a containment high radiation situation. 7.6.1.2.3 Analysis

7.6.1.2.3.1 General Function al Requirement Conformance The physical location and monitoring characteristics of the reactor building ventilation exhaust plenum radiation monitoring channels are adequate to detect abnormal amounts of radioactivity in the reactor building vent plenum and to initiate isolation. The redundancy and arrangement of channels ensure that no single failure can prevent isolation when required. During refueling operation (including criticality tests), the monitoring system acts as an engineered safeguard against the consequences of the refueling accident and the rod drop accident. The response of the reactor building ventilati on exhaust plenum radiation monitoring subsystem to the refueling accident is presented in Chapter 15.0.

LSCS-UFSAR 7.6-4 REV. 14, APRIL 2002 7.6.1.2.3.2 Specific Re quirement Conformance Attachment 7.A presents the system conformance to IEEE criteria and other regulatory requirements. 7.6.1.2.3.3 Regulatory Guides This topic is discussed in Appendix B.

7.6.1.2.3.4 10 CFR 50 Appendix A Criterion 13

The subsystem conforms to Criterion 13 in that the instruments employed more than adequately cover the anticipated range of radiation under normal operating conditions with sufficient margin to in clude postulated accident conditions. Criterion 20 The subsystem conforms to Criterion 20 in that activation of the trip circuit will

result in alarm annunciator activation and, depending upon the specific trip, a trip indication being sent to the plant vent system, the standby gas treatment system, and the containment system. Criterion 21 The subsystem conforms to Criterion 21 in that redundant circuits are an integral part of the system design. Criterion 22 The subsystem conforms to Criterion 22 in that the effects of natural phenomena and normal operation (including testing) do not result in loss of protection.

Criterion 23 The subsystem conforms to Criterion 23 in that the trip circuits associated with each channel have been designed to specifically "fail-safe" in the event of loss of power. Criterion 24 The subsystem conforms to Criterion 24 in that manufacturing construction features assume separation from the control system.

LSCS-UFSAR 7.6-5 REV. 13 Criterion 29 No anticipated operational occurrence can prevent this equipment from performing its safety function. Criterion 64 Continuous radiation monitoring is prov ided for this discharge path under all reactor conditions. 7.6.1.3 Fuel Pool Ventilation Exhaust Plenum Radiation Monitoring Subsystem 7.6.1.3.1 Design Bases 7.6.1.3.1.1 Safety Design Bases The subsystem:

a. Provides the capability of detecting gamma radiation level in the fuel pool vent exhaust plenum.
b. Initiates control signals in the event the radiation level exceeds a predetermined level to isolate the reactor building vent system, to initiate the standby gas treatment system, and to close primary containment purge and vent valve.
c. Provides alarms as the radiation level approaches the trip level for isolation or as the level has reached the trip level.

The subsystem instrumentation and controls conform to the specific requirements shown in Tables 7.1-2 and 7.1-7. 7.6.1.3.1.2 Power Generation Design Bases

The subsystem provides an indication in the control room of the gross gamma radiation level and provides the recorder signal. 7.6.1.3.2 Description The fuel pool vent plenum radiation monitoring subsystem is identical to the reactor building ventilation exhaust plenum monitoring subsystem, which is

discussed in Subsection 7.3.2.2.3.

LSCS-UFSAR 7.6-6 REV. 13 7.6.1.3.3 Analysis The analysis for the reactor building vent exhaust plenum radiation monitoring subsystem, discussed in subsection 7.6.1. 2.3 and Attachment 7.A, applies to this system since they are identical.

7.6.2 Reactor

Coolant Pressure Boundary Leakage Detection 7.6.2.1 Design Bases 7.6.2.1.1 Safety Design Bases The safety design bases for the leak detection systems are as follows:

a. Signals are provided to perm it isolation of abnormal leakage before the results of this leakage become unacceptable.
b. The unacceptable results are as follows:
1. A threat of significant compromise to the reactor coolant pressure boundary.
2. A leakage rate in excess of the coolant makeup capability to the reactor vessel.

The part of leak detection that is related to isolation circuits is designed to meet requirements of the engineered safety feature systems and to comply with the specific regulatory requirements listed in Tables 7.1-2 and 7.1-8. 7.6.2.1.2 Power Generation Design Basis A means is provided to detect abnormal le akage from the reactor coolant pressure boundary.

7.6.2.2 General

System Description

The instrumentation and controls associated with the leak detection system are discussed in Subsection 5.2.5. Associated automatic valve isolating logic is defined to be part of the containment and reactor vessel isolation control system (Subsection 7.3.2) and RCIC instrumentation and control system (Subsect ion 7.4.1) and is described in those subsections.

The safety-related portions of the leak detection system perform the following functions:

a. Main Steamline Leak Detection.

LSCS-UFSAR 7.6-7 REV. 16, APRIL 2006 b. RCIC System Leak Detection.

c. RHR System Leak Detection.
d. Reactor Water Cleanup System Leak Detection.

Non-safety-related portions of the leak detection system are discussed in Subsection 7.7.15. The purpose of the leak detection instrumentation and controls is to provide the signals necessary to detect and isolate le akage from the reactor coolant pressure boundary before predetermined limits are exceeded.

7.6.2.2.1 Power Sources Power separation is applicable to leak dete ction signals that are associated with the isolation valve systems. Four power sources are used to comply with separation criteria. Equipment associated with Division 1 is powered by 120-Vac Instrument Bus A. Division 2 equipment is po wered by 120-Vac Instrument Bus B.

7.6.2.2.2 Equipment Design The systems or parts of systems which contain water or steam coming from the reactor vessel or which supply water to the reactor vessel, and which are in direct communication with the reactor vessel, are provided with leakage detection systems as listed above (Figure 7.3-7 and Drawing Nos. M-155 and M-157).

7.6.2.2.3 Main Steamline Leak Detection The main steamline leak detection subsystem consists of three types of monitoring circuits. The first of these monitors the ambient and differential area temperature, triggering the alarm circuit and main steamline isolation valve logic when the observed temperature rises above a preset maximum. The second circuit monitors the mass flow rate through the main steamlines and uses this information for comparison purposes and to trigger the alarm circuit and close isolation valves when the observed flow rate exceeds a preset maximum. The third type of circuit detects low water level in the reactor vessel and sends a trip signal to the isolation valve logic when the level decreases below a preselected setpoint.

LSCS-UFSAR 7.6-8 REV. 16, APRIL 2006 Thermocouples are positioned in the main st eamline tunnel so that they are screened from direct incident-radiated heat and yet are still able to respond to the temperature of the ambient air. All of the thermoco uples are terminated on Digital Recorders located in the control room, which compute and display differential temperatures for the rooms as well as the ambient temperatures. Output relays from the recorders will initiate alarms and isolations when the associated temperature s exceed predefined setpoints. There are no isolations associated with ambient temperatures. During start-up of the reactor building ventilation system, the differential temperature isolation circuits are bypassed, preventing a trip signal to initiate the isolation logic, and an alarm is provided for indicating the bypass function. All other alarm and indicating functions provided by the ambient temperature and differential temperature circuits under this condition will function as previously stated above. This will prevent spurious isolations re sulting from reactor building temperature transients that are experienced during the start-up of the reactor building ventilation system. Each main steamline is instrumented to monitor the steam flow rate through it. The flow rate monitoring components of the main steamline leak detection system consist of a set of four differential pressure switches (DPS) and an associated steam flow restrictor for each main steamline. The outputs of the DP switches are connected to components of the primary containment and re actor vessel isolation system and give a coincidence signal for main steamline flow below the setpoint trip value. Flow rates in excess of the predetermined setpoint will cause DPS actuation. Reactor water level is monitored to indicate the presence of a steam leak. Under conditions of normal reactor operation at constant power, reactor water level should remain fairly constant at its programmed level, since the rate of steam mass flow leaving the boiler is matched by the feedwater mass flow rate into the vessel. However, given a condition of continued st eam leakage from the closed system, the reservoir of condensate to be returned to the reactor vessel decreases, and the reactor water level soon cannot be maintained. Reactor water level is monitored by four level switches as part of the design of the nuclear steam supply system in addition to the normal complement of process monitoring instruments. Reactor wate r level falling below the predetermined minimum allowable level will result in switch actuation and subsequent primary containment and reactor vessel isolation system response.

LSCS-UFSAR 7.6-9 REV. 13 7.6.2.2.4 RCIC Syst em Leak Detection Subsystem Function The steam circuits of the RCIC system are co nstantly monitored for leaks by a leak detection subsystem. Leaks from the RCIC w ill cause a change in at least one of the following monitored operating parameters

sensed area temperature, steam pressure, or steam flow rate. If the monitored parameters indicate that a leak may exist, the detection subsystem (Figure 7.3-7 and Drawing Nos. M-155 and M-157) responds by activating an annunciator and initiating a RCIC isolation trip logic signal. Theory of Operation The RCIC leak detection subsystem consists of three types of mo nitoring circuits. The first of these monitors ambient and differential temperature to trigger an annunciator when the observed temperature rises above a preset maximum. The second type monitors the flow rate (differential pressure) through the steamline and triggers an annunciator when the observ ed differential pre ssure rises above a preset maximum. The third type of circuit monitors the steamline pressure upstream of the differentia l pressure element and is also annunciated. Alarm outputs from all three circuits are also used to generate the RCIC autoisolation signal. The area temperature monitoring circuit is similar to the one described for the main steamline tunnel temperature monitoring system except both ambient and differential temperature monitoring circuits send trip signals to the isolation logic.

(see Subsection 7.6.2.2.3). The RCIC equipment area and RCIC pipe chase also utilize ambient temperature leak detection monitors in these respective areas. Isolation will occur at the established leakage rate limit (25 gpm) or below regardless of the ambient temperature under normal operational conditions (i.e., CSCS cubicle area coolers not operating). If the CSCS cubicle coolers are operating, the leakage rate at which isolation will be actuated will be slightly higher (approximately 40-50 gpm). The leakage rate at which an alarm is actuated will be at the established rate (5 gpm) during design ambient temperature conditions expected during summer. During winter design conditions, the leakage rate a which the alarm is actuated will be slightly higher, but always less than the established isolation actuation leakage rate limit. During winter design conditions, the differential temperature alarm actuation is conservative (i.e., actuates at leakage rates less than the established limit). The RCIC equipment area differential temperature detectors monitor the temperature differential between the

general area from which the reactor bu ilding ventilation is induced, and the temperature in the equipment area. The RCIC pipe chase differential is monitored between the ducted supply ventilation and the chase temperature. LSCS-UFSAR 7.6-10 REV. 13 The steamline from the nuclear boiler leading to the RCIC turbine is instrumented with one set of two differential pressu re switches connected to measure the differential pressure created as steam flows past an elbow in the line so that the steam flow rate through it can be monito red. In the presence of a leak, the RCIC system responds by generating the autoisolation signal.

Steamline pressure to the RCIC turbine is monitored to detect gross system leaks that may occur upstream of the differentia l pressure element (e lbow), causing the line pressure to drop to an abnormally low level. This line pressure is monitored by the pressure switches which also monitor RHR steamline pressure (see Subsection 7.6.2.2.5). 7.6.2.2.5 RHR System Leak Detection Subsystem Function The RHR system is constantly monitored for leaks by the leak detection system (Figure 7.3-7 and Drawing Nos. M-155 and M-157). Leaks from the RHR system are detected by flow rate and system pr essure similar to the RCIC system. Logics from all these channels are used to gene rate RHR auto isolation signals and alarm communication. If the monitored parameters indicate that a leak may exist, the detection system responds by activati ng an annunciator and initiating a RHR isolation trip logic signal. Theory of Operation The RHR system is a moderate energy system. Since temperature and differential temperature leak detection monitors are only effective for hot (high energy) systems, other means of leak detection are relied upon. The RHR leak detection subsystem consists of two types of monitoring circuits. The first monitors the flow rate (differential pressure) through the steamline, triggering an annunciator when the observed differenti al pressure (flow) rises above a preset maximum. The second type of circuit monitors the line pressure upstream of the differential pressure element and is also annunciated. Alarm outputs from both circuits are also used to generate the RHR autoisolation signal. Flow rate monitoring is provided on the RHR shutdown cooling suction line. Flow rates in excess of the predetermined maximum are indicative of a line leak or break and will generate differential pressure heads of sufficient magnitude to cause DPS actuation.

Process line pressure is monitored to detect gross system leaks that may occur upstream of the flow element, causing th e line pressure to drop to an abnormally low level. Line pressure is monitored by two pressure switches actuating on low pressure. LSCS-UFSAR 7.6-11 REV. 13 Additionally, differential pressure between RHR lines and RHR and LPCS lines is monitored by differential pressure-indicating switches to detect RHR or LPCS line break. Annunciation is provided in the main control room. Floor drain and radiation monitors are also available to indicate system leakage from the RHR equipment areas. 7.6.2.2.6 Reactor Water Cleanup System Leak Detection Subsystem Function The purpose of this part of the leak detection system is to monitor the reactor cleanup system components and activate a system annunciator should a system leak of sufficient magnitude occur. In addition to annunciation, a high flow comparison activates automatic isolation of the cleanup system. Theory of Operation The reactor water cleanup (RWCU) leak detection subsystem consists of three types of monitoring circuits. The first of these monitors the ambient and differential temperature of the RWCU Pump and Heat Exchanger Rooms, Holdup Pipe Room, and F/D Valve Rooms, triggering the alarm circuit and isolation of RWCU isolation logic when the monitored temperature rises above a preset maximum. For Unit 2, monitors are located in the Heat Exchanger Rooms only. The area temperature monitoring circuit is similar to the one described for the main steamline temperature monitoring system except both ambient and differential temperature monitoring circuits send trip signals to the isolatio n logic. (see Subsec tion 7.6.2.2.3 and Figure 7.6-1). The reactor water cleanup leak detection subsystem includes an area drain monitoring system. The monitoring subsystem activates an annunciator when the reactor building sump flow exceeds a predetermined value. In addition to floor drain detection methods, leakage is also monitored by the flow comparison of water inlet and outlet flow rate. The floor drain monitoring circuits are described in Subsection 7.7.15.2.8. RWCU pump suction flow is monitored, and provides for alarm and isolation for RWCU pipe break flow rates. A time dela y is incorporated in the circuit to avoid spurious trips due to operational transients. This delay is based on the HELB analysis.

LSCS-UFSAR 7.6-12 REV. 20, APRIL 2014 RWCU system inlet flow is compared to RWCU outlet flow to the feedwater lines or to the main condenser. A flow element, flow transmitter, and square root converter provide signals to a flow summer which trip s two timers and activates an alarm at a preselected difference in flows. After a time delay to avoid spurious trips, the time switches trip differential flow alarm units, activating isolation. Flow indication for return to feedwater or to main condenser/waste collection surge tanks and differential flow indication are provided in the control room. The RWCU differential flow instrumentation measures volumetric flow with no temperature compensation and, therefore, no correction for differences in coolant densities. The system is designed for power operation temperatures and pressures. The RWCU System leak detection interlocks for area high and differential temperature and for RWCU System different ial flow are bypassed for less than 1 hour by operation of test bypass keylock switches during spurious trips of Reactor Building ventilation to prevent unnecessary RWCU System isolation due to higher ambient temperatures expected when the Reactor Building ventilation is off. Alarms from the leak detection devices remain available to provide Operator warning small line leaks. Isolation logic is restored to normal upon restart of Reactor Building ventilation.

During operational conditions when the Unit is in cold shutdown, refuel, or defueled, the Reactor Water Cleanup System Leak Detection Isolation trip functions may be continuously bypassed. These isol ations consist of RWCU HX Room Area High Temperature and High Differentia l Temperature, High RWCU Differential Flow and the associated leak detection power monitoring trip function. These isolation are associated with high energy line breaks (HELB) and detecting leakage related to operational conditions when the RWCU system is at high temperatures (above 212 degrees F). These isolations are not required during conditions when the reactor coolant is at conditions of low energy and low temperature. During these shutdown/refuel/defueled conditions the above Leak Detection isolation functions are not required operable by the corresponding Technical Specification. 7.6.2.2.7 Testability The proper operation of the sensors and the logic associated with the leak detection systems is verified during the leak detection system preoperational test and during inspection tests that are provided for the various components during plant operation. LSCS-UFSAR 7.6-13 REV. 16, APRIL 2006 All temperatures are monitored by dual el ement thermocouples. One element of each is connected to the digital recorders, which allows for the se cond element to be used as an in-place spare. Detailed testing and calibration for each digital recorder can be performed using standard test and calibration procedures. Alarm and indictor lights monitor the status of the trip circuit. Each digital recorder has indications on their display screens that will indicate the status of the channel alarms. Setpoints are revised using the modification process to revise the configuration file for the specific affected recorder(s). In addition, keylock test switches are provided so that the logic can be tested without sending an isolation signal to the system involved. Thus, a complete system check can be confirmed by checking activation of the isolation relay associated with each switch. Detailed testing and calibration for each RWCU differential flow leak detection alarm units can be performed using standa rd test and calibration procedures. Alarm and indicator lights monitor the status of the trip circuit. Testing of flow, reactor vessel level, and pressure leak detection equipment is

described in Subsection 7.3.2. 7.6.2.2.8 Environmental Considerations The sensors, wiring, and electronics which are associated with the isolation valve logic are designed to withstand the condit ions that follow a loss-of-coolant accident. 7.6.2.3 Analysis 7.6.2.3.1 General Function al Requirement Conformance The part of leak detection system instrumentation that is related to the system isolation circuitry is designed to meet requirements of the primary containment and reactor vessel isolation control system. There are at least two different methods of detecting abnormal leakage from each reactor coolant pressure boundary system within the primary containment and in each area as shown in Table 5.2-8. The instrumentation is designed so that it may be set to provide alarms at

established leakage rate limits and isolate the affected system if necessary. The alarm points are determined analytic ally, based on design data and on measurements of appropriate parameters made during startup and preoperational tests. This satisfies the power generation design bases and safety design bases.

LSCS-UFSAR 7.6-14 REV. 14, APRIL 2002 7.6.2.3.2 Specific Requirement Conformance Attachment 7A presents the system conformance to IEEE criteria and other regulatory requirements. 7.6.2.3.3 Regulatory Guides This topic is discussed in Appendix B.

7.6.2.3.4 10 CFR 50 Appendix A Criterion 13

The leak detection sensors and associated electronics are designed to monitor the reactor coolant leakage over all expected ranges required for the safety of the plant. Automatic initiation of the system isolation action, reliability, testability, independence, and separation have been factored into leak detection design as required for isolation systems.

Criterion 19 Controls and instrumentation are provided in the control room. Criterion 20 Leak detection equipment senses accident conditions and initiates the containment and reactor vessel isolation control system when appropriate. Criterion 21 Protection related equipment is arranged in two redundant divisions and maintained separately. Testing is covered in the conformance discussion for regulatory guides.

Criterion 22 Protection related equipment is arranged in two redundant divisions so no single failure can prevent isolation. Functional diversity of sensed variables is utilized. Criterion 23 Signals provided are such that isolation logic is fail safe.

LSCS-UFSAR 7.6-15 REV. 13 Criterion 24 The system has no control functions. Criterion 29

No anticipated operational occurrence can prevent an isolation. Criterion 30 The system provides means for detection and generally locating the source of reactor coolant leakage. This criterion also applies to the sump, drywell, recirculating pump, and ADS leak monitoring equipment.

Criterion 33 The leak detection total leakage limitations are confined to conservative levels far below the coolant makeup capacity of the RCIC system. Criterion 34 Leak detection is provided for the RHR shutdown cooling and RCIC lines penetrating the drywell. Criterion 35 ECCS leak detection is augmented by the sump monitoring system portion of the

leak detection system. ECCS leaks can easily be identifi ed by operator correlation of various flow, pressure, and reactor vessel level signals transmitted to the control room. Criterion 54 Leak detection is provided for main steam, RCIC, RHR shutdown cooling, and reactor water cleanup lines penetrating the drywell. Sump fill rate monitoring provides leak detection for other pipes penetrating the drywell and reactor buildings.

7.6.3 Neutron

Monitoring System Instrumentation and Controls 7.6.3.1 General

System Description

The safety-related subsystems of the ne utron monitoring system consist of the following:

a. intermediate range monitor (IRM) subsystem, and LSCS-UFSAR 7.6-16 REV. 18, APRIL 2010
b. average power range monitor (APRM) subsystem.
c. oscillation power range monitor (OPRM) subsystem The purpose of this system is to detect excessive neutron flux in the core and provide signals to the reactor protection system and the rod block portion of the rod control management system. It also provides information for operation and control of the reactor.

The OPRM subsystem detects and suppresses potential core power oscillations at high power and low flow conditions, in order to prevent exceeding the fuel safety limits. The IRM, APRM, and OPRM subsystems provide a safety function and have been designed to meet particular requirements established by the NRC. The LPRM subsystem has been designed to provide a sufficient number of LPRM inputs to the APRM and OPRM subsystems to meet th eir requirements. Although, the LPRM subsystem was originally not considered a safety system, General Electric re-evaluated the LPRM subsystem in 1987 and concluded it should be considered safety related. Consequently, all renewa l parts for the subsystem are procured as safety related. The portions of the neutron monitoring system, which have no safety function or was historically considered to have no safety function are discussed in Subsection 7.7.6. 7.6.3.1.1 Power Source

The power sources for each system are discussed in the individual system descriptions. 7.6.3.2 Intermediate Range Monitor Subsystem 7.6.3.2.1 Design Bases

7.6.3.2.1.1 Safety Design Bases The IRM generates a trip signal that can be used to prevent fuel damage resulting from abnormal operational transients that occur while operating in the intermediate power range. The independence and redundancy incorporated in the design of the IRM are consistent with the safety design bases of the reactor protection system. The IRM is designed in accordance with the specific regulatory requirements shown in Table 7.1-2.

LSCS-UFSAR 7.6-16a REV. 14, APRIL 2002 7.6.3.2.1.2 Power Generation Design Bases The IRM generates an interlock signal to block rod withdrawal if the IRM reading exceeds a preset value or if the IRM is no t operating properly. The IRM is designed so that overlapping neutron flux indications exist with the SRM and APRM subsystems.

LSCS-UFSAR 7.6-17 REV. 13 7.6.3.2.2 System Description Equipment Design The IRM monitors neutron flux from the upper portion of the SRM range to the lower portion of the power range (see Figu re 7.6-7). The subsystem has eight IRM channels, each of which includes one detector that can be positioned in the core by remote control (see Figure 7.6-4). The detectors are inserted into the core for a reactor startup and are withdrawn after the reactor mode selector switch is turned to RUN. a. Power Supply Power is supplied separately from two 24-Vdc sources. The supplies are split according to their uses so that loss of a power supply will result in loss of only one trip system of the reactor protection system.

b. Physical Arrangement Each detector assembly consists of a miniature fission chamber attached to a low-loss, quartz-fiber-insulated transmission cable. When coupled to the signal conditioning equipment, the detector produces a reading of full scale on the most sensitive range with a neutron flux of 4 x 10 8 nv. The detector cable is connected underneath the reactor vessel to a triple-shielded coaxial cable that carries the pulses generated in the fission chamber to the preamplifier.

The detector and cable are located in the drywell. They are movable in the same manner as the SRM detectors and use the same type of mechanical arrangem ent (see Figures 7.6-3, 7.6-4, and Reference 1).

c. Signal Conditioning A voltage amplifier unit located ou tside the drywell serves as a preamplifier. This unit converts the current pulses to voltage pulses, modifies the voltage signal, and provides impedance matching. The preamplifier output signal is coupled by a cable to the IRM signal conditioning electronics (see Figure 7.6-5).

Each IRM channel receives its input signal from the preamplifier and operates on it with various combinations of preamplification gain and amplifier attenuation ratios. The amplification and attenuation ratios of the IRM and LSCS-UFSAR 7.6-18 REV. 13 preamplifier are selected by a remote range switch that provides ten ranges of increasing attenuation (the first six called low-range and the last four called high-range) acting on the signal from the fission chamber. As the neutron flux of the reactor core increases from 1 x 10 8 nv to 1.5 x 10 13 nv, the signal from the fission chamber is attenuated to keep the input signal to the

inverter in the same range. The output signal, which is proportional to neutron flux at the detector, is amplified and supplied to a locally mounted meter. Outputs are also provided for a remote meter and recorder.

d. Trip Functions The IRM is able to generate a trip signal that can be used to prevent fuel damage resulting from abnormal operational transients that occur while oper ating in the intermediate power range. The IRM is divided into two groups of IRM channels arranged in the core as shown in Figure 7.6-5. Four IRM channels are

associated with one of the two trip systems of the reactor protection system. Two IRM cha nnels and their trip auxiliaries from each group are installed in one bay of a cabinet; the remaining two channels are installed in a separate bay of the cabinet. Full-length side covers isolate the cabinet bays. Each IRM channel includes four trip circuits as standard equipment. One trip circuit is used as an instrument trouble trip. It operates on three conditions: (1) when the high voltage drops below a preset level, (2) when one of the modules is not plugged in, or (3) when the OPERATE- CALIBRATE switch is not in the OPERATE position. Each of the other trip circuits can be specified to trip when pr eset downscale or upscale levels are reached. The trip functions actuated by the IRM trips are indicated in Table 7.6-1. The reactor mode switch determines whether IRM trips are effective in initiating a rod block or a reactor scram. With the reactor mode switch in REFUEL or STARTUP, an IRM upscale or inoperative trip signal actuates a neutron monitoring system trip of the reactor protection system. Only one of the IRM channels must trip to initiate a neutron monitoring system trip of the associated trip sy stem of the reactor protection system. The IRM rod block trip functions are discussed in Subsection 7.7.2.2.3.

LSCS-UFSAR 7.6-19 REV. 14, APRIL 2002 The arrangement of IRM channels allows one IRM channel in each group to be bypassed without compromising intermed iate range neutron monitoring. Each IRM channel is tested and calibrate d using procedures which incorporate IRM vendor instruction manual recommendations, standard industry practices and LaSalle specific requirements. The IRM detector drive mechanisms and the IRM rod-blocking functions are checked in the same manner as for the SRM channels. Each IRM channel can be checked to ensure that the IRM high flux scram function is operable. Environmental Considerations The wiring, cables, and connectors located in the drywell are designed for continuous duty in the conditions described in Section 3.11. 7.6.3.2.3 Analysis 7.6.3.2.3.1 General Function al Requirement Conformance The analysis for the RPS trip inputs from the intermediate range monitor subsystem is discussed in Attachment 7. A under the reactor protection system. The IRM is the primary source of information as the reactor approaches the power range. Its linear steps (approximately a half decade) and the rod blocking features on both high flux level and low flux level require that all the IRM's are on the correct range as core reactivity is increased by rod withdrawal. The SRM overlaps the IRM. The sensitivity of the IRM is such that the IRM is on scale on the least sensitive (highest) range with approximately 15% reactor power. The number and locations of the IRM detectors have been analytically and experimentally determined to provide sufficient intermediate range flux level information under the worst permitted bypass or detector failure conditions. To verify this, a range of rod withdrawal acci dents has been analyzed. The most severe case assumes that the reactor is barely subcritical. One-fourth of the control rods plus one more rod have been removed in the normal operating sequence (Figure 7.6-8). The error or malfunction is removal of the control rod adjacent to the last rod withdrawn. This rod has been chosen to maximize the distance to the second nearest detector for each trip system. It is assumed that the nearest detector in each RPS trip system is bypass ed. A scram signal is initiated when one IRM detector in each RPS trip system reaches its scram trip level. The neutron flux versus distance resulting from this withdraw al is shown in Figure 7.6-9. Note that the second nearest detector in Trip System B is a different distance away than the second nearest detector in Trip System A. The ratio of the neutron flux at the farther point to the peak flux is 1/857. Th is detector reaches its high scram trip setting of 120/125% of full scale at a local flux of approximately 4.0 x 10 8 nv. At that time the peak flux in the core is 3.45 x 10 11 nv or .66% rated average flux. The core LSCS-UFSAR LU2000-164 7.6-20 REV. 14, APRIL 2002 average power is .050% when scram occurs. For this scram point to be valid the IRM must be on the correct range. To assure that each IRM is on the correct range, a rod block is initiated any time the IRM is both downscale and not on the most sensitive (lowest) scale. A rod block is initiated if the IRM detectors are not fully inserted in the core unless the reactor mode switch is in the RUN position. The IRM scram trips and the IRM rod block trips are automatically bypassed when the reactor mode switch is in the RUN position. The IRM detectors and electronics have been tested under operating conditions and verified to have the operational characteristics described. They provide the level of precision and reliability required by the RPS safety design basis. 7.6.3.2.3.2 Specific Requirement Conformance Attachment 7.A presents the IRM subs ystem conformance to IEEE criteria and other regulatory requirements. 7.6.3.2.3.3 Regulatory Guides This topic is covered in Appendix B. 7.6.3.2.3.4 10 CFR 50 Appendix A Criteria 13, 19, 20, 21, 22, 23, 24, and 29 The IRM detectors and associated electronics are designed to monitor the incore flux over all expected ranges required for the safety of the plant. Automatic initiation of protection system action, reliability, testability, independence, and separation have been fa ctored into the IRM design as required for protection systems. 7.6.3.3 Average Power Range Monitor Subsystem

7.6.3.3.1 Design Bases 7.6.3.3.1.1 Safety Design Bases Under the worst permitted input LPRM bypa ss conditions, the APRM is capable of generating a trip signal in response to average neutron flux increases in time to prevent fuel damage. The independence and redundancy incorporated into the design of the APRM are consistent with the safety design bases of the reactor protection system. The APRM is designed in accordance with the specific regulatory requirements listed in Table 7.1-2.

LSCS-UFSAR 7.6-21 REV. 13 7.6.3.3.1.2 Power Generation Design Bases The APRMS provides the following functions:

a. a continuous indication of average reactor power (neutron flux) from a few percent to 125% of rated reactor power, b. interlock signals for blocking further rod withdrawal to avoid an unnecessary scram actuation, c. a reference power level for the rod block monitor subsystem, d. a reference power level for controlling reactor recirculation system flow, and
e. a reactor thermal power signal derived from each APRM channel which approximates the dynamic effects of the fuel.

7.6.3.3.2 System Description

Equipment Design The APRM subsystem has six APRM ch annels. Each channel uses input signals from a number of LPRM channels. Three APRM channels are associated with each trip system of the reactor protection system.

a. Power Supply The APRM channels receive power from the 120-Vac supplies used for RPS power. Power for each APRM trip unit is supplied from the same power supply as the APRM it services. APRM Channels A, C, and E are powered from the a-c bus used for Trip System A of the reactor protection system; APRM Channels B, D and F are powered from the a-c bus used for Trip System B. The a-c bus used for a given APRM channel also supplies power to its associated LPRM's.
b. Signal Conditioning The APRM channel uses electronic equipment that averages the output signals from a selected set of LPRM's, trip units

that actuate automatic devices, and signal readout equipment. Each APRM channel can average the output signals from as many as 24 LPRM's. Assignment of LPRM's to an APRM follows the pattern shown in Figure 7.6-2. Position A is the bottom position, Positions B and C are above Position A, and Position D is the LSCS-UFSAR 7.6-22 REV. 18, APRIL 2010 topmost LPRM detector position. The pattern provides LPRM signals from all four core axial LPRM detector positions. The APRM amplifier gain can be adjusted by combining fixed resistors and potentiometers to allow calibration. The averaging circuit automatically corrects for the number of unbypassed LPRM amplifiers providing inputs to the APRM. Each APRM channel receives two independent, redundant flow signals representative of total recirculation driving flow. Each signal is provided by summing the flow signals from the two recirculation loops. These redund ant flow signals (Figure 7.6-2) are sensed from four pairs of elbow taps, two in each recirculation loop. No single ac tive component failure can cause more than one of these two redundant signals to read incorrectly. To obtain the proper (most conservative) reference signal under single-failure conditions, these flow signals are routed to a low-auction circuit. This circuit selects the lower of the two signals for use as the reference in the thermal power scram trip for that particular APRM. Because there are two redundant flow units assigned to each trip system, one flow unit in each trip system can be bypassed for a short time. This design meets the intent of IEEE 279-1971.

c. Trip Function The APRM channels receive input signals from the LPRM

channels and provide a continuous indication of average reactor power from as few percent to greater than rated reactor power. The APRM subsystem has sufficient redundant channels to meet industry and regulatory safety criteria. Under the worst permitted input LPRM bypass cond itions, the APRM subsystem is capable of generating a trip scram signal before the average neutron flux increases to the point that fuel damage is probable. The trip units for the APRM's supply trip signals to the RPS and the rod control management syst em. Table 7.6-2 itemizes the APRM trip functions. Any one APRM can initiate a rod block, depending on the position of the reactor mode switch. The APRM upscale rod block and the thermal power scram trip setpoints vary as a function of reactor recirculation driving loop flow. The APRM signal for the thermal power scram trip is passed through a 6-second time constant circuit to simulate thermal power. A faster response (approximately 0.09 seconds) APRM upscale trip has a fixed setpoint not variable with LSCS-UFSAR 7.6-23 REV. 13 recirculation flow. Any APRM upscale or inoperative trip initiates a neutron monitoring system trip in the RPS. Only the trip system associated with that APRM is affected. At least one APRM channel in each trip system of the RPS must trip to cause a scram. The operator can bypass the trips from one APRM in each trip system of the RPS. A simplified circuit arrangement is shown in Figure 7.6-6. In addition to the IRM upscale trip, a fast response APRM trip function with a setpoint of 15% power is active in the startup mode. APRM channels are calibrated using data from previous full power runs. They are tested by procedures which incorporate vendor instruction manual recommendations, standard industry practices and LaSalle specific requirements. Each APRM channel can be tested individually for the operability of the APRM scram and rod-blocking functions by introducing test signals. 7.6.3.3.3 Analysis 7.6.3.3.3.1 General Function al Requirement Conformance Each APRM derives its signal from LPRM information. The assignment, power separation, cabinet separation, and LPRM si gnal isolation are in accord with the safety design bases of the RPS. There are six APRM channels, three for each RPS trip system, to allow one undetected failure in each trip system and still satisfy the RPS safety design bases. Figure 7.6-10 illustrates the ability of the APRM to track core power versus coolant flow starting at 100% power and 100% flow to below the 65% flow point. Figure 7.6-11 illustrates the ability of the APRM to respond to control rod motion. The conditions for this are selected from the most restrictive case. The figure also shows a full withdrawal of a control rod from limiting conditions at rated power. Normal control rod manipulation results in good agreement (less than 6% deviation on the worst APRM) through a wide range of power levels. The flow-referenced APRM scram setpoint is adequate to prevent fuel damage during an abnormal operational transient, as demonstrated in Chapter 15.0.

7.6.3.3.3.2 Specific Requirement Conformance The portion of the APRM subsystem that provides outputs to the reactor protection system is designed to provide complete periodic testing of protection system actuation functions. This provision is accomplished by initiating an output trip of LSCS-UFSAR 7.6-24 REV. 17, APRIL 2008 one APRM channel at any given time which will result in tripping one of the two RPS trip systems. Operator indication of APRM bypass is provided by indicator lamps. Attachment 7.A pres ents the system conforma nce to IEEE criteria and other regulatory requirements. 7.6.3.3.3.3 Compliance with 10 CFR 50 Criteria 13, 19, 20, 21, 22, 23, 24, and 29 The APRM detection and associated electronics are designed to monitor the incore flux over all expected ranges required for the safety of the plant. Automatic initiation of protection system action, reliability, testability, independence, and separation have been factored into the APRM design as required for protection systems.

7.6.3.4 Oscillation Power Range Monitor Subsystem

The Oscillation Power Range Monitor (OPRM) subsystem is a microprocessor-based monitoring and protection system, which will:

  • detect a thermal-hydraulic instability,
  • provide an alarm on detection of an osc illation (based on period-based algorithm only), and
  • initiate an Automatic Suppression System (ASF) trip to suppress an oscillation prior to exceeding fuel safety limits.

The subsystem design, technical details, equipment qualification, and validation are

discussed in Reference 3. The NRC ha s accepted the above reference, and had issued a safety evaluation report (Reference 4). 7.6.3.4.1 Design Bases 7.6.3.4.1.1 Safety Design Bases

Boiling water reactor cores may exhibit thermal-hydraulic reactor instabilities in certain portions of the core power and flow operating domain. General Design Criterion 10 (GDC 10) requires that the reactor core be designed with appropriate margin to assure that acceptable fuel design limits will not be exceeded during any condition of normal operation including the effects of anticipated operational occurrences. GDC 12 requires assurance that power oscillations which can result in conditions exceeding specified acceptable fuel design limits are either not possible or can be reliably and readily detected and suppr essed. The OPRM is provided to meet the requirements of these GDCs by adding a detect and suppress feature to the Reactor Protection System. LSCS-UFSAR 7.6-25 REV. 17, APRIL 2008 7.6.3.4.1.2 Power Generation Design Bases The power generation design basis of OPRM consists of assuring that spurious scrams do not occur.

7.6.3.4.2 System Description Detailed description of OPRM subsystem design and physical arrangements are provided in the Generic Topical Report (R eference 3). Basic and station specific information is summarized here. The OPRM subsystem consists of 4 OPRM trip channels, each channel consisting of two OPRM modules. Each OPRM module receives input from individual LPRMs, which are combined into localized monitoring cells. It also receives input from the RPS average power range monitor (APRM) power and recirculation flow signals to automatically enable the trip function of the OPRM module. The OPRM interconnection diagram is shown in Figure 7.6-12. The OPRMs are capable of detecting thermal-hydraulic instabilities within the reactor core. Each OPRM includes a signal processing module, Automatic Suppression Function (ASF) Trip Relay Assembly, OPRM Annun ciator Relay Assembly, two Digital Isolation Blocks (DIBs), and an Enable/Bypass Selector Switch. The OPRM trip circuits may be bypassed if initiated by a selector switch. The bypass is accomplished through hardwired bypass of ASF trip relay contact by selector switch contact and through actuation of OPRM logic circuits and software. The bypass condition of the OPRM unit is annunciated in the MCR panel utilizing the selector switch contact. Also, the OPRMs may be manually enabled by the selector switch for any recirculation flow and reactor power levels.

a. Modes of Operation The OPRM has two modes of operation, oper ate and test. In the operate mode, it performs all of its normal trip and alarm functions as well as broadcasting status information to fiber optic output ports. The test mode is utilized for test, calibration, setpoint adjustment and downloading of the event buffer. In the test mode, the OPRM's trip output is bypassed an d the channel is considered inoperable.

Entry into the test mode is controlled by a key switch and is annunciated in the control room.

b. Event Buffer LSCS-UFSAR 7.6-26 REV. 13 When a trip occurs, data immediately prior to and following the tr ip is captured in an event buffer. This buffer may be downloaded to aid in the analysis of the trip.

The event buffer can also be captured and downloaded at any time for non-trip analysis by placing the OPRM in the test mode.

c. Maintenance Terminal A portable maintenance terminal is utilized for system testing, calibration and data collection. It is connected to the OPRM via fiber optic cables. This maintains isolation between the safety related OPRM and the non-safety related maintenance terminal.

With the OPRM in its operate mode, the maintenance terminal may only be used to collect data, which is broadcast by the OPRM at fixed intervals. Communications in this mode are one way, namely OPRM to maintenance terminal. The OPRM will not respond to commands from the main tenance terminal when in the operate mode. Thus, the maintenance terminal cannot affect OPRM operation. In the OPRM test mode, bi-directional, fiber optic communications are established between the OPRM and its maintenance terminal. In this mode, commands may be sent from the maintenance terminal to the OPRM to perform such actions as altering the OPRM configuration and setpoints, downloading event buffers and error logs and testing various OPRM functions. Additional, conventional test cables may be connected between the maintenance terminal and a test port on the OPRM for use in calibration and testing. To access this test port, a shorting plug must be removed from the OPRM. Removal of th e shorting plug causes the OPRM to become inoperable and is annunciated in the control room.

d. Power Supply Power supplies for the OPRMs are the same as those for the APRM channels. These power supplies provide required voltage sources +/- 15 Vdc and + 5 Vdc for OPRM signal processing modules and DIBs, +20 Vdc for ASF Trip Relay Assemblies, OPRM annunciator Relay Assemb lies and DIBs, and +/- 20 Vdc for new flow units and existing APRM and LPRM channels.
e. Physical Arrangement The OPRM signal processing modules are installed in APRM and LPRM Pages of a Power Range Neutron Monitoring System (PRNMS) Panel by removing one of the voltage regulators and installing in its loca tion the OPRM signal processing module. The power supply function of the removed voltage regulator will be taken over by the new voltage regulator with the increased load capacity that will replace one of the existing voltage regulators in the APRM and LPRM Pages. Selector switches required for manual enable and bypass functions will be installed in the PRNMS panel. Automatic Suppression Function (ASF) Trip Relay Assemblies, OPRM Annunciator Relay Assemblies and Digital Isol ation Blocks will be installed in the PRNMS panel.

LSCS-UFSAR 7.6-27 REV. 14, APRIL 2002

f. Exclusion Region The OPRM is required to be operable in order to detect and suppress neutron flux oscillations in the event of thermal-hydraulic instability. As described in Reference 3, the region of anticipated oscillation is defined by thermal power > 30% RTP and core flow < 60% of rated core flow (see Figu re 7.6-7). Therefore, the OPRM trip is enabled in this region. Reference 8 evaluated the effects of power uprate and maximum extended load line limit on the OPRM. The region of anticipated oscillation is modified for power uprate operation to maintain the pre-uprate absolute power and flow coordinates. However, to protect against anticipated transients, the OPRM is required to be operable with thermal power > 25% RTP. This provides sufficient margin to account for potential instabilities as a result of a loss of feedwater heater transient.
g. Algorithm Reference 3 describes three separate algorithms for detecting stability-related oscillations: the period detection algorithm, the amplitude-based algorithm, and the

growth rate algorithm. The OPRM System hardware implements these algorithms in a microprocessor-based module. The module executes the algorithms based on LPRM inputs and generates alarms and trip s based on these calculations. These trips result in tripping the Reactor Protection System (RPS) when appropriate RPS trip logic is satisfied. Only the period based detection algorithm is used in the safety analysis. The remaining algorithms provide defense in depth and additional protection against anticipated oscillations.

h. Trip Function The OPRMs are designed to provide an alar m (based on period-based algorithm only) and initiate, when armed, an automatic suppression function (ASF) trip to suppress oscillations prior to exceeding the MCPR sa fety limits. The OPRMs are auto enabled at the specified reactor recirculation flow and reactor power setpoints. The ASF initiates an ASF trip through the RPS based on the existing plant trip logic and configuration. The OPRMs provide alarm for pre-trip conditions and other alarm functions such as Trouble, INOP, and Trip Enabled to be displayed in the Main Control Room (MCR). Table 7.6-4 lists the OPRM trip functions and setpoints.
i. Alternate Backup Method At times when OPRM channels may be inoperable, and until they can be restored to operable status, an alternate method of detecting and suppressing thermal hydraulic instability oscillations can be used. This alternate method is described in References 6 & 7. It consists of increased operator awareness and monitori ng for neutron flux oscillations when operating in the region where oscillations are possible. If indications of oscillation, as described in References 6 & 7 are observed by the operator, the operator will take the acti ons described by the procedure, which may include initiating a manual scram of the reactor.

LSCS-UFSAR 7.6-28 REV. 13

j. Component Qualification Considerations The OPRM devices are designated Class 1E, Seismic Category I and are qualified to the applicable portions of IEEE-381 and IEEE-344.
k. Single Failure Considerations Since the OPRMs perform a protective function, they are required to withstand a single failure. To ensure acceptable de fense against single random failures, the combination of architecture, wiring practices, and use of isolation devices is applied to provide the required redundancy, isolation, and physical independence.

There are two redundant OPRM channels in each RPS division. OPRMs in each RPS division are electrically isolated and physically separated from OPRMs in other RPS divisions. Within each OPRM channe l there are two OPRM modules. The use of two OPRM modules per channel provides redundancy against an OPRM hardware failure in the same channel. The redundant OPRM modules in the same RPS division share the same Class 1E power supplies as those used by the safety-related APRM modules in that RPS division. However, each OPRM module is electrically isolated from the compani on module in the same channel.

l. Redundancy, Diversity, and Separation Since the OPRM operation interfaces with PRNMS and RPS, its redundancy, diversity, and separation requirements are the same as the requirements for these systems. The LPRM analog signals, which are locally wired, ar e provided to OPRMs with the same redundancy and separation as provided to the APRM channels and LPRM groups. One exception is that the analog signals from LPRM and related OPRM constitute OPRM channel G and H for the LPRM group A and B respectively. The OPRMs receiving LPRM analog signals associated with APRM channels constitute OPRM channels A through F. Thus, two OPRM channels fall into one RPS division for the RPS trip circuits providing the required redundancy between RPS divisions and between OPRM channels. The output digital signals are redundant and separated the same way as the actuation signals from APRM channels, with the exception that OPRM channels G and H replace channels E and F in order to eliminate the double up of channels E and F in the RPS divisions A2 and B2. The assignment of OPRM channels and existing APRM channels for each RPS division is as follows:

RPS Division OPRM Channel APRM Channel A1 A, E A, E A2 C, G C, E B1 B, F B, F B2 D, H D, F

LSCS-UFSAR 7.6-29 REV. 17, APRIL 2008 7.6.3.4.3 Analysis 7.6.3.4.3.1 Conformance to Functional Requirements The OPRM subsystem is designed to alarm when a stability-related thermal-hydraulic oscillation is detected (based on period-based algorithm only), and to initiate an ASF trip when oscillations are larg e enough to threaten fuel safety limits. The OPRM design assures high reliability as it is governed by Quality Assurance requirements, and applicable industry standards. The system performs self-health tests on a continuous basis. Reference 5 describes the licensing basis and methodology that demonstrates the adequacy of the hardware and software to meet the functional requirements. A brief summary of the design is provided in UFS AR subsections 4.4.4.6. 3 through 4.4.4.6.6. 7.6.3.4.3.2 Regulatory Guides Conformance to Regulatory Guides is discussed in Appendix B. 7.6.3.4.3.3 General Design Criteria The GDCs applicable to OPRM are 10 and 12. The OPRM subsystem is designed to conform to the applicable re quirements of these GDCs.

7.6.4 Recirculation

Pump Trip 7.6.4.1 System Description See Subsection G.5.1 of Appendix G. 7.6.4.2 Analysis 7.6.4.2.1 General Functional Requirements Conformance

The RPT system is designed to aid the RPS in protecting the integrity of the fuel barrier. Turbine stop valve closure or turbine control valve fast closure initiates a scram and recirculation pump trip in time to keep the core within the thermal-hydraulic safety limit during operational transients. Recirculation pump trip is a two-out-of-two logic system. Each of the logic channels is initiated by logic from the RPS system, which requires a two-out-of-two confirmation of the sensed variable. A trip of the sensed variable in any two divisions results in a trip initiate signal for all recirculation pumps. Failure or repair in a single RPS division does not violate single-failure criteria. Channel bypass switches are provided. The switches pr ovide a "tripped" input to LSCS-UFSAR 7.6-30 REV. 14, APRIL 2002 the recirculation pump trip logic. Sensors, channels, and logics of the RPT system are not used directly for automatic control or process systems. Therefore, failure in the control and instrumentation of process systems cannot induce failure of any portion of the system. Design of the system to safety class requirements and the redundance of Class 1E power supplies as breaker trip sources assures actuation of the pump trip function if required during design-basis earthquake ground motion. Operator verification that two-pump trip has occurred may be made by observing one or more of the following functions:

a. recirculation flow indicators on the MCB panel, b. breaker trip indicating lights on the MSB panel, c. two-pump trip initiation annunciator Division 1, and
d. two-pump trip initiation annunciator Division 2.

7.6.4.2.2 Specific Requirement Conformance

Refer to 7.A.5.3.1.

7.6.4.2.3 Regulatory Guides This subject is addressed in Appendix B.

7.6.5 Alternate

Rod Insertion (ARI) System Controls and Instrumentation The ARI system consists of transmitters, detection and actuation logic, and the necessary interfaces with the control ro d drive system to provide an alternate method for automatic initiation of a scram function. The safety-related components consist of the following:

a. Division 1 transmitters: - Reactor high dome pressure - Reactor water level below level 2 b. Division 2 transmitters: - Reactor high dome pressure - Reactor water level below level 2 c. Manual initiation division 1 switches d. Manual initiation division 2 switches
e. Four trip logic units per division (2 Pressure/2 Low Water Level) f. Ten dual coil solenoid valves plus associated logic circuitry. g. Division 1: - SDV vent valve position indicator - SDV drain valve position indicator LSCS-UFSAR 7.6-31 REV. 13 - Instrument air inlet valve position indicator - North bank HCU instrument air valve position indicator - South bank HCU instrument air valve position indicator h. Division 2: - SDV vent valve position indicator - SDV drain valve position indicator

- Instrument air inlet valve position indicator - North bank HCU instrument air valve position indicator - South bank HCU instrument air valve position indicator The instrumentation and controls associ ated with the ARI system perform the following functions:

a. Sense reactor vessel high pressure b. Sense reactor vessel low water level c. Initiate logic to actuate solenoid valves d. Shutoff air supply to pilot air header e. Vent Scram valve pilot air header f. Vent air header to scram discharge volume vent and drain valves. The equipment used in the ARI system is independent and diverse from the RPS equipment.

ARI system equipment is qualif ied to assure that it w ill, on a continuing basis, function during and after an ATWS event. The ARI system equipment is qualified to safe shutdown earthquake conditions The system provides the operator with information regarding system readiness, functional controls, and inoperative status. The ARI instrumentation specification and setpoints are given in Table 7.6-3. 7.6.5.1 Safety Design Bases The ARI system is designed to meet the following requirements:

1. ARI shall be redundant and diverse from the normal scram systems, except for the air supply system.
2. ARI shall be initiated by reacto r vessel low water level and/or high reactor vessel pressure signals for automatic initiation or by manual initiation.
3. The ARI shall use separate soleno id operated valves, energized to open. The valves shall be sized to allow insertion of all control rods to begin with a maximum time delay of 35 seconds. This delay shall be the time interval from receipt of the system initiation until all control rods have started insertion.

LSCS-UFSAR 7.6-32 REV. 13

4. All ARI solenoid valves shall be capable of providing open/closed position indication.
5. The control rod drives must be functional to provide reactor scram when ARI is required. For the ARI function, the maximum time between receipt of the initiation si gnal and the time when all control rods have started inserting shall be 35 seconds. The maximum time delay between receipt of the initiation signal and the time when all control rods reach their full-in position shall be 45 seconds.
6. The main operator control console benchboard display of the control rod positions shall be powered from uninterruptible power sources.

These power sources shall provide power to enable the display to remain functional for at least one ho ur after the ARI initiation even if loss of normal power has occurred.

7. The ARI system shall respond corre ctly to the sensed variables over the expected range of magnit udes and rates of change.
8. A sufficient number of sensors shall be provided for monitoring essential variables that have spatial dependence.
9. The following bases assure that the ARI system is designed with sufficient reliability:
a. Loss of a divisional power su pply shall neither cause nor prevent a reactor scram from the ARI system.
b. Once initiated, an ARI system action shall go to completion. Reset is prohibited for at least 2 minutes after initiation. After the 2 minutes have elapsed, 4 of the 10 ARI scram exhaust valves will automatically reset (north and south side HCU vents). The remaining 6 valves (ARI vents at the backup scram valves, SDV vents, and SDV drains) will close when the operator manually resets the Division I and Division II ARI logic.
c. There shall be sufficient electrical and physical separation between redundant instrumentation and control equipment monitoring the same variable to prevent environmental factors, electrical transients, or physical events from impairing the ability of the system to respond correctly.
d. Expected earthquake ground motions (operating basis earthquake - OBE) as amplified by buildings and supporting LSCS-UFSAR 7.6-33 REV. 13 structures shall not impair th e ability of the ARI system to initiate a reactor scram.
e. No single failure within the ARI system shall prevent proper ARI system action.
f. No single intentional bypass, maintenance operation, calibration operation, or test to verify operational availability shall impair the ability of the ARI system to respond correctly.
g. The system shall be designed so that the required number of sensors for any monitored variable exceeding the setpoint will initiate an ARI.

The following bases reduce the pr obability that ARI system operational reliability and precision will be degraded by operator error:

1. Access to trip settings, component calibration controls, test points, and other terminal points shall be under the control of plant operations supervisory personnel.
2. Manual bypass of instrumentation and control equipment components shall be under the control of the control room operator. If the ability to trip some essential part of the system has been bypassed, this fact shall be continuously annunciated in the control room.

7.6.5.2 Equipment Design The ARI system is redundant and diverse from the Reactor Protection System (RPS), such that no credible common mode failure can prevent both normal scram and ATWS prevention or mitigation function

s. Diversity from RPS is achieved by meeting the following criteria: (a) use of components from different manufacturers, (b) use of energized trip status, (c) use of direct current power sources, and (d) use of transmitters employing different principles for measuring the reactor pressure and reactor water level parameters. The ARI sy stem is designed so that no single component failure can prevent th e specified system function.

The ARI system will be initiated by re actor pressure vessel (RPV) high dome pressure and/or RPV level 2 low-water level. The initiation sensors are level and pressure transmitters in the nuclear boiler system. The transmitter signals actuate trip logic when the setpoints are exceeded (See Table 7-6.3). Upon receipt of an ARI initiation signal, fi ve air-operated solenoid valves in each division operate to insert the control rods.

LSCS-UFSAR 7.6-34 REV. 13 There are four separate trip units for each di vision of valve actuat ors. The trip logic uses RPV high pressure and/or RPV low-water level to originate a trip signal in a 1:2:2 configuration. The ARI uses separate dual-coil solenoid op erated valves, energized to open. The valves are sized to allow insertion of all control rods to begin within 35 seconds and to be completed within 45 seconds of receipt of initiation signal. ARI System Valves - The solenoid valves employ direct current dual coil operators. The valves are provided with position switches to indicate valve open/close status. The valves perform three functions during an ATWS trip:

1. Block the instrument air supply line to the pilot scram valves.
2. Exhaust the air from the pilot scram air header to 5 psig in 15 seconds.
3. Exhaust air header to the scram discharge volume vent and drain valves, thus permitting these valves to close.

7.6.5.3 Theory of Operation The ARI system senses, processes and provid es trip signals to prevent an ATWS event by exhausting the scram discharg e air header through ARI scram valves entirely separate from the reactor protection system scram discharge valves. This provides an alternate means of initiating control rod insertion. The automatic and manual actuation signals to the ARI scram valves shall seal-in for 2 minutes to assure that all control rods have time to fully insert. Reset of the ARI function is automatic for valves C11-F404A, B, F405A, B and manual for valves C11-F400, 401, F402A, B, F403A, B. Re set is prohibited for 2 minutes after initiation. Manual ARI Actuation - The ARI system can be manually initiated from a location in the control room near the RPS manual scram switches. The ma nual initiation of ARI is designed such that no single oper ator action can result in inadvertent initiation. The manual ARI initiation functi on is distinct and separate from the manual RPS scram initiation functions. Different types of display and pushbutton equipment is utilized to distinguis h ARI equipment for ATWS purposes. 7.6.5.4 ARI System Op erator Information

The ARI system is designed to provide th e operator with the reactor level and pressure values, trip status, valve position, test status, inoperative, failure and maintenance status. ARI system unique annunciators are provided on the main operator console in the control room for each ARI channel to indicate that the ARI system has been initiated. LSCS-UFSAR 7.6-35 REV. 13 Indicators are provided for input trip signals to ARI and output protective action signals from the ARI logic. Abnormal status indication is provided for those functions/components associated with the AT WS mitigation signals. These include the four steam dome pressure transmitters and associated trip units, the four vessel level transmitters and associated trip units and the manual ARI initiation circuitry. An indicating light lights up when the ARI lo gic is initiated. A different indicating light is used to indicate to the operator that manual reset of the ARI control logic is permissive. This light remains on until the operator resets the control logic manually. An alarm also annunciates in the control room to alert the operator that the ARI control logic has been initiated. Open/closed position indication for monitoring all ARI scram valves is also provided. Test sw itches and indicating lights are provided for periodic testing of ARI initiation control logic without opening the solenoid valves. 7.6.5.5 Power Supply

The ARI system has one power generation ob jective. The setpoints, power sources, and controls and instrumentation are arranged in such a manner as to preclude spurious ARI scrams. Two separate divisions of ARI logic, sensors and control valve solenoids are powered by 125 Vdc Class 1E Division 1 and Divisi on 2 power sources. The power supplies for the ARI system equipment are uninterruptible, separate, and independent from

the RPS power supplies. The two 125 Vd c power divisions are separate and independent of each other. 7.6.5.6 Cabling and Wiring Cabling and wiring for the ARI redundant divisions follow the separation criteria specified in IEEE 384-1977, Standard Criteria.

7.6.5.7 Testability The proper operation of the transmitters and the logic associated with the ARI system can be verified during system preo perational testing. Auto initiation and the required system time responses are testable with the reactor at rated temperature and pressure during startup. All individual ARI scram solenoid valves and solenoid logic circuits have built-in test capability for individual solenoid integrity testing. The ARI system has two redundant control logics, one in division 1 and one in division 2. Either one can perform a re actor scram function. Division 1 and 2 LSCS-UFSAR 7.6-36 REV. 13 solenoid valves are controlled by division 1 and division 2 control logic, respectively. A test switch is provided for each division. When the test switch is in the test position, the control logic is set in the test mode and an annunciator in the control room alerts the operator of the test status of that divisional control logic. When division 1 logic is in the test mode, division 2 valves remain responsive to the reactor vessel low water level signals and the high reactor vessel pressure signals to

provide uninterrupted ATWS mitigation capability. The ARI test logic annunciator does not clear until the test switch is returned to the normal position. 7.6.5.8 Redundancy and Diversity The ARI is activated automatically by reac tor vessel low water level and/or high reactor vessel pressure signals when they reach a predetermined level. There are four separate trip channels for each divi sional control logic. The trip logic is initiated by RPV high pressure and/or RPV low water level in a 1:2:2 configuration to actuate the ARI solenoid valves. Ther e are two divisional power supplies which are independent of each other to power the ARI control logic. Sensor and power cables are routed to two ARI control cabinets in the auxiliary electrical equipment room. The cables and control cabinet of one division are physically separated and independent of those of the other division. Each cabinet houses both of the trip

channels for one division. 7.6.5.9 Environmental Considerations The ARI equipment is located outside the prim ary containment and it is selected in consideration of the normal and abnormal/transient environments in which it must operate.

7.6.6 References

1. W. R. Morgan, "In-Core Neutron Monitoring System for General Electric Boiling Water Reactors", APED-5706, November 1968 (Rev.

April 1969).

2. Hatch Amendment 7, pp. 7-3.0-1 and 7-5.0-1, June 24, 1969.
3. Licensing Topical Report CEND-400-P, Rev. 01, "Generic Topical Report for the ABB Option III Os cillation Power Range Monitor (OPRM)", prepared for the BWR Owners Group by ABB Combustion Engineering, May 1995.
4. U.S. Nuclear Regulatory Commission Safety Evaluation Report, "Acceptance of Licensing Topical Report CEND-400-P", transmitted from B.A. Boger to R.A. Pinelli of GPU Nuclear, August 16, 1995.

LSCS-UFSAR 7.6-37 REV. 17, APRIL 2008

5. NEDO-32465-A, "BWR Owners Group Re actor Stability Detect and Suppress Solution Licensing Basis Methodology and Reload Application," August 1996.
6. BWROG Letter BWROG-9479, "Guidelines for Stability Interim Corrective Action", June 6, 1994.
7. ComEd Letter from John C. Brons to William T. Russell, "Response to Generic Letter 94-02 (BWR Stab ility)", September 9, 1994.
8. LaSalle County Station Power Upra te Project, Task 202, "Thermal-Hydraulic Stability," GE-NE-A1300384-13-01, Revision 0, August 1999.

LSCS-UFSAR TABLE 7.6-1 IRM TRIPS** TABLE 7.6-1 REV. 15, APRIL 2004 TRIP FUNCTION NORMAL SETPOINT TRIP ACTION IRM upscale (high-high) or IRM inoperative***

  • Scram, annunciator, red light display IRM upscale (high)## # Scram, annunciator, amber light displayIRM downscale## # Rod block (exception on most sensitive scale), annunciator, white light display IRM bypassed White light display
  • IRM is inoperative if module interlock chain is broken, operate-calibrate switch is not in operate position, or detector polarizing voltage is below 80 volts. ** Accuracy 2%; Calibration 0.5%; Design-Basis Allowable 2% # For Normal Setpoint, see the applicable calculation. *** See UFSAR Table 7.2-1 for more information on IRM upscale (high-high).
    1. See UFSAR Table 7.3-5 for more information.

LSCS-UFSAR TABLE 7.6-2 TABLE 7.6-2 REV. 15, APRIL 2004 APRM SYSTEM TRIPS TRIP FUNCTION TRIP POINT RANGE NOMINAL SETPOINT ALLOWABLE VALUE ACTION APRM downscale Note # Note ** Note # Rod block, annunciator white light display APRM upscale (high) Note # Note ** Note # Rod block, annunciator amber light display APRM upscale (thermal power) Note # # Note ** Note # # Scram, annunciator, red light display APRM upscale (high-high) Note # # Note ** Note # # Scram, annunciator, red light display APRM inoperative Calibrate switch or too few inputs Not in operate mode or module interlock chain broken or less than 14 N/A Scram, rod block, annunciator, red light display APRM bypass Manual switch N/A N/A White light

__________________

  • APRM signal passes through a 6-second time constant circuit to simulate heat flux. ** For Nominal Setpoint, see the applicable calculation.
  1. See UFSAR Table 7.3-5 for more information.
  2. # See UFSAR Table 7.2-1 for more information.

LSCS-UFSAR TABLE 7.6-3 TABLE 7.6-3 REV. 16, APRIL 2006 ALTERNATE ROD INSERTION (ARI) / ANTICIPATED TRANSIENT WITHOUT SCRAM RECIRUCLATION PUMP TRIP SYSTEM INSTRUMENTATION SPECIFICATIONS & SETPOINTS

SCRAM FUNCTION INSTRUMENT TRIP SETTING ALLOWABLE VALUE ANALYTIC OR DESIGN BASIS LIMIT ACCURACY CALIBRATION DESIGN BASIS ALLOWANCE DEVICE RANGE REACTOR DOME HIGH PRESSURE Pressure Transmitter Note 1 Note 2 Note 1 Note 1 Note 1 Note 1 800-1300 psi RPV LOW LOW WATER LEVEL (LEVEL TWO) Differential Pressure Transmitter Note 1 Note 2 Note 1 Note 1 Note 1 Note 1 -150 to +60 inches

Note 1: See applicable calculation listed in Table T3.3.4.2 - 1 of Technical Requirements Manual, Appendix D. Note 2: See Technical Specification for Allowable Value.

  • Accuracy Range is the full scale calibrated Range for each transmitter.

LSCS-UFSAR TABLE 7.6-4 TABLE 7.6-4 REV. 17, APRIL 2008 OPRM SYSTEM TRIPS TRIP FUNCTION TRIP SETPOINT CONFIRMATION COUNT SETPOINT ACTION OPRM Alarm N/A

  • Annunciator OPRM Trip *** *** Annunciator, Automatic suppression function (ASF) trip signal to RPS OPRM Bypass Selector switch contact N/A Annunciator OPRM Inoperative/ Trouble OPRM annunciator relays N/A Annunciator System Enable Setpoints are based on the analytical limits: 28.6% thermal power

< 60% core flow N/A Annunciator

  • Can be varied to meet operating needs. *** Refer to cycle specific values in the Core Operating Limits Reports for Units 1 and 2.

LSCS-UFSAR TABLE 7.7-1 (SHEET 1 OF 2) TABLE 7.7-1 REV. 18, APRIL 2010 Deleted LSCS-UFSAR TABLE 7.7-1 (SHEET 2 OF 2) TABLE 7.7-1 REV. 18, APRIL 2010 Deleted LSCS-UFSAR TABLE 7.7-2 TABLE 7.7-2 REV. 0 - APRIL 1984 GASEOUS RADWASTE PROCESS INSTRUMENTS PARAMETER MAIN CONTROL ROOM ALARM ALARM INDICATED RECORDED HIGH LOW SJAE intercondenser pressure --- X X X Second stage SJAE flow --- X X X Preheater inlet pressure X --- --- --- Recombiner inlet temperature X --- --- X Recombiner temperatures --- X X X Recombiner outlet hydrogen --- X X --- Off-gas condenser level --- --- X X Off-gas condenser outlet temperature --- --- X --- Prefilter differential pressure X --- X --- Off-gas reheater inlet temperature --- X X X Off-gas reheater outlet temperature X --- --- --- Charcoal bed inlet moisture --- X X --- Charcoal bed temperature --- X X --- Charcoal bed differential pressure X --- X --- Afterfilter differential pressure X --- X --- Off gas system flow --- X X X

LSCS-UFSAR TABLE 7.7-3 (SHEET 1 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEND 2 RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-l-1 STAT NO. 1 STANDBY GAS 1.00 TO 10000 5.0 25.0 -- ARM-1-2 STAT NO. 2 RWCU PHASE SEP. 1.00 TO 10000 5.0 25.0 -- ARM-1-3 STAT NO. 3 RX BLDG SAMPLE SINK 0.10 TO 1000 5.0 25.0 Local indicator and alarm ARM-1-4 STAT NO. 4 CONTAINMENT PURGE 1.00 TO 10000 5.0 25.0 -- ARM-1-5 STAT NO. 5 NORTH HCU MODULES 0.10 TO 1000 0.5 2.5 -- ARM-1-6 STAT NO. 6 SOUTH HCU MODULES 0.10 TO 1000 0.5 2.5 -- ARM-1-7 STAT NO. 7 OFF-GAS EQUIP. AND SAMPLE 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-1-8 STAT NO. 8 TIP ROOM 1.00 TO 10000 10-100 100.0 Local indicator and alarm ARM-l-9 STAT NO. 9 RX BLDG MEZZ- ANINE FLOOR 0.10 TO 1000 1.0 5.0 -- ARM-1-10 STAT NO. 10 CRD STORAGE AND REPAIR 0.10 TO 1000 2.0 10.0 -- ARM-l-11 STAT NO. 11 NW RHR HX 1.00 TO 10000 60 100.0 -- ARM-1-12 STAT NO. 12 SE RHR HX 1.00 TO 10000 60 100.0 -- ARM-1-13 STAT NO. 13 TURBINE BLDG SAMPLE SINK 0.10 TO 1000 0.5 2.5 Local indicator and alarm LSCS-UFSAR TABLE 7.7-3 (SHEET 2 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEND 2 RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-l-14 STAT NO. 14 COND.DEMIN REGEN VALVE AISLE 100 TO 10000 10-100 100.0 -- ARM-1-15 STAT NO. 15 URC VALVE AISLE 1.00 TO 10000 10-100 100.0 -- ARM-1-16 STAT NO. 16 RCIC TURBINE 1.00 TO 10000 5-30 30.0 Local indicator and alarm ARM-1-17 STAT NO. 17 HPCS PUMP 0.10 TO 1000 0.5 2.5 -- ARM-1-18 STAT NO. 18 COND. BOOSTER PUMPS 0.10 TO 1000 0.5 2.5 -- ARM-1-19 STAT NO. 19 AUX EQUIP ROOM 0.10 TO 1000 0.5 2.5 -- ARM-1-20 STAT NO. 20 SPARE ---- --- --- --- ARM-1-21 STAT NO. 21 SPARE ---- --- --- --- ARM-l-22 STAT NO. 22 SPARE CHANNEL --- --- --- -- ARM-1-23 STAT NO. 23 SPARE CHANNEL --- --- --- -- ARM-l-24 STAT NO. 24 SPARE --- --- --- -- ARM-1-25 STAT NO. 25 SPARE --- --- --- --

LSCS-UFSAR TABLE 7.7-3 (SHEET 3 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEND 2 RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-l-26 STAT NO. 26 SPARE --- --- --- -- ARM-1-27 STAT NO. 27 SPARE --- --- --- -- ARM-1-28 STAT NO. 28 SPARE --- --- --- --- ARM-1-29 STAT NO. 29 SPARE --- --- --- -- ARM-1-30 STAT NO. 30 SPARE --- --- --- -- ARM-2-1. STAT NO 1 STANDBY GAS 1.00 TO 10000 5.0 25.0 --- ARM-2-2 STAT NO 2 RWCU PHASE SEP 1.00 TO 10000 5.0 25.0 --- ARM-2-3 STAT NO 3 RX BLDG SAMPLE SINK 0.10 TO 1000 5.0 25.0 Local indicator and alarm ARM-2-4 STAT NO 4 CONTAINMENT PURGE 1.00 TO 10000 5.0 25.0 --- ARM-2-5 STAT NO. 5 NORTH HCU MODULES 0.10 TO 1000 0.5 2.5 --- ARM-2-6 STAT NO. 6 SOUTH HCU MODULES 0.10 TO 1000 0.5 2.5 ---

LSCS-UFSAR TABLE 7.7-3 (SHEET 4 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEND RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-2-7 STAT NO. 7 OFF-GAS EQUIP AND SAMPLE 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-2-8 STAT NO. 8 TIP ROOM 1.00 TO 10000 10-100 100.0 Local indicator and alarm ARM-2-9 STAT NO. 9 RX BLDG MEZZ- ANINE FLOOR 0.10 TO 1000 1.0 5.0 -- ARM-2-10 STAT NO. 10 CRD STORAGE AND REPAIR 0.10 TO 1000 2.0 10.0 -- ARM-2-11 STAT NO. 11 NW RHR HX 1.00 TO 10000 60.0 100.0 -- ARM-2-12 STAT NO. 12 SE RHR HX 1.00 TO 10000 60.0 100.0 -- ARM-2-13 STAT NO. 13 TURBINE BLDG SAMPLE SINK 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-2-14 STAT NO. 14 COND DEMIN REGEN VALVE AISLE 1.00 TO 10000 10-100 100.0 -- ARM-2-15 STAT NO. 15 SPARE -- -- -- -- ARM-2-16 STAT NO. 16 RCIC TURBINE 1.00 TO 10000 5-30 30.0 Local indicator and alarm ARM-2-17 STAT NO. 17 HPCS PUMP 0.10 TO 1000 0.5 2.5 -- ARM-2-18 STAT NO. 18 COND BOOSTER PUMP 0.10 TO 1000 0.5 2.5 --

LSCS-UFSAR TABLE 7.7-3 (SHEET 5 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEND 2 RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-2-19 STAT NO. 19 AUX EQUIP ROOM 0.10 TO 1000 0.5 2.5 - ARM-2-20 STAT NO. 20 SPARE - - - - ARM-2-21 STAT NO. 21 SPARE - - - - ARM-2-22 STAT NO. 22 SPARE - - - - ARM-2-23 STAT NO. 23 SPARE - - - - ARM-2-24 STAT NO. 24 SPARE - - - - ARM-2-25 STAT NO. 25 SPARE - - - - ARM-2-26 STAT NO. 26 SPARE - - - - ARM-2-27 STAT NO. 27 SPARE - - - - ARM-2-28 STAT NO. 28 SPARE - - - - ARM-2-29 STAT NO. 29 SPARE - - - - ARM-2-30 STAT NO. 30 SPARE - - - -

LSCS-UFSAR TABLE 7.7-3 (SHEET 6 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEND RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-3-1 STAT NO. 31 REFUEL FLR HIGH RANGE 0.100 TO 10 6 1.0 1000 Local indicator and alarm ARM-3-2 STAT NO. 32 REFUEL FLR LOW RANGE 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-3-3 STAT NO. 33 NEW FUEL STORAGE VAULT 0.10 TO 1000 8.0 25.0 - ARM-3-4 STAT NO. 34 REFUEL FLR EQUIP HATCH 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-3-5 STAT NO. 35 VENT STACK SAMPLE 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-3-6 STAT NO. 36 MAIN CONTROL ROOM 0.10 TO 100 0.5 2.5 - ARM-3-7 STAT NO. 37 HP TURBINE 0.10 TO 1000 0.5 2.5 - ARM-3-8 STAT NO. 38 TURBINE BLDG DECON PIT 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-3-9 STAT NO. 39 RX BLDG TRACKWAY 0.10 TO 1000 0.5 2.5 - ARM-3-10 STAT NO.40 HOT LAB CORRIDOR 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-3-11 STAT NO. 41 TURBINE BLDG BSMT ELEVATOR 0.10 TO 1000 0.5 2.5 - ARM-3-12 STAT NO. 42 O.G. HVAC EXHAUST AREA 0.10 TO 1000 0.5 2.5 -

LSCS-UFSAR TABLE 7.7-3 (SHEET 7 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEN D RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-3-13 STAT NO. 43 O.G. UPPER BSMT 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-3-14 STAT NO. 44 O. G. CHAR. ADS. VALVE AISLE 1.00 TO 10000 5.0 30.0 Local indicator and alarm ARM-3-15 STAT NO. 45 SERVICE BLDG OFFICE CORRIDOR 0.01 TO 100 0.5 2.5 - ARM-3-16 STAT NO. 46 LAUNDRY 0.10 TO 1000 0.5 2.5 - ARM-3-17 STAT NO. 47 MACHINE SHOP 0.10 TO 1000 0.5 2.5 Local indicator and alarm ARM-3-18 STAT NO. 48 SERVICE BLDG LUNCH ROOM CORRIDOR 0.01 TO 100 0.5 2.5 - ARM-3-19 STAT NO. 49 SPARE - - - - ARM-3-20 STAT NO.50 SPARE - - - - ARM-4-1 STAT NO. 1 CONC WASTE TANKS 0.1 TO 1000 60.0 100.0 - ARM-4-2 STAT NO. 2 UNIT 1 FL. DR. CONC. PUMP & VALVE ROOM 0.1 TO 1000 60.0 100.0 -

LSCS-UFSAR TABLE 7.7-3 (SHEET 8 OF 8) TABLE 7.7-3 REV. 0 - APRIL 1984 AREA RADIATION MONITORS CHANNEL 1 IDENTIFICATION ARM NAMEPLATE LEGEND 2 RANGE (mR/hr) ZONE (mR/hr) SETPOINT 3 (mR/hr) OTHER 4 ARM-4-3 STAT NO. 3 UNIT 2 FL. DR. CONC. PUMP & VALVE ROOM 0.1 TO 1000 60.0 100.0 - ARM-4-4 STAT NO. 4 CHEM WST. CONC. PUMP & VALVE RM 0.1 TO 1000 60.0 100.0 - ARM-4-5 STAT NO. 5 RADWASTE CONTROL ROOM 0.01 TO 100 0.5 2.5 - ARM-4-6 STAT NO. 6 DRUM LABELING STA. 0.1 TO 1000 0.5 2.5 - ARM-4-7 STAT NO. 7 RADWASTE COMPACTOR 0.1 TO 1000 0.5 2.5 - ARM-4-8 STAT NO. 8 N. HIGH LEVEL DRUM STORAGE 1.0 TO 10000 60.0 100.0 - ARM-4-9 STAT NO. 9 S. HIGH LEVEL DRUM STORAGE 1.0 TO 10000 60.0 100.0 - ARM-4-10 STAT NO.10 SERVICE BLDG TECH SUPPORT CENTER 0.1 TO 1000 0.5 2.5 - ________________________________________________________________________________________________ 1. Channel Identification code: ARM numbers and station (STAT) numbers are those specified in radiation zone maps. 2. The actual ARM nameplate legend contains, or implies, in somewhat abbreviated form, the ARM location by building and area.

3. These are tentative. Actual setpoints will be changed in accordance with the station setpoint change procedure as determined by the rad chem department.
4. Dash entry in this column means "no special provisions on this monitor." All have recorders.

LSCS-UFSAR TABLE 7.7-4 TABLE 7.7-4 REV. 14, APRIL 2002 SRM SYSTEM TRIPS TRIP FUNCTION NORMAL SETPOINT TRIP ACTION

SRM upscale (high) or *,*** Rod bloc k, amber light display, annunciator SRM instrument inoperative ** Rod bl ock, amber light display, annunciator Detector Retraction Permissive (SRM downscale)

  • Bypass detector full-in limit switch when above preset limit, annunciator, green light display, rod block when below preset limit with IRM range

switches on first two ranges SRM period 50 sec Annunciator, amber light display SRM downscale *,*** Rod block, annunc iator, white light display SRM bypassed White light display

________________________

  • For Normal Setpoint, Accuracy, Calib ration, and Design Allowable Basis inform ation, see the applicable calculation.
** SRM is inoperative if module interlock chain is broken. Operate-calibrate switch is not in operate position or detector polarizing voltage is below 300 volts.
      • See UFSAR Table 7.3-5 for more information.

LSCS-UFSAR TABLE 7.7-5 TABLE 7.7-5 REV. 0 - APRIL 1984 LPRM SYSTEM TRIPS TRIP FUNCTION TRIP RANGE TRIP SETPOINT TRIP ACTION LPRM downscale 2% to full scale 3% White light and annunciator LPRM upscale 2% to full scale 100% Amber light and annunciator LPRM bypass Manual switch White light and APRM averaging compensation

LSCS-UFSAR TABLE 7.7-6 TABLE 7.7-6 REV 14 - APRIL 2002 RBM SYSTEM TRIPS TRIP FUNCTION NOMINAL SETPOINTALLOWABLE TRIP ACTION

RBM upscale (high) Note* Note*** Rod block, annunciator, amber light display RBM inoperative 1* N/A Rod block, annunciator, amber light display RBM downscale Note* Note*** Rod block, annunciator, amber light display RBM bypassed Manual switch or Peripheral rod selected or APRM reference below 30% N/A White light display

  • For Nominal Setpoint, see the applicable calculation. ** RBM is inoperative if module interlock chain is broken, OPERATE-CALIBRATE switch is not in OPERATE position, less than 50% of available LPRM signals are above 3% threshold, or internal logic self-test circuits indicate trouble. *** See UFSAR Table 7.3-5 for more information.

LSCS-UFSAR TABLE 7.7-7 TABLE 7.7-7 REV. 19 - APRIL 2012 REFUELING INTERLOCK EFFECTIVENESS SITUATION REFUELING PLATFORM POSITION REFUELING TMH

  • PLATFORM FMH
  • HOISTS FG
  • SERVICE PLATFORMHOISTS CONTROL RODS MODE SWITCH ATTEMPT RESULT
1. Not near core UL* UL* UL* UL* All rods in Refuel Move refueling platform over core No restrictions 2. Not near core UL UL UL UL A11 rods in Refuel Withdraw rods Cannot withdraw more than one rod 3. Not near core UL UL UL UL One rod withdrawn Refuel Move refueling platform over core No restrictions 4. Not near core Any hoist loaded UL One rod withdrawn Refuel Move refueling platform over core Platform stopped before over core 5. Over core UL UL UL UL All rods in Refuel Withdraw rods Cannot withdraw more than one rod 6. Over core Any hoist loaded All rods in Refuel Withdraw rods Rod block 7. Not near core UL UL UL L* All rods in Refuel Withdraw rods Rod block 8. Deleted 9. Deleted 10. Not near core UL UL UL UL All rods in Startup Move refueling platform over core Platform stopped before over core 11. Not near core UL UL UL L A11 rods in Startup Operate service platform hoist No restrictions 12. Not near core UL UL UL L One rod withdrawn Startup Operate service platform hoist Hoist operation prevented 13. Not near core UL UL UL L All rods in Startup Withdraw rods Rod block 14. Not near core UL UL UL UL All rods in Startup Withdraw rods No restrictions 15. Over core UL UL UL UL All rods in Startup Withdraw rods Rod block 16. Any Any condition Any condition Any condition, reactor not at power Startup Turn mode switch to run Scram 17. Over core Any hoist loaded One rod withdrawn Refuel Operate hoist Hoist operation prevented

LSCS-UFSAR TABLE 7.7-8 TABLE 7.7-8 REV. 0 - APRIL 1984 PROCESS RADIATION MONITORING SYSTEMS CHARACTERISTICS MONITORING SUBSYSTEM INSTRUMENT

  • INSTRUMENT SCALE (Decade Log)

TRIPS PER UPSCALE CHANNEL DOWNSCALE Air ejector off-gas (pretreat) 

(posttreat) 1 to 10 6 mR/h  10 to 10 6 counts/min 6

5 1 3 1 1 Station vent stack 10-7 to 10 5 µCi/cc 5 2 1 Process liquid 10 to 10 6 counts/min

    • 5 1 1 Carbon bed vault 1.0 to 10 6 mR/h 6 1 1
  • Range of measurements depends on items such as source geom etry, background radiation, shielding, energy levels, and method of sampling.
** Readout depends on the pulse height discriminator setting

LSCS-UFSAR TABLE 7.7-9 TABLE 7.7-9 REV. 18, APRIL 2010 MATRIX OF NON-SAFETY CONTROL SYSTEMS AFFECTED BY HELB EVENTS HELB EVENTS NON-SAFETY CONTROL SYSTEMS LOCA MSLB FWLB INSTRUMENTLINE BREAK

Reactor Vessel Instrumentation

and Controls X Rod Control Management System X Recirculation Flow Control System X Feedwater Control System X X Pressure Regulator and Turbine

Generator Controls X X Neutron Monitoring Systems (Non-Safety Portion) Process Computer System Reactor Water Cleanup System Area Radiation Monitoring System X X Gaseous Radwaste Control System Liquid Radwaste Control System Spent Fuel Pool Cooling and Cleanup System Refueling Interlocks System Process Radiation Monitoring System X X Leak Detection System X ______________________ NOTE: Blank areas mean that HELB events do not affect non-safety-related Control Systems. For the instrument line break, note that all individual non-safety control systems cannot be affected by a single or common type HELB due to physical and el ectrical separation of these control systems throughout the plant.

LSCS-UFSAR 7.A.1-1 REV. 13 ATTACHMENT 7.A - ANALYSIS OF CONFORMANCE OF INSTRUMENTATION AND CONTROL SYSTEMS WITH IEEE CRITERIA 7.A.1 INTRODUCTION This attachment provides an analysis of the conformance of the LaSalle plant instrumentation and control systems with applicable IEEE criteria. General Conformance to IEEE Criteria Conformance to IEEE 317-1972 IEEE 317-1972, "IEEE Standard for Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations," provides an acceptable method of complying with Appe ndix B and General Design Criterion 50 of Appendix A to 10 CFR 50 with respect to mechanical, electrical, and test requirements for the design, construction, and installation of electric penetration assemblies in containment structures for wa ter-cooled nuclear power plants, subject to the following qualifications:

a. Section 4 should be supplemented as follows: the electric penetration assembly should be designed to withstand, without loss of mechanical integrity, the maximum possible fault current versus time conditions (which could occur because of single random failures of circuit overload protection devices) within the

two leads of any one single-phase circuit or the three leads of any one three-phase circuit. Incorporating adequate self-fusing characteristics within the penetration conductors themselves constitutes an acceptable design approach. Where self-fusing characteristics are not incorporated, the circuit overload protection system should conform to the criteria of IEEE 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations" (also designated ANSI N 42.7-1972). b. The maximum containment pr essure to be specified in accordance with Section 4.3 should be construed as being synonymous with maximum containment internal pressure as defined in Footnote 1 to Article NE3000 of Section III of the ASME Boiler and Pressure Vessel Code (Summer 1972 Addenda). c. The specific applicability or acce ptability of the codes, standards, and guides referenced in Section 3 will be covered separately in other guides where appropriate. LSCS-UFSAR 7.A.1-2 REV. 13 d. Section 8 should be supplemented as follows: the quality assurance requirements for the design, construction, installation, and testing of electric penetration assemblies shall be in accordance with the requirements set forth in ANSI N 45.2-1971, "Quality Assurance Program Requirements for Nuclear Power Plants," and ANSI N 45.2.4-1972, "Installation, Inspection, and Testing Requirements for Instrumentation and Electric Equipment During the Construction of Nuclear Power Generating Stations" (also designated IEEE 336-1971). Conformance to IEEE 323-1971 Written procedures and responsibilities are developed for the design and qualification of all Class 1 electric equipment. This includes preparation of specifications, qualification procedures, and documentation for Class 1 equipment. Qualification testing or analysis is accomplished prior to release of the engineering design for production. Standards manuals are maintained containing specifications, practices, and proced ures for implementing qualification requirements, and an auditable file of qualification documents is available for review. Conformance to IEEE 336-1971 Specifications, where applicable, include requirements for conformance to IEEE 336 and will be submitted with test results. Conformance to IEEE 338-1971 This discussion is presented on a system basis in the analysis portions of Sections 7.A.2, 7.A.3, 7.A.4 and 7.A.5.

LSCS-UFSAR 7.A.2-1 REV. 13 7.A.2 REACTOR PROTECTION SYSTEM 7.A.2.1 Criteria for Protection Systems for Nuclear Power Generating Stations (IEEE 279-1971) 7.A.2.1.1 Scram Discharge Volume High Water Level Scram General Functional Requirement (IEEE 279, Par. 4.1) The purpose of the scram discharge volume high-water-level scram trip is to assure that adequate volume remains to accommodate the water discharged from the withdrawn control rod drives in the event that a reactor scram occurs.

The water level setpoint is set such that sufficient volume remains to accomplish any subsequent reactor scram. Due to the hydraulic design of the piping and the volume, the rate of change of water level is relatively slow and is a ssumed to be negligible in terms of its transient influence on the sensor. The only response time imposed upon the sensor is that the electrical contact open within 1 second after the water level has risen to the setpoint value. Single-Failure Criterion (IEEE 279, Par. 4.2) The scram discharge volume high-water-lev el scram trip meets the single-failure criterion.

The four sensors are divided into two groups. The A and B sensors are connected to one process tap, and the C and D sensors ar e connected to another process tap. The two process taps are separated and isolated in their physical connections to the discharge volume. Wiring from each sensor to the control room relay cabinets is run in a separate rigid conduit to maintain the electrical and physical separation of the sensor trip channels. A separate distinct trip cha nnel relay is provided for each sensor. These relays are separated from one another by cabinet wall barriers to maintain independence from the trip channels. Quality of Components and Modules (IEEE 279, Par. 4.3) These components have been previously used successfully in all GE BWR power plants for this function.

LSCS-UFSAR 7.A.2-2 REV. 14, APRIL 2002 Equipment Qualification (IEEE 279, Par. 4.4) Vendor qualification is required to pr ove that the component will perform in accordance with the requirements listed on the purchase specification. These are based on the intended application. This qualification, augmented by the existing field experience with these components in this application, serves to qualify these components. GE Nuclear Energy Division conducts qualification tests of the relay panels to confirm their adequacy for this service. In situ operational testing of these sensors, channels, and the entire protection system will be performed at the project site during the preoperational test phase.

Channel Integrity (IEEE 279, Par. 4.5) The channel components are specified to operate under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6)

The four trip channels are physically separa ted and electrically isolated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) The four trip channels comply with this design requirement.

Each trip channel output relay uses two contacts (in series) within the RPS trip logic. One additional contact on each re lay is wired to a common annunciator in the control room. There is no single failure that will prevent proper functioning of this protection system when su ch action is required. Derivation of System Inputs (IEEE 279, Par. 4.8)

The measurement of discharge volume wate r level is an appropriate variable for this protective function. The desired variable is "available volume" to accommodate a reactor scram. However, the measurement of consumed volume is sufficient to infer the amount of remaining available volume, since the total volume is a fixed, predetermined value established by the design.

LSCS-UFSAR 7.A.2-3 REV. 13 Capability for Sensor Checks (IEEE 279, Par. 4.9) During reactor operation, the discharge vo lume level switches may be tested by using the locked instrument valves in proper sequence in conjunction with quantities of demineralized water. The test procedure is similar to the calibration procedure for this protective equipment.

Capability for Test and Calibration (IEEE 279, Par. 4.10) The test of the level switches associated with discharge volume water level measurement can be performed during full power operation. At plant shutdown, the level switches may be calibrated by introducing a fixed volume of water into the discharge volume and observing that all level switches operate at the appropriate volumetric levels. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Individual level switches may be removed from service under administrative control described in the preceding test procedure. Since only one level switch associated with reactor scram is valved out of service at any given time, and since the test interval to confirm proper level switch resp onse is relatively short, the protective function is maintained by means of the one level switch in service on one of the trip systems and the two level switches in service on the other trip system. Furthermore, the operator can ascertain that the discharge volume is empty prior to the start of any single level switch test.

Operating Bypasses (IEEE 279, Par. 4.12) An operating bypass is provided in the cont rol room to enable the operator to bypass the trip outputs. Control of this bypass is achieved through administrative means, and its only purpose is to permit reset of the RPS following reactor scram. Compliance of this bypass function with IEEE 279 is described in Subsection 7.A.2.1.13 dealing with trip bypass functions. Indication of Bypasses (IEEE 279, Par. 4.13) Operating bypasses are annunciated in the main control room by the discharge volume high water level trip bypass annunc iator. The control room operator must exercise control judgment over valving one level switch out of service at a time during the periodic test of the trip channe l level switches. When the level switch is placed in its tripped condition as a result of the test, the operator is informed of the trip by the discharge volume high-water-l evel trip annunciator and the trip channel identification logged by the annunciator system. LSCS-UFSAR 7.A.2-4 REV. 14, APRIL 2002 The discharge volume high-water-level, trip-bypassed annunciator provides the operator with indication that one or more operating bypass channels have been placed into effect. Manual bypasses are indicated in the control room on the ESF status indication panel as described in Section 7.8.

Access to Means for Bypassing (IEEE 279, Par. 4.14) All instrumentation valves associated with the periodic testing of individual level switches are either locked-open or locked-closed valves depending upon their normal state. The operator has direct control of these valves.

Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this protective function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The level switches trip at the setpoint value and remain in a tripped condition as long as the water level exceeds the setpoint value. Hence, the trip channel output to the RPS trip logic will be in its tripped state whenever the setpoint is exceeded. It is necessary only that the process sensors remain in a tripped condition for a sufficient amount of time to deenergize the scram contactors and open the seal-in contact in the trip logic associated with the scram contactors. Once this action is accomplished, the trip actuator logic initiates reactor scram regardless of the state of the process sensors that initiated the sequence of events. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Access to the scram discharge volume high water level instruments for calibration is anticipated during reactor operation and is under administrative control. Identification of Protective Actions (IEEE 279, Par. 4.19) Any one of the four level sw itches will initiate a cont rol room annunciator when the trip setpoint has been exceeded. Identification that the particular trip channel has exceeded its setpoint is accomplished as a typed record from the annunciator system or visual observation of the relay contacts at the RPS panels.

LSCS-UFSAR 7.A.2-5 REV. 14, APRIL 2002 Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is annunciation of a scram discharge volume high water level trip and that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21) Because the water level measurement and its one-to-one relationship between a given level switch and its associated trip channel output relay are inherently simple, the design facilitates maintenance of this protective function. Identification of Protection Systems (IEEE 279, Par. 4.22)

Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified specifically as reactor protection system wiring. 7.A.2.1.2 Main Steamline Isolation Valve Closure Scram Trip

General Functional Requirement (IEEE 279, Par. 4.1) The purpose of the main steamline isolation valve closure scram trip is to protect the reactor whenever its link to the heat sink (turbine or condenser) is in the process of being removed. The valve stem position of each main steamline isolation valve is monitored by limit switches. The limit switch setpoint is set at 8% or less, valve motion away from the full open position. In this way, the instrument channel signals the reactor protection system to anticipate imminent closure of the isolation valves, and the response time of the switch contacts is spec ified to be less than or equal to 10 msec after the valve has reached its setpoint position. Each division logic receives inputs from both valves in two main steamlines. The logic arrangement is established to enhance frequent testing of these valves without causing a half scram (trip of one of the tw o pilot solenoids on each scram valve) for each valve test. The chosen logic arrangement is labeled as "three-out-of-four" steamlines isolated to produce reactor scra m, rather than the general one-out-of-two twice arrangement characteristic of the GE BWR. Single-Failure Criterion (IEEE 279, Par. 4.2) The main steamline isolation valve closure scram trip meets the single-failure criterion.

LSCS-UFSAR 7.A.2-6 REV. 13 Each main steam isolation valve was originally designed to use a limit switch junction box in close proximity to the valv

e. However, the us e of these junction boxes was eliminated and individual conduits were run directly to the switches. One switch is used with the RPS A trip system, and the other switch is used with the RPS B trip system. Failure of any single limit switch will thus not prevent proper protection system operation when it is required.

For the eight instrument channels utilizing 16 limit switches, an attempt has been made to diversify the assignment of limit switch contacts so as to minimize the effect of any common mode failure affecting the same contact of each switch. One limit switch associated with the inboard valve in one main steamline is connected in series with one limit switch a ssociated with the outboard valve in that same main steamline. The valve opening contacts energize a trip channel relay whenever both valves in the main steamline are open 92% or less. Wiring from the limit switch on each valve to the control room RPS relay panels is required to be run in two separate conduits, one for each contact of the limit switch, to maintain the necessary electrical and physical separation.

The two relays associated with any one trip logic (for example relays A and E of the A1 trip logic) are located in one panel that is physically and electrically separated from the panels containing the other trip logic circuits. Quality of Components and Modules (IEEE 279, Par. 4.3) These components have been successfully us ed in all GE BWR power plants for this function. Equipment Qualification (IEEE 279, Par. 4.4) Vendor qualification is required to prov e that these components will perform in accordance with the requirements listed on the purchase specification for the intended application. This qualification, augmented by existing field experience with these components in this application, suffices to qualify the parts. GE Nuclear Energy Division conducts qualification test s of the relay panels to confirm their adequacy. In situ operational testing of the limit switches and other channel components will be performed at the site during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5)

The channel components are designed to be operable under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents.

LSCS-UFSAR 7.A.2-7 REV. 13 Channel Independence (IEEE 279, Par. 4.6) The eight trip channels are physically sepa rated and electrically isolated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) The eight trip channels comply with this requirement. The limit switches calling for RPS use are routed through separate conduit connections relative to the other limit sw itches used for indi cator lights in the control room. After the cabling emerges from the limit switch, it is routed separately from any other cabling in the plant to the RPS panels in the control room. Each trip channel output relay uses two contacts (in series) within the RPS trip logic. One additional contact on each re lay is wired to a common annunciator in the control room. There is no single failure th at will prevent proper functioning of this protective equipment when such action is required.

Interlocks exist to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8) The measurement of main steamline isolation valve position is an appropriate variable for the reactor protection system. The desired variable is "loss of the reactor heat sink"; however, isolation valve closure is the logical variable to infer that the steam path has been blocked between the reactor and the heat sink. It should be noted that other valves in this steam path, such as turbine stop valves, etc., are also monitored by the reactor protection system to assure proper response of the reactor to path blockages downstream of the main steamline isolation valves. Capability for Sensor Checks (IEEE 279, Par. 4.9) A specific test procedure will cause the limit switches to operate at the setpoint value of the valve position. The logic of four instrument channel logics is as follows:

a. Al (tripped) = Inboard or outboard valve partially closed in MSL-A, and inboard or outboard valve partially closed in MSL-B; LSCS-UFSAR 7.A.2-8 REV. 16, APRIL 2006 b. A2 (tripped) = Inboard or outb oard valve partially closed in MSL-C, and inboard or outboard valve partially closed in MSL-D; c. Bl (tripped) = Inboard or outboard valve partially closed in MSL-A, and inboard or outboard valve partially closed in MSL-C; and
d. B2 (tripped) = Inboard or outb oard valve partially closed in MSL-B, and inboard or outboard valve partially closed in MSL-D. For any single valve closure test, two of the eight instrument channels will be placed in a tripped condition, but none of the channel logics will be tripped, and no RPS annunciation or computer logging will occur. This arrangement permits single valve testing without corresponding tripping of the RPS. The observation that no RPS trips result is a valid and necessary test result.

At reduced power levels, two valves may be tested in sequence to produce RPS trips, annunciation of the trips, and computer logg ing of the trip channel identification. For example, closure of one valve in main steamline A and another valve in main steamline B will produce an A1 trip logic trip and should not produce trips in the B1 or B2 channel logic circuits. These observations are another important test result that confirms proper RPS operation. Each possible combination of single valve closure and switch operation is performed in sequence to confirm proper operation of all eight instrument channels.

These test results confirm that the valve limit switches operate as the valves are manually closed. Capability for Test and Calibration (IEEE 279, Par. 4.10) During reactor shutdown, calibration of the main steamline isolation valve limit switch setpoint at a valve position of less than or equal to 8% closure is possible by physical observation of the valve stem. During plant operation, the operator can confirm that the limit switches operate during valve motion, from full open to full closed and vice versa, by comparing the time that the RPS trip occurs with the ti me that the valve position indicator lights in the control room signal that the valve is fully open and fully closed. This test does not confirm the exact setp oint, but does provide the operator with an indication that the limit switch operates between the limiting positions of the valve. LSCS-UFSAR 7.A.2-9 REV. 13 Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Due to the use of valve limit switches, it is not possible for the operator to remove an instrument channel from service. Limit switch testing is an integral part of the main steamline isolation valve test.

Operating Bypasses (IEEE 279, Par. 4.12) An operating bypass is provided for this RPS protective function. This bypass requires that the reactor system mode switch, which is under the direct control of the operator, be placed in other than the RUN position. The only purpose of this bypass is to permit the reactor protection system to be placed in its normal energized state for operation at low power levels with the main steamline isolation valves not fully open. Compliance of this trip bypass function with IEEE 279 is described in Subsection 7.A.2.1.14 dealing with trip bypass functions. Indication of Bypasses (IEEE 279, Par. 4.13)

The main steamline isolation valve closure trip bypass annunciators provide the operator with the indication that one or more operating bypass channels have been placed into effect for this RPS protective function. The switches that bypass the main steam differential temperature isolation signals are provided with alarm indication in the main control room whenever the switches are turned to the "bypass" position. A total of two alarms are provided, one per ESF division.

Access to Means for Bypassing (IEEE 279, Par. 4.14) Compliance of the operating bypass is discu ssed in the subsection dealing with trip bypass functions. Multiple Setpoints (IEEE 279, Par. 4.15)

This design requirement is not applicable to this protective function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The limit switches trip at the fixed setpoi nt value and remain in that condition for valve positions between 92% open and the fully closed position. Hence, the trip channel output to the RPS logic is in its tripped state whenever the setpoint is exceeded. It is necessary only that the process sensors remain in a tripped condition for a sufficient amount of time to deenergize the scram contactors. Once this action is LSCS-UFSAR 7.A.2-10 REV. 16, APRIL 2006 accomplished, the trip actuator logic proceeds to initiate reactor scram regardless of the state of the process sensors that initiated the sequence of events. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this protective function.

Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Access to the process limit switch inputs is not possible during reactor operation due to the ambient temperature and radiation conditions. Identification of Protective Actions (IEEE 279 Par. 4.19) Partial or full closure of any main steamline valve causes a change in the status of position indicator lights in the control room. These indications are not a part of the reactor protection system, but they do provide the operator with valid information pertinent to the valve status. Partial or full closure of one or both va lves in a particular set of two main steamlines initiates a control room annunc iator when the trip setpoint has been exceeded. This same condition permits identification of the tripped trip channels in the process computer or visual inspection of the relay contacts at the RPS panels. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is both annunciation and relay position

indication of a MSIV closure scram trip an d that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21) Due to the inherent simplicity of the valve limit switch for the process sensor and the relationship of one limit switch contact for the inboard valve and one limit switch for the outboard valve feeding one tr ip channel output relay, the design of the system facilitates maintenance of this protective function. During power operation, it may be necessary to reduce power in order to close valves in more than one main steamline. With this arrangement, a sequence of valve tests will permit the operator to determine fully a defective component or to isolate the difficulty to one of two limit switches in a given main steamline.

LSCS-UFSAR 7.A.2-11 REV. 17 APRIL 2008 Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.3 Turbine Stop Valve Closure Scram General Functional Requirements (IEEE 279, Par. 4.1) The purpose of the turbine stop valve closure scram trip is to protect the reactor whenever its link to the heat sink is in the process of being removed. The valve stem position of each turbine st op valve is monitored by limit switches. The limit switch setpoint is set at 6% or less valve motion away from the full open position. In this way the instrument channel signals to the reactor protection system anticipate imminent closure of the stop valves, and the response time of the switch contacts is specified to be less than 10 msec after the valve has reached the setpoint position.

Each division logic receives inputs from two stop valves. The logic arrangement is established to enhance frequent testing of these valves without causing a half scram (trip of one of the two pilot solenoids on ea ch scram valve) for each valve test. The chosen logic is labeled as three-out-of-fou r stop valve closures to produce reactor scram rather than the general one-out-of-two-twice arrangement characteristic of the GE BWR.

Single-Failure Criterion (IEEE 279, Par. 4.2) The turbine stop valve closure scram trip meets the single-failure criterion. Physical separation of individual switch boxes is on the order of 56 inches for a typical plant.

Operation of one turbine stop valve for test purposes will not result in an RPS trip. Partial or full closure of three turbine stop valves will initiate reactor shutdown if the initial operating power level is greater than or equal to 25% of rated core thermal power. Wiring from the limit switch junction box for each stop valve is run so as to maintain the necessary electrical and physical separation.

LSCS-UFSAR 7.A.2-12 REV. 13 Quality of Components and Modules (IEEE 279, Par. 4.3) Highly reliable components have been sele cted for the limit switches and relays. Equipment Qualification (IEEE 279, Par. 4.4)

Vendor qualification is required to prov e that these components will perform in accordance with the requirements listed on the purchase specification for the intended application. This qualification, augmented by field experience with these components in this application, serves to qualify the parts. GE Nuclear Energy Division conducts qualification tests of the relay panels to confirm their adequacy for this application. In situ operational testing of the limit switches and other channel components was performed at the site during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5) The channel components are designed to be operable under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The eight trip channels are physically sepa rated and electrically isolated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) The eight trip channels comply with this design requirement. The limit switch cables for RPS use are routed through separate conduit connections relative to the other limit switch contacts used for indicator lights and turbine control purposes. After the cablin g emerges from the limit switch junction box for each turbine stop valve, it is rout ed separately from any cabling in the plant to the RPS panels in the control room. Each trip channel output relay uses two contacts (in series) within the RPS trip logic. One additional contact on each re lay is wired to a common annunciator in the control room. There is no single failure that will disable this protective function when it is required. Interlocks exist to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system.

LSCS-UFSAR 7.A.2-13 REV. 16, APRIL 2006 Derivation of System Inputs (IEEE 279, Par. 4.8) The measurement of turbine stop valve posi tion is an appropriate variable for this RPS protective function. The desired variabl e is "loss of the re actor heat sink." However, stop valve closure is the logical variable to infer that the steam path has been blocked between the reactor and the heat sink.

Capability for Sensor Checks (IEEE 279, Par. 4.9) The logic of the four instrument channel logics is as follows:

a. A1 (tripped) = Turbine Stop Valve 1 partially closed, and Turbine Stop Valve 2 partially closed;
b. A2 (tripped) = Turbine Stop Valve 3 partially closed, and Turbine Stop Valve 4 partially closed;
c. B1 (tripped) = Turbine Stop Valve 1 partially closed, and Turbine Stop Valve 3 partially closed; and
d. B2 (tripped) = Turbine Stop Valve 2 partially closed, and Turbine Stop Valve 4 partially closed.

For any single stop valve closure test, two of the eight instrument channels will be placed in a tripped condition, but none of the channel logics will be tripped, and no RPS annunciation or computer logging will occur. This arrangement permits single valve testing without corresponding tripping of the RPS, and the observation that no RPS trips result is a valid and necessary test result. At power levels which are reduced but greater than or equal to 25% of rated core thermal power, two valves may be tested in sequence to produce RPS trips, annunciation of the trips, and computer prin tout of the trip channel identification. These observations are another important test result that confirms proper RPS operation.

In sequence, each possible combination of single valve closure and switch operation is performed to confirm proper operation of all eight instrument channels. Capability for Test and Calibration (IEEE 279, Par. 4.10) During reactor shutdown, calibration of the setpoint of the turbine stop valve limit switch at a valve position of less than or equal to 8% closure is possible by physical observation of the valve stem.

LSCS-UFSAR 7.A.2-14 REV. 16, APRIL 2006 During plant operation, the operator can confirm that the limit switches operate during valve motion from full open to full closed, and vice versa, by comparing the time that the RPS trip occurs with the time that the valve position lights in the control room signal showing that the valve is fully open or fully closed. This test does not confirm the exact setpoint but does provide the operator with an indication that the limit switch operates between the limiting positions of the valve. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) The eight trip channels meet this design requirement. Because of the use of valve limit switches, it is not possible for the operator to remove a trip channel from service. Limit switch testing is an integral part of the turbine stop valve test. Operating Bypasses (IEEE 279, Par. 4.12) An operating bypass is provided for this protective function in that the turbine stop valve trip output will not be operable whenever the turbine is operating at an initial power level below 25% of rated core therma l power. The only purpose of the bypass is to permit the reactor protection system to be placed in its normal energized state for operation at low power levels with the turbine stop valves not fully open. Compliance of this trip bypass function with IEEE 279 is described in Subsection 7.A.2.1.15 dealing with trip bypass functions. Indication of Bypasses (IEEE 279, Par. 4.13) The turbine stop and control valve fast-closure trips bypassed annunciator provides the operator with indication that one or more operating bypass channels have been placed into effect. Access to Means for Bypassing (IEEE 279, Par. 4.14) No manual controls are provided in the system design for bypass of the RPS function. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this protective function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The limit switches trip at the fixed setpoi nt value and remain in that condition for valve positions between the trip set point and fully closed. Hence, the trip channel output to the RPS logic is in its tripped state whenever the setpoint is exceeded.

LSCS-UFSAR 7.A.2-15 REV. 16, APRIL 2006 It is only necessary that the process sensors remain in a tripped condition for a sufficient amount of time to deenergize the scram contactors and open the seal-in contact in the trip logic associated with the scram contactors. Once this is accomplished, the trip actuator logic initiates reactor scram regardless of the state of the process sensors that initiated the sequence of events.

Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Access to the limit switches is not anticipated during reactor operation due to ambient environmental conditions. The reactor operator is permitted full access to the turbine stop valve test controls, since motion of the valve during this test produces a valid sensor response. Identification of Protective Actions (IEEE 279, Par. 4.19)

Partial or full closure of any turbine stop valve is indicated by valve position indicator lights in the control room. These indications are not a part of the RPS, but they do provide the operator with valid information pertinent to the valve status. An RPS channel logic trip due to partial or full closure of turbine stop valves initiates a control room annunciator when the trip point has been exceeded. This same condition permits identification of the tripped instrument channels in the process computer or by visual observation of the channel trip device in the logic cabinets. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is both annunciation and relay position indication of turbine stop valve closure scram trip and that the scram logic has been actuated.

System Repair (IEEE 279, Par. 4.21) Because of the inherent simplicity of the valve limit switch for the process sensor and the relationship of a limit switch cont act with its associated channel logic, the design of the system facilitates main tenance of the protective function.

During power operation, it may be necessary to reduce power in order to close more than one turbine stop valve in order to accomplish a specific RPS test. The sequence of tests permits the operator to determine a defective limit switch contact or instrument channel logic device. LSCS-UFSAR 7.A.2-16 REV. 13 Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.4 Turbine Control Valve Fast Closure Scram General Functional Requirement (IEEE 279, Par. 4.1) The purpose of the turbine control valve fast closure scram is to protect the reactor whenever its link to the heat sink is in the process of being removed. Turbine control valve fast closure is monitored by pressure switches mounted on the EHC oil lines. The control valve fast closure pressure switches must provide RPS inputs within 30 msec after the contro l valves start their rapid closure. The logic arrangement is the one-out-of-two twice form characteristic of the GE BWR, since the expected test frequency for the generator load rejection sensing portion of the turbine control system is less than that anticipated for the turbine stop valve equipment. Single Failure Criterion (IEEE 279, Par. 4.2) The turbine control valve fast closure scram meets the single-failure criterion.

One of the four pressure switches is used in each RPS instrument channel. Quality of Components and Modules (IEEE 279, Par. 4.3) The pressure switch used is of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4) Vendor qualification is required to prov e that these components will perform in accordance with the requirements listed on their purchase specification for the intended application for the devices. This qualification, augmented by existing field experience with these components in this a pplication, will serve to qualify the parts. GE Nuclear Energy Division conducts qua lification tests of the logic cabinets including mounted components to confirm their adequacy for this application. In situ operational testing of the devices and other channel components was performed at the site during the preoperational test phase. LSCS-UFSAR 7.A.2-17 REV. 13 Channel Integrity (IEEE 279, Par. 4.5) The channel components are designed to be operable under normal and abnormal conditions of environment, energy supply, malfunction, and accidents.

Channel Independence (IEEE 279, Par. 4.6) The instrument channels are physically separated and electrically isolated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7)

All trip channels of this protective functi on comply with this design requirement. Pressure switch contacts for RPS use are routed separately relative to other contacts of these devices used for indicator lights and turbine control purposes. After the cabling emerges from the junction boxes, it is routed in Class lE wireways to the logic cabinets in the control room. One contact from each instrument channel logic device goes to the annuncia tor system in the control room. For these configurations, there is no single failure that will prevent proper functioning of this protective function when such action is required. Interlocks exist to the control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system.

Derivation of System Inputs (IEEE 279, Par. 4.8) Due to the normal throttling action of the turbine control valves with changes in the plant power level, measurement of control valve position is not an appropriate variable for this protective function. The desired variable is "rapid loss of the reactor heat sink;" conseque ntly, some measurement of control valve closure rate is indicated. Protection system design practice has discouraged use of rate-sensing devices for protective purposes. In this instance, it was determined that detection of hydraulic actuator operation is a more positive means of determining fast closure of the control valves.

LSCS-UFSAR 7.A.2-18 REV. 14, APRIL 2002 Loss of hydraulic pressure in the EHC oil lines is monitored to initiate fast closure of the control valves. These measurements provide indication that fast closure of the control valves is imminent. This measurement is considered an adequa te and proper variable for the protective function taking into consideration the reliability of the chosen sensors relative to other available sensors and the difficulty in making direct measurements of control valve fast closure rate. Capability for Sensor Checks (IEEE 279, Par. 4.9) During the control-valve fast-closure test, the RPS channels are tested using method five discussed in Section 7.2.2.10 above which will prevent an actual RPS channel trip from occurring. The four RPS instrument logics are arranged as follows, assuming initial operation above at greater than or equal to 25% of rated core thermal power:

a. A1 (tripped) = Pressure Switch A loss of oil pressure,
b. A2 (tripped) = Pressure Switch C loss of oil pressure,
c. Bl (tripped) = Pressure Switch B loss of oil pressure, and
d. B2 (tripped) = Pressure Switch D loss of oil pressure.

During plant operation, the individual pressure switches may be valved out of service, and the turbine control system ma y be used to operate the turbine bypass valves so as to perform a periodic test of the RPS inputs and channel logic. Capability for Test and Calibration (IEEE 279, Par. 4.10) Actual calibration of the setpoint can on ly be accomplished at plant shutdown.

Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) The four instrument channels comply with this design requirement. They utilize pressure switch contacts as the process input, and administrative controls are imposed to ensure that each channel is retu rned to service following its being valved out of service during periodic tests.

Operating Bypasses (IEEE 279, Par. 4.12) An operating bypass is provided for the cont rol valve fast closure function, since the trip will not be operable whenever the turbine is operating at an initial power level LSCS-UFSAR 7.A.2-19 REV. 14, APRIL 2002 of less than 25% of rated core thermal power. Compliance of this trip bypass function with IEEE 279 is described in Subsection 7.A.2.1.15 dealing with trip bypass functions. Indication of Bypasses (IEEE 279, Par. 4.13)

The turbine stop and control valve fast closure trips bypassed annunciator provides the operator with indication that the operating low power bypass has been placed into effect for this protective function. During turbine control valve fast closure testing, manual bypasses are indicated in the control room on the ESF status indication panel as described in Section 7.8. Access to Means for Bypassing (IEEE 279, Par. 4.14) The operating low power bypass for both configurations is discussed in Subsection 7.A.2.1.15 dealing with trip bypass functions. Multiple Setpoints (IEEE 279, Par. 4.15)

This design requirement is not applicable to this protective function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The instrument channels on the EHC oil line pressure remain in a tripped condition until the sensed oil pressure is restored.

For each of these inputs, it is necessary only that the instrument channel sensors remain in a tripped condition in excess of the logic time delay to seal in the tripped condition. Once this action is accomplished, the ac tuator logic proceeds to initiate reactor scram regardless of the state of process sensors that initiated the sequence of events. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18)

Testing of the instrument channels is ac complished with the turbine test controls that are fully accessible to the reactor operator during plant operation.

LSCS-UFSAR 7.A.2-20 REV. 16, APRIL 2006 Identification of Protective Actions (IEEE 279, Par. 4.19) Any time EHC oil line pressure exceeds th e setpoint, control room annunciators will be initiated for that protective function and identification of the tripped instrument channels will be provided in the process computer. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is annunciation of turbine control valve fast closure scram trip and that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21)

During the periodic test, the operator can determine any defective component and replace it during plant operation. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.5 Reactor Vessel Low Water Level Scram Trip General Functional Requirement (IEEE 279, Par. 4.1)

The purpose of the reactor ve ssel low water level scram trip is to protect the reactor from being uncovered as a result of falling water level in the vessel. Reactor vessel low water level is monitored by four differential pressure transmitters mounted on separate instrume nt lines. Each transmitter provides an input signal to a trip unit in one of the four RPS channels. The normal reactor vessel water level is between 30 and 40 inches above the trip setpoint, and the trip signal input to the reactor protection system must occur within 1 second after the level has just exceeded the fixed setpoint. The logic arrangement is the normal GE BWR one-out-of-two twice configuration. Single-Failure Criterion (IEEE 279, Par. 4.2)

The reactor vessel low water level scram tr ip meets this design requirement. Wiring from one differential pressure transmitter/trip unit is run separately from the wiring associated with the other differential pressure transmitters/trip units on the other instrument line. LSCS-UFSAR 7.A.2-21 REV. 13 Quality of Components and Modules (IEEE 279, Par. 4.3) The level transmitter and trip unit are highly reliable and of high quality. Equipment Qualification (IEEE 279, Par. 4.4)

Vendor certification is required that these components will perform in accordance with the requirements listed in the purchase part drawing for the intended application. This certification, in conjunction with field experience with these components in this application, serves to qualify the parts. GE Nuclear Energy Division conducts qualification tests of the relay panels to confirm their adequacy for this application. In situ operational testing of the devices and other channel components was performed at the site during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5) The channel components are designed to be operable under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The trip channels for this protective function are physically separated and electrically isolated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) All trip channels of this protective functi on comply with this design requirement. Electrical cables for RPS use are rout ed through separate conduit runs. Each trip channel output relay uses two contacts (in series) within the RPS trip logic. One additional contact on each re lay is wired to a common annunciator in the control room. There is no single failure that will prevent proper functioning of this protective function when such action is required. The system does not interlock to control systems.

LSCS-UFSAR 7.A.2-22 REV. 13 Derivation of System Inputs (IEEE 279, Par. 4.8) Actual water level is the desired variable, and the selected sensors monitor this variable directly. Capability for Sensor Checks (IEEE 279, Par. 4.9) Because of the normal one-out-of-two twic e configuration of the RPS logic for this protective function, one level transmitte r and/or trip unit may be removed from service to perform the periodic test on any trip channel. The transmitter can be checked for operab ility by valving it out from the sensing lines and applying a test pressure source. The trip units in the control room can be checked separately by applying a calibra tion signal and verifying the setpoint. Capability for Test and Calibration (IEEE 279, Par. 4.10) During calibration, a variable differential pr essure is applied to the differential pressure transmitter and is measured with a highly accurate precalibrated test gauge. Then the operation of the trip unit and indicator scale may be checked against the scale reading of the test gauge. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) During periodic test of any one trip channel, the level transmitter and/or trip unit is removed from service and is returned to service under administrative control procedures. Since only one level transmitter and/or trip unit is removed from service at any given time during the test interval, protective capability is maintained through the remaining instrument channels. Operating Bypasses (IEEE 279, Par. 4.12) This design requirement is not applicable to this protective function.

Indication of Bypasses (IEEE 279, Par. 4.13) When an instrument is bypassed, the bypa ss is annunciated in the control room and indicated on the logic cabinets. Manual bypasses are also indicated in the control room on the ESF status indication panel as described in Section 7.8. LSCS-UFSAR 7.A.2-23 REV. 16, APRIL 2006 Access to Means for Bypassing (IEEE 279, Par. 4.14) During the periodic test, administrative control procedures must be followed to remove one level transmitter and/or trip unit from service and subsequently return it to service.

Since no operating bypasses are available for this protective function, this design requirement does not apply. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this protective function.

Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The instrument channels remain in a tripped condition as long as the indicated water level is less than the established setpoint. For these inputs, it is necessary only that the instrument channels remain in a tripped condition in excess of the logic time delay to seal in the trip condition. Once this action is accomplished, the actuator logic proceeds to initiate reactor scram regardless of the state of the

process sensors that initiate d the sequence of events. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Access to the reactor vessel water level instrument is anticipated during reactor operation and is under administrative control of the plant personnel. Identification of Protective Actions (IEEE 279, Par. 4.19) Actuation of any level sensor to produce a tripped condition initiates a control room annunciator and produces a record of iden tification of the trip channel in the process computer. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is annunciation of reactor vessel low water level scram trip and that the scram logic has been actuated. LSCS-UFSAR 7.A.2-24 REV. 17, APRIL 2008 System Repair (IEEE 279, Par. 4.21) The one-to-one relationship between a level sensor and its instrument logic channel permits the plant personnel to identify any component failure during operation of the plant. Provisions have been made to facilitate repair of the channel components during plant operation.

Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.6 Main Steamline High Radiation Scram Trip (Deleted) 7.A.2.1.7 Neutron Monitoring System Scram Trip General Functional Requirement (IEEE 279, Par. 4.1)

The purpose of the neutron monitoring system scram trip is to limit the reactor power to an established maximum value. Those portions of the neutron monitoring system that pr ovide a gross power protective function are the average power range monitor (APRM) with flow reference scram and the intermediate ra nge monitor (IRM). The portion that provides power oscillation protective function is the oscillation power range monitor. Single-Failure Criterion (IEEE 279, Par. 4.2) The neutron monitoring system scram trip meets the single-failure criterion. Quality of Components and Modules (IEEE 279, Par. 4.3)

The NMS detectors and associated electronic equipment are of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4) At the component and module level, the Nuclear Energy Division of General Electric Company has conducted qualificat ion tests to qualify the items for this application. LSCS-UFSAR 7.A.2-25 REV. 17, APRIL 2008 General Electric Company's Nuclear Energy Division conducts qualification tests of the logic cabinets including mounted components to confirm their adequacy for this service. In situ operational testing of the detectors, monitors, channels, and other portions of the reactor protection system was conducted during the preoperational test phase.

Channel Integrity (IEEE 279, Par. 4.5) The channel components are designed to be operable under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6)

The eight IRM, six APRM and four OPRM channels (eight modules) are electrically isolated and physically separated from one another to comply with this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) The IRM, APRM and OPRM trip channels for this protective function comply with this design requirement. Within the IRM and APRM modules, prior to their output trip unit driving the RPS, analog outputs are derived for use with control room meters, recorders, and the process computer. Electrical isolation has been incorporated into the design at this interface to prevent any single failure from influencing the protective output from the trip unit.

The trip unit outputs are physically separa ted and electrically isolated from other plant equipment in their routing to the RPS panels. Within the RPS panels, each trip channel ou tput relay uses two contacts in series within the RPS trip logic. One additional contact from each relay is wired to a common annunciator in the control room.

There is no single failure of these outp uts that will prevent proper protection system action when it is required. Interlocks exist to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8) The measurement of neutron flux is an appropriate variable to determine the reactor power relative to a predetermined setpoint. In addition, the OPRM receives LSCS-UFSAR 7.A.2-26 REV. 13 reactor coolant flowrate signal from differential pressure transmitters in the reactor coolant recirculation lines. Capability for Sensor Checks (IEEE 279, Par. 4.9) During reactor operation in the RUN mode, the IRM detectors are stored below the reactor core in a low-flux region. Movement of the detectors into the core permits the operator to observe the instrument response from the different IRM channels and confirms that the inst rumentation is operable. In the power range of operation, the individual LPRM detectors respond to local neutron flux and provide the operator with an indication that these instrument channels are responding properly. The six APRM channels may also be observed to respond to changes in the gross power level of the reactor to confirm their operation. Each APRM instrument channel may also be calibrated with a simulated signal introduced into the amplifier input, and each IRM instrument channel may be calibrated by introducing an external signal source into the amplifier input. During these tests, proper instrument resp onse may be confirmed by observation of instrument lights in the contro l room and trip annunciators. Capability for Test and Calibration (IEEE 279, Par. 4.10) The APRM's are calibrated to reactor power by using the reactor heat balance (TIP) system to establish the relative local flux profile. LPRM gain settings are determined from the local flux profiles me asured by the TIP system once the total reactor heat balance has been determined. The OPRM provides a means of testing and calibrating the channel logic module and LPRMs. The OPRM functions to perform automatic testing of the individual hardware modules and report any detected failures. Each OPRM channel lo gic module is capable of automatic and manual testing. The gain-adjustment factors for the LPRM's are produced as a result of the process computer nuclear calculations involving the reactor heat balance and the TIP flux distributions. When incorporated into the LPRM's, these adjustments permit the nuclear calculations to be completed for the next operating interval and establish the APRM calibration relative to reactor power. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11)

A sufficient number of IRM channels has been provided to permit any one IRM channel in a given trip system to be manually bypassed and still ensure that the remaining operable IRM channels comply with the IEEE 279 design requirements. LSCS-UFSAR 7.A.2-27 REV. 17, APRIL 2008 One IRM manual bypass switch has been prov ided for each RPS trip system. The mechanical characteristics of this switch permit only one of the four IRM channels of that trip system to be bypassed at any time. In order to accommodate a single failure of this bypass switch, electrical interlocks have also been incorporated into the bypass logic to prevent bypassing of more than one IRM in that trip system at any time. Consequently, with any IRM bypassed in a given trip system, at least two and generally three IRM channels remain in operation to satisfy the protection system requirements. In a similar manner, one APRM manual bypa ss switch has been provided for each RPS trip system to permit one of the th ree APRM's to be bypassed at any time. Mechanical interlocks have been provided with the bypass switch, and electrical interlocks have been provided in the bypass circuitry to accommodate the possibility of switch failure. With the maximum numbe r of APRM's bypassed by the switches, sufficient APRM channels remain in operat ion to provide the necessary protection for the reactor. Also, a sufficient number of OPRM channels (each channel consisting of two modules) have been prov ided to permit any one OPRM module in a given trip system to be manually bypassed, while still ensuring that the remaining operable OPRM channels comply with the IEEE 279 design requirements.

Operating Bypasses (IEEE 279, Par. 4.12) Operating bypass capability is not provided for the neutron monitoring system instrument channels, except for the OPRM channels. The OPRM trip logic is automatically activated when the reactor power and recirculation flow are in the appropriate operating regions of the reactor power/flow map. The OPRM automatically enables its pre-trip and trip alarm outputs upon entry into the high power, low core flow region of the power/flow operating map, thereby ensuring the OPRM system protection function is available as needed. Maintenance, test, or calibration bypasses are accomplished by the manual bypass switches for any IRM or APRM channel during reactor operation. Indication of Bypasses (IEEE 279, Par. 4.13) When any IRM, APRM or OPRM instru ment channel output to the RPS is bypassed, this fact is indicated by lights for each channel located on the main control room panels. Manual bypasses are also indicated in the control room on the ESF status indication panel as described in Section 7.8.

Access to Means for Bypassing (IEEE 279, Par. 4.14)

LSCS-UFSAR 7.A.2-28 REV. 17, APRIL 2008 Manual bypassing of any IRM, APRM, or OPRM channel is accomplished with control room selector switches under the administrative control of the operator. Multiple Setpoints (IEEE 279, Par. 4.15) The trip setpoint of each IRM channel is established at the 120/125% of full scale mark for each range of IRM operation. The IRM is a linear, half-decade per range instrument. Therefore, as the operator switches an IRM from one range to the next, the trip setpoint tracks the operator's selection. In the transition from STARTUP to RUN modes of operation, the reactor system mode switch is used to convert from IRM protection to APRM protection.

Each of these multiple setpoint provisions is a portion of the reactor protection system and complies with the design requirements of IEEE 279. The OPRM does not have multiple setpoints to accommodate different operating conditions. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The IRM, APRM, and OPRM trip unit outputs remain in a tripped condition whenever the trip setpoint is exceeded.

It is only necessary that the trip units remain in a tripped condition in excess of the logic time delay to seal in the tripped cond ition. Once this action is accomplished, the actuator logic initiates reactor scra m regardless of the state of the IRM or APRM instrument channels that in itiated the sequence of events. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Access to the IRM, APRM and OPRM setpoint adjustments, calibration controls, and test points is under the administrative control of the plant personnel. The calibration and setpoint controls are located in the NMS cabinets, except for the OPRM, and the transition from IRM to APRM coverage is controlled by the keylocked reactor system mode switch. OPRM calibration and setpoint adjustment is accomplished via the maintenance terminal, with OPRM in the test mode. The OPRM mode is administratively controlled by a key-locked switch.

LSCS-UFSAR 7.A.2-29 REV. 13 Identification of Protective Actions (IEEE 279, Par. 4.19) Neutron monitoring system annunciators prov ided in the control room indicate the source of the RPS trip. The process computer provides a typed record of the tripped neutron monitoring system channel as well as identification of individual IRM and APRM channel trips. For the OPRM system, a sequence of events recorder provides a record of system trips. Each instrument channel, whether IRM, APRM, or OPRM has control room panel lights indicating the status of the channel for operator convenience. Information Readout (IEEE 279, Par. 4.20)

The data presented to the operator is an nunciation of neutron monitoring system scram trip and that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21) Replacement of IRM and LPRM detectors must be accomplished during plant shutdown. Repair of the remaining portions of the neutron monitoring system may be accomplished during plant operation by appropriate bypassing of the defective instrument channel. The design of the system facilitates rapid diagnosis and repair. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.8 Drywell High-Pressure Scram General Functional Requirement (IEEE 279, Par. 4.1) The purpose of the drywell high-pressure scram is to detect an increase in the drywell pressure. The increase in pressure within the drywell may be the result of increasing temperature or a possible loss of coolant from the reactor vessel. Drywell high pressure is monitored by four pressure taps and pressure switches. The time response requirement imposed upon the operation of the instrument

channel is within 0.6 seconds af ter the setpoint is exceeded.

LSCS-UFSAR 7.A.2-30 REV. 13 Single-Failure Criterion (IEEE 279, Par. 4.2) The drywell high pressure scram trip meets the single-failure criterion. One pressure switch is mounted on each pressure tap, and the redundant taps are physically separated from one another by the reactor vessel. Wiring from each pressure switch is run in a separate rigid conduit from the pressure switch to the RPS cabinets in the control room to maintain both physical and electrical separation and isolation among the trip channels. A separate trip channel output relay is provided for each pressure switch and is physically separated in the RPS cabinets.

Quality of Components and Modules (IEEE 279, Par. 4.3) The RPS trip pressure switches are of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4) Vendor qualification is required for the pressure switches and trip channel output relays to prove that the parts perform in accordance with the requirements listed on the purchase specification for the intended application. This qualification, augmented by existing field experience with these components in this application, serves to qualify these components. General Electric Nuclear Energy Division will conduct qualification tests of the relay panels to confirm their adequacy for this service. In situ operational testing of the sensors, channels, and the entire protection system was performed during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5) The channel components are designed to be operable under normal and abnormal

conditions of environment, energy supply, malfunction, and accidents. Channel Independence (IEEE 279, Par. 4.6) The four trip channels of this protective function are physically separated and electrically isolated to meet this design requirement.

Control and Protection System Interaction (IEEE 279, Par. 4.7) The four trip channels of this protective function comply with this design requirement. The system interlocks to control systems only through isolation LSCS-UFSAR 7.A.2-31 REV. 13 devices such that no failure or combinatio n of failures in the control system will have any effect on the reactor protection system. Each trip channel output relay uses two contacts in series within the RPS trip logic. One additional contact from each relay is wired to a common annunciator in the control room. For all of these outputs, there is no single failure that will prevent proper functioning of this protective function when such action is required. Derivation of System Inputs (IEEE 279, Par. 4.8) The measurement of drywell high pressure is an appropriate variable to detect an abnormal condition within this boundary. High pressure within the drywell could indicate a break in the reactor coolant pressure boundary, and these sensors would respond to limit the conseq uences of such a break. Capability for Sensor Checks (IEEE 279, Par. 4.9) During reactor operation one pressure switch may be valved out of service at a time to perform testing under administrative control. At the conclusion of the test, administrative control must be used to ensure that the pressure sensor has been properly returned to service. Capability for Test and Calibration (IEEE 279, Par. 4.10) Once a pressure switch has been pr operly valved out of service under administrative control, testing of the pressure switch and its setpoint may be performed using a variable source of pressure. When the trip setpoint has been exceeded, the control room operator will obtain an annunciation of the trip and a typed record of the trip channel identification. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Individual pressure switches may be removed from service under administrative control in order to perform periodic tests or maintenance.

No automatic bypass functions are provided in the RPS design for this protective function. Operating Bypasses (IEEE 279, Par. 4.12) This design requirement is not applicable to this protective function.

LSCS-UFSAR 7.A.2-32 REV. 13 Indication of Bypasses (IEEE 279, Par. 4.13) When a pressure switch has been valved out of service for periodic testing and the simulated input has exceeded the trip setp oint, a control room annunciator for this protective function indicates a tripped cond ition, and the process computer logs the instrument channel identification.

Manual bypasses are also indicated in the control room on the ESF status indication panel as described in Section 7.8. Access to Means for Bypassing (IEEE 279, Par. 4.14) This design requirement is not applicable to this protective function.

Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this protective function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16)

The instrument channels for this protective function remain in a tripped condition whenever the trip setpoint is exceeded. It is only necessary that the instrument channel remain in a tripped condition in excess of the logic time delay for seal-in of the tripped condition. Once this action is accomplished, the actuator logic initiates reactor scram regardless of the state of the process sensor s that initiated the sequence of events. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Access to the instrument channel adjustment s is under the administrative control of plant personnel. Identification of Protective Actions (IEEE 279, Par. 4.19) The four instrument channels initiate a control room annunciator for this protective function when the setpoint is exceeded. Identification of the instrument channel is provided by the typed log fr om the annunciator system.

LSCS-UFSAR 7.A.2-33 REV. 13 Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is annunciation of drywell high pressure scram trip and that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21) Due to the one-to-one relationship of pressure switch and instrument channel logic, this design requirement is satisfie d by this protective function. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.9 Reactor Vessel High Pressure Scram General Functional Requirement (IEEE 279, Par. 4.1) The purpose of the reactor high-pressure scram trip is to limit the positive pressure effect on reactor power. An increase in reactor pressure while the plant is operating tends to compress the steam voids and results in a positive reactivity effect and increased reactor heat generation. This reactor scram trip is established to reduce the heat generation within the reactor whenever the high-pressure setpoint is reached. Reactor pressure is monitored by four pressure switches connected to four process instrument lines. A time response of 0.5 second is required from the time that the setpoint is exceeded to the time that the switch contacts of the pressure switch open. The pressure switch contacts are connected into the trip channels in the normal one-out-of-two twice configuration.

Single-Failure Criterion (IEEE 279, Par. 4.2) The reactor high-pressure scram trip meets the single-failure criterion. Each pressure switch is connected to a reactor vessel tap physically separated from the other related taps. Wiring from the contacts of each pressure switch is run in a metal conduit from the sensor to the RPS cabinets in the control room to maintain both physical separation and electrical isolation of the redundant channels. A pressure switch channel output relay is associated with each sensor and is physically separated within the RPS cabinets from the redundant channels.

LSCS-UFSAR 7.A.2-34 REV. 13 Quality of Components and Modules (IEEE 279, Par. 4.3) The pressure sensor is of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4)

At the component level, vendor qualification is required to prove that the pressure switch and trip channel output relay will perform in accordance with the requirements listed on the purchase part drawings. This qualification, augmented by existing field experience for these components in this application, serves to qualify these components. The Nuclear Energy Division of General Electric conducts qualification tests of the

relay panels to confirm their ad equacy for this application. In situ operational testing of the sensor, channels, and RPS was performed during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5)

Channel components are designed to be operable under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The four trip channels for this protective function are physically separated and electrically isolated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) All trip channels of this protective functi on comply with this design requirement. Pressure switch contacts are routed in metal conduit from the sensor to the RPS panels in the control room. Each trip ch annel output relay uses two contacts in series within the RPS trip logic. One additional contact from each relay is wired to a common control room annunciator. Inte rlocks exist to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8)

For this protective function, selection of reactor vessel pressure is an appropriate variable to provide the required protective function.

LSCS-UFSAR 7.A.2-35 REV. 13 Capability for Sensor Checks (IEEE 279, Par. 4.9) Administrative controls are required to valve one sensor out of service at a time to perform a periodic test of the trip channel. During this test, operation of the sensor, its contacts, and the balance of the RPS trip channel may be confirmed.

Capability for Test and Calibration (IEEE 279, Par. 4.10) Once a pressure switch has been valved out of service under administrative control, confirmation of the pressure setpoint can be made by use of a variable source of pressure. As the setpoint is exceeded, the control room operator obtains annunciation of the trip and a computer record of the trip channel identification.

Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Individual sensors may be valved out of service under administrative control to perform the periodic test or maintenance. No automatic bypass provisions are includ ed in the design for this protective function.

Operating Bypasses (IEEE 279, Par. 4.12) This design requirement is not applicable to this protective function. Indication of Bypasses (IEEE 279, Par. 4.13)

The control room operator must exercise ad ministrative control over the valving out of service of one pressure switch at a time. Once a pressure switch has been removed from service and a simulated pressure has been introduced in excess of the setpoint, a control room annunciator indica tes the tripped condition and provides a typed record of the channel identification. Manual bypasses are also indicated in the control room on the ESF status indication panel as described in Section 7.8. Access to Means for Bypassing (IEEE 279, Par. 4.14) This design requirement is not applicable to this protective function. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this protective function.

LSCS-UFSAR 7.A.2-36 REV. 13 Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) Pressure switches for this protective function remain in a tripped condition whenever the trip setpoint is exceeded. It is necessary only that the process sensors remain in a tripped condition for a sufficient length of time to deenergize the scram contactors and open the seal-in contact of the trip logic associated with the scram contactors. Once this action is accomplished, the trip actuator logic initiates reactor scram regardless of the state of the process sensors that initiated the sequence of events. Manual Initiation (IEEE 279, Par. 4.17)

This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Access to the pressure switch setpoint adjustment is under the administrative control of plant personnel.

Identification of Protective Actions (IEEE 279, Par. 4.19) When the trip setpoint is exceeded for any one of the four pressure switches, a control room annunciator is initiated and a typed record provides an identification of the trip channel. Information Readout (IEEE 279, Par. 4.20) The data presented to the control room operator is both annunciation and relay position indication of reactor vessel high pressure scram trip and that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21)

Due to the one-to-one relationship of pressure switch and trip channel output relay, this design requirement is satisfied for this protective function. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection system," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. LSCS-UFSAR 7.A.2-37 REV. 13 7.A.2.1.10 CRD Low Charging Pressure Scram General Functional Requirement (IEEE 279, Par. 4.1) The purpose of the CRD low charging pressure scram is to assure that adequate pressure remains in the charging header to accomplish CRD rod insertion in the core when the mode switch is in Startup or Refuel. CRD low charging pressure setpoint is established such that sufficient accumulator pressure remains to accomplish a normal reactor scram. The selected scram setpoint is consistent with control rod minimum insertion times, thus obviating the need to derive different insertion times for other reference pressures. Single-Failure Criterion (IEEE 279, Par. 4.2) The CRD low charging pressure scram trip meets the single-failure criterion. The four pressure transmitters are connected to individual taps. The four process taps are separated and isolated via their physical connections to the charging header. Wiring from each transmitter to the control room relay cabinets is run in a separate conduit to maintain the electrical and physical separation of the trip channels. A separate trip relay is provided for each transmitter. The trip units and relays are separated from one another by cabinet wall barriers to maintain independence. Quality of Components and Modules (IEEE 279, Par. 4.3) Similar components have been previously used in many GE BWR power plants for this type of safety function.

Equipment Qualification (IEEE 279, Par. 4.4) Equipment qualification is required to es tablish that the component will perform in accordance with the functional requirements within the environment zone of the intended application. This LaSalle safety-related Class 1E equipment is to be qualified to the requirements of NU REG-0588, Category I (IEEE 344, 1975 and IEEE 323,1974).

In situ operational testing of these trip units and relays, channels, and the entire protection system will be performed at the project site during the preoperational test phase. LSCS-UFSAR 7.A.2-38 REV. 16, APRIL 2006 Channel Integrity (IEEE 279, Par. 4.5) The channel components are specified to operate under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The four trip channels are physically separa ted and electrically isolated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) The four trip channels comply with this design requirement. Each trip channel output relay uses two contacts (in series) within the RPS trip logic. One additional contact on each re lay is wired to a common annunciator in the control room, and another contact on each relay is wired to the process computer to provide a record of the channel trips. There is no single failure that will prevent proper functioning of this protection system when such action is required.

Derivation of System Inputs (IEEE 279, Par. 4.8) The measurement of CRD low charging pressure is an appropriate variable for this protective function. The desired variable is "available pressure" to accommodate a reactor scram. Capability for Sensor Checks (IEEE 279, Par. 4.9) During reactor operation, one of the four pressure transmitter trip channels at a time may be taken out of service to perform calibration. Operation of the transmitter and trip unit is confirmed separately in each channel. Capability for Test and Calibration (IEEE 279, Par. 4.10)

The test of the pressure transmitters associated with measurement of CRD low charging pressure can be performed during full power operation. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Individual pressure transmitters and/or trip units may be removed from service for maintenance or replacement. A single transmitter/trip unit for one channel may be removed at any time because the protective function is maintained by the other three channels. LSCS-UFSAR 7.A.2-39 REV. 13 Operation Bypass (IEEE 279, Par. 4.12) No bypasses exist for the CRD system low charging pressure scram. The CRD low charging-pressure scram is not active when the reactor mode switch is in the RUN position because the reactor vessel is at op erating pressure. It is also not required in the SHUTDOWN position because no control rods can be withdrawn in this position. Indication of Bypasses (IEEE 279, Par. 4.13) The low charging water pressure scram in the CRD system is not needed in the RUN or SHUTDOWN modes hence its subordination to the mode switch.

Manual bypasses are indicated in the control room on the ESF status indication panel as described in Section 7.8. Access to Means of Bypassing (IEEE 279, Par. 4.14) The reactor mode switch, which interlocks the CRD low charging water pressure scram to be active only in the STARTU P or REFUEL positions, is a key-locked switch located on the main control board. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this protective function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The trip units for pressure transmitters trip at the setpoint value and remain in a tripped condition as long as the pressure is less than the setpoint value. Hence, the trip channel output to the RPS trip logic remains in its tripped state whenever the setpoint is attained. It is necessary only that the process sensors remain in a tripped condition for a sufficient amount of time to deenergize the scram contactors and open the seal-in contact in the trip logic associated with the scram contactors. Once this action is accomplished, the trip actuator logic initiates reactor scram regardless of the state of the process sensors that initiated the sequence of events. Manual Initiation (IEEE 279, Par. 4.17)

This design requirement is not applicable to this protective function.

LSCS-UFSAR 7.A.2-40 REV. 13 Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) All access to setpoint adjustments, calibration controls, and test points is under administrative control. Identification of Protective Action (IEEE 279, Par. 4.19) Any one of the four pressure transmitters will initiate a control room annunciator when the trip setpoint is attained. Identification that the particular trip channel has attained its setpoint is accomplished via visual observation of the relay contacts at the RPS panels. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is both an annunciation and relay position indication of a CRD low charging pressure trip and that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21)

Because the charging pressure measurement and its one-to-one relationship between a given pressure transmitter and its associated trip channel output relay are inherently simple, the design facilitates maintenance of this protective function. 7.A.2.1.11 Manual Pushbutton Scram General Functional Requirement (IEEE 279, Par. 4.1) This design requirement is not applicable to RPS functions requiring manual intervention by the control room operator. Single-Failure Criterion (IEEE 279, Par. 4.2) The four manual scram pushbuttons are arranged in a one-out-of-two twice logic. The four manual scram pushbuttons are located on one panel in two groups of two with approximately 6 inches separation in each group to permit the operator to initiate protective action with one motion of one hand. The two groups of switches are separated by 3 or more feet, and the sw itch contact blocks are installed in metal barriers.

This logic arrangement satisfies the single-failure criterion.

LSCS-UFSAR 7.A.2-41 REV. 13 Quality of Components and Modules (IEEE 279, Par. 4.3) The manual scram switches are selected to be of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4)

Vendor qualification is required to prove that the switch performs in accordance with the requirements of this application. This qualific ation, augmented by existing field experience with this component in this application, serves to qualify the device for this application. In situ operational testing of the switch was performed during the preoperational test phase.

Channel Integrity (IEEE 279, Par. 4.5) The manual scram pushbutton is designed to be operable under the normal and abnormal conditions of environment, ener gy supply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The manual scram pushbutton is a channel component. The trip channels are physically separated and electrically isolated to comply with this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7)

There is no control interaction with the manual scram. Interlocks exist to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8) These design requirements are not applicable.

Capability for Sensor Checks (IEEE 279, Par. 4.9) These design requirements are not applicable. Capability for Test and Calibration (IEEE 279, Par. 4.10)

During reactor operation, one manual scram pushbutton may be depressed to test the proper operation of the switch. Once the RPS has been reset, the other switches may be depressed to test their operation on e at a time. For each such operation, a LSCS-UFSAR 7.A.2-42 REV. 16, APRIL 2006 control room annunciation is initiated an d the process computer identifies the pertinent trip. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Since actuation of one manual scram pushbutton places its RPS trip system in a tripped condition, it is in compliance with this design requirement. Operating Bypasses (IEEE 279, Par. 4.12) This design requirement is not applicable. Indication of Bypasses (IEEE 279, Par. 4.13) This design requirement is not applicable. Access to Means for Bypassing (IEEE 279, Par. 4.14) This design requirement is not applicable.

Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) Once the manual scram pushbuttons are depressed, it is ne cessary only to maintain them in that condition until the manual scram contactors have deenergized and open the seal-in contact of the manual trip logic associated with the scram contactors. At this point, the trip actuator logic initiates reactor scram regardless of the state of the manual scram pushbuttons. Manual Initiation (IEEE 279, Par. 4.17)

The four manual scram armed pushbuttons (one in each of the four RPS trip logics) comply with this design requirement. The logic for the manual scram is one-out-of-two twice. Failure of an automatic RPS function cannot prevent the manual portions of the system from initiating the protective action. The manual scram pushbuttons are implemented into the scram contactor coil circuits in order to minimize the dependence of manual scram capability on other equipment.

Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) This design requirement is not applicable. LSCS-UFSAR 7.A.2-43 REV. 16, APRIL 2006 Identification of Protective Action (IEEE 279, Par. 4.19) When any manual scram pushbutton is depr essed, a control room annunciation is initiated and the process computer identifies the tripped RPS trip logic.

Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is annunciation of manual pushbutton scram trip and relay position indication and annunciation that the scram logic has been actuated. System Repair (IEEE 279, Par. 4.21)

Due to the simplicity of the manual scram function, the design complies with this requirement. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinet is identified as part of the reactor protection system wiring. 7.A.2.1.12 Reactor System Mode Switch General Functional Requirement (IEEE 279, Par. 4.1)

When the reactor system mode switch has been placed in one of its four possible positions, it performs two protective functions: (l) selection of particular sensors for the scram functions, and (2) selection of appropriate bypasses for certain sensors. In addition to these protective functions, the mode switch performs certain interlock functions that are not associated with the RPS. Among these interlock actions are restrictions on control rod withdrawal and movement of refueling equipment. The mode switch consists of a single manu al actuator connected to four distinct switch banks. Each bank is housed within a fire-retardant cover. Contacts from each bank are wired to individual metallic terminal boxes in conduit. When the mode switch is set to a given position, it enables those protective functions pertinent to that mode of operation to perform the necessary automatic protective action. LSCS-UFSAR 7.A.2-44 REV. 13 Single-Failure Criterion (IEEE 279, Par. 4.2) The reactor system mode switch complies with the single-failure criterion. For the protective functions, each bank of the mode switch is associated with a specific RPS trip logic, and the banks of the mode switch have been physically separated and electrically isolated from one anothe r to meet this design requirement. Quality of Components and Modules (IEEE 279, Par. 4.3) The switch chosen for this application is of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4)

Vendor qualification is required to prove that this switch operates in accordance with the requirements of this application. In addition, General Electric Nuclear Energy Division conducts operational in situ tests of the mode switch during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5)

The mode switch is designed to be operable under normal and abnormal conditions of environment, energy supply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The mode switch banks are physically separated and electrically isolated to comply with this design requirement.

Control and Protection System Interaction (IEEE 279, Par. 4.7) The reactor system mode switch is used for protective functions and restrictive interlocks on control rod withdrawal and refueling equipment movement. Additional contacts of the mode switch are used to disable certain computer inputs when the alarms would represent incorrect information for the operator. No control functions are associated with the mode switch. Hence, the switch complies with this design requirement. The system interlocks to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8)

Since the mode switch is used to connect appropriate sensors into the RPS logic depending upon the operating state of the reactor, the selection of particular contacts to perform this logic operation is an appropriate means for obtaining the desired function. LSCS-UFSAR 7.A.2-45 REV. 13 Capability for Sensor Checks (IEEE 279, Par. 4.9) Operation of the mode switch may be ve rified by the operator during plant operation by performing certain sensor te sts to confirm proper RPS operation. Movement of the mode switch from one position to another is not required for these tests, since the connection of appropriate sensors to the RPS logic as well as disconnection of inappropriate sensors may be confirmed from the sensor tests. Capability for Test and Calibration (IEEE 279, Par. 4.10) Operation of the reactor system mode switch from one position to another may be employed to confirm certain aspects of the RPS trip channels during periodic test and calibration. During tests of the trip channels, proper operation of the mode switch contacts may be easily verified by noting that certain sensors are connected into the RPS logic and that any other sensors are disconnected from the RPS logic in an appropriate manner for the gi ven position of the mode switch. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11)

The use of four banks of contacts for the mode switch permits any RPS trip channel which is connected into the mode switch to be periodically tested in a manner that is independent of the mode switch itself. Consequently, for any stated position of the mode switch, a sufficient number of trip channels remain operable during the periodic test to fulfill this design requirement. Movement of the mode switch handle from one position to another disc onnects all redundant channels associated with the former position and connects all redundant channels pertinent to the latter position. In this manner, the mode switch complies with this design requirement. Operating Bypasses (IEEE 279, Par. 4.12) There are no operating bypasses that are imposed upon the RPS trip channels or RPS trip logic as the result of the position of the mode switch itself. For the scram discharge volume high water level trip channels, the operating bypass is imposed when the mode switch and another bypass switch are placed in specific positions. The main steamline isolation valve closure trip channels are bypassed only when the mode switch is in specified positions and when the reactor pressure is less than normal operating pressure. For each of these operating bypasses, four independent bypass channels are provided through the mode switch to assure that all of the protection system criteria are satisfied.

LSCS-UFSAR 7.A.2-46 REV. 13 Indication of Bypasses (IEEE 279, Par. 4.13) When the conditions for any single bypass channel are satisfied, the control room operator is notified by means of an a nnunciator for that particular set of bypass conditions. Bypassing is not allowed in the trip logic or actuator logic.

Access to Means for Bypassing (IEEE 279, Par. 4.14) The mode switch is a keylock switch under the administrative control of plant personnel. Since other controls must be operated or other sensors must be in an appropriate state to complete the operating bypass logic, the mode switch itself satisfies this requirement.

Multiple Setpoints (IEEE 279, Par. 4.15) Operation of the mode switch from one position to another imposes different RPS trip channels into the RPS logic in accord ance with the reactor conditions implied by the given position of the mode switch. This action does not influence the established setpoint of any given RPS trip channel, but merely connects one set of channels as another set is disconnected. Consequently, the mode switch meets this design requirement. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The function of the mode switch is to pr ovide appropriate RPS trip channels for the RPS trip logic on a steady-state basis for each of four given reactor operating states: SHUTDOWN, REFUEL, STARTUP, and RUN. Protective action, in terms of the needed transient response, is derived from the other portions of the trip channels independent of the mode switch. Hence, the mode switch does not influence the completion of protective action in any manner. Manual Initiation (IEEE 279, Par. 4.17) Movement of the mode switch to the SHUTDOWN position initiates reactor shutdown. The design of the manual ac tuation is such that a minimum of equipment is employed to provide manual ac tuation directly to the manual trip logic and scram contactors. No single failure in the manual or automatic portions of the system can prevent either a manual or automatic scram. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18)

This design requirement is not applicable to the mode switch protective function. LSCS-UFSAR 7.A.2-47 REV. 16, APRIL 2006 Identification of Protective Actions (IEEE 279, Par. 4.19) Identification of the mode switch in SHUTDOWN position scram trip is provided by the manual scram, the process computer, and the mode switch in SHUTDOWN annunciator.

Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is ann unciation when the mode switch has been placed in shutdown position. System Repair (IEEE 279, Par. 4.21)

The mode switch design complies with this design requirement. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinet is identified as part of the reactor protection system wiring. 7.A.2.1.13 Scram Discharge Volume High Water Level Trip Bypass General Functional Requirement (IEEE 279, Par. 4.1) Since the discharge volume high water level trip is bypassed by manual operation of a bypass switch and the reactor system mode switch, the requirement for automatic response is not meaningful for the bypass channels. This bypass function is provided to permit manual reset of the RPS following scram. Administrative control must be applied to remove the bypass on ce the water has been drained from the instrument volume associated with the discharge piping. Single-Failure Criterion (IEEE 279, Par. 4.2) Since this bypass requires manual oper ation of a bypass switch and the mode switch to establish four bypass channels, the design of the bypass function complies with this design requirement. For the bypass switch, a single operator connects to four physically and electrically separated bl ocks of switch contacts within the switch body. Wiring from the contacts is routed in conduit to separate metallic terminal boxes. One set of switch contacts, in conjunction with mode switch contacts, is used to energize each trip channel bypass relay when the bypass condition is desired.

LSCS-UFSAR LU2000-060 7.A.2-48 REV. 14, APRIL 2002 There is no single failure of this bypass function that will satisfy the condition necessary to establish the by pass condition. Hence, this function complies with the single-failure criterion. Quality of Components and Modules (IEEE 279, Par. 4.3)

The bypass switch is of high reliability and quality. Equipment Qualification (IEEE 279, Par. 4.4) Vendor qualification is required to prove that the switch performs in accordance with the requirements of this application. This qualific ation, augmented by existing field experience with this component in this application, serves to qualify the device for this application. In situ operational testing of the by pass switch was performed during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5)

The bypass switch and associated bypass channel relays are designed to be operable under normal and abnormal conditions of environment, energy supply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The bypass circuitry complies with this design requirement.

Sufficient physical separation and electrical isolation exists to assure that the bypass channels are satisfactorily independ ent. Moreover, the conditions for bypass have been made quite stringent in order to provide additional margin. Control and Protection System Interaction (IEEE 279, Par. 4.7)

This bypass function complies with this design requirement. For each trip channel bypass relay, two contacts are used in the bypass logic. One contact of each relay is also wired to a common annunciator in the control room and one contact is wired to the control rod bl ock circuitry to prevent rod withdrawal whenever the trip channel bypass is in effect.

There are no control system interactions with these bypass relay outputs. Interlocks exist to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. LSCS-UFSAR 7.A.2-49 REV. 16, APRIL 2006 Derivation of System Inputs (IEEE 279, Par. 4.8) Due to the manual action required for this bypass function, this design requirement is satisfied by operator interaction with a single bypass switch and the mode switch. Capability for Sensor Checks (IEEE 279, Par. 4.9) During plant operation in the startup and run modes, imposition of this bypass function is inhibited by the reactor system mode switch. Under these circumstances, operation of the bypass swit ch should not produce a bypass condition for any single trip channel, and this fact can be determined from the control room annunciator, a visual inspection of the bypass relays, and the process computer indication of any discharge volume high water level trip channel placed in a tripped condition prior to the bypass switch test. Capability for Test and Calibration (IEEE 279, Par. 4.10) In the startup and run modes of plant op eration, the preceding procedure may be used to confirm that trip channels are no t bypassed as a result of operation of the bypass switch. In the shutdown and refuel modes of plant operation, a similar procedure may be utilized to produce bypassing of all four trip channels. Due to the discrete "ON-OFF" nature of the bypass function, calibration is not meaningful.

Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Individual bypass of the four trip channel bypass networks is not provided in the design. Due to the stringent conditions required to achieve trip channel bypass, the protection system trip channels are not bypassed by the bypass switch function during operation of the plant in the startup or run modes.

Operating Bypasses (IEEE 279, Par. 4.12) The discharge volume high water trip channels are bypassable only in the shutdown and refuel modes of operation. The by pass is manually initiated and must be manually removed to commence control rod withdrawal. Since the bypass is used for RPS reset after a reactor scram, automatic removal of the bypass is not a meaningful design requirement.

Indication of Bypasses (IEEE 279, Par. 4.13) Bypass of any single discharge volume high water level trip channel produces a control room annunciation.

LSCS-UFSAR 7.A.2-50 REV. 14, APRIL 2002 Access to Means for Bypassing (IEEE 279, Par. 4.14) Both switches needed to achieve this bypa ss are located on the same panel and both require keylock operations by plant personnel. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this trip bypass function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) This bypass function is required only after a reactor scram when the discharge volume has accumulated water and must be drained. If the mode switch is placed in the shutdown position so as to effect the bypass function, the reactor scrams to satisfy the protective action completion requirement. Consequently, this bypass function permits completion of protective action once it is initiated and satisfies this design requirement. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this trip bypass function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) This design requirement is not applicable to this trip bypass function.

Identification of Protective Actions (IEEE 279, Par. 4.19) The bypass function does not initiate protective action; hence, two control room annunciators are provided to indicate the bypass condition from one or more bypass channels. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is ann unciation when the discharge volume high water level trip has been bypassed. System Repair (IEEE 279, Par. 4.21) The design of this bypass function comp lies with this design requirement.

LSCS-UFSAR 7.A.2-51 REV. 13 Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System", and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.14 Main Steamline Isolat ion Valve Closure Trip Bypass General Functional Requirement (IEEE 279, Par. 4.1) The main steamline isolation valve closure trip bypass function is a semiautomatic bypass in that the reactor system mode switch must be placed in the SHUTDOWN, REFUEL, or STARTUP position in order to obtain the trip bypass. This bypass is provided to permit the RPS to be manually reset when the plant is operating in one of the three aforementioned modes with th e isolation valves closed. The automatic removal of this bypass by movement of the mode switch to the RUN position immediately institutes the isolation valve trip as a protective function to the RPS. Single-Failure Criterion (IEEE 279, Par. 4.2) The bypass function complies with the single-failure criterion. One contact from each bank of the mode sw itch energizes one of four bypass relays whose contacts are connected into the RPS trip logic. The relationship of these bypass relays to the RPS trip channels is on a one-to-one basis. Consequently, four particular bypass relays must be energized in order to bypass the protective function, hence no single failure in the bypass circuitry will interfere with the protective action of the trip channels. Quality of Components and Modules (IEEE 279, Par. 4.3) The circuit components are of high quality and reliability.

Equipment Qualification (IEEE 279, Par. 4.4) These same components have been described in earlier portions of this report, and the basis for equipment qualification is identical in all respects. Channel Integrity (IEEE 279, Par. 4.5) The channel components are designed to be operable under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents.

LSCS-UFSAR 7.A.2-52 REV. 13 Channel Independence (IEEE 279, Par. 4.6) The four bypass channels comply with this design requirement. One contact from each bank of the mode switch is physically separated and electrically isolated from the others to satisfy this requirement. The four bypass relays are independent of one another and are physically separated and electrically isolated from one another. Control and Protection System Interaction (IEEE 279, Par. 4.7) This bypass function has no interaction with any control system in the plant. Two contacts of each relay are used to initiate a control room annunciator for this bypass function. Interlocks exist to control systems only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8) The instrumentation furnished for this bypass function complies with this design requirement. The main steamline isolation valve closure trip results from valve closure whenever the reactor is operating in the RUN mode. This constraint has been selected to permit manual reset of the RPS under sp ecified conditions whenever the main steamline isolation valves ar e partially or fully closed.

Capability for Sensor Checks (IEEE 279, Par. 4.9) Testing of the entire bypass circuit is possible in the SHUTDOWN, REFUEL, or STARTUP positions of the mo de switch. Confirmation that the bypass is not in effect in the RUN mode may be made at operating conditions. Capability for Test and Calibration (IEEE 279, Par. 4.10) Testing of the bypass circuit can be accomplished only when the mode switch is not in the run position. Hence, this test may be performed in the startup operating phase. Since it can be confirmed that the bypass is not in effect when operating in the RUN mode, the suggested tests are adequate to confirm proper bypass status during plant operation. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) LSCS-UFSAR 7.A.2-53 REV. 16, APRIL 2006 During normal plant operation, the bypass circuit is not in operation, and its circuitry is in a passive, deenergized state. Removal of the bypass capability is permitted during plant operation since it has no effect upon plant safety. Under plant conditions where the bypass is operable, one channel may be removed from service for test purposes without causing a reactor scram or influencing any aspect of reactor safety.

Operating Bypasses (IEEE 279, Par. 4.12) This operating bypass complies with this design requirement. Whenever permissive conditions for bypass are not met, the bypass is automatically removed. Four channels are provided for this bypass to assure compliance with the IEEE 279 requirements. Indication of Bypasses (IEEE 279, Par. 4.13) Whenever one of the four bypass channels is placed in the bypass state, a control room annunciator is initiated. If the associ ated protective trip channel were in its tripped state at this time, the process computer identifies the return to normal condition for the trip. Access to Means for Bypassing (IEEE 279, Par. 4.14) The mode switch is under the keyloc k supervision of plant personnel. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this trip bypass function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) Under ordinary circumstances, this bypass function will have no effect upon the main steamline isolation valve closure trip.

If the trip channels assume the tripped condition for a sufficient time to deenergize the scram contactors and open the seal-in contact of the scram contactors in the RPS trip logic prior to initiation of two or more specific trip bypass channels, the reactor will scram. Since this delay time is on the order of 13 msec between opening of the process sensor contact and opening of the seal-in contact of the scram contactor, this transition region is inconsequential.

Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this trip bypass function. LSCS-UFSAR 7.A.2-54 REV. 13 Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) This design requirement is not applicable to this trip bypass function. Identification of Protective Actions (IEEE 279, Par. 4.19)

This bypass function does not initiate protective actions, therefore, one control room annunciator has been provided to indicate the bypass condition from one or more bypass channels. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is ann unciation when the MSIV closure trip has been bypassed. System Repair (IEEE 279, Par. 4.21) The design of this bypass function comp lies with this design requirement. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.15 Turbine Stop Valve and Control Valve Trip Bypass General Functional Requirement (IEEE 279, Par. 4.1) The turbine stop valve and control valve trip bypass senses turbine first-stage pressure by means of two taps and four pressure switches so as to activate a trip bypass if the turbine is operating below 25% of rated core thermal power for the plant. This bypass is provided to permit continued reactor operation at low power levels when the turbine valves are closed. The setpoint of less than 25% of rated core thermal power for actuation of this bypass is required to meet transient analysis assumptions which take into account the resultant consequences of a bypassed turbine RPS trip as a function of reactor operating power. Removal of this bypass is automatically accomplished as the reactor power and turbine first-stage pressure reach the setpoint value equivalent to 25% of rated core thermal power.

Single-Failure Criterion (IEEE 279, Par. 4.2) This bypass function complies with the single-failure criterion. LSCS-UFSAR 7.A.2-55 REV. 14, APRIL 2002 Two pressure switches are connected to ea ch of two turbine first-stage pressure taps. Cables from the contacts of the pressure switches are routed in conduit to the RPS cabinets in the control room. The logic configuration for the bypass is the standard one-out-of-two twice arrangement such that a single bypass channel is associated with a single trip channel for st op valve closure and a single trip channel for control valve fast closure.

Each pressure switch contact is connected to a single bypass channel output relay. No single failure of this bypass circuitry will interfere with the normal protective action of the RPS trip channels. Quality of Components and Modules (IEEE 279, Par. 4.3) The four pressure switches selected for th is bypass function are of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4) These same components have been described in earlier portions of this report, and the basis for equipment qualification is identical in all respects. Channel Integrity (IEEE 279, Par. 4.5) The channel components are designed to be operable under normal and abnormal conditions of environment, energy su pply, malfunctions, and accidents.

Channel Independence (IEEE 279, Par. 4.6) The four bypass channels comply with this design requirement. One contact from each pressure switch is connected to one bypass relay in the RPS cabinets. The pressure switches and taps are physically separated and their wiring is electrically isolated to provide channel independence. The four bypass relays are independent of one another and are physically separated to meet this design requirement. Control and Protection System Interaction (IEEE 279, Par. 4.7) This bypass function has no interaction with any control system in the plant. Two output relay contacts in series are used in the RPS trip logic and one additional contact from each relay is used to initiate a control room annunciator for this bypass function.

LSCS-UFSAR 7.A.2-56 REV. 16, APRIL 2006 Derivation of System Inputs (IEEE 279, Par. 4.8) Since the intent of this bypass is to permit continued reactor operation at low power levels when the turbine stop or control va lves are closed, the selection of turbine first-stage pressure is an appropriate variable for this bypass function. In the power range of reactor operation, turbine first-stage pressure is essentially linear with increasing reactor power. Conseque ntly, this variable pr ovides the desired measurement of power level. Capability for Sensor Checks (IEEE 279, Par. 4.9) Testing of individual pressure switches is permitted during plant operation by valving one pressure switch out of service at a time under administrative control. A variable pressure source may then be introduced to the switch to confirm the setpoint value and switch operations. Capability for Test and Calibration (IEEE 279, Par. 4.10) Administrative control must be exercised to valve one pressure switch out of service for the periodic test. During this test, a variable pressure source may be introduced

to operate the switch at the setpoint value. When the condition for bypass has been achieved on an individual sensor under test, the control room annunciator for this bypass function is initiated. If the RPS trip channel associated with this sensor were in its tripped state, the process computer identifies the return to normal state for the RPS trip logic. When the plant is operating at greater than or equal to 25% of rated core thermal power, testing of the turbine stop valve and control valve fast closure trip channels confirms that th e bypass function is not in effect. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) During normal plant operation at greater than or equal to 25% of rated core thermal power, the bypass circuitry is in its passive, deenergized state. At these conditions, removal of the bypass for periodic test is permitted si nce it has no effect on plant safety. Under plant conditions below 25% of rated core thermal power, one bypass channel may be removed from service at a time without initiating protective action or affecting plant safety. This removal from service is accomplished under administrative control of plant personnel. Operating Bypasses (IEEE 279, Par. 4.12) The turbine stop valve and control valve trip bypass comply with this design requirement. When the turbine first stage pressure reaches a level equivalent to 25% of rated core thermal power, the four pressure switches respond and open the bypass circuit in the RPS trip logics. LSCS-UFSAR 7.A.2-57 REV. 16, APRIL 2006 Indication of Bypasses (IEEE 279, Par. 4.13) Whenever one of the four bypass channels is placed in the bypass state, a control room annunciator is initiated. If the associ ated RPS trip channel were in its tripped state at this time, the process computer identifies the return to normal condition of this trip. Access to Means for Bypassing (IEEE 279, Par. 4.14) Under normal operating conditions, all fo ur bypass channels are in operation and are automatically removed from service as reactor power reaches the setpoint equivalent to 25% of rated core thermal power and are automatically reinstated as reactor power is reduced below this same setpoint. During periodic test of each

bypass channel, one sensor is removed from service under administrative control. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable to this trip bypass function. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) This bypass function is placed into effect only when the turbine first-stage pressure is at or below a level corresponding to 25% of rated core thermal power. For plant operation above this setpoint, the trip channels initiate protective action once the scram contactors have deenergized and opened the seal-in contact associated with the RPS trip logic. Since the required time to open the seal-in contact is on the order of 13 msec, the bypass pressure switches will not respond quickly enough to prevent completion of the protective action. Manual Initiation (IEEE 279, Par. 4.17) This design requirement is not applicable to this trip bypass function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Administrative control is required to perform any adjustments upon the pressure switches for this bypass function. Identification of Protective Actions (IEEE 279, Par. 4.19) This bypass function does not initiate protective actions. Therefore, one control room annunciator has been provided to in dicate the bypass condition from one or more bypass channels. LSCS-UFSAR 7.A.2-58 REV. 13 Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is annunciation when the control valve fast closure and turbine stop valve trips have been bypassed. System Repair (IEEE 279, Par. 4.2l) The design of this portion of the RPS complies with this design requirement. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.16 Neutron Monitoring System Trip Bypass This bypass is discussed in Subsection 7.2.2.5.

7.A.2.1.17 RPS Trip Logic, Trip Ac tuators, and Trip Actuator Logic General Functional Requirement (IEEE 279, Par 4.1) All of the RPS "A1" trip channels terminate in the RPS "A1" trip logic, which in turn, connects to the RPS trip actuators and trip actuator logic to control the control rod drive scram solenoids. Once the trip logic has been signaled by a protection system trip channel, the series contact string is open circuited to permit deenergization of the trip actuators. The trip actuators then remain in that state until manually reset. Four trip logic strings are provided in the reactor protection system in a one-out-of-two twice arrangement. Hence, the RPS trip logic and trip actuator circuitry comply with this design requirement. Single-Failure Criterion (IEEE 279, Par. 4.2) Those portions of the RPS downstream of the trip channels comply with this design requirement. Any postulated single failure of a given trip logic does not affect the remaining three trip logics. Similarly, any single failure of a trip actuator does not affect the remaining trip actuators, and any single failure of one trip actuator logic does not affect the other trip actuator lo gic networks. The cabling associated with one trip logic is routed in a conduit that is physically separated from similar cabling associated with the other trip logics. Cabling from the trip actuator logic to the scram solenoid groups is rout ed in individual conduits to comply with this design requirement. Because any individual control rod may fail to operate from either the LSCS-UFSAR 7.A.2-59 REV. 13 "A" or "B" solenoid valves, wiring of these two solenoids for one control rod is routed together within a single conduit. Quality of Components and Modules (IEEE 279, Par. 4.3) The RPS trip logic consists of series-connected relay contacts from the trip channel output relays. The relay is of high quality and reliability. The RPS trip actuator logic consists of relay contacts connected in a specific arrangement from the trip actuators. The trip actuators are of high quality and reliability. Equipment Qualification (IEEE 279, Par. 4.4) At the component level, vendor qualification is required to prove that these parts operate in accordance with the requiremen ts of the purchase specification. This qualification, augmented by field experience with these components in this application, serves to qualify the components. Channel Integrity (IEEE 279, Par. 4.5) Even though the channel interpretation is not appropriate to the RPS trip logic, the trip actuators and the trip actuator logic are designed to be operable under normal and abnormal conditions of environment, energy supply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) This design requirement is not applicable. Control and Protection System Interaction (IEEE 279, Par. 4.7) The four RPS trip logic strings are totally separate from any other plant system. The RPS trip actuators utilize the power cont acts of the scram contactors to provide the trip actuator logic and the seal-in co ntact of the trip actuator. They utilize auxiliary contacts for control room annuncia tion and initiation of the backup scram valves. Due to the design of this output and separation of the cabling, there is no interaction with control systems of the plant. The trip actuator logic has no interaction with any other plant system, and the scram solenoids are physically separate and electrically isolated from the other portions of the control rod drive hydraulic control unit.

Consequently, this design requirement is met by this equipment. The system interlocks to control systems only through isolation devices such that no failure or LSCS-UFSAR 7.A.2-60 REV. 16, APRIL 2006 combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8) This design requirement is not applicable.

Capability for Sensor Checks (IEEE 279, Par. 4.9) This design requirement is not applicable. Capability for Test and Calibration (IEEE 279, Par. 4.10)

The previously described trip logic test switch permits each individual trip logic, trip actuator, and trip actuator logic to be tested on a periodic basis. Testing of each process sensor of the protection system also affords an opportunity to verify proper operation of these components. Calibration of the time response of the trip channel relays and trip actuators may be accomp lished by connection of external test equipment to test points provided in the RPS control room panels in addition to information stored in the process computer. Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) This design requirement is not applicable. Operating Bypasses (IEEE 279, Par. 4.12)

This design requirement is not applicable. Indication of Bypasses (IEEE 279, Par. 4.13) This design requirement is not applicable. Access to Means for Bypassing (IEEE 279, Par. 4.14) This design requirement is not applicable. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable.

Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) The interface of the RPS trip logic and the trip actuators assures that this design requirement is accomplished. The trip actuator is normally energized and is sealed LSCS-UFSAR 7.A.2-61 REV. 16, APRIL 2006 in by one of the power contacts to the trip logic string. Once the trip logic string has been open-circuited as a result of a proc ess sensor trip channe l becoming tripped, the scram contactor seal-in contact opens in approximately 13 msec. At this point in time, the completion of protection action is directed without regard to the state of the initiating process sensor trip channel.

Manual reset by the operator bypasses the seal-in contact to permit the RPS to be reset to its normally energized state when all process sensor trip channels are within their normal (untri pped) range of operation. Manual Initiation (IEEE 279, Par. 4.17) The trip actuator logic may be placed in a tripped condition from either one of the two trip logics (i.e., Al or A2) associated with one RPS trip system. This action can be accomplished with the trip logic test switch, manual scram pushbuttons, or reactor system mode switch. As a result, the design meets this design requirement. No single failure in the manual or automatic portions of the system can prevent either a manual or automatic scram. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) This design requirement is not applicable. Identification of Protective Actions (IEEE 279, Par. 4.19) Four control room annunciators are provided to identify the tripped portions of the RPS in addition to the previously de scribed trip channel annunciators:

a. A1 or A2 trip logics tripped, and
b. B1 or B2 trip logics tripped.

These same functions are connected through independent auxiliary contacts of the scram contactors to the process computer to provide a record of the relay operations. Information Readout (IEEE 279, Par. 4.20) The data presented to the operator is both annunciation and relay position indication that the RPS trip logic has been actuated. System Repair (IEEE 279, Par. 4.21) The design of this portion of the RPS complies with this design requirement.

LSCS-UFSAR 7.A.2-62 REV. 14, APRIL 2002 Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.18 Reactor Protection System Reset Switch General Functional Requirement (IEEE 279, Par. 4.1) The RPS reset switch is under the administrative control of the control room operator. Since the reset switch is introduced in parallel with the trip actuator seal in contact through auxiliary relay contacts, failure of the reset switch cannot prevent initiation of protective action when a sufficient number of trip channels assumes the tripped condition. Hence, the automatic initiation requirement for protective action is not invalidated by this reset switch. Single-Failure Criterion (IEEE 279, Par. 4.2)

The RPS reset switch and associated logic comply with this design requirement. The reset switch is constructed with a si ngle operator and four physically and electrically separated contact blocks. The wires from the contact blocks go through conduit to metallic terminal boxes. Proper operation of the reset switch and its auxiliary relays can be ascertained during periodic test of the RPS or whenever any particular channel is returned from a tripped state to the normal untripped condition. Failure would be noted as an automatic reset of specific trip actuators (depending upon the cause of failure) rather than remaining in a deenergized state until manually reset. Since opening of the process sensor trip ch annel is the initiating event for reactor scram, failure of the reset switch will not prevent deenergization of the trip actuators during the time interval that the process actually exceeds the trip setpoint. Quality of Components and Modules (IEEE 279, Par. 4.3) The RPS reset switch chosen for this application is of high reliability and quality. Equipment Qualification (IEEE 279, Par. 4.4) Vendor certification is required that the selected switch performs in accordance with the purchase specification requirements for this application. In addition, in LSCS-UFSAR 7.A.2-63 REV. 13 situ operational tests are performed on the switch during the preoperational test phase. Channel Integrity (IEEE 279, Par. 4.5) The RPS reset switch is not a trip channe l component; rather, its auxiliary relays are elements in the individual RPS trip logic strings. Nevertheless, it functions properly under normal and abnormal conditions of environment, energy supply, malfunctions, and accidents. Channel Independence (IEEE 279, Par. 4.6) The four RPS reset channels to the trip actuators are physically separated and electrically isolated. Control and Protection System Interaction (IEEE 279, Par. 4.7) Switch contacts of the RPS reset switch are used only to control auxiliary relays. Contacts from the relays are used only in the trip actuator coil circuit. Consequently, this RPS function has no interaction with any other system in the plant. Interlocks exist to control system s only through isolation devices such that no failure or combination of failures in the control system will have any effect on the reactor protection system. Derivation of System Inputs (IEEE 279, Par. 4.8) This design requirement is not applicable.

Capability for Sensor Checks (IEEE 279, Par. 4.9) This design requirement is not applicable. Capability for Test and Calibration (IEEE 279, Par. 4.10)

Operation of the reset switch following a trip of one RPS trip system confirms that the switch is performing its intended function. Operation of the reset switch following trip of both RPS trip systems confirms that all portions of the switch and relay logic are functioning properly since half of the control rods are returned to a normal state for one actuation of the switch. Channel Bypass or Removal From Operation (IEEE 279, Par. 4.11) This design requirement is not applicable.

LSCS-UFSAR 7.A.2-64 REV. 13 Operating Bypasses (IEEE 279, Par. 4.12) This design requirement is not applicable. Indication of Bypasses (IEEE 279, Par. 4.13)

This design requirement is not applicable. Access to Means for Bypassing (IEEE 279, Par. 4.14) This design requirement is not applicable. Multiple Setpoints (IEEE 279, Par. 4.15) This design requirement is not applicable. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16) Under ordinary circumstances, the process sensor initiating reactor scram remains in a tripped condition for a significant length of time (i.e., 2 to 10 seconds minimum) and causes the trip actuators to deenergize and open the seal-in contact in the trip logic. The seal-in contact is opened approximately 13 msec after the process sensor trip channel is placed in the tripped state, and the scram discharge volume high water level sensors will be in a tripped state within approximately 2 seconds. Consequently, the trip actuators will be commanded to deenergize, (1) as long as the process sensor trip channels remain trippe d, or (2) as long as the seal-in contact remains open and is not bypassed by gross failure of the RPS reset switch, or (3) as long as the scram discharge volume high water level trip channels or any other RPS trip channels remain in a tripped condition. As a result, failure of the RPS reset switch in such a manner as to bypass the seal-in contacts of the trip actuators does not affect reactor shutdown in any manner. Manual Initiation (IEEE 279, Par. 4.17) Since the RPS reset function does not initiate protective action, the design complies with this design requirement. No single failure in the manual or automatic portions of the system can prevent either a manual or automatic scram. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18)

This design requirement is not applicable.

LSCS-UFSAR 7.A.2-65 REV. 13 Identification of Protective Actions (IEEE 279, Par. 4.19) Reset of the RPS is not a protective action

however, proper operation of the switch may be inferred from removal of annunciate d and indicated conditions as the RPS returns to its normally energized state.

Information Readout (IEEE 279, Par. 4.20) The information presented to the control room operator is illustrated in the preceding paragraph. System Repair (IEEE 279, Par. 4.21)

The design of this protective function complies with this design requirement. Identification of Protection Systems (IEEE 279, Par. 4.22) Each system cabinet is marked with the wo rds "Reactor Protection System," and the particular redundant portion is listed on a distinctively colored marker plate. Cabling outside the cabinets is identified as part of the reactor protection system wiring. 7.A.2.1.19 Alternate Rod Insertion (ARI) System General Functional Requirements Conformance The ARI system is designed to increase the reliability of the reactor scram system in an ATWS event. Low reactor water level and/or high reactor pressure initiate the ARI system to provide a reactor scram. The four channel trip logic is initiated by RPV high pressure and/or RPV low water level in a 1:2:2 configuration to actuate the ARI scram solenoid valves. A trip in either of the two divisions results in a reactor scram by energizing th e ARI scram solenoid valves. Test switches and indicating lights are prov ided for testing the ARI control logic. The sensors and logics of the ARI system are not part of the CRD or other plant process control system. Therefore, the failure of process control systems instrumentation will not affect the ARI system. The ARI system is designed to meet safety grade requirements. The redundancy of Class 1E power supplies assures the reliable operation of the ARI control logic and actuation of the ARI solenoid operated valves.

Operator verification that reactor scram through the ARI system has occurred may be made by observing the following indications:

a. ARI solenoid operated valves position indication b. ARI initiation annunciator Div. 1 LSCS-UFSAR 7.A.2-66 REV. 13 c. ARI initiation annunciator Div. 2 d. Indicating light for ARI initiation Div. 1 e. Indicating light for ARI initiation Div. 2 Specific Requirement Conformance

Automatic initiation of protection system action, reliability, testability, independence, and separation have been design ed into this system. The design is in conformance with the followi ng codes and standards. Institute of Electrical and Electronics Engineers (IEEE) Standards

a. 279-1971, Criteria for Protection Sy stems for Nuclear Power Generating Stations b. 308-1974, Criteria for Class 1E Power Systems for Nuclear Power Generating Stations c. 323-1974, Qualifying Class 1E Equipment for Nuclear Power Generating Stations d. 338-1975, Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Station Class 1E Power and Protection Systems
e. 344-1975, Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations
f. 379-1977, Standard Application of the Single Failure Criteria to Nuclear Power Generating Station Class 1E Systems
g. 384-1977, Standard Criteria for Inde pendence of Class 1E Equipment and Circuits General Functional Requirement (IEEE 279-1971 paragraph 4.1)

The ARI trip logic is initiated by RPV high pressure and/or RPV low water level in a 1:2:2 configuration to actuate the ARI scram solenoid valves. Each divisional control logic consists of two reactor water level and two reactor pressure channels with individual sensors. The reactor water level trip protects the core from being uncovered as a result of falling water level in the vessel and the high reactor pressure trip is to limit the positive pressure effect on the reactor pressure vessel. If either of these variables exceeds its setpoint, a trip signal is generated.

LSCS-UFSAR 7.A.2-67 REV. 14, APRIL 2002 Single Failure Criterion (IEEE 279-1971 paragraph 4.2) The design complies. Quality of Components and Modules (IEEE 279-1971 paragraph 4.3)

The division logic circuitry devices selected for the ARI system are high quality and high reliability type devices. These devices are qualified per IEEE 323-1974 and IEEE 344-1975. Equipment Qualification (IEEE 279-1971 paragraph 4.4) At the component level, vendor qualification is required that these parts will operate in accordance with the requiremen ts of the purchase specification. All components, modules and subassemblies in the ARI system are qualified to Industry Standards IEEE 323-1974 and IEEE 344-1975 (See UFSAR 3.10).

Channel Integrity (IEEE 279-1971 paragraph 4.5) The logic system complies with this requirement.

Channel Independence (IEEE 279-1971 paragraph 4.6) The two divisional arrangement meet this requirement. Control and Protection System Interaction (IEEE 279-1971 paragraph 4.7)

The two divisional logic elements are totally separated from any nonprotection system. Electrical cable separation and mechanical separation of the electrical devices on the ARI system assures that no interaction exists with any other plant control systems. The ARI control logic is not electrically interlocked with other plant control systems. Therefore, the fa ilure of other plant control systems will have no effect on the ARI system. Exce ption of course is obvious for multiple mechanical failures of CRD drives or HCU's that support each CRD hydraulically and pneumatically. Derivation of System Inputs (IEEE 279-1971 paragraph 4.8) The design complies with this requirement. Capability for Sensor Chec k (IEEE 279-1971 paragraph 4.9) The reactor vessel low water level and reactor high pressure transmitters can be checked for operability by valving out the transmitter from the impulse lines and applying a test pressure source. This veri fies the operability of each sensor over its LSCS-UFSAR 7.A.2-68 REV. 14, APRIL 2002 calibration range. The trip units mounted in the auxiliary electrical equipment room are calibrated separately by introd ucing a calibration signal source and verifying the setpoint. Capability for Test and Calibration (IEEE 279-1971 paragraph 4.10)

The ARI control logic can be tested during plant operation. Test switches can be activated from the auxiliary electrical equipment room to prevent opening the ARI solenoid valves inadvertently. Indica ting lights and the annunciator inform the operator that an ARI channel test is in progress and that control logic circuits are energized. The reactor water level and reactor pressure sensors for the ARI system may be tested by cross comparison of channels. In addition, each channel may be calibrated individually for its process input by introducing an electronic calibration signal into the trip unit to verify proper trip actuatio

n. The change of state of the trip device may be observed by visual inspection of the trip device indicating light on the logic cabinet. Calibration of the sensing elem ents may be performed at any operational condition under proper administrative controls. The transmitters must be valved out of service for calibratio n against a pressure source.

Channel Bypass or Removal from Operation (IEEE 279-1971 paragraph 4.11) Valving out of a sensor for calibration ca n be indicated by manual actuation of the out-of-service indicator. A trip unit in ca libration causes automatic actuation of the out-of-service indicator. Calibration of a single transmitter or trip unit causes a channel logic trip, but not an ARI system initiation.

Operating Bypasses (IEEE 279-1971 paragraph 4.12) This design requirement is not applicable. Indication of Bypasses (IEEE 279-1971 paragraph 4.13)

This design requirement is complied with by indication of test bypasses. Access to Means for Bypassing (IEEE 279-1971 paragraph 4.14) This design requirement is complied with by operator control of test program. Multiple Setpoint (IEEE 279-1971 paragraph 4.15) This design requirement is not applicable. LSCS-UFSAR 7.A.2-69 REV. 16, APRIL 2006 Completion of Protective Action Once it is Initiated (IEEE 279-1971 paragraph 4.16) Once the ARI system is tripped, the ARI solenoid operated valves will be energized to initiate a reactor scram. An annunciato r for each division is provided in the control room which informs the operator that the logic has tripped the ARI system. An indicating light also lights when the ARI logic is tripped. The automatic and manual actuation signals to the ARI valves seal-in for 2 minutes to assure that all control rods have time to fully insert. An indicating light is provided to indicate to the operator that manual reset of the ARI logic is permissive. Manual Initiation (IEEE 279-1971 paragraph 4.17)

The unique manual ARI switches are provided for each divisional control logic. Failure of an automatic ARI initiation cannot prevent the manual portions of the system from initiating the protective action. In order to avoid inadvertent manual trip of the ARI system, two manual scram switches in each divisional control logic must be activated to permit manual initiati on of the ARI function. These switches are located in close proximity to the existing RPS manual scram pushbuttons.

Access to Setpoint Adjustments, Calibration and Test Points (IEEE 279-1971), paragraph 4.18 During reactor operation, access to setpoint adjustments, calibration controls, and test points for the following ARI trip variables is under the administrative control of plant supervisory personnel:

a. Reactor vessel low water level trip b. Reactor vessel high pressure trip Identification of Protective Actions (IEEE 279-1971, paragraph 4.19)

Control annunciators are provided to id entify the tripped portions of ARI:

a. Division 1 ARI initiated. b. Division 2 ARI initiated.

These functions are connected to the proce ss computer to provide a record of the system status. Information Readout (IEEE 279-1971, paragraph 4.20) The information presented to the control room operator satisfies this design requirement. LSCS-UFSAR 7.A.2-70 REV. 13 System Repair (IEEE 279-1971, paragraph 4.21) During periodic testing of the logic channel sensors for the following ARI initiating variables, the operator can determine an y defective component and replace it during plant operation:

a. Reactor vessel low water level trip b. Reactor vessel high pressure trip c. ARI DC/DC Power Supply Identification of Protection Systems (IEEE 279-1971 paragraph 4.22)

A colored nameplate identifies each panel that is part of the ARI system. The nameplate shows the division to which each panel is assigned and also identifies the function of the control panel. The system to which each relay belongs is identified on the relay panels. IEEE 308-1974 (Criteria for Class 1E Power Systems for Nuclear Power Generating Stations) Class 1E DC power is required to energize the control logic and ARI solenoid operated valves. These electrical loads are part of the essential loads, therefore, these electrical loads are physically se parated and electrically isolated into redundant load groups so that safety actions provided by redundant counterparts are not compromised. IEEE 323-1974 (Qualifying Class 1E Equipment for Nuclear Power Generating Stations) Written procedures are developed for the design and qualification of all Class 1E electric equipment. This includes preparation of specifications, qualification procedures, and documentation for Class 1E equipment. Equipment qualification is accomplished prior to operation of upgr aded equipment installed as a plant modification. Standard manuals are mainta ined containing specifications, practices and procedures for implementing qualificat ion requirements, and an auditable file of qualification documents is available for review. IEEE 338-1975 (Standard Criteria for Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protection Systems) The design of the ARI system meets th e requirements of IEEE 338. The ARI sensors and control logic and one solenoid channel can be tested during plant operation. Opening of the scram solenoid valves will not be tested during plant operation.

LSCS-UFSAR 7.A.2-71 REV. 13 IEEE 344-1975 (Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations) Seismic Qualification requirements are satisfied by all Class 1E ARI equipment. Records covering all essential components are maintained.

IEEE 379-1977 (Standard Application of the Single Failure Criteria to Nuclear Power Generating Station Class 1E Systems) Application of the single-failure criterion to nuclear power generating station protection systems requirements is satisfied by consideration of the different single failure modes and carefully designing all single-failure modes out of the system through redundant logic design and proper separation of redundant portions of the system. IEEE 384-1977 (Standard Criteria for Independence of Class 1E Equipment and Circuits) Physical independence of the ARI system is provided by separation and isolation of redundant portions of the ARI system, including sensors, wiring, logic devices, and actuating equipment. Signals between re dundant Class 1E divisions and between Class 1E and non-Class 1E circuits are electrically isolated or physically separated to preclude a credible single failure from preventing the safety function. Channel independence of the sensors for ea ch variable is provided by electrical isolation and mechanical separation. The A and C sensors for reactor vessel low water levels, for instance, are located on two independent local instrument stands that are Division 1 equipment. The B and D sensors that are Division 2 equipment are located on two other independent instrument stands, widely separated from the Division 1 stands. The A, B, C and D sensors have independent process taps. Each process tap is quadrentially separated from the other. Disabling of one sensor in one location does not disable the control of the other division. Logic cabinets for Division 1 are in a separate physical location from those of Division 2, and each division is complete in itself, with its own essential battery control, instrument bus, and power distribution buses. The divisional split is carried all the way from the process taps to the final actuated equipment, and includes control logic power supplies. 7.A.2.2 Criteria for Class 1E Electric Systems (IEEE 308-1971)

This does not apply to the reactor protection system. The reactor protection system is fail-safe, and its power supplies are thus unnecessary for scram. A total loss of power will cause a scram. A loss of one po wer source will cause a trip system trip.

LSCS-UFSAR 7.A.2-72 REV. 13 7.A.2.3 General Guide for Qualifying Class 1 Electric Equipment (IEEE 323-1971) This is satisfied by complete qualificatio n testing and certification of all essential components. Records covering all essential components are maintained.

7.A.2.4 Periodic Testing of Protection Systems (IEEE 338-1971) This is complied with by being able to te st the reactor protection system from sensors to final actuators at any time duri ng plant operation. The test must be performed in overlapping portions. 7.A.2.5 Seismic Qualification of Class 1 Electric Equipment (IEEE 344-1971) These requirements are satisfied by all Class 1 RPS equipment as described in Section 3.10. 7.A.2.6 Application of the Single-Failure Criterion to Nuclear Power Generating Station Protection Systems (IEEE 379-1972)

These requirements are satisfied by consid eration of the different types of failure and carefully designing all potential violations of the single-failure criterion out of the system.

LSCS-UFSAR 7.A.4-1 REV. 13 7.A.4 Systems Required For Safe Shutdown 7.A.4.1 Reactor Core Isolation Cooling System Instrumentation and Controls 7.A.4.1.1 IEEE 279-1971 Criteria for Pr otection Systems for Nuclear Power Generating Stations Single-Failure Criterion (IEEE-279, Par. 4.2) The RCIC system is not required to meet the single-failure criterion. The control logic circuits for the RCIC subsystem initiati on and control are housed in a single relay cabinet and the power supply for the control logic and other RCIC equipment is from a single d-c power source.

The RCIC initiation sensors and wiring up to the RCIC relay logic cabinet do, however, meet the single-failure criterion. Physical separation of instrument lines is provided so that no single instrument rack destruction or single instrument line (pipe) failure can prevent RCIC initiation. Wiring separation between divisions also provides tolerance to single wireway de struction (including shorts, opens, and grounds) in the accident detection portion of the control logic. The single-failure criterion is not applied to the logic relay cabinet or to other equipment required to function for RCIC operation. Equipment Qualification (IEEE 279, Par. 4.4) Environmental

No components of the RCIC control system are required to operate in the drywell environment except for the condensate pots of the vessel level sensors. The RCIC steamline isolation valve located inside the drywell is a normally open valve and is therefore not required to operate except under test and isolation conditions. Other process sensor equipment for RCIC initiation is located outside the containment and is capable of accurate oper ation in the temperature conditions that result from abnormal conditions. Panels and relay cabinets are located in the control room and/or auxiliary equipment room environment so environmental testing of components mounted in these enclosures was not warranted at unusual environmental conditions. The components in the RCIC control system have demonstrated their reliable operability in previous applications in nucle ar power plant protec tion systems or in extensive industrial use.

LSCS-UFSAR 7.A.4-2 REV. 13 Channel Integrity (IEEE 279, Par. 4.5) The RCIC system instrument initiation channels satisfy the channel integrity objective. Channel Independence (IEEE 279, Par. 4.6) Channel independence for initiation sensors is provided by electrical and mechanical separation. The A sensors for reactor vessel level, for instance, are located on one local instrument panel identified as Division 1 equipment and the B sensors are located on a second instrument panel widely separated from the first and identified as Division 2 equipment. The A sensors have a common pair of process taps which are widely separated from the corresponding taps for the B

sensors. Disabling of one or both sensors in one location does not disable the control for RCIC initiation. Control and Protection System Interaction (IEEE 279, Par. 4.7) The RCIC system has no interaction with plant control systems. Annunciator circuits using contacts of sensors and logic relays cannot impair the operability of the RCIC control system because of electrical isolation. Derivation of System Inputs (IEEE 279, Par. 4.8) The RCIC system uses a direct measure of the need for coolant inventory makeup, e.g., reactor vessel low water level.

Capability for Sensor Checks (IEEE 279, Par. 4.9) All sensors are installed with calibration taps and instrument valves to permit testing during normal plant operation or during shutdown. The reactor vessel level transmitters and trip units can be checked for operability by closing the low side instrument valve and bleeding off a small amount of water through the low side bleed valves (which are provided for venting the instruments) while observing the scale reading and channel trip indication in either the main control room or the auxiliary electrical eq uipment room at the relay logic cabinets, and then reopening the instrument valve. Capability for Test and Calibration (IEEE 279, Par. 4.10)

The RCIC control system is capable of being completely tested during normal plant operation to verify that each element of the system, whether acti ve or passive, is capable of performing its intended function. Sensors can be exercised by applying test pressures. The setpoint of the trip unit can be checked in place by applying a LSCS-UFSAR 7.A.4-3 REV. 13 calibration signal to the unit. Pumps ca n be started by closing the appropriate breakers, to pump against system check valves (or return to suppression pool through test valves) while the reactor is at pressure. Motor-operated valves can be exercised by the appropriate control rela ys and starters, and all indications and annunciations can be observed as the system is tested.

Channel Bypass or Removal from Operation (IEEE 279, Par. 4.11) Calibration of a sensor which introduces a single instrument channel trip cannot cause a protective function without the coincident trip of a second channel. There are no instrument channel bypasses. Remo val of a sensor from operation during calibration does not prevent the redundant instrument channel from functioning. Removal of an instrument channel from service during calibration is brief. Operating Bypasses (IEEE 279, Par. 4.12) Manual Bypasses There are several means by which the RCIC system could be deliberately rendered inoperative by plant operating personnel:

a. Manually opening feeder breakers to the motor starter for valves, pumps, etc., that are re quired to function during RCIC operation. Manually opening a breaker for a specific motor deenergizes the control power to the motor starter and thus deenergizes the valve position lights and so indicates to the operator that an off-normal condition exists. Tagging

procedures may also be used to indicate out-of-service equipment and are considered an adequate indication of equipment status. Manual opening of breakers is a requirement for safe maintenance of equipment.

b. Manually opening d-c control power feeder breakers. Tripping or opening a d-c control power feeder breaker gives a loss-of-

power alarm.

c. Manually shutting off instrument line valves in various specific combinations.
d. Placing of the flow controller from "Auto" to "Manual" operation in the main control room or adjusting "Auto" setpoint to an incorrect position. Manual operation of the flow controller is provided to allow operator intervention should the auto portion of the controller fail. The availab ility of an auto setpoint control on the controller is desirable so that the operator can regulate LSCS-UFSAR 7.A.4-4 REV. 13 the flow to maintain water level rather than cycling the turbine between the auto trip and start level setpoints without going to the "Manual" mode of operation. The controller is in the main control room and therefore under the direct supervision of the control room operator.

All of these items are under operator cont rol and are not automatically defeated by RCIC initiation signals. Automatic Bypasses The following is a list of automatic bypasses which can render the RCIC system inoperative:

a. RCIC steamline isolation signal; and
b. RCIC turbine trip caused by:
1. RCIC isolation signal, 2. RCIC pump suction pressure low, 3. RCIC turbine exhaust pressure high, and
4. RCIC turbine overspeed.

These functions are discussed in Subsection 7.4.1.2.3. In summary, there is no violation of the operating bypass section of IEEE 279, since RCIC and HPCS cannot be simultaneously disabled. Indication of Bypasses (IEEE 279, Par. 4.13) Automatic indication of bypa sses is provided by individu al annunciators to indicate what function of the system is out of servic e, bypassed, or otherwise inoperative. In addition, each of the indicated bypasses also activates a "system inoperative" annunciator. Manual "system inoperative" switches are provided for operator use for items that are only under supervisory control. Access to Means for Bypassing (IEEE 279, Par. 4.14)

Access to motor control centers and instrume nt valves is controlled as previously discussed in this subsection. Access to other means of bypassing is located in the main control room and therefore under the administrative control of the operators.

LSCS-UFSAR 7.A.4-5 REV. 13 Multiple Setpoints (IEEE 279, Par. 4.15) This is not applicable because all setpoints are fixed. Completion of Protective Action Once It Is Initiated (IEEE 279, Par. 4.16)

The final control elements for the RCIC system are essentially bistable, i.e., motor-operated valves stay open or closed once they have reached their desired position, even though their starter may drop out. In the case of pump starters, the auto initiation signal is electrically sealed-in. Thus, once protective action is initiated (i.e., flow established), it must go to completion until terminated by deliberate operator action or automatically stopped on high vessel water level or system malfunction trip signals. Manual Actuation (IEEE 279, Par. 4.17) Each piece of RCIC actuation equipment requ ired to operate (pum ps and valves) is capable of manual initiation from the main control room.

Failure of logic circuitry to initiate the RCIC system will not affect the manual control of equipment. However, failures of active components or control circuits which produce a turbine trip may disable the manual actuation of the RCIC system. Failures of this type are continuously monitored by alarms.

Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279, Par. 4.18) Setpoint adjustments for the RCIC high drywell pressure instrument trip channels are integral with the sensors on the local instrument racks and cannot be changed without the use of tools to remove covers over these adjustments. Setpoint adjustments for the reactor vessel low level instrument trip channels are integral with the trip units in the relay logic cabinets and also require the use of tools. Control relay cabinets are capable of being locked to prevent unauthorized actuation. The range (or span) of the reactor vessel pressure switches is not adjustable. Because of these restrictions , compliance with this requirement of IEEE 279 is considered complete. Identification of Protective Actions (IEEE 279, Par. 4.19)

Protective actions are directly indicated and identified by annunciator operation, trip unit indicating lights, or action of th e sensor relay which has an identification tag and a clear glass window front which permits convenient visible verification of LSCS-UFSAR 7.A.4-6 REV. 13 the relay position. The combination of annunciation and relay observation is considered to fulfill the requirements of this criterion. Information Readout (IEEE 279, Par. 4.20) The RCIC control system is designed to provide the operator with accurate and timely information pertinent to its status. It does not introduce signals into other systems that could cause anomalous indications confusing to the operator. Periodic testing is provided for verifying the op erability of the RCIC components and, by proper selection of test periods to be compatible with the historically established reliability of the tested components, complete and timely indications are made available. Sufficient information is provided on a continuous basis so that the operator can have a high degree of confidence that the RCIC function is available and/or operating properly. System Repair (IEEE 279, Par. 4.21) The RCIC control system is designed to permit repair or replacement of components. All devices in the system ar e designed for a 40-year lifetime under the specified duty cycle. Since this duty cycle is composed mainly of periodic testing rather than operation, lifetime is more a matter of shelf life than active life. However, all components are selected for continuous duty plus thousands of cycles of operation, far beyond that anticipated in actual service. Recognition and location of a failed component is accomplished during periodic testing. The simplicity of the logic makes the detection and location relatively easy, and components are mounted in such a way that they can be conveniently replaced in a short time. For example, estimated replacement time for the type of relay used is less than 30 minutes. Sensors which are connected to the instrument piping cannot be changed so readily, but they are required to be connected with separable screwed or bolted fittings and can be changed reasonably in less than 1 hour, including electrical connection replacement. Identification (IEEE 279, Par. 4.22) All controls and instruments are located in one section of the control room panel and are clearly identified by nameplates. Relays are located in one panel for RCIC use only. Relays and panels ar e identified by nameplates. 7.A.4.1.2 IEEE 323-1971 Trial-Use Standa rd - General Guide for Qualifying Class I Electric Equipment for Nuclear Power Generating Stations Specific conformance to requirements of IEEE 323 is covered in Subsection 7.A.1.

LSCS-UFSAR 7.A.4-7 REV. 13 7.A.4.1.3 IEEE 338-1971 Trial-Use Criteria for Periodic Testing of Nuclear Power Generating Station Protection Systems The only paragraphs of IEEE 338-1971 that apply to the design of the RCIC system are covered as follows:

a. capability for Sensor Checks (IEEE 338-1971, 2.1)(Reference Subsection 7.4.1.3.2); and
b. capability for Test and Calibration (IEEE 338-1971,2.2) (Reference Subsection 7.4.1.3.2).

7.A.4.1.4 IEEE 344-1971 Guide for Seismic Qualification of Class I Electric Equipment for Nuclear Power Generating Stations The conformance to the requirements of IEEE 344-1971 is detailed in Section 3.10.

LSCS-UFSAR 7.A.5-1 REV. 13 7.A.5 Other Instrumentation Systems Required For Safety 7.A.5.1 Main Steamline Radiation Monitoring Subsystem 7.A.5.1.1 Specific Requirement Conformance

IEEE 279-1971 Conformance to IEEE 279 is show n in Subsection 7.A.2.1.6. IEEE 323-1971 Qualification of the components of this su bsystem is covered in Subsection 7.A.1. IEEE 338-1971 This subsystem is testable during reacto r operation as described in Subsection 7.A.2.1, Paragraphs 4.9, 4.10, 4.11, 4.13, and 4.14. IEEE 344-1971 Seismic qualification of the components of this subsystem is covered in Section 3.10. IEEE 379-1972 This subsystem meets the single-failure criteri on as described in Subsection 7.A.2.1, Paragraph 4.2.

7.A.5.2 Reactor Building Ventilation Exhaust Plenum Radiation Monitoring 7.A.5.2.1 Specific Requirement Conformance IEEE 279-1971

General Functional Requirement (IEEE 279-1971 Paragraph 4.1) The purpose of this subsystem is to initiate isolation of potentially contaminated plant ventilation effluent paths and initia te standby gas treatment in the event of excessive amounts of radioactive gases and particulates in the reactor building vent plenum. For two channels, two-out-of-two high-high radiation or inoperative trips shall:

a. shut down and isolate the reac tor building vent system outboard valves, LSCS-UFSAR 7.A.5-2 REV. 13 b. close outboard drywell and suppression pool purge and vent valves, and
c. initiate one standby gas treatment train.

For the other two channels, the same signals will operate equivalent inboard valves (a and b) and initiate the other standby gas treatment train (c). Single-Failure Criterion (IEEE 279-1971 Paragraph 4.2) This criterion is met since there are tw o independent pairs of channels which initiate redundant equipment. One failure affects only one pair of channels.

Quality of Components and Modules (IEEE 279-1971 Paragraph 4.3) The sensor and converters as well as the indicator and trip units are fully described in GE technical manuals and have been used in all GE boiling water reactor power plants. Equipment Qualification (IEEE 279-1971 Paragraph 4.4) On the component and module level, General Electric's Nuclear Energy Division conducts qualification tests to qualify the items for this application. In situ operational testing of the detectors, monitors, and channels is performed at the site during the preoperational test phase.

Channel Integrity (IEEE 279-1971 Paragraph 4.5) The channel components are operable under the predetermined normal and abnormal circumstances. The trip channel components have been selected to fulfill these minimum requirements.

Channel Independence (IEEE 279-1971 Paragraph 4.6) The four trip channels of this protective function are electrically isolated and physically separated in order to meet this design requirement. Control and Protection System Interaction (IEEE 279-1971 Paragraph 4.7) The four monitors for this protective functi on comply with this design requirement. Isolated contacts are used to provide isolation signals to close appropriate valves. LSCS-UFSAR 7.A.5-3 REV. 13 Separation of inboard and outboard circuitry prevents postulated failures from impairing subsystem operation. Derivation of System Inputs (IEEE 279-1971 Paragraph 4.8) The measurement of radiation in the reacto r building ventilation exhaust plenum is the appropriate variable to determine radi oactive releases into the containment. Capability for Sensor Checks (IEEE 279-1971 Paragraph 4.9) Due to the two-out-of-two configuration of the trip logic, one channel at a time may be removed from service to perform periodic tests.

Capability for Test and Calibration (IEEE 279-1971 Paragraph 4.10) An internal trip test circuit, adjustable over the full range of the trip circuit, is provided. The test signal is fed into the indicator and trip unit input so that a meter reading is provided in addition to a tr ip. All trip circuits are the latching type and must be manually reset at the front panel.

Facilities for calibrating these monitor units are provided. It is a test unit designed for use in the adjustment procedure for the area radiation monitor sensor and convertor unit. It provides several gamma radiation levels between 1 and 250 mrem/hr. The calibration unit source is Co

60. A cavity in the calibration unit receives the sensor and convertor unit. Located on the back wall of the cylindrical lower half of the cavity is a window through which radiation from the source emanates. A chart on each unit indicates the radiation levels available from the unit for the various control settings.

Channel Bypass or Removal from Operation (IEEE 279-1971 Paragraph 4.11) During the periodic test of any given channel, the controls associated with a monitor permit the monitor to be tested for prop er operation. The two-out-of-two trip system logic prevents system level protective action. The two-out-of-two trip system logic channel when in the test mode provides an inoperative trip signal in order to meet the single-failure requirements. Operating Bypasses (IEEE 279-1971 Paragraph 4.12) This design requirement is not applicable to this protective function.

LSCS-UFSAR 7.A.5-4 REV. 13 Indication of Bypasses (IEEE 279-1971 Paragraph 4.13) A downscale annunciation is produced during the monitor tests with its front panel controls. Substitution of the process input with a simulated input to the monitor produces downscale and upscale annunciation s in the control room under specific conditions of the test.

Access to Means for Bypassing (IEEE 279-1971 Paragraph 4.14) During the periodic test, administrative control procedures must be followed to remove one monitor from service and subsequently return it to service. Multiple Setpoints (IEEE 279-1971 Paragraph 4.15) This design requirement does not a pply to this protective function. Completion of Protective Action Once It Is Initiated (IEEE 279-1971 Paragraph 4.16) The monitor output trip circuit remains in a tripped state whenever the gamma radiation level exceeds the established setpoint. Manual Initiation (IEEE 279-1971 Paragraph 4.17) This design requirement is not applicable to this protective function. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279-1971 Paragraph 4.18) Access to the monitors is under the administrative control of plant personnel. Operation of the monitor front panel controls, whether for calibration or test purposes, results in a downscale annunciati on from that channel in the control room. Identification of Protective Actions (IEEE 279-1971 Paragraph 4.19) Actuation of any radiation monitor to produce a tripped condition will initiate a control room annunciator for this protective function. System Repair (IEEE 279-1971 Paragraph 4.21) The one-to-one relationship of detector, monitor, and trip circuitry permits the operator to identify a faulty channel and determine the defective component.

LSCS-UFSAR 7.A.5-5 REV. 13 Provisions have been made to facilitate repair of the channel components during plant operation. Identification (IEEE 279-1971 Paragraph 4.22) Special identification is provided for these monitors by special colored marker plates which identify the reactor protection system division with which the units are associated. IEEE 323-1971 Qualification of components of this subs ystem is covered in Subsection 7.A.1.

IEEE 338-1971 This subsystem is testable during reacto r operation as described under the IEEE 279 conformance description above, Paragr aphs 4.9, 4.10, 4. 11, 4.13 and 4.14. IEEE 344-1971

Seismic qualification of the components of the subsystem is covered in Section 3.10. IEEE 379-1972 This subsystem meets the single-failure cri terion as described under the IEEE 279 conformance description above, Paragraph 4.2.

7.A.5.3 Recirculation Pump Trip System 7.A.5.3.1 Specific Requirements Conformance IEEE 279 General Functional Requirement (IEEE 279-1971 Paragraph 4.1) Two instrument channels are connected to both division logics. In the division logics, the channels lose their identity since they are combined. The combination is two-out-of-two. When both instrument channels inputting a common divisional logic and monitoring the same variable exceed their setpoint, RPT occurs if an inhibit is not present.

Single-Failure Criterion (IEEE 279-171 Paragraph 4.2) The design complies.

LSCS-UFSAR 7.A.5-6 REV. 13 Quality of Components and Modules (IEEE 279-1971 Paragraph 4.3) The division logic consists of high-quality circuitry that has been proved to be highly reliable and is qualified per IEEE 323. The actuators are devices selected to be operated substantially within their capabilities and are of high quality and reliability and qualified for their application per IEEE 323. Equipment Qualification (IEEE 279 Paragraph 4.4) At the component level, vendor certification is required that these parts will operate in accordance with the requirements of the purchase specification. General Electric will qualify the system and its componen ts, modules, and subassemblies. In addition, in situ operational tests will be performed on the system during the preoperational test phase. Channel Integrity (IEEE 279-1971 Paragraph 4.5) The logic system complies with this requirement.

Channel Independence (IEEE 279 Paragraph 4.6) The two-division arrangement meets this requirement. Control and Protection System Interaction (IEEE 279 Paragraph 4.7)

The two division logics are totally separate from any nonprotection system. Due to the design of this output and separation of the cabling, there is no interaction with control systems of the plant. The actuator logic has no interaction with any other plant system, and the breaker trips are physically separate and electrically isolated from the other portions of the recirculation pump power supply. Consequently, this design requirement is met by this equipm ent. Any system interlocks to control systems are isolated such that no failure or combination of failures in the control systems has any effect on RPT. Derivation of System Inputs (IEEE 279 Paragraph 4.8) This design requirement is met by the instrument channels selected for inputs. Capability for Sensor Chec ks (IEEE 279 Paragraph 4.9) This design requirement is not literally applicable but by interpretation can be applied and is fully complied with by the inpu t tests, logic tests, and output tests for LSCS-UFSAR 7.A.5-7 REV. 13 which provisions are made. The system utilizes RPS sensors addressed in Subsection 7.2.3. Capability for Test and Calibration (IEEE 279 Paragraph 4.10) Refer to Subsections 7. A.2.1.3 and 7.A.2.1.4. Channel Bypass or Removal from Operation (IEEE 279 Paragraph 4.11) This design requirement is not applicable. Operating Bypasses (IEEE 279 Paragraph 4.12)

This design requirement is not applicable. Indication of Bypasses (IEEE 279 Paragraph 4.13) This design requirement is complied with by indication of test bypasses. Access to Means for Bypassing (IEEE 279 Paragraph 4.14) This design requirement is complied with by operator control of test program. Multiple Setpoints (IEEE 279 Paragraph 4.15) This design requirement is not applicable.

Completion of Protective Action Once It Is Initiated (IEEE 279 Paragraph 4.16) Once the RPT relays are tripped, they in tu rn trip the trip coils of the recirculation pump breakers. An annunciator for each di vision is provided in the control room which informs the operator that the logic has initiated the RPT. The process computer logs the fact that an RPT has occurred.

Manual Actuation (IEEE 279 Paragraph 4.17) Not applicable. Access to Setpoint Adjustments, Calibration, and Test Points (IEEE 279 Paragraph 4.18) This design requirement is met. Refer to Subsection 7.2.3. LSCS-UFSAR 7.A.5-8 REV. 16, APRIL 2006 Identification of Protective Actions (IEEE 279 Paragraph 4.19) Control room annunciators are provided to identify the tripped portions of RPT in addition to the previously described instrument channel annunciators associated with the RPS:

a. Division 1 logic tripped, and
b. Division 2 logic tripped.

These same functions are connected to the process computer to provide a record of the system status.

Information Readout (IEEE 279 Paragraph 4.20) The information presented to the control room operator satisfies this design requirement. Systems Repair (IEEE 279 Paragraph 4.21)

The design of this portion of the RPS complies with this design requirement. Identification of Protection Systems (IEEE 279 Paragraph 4.22) Refer to Subsections 7. A.2.1.3 and 7.A.2.1.4. Criteria for Class 1E Electric Systems (IEEE 308) This does not apply to the logic system, which is fail safe. Its power supplies are thus unnecessary for RPT. A 1E system is required to energize the breaker trip coils. Standard for Qualifying Class 1 Electric Equipment (IEEE 323)

See Subsection 7.A.1. Periodic Testing (IEEE 338) Refer to Subsection 7.2.3. Seismic Requirements (IEEE 344) - All Class 1E equipment will meet the requirements of Section 3.10. LSCS-UFSAR 7.A.5-9 REV. 13 Application of the Single-Failure Criterion to Nuclear Power Generating Station Protection Systems (IEEE 379) These requirements are satisfied by consid eration of the different types of failures and carefully designing all violations of the single-failure criterion out of the system. An exception is imposed during periodic logic testing.

7.A.5.4 Leak Detection System 7.A.5.4.1 Specific Requirement Conformance Unless otherwise noted, specific regulatory requirements discussed below apply only to those portions of the leak detection system which supply signals to the

primary containment and reactor vessel isolation control system. IEEE 279-1971 and IEEE 379-1972 Leak detection system compliance with IEEE 279 and IEEE 379 is included in the IEEE 279 and IEEE 379 compliance discussi ons of the primary containment and reactor vessel isolation control system, Su bsection 7.3.2.3, fo r which this system provides logic trip signals. IEEE 323-1971 Leak detection compliance is shown in Subsection 7.A.1. IEEE 338-1971 Leak detection compliance with IEEE 338 is shown. All active components of the leak detection system associated with the is olation signal can be tested during plant operation. IEEE 344-1971

Leak detection system complianc e is shown in Section 3.10. 7.A.5.5 Intermediate Range Monitor Subsystem 7.A.5.5.1 Specific Requirement Conformance IEEE 279-1971 The IRM design is shown to comply with the design requirements of IEEE 279, "Neutron Monitoring Scram Trip", in Subsection 7.A.2.1.

LSCS-UFSAR 7.A.5-10 REV. 13 IEEE 323-1971 IRM compliance is shown in Subsection 7.A.1. IEEE 338-1971

IRM compliance with IEEE 338 is shown in Subsection 7.A.2.1 under "IEEE 279 Conformance - Neutron Monitoring Scra m Trip" (Paragraphs 4.9 and 4.10). IEEE 344-1971 IRM compliance is shown in Section 3.10.

IEEE 379-1972 IRM signal separation, cabinet separation, use of isolation circuitry, and number of channels per trip system are methods used to meet the single-failure criterion. Convenient test and calibration circuits permit frequent checks for undetected failures.

7.A.5.6 Average Power Range Monitor Subsystem 7.A.5.6.1 Compliance with IEEE 279-1971 The APRM design is shown to comply with the design requirements of IEEE 279 in Subsection 7.A.2.1 under IEEE 279-1971.

Compliance with IEEE 323 APRM compliance is shown in Subsection 7.A.1 and Topical Report NEDO 10698. Compliance with IEEE 338 APRM compliance with IEEE 338 is shown in Subsection 7.A.2.1. Compliance with IEEE 344 APRM compliance will be shown in Section 3.10. Compliance with IEEE 379

LPRM signal separation, cabinet separation, use of isolation circuitry, and number of channels per trip system are methods used to meet the single-failure criterion. Convenient test and calibration circuits permit frequent checks for undetected failures. Eees INSTRUMENT RACK (RPS 1 Al 270*ECCSINSTRUMENT RACK (RPS 1 B)(I)ECCS INSTRUMENT RACK IRPS 2 Bl//OAYWELL 90*RCIC STEAM TO TURBINE (1)ECCS INSTRUMENT RACK (RPS 2 A)NOTES: (I)SEPARA TlON AGAINST DESIGN BASIS EVENT USEO BETWEEN SOURCE OF DAMAGE AND ELECTRICAL EQUIPMENT OF DifFERENT DIVISIONS AS DENOTED BY 1, 2.AND 3.(II)EITHER OF'THE INSTRUMENT RACKS 3 CAN ACTUATE HPCS.LA SALLE COU NTY STATION IJPOATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.1-1 SCHEMATIC ARRANGEMENT OF RPV NOZZLES FOR ECCS AND INSTRUMENTS RF.V.0-APRIL 1984 I r SCRAM GROUP RACEWAY 1 OA EQUIVALENT I L-...l v'///ij////////'/PENETRATION B RACEWA If N8*I I INSTRUMENT NON NEUTRON C A 8 0 SENSORS DIV IIA SAM&DlV IA APRM lAM APAM DIV 18 DlV liB III I A a&F B I I I I PENET A'IP ,-., PENET 0PWR PWA r---"A""8"SRM" TAIP::;: TRIPl.OGIC LOGIC LPAM-..IRM INDIVIDUAL 9'"AlfiE A 8 A I-OUTM.\I-APRMAPRM LOGIC EXT.FE l-INTER-r/L.PRM TRIP CONNECTION SRM&TRIP IRMB G4""",=-l.OGIC LOGIC D&HG3 C0 G3G2......-+RACeWAY NA" RACEWAY NO'APRM SAMC&APAM*lAM lr C C&G 0 TRIPS LOGIC TRIPS LOGIC OUTPUT A OUTPUT B JI (r/'//////"/////7//1 TYPICAL OF PENETC RACEWAY NC'GROUPS 2.3.&4 r-----------..,

_.___...J Ir ENCLOSURE Y"//.'///////////

'/.'/PENETRATION'

  • _______L-_SCRAM SOLENOIDS FOR ONE ROO""""L-.__RPS TERMINAL BOX ON'--___._-J---...._....J HYDRAUUC CONTROL UNIT AIR-----l ONE CONDUIT---.....-FOR EACH ROD.---1.__............'RACEWAYS NA.NB, ETC.MAY BE ASSIGNED TO SEPARATE DIVISIONS AS APPROPRIATE TO PLANT LAYOUT.RATHER THAN REOUIRING EIGHT SEPARATE DIVISIONS."IF THE WIRING FOR MORE THAN ONE ROO GROUP GOES THROUGH THE SAME PENETRATION, A METAL BARRIER WHICH EXTENDS THROUGH THE PENETRATION MUST 8E PROVIDED BETWEEN THE WIRING FOR THE DIFFERENT GROUPS.LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPuRT FIGURE 7.1-2 RPS SEPARATION CONCEPT REV.0-APRIL 1984

>a>o lD I ,....""" u.J..j..j'"..j'J"I>a::Q...j..j 0::: wwZ..j"'a:: a:: " 0-<0::l (J>>W wWO 1-::>::>a:: t:.!:l (J>w'" 1-0<<0)-Q.Z..j:::Jw ZI-l-i<Z LL.a:: W I-::EO o (J>u U I.J.J<<I.J.J VJ+: LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.1-3 EMERGENCY CORE COOLING SYSTEMS (EeCS)SEPARATION SCHEME REV.0-APRIL 1984 SENSORS WIREWAVS NS 4 LOGIC NON-APS SENSORS TRIP LOGIC A TRIP LOGIC B c TRIP LOGIC C TRIP LOGIC D NON-RPS SENSORS AUXILIARY RELAYS MANUAL OUTBOARD VALVES SWITCH MANUAL AUXILIARY RELAYS SWITCH INSOARD VALVES MOTOR STARTERS (FOR MOV'S ONL VI DIV 1 POWER AC AND/OR DC M.O.OR SOL.I I I I I I I I I I........... --DIV2...._.,..._..POWER AC ANDIOR DC M.D.OR SOL.LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.1-4 NSSS SEPARATION CONCEPT REV.0-APRIL 1984 COMMON PROCESS TAl'(OPTIONAL) SENSORS CONDUITS I I I I I I I I DIV 1*CONDUIT COMMON PROCESS TAl'(OPTIONAL) CONDUITS TRIP LOGIC B TRIP LOGIC 0 RPS PANELS FAILSAFE LOGIC TRIP LOGIC AI I I DIV 2 CONDUIT----, I I I I TRIP LOGICC 2 INDIVIDUAL CABLES IN A SINGLE RACEWAY AUXILIARY RELAYS OUTBOARD VALVES MANUAL SWITCH MANUAL SWITCH AUXILIARY RELAYS INBOARD VALVES 2 INDIVIDUAL CABLES IN A SINGLE RACEWAY CONTAINMENT E PENHi'll'noN COMMON RACEWAY!"...o (II-<OUTBOARD VALVE*INTERCONNECTING CONDUITS USED FOR MAIN STEAM ISOLATION VALVE LOGIC ONLY!'J...a en III INBOARD VALVE LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.1-5 MAIN STEAMLINE ISOLATION SEPARATION CONCEPT REV.0-APRIL 1984 A C B o SEE NOTE DIV 2 WIREWAY+-k+-k.1.1..L A-r-T t*I I I THER OTHER DIV1 DIV1 DIV 2 INPUT INPUT TERMINAL BOX CONTAINING l DIV 1 RelC CONTROL VI LOG'C"'RCU7 TO AY DIV 2 EQUIP RCle CONTROL LOG IC DIV 2 PANEL CABINET DIV 1 o 01 WIREW MULTIPLE CIRCUIT REACTOR VESSEL LEVEL SENSORS NOTE: CIRCUITS FOR RelC INITIATIONS UTILIZE CONTACTS ELECTRICALL" SEPARATE FROM THOSE USED FOR OTHER DIV 2 INPUTS LA SALLE COU NTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.1-6 RCIC SENSOR SEPARATION SCHEME REV.0-APRIL 1984 naououm aoaaflnoaa aonannonaona<- Uaaaoaaoaaaao loanoaaaonaao couccuo Done nannoaanaaaa nanaanaaaaoa aaonananaclo oaaanaaooaa ooaoaaooaao nomanoaaao 18 04 a 0oam I. aanoaaa 1. 9L Ie1 (II IdMAt= ^~Il~ Y~I~IfMt~T wGY1wt1. Mf UW11fNL M10 ' ~, I I<e~ lm a d r~av r'~wn T t Win/ In Iw~I 1 A w LI~ i" IMP ~ " AN-00 IRMr '/ !" L 4Y11" w" KWwIlW1" allOf ~1 Il" 0" II AMAI aws ! wlr " nw Iwr me i w 1. 1 i. mr ~ rA aG t" wlt wAt wl.r[ rqr 110" R' wlr wlu " m re Iwl Il0" I rrfs is ani" s 1" , was falo. 1. " " IwwA g. tlllw" m lflllllwq', iAWt w11G1 AWwIAllw IVOIIOOR. 1. wl Iww, rA rmr, smim w[ xr t" ItnA, 1" nw M r. tlw mlgm enA e111A Yl W .wY W. 14 M11" n 1" w -www A mao wrP (¢11 li. R~ti11~wSAIYIIA'm wL M, AII~MYi It. ~ ~ ~ Yw! A v1A t1 PIII " IOY" Mt " 1 Y 41 Ma :r INi1f"%~ 1 ¢IG`40Y1m - IIIA ~n1Ai q ! ". R ~ ~lu"+~ ~ ~~" (lGl, ! " H" 04" GAD Mn i' I MI "~S IAl l ~l~ ~ A 1. ¢KI" w04T1a yA ¢NA "¢........ .... G71" l111 f. 1". w. 11¢A MW M mlr Me. . .. .. .. iaww !. west" lanlA elms M w ...... AI A OU"!" 1 1. e" Y ellAlln M M .... ... .... .. .. GN4n1 1. t"!Iw plb M ro ........... ..... . AI" Ial 1. 101113 " 1 curt e M rw ............. .... " l1. wRm" l" n1Mrm .............Gy.iW 1. Sam R" . " ................ W.InI H. mwi " n fta~ In N" ............. t~ml u. naAwl" r111" wwmm.....uvaa... ..U.IwaA1m1-.r."................. -Im 11. tom ! IwIIa01 ~1....... ......... YFI" 1 11, ffmcm twlm ~~ ¢A1100111" --- " to on (""" 11 YYt t . rsw an¢ slaw rm " A R. ola. cart: K BXTIIKAL M0INCTOM AMMMY (Ef,. 1111P Nlf CRAY YCAI161 CO OYBt , V0.TA LROMA -KLUGE a uSloot Mtak Acy. 16. A SINGLE SCRAM PILOT VALVE WITH DUAL SOLENOID OPERATED PILOT ASSEMBLIES MAY BE INSTALLED IN PLACE OF TWO SCRAM PILOT VALVES. REV. 18 - APRIL 2010 FIGURE 7.2-1 REACTOR PROTECTION SYSTEM rED (SHEET 1 OF 4)LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT..,.WI_'".e-.t e:-.*.. _-.., ,........1'.::Jf"'=:'L.'...,.. dA-IUtJ 11.=.. .......*It,

  • __*....-----"".......",..f"A&" fWSICM.LY......-.........'

w&4... C1'l'l,...._.-.o..c.aa ...:::;"'J:=r:::::.-:...:;-:::::;;;-=..;W:... ..,-0'"...,...&l.I. "...ct..',JI-.oJ,O I._.COJ.*m-,., IEStIII we...,.--..a.n J.NClUa"" til tc>>"J tmO t.__Ift to cU-fotlt*...-, PO ,..-aerot*...,.D(DI M rca ,..J...C_SII****..*C..*."***I'QJ"'",<.Ii..l..t.--".le*..-.aft'" E.,..u*.-.:oa.._.."._u.-..

  • ..........

"'a;a..'".a...-..t"'"'1**,**.-ra CMIVII:I....."c..CII.-............ 1&............. 8'U.01.2'*_.VQL_OIl_I'I\l:GIIUttV. 16.A SINGLE SCRAM PILOT VALVE WITH DUAL SOLENOIO OPERATED PILOT ASSEUBLIES UAY BE INSTALLED IN PlACE Of TWO SCRAM--1"""ES---norMlR ClI-'"*.....**__ 14)*:I__..d.J ,*****10..)"----..I_.---110 I..._-1----aI*..I I a I**I**....------.I I*I**I.----0---......t*I t" I I-----1L1t**" I I" I" I*I:J t I f I-*" I-I I.." t*--" lit*&._Ill ILC'IIlIC/IIL --£IM'I'"---,<:It/All..,C.."&._Ill.!at." ,-," l'tllnII::'IDI A--.-_. (NOT.14)-------------------1------------ ..it*.).--1--,,SIIOi

'+--(NOTE H5)I..I L__.J_T I.....-ND-t I I I I I I I L L_..===-*/II.D H*REV.18-APRIL 2010 8 7 6 5 4 2 A e E F o cCOUNTY STATION UPOAT£OWETY ANAlYSJS REPORT f'*E o c B*, e 7-.6__[__5_4.3 2 FlCURE 7.2-1 RtACTOR PROT£CTJON SYS1EM lED SHEET 2 Of 4)REVISION 13 1 A B c o F 2.3 COUNTY STATION fiNAL SAF'ElY ANAL YSJ S. -..e-.'1#.........-'---'=-..--c-;-:--,---,.-..,.-_-.J 4 tot**'--r:Er:)r-------Ma, 5'"'1 tmID___-+-I__--.:::.:J,..I ,----,t t J{f;',1 1.14'Ol';,.-T:.J;)...:_.*...J4' L.::===t-"...,-;:;; S..-,.,- 6..C3:l---..--,..---;J-.J. .-......,.'.L.-__..7 __ _-.-,,-,.-4 3 I ED __-------,.----------------.

_.--.,..__T..--.., Ir---__:i--*I I J....r:,J.t:...__.___*1**-1 8 8

.-,......<&:I:D,..,),,\<.:&::E:I:l- -\.- E I "0<Hfj] fJ----WAClOII...t6000"'U...., --_._-A.,\<:IDi:3------ r..1..'"'"'- \-- .......1.I"w14.-.......... .---...c.""__.\..,....." G!L}----,\ c 91,1;:,'B

  • o TRIP tOlL..*REC,IRC PUMP TR\P 5Y5IEM A TYP fOR S"SE:t.C,EPT A5 IN (;)H L.A SALLE COU NTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.2-1 REACTOR PROTECTION SYSTEM lED (SHEET 4 of 4)

;;---...,..---;;-----;rr---.-*

...--__----------------- ...=:t=..-t REV It0-APRIL 1984 LSCS-UFSAR CftC C"....US...IJT"O"......NST..... 00000'TQfI'fIIG I.I..n IN Sl AJIIT"'" IfItliltTP .it!:T\.;"!:. I TV"..MODI!,",TeM MCOI""Te""CO, SW.n:" COO/TIlO.IN""UlI.IN IT.aTIN""'""ALVI....,.tI.OIV"I-OPRM HUCU"" OtSC..VOL 1CIl....",UT"Oto l'U....flflS1"gp ,Y,nM au"'....Gf TRIP....NU.'"""'.UUlt...1Ci" 1.....1.VOLU....."TI" MOOItTOHC V-Lyl"'0" NOT....."11 UVU..tGOO UNili ,....'" CI.OIUlI, lI"-.I.L I I"'oOC1'O" li{MODI_Te", ,............ 1 vU....I 1..00I_TCHPOWER'NSMUTCIOWN -""AT'"...n....TUO 2f>%FtATED LlV....._MCII:II_n:too ..."....I SC;""" LASALLE COUNTY STATION UPDATED FINAL SAFETY A.,."JALYSIS REPORT FIGURE 7.2-2 REACTOR PROTECTION SYSTEM SCRAM FUNCTIONS REV.17, APRIL 2008 TRIP SYSTEM A ACTUATORS TRIP SYSTEM B LOGIC At LOGIC A2.ILOGIC 81 lOGIC 82 EAl GA2 B81 fal He2 Dez 8Bl GROUP.SOLENOIDS Bat:z:.F81f81 DB2;;:.HB2H82 ACTUATOR LOGICS ASSOCIATED WITH TRIP SYSTEM B/r--------JI' , GROUP 1 GROUP 2 GROUP 3 SOLENOIDSSOLENOIDSSOLENOIDS AAt:z: EA1:;;l: EAl;t!: AAI CA2 Z GA2 Z GA2'%CA2 ACTUATOR LOGICS ASSOCIATED WITH TRIP SYSTEM A/r----I A , GROUP 1 GROUP 2 GROUP 3 GROUP.-SOLENOIDS SOLENOIDS SOLENOIDS SOLENOIDS NOTE.CONTACTS SHOWN IN NORMAL CONDITION C-0 r 0)::>>>>>n-t-t tTl (J)C 0>>>>-t" r 0......r;;0 z Vl">>111 j....."--........r-If):t:>G'>()nz c Vl 0:r: 0:;0>>m m.., C 3:)::>m>>n'-l-t Z-,-t<-l......C N n>>I>>-<*'--'-t Z:J 0 w>>(J):J:;0 r-1<-l r-Vl>>;0>-i G'>(/I-l*......0)n)Vl tTl Z*u*C)AI-i LSCS*UFSAR tllalT C_AI.IC!'.MI SYSTIM A:I""If'LCGIC NOTE: CONTACTS SHOWN IN NORMAL CONDITION LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FlGCRE 7.2-4 LOGICS IN ONE TRIP SYSTEM (SCHEM-".TIC) RRV 13 LSCS-UFSAR I"MCMA_ILA 101'11 OP lIGHT!'HIUTIIIOI'I ...,H'TOIllNC IVrrEM I...U&I I I I"'--..,.....- A OPRM T.IUP A OPRM BYPASS IIIUCTOlII 'IIIotICTIOfll SYETlM tlIlUTIlOfll _ITO_INC IYsnM LOGICS ITWO 0'lIGHT'NDTI: CONT AC"'I1 IIHOWH'N"'Oll.....L CO/llOIT_IIIIACTCIIl 'III0TICTIOH SVSTIMLOGIC: 10fll1 0aulll'LASALLE COCNTY STATION UPDATED FINAL SAFETY....."ALYSIS REPORT FIGURE 72-5 REL,>TIONSHIP BETWEEN NEUTRON MONITORING SYSTEM AND REACTOR PROTECTION SYSTEM REV.17, APRIL 2008 TRIP SYSTEM A POWER BUS SV05-1 5 A TRIP SYSTEM B POWER BUS 3 TURBINE STOP VALVE CLOSURE CHANNELS 3 H A1 E C A2 G B B1 F o B2 H NOTES: REACTOR PROTECTION SYSTEM LOGICS 1.CONTACTS SHOWN IN NORMAL CONDITION. 2.THREE OUT OF FOUR STOP VALVES MUST CLOSE TO CAUSE A SCRAM.LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORTFI GU RE 7.2-6 CONFIGURATION FOR TURBINE STOP VALVE CLOSURE REACTOR TRIP REV.0-l\PIn L 1984

olO.."".._",""""",,=_..,"'**,.,,, olO...,.m""-"",,,..f02lAIIIfOUAI,.fO:lt8t11+: fOall12l+: fOlICCtIfOZlCIal"%fOllOltl"%fOllOl%I}1"--(MOTOIl*GENUIATOIl*1.* SHA' STIAM STEAM SllAM Sll_sn_su_IUAM nE_LINE A LINE I lINEC LINE 0 LINE...LINE C lINfl LINED\;;Q C::.E!separated. IZ}I::-II TRlPSVSTIiM I I A , F021e.STUM lINE C.INIOAIIO VALVE f021C.STU" LINE C.OUTBOAIID VALVE fOUD.lIE"" LINE D.IH80AIlD VALVE fOlIO..STEAM L1HE O.OUT80"1II0 VALVE switches on the same valve is physically or more steam lines will cause a SCRAM.CG IIIf...CTOR PIIOTECTION IVIllM LOGICS ICONT ACTlIHOWN IN NOll MAL CONDITIONI MAIN STEAM LINE ISOLATION CHANNELS (SWITCH CONTACfS SHO....'N IN POSITIONS WHEN ISOLATION VALVES ARE OPEN"'1...2 TlllPSVSnN A I ,......-----......, IllV: F022A*UfAM UNf INIOAIlD VALVE F021A*SlEAM LINE OUTIO...IlD V"'LVE F0228.STE...M LUfE I.INIOIIRD VALVE Foall..STEAM LINE I.DUTIOAROVIILVE Note: 1.Wiring for the two 2.Isolation of three (j 0 Z'"tj c::: 5;5 c:i:i t:::..., c-o..,.:..z...::rn;0""t',O."n**>;0-(Jl trICl t;: (j c: 0-;oZ'"'3 t11:--'-<:::l;0'"':>*_t'l....rnt'"'-<'"'3 Z rn--0 t'l (JlZ en;0["l 0'1:l0;0;0 II j.., t::: 0<.z..,.w RPS M-G POWER SUPPLY C 120 r"'lFEEO M C RpS M-G PoweR SUPPLY c RELAY PROTECTIVECIRCUITRY I"-------(EPA SOLID-STATE -PROTECTIVE CIRCUITRY EPA SOLID-STATE -PROTECTive CIRCUITRY EPASOLID-STATE PROTECTIVE CIRCUITRY (I_____.J (EPASOLID-STATE PROTECTIVE RELAYPROTECTIVE CIRCUITRY EPASOLID-STATE PROTECTIVE C CIRCUITRY____J (EPA_SOLID-STATE PROTECTIVE CIRCUITRY LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.2-8 BLOCK DIAGRAM-RPS PROTECTIVE CIRCUITELECTRICAL PROTECTION ASSEMBLY (EPA)REV.0-APRIL 1984 Rcrc LPCS DIV I RHR A DIV 1 RECIRC A NOTE: AZIMUTHS SHOWN ARE FOR REACTOR VESSEL LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-1 PIPING ARRANGEMENT REV.0-APRIL 1984 ACCIDENT 2 2 3 2 2 z CORE COOLING ACCIDENT SMALL BREAK MOOEL WHERE 1.2 AND 3 ARE ELECTRICAL DIMENSIONS 2 LARGE IIREAK MODEL 2 CORE COOLING LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-2 ECCS-MECHANICAL AND INSTRUMENTATION NETWORK MODELS REV.0-APRIL o*o l-I.>is N>is ilia::

  • ...-i5i>0 a l-*..,>is...a:<<0.....I-cO 0C.;:)11: 1--i8z...o!!2...:::l c Z...>uo 28..t-......CW 1>>0 LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-3 EMERGENCY CORE COOLING SYSTEM (EceS)SEPARATION SCHEME REV.0-APRIL 1984 BA1'TERY B RHR 8.RHR C 2 START RHR B START RHR C HPCS RCIC BATTERY C STOPHPCS BATTERY A STOP RCIC STAR'Hl"CS START RCrCo.REACTOR VESSel WATER LEVELo.HIGH DRYWELL PRESSURE 1.2.AND 3 ARE ELECTRICAL DIVISIONS LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-4 INITIATION LOGIC-RHR BAND C, HPCS, RCle REV.0-APRIL 1984 LSCS-UFSAR FIGURE 7.3-5 REV. 14 - APRIL 2002 SEE DRAWINGS 1E-1 (2)-4201AA THROUGH 1E-1 (2)-4201AR Un-rATION LOGIC ADS A ADS IJ A START ADSA 2 2 2 LPCS.RHR A., START ADS 8 START LPCS START RHR A (0.LOW REACTOR WATER LEVELo.HIGH DRYWELL PRESSURE REV.3-APRIL 1987.:>t*TIME DELAY I'.IHERE 1.2.AND 3 REPRESENT ELECTRICAL DIVISIONS LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT 7.3-6 I ITIATIJN LOGIC-ACS, LPCS, RHR A E F o.---.................

....--........... ...-.......t.......... ........................... ...::==--:,:u------

.._...__....-...............

................ _...---..,.....................

_-_.......................

,--......_--..-".....If.u_........_..*_.........-...._...-...... ..._.......,-................ -.---................ _-...... ---2 1 4 ,.:!..i!MI.!,-.IM MDCD!_i.....*I*Ii.5 6-7----1............ ......--......L_I a E D F c B.......... n.__-_-1.------ ..._....DWG.NO.732B191AA SHEBT 1 SPBC.NO.J-2500..LASALLE COUNTY STATION UPDf.TED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-1 LIWt DETECTION SYSTEM lED SHEET 1 OF 2 REV.13 c B JNSntlJV£NT5 IN 1M: HlllDUP AND F Ii).ur$UJT!l[1l 1'1'........"..fOf'fHl: HOlfJUP;.Nt)riO"OI:)tIS.tnCCiQER:NSlf1n....i:NfS Mt(N61* R£SP{'CTJvn, rOR fH(HQIl..OUP AHO'/0 JtOOWS.'-ECO"'OC-':

"'S-*Rwt!'tfS M£liII82'A..-rS"!i7'"IV£LY.

7 5 I 4:3*-'1-2 lro-UN<omeno", SYSl'EM OUTI..IN[ r-;,.,-----------) I I*I I f I I--.(**I::u....l I Tn!L../-I___..__.._.J o[B LtA',.".'tf"'tHH4 <;TlfTf'l4 1l"1\hUT:1W)ttCilJM';"'*1 c t"IMl.DFf;T'1"**L'f'Ua-.aJ"Qfflt J LSCS-UFSAR 5I*a E Il c II A 8 7 II LASAlLE COUN'lY STATION UPDATED FINAL SAFETY ANALYSIS FIGURE 7.3-7 Sheet 2 of2 LEr\K DETECTION SYSTEM REV.16, APRIL 2006 TOP VIEW:t r.-II...------.-,.--II"'"--.....II J 1 J f J j I 61 S9 57 55 53 51 49 47 45 43 41 39 37 35 33 31 29 27 25 23 21 19 17 15 13 11 09 01 05 03 01Local Power Range Monitoring System (LPRM)..Source Range Monitoring System (SRM)It Intermediate Range Monitoring System (IRM)43 Total Penetrations -55 4 8 LA SALLE COUNTY STATiON UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-8 VESSEL PENETRATIONS FOR NUCLEAR INSTRUMENTATION REV.1-APRIL 1985 ISOLA TlON TRIP SYSTEM A ISOLA TlON TRIP SYSTEM B.I I8 ENSORA',.I I ,...---r--' .I;--;:i;rt:1 I::*0':'-'__....J'--I-..J I CHANNEL A CHANNEL C I CHANNEL B CHANNEL 0 A-c POWER IREACTOR A-c POWER (REACTOR PROTECTION SYSTEM M-G CHANNELS PROTECTION SYSTEM M-G SET A OR SET B OR_A_-c.,;,..PO.,;,..W..;.ER_l I A_-c_PO..;;...W_f_R,;".1 _..1...1...1...c I la..1..0--:::E---:E--}INPUTS FROMI--E----:r.--I I'OTHER'I I__:::c...:r=__l TRIP C,ANNELS,__I.::r__T ISOLATION LOGICS=-r=T LOGIC Al LOGIC A2 I LOGIC 81 LOGIC B2 AI A2 1.2: I al ISOLATION ACTUATORS fROM I.e POWER fROM AC POWER FROM AC POWER FROM AC POWER RPS MG SET A RPS Me SET B RPS MG SET A RPS MG SET B Al 1 1 81 A2 1 1 821 TRIP III I ACTUATOR A2 f 1 82 AI f f Bl LOGICS INBOARO VALVES OUTBOARD VALVES LA SALLE COUNTY STATION FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-9 ISOLATION CONTROL SYSTEM FOR MAIN STEAMLINE ISOLATION VALVES REV.0-APRIL , eMll"lllL_A-c I'OW£It I/lf.ACTOII I"lIOtlCTIONSYSTlN ....c SET..Ott A-e 1'OWf".LSCS-UFSAR ISO...TIOM ,1ft" SYSTUI-I ISOLATIOIl rill,.USTO!I I ee I 1, I'I:-:;--*0;I'---J l..._I_.J I CHAN"E", e CHANNEL 0 A-c"OWlII[ACTOII ,""onCTION SYSTEIoIIltlo-C SET'011 A-c"OW"", LOCIC C i A J..c I.1...1.0--;I ..;:o' +/-f Tit..*CIWIINfU t__-r..:r:.._II--+-.....----,\It ISOLATION LOGICS-r-LOCICI LOGIC 11 AI.AI ,I trOGIC A'I'A'I.1 ISOLATION ACTUATORS VALVE CONTIIIOL."OWE" I Itl I I 1 L.J IIIIOTOI'CONTItOLLl!1t oUreaAIID VALVE CLOSIHC"OWEIl VALVE CLOS""C fIOWt:lt-----.--:--Li?------------ ..--L}?-.----

  • Applies to Group 2 (VP&WR)and Group 4 DC Power for LogiC Actuation for Group 2 (VI'&WR)and Group 4 LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-10_ISOLATION CONTROL SYSTEM USING MOTOR*OPERATED VALVES REV.13 LSCS*UFSAR AIR SUPP\.Y NC)nlIran"\ x....

r I.I I I I I I-r-'IIII*I I I I------r-I I I I I ,------,I I I I__...J LECEND (D3 WAY VALVE.NORGREN WAY VAL.VE:..NORGREN 3 THROT'T1.E VALVE..;I WAYVALVE 83 WAY SOLE.N.OlO VALVE@;I WAY SOLENOID VALVE@$PEEDCONTAOl.VALVE Q):r WAY VALVE: NORGREN@H"l't)RAUUC C'YUNDER LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-11 SHEET 1 MAIN STEAMLINE ISOLATION VALVE (SCHEMATIC) REV.13 "'13-1"601 ECCS PANEL REACTOR WA TEA CLEANUP AND RECIRC CONTROL PANEL...13.,602 MAIN REACTOR CONTROl.PANEL...13*P603 BARAIERS\Ir rBARRIERS\II DIV 3 OIV 2 OIV 1 I I I Ansa ADSA MSLIV MSLIV INBOARD OUTBOARD CONTROLS CONTROLS HflCS HPeS AHA RHR RHR LPeS RCIC DIG C B A CONTROLS CONTROLS CONTROLS---'""/\I\f I\I\I"/............. --"" I RPS CONTROLS I LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-12 CONTROL ROOM PANELS REV.0-APRIL 1984 LEGEND 0)3'dAY V/'..LVE: AS;"}GD TEE and PLUG SPRING CAt"J SOLENOID---EXHC,UST"'\Ei'JGAGG1EIH DEV i::E OV/TO 1*1A/;1 VALVE INSTRUHENT Q 0AIR SU P PLYi//I AIR CYL I tJDER I LA SALLE COU NTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.3-13 REV.3-APRIL 1987 VENT and PunGE ISOLATION VALVE (SCHEMATIC) LSCS-UFSAR FIGURE 7.5-1 REV. 18, APRIL 2010 See Drawings 1E-1(2)-4603AP thru AT For most current revision of REACTOR CONTROL BENCHBOARD PANEL ARRANGEMENT. LSCS-UFSAR FIGURE 7.5-2 REV. 14 - APRIL 2002 See Drawings 1E-1 (2)-4601AA thru AD for most current revision of REACTOR CORE COOLING BENCHBOARD PANEL ARRANGEMENT. LSCS-UFSAR FIGURE 7.5-3 REV. 14 - APRIL 2002 See Drawings 1E-1 (2)-4602AH thru 4602AJ for most current revision of REACTOR WATER CLEANUP AND RECIRCULATION BENCHBOARD PANEL ARRANGEMENT. LSCS-UFSAR jt=<l 1'8 t;...:8...j j::;)::;)a:: a::.s i i It.C!I Q i 8!!.!J p lis Jiil fI-jI a::<<l<I j r=-<l"2"2..III t:.I:: l5 j"" JI j 8 0 u a:: a::.s j i.5 f.;j!Ii I , I 0:s.f t!t!I-i J!I II tOt!!2!tit i I-,j I-g 8..l-I::.:s.j j 1il!(l)f!::E en I::E I s:e.$t I!It I I I , Q.i , f!f i I-c i!I.5 !Jw jl-LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-1 AREA TEMPERATURE MONITORING SYSTEM BLOCK DIAGRAM FIGURE 7.6-1 REV.16, APRIL 2006 VON . t~ V.DG f.-i"TUIMLOAATt Mllfic 1gNI1011j cx" --'.~.-CAL C W.~ 1 Ix 1< INTERM merit RANGE MONITOR NWI TIIIW LL 1 1 a" INTERh1EaATE RANGE MON. filAi~1NEL5 -RECTOR PROTECTION SYTEM-TRIP SYSTEM A p~1f,L AU1aLYLLLM > s w 7wo "v". wpM O OR LEVEL I LEVEL low. IMP. r L a: am"" 'e"~ wL a MFR 120-2M VAC. 34 +-vOLOOG r l eyalm TIP DRIVE MACH[ S A LEVEL START-UP RANGE NEUTRON MONITORING U OI. A CA G CIL L CN. A CKG \ JC1LA ~ NOTE 9 NUJ U L_ . " Tp.O CW " CAL w i APIM u L_.. Cw 0 C".. POWER DISTRIBUTION SRM DRIVE MOTORS a 0 0 C1L Co. uLn~ ~uL" ~-NGTE 9 ~ ~>>N C a o slw~c~rr~t oN SOURCE RANGE MON,CHANNELS aowc FLOW ItR3 tied 4, to ) u porpa 120 MAC 1. S (UPS Note I ) AE ICI DETAIL B ) O FIG. 2 LOR% w Tw Stir 041. nw a Rpa Au. war car u 3 Cow Law, - SOT"" or GO<<--r 0 0 0 C3 PERIOD RO" 1 NOTE 2. LIv" . LMM llKL ARdI. OR/LiY (NLFLRIwcaoT6CORLTOPVIEW) 12RNAC-+-120 VA.C. INST. BUS DIS c.# CK +~1 COUNT LOG p" NOTE ,00 ANT RATE 1. RATE ROW NOTE ,. E E NOTE 2. SOURCE RANGE MONITOR TRIPS DN INIST AIAFIMI pl DOWNWALAE fai . LEVEL INDP. PERT. A[RY1" itVt SEE REFERENCE DOCUMENT 4 FOR FUNCTIONAL USE OF THESE DEVIC,~S cu bb <<i1R`A Rs:- f-TAM DRIVE MOTORS-~ _ A RtEODRDERS--~ 8602 R603A R6638 R613C R"3D " Iw ~ aui wl f--!f ~!l ARM ~e+er TII" t 4" I r~ ;, UI~t,T 4 ,wr wN .La aa LIWT T!I ul'!~" IRM'i) --INTERMEDIATE RANGE HON. CHANNELS--- REACTOR PROTECTION SYSTEM TRIP SYSTEM "E' RECORDERS Ilbd/AWW/RBM (SEE DETAIL A J J J ~ J Y J J a a a a a a <E u W <o ~E m a nE o f J b< bLl bW b~ bm 60 b< bm FROM POWER RANGE NEUTRON MONITOR-SH. 2 DETAIL 0 t E ~ s7 55. 51 4 9 43 39 35 31 27 23 19 15 11 e7 83 41 33 25 17 89 FIG. 3 !I I'll 114 11 312 11 41 1 . CONTROL ROOM FROM INTERMEDIATE RANGE MgVI70R 56 62 06 1" 14 1 8 22 26 30 34 36 42 46 56 54 58 (TOP VIEW OF CORE) WHEN A ROD IS SELECTED IN ANY CROUP, THE LPRH.I DETECTOR ASSEMBLIES ASSIGNED TO THAT GROUP (SEE FIG. 3) ARE ROUTED VIA THE LPFD4 70 THE RBMS SUCH THAT THE A ! 'C' LEVEL DETECTOR SIGNALS 00 TO RBM S1 AND THE '" 8 b' LEVEL DETECTOR SIGNALS GO TO ROM V. WHEN A PERIPHERAL ROD (SHADED IN TIC. 3 IS SELECTED, THE R19M'S ARE AUTOMATICALLY 8YP . THE LPRbN SIGNALS ARE ROUTED TO THE LPRM LEVEL. GROUP DISPLAY AS SHOWN IN FIG. 2 WHEN A DETECTOR ASSDBY IS NOT PRESENT IN A GROUP THE CORRESPONDING READOUTS IN THE LPRM LEVEL GROUP DISPLAY WILL BE ZERO. RANGE MONITOR RM NTERMEDIATE RANGE MONITOR ROM ROD BLOCK MONITOR LPRM LOCAL POWER RANGE MONITOR APRN AVERAGE POWER PotNGE MONITOR TIP 1 INCA IN-CORE PROBE RGE SW R ITCH CH CHANNEL 57 53 48-45-41-37-33 ~ 29 21 ABlREVIATIONS

rcrnw~eo+ (es+.HNM FIG. 1 +~++++t t+ 0+ 0~0~000 0 ++ +0+ +Q+ +Q+ ++ ++ +O+ t+.+++ F ++`++++ +Q+~+~+ +Q+a+~+ +O++e++p+

+ ++ +++++d+a+ + +++ V ++ + 1+ + +~+ + +++++ + +I + +++ ++.+++ + +XL+++ b3 0 0 OoO .LQr ++ ++++++++ ~~~~~ , ++ ++ ++ ++ + +++++++ rjT as ~ 16 4 32 46 4a 11 12 20 26 36 44 -90' DETECTOR & CONTROL ELEMENT ARRANGEMENT SRM SPARE EMITTING SOURCE POSITION (7) NOTES: 1. PARTS ARE LOCATED A"CENT TO OR ON THE SIGNAL CONDITIONING EQUIPMENT PERF'ORM114G THE FUNCTION INDICATED. 2. PART IS LOCATED ON THE MAIN CONTROL ROOM PANEL. 3. POSITION INFORMATION IS INPUT EVERY 1 INCH, FLUX LEVEL INFORMATION IS INPUT EVERY 3 ]NICHES ON WITHDRAWAL. 4, ALL EQUIPMENT AND INSTRUMENTS ARE PREFIXED BY NUMBER C51 UNLESS OTHERWISE NOTED. 5. FOR LOCATION AND IDENTIFICATION OF INSTRUMENTS SEE INSTRUMENT DATA SHEET LISTED IN MPL FOR EACH INSTRUMENT. 6. 7. EXCEPT FOR PART NO. 10, THE EXACT ASSIGNMENT OF TIP GUIDE TUBES FROM SPECIFIC INDEXING MECHANISMS TO SPECIFIC POWER RANGE DETECTOR ASSEMBLIES IN RESPECTIVE GROUPS SHOWN IS DETERMINED BY OTHERS TABLE 2A. LASALLE E NINE MILE PT. 2. TABLE 28. HANFORD ONLY. 0. APRM CHANNEL *'C" OUTPUT SIGNAL Swill TO THE RECIRC. SYSTEM ADEPT WREN CNMNNIEL ' IS BY-PASSED APRM 'E' SIGNAL SHALL AUTOMATICALLY GO TO THE RECIRC. SYSTEM. 9. FLOW UNIT INCLUDES FLOW StMMERPOWER SUPPLY SOLARE ROOT FUNCTIONS AS SHOWN ON REFERENCE DWG. 2. I O. DELETED 11, N MP-2 USES AE SUPPLIED UPS POWER. REFERENCE DOCUMENTS: MPL ITEM NO. 1. REACTOR ASSEMBLY ARRANGEMENT-------813-2010

2. REACTOR RECIRCULATION STS. P&ID------8M/B35-1818
3. CONTROL ROD HYDRAULIC SYS. FCO------C11/CI2-1018
4. NEUTRON MONITORING SYS. FCD--------C51-1020 S. DESIGN SPECIFICATION-------------C51-4010
6. REACTOR PROTECTION SYS. TED,--------C71/72-1010 LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-2 NEUTRON MONITORING SYSTEM TED (SHEET 1 OF 2) REV, 18 - APRIL 2610 (TOP VIEW OF CORE) LEGEND + CONROL RODS (IO5) 0 LPRM DETECTOR ASM IN THE F+AWER RANGE DETECTORS ASM-TRIP SYSTEM Il (21) X SRM DETECTORS (4) LPRM DETECTOR ASM IN THE POWER WV~E A SRM EMITTING DETECTORS ASM-TRIP SYSTEM

'II' (22) SOURCES (7) ARM DETECTORS (6) 90'o o oDETECTORS (e)FIG.r DETECTOR&: CONTROL ELEMENT ARRANGEMENT (TOP VIEW Of COllE)LEGEND+CONlROL ROOS (185)X SI'lN DETECTORS (4)A SRW EIooImIHC SOURCES (7)$RW SPNlE DImINO SCUtCE POSmON (7) ,++--H--+t-+-+-FROIo4 INTERWEOIATE ItAHCE WONIlOR(SEE DETAIL A)0..0..PEIIllOO AUl NOTE 2.-----+----INTERMEDIATE RANGE MON.CHANNELS----I REACTOR PROTECTION SYSTEM TRIP SYSTEM"B'" LOC COUNT RATE.....NOTE 2.P£Rl00 NOTE 1.SOURCE RANGE MONITOR Kiii LOC COUNT RATE NOTE 1.INT£RMEQIAJE RAH<a MON,we lC60l r....UK 01 SEE REFERENCE DOCUWEHT 4 FOR fVNCTlONAl USE OF THE$(DEVICES DEIAlJ. r)START-UP RANGE NEUTRON MONITORING I------INTERHEDIATE RANGE MON. PROTtC.TOl SmEM-TR\p A FIG.:3 POWER DISTRIBUTION

  • MV*pc.

v.....C.INST.BU$-----NOTES: 1.PARTS AA£.LOCATED AOJICENT TO OR ON lHE SIGHAl COHomONIHC EQOIPWENT PERf""ORNIHG THE NNCTlON INDICATED. 2.PART ($LOCATED ON lHE WAlN CONTROL ROOM PANEL.3.POSITION 1Nf"OflIiI4TlON (S IN"UT MR'Y 1 INCH.FLUX LEVa (ff'ORMATION IS INPVl" EVERY 3 INCt£S ON WrTHDl'tRt'AL. 4.ALL EQU(PWENT AND INS'rRI..JWENTS AA£.PREFIXED BY NUNBER C51 UNLESS OTHERWISE NOTED.5.FOR LOCATION AND lOENllFlCATION OF INSTRUMENTS SEE INSTRUWENT o.TA SHEET LISTED IN FOR EACH INSTRUIoENT. 6.7.EXCEPT FOR PNU NO.18.Tt£EXACT ASSIGNIENT or TIP GUIDE TU£IES F'ROM SPECIfiC INDEXING MECIWlISNS TO SPEClnc POWER IWIGE DETECTOR ASSELeUES IN RESPECTIVE GROUPS SHOWN IS DETERMINED BY OTHERS2A, I.ASAU.E II NINE WILE PT.2.TABLE 29.HANFORD ONLY.e. PASSED APRW"r'SIGNAL SHAL1.AUTOWATlCALlY GO TO lHE RECIRC.SlSTEIot.9.now UNIT INCUJOES now SUMMER.POWER SUPPLY II SQUARE ROOT F"UNCTIONS AS SHOWN ON REFERENCE OWG.2.1**DELETED 11.NIolP-2 USESSUPPLIED uPS POWER.REfERENCE 1XlClAlENTS: MPLNO.1.REACTOR ASSEIooIIILY ARRANCEWENT-------B13-,.10 2.REACTOR RECIRCULATION SYS.PokJD------BJ3/835-1818 3.CONTROL ROO H'1'ORAULIC sYS.F"CD------Cl1/C12-1818 4.NEUTRON IoIONITORINC SYS.F'CD--------C51-1t20 5.DESIGN SPECIFICATlON-------------C51-4.10 6.REACTOR PROTECTION SYS.lED.--------cn/72-1.14.COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FICURE 7.6-2 NEUTRON MONITORINC SYSTEM lED (SHEET 1 OF 2)REV.18-APRIL NIl!) r"" c+" y r" r " ;+rr:+r: " rnn": " rr1: " trot": " re rr" r.-.NEW s o"" N"~""~" rrrrrr":~r.arrn'~f /r"/W/! " an""/"/rr/r":r;: """" r": " me an: " M t rr".!." DI " tier.~rrr" r~~" ti" r" r"'rrr/" r: "/n!!: rr:~r"~rnr." Cr"":+lrr: " rr!lr.: " l~rrr"~" r~" a" rlrsr."/r"!isr~ri/nrH/~rrrrur~ """ rr" rr/ " ra" ulr" lrr: "//""":+" 1:!" r"1:+ r.~r" sNyl1"/"" NOE " ios GENESIS :~nur rr~1" rrr" r. 1"" rxhy,l " " 1" man r Ifl r C k r T ltJ~ LFral ~nLrra u~ -b u~`~a. t (w l11" lF" hl#ti' 1'NYa1 L.a" A b lard IFm" M1 F 1 R 3 I a a r h r J Y Y w r Y h OS-~ b 9 . 7r~ 0 m z r c 0 z 0 Z 0 z 1 N "< l 3 9 d 'M" rt is Mi " c:ra lASAI..LE COUNTY STATION UPDATED nNAL SAFETY ANALYSIS REPORT FlCUR£: 7.6-2MONITORINC SVSfEt,l lEO (SHEET 2 Of 2)"----vJ Il**.,................... .........OJ=ISOlATED SIl>N'L III-I.E.LEVa SIGNAl..._--------FlA:I't'W:.'TlON ltt$11!M1'RIPS"t'STEM "8" ...'...._na_...t).-.M£T£R (&..P1bI\L.e VI L.)"-.0+TVPOFI......o-X-+--....---lI-......OoWoI T POWER RANGE NEUTRON MONITORING (INSTRIJt,jENTS PART OF K6r.l UNLESS OTHERWISE NOTED)......**.-.iL_..a&-***40..-...........*n...., 14<Ie 4O-Oe 2."I**...1 pe_................ e REV.18-APRIL 2810 lASAI..LE COUNTY STATION UPDATED nNAL SAFETY ANALYSIS REPORT FlCUR£: 7.6-2MONITORINC SVSfEt,l lEO (SHEET 2 Of 2)"----vJ Il**.,................... .........OJ=ISOlATED SIl>N'L III-I.E.LEVa SIGNAl..._--------FlA:I't'W:.'TlON lttS11!M1'RIPS"t'STEM "8" ...'...._na_...t).-.M£T£R (&..P1bI\L.e VI L.)"-.0+TVPOFI......o-X-+--....---lI-......OoWoI T POWER RANGE NEUTRON MONITORING (INSTRIJt,jENTS PART OF K6r.l UNLESS OTHERWISE NOTED)......**.-.iL_..a&-***40..-...........*n...., 14<Ie 4O-Oe 2."I**...1 pe_................ e REV.18-APRIL 2810

*-----.....--;.f a I I..-LSCS-UFSAR

--H--......-...---r--+--IMA+-"-- --LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-3 SRM/IRM NEUTRON MONITORING UNIT FIGURE 7.6-3 REV.12-MARCH 1998 r REV.0-APRIL 1984 III t u III i;C'"..II.LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-4 DETECTOR DRIVE SYSTEM SCHEMATIC I filial IE RICl1ROIR LOCAl L AlIP LOCAl LAllI'LA SALLE COUNTY STATION UPDATED fINAL SAH.IY ANALYSIS[{EPorn}TlilP 8 OUTPUT OOW!l*1-_____SCAlIAlARiI ON lfVll LOCAllAlll' -}TNIP OOulf'ul Uf\CM.1 1-------<HI-HI)TRIP ON LIVE[lIlP C TIIP 8 TlllP 0}JIllP AOOJPUT 1------INSTRUlllHT IHOP£IlAllV[ L--.J LOCAl LAllI'}TllIP C OUTPUT Uf\lAll I-TlllP SU'-------'IlOOULE IRTERlOCU-IS RllIOTf CONTROL[II(]lOR lalOUlf+}IV FIGURE 7.6-5 FUNCTIONAL BLOCK DIAGRIiN OF IRf1 CHANNEL REV.0 l\PRIL 19d4 I II I loI:I I...\0II-.......'"'":It I I...MI-........I'""" I Cl I M'" II"""wen lu)-I:lI en M Z I§" 0-r::r-;:: u I I.U..'"'"..;,;"" 0 cr I...cr I w 0 lOl<: ';i I-c::-:r-w cr 0 z I-.......0"'"'"I iii 0...w 0 I...w'"I-c:r-<<...>--'"......I";,;;,;Z:::l I......ci iri w u I;M......I'"...Z..J cr-0<<...I !i"":::lw U Z>w:::!:I%cr..J..J:::l III I""<C<Co(I.....N ,...'"'"'" , u: I!::>:::l1Xl <I(I l-III z L_________..J Q 0 I.,LOCO U<<z"'''' M W W""l-I w 0..J'"";,;'" z 3S,.:>DI 3£:>1 39:>1 801 at,.8L:>I OL:>I aDI at:>l:>C:>I l\1Z:>I'\1£)1 , j....DI-A V A...v...J\r-.J\r-..(.J., S:>INOI:I.J.:)n3 A'lI1:10SN3S .,..A<<..iii v<<'".,.,::>GIl s::>INOl:U.:>'113 ..III tiOSN3S v..0(V (ij I I\,-fj--------;;:-<<v I A I IlII:IOSN3S_V_<<iii-'\,-I-.......y A V"-"v--"--IL v S::>INOI:I.L:>3'3 A'llI:lOSN3S ..IXI A:;;..II)i v w>S:lINOlU.;)3'

I...'II:IOSN3S

..lD v iii I"v-0..S::>INOlU;),113.A'lII:1OSN3S v II)A iii v I Iy-....'"...w 2 Z<<:I: C)LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-6 REV.0-APRIL 1984 APRM CIRCUIT ARRANGEMENT FOR REACTOR PROTECTION SYSTEM INPUT SRII IRII LSCS*UFSAR LP"*i o OPfRA1ICIII SOURCl I lOll I*::>>........!II:...10 10::l'lI....i'it la'......Llt..*...all' H H U.T*...u..0:.......-......_....c*....!Ill._......t*e:t*I Cl......<I(.........!i II::I:...c!...lilt)0 J...::l...-I--Ill.::::I...-....*<I(......Cl.......*......IE>>-..J...::::I...*If Core flow<60%100 10 0.1.01 10-6*w!LASALLE COUNTY STATION UPDATED FINAL S.L\FETY ANAL YS1S REPORT FIGURE 7.6-7 RANGES OF NEUTRON MONITORING SYSTEM REV.13 =1-0 D DDOOI 0 1 OED 0 I..IRM DETECTOR, TRIP SYSTEM A*IRM DETECTOR, TRIP SYSTEM B@IRM DETECTOR, BYPASSED-$-NEXT CONTROL ROD WITHDRAWN IN SEQUENCE o CONTROL ROO WITHDRAWN OUT OF SeQUENCE'*CONTROL ROD WITHDRAWN LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-8 CONTROL ROD WITHDRAWAL ERROR FROM COLD CONDITION REV.0-APRIL 1984 w C1<{a: w><{UJ a: 8 o...w>;: c(.j w II:)(::l.j U...JII: w:r I-100------------------------------, 10 0.1 0.01 I........l-I....I.........5 0 5 10 15 20 RADIAL DISTANCE IN FUEL BUNDLES LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-9 NORMALIZED FLUX DISTRIBUTION FOR ROD WITHDRAWAL ERROR .J U.;...Z LU ()a: w 0.l:J3MOd 31ll,U. NOl.J.'o'11\30.l.N3:ll:l3d LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FI GURE 7.6-10 APRM TRACKING WITH REDUCTION IN POWER BY FLOW CONTROL REV.0-APRIL 1984 4 3 2 a::...:<: 0..w:l a:: I-::ii 0 a:: u..I-::f>...0 cw u a:: w..-1-2 12 10 8-3.l----....---...---...J.---_..J- ..I....J o 2 4 e CONTROL ROO POSITION (ft WITHDRAWN) LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.6-11 APRM TRACKING WITH ON-LIMITS CONTROL ROD WITHDRAWAL REV.0-APRIL 1'1

"-----'*----

........J..L...__-1.----...1..--.

  • c o UJMlJIOCI'II lCU_....1DI........amr**,.. 1lPt',_",.__ou ,-IIM-.,-hi*" 1liOUA.1 AI-C.-_._0 OPRM E ,....t rU-A5.-L EI APR'" E DPRUI:-=-'H L.--'---".---'

1-----(----f it..------{.__.....-,---1 t--_..--C----{RBM A BAY 4 ,...ru-c 1_c_I I I I I I I , III_D-, ,*tII FU-O BAY 2 I J I I'I I/T ,' ..-i,I I I l_I I I I RBM B I APRM A I APRM C OPRM I-!i_.j cI t I I:.&'=I 1-" I--OPRM G t-----.----f OPRM r 1-----._---{1---...*_.--1-,_I!IT No.I 1_J I[-_0 i I i I I 1 I , I---J, L'-----.-/"'-f--.. I , I I I I I BAY 1 1-101 ,-It F"U-B lPRM A APRM r_"_'l'M[...,..1_.-II o c*FRONT VIEW..LASALLE COUNTY STATION UPDATED FINAl.SAFETY ANALVSIS FIGURE 7.6-12 OPItM BLOCK INTERCONNEcrlON DIAGRAM POwf:n RANGE NEUTRON MONITORING CABINET 1(2)1113.1'008 ...-..-_.. REV.13 SHUTDOWN 400 IN, ALTERNATE REACTOR WATER LEVEL 496 IN.o FUEL ZONE-Ill INSTRUMENT ZERO UPSET 180 IN../MAIN STEAM NARROW WIDE RANGE RANGE 60 IN, 60 IN._00_ SEPARATOR DRYER SKIRT SHROUD-160 IN*......-----, ,---------'-..---------TAF-161 2.WIDE THE INSTRUMENTS ARE CALIBRATED FOR 1000 psig IN THE VESSEL.135°F IN THE DRYWELL.AND WITH NO JET PUMP 4.UPSET RANGE: THE INSTRUMENT IS CALIBRATED FOR SATURATED WATER AND STEAM CONDITIONS AT 1000 psig IN THE VESSEL AND 135°F IN THE DRYWELL.JET PUMP FLOW NORMAL.-311----BAF RECIRCULATION SYSTEM JET PUMPS 3.NARROW RANGE: THE INSTRUMENTS ARE CALIBRATED FOR SATURATED WATER AND STEAM CONDITIONS AT 1000 psig IN THE VESSEL 135°F IN THE DRYWELL.JET PUMP FLOW NORMAL.CALIBRATION CONDITIONS I, FUEL ZONE: THE IuSTRUM.ENTS ARE CALIBRATED FOR SATURATED WATER STEAM CONDITIONS AT 0 psig IN THE VESSEL MID THE DRYWELL WITH NO JET PUMP FLOW.CORE TOP OF ACTIVE FUEL nAF)5.SHUTDOWN: THE INSTRUMENT IS CALIBRATED FOR 12C'P WATER AT o psig IN VESSEL BooF IN THE DRYWELL.NO JET PUMP FLOW.6.AlL RWLIS: THE INSTRUMENT IS CALIBRATED FOR 120'F WATER AT 0 PSIG IN VESSEL AND 90'F IN DRYWELL WITH NO JET PUMP FLOW.IT CAN ONLY BE USED IN PlANT MODES 4&5.LA SALLE COU NTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-1 REACTOR VESSEL WATER LEVEL RANGES REV.17-APRIL 2008 I I 1 1 ____._____, I + 1 I s _ - " - " - - _ - - - " " - - - - - - - - - " " - " - - - - " " - " - V ill l elm ---- - ___""------ PHi: I I la d II in d I I wd Ill fill !rl I f ill - .~ -------------------------r """""_"_"_"-""_"_""" r""-"___""""_"_r"""-""-_"_"-"--------LLI 11 1 i! 1 1 1 i i II 1 II 1 1 :d Tt o l , --------------- _-"" ""-----_-- m F-0 a O 0 0 N N ,....-.-...,.,I*I Analog Ir--o;;-l-I A11 I M I i tt------..I'LOIIO!______.1**J... .. ..: Core........

            • -4a':***Core Map ,::*****I"'.........

...I'.'t CaIIIfDIer! DfspISV*I 8 I.......-II'c....I I I+-!.: ,..-------- ..._------..'-.......-.....--:.:.:+....... EIIImIt t I ,.............

"._a ,I: 20-:I: CG*oIIr H.,---!I"'""'" Rod Select: 'A: Display ,: Rod...: I: ,J: Rod geIIdI: ",.,."r--------

.....--t ModlIIe Ia--......i--"""'-*Swli:tta*J I NOftMAL I ,..,...------4 1'VP-A 5'IVP-I.1------""" RIghttid'(R1)TrantpandiIJI IBr..aa Amplliln 1 r....--........_--, To PPC (ChIn A)*r----..........-.....-I , Rod PoIltion.nbmIIon C8bInet , r J--I........ LA SALLE COUNTY STAnoN UPDATED FINAl SAFETY ANAlYSIS REPORT FIGURE 7.1-28 ROD CONTROl MANAGEMENT SYSTEM Rev.18, April 2010 ,....-.-...,.,I*I Analog Ir--o;;-l-I A11 I M I i tt------..I'LOIIO!______.1**J... .. ..: Core........

            • -4a':***Core Map ,::*****I"'.........

...I'.'t CaIIIfDIer! DfspISV*I 8 I.......-II'c....I I I+-!.: ,..-------- ..._------..'-.......-.....--:.:.:+....... EIIImIt t I ,.............

"._a ,I: 20-:I: CG*oIIr H.,---!I"'""'" Rod Select: 'A: Display ,: Rod...: I: ,J: Rod geIIdI: ",.,."r--------

.....--t ModlIIe Ia--......i--"""'-*Swli:tta*J I NOftMAL I ,..,...------4 1'VP-A 5'IVP-I.1------""" RIghttid'(R1)TrantpandiIJI IBr..aa Amplliln 1 r....--........_--, To PPC (ChIn A)*r----..........-.....-I , Rod PoIltion.nbmIIon C8bInet , r J--I........ LA SALLE COUNTY STAnoN UPDATED FINAl SAFETY ANAlYSIS REPORT FIGURE 7.1-28 ROD CONTROl MANAGEMENT SYSTEM Rev.18, April 2010 .....2 a*TG t I...FCF: q22D223 FINAL SAFETY ANALYSIS REPORT LA SALLE COUNTY STATION............. _------_..._----PlN"'o._..*...**.Ac.....*,IO..

    • 111 1.AI t.Ai....*---.........

... i.....................*. _______ ON'NDICI(I1)R PROMC\tt\.A 5,..I__L-_,--, A 8 D Fl:GtTlUB 7.7-4 ELEVE:ft-WIR£ POSITION PROBE , a**IH REV.0-APRIL 1984 IAS5000S1II MB300:=Master Bus 300 AEW AF100'" Advant Fieldbus 100 MB300 I!LAN I MIA Stations t AC450\AF100 111111 I\GateWayAC70+5800 110 I*+AC70+5800 110 I 5800 I/O for AWLCAC70+8800 I/O I Jet Pump Instrumentation F=l AC70+5800 1/0 I Flat Panel Ditoplay I I I Loop B I AC70+MODBU5Loop A=1 FCI+5800 1/0 I HPU HPU 21 I AA I..Subloop A1 Subloop A2 LogiC (")S 120Vac Process Instrumentation --l>KJ f--FCV Pump LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-5A CONFIGURATION OF THE RRFC SYSTEM REV.15, APRIL 2004 Individual Setpeint MUX Dec Inc INT+From A2 subloop Subloop A2 controller --'Servo Valve FCY Position (RVOT and LVDT}Recirculation Flow Loop A Position Error or FCV Veloclty Velocity Demand 1 Individual PositionSet 7 00int Man/Auto FCV Control output Servo Controller I El--P-crc. Function Valve-j Generator Position Umlter I+MUX Ganged Posillon Setpoln!+Dec Inc INT Dec Inc+MUX Bias Function INT+'7 Individual Position Setpelnt Individual Setpeint MUX Dec Inc+INT Man/Auto Function Generator Fev Control output FCVRunback FCV Velocity Position Servo Controller SubloopB1 From B2 subloop_Subloop B2 FCV Position controller Servo Valve (RYDT and LYDTl LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-56 TYPICAL RRFC SYSTEM CONTROL ALGORITHM OVERVIEW REV.15, APRIL 2004 MB300=Master Bus 300AF1 00=Ad van t Fie Id bus 1 00 L..--.f-------- ...TORFPA*LEVEL 8 TRIP FUNCTIONS___-Process Instrum entation MIA Stations II 125Vdc MB300 AF100 LAN LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-5C PRINCIPAL CONFIGURATION OF THE RWLC SYSTEM REV.15, APRIL 2004 MUX Dec Inc INT TDRFP A+Speed Man/Auto TDRFP A MUX Dec Inc+Man/Aulo+TDRFP B r W (J MUX W Dec C::: Inc"'j+W?d Common Conlrol Output PI Feedwater Flow Controller Post Scram Profile Signal SlnglelThree-Elemenl Conlrol----., Single-Element Conlroller PI Reactor Waler level Selpolnl INT-+Flow_Equalizer&Bias MUX+Dec Inc Individual Feedwaler Flow TDRFP A and B Feedwaler Flow Header-+I-----------------.J AandB-++Feedwater Flow DemandSoft MajOrity Selector level Contreller Reaclor Waler level*PI+...--,,..r....--+...o-3 Narrow Range-+M-IT.I Upset Range-S t ,-..,-.,-I-level Error+Sleam line Flow A-D-*r--------'Predefined Feedwater 4 Flow Selpolnl Profile--------.J dUring Scram.LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-50 RWLC SYSTEM CONTROL ALGORITHM OVERVIEW REV.15, APRIL 2004 LSCS-UFSAR 8FV RfTERENCF ()J REV.I7.APRIL 2008 LSCS-UFSAR 8FV RfTERENCF ()J REV.I7.APRIL 2008 LSCS-UFSAR M N REV .17, APRIL 2008 --+---+*LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-7 TRAVERSING INCORE PROBE ASSEMBLY REV.0-APRIL 1984

2....L.-__---:._......-_3--1-I.--4!S ____'_7 A A.ee:A MONtiOe:-. 'NlTHOO,/1A.Ux'.Ut---J,.T ACZ,elJa.. CL4ANI'Je:.L.- ""lTH J:;..UY--.. UN\,'L-e8Feli2.-,0 3-ADDITlONAl-c::?F"'0" Af-..JD t-A2....e" W\\")4 T""'es A-c:>eCAC;>1!5r"C>,-,PPL, E::P.4-E!:t<OF' Ut-.Jt-r(to-SOT 5-POE-Lo<:..,A..T\oto--J F'<::::..A'-'o,.,J OF" tN'OTR...Ut-...Ae.NT6** c:::¥\.T" n21-3050. IN RE.C.ORDE.R BOARO, Mll-'.aO.7-,-OMNONPOWlR SUPPL\t,S "'NO TR,\PRE.(ORDlR S LOl"TE..D IN ,- 8'( SMOWN ON 1)2.1-30'!lO. FINAL SAFETY ANALYSIS REPORT NO. TiU" u_rr!t FOI C.O"MO" ",ttlL M rr P.t.4 4\,e\pTtc:>+.J-D21-Pr&:OO U......,..,-o.Howt-.J-tr'<P)De,,A..\L-"'A." KD011)K&Ol£.AANCal QUANTITY (NQTL t)MR/HI

  • tOMvtllTtR UttiT'NDltf\rORTRlP UNIT NaTi.S UNIT UNIT COMN6M UNIT UNIT COMMQtf UMIT UNIT COYMON-,*z.*t-I..,*z.01-'00 l 5*0 0 0 t 5 fD 01-100011\1 1 Z., 19 11 12 1-\0'8 a z.:!a 3 ,&I 2.lOt.U,\, , 0 0 0 0 0 I 0 0 ,-De'e:>.-e.PeaA\-WlR.e" c.Ae&..:e:--A<Dz'-4010 2-

......... MO.....U-r'o--DZ-'-4CHO VO\\)SUPER-SE-TIED 13'(B c..8 E 2.5 REV 0---L-A-S-A-L-L-E-C-O-U-N-T-Y-S-T-A-T-IO-N-- .....}UNI,'"} }COM'-Rtll.}U/JI-r"',}VNrT....t:.}C.OM*I I FfZ..c:::)t-<\

,'Z,.oINe>TI2..Vt--te.t-..JT tt'i'P oF t:..)NOO!J (T'(P oFHOOt.(TY'Of ,)NC03 (TY'Of,)t"T'1'P c:>t=tN'POF.3)("'1'(P CJF: 2.)

K001 (fYP ()ft)KQ04 (ryp Of,)---- L-Oc.AL. I MUL::T"'lPO'toJ'T UNII'¢'eA-\C)wN, T"fP\CA.LUNl-!:.. HOT£.7 It--JDIGA-rOtr:.. .; Ut-..J\I MULTIPOINT t'r'-fp}Rt.C.OROLl O'fl=Uf-.,J"'" I..._----R"OOc..------K-(oo\(-r--<P 0'" L)}K(pOL("r'<PUNrr*1-c.OMMON KiO\(TYP\)}tOM K'Ot.(TY'Of')\ t-JoOt Z)}Noot.(\'(p ()Ipt I (0)LJfo.J,-r., ('TvP 0,......llYp OF t)t-JOO' }....OOt, ('-r-{POFU"-l\.,-..L(T'1'PMOO'(TYP}Maot (Tl'Of II)COM lkt." N003 iTY'Of')I t I l I" I I I I I I I I IIIL__, r------JIIII I IIII'I I I I r-------,--*-------------------l

.LI COMMaN C.OMlAOM e:EFUeu"-J

<:.a tJE!tN FlJEL-t:A::?W"-J ex::..6..L-& . e:o.LDI......<::t MONITORSAeeA,..\4\G::tH...\... RA.O'.o...Tto-J 1Z..bO\A.\'lOto-J RA,D'b:'TIQto..J eAo\A.rnOf'J , LOCALJ I I I tGL-.A)(ON I lJt.."-r-\(T'lP OF ce. l)t....1 rT.£C1'(p OF 5 I C.OM(TY'OF ZTYelPII I,t*...-------------------. A,e>,C see l,-.-6)CONTe:.ol-eue>I E F B o c H'FIGtJU 7.7-8 AREA RADIATION BLOCK DIAGRAM 8 7!5 4 2.....-....REV.0-APRIL 1984 lOCAl.PEIllOO11£ HR LA SALLE COUNTY STATION fINAL SAfETY ANALYSIS REPORT lOCAl.LC}IIETU REIIOIl LCR R£COl<<llR TIIlI'RUET Roon PU!IOOIiEHR t---<:>---} TRIP f OUIPUT PEIllOD }TIllP E OUTPUI L-.Jt-----... ,1I1-HII tOCAtlAMP}TRIP 0 OUTPUT[-:]:.::r:::::-:::L j-------UPleAt E ,"" lIVEl LOCAL tAMP}lRlP C OUTPUT l..J------O[I[CTORRURACT (00W!;leAlEI lOCAl.lAMP}TRIP 8 OUIPUT l.J-----..OOllttSCAl. I At ARII ON L!VEl lOCAl.lAMP}I RIP A It OUTPUT RU--............ o--ooq_9"-1-IHITIlUIIINI OPEl 0tt..,+L--.J CAl.UU IIOllULI IllEltlOCKI-I>V+I>Y HUKill ONIVI OIHTl<<ll fiGURE 7.7 9 FlJIICTIOIIAI BLOCK OIA(;WI/1 Of SRil CIlAIINH REV.0-APRIL 1984 LENGTH Of'ACllV1 FUEL 31"___--l--2"-f----o-*f IJI'fIII DUf:CTOIt DETtCTOlt nUIIIILECALI**TIOft Tuel DD aJ...---HTf.CTOIt 1M""DD_---f-:.......__'UEL IlIIOLl-=.a.:;;;;;;; =:.;.=-'CClt11lCL..IUDC DDDDDD DDDDDD DD DO LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-10 POWER RANGE MONITOR DETECTOR ASSEMBLY LOCATION REV.0-APRIL 1984 Note: Assignment is automati ca 11y initiated upon rod selection. 1"",V 1'\V r'\-V,\Vf'\.Vf'\. y,,\'/'/f'\.V i, V'\/r'\.V f'\./'\/"'f\..V"V V r'\.V r".1'\'/*"V l/" V f'\.r\.,.V'"'/'/"/f'\.-'"'/" V-/'"-V f'\.'" Vv" V--y r'\.V'"'"'/'"/-V" I I".'/"'-,/.I," y.1-'/'" I V",:1-"/I'-,/V'"I I V"--:t£"'/r'\..V--l-V"'/"-r'\..V'" V-::\": V"/.-'"'";.V"--,/"-V"'I/I'\.I/'"'"/I"-/'/'"'/"-." l1'""-/V"-/"-'" V"-/"-V"-'/'"'/,/"-V'/"'/,'/'i'../'V' V,V j I J I I1I 1 I 6 59 57 55 53 51 49 47 45 43 41 39 37 35 33 31 29 27 25 23 21 19 17 15 13 11 09 01 05 03 01 rsIZJ RSIiI AutClll1ltically Bypassed*Typical Rod Yielding Four LPRM Strings as InputIRe.ding zerofd)tyoical Rod Yielding Three*Ty,ical Rod Y e1ding Two LPRM lPRM Strings as Input Str1 ngs as Input LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-11 ASSIGNMENT OF LPRM INPUT TO RBM SYSTEM REV.0-AJ:'RIL otCDUOW'"Z...;:......u<<>-II: U C 1:....J i..::<<on<D c':5 0II:-'<<0..II:.....z'" z z 0<<u 1: U..;: l"l l"l l:i'" w+z:i l.: U 0-'..l"l II)'" 0....0 N N II: ,...------.:- .............,r__------------..,::: '-.-L..--L...J.- lilIf!§1VIl.INI lb-WBl:l LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-12 RBM RESPONSE TO CONTROL ROO MOTION (CHANNELS A AND C)REV.0-APRIL 1984

g<<aloew'""'i+z...w a:-'u a>...J: U Z::;i w" r-'(.)'"9 e0 al a:0....0 0 0 a: II: I-+It>Z CD-'0...u z z<<:I: u:;'""'ri l:i I--I-..L...L-.l..-__.L---l'--...::-o a 1VU.INI%*VolIHl LA SALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-13 RBM RESPONSE TO CONTROL ROD MOTION (CHANNELS B AND D)REV.0 APRIL B134 [J I*I.....**.....*",------,"-MOTOR FS NO.1 SEAL CAVITY--+----1.........NO.2 SEAL CAVITY 1<<'1'VMPSEAL IT AGING FLOW'tHIGH/LOWI TO DRYWILL EQUIPMENT SUMP"QUTER SEAL L EAUGE"LOW DETECTION" lHIGHI LA SALLE COUNTY STATION llPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.7-14 RECIRCULATION PUMP LEAK DETECTION BLOCK DIAGRAM REV.0-APRIL 1984 "\Ul}lImy IX]J IKOY-A"I HlyIX J J f1 0 I.IB"0" r_CR CR-a:I"",, 11 II 75b 4 1[)C[IWi l Cl05£0 WHEN Cl05l0 WlllN[IKOY I)fuME'A IS PIJMf'B IS 9 1KEY-B MI loll RUNNING HUNlJI NG-L" 10-II"'" l"" ,j"" c'1'"':>.0 II II M til cc M c.-b_tl b" 12 b 12 b j:)110C lOll t:*: I-<'>lOU 100 rr 1 I1;1 n 5 I I II I'Imy c (w)(w)-'RLY-I Xj"'f_J"ec"1 lIlf I ,L,,"'LL_'}'''' 2)nusml PI1MP III]]SlAin IKOiA IWYll tl4 IKOY F liME fRf(j.IDl Tor""".__....-'-'.,'.---"--".-'" I),vler IkDY C AGAS1Al lor 12 SIU CA I*."{OI2AH'ill-u-hi l." (5't:j.CLO::?", 0.:..-LtJ-w-w-II t 21 t 51 T j T4,,78 61 OlV ICl fllYIX RH Al niT IlGAllJ: I.J J orvin IWY t AGASIAl IYl'f GPIIi Wllll MlillflllllG CAl" AriD 5fllltlf,S '::,1.OEVICf IKlli-O AGAS1AI flPI (IPIIl WIlli MUUNTING CAI.III-I\OO'j', MID lUCKING SPIlINGS CA1./ICiW1HO::r;o lut IF}*.1"l"ntll.CJ..cu::.:t::;a:: B1l:1-.****2':.>o.:::"j.-":<<J,""'l!JQ4t-...,"I"'l 12 L"}11 I 10 l 14 I.R4}_t,'!1I--!1 I-, I I MIT M2 MlT 1011 114 CCI cc 101 d l..M'" 1.1 I I b 111101 II I , 4't I".t!J*f:'O 1,1 [, 21.4_f , n ,1.1_,111 1 ll[HI 141'101->C(,I lOU I I-I'-, 1'-*5-b I2LM II 9 CC" 111 L t I UU I I{)I d III 112 MJ'/OIVICf IKOY B fAGI (liPS lIN Ofl AY I CA1.IIIIPSIAf,[01l1t'1'[11 IIlal SIIiH ACE MulJH1IUG AnAI'ILII CAT.lllil",O n".OlV I Cl IKln A lAG![IlP50N ill!Ai II{)MINI CAT.UIlP5t>A6 tOU I ppm\/1111 SURFACE NOUNTlNG ADAPIlII CALUIlP)O)) (..;IdC,l..J-31 M t 8[CC r I M l-,-ci ,f,_, CC IOC_'_b b 4 TOO---6 3 L...r 81 cc 1-, 0 5, 1.1{-O-I.cc IOC-_,bb 4 IOU 6 III-,-<lei VI ejUl u;.. w-II l 2 1 l T:1 1 121c:-0 CJ r 1:>--l)..P1 U)CJ lJI C 3: II l-ou>---<r z ,--J:;>r rq'1 r fTI..7, G')If)0 C:1-C:.J;0'1 0 rn rr1 rt1 C-I.--1 rq---J-<Z:d I Cl t<:l---I""" p-;<: ""--1: I Z-<C, ,-);0-I::z uo r lJI-J-<--I ,f)-;......,...." l-l/l:P JTl-;'":.-p;0 0rn H'u Z I:'C);0 f-'--i\D'0 LSCS-UFSAR FIGURE 7.8-1 LASALLE COUNTY STATION UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 7.8-1 SPDS PRIMARY DISPLAY FIGURE 7.8-1 REV.11-APRIL 1996}}

Retrieved from "https://kanterella.com/w/index.php?title=ML14113A091&oldid=1359214"