System Description

DOE-STD -3009-94

hydrogen concentration in the dissolver offgas and provide a signal to

shutdown the dissolving operation before explosive concentrations of

hydrogen are reached." The specific accidents associated with the safety

function should be identified.

4.3.X.2

System Description

This subsection provides a description of the safety-class SSC and the basic

principles by which it performs its safety function (e.g., sensor and interlock

for hydrogen detector discussed in section 4.3.X.1). Describe its boundaries

and interface points with other SSCs relevant to the safety function.

Identify SSCs whose failure would result in a safety-class SSC losing the

ability to perform its required safety function. These SSCs would also be

considered safety-class SSCs for the specific accident conditions for which the

safety-class designation was made originally.

When describing the SSC, provide a basic summation of the physical

information known abo ut the SSC, including Process and Instrumentation

Drawings (P&IDs), or a simplified system drawing with reference to P&IDs.

If known, abstract and reference pertinent aspects of manufacturer's

specifications. Pertinent aspects are considered to be those that directly relate

to the safety function (e.g., diesel generator load capacity, time to load if

critical) as opposed to general industrial equipment specifications that fall out

from these capabilities (e.g., starting torque, motor insulation, number and type

of windings). Such lower tier details should be implicitly included only by

reference to the overall specifications.

4.3.X.3

Functional Requirements

This subsection identifies requirements that are specifically needed to fulfill

safety functions. Such functional requirements are specified for both the safety

class SSC and any needed support safety-class SSCs.

Limit functional requirement designation to those requirements necessary for

the safety function. Functional requirements are provided for safety-class

SSCs for the specific accident(s) where the safety-class SSC must function

(e.g., if that accident is not initiated by an earthquake, the functional

requirement does not involve seismic parameters).

Functional requirements specifically address the pertinent response parameters

or nonambient environmental stresses related to an accident for which the

safety function is being relied upon. In the hydrogen detector example, one

obvious parameter would be maintaining hydrogen concentration below the

explosive limit. If the offgas temperature was significantly above ambient

temperatures, operation at that temperature would be a functional requirement

as well.

Page 58