Text

Technical Specification Bases Pages Associated with License Amendment 236
	ML093490963
Person / Time
Site:	Vermont Yankee File:NorthStar Vermont Yankee icon.png
Issue date:	12/09/2009
From:	Mannal D; Entergy Nuclear Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	BVY 09-072
	Download: ML093490963 (109)
	v • d • e

Entergy Entergy Nuclear Operations, Inc.

Vermont Yankee P.O. Box 0250 Vernon, VT 05354 Tel 802 257 7711 David J. Mannai Licensing Manager BVY 09-072 December 9, 2009 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555

SUBJECT:

REFERENCE:

Technical Specification Bases Pages Associated with License Amendment 236 Vermont Yankee'Nuclear Power Station Docket No. 50-271 License No. DPR-28 Letter, USNRC to Entergy Nuclear Operations, INC.,

"Vermont Yankee Nuclear Power Station - Issuance of Amendment RE: Instrumentation Technical Specifications (TAC NO. MD8111)," NVY 09-062, dated June 12, 2009 1.

Dear Sir or Madam:

This letter provides revised Vermont Yankee Nuclear Power Station (VY) Technical Specification (TS) Bases pages. The TS Bases were revised in conjunction with an Amendment to Operating License DPR-28 issued in Reference 1.

These changes, processed in accordance with our Technical Specification Bases Control Program (TS 6.7.E), were determined not to require prior NRC approval. The revised Bases pages are provided as Attachment 1 for your information and for updating and inclusion with your copy of VY Technical Specifications. No NRC action is required in conjunction with this submittal.

There are no new regulatory commitments being made in this submittal.

Should you have any questions concerning this submittal, please contact me at 802-451 -

3304.

Sincerely,

[DJM/JMD]

Attachment:

1. Revised Technical Specification Bases Pages cc list (next page)

A6DI

BVY 09-072 Docket 50-271 Page 2 of 2 cc:

Mr. Samuel J. Collins, Region 1 Administrator U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406-1415 Mr. James S. Kim, Project Manager Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555 USNRC Resident Inspector Vermont Yankee Nuclear Power Station 320 Governor Hunt Road Vernon, VT 05354 Mr. David O'Brien, Commissioner VT Department of Public Service 112 State Street, Drawer 20 Montpelier, VT 05620-2601

BVY 09-072 Docket No. 50-271 Vermont Yankee Nuclear Power Station Revised Technical Specification Bases Pages

VYNPS BASES: 3.l.A/4.1.A REACTOR PROTECTION SYSTEM BACKGROUND The Reactor Protection System (RPS) initiates a reactor scram when one or more monitored parameters exceed their specified limits, to preserve the integrity of the fuel cladding and the reactor coolant pressure boundary (RCPB) and minimize the energy that must be absorbed following a loss of coolant accident (LOCA).

This can be accomplished either automatically or manually.

The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor.

This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance.

The LSSS are defined in this Specification as the Allowable Values, which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs) during Design Basis Accidents (DBAs)and transients.

The RPS, as described in the UFSAR, Section 7.2 (Ref.

1), includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram.

Functional diversity is provided by monitoring a wide range of dependent and independent parameters.

The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve (TCV) fast closure, turbine stop valve (TSV) position, drywell pressure, and scram discharge volume (SDV) water level, as well as. reactor mode switch in shutdown position and manual scram signals.

There are at least four redundant sensor input signals from each of these parameters (with.the exception of the reactor mode switch in shutdown scram signal and the manual scram signal).

Most channels include instrumentation that compares measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic.

The RPS is comprised of two independent trip systems (A and B) with three logic channels in each trip system (logic channels Al, A2, and A3; Bi, B2, and B3) as shown in Reference 1 figures.

Logic channels Al, A2, BI, and B2 contain automatic logic for which the above monitored parameters each have at least one input to each of these logic channels.

The outputs of the logic channels in a

trip system are combined in a one-out-of-two logic so that either channel can trip the associated trip system.

The tripping of both trip systems will produce a reactor scram.

This logic arrangement is referred to as a one-out-of-two taken twice logic.

In addition to the automatic logic channels, logic channels A3 and B3 (one logic channel per trip system) are manual scram channels.

Both must be deenergized in order to initiate the manual trip function.

Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip),

a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received.

This 10 second delay on reset ensures that the scram function will be completed.

Amendment No.

236 29

VYNPS BASES: 3.1.A/4.I.A REACTOR PROTECTION SYSTEM BACKGROUND (continued)

One scram pilot valve with two scram valves are located in the hydraulic control unit for each control rod drive (CRD).

Each scram pilot valve has two solenoids with the solenoids normally energized.

The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD.

When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram.

The scram valves control the supply and discharge paths for the CRD water during a scram.

One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B.

Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram.

The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS.

Additionally, the RPS System controls the SDV vent and drain valves. such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The actions of the RPS are assumed in the safety analyses of References 1, 2, and 3.

The RPS initiates a reactor scram when monitored parameter values exceed the trip values, specified by the setpoint methodology and listed in Table 3.1.1 to preserve the integrity of the fuel cladding, the RCPB, and the containment by minimizing the energy that must be absorbed following a LOCA.

RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c) (2) (ii).

Trip Functions not specifically credited in the accident analysis are retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

The operability of the RPS is dependent on the operability of the individual instrumentation channel Trip Functions specified in Table 3.1.1.

Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.1.1.

As a result, for most Trip Functions, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

Since the APRM flow biased flux scram Trip Setting is an Allowable Value, it is only considered inoperable if its actual trip setpoint is not within the Trip Setting specified in Table 3.1.1 The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each channel must also respond within its assumed response time, where applicable.

Amendment No.

236 30

VYNPS BASES:

3.l.A/4.l.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

The operability of scram pilot valves and associated solenoids, backup scram

valves, and SDV valves, described in the Background section, are not addressed by this LCO.

The individual Trip Functions are required to be operable in the MODES or other specified conditions indicated in Table 3.1.1, which may require an RPS trip to mitigate the consequences of a design basis accident or transient.

To ensure a reliable scram function, a combination of Trip Functions is required in each MODE to provide primary and diverse initiation signals.

The RPS is required to be operable in

RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212'F, and in Refuel with reactor coolant temperature < 212*F and any control rod withdrawn from a core cell containing one or more fuel assemblies.

Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and, therefore, are not required to have the capability to scram.

Provided all other control rods remain inserted, the RPS function is not required.

In this condition, the required Shutdown Margin and refuel position one-rod-out interlock ensure that no event requiring RPS will occur.

During normal operation in HOT SHUTDOWN and COLD SHUTDOWN, all control rods are fully inserted and the Reactor Mode Switch Shutdown Position control rod withdrawal block does not allow any control rod to be withdrawn.

Under these conditions, the RPS function is not required to be operable.

The specific Applicable Safety Analyses,

LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Mode Switch in Shutdown The Reactor Mode Switch in Shutdown Trip Function provides signals, via the manual scram logic channels, to two RPS logic channels, which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability.

This Trip Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

The reactor mode switch is a

single switch with two channels, each of which provides input into one of the manual RPS logic channels (A3 and B3).

The reactor mode switch is. capable of scramming the reactor if the mode switch is placed in the shutdown position.

There is no Trip Setting for this Trip Function, since the channels are mechanically actuated based solely on reactor mode switch position.

Two channels of Reactor Mode Switch in Shutdown, with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be operable.

The Reactor Mode Switch in Shutdown Trip Function is required to be Amendment No.

236 31

VYNPS BASES:

3.I.A/4.l.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) operable in

RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 2120 F, and in Refuel with reactor coolant temperature < 212OF and any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

2.

Manual Scram The Manual Scram push button channels provide signals to the manual scram logic channels (A3 and B3),

which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability.

This Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

There is one Manual Scram push button channel for each RPS trip system.

In order to cause a scram it is necessary for each trip system to be actuated.

There is no Trip Setting for this Trip Function since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of Manual Scram with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be operable in

RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F, and in Refuel with reactor coolant temperature < 212'F and any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

3.a.

Intermediate Range Monitor High Flux The IRMs monitor neutron flux levels from the upper range of the source range monitor (SRM) to the lower range of the average power range monitors (APRMs).

The IRMs are capable of generating trip signals that can be used to prevent fuel damage resulting from abnormal operating transients in the intermediate power range.

In this power range, the most significant source of reactivity change is due to control rod withdrawal.

The IRMs provide diverse protection from the rod worth minimizer (RWM),

which monitors and controls the movement of control rods at low power.

The RWM prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion.

The IRMs provide mitigation of the neutron flux excursion.

To demonstrate the capability of the IRM System to mitigate control rod withdrawal.events, a generic analysis has been performed (Ref.

3) to evaluate the consequences of control rod withdrawal events during startup.

This analysis, which assumes that one IRM channel in each trip system Amendment No.

236 32

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) is bypassed, demonstrates that the IRMs provide protection against local control rod withdrawal errors and results in peak fuel enthalpy below the 170 cal/gm fuel failure threshold criterion (Ref. 4).

The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed.

The IRM System is divided into two groups of IRM channels, with three IRM channels inputting to each trip system.

The analysis of Reference 3 assumes that one channel in each trip system is bypassed.

Therefore, four channels with two channels in each trip system are required for IRM operability to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range.

The analysis of Reference 3 has-adequate conservatism to permit the IRM Trip Setting of 120 divisions of a 125 division scale.

The Intermediate Range Monitor High Flux Trip Function must be operable during STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212OF when control rods may be withdrawn and the potential for criticality exists.

In Refuel with reactor coolant temperature < 212 0F, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions.

In RUN, the APRM System, the RWM, and the Rod Block Monitor provide protection against control rod withdrawal error events and the IRMs are not required.

3.b.

Intermediate Range Monitor Inop This trip signal provides assurance that a minimum number of IRMs are operable.

Anytime an IRM mode switch is moved to any position other than "Operate," whenever the detector voltage drops below a preset level, or when a module is not plugged in, an inoperative trip signal will be received by the RPS unless the IRM is bypassed.

Since only one IRM in each trip system may be bypassed, only one IRM in each RPS trip system may be inoperable without resulting in an RPS trip signal.

This Trip Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

Four channels of Intermediate Range Monitor Inop with two channels in each trip system are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

Amendment No.

236 33

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Since this Trip Function is not assumed in the safety analysis, there is no Trip Setting for this Trip Function.

This Trip Function is required to be operable when the Intermediate Range Monitor High Flux Trip Function is required.

4.a.

Average Power Range Monitor High Flux (Flow Bias)

The Average Power Range Monitor (APRM) channels receive input from the Local Power Range Monitors (LPRMs) within the reactor core, which provide indication of the power distribution and local power changes.

The APRM channels average these LPRM signals to provide continuous indication of average reactor power from a few percent to greater than Rated Thermal Power.

The Average Power Range Monitor High Flux (Flow Bias) Trip Function monitors neutron flux relative to the reactor coolant flow.

The trip level is varied as a function of recirculation drive flow (i.e., at lower core flows, the setpoint is reduced proportional to the reduction in power experienced as core flow is reduced with a fixed control rod pattern) and is clamped at an upper limit.

The relationship between recirculation drive flow and reactor core flow is non-linear at low core flows.

Due to stability concerns, separate APRM flow biased scram trip setting equations are provided for low core flows.

The flow bias portion of the Average Power Range Monitor High Flux (Flow Bias) Trip Function is not specifically credited in the accident or transient analyses, but is included to provide protection against transients where Thermal Power increases slowly and to provide protection against power oscillations which may result from reactor thermal hydraulic instabilities.

However, the clamp portion of the Average Power Range Monitor High Flux (Flow Bias) Trip Function is assumed to terminate the main steam isolation valve closure event and along with the safety/relief valves (S/RVs) limits the RPV pressure to less than the ASME Code limits.

The control rod drop accident (CRDA) analysis also takes credit for the clamp portion of this Trip Function to terminate the CRDA.

The APRM System is divided into two groups of channels with three APRM channels inputting into each trip system.

The system is designed to allow one channel in each trip system to be bypassed.

Any one APRM channel in a trip system can cause the associated trip system to trip.

Four channels of Average Power Range Monitor High Flux (Flow Bias) with two channels in each trip system arranged in a one-out-of-two logic are required to be operable to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 13 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the levels at which the LPRMs are located, except that channels A, C, D and F may lose all APRM inputs from the companion APRM cabinet plus one additional LPRM input and still be considered operable.

The LPRMs, themselves, do not provide a scram signal.

Each APRM channel receives one total drive flow signal representative of total core flow.

The total drive flow signals are generated by two flow converters, one Amendment No.

236 33a

VYNPS BASES:

3.I.A/4.I.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) of which supplies signals to the trip system A APRMs, while the other supplies signals to the trip system B APRMs.

Each flow converter signal is provided by summing up a flow signal from the two recirculation loops.

Each required Average Power Range Monitor High Flux (Flow Bias) channel requires an input from one operable flow converter (e.g.,

if a converter unit is inoperable, the associated Average Power Range Monitor High Flux (Flow Bias) channels must be considered inoperable).

An APRM flow converter is considered inoperable whenever it cannot deliver a flow signal less than or equal to actual recirculation flow conditions for all steady state and transient reactor conditions while in RUN.

The APRM flow biased flux scram Trip Setting is an Allowable Value, which is the limiting value that the trip setpoint may have when tested periodically, beyond which appropriate action shall be taken.

For Vermont Yankee, the periodic testing is defined as the calibration.

The actual scram trip is conservatively set in relation to the Allowable Value to ensure operability between periodic testing.

The Trip Setting is derived from the Analytical Limit assumed in the CRDA analyses.

W is percent of rated two loop drive flow where 100% rated drive flow is that flow equivalent to 48 X 106 lbs/hr core flow.

The Average Power Range Monitor High Flux (Flow Bias) Trip Function is required to be operable in RUN where there is a

possibility of generating excessive Thermal Power and potentially exceeding the SL applicable to high pressure and core flow conditions (SL l.1.A) and where there is the possibility of neutronic/thermal hydraulic instability.

During STARTUP/HOT STANDBY and Refuel, other IRM and APRM Trip Functions provide protection for fuel cladding integrity.

Although the Average Power Range Monitor High Flux (Flow Bias) Trip Function is assumed in the CRDA analysis, which is applicable in STARTUP/HOT STANDBY, the Average Power Range Monitor High Flux (Reduced)

Trip Function conservatively bounds the assumed trip

and, together with the assumed IRM trips, provides adequate protection.

Therefore, the Average Power Range Monitor High Flux (Flow Bias) Trip Function is not required in STARTUP/HOT STANDBY.

4.b. Average Power Range Monitor High Flux (Reduced)

The APRM channels receive input signals from the LPRMs within the reactor core, which provide an indication of the power distribution and local power changes.

The APRM channels average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than Rated Thermal Power.

For operation at low power (i.e.,

STARTUP/HOT STANDBY),

the Average Power Range Monitor High Flux (Reduced) Trip Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most operation at low power levels, the Average Power Range Monitor High Flux (Reduced) Trip Function will provide a secondary scram to the Intermediate Range Monitor High Flux Trip Function because of the relative setpoints.

With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor High Flux (Reduced) Trip Amendment No.

236 33b

VYNPS BASES: 3.l.A/4.l.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Function will provide the primary trip signal for a core-wide increase in power.

No specific safety analyses take direct credit for the Average Power Range Monitor High Flux (Reduced) Trip Function.

However, the Average Power Range Monitor High Flux (Reduced) Trip Function indirectly ensures that before the reactor mode switch is placed in the run position, reactor power does not exceed 23% RTP (SL 1.1.B) when operating at low reactor pressure and low core flow.

Therefore, it indirectly prevents fuel damage during significant reactivity increases with reactor power < 23% Rated Thermal Power.

The APRM System is divided into two groups of channels with three APRM channel inputs to each trip system.

The system is designed to allow one channel in each trip system to be bypassed.

Any one APRM channel in a trip system can cause the associated trip system to trip.

Four channels of Average Power Range Monitor High Flux (Reduced) with two channels in each trip system are required to be operable to ensure that no single failure will preclude a scram from this Trip Function on a valid signal.

In addition, to provide adequate coverage of the entire core, at least 13 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the levels at which the LPRMs are located, except that channels A, C, D and F may lose all APRM inputs from the companion APRM cabinet plus one additional LPRM input and still be considered operable. The LPRMs, themselves, do not provide a scram signal.

The Trip Setting is based on preventing significant increases in power when reactor power is

< 23% Rated Thermal Power.

The Average Power Range Monitor High Flux (Reduced) Trip Function must be operable during STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212*F when control rods may be withdrawn since the potential for criticality exists.

In RUN, the Average Power Range Monitor High Flux' (Flow Bias) Trip Functions provide protection against reactivity transients and the RWM and Rod Block Monitor protect against control rod withdrawal error events.

4.c.

Average Power Range Monitor Inop This signal provides assurance that a minimum number of APRMs are operable.

Anytime an APRM mode switch is moved to any position other than "Operate," an APRM module is unplugged, or th4 APRM has too few LPRM inputs (< 13 for channels B and E; < 9 for channels A, C, D and F),

an inoperative trip signal will be received by the RPS, unless the APRM is bypassed.

Since only one APRM in each trip system may be bypassed, only one APRM in each trip system may be inoperable without resulting in an RPS trip signal.

This Trip Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of' the RPS as required by the NRC approved licensing basis.

Amendment No. 236 33c

VYNPS BASES: 3.1.A/4.I.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Four channels of Average Power Range Monitor Inop with two channels in each trip system are required to be operable to ensure that no single failure will preclude a scram from this Trip Function on a valid signal.

There is no Trip Setting for this Trip Function.

This Trip Function is required to be operable in the MODES where the APRM Trip Functions are required.

5.

High Reactor Pressure An increase in RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion.

This causes the neutron flux and Thermal Power transferred to the reactor coolant to increase, which could challenge the integrity of the fuel cladding and the RCPB.

The High Reactor Pressure Trip Function initiates a scram for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power.

For the overpressurization protection analyses of Reference 5, reactor scram (the analyses conservatively assume scram from the APRM High Flux (Flow Bias) signal, not the High Reactor Pressure signal), along with the S/RVs, limits the peak RPV pressure to less than the ASME Section III Code limits.

High reactor pressure signals are initiated from four pressure transmitters that sense reactor pressure.

The High Reactor Pressure Trip Setting is chosen to provide a sufficient margin to the ASME Section III Code limits during the event.

Four channels of High Reactor Pressure Trip Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

The Function is required to be operable in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212OF since the Reactor Coolant System (RCS) is pressurized and the potential for pressure increase exists.

6.

High Drywell Pressure High pressure in the drywell could indicate a break in the RCPB.

A reactor scram is initiated to minimize the possibility of fuel damage and to reduce the amount of energy being added to the coolant and the drywell.

The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the requirements of 10 CFR 50.46 are met.

High drywell pressure signals are initiated from four pressure transmitters that sensedrywell pressure.

The Trip Setting was selected to be as low as possible and indicative of a LOCA inside primary containment.

Amendment No.

236 33d

VYNPS BASES: 3.l.A/4.I.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Four channels of High Drywell Pressure, with two channels in each trip system arranged in a one-out-of-two logic, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

The Trip Function is required in

RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212 0 F, where considerable energy exists in the RCS, resulting in the limiting transients and accidents.

7.

Reactor Low Water Level Low RPV water level indicates the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, a reactor scram is initiated at low water level to substantially reduce the heat generated in the fuel from fission.

The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling Systems (ECCS),

ensures that requirements of 10 CFR 50.46 are met.

Reactor Low Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Low Water Level Trip Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

The Reactor Low Water Level Trip Setting is selected to ensure that during normal operation spurious scrams are avoided and that enough water is available above the top of enriched fuel to account for evaporative losses and displacements of coolant following the most severe abnormal operational transient involving a reactor water level decrease.

The Trip Setting is referenced from top of enriched fuel.

The top of enriched fuel has been designated as 0 inches and provides a common reference point for all reactor vessel water level instrumentation.

The Trip Function is required in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212*F where considerable energy exists in the RCS resulting in the limiting transients and accidents.

ECCS initiations at low water levels provide sufficient protection for level transients in all other MODES.

Amendment No.

236 33e

VYNPS BASES: 3.1.A/4.l.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

8.

Scram Discharge Volume High Level The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram.

Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered.

Therefore, a reactor scram is initiated while the remaining free volume is still sufficient to accommodate the water from a full core scram.-

No credit is taken for a scram initiated from these Trip Functions for any of the design basis accidents or transients analyzed in the UFSAR.

However, they are retained to ensure the RPS remains operable.

There are four level transmitters and trip units associated with each instrument volume.

Four trip units (two for each instrument volume) are provided for each RPS trip system.

On a per instrument volume basis, these trip units are arranged in pairs so that no single event will prevent a scram from this Trip Function on a valid signal.

The Trip Setting is chosen low enough to ensure that there is sufficient volume in the SDVs to accommodate the water from a full scram.

Eight channels of the Scram Discharge Volume High Level Trip Function, with two channels per volume in each trip system, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

These Trip Functions are required in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212*F, and:

in Refuel with reactor coolant temperature < 212*F and any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

At all other times, this Trip Function may be bypassed.

9.

Main Steamline Isolation Valve Closure Main steamline isolation valve (MSIV) closure results in loss of the main turbine and the condenser as a heat sink for the nuclear steam supply system and indicates a need to shut down the reactor to reduce heat generation.

Therefore, a reactor scram is initiated on a Main Steamline Isolation Valve Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient.

However, for the overpressurization protection analyses of Reference 5, the Average Power Range Monitor High Flux (Flow Bias) Trip Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code limits.

That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis.

The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the requirements of 10 CFR 50.46 are met.

Amendment No.

236 33f

VYNPS BASES:

3.l.A/4.I.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

MSIV closure signals are initiated from position switches located on each of the eight MSIVs.

Each MSIV has two position switches; one switch inputs to RPS trip system A while the other switch inputs to RPS trip system B.

Thus, each RPS trip system receives an input from eight Main Steamline Isolation Valve Closure channels, each consisting of one position switch.

The logic for the Main Steam Isolation Valve Closure Trip Function is arranged such that either the inboard'or outboard valve on three or more of the main steam lines must close in order for a scram to occur.

In

addition, certain combinations of valves closed in two lines will result in a half-scram.

The Main Steam Isolation Valve Closure Trip Setting is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient.

Sixteen channels of the Main Steam Isolation Valve Closure Trip Function, with eight channels in each trip system, are requited to be operable to ensure that no single instrument failure will preclude the scram from this Trip-Function on a valid signal.

This Trip Function is only required in RUN since, with the MSIVs open and the heat generation rate

high, a pressurization transient can occur if the MSIVs close.

In STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212*F, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection.

10. Turbine Control Valve Fast Closure Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, a

reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves.

The Turbine Control Valve Fast Closure Trip Function is the primary scram signal for the generator load rejection event analyzed in Reference 6.

For this event, the reactor scram reduces the amount of energy required to be absorbed and ensures that the MCPR SL (SL 1.1.A) is not exceeded.

Turbine Control Valve Fast Closure signals are initiated by the four pressure switches that sense acceleration relay oil pressure.

Each pressure switch provides a signal to a separate RPS logic channel.

This Trip Function must be enabled at Thermal Power > 25% Rated Thermal Power.

This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Trip Function.

The Turbine Control Valve Fast Closure Trip Setting is selected to detect imminent TCV fast closure.

Amendment No.

236 33g

VYNPS BASES: 3.l.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Four channels of Turbine Control Valve Fast Closure with two channels in each trip system arranged in a one-out-of-two logic are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

This Trip Function is required, consistent with the analysis assumptions, whenever Thermal Power is > 25% Rated Thermal Power.

This Trip Function is not required when Thermal Power is

< 25% Rated Thermal Power, since the High Reactor Pressure and the Average Power Range Monitor High Flux (Flow Bias) Trip Functions are adequate to maintain the necessary safety margins.

11.

Turbine Stop Valve Closure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves.

The Turbine Stop Valve Closure Trip Function is the primary scram signal for the turbine trip event analyzed in Reference 7.

For this event, the reactor scram reduces the amount of energy required to be absorbed and ensures that the MCPR SL (SL I.1.A) is not exceeded.

Turbine Stop Valve Closure signals are initiated from limit switches located on each of the four TSVs.

Each TSV has one limit switch with two contacts; one contact inputs to RPS trip system A; the other contact inputs to RPS trip system B.

Thus, each RPS trip system receives an input from four Turbine Stop Valve Closure channels, each consisting of one limit switch contact.

The logic for the Turbine Stop Valve Closure Trip Function is such that three or more TSVs must be closed to produce a scram.

In addition, certain combinations of two valves closed will result in a half-scram.

This Function must be enabled at Thermal Power > 25% Rated Thermal Power.

This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Trip Function.

The Turbine Stop Valve Closure Trip Setting is selected to be high enough to detect imminent TSV closure, thereby reducing the severity of the subsequent pressure transient.

Eight channels of Turbine Stop Valve Closure, with four channels in each trip system, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal if any three TSVs should close.

This Trip Function is required, consistent with analysis assumptions, whenever Thermal Power is > 25% Rated Thermal Power.

This Trip Function is not required when Thermal Power is < 25% Rated Thermal Power since the High Reactor Pressure and the Average Power Range Monitor High Flux (Flow Bias) Trip Functions are adequate to maintain the necessary safety margins.

Amendment No.

236 33h

VYNPS BASES: 3.l.A/4.l.A REACTOR PROTECTION SYSTEM ACTIONS Table 3.1.1 ACTION Notes l.a.l) and l.a.2)

Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Ref.

8) to permit restoration of any inoperable channel to operable status.

However, this out of service time is only acceptable provided the associated Trip Function's inoperable channels are in only one trip system and the Trip Function still maintains RPS trip capability (refer to Bases for Table 3.1.1 ACTION Notes l.b.l), 1.b.2),

and l.c.l)).

If the inoperable channel cannot be restoredto operable status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Table 3.1.1 ACTION Note l.a.l) or l.a.2).

Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternatively, if it is not desired to place the channel (or trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram),

the applicable action of Table 3.1.1 ACTION Note 2 must be taken.

Table 3.1.1 ACTION Notes l.b.l) and l.b.2)

Table 3.1.1 ACTION Notes l.b.l) and 1.b.2) apply when, for any one or more Trip Functions, at least one required channel is inoperable in each trip system.

In this condition, provided at least one channel per trip system is operable, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system.

Table 3.1.1 ACTION Notes l.b.l) and l.b.2) limit the time the RPS scram logic, for any Trip Function, would not accommodate single failure in both trip systems (e.g., one-out-of-one and one-out-of-one arrangement for a typical four channel Trip Function).

The reduced reliability of this logic arrangement was not evaluated in Reference 8 for the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time.

Within the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the associated Trip Function will have all required channels operable or in trip (or any combination) in one trip system.

This is accomplished by either placing all inoperable channels in trip or tripping the trip system.

Completing one of these Actions (either Table 3.1.1 ACTION Note l.b.1) or l.b.2)) restores RPS to a reliability level equivalent to that evaluated in Reference 8, which justified a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowable out of service time as presented in Table 3.1.1 ACTION Note l.a.l) and l.a.2).

The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g., a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels if the two inoperable channels are in the same Trip Function while the four inoperable channels are all in Amendment No.

236 33i

VYNPS BASES: 3.1.A/4.l.A REACTOR PROTECTION SYSTEM ACTIONS (continued) different Trip Functions).

The decision of which trip system is in the more degraded state should be based on prudent judgment and take into account current plant conditions (i.e.,

what Mode the plant is in).

If this action would result in a scram, it is permissible to place the other trip system or its inoperable channels in trip.

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Trip Functions, and the low probability of an event requiring the initiation of a scram.

Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram, the applicable actions of Table 3.1.1 ACTION Note 2 must be taken.

Table 3.1.1 ACTION Note l.c.l)

Table 3.1.1 ACTION Note l.c.l) is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Trip Function result in the Trip Function not maintaining RPS trip-capability.

A Trip Function is considered to be maintaining RPS trip capability when sufficient channels are operable or in trip (or the associated trip system is in trip),

such that both trip systems will generate a trip signal from the given Trip Function on a valid signal.

For the typical Trip Function with one-out-of-two taken twice logic and the IRM and APRM Functions, this would requireboth trip systems to have one channel operable or in trip (or the associated trip system in trip).

For Trip Function 1 (Reactor Mode Switch in Shutdown) and Trip Function 2 (Manual Scram),

this would require both trip systems to have one channel, each operable or in trip (or the associated trip system in trip).

For Trip Function 8 (Scram Discharge Volume High Level), this would require both trip systems to have one channel per instrument volume operable or in trip (or the associated trip system in trip).

For Trip Function 9 (Main Steamline Isolation Valve Closure),

this would require both trip systems to have each channel associated with the MSIVs in three main steam lines (not necessarily the same main steam lines for both trip systems) operable or in trip (or the associated trip system in trip).

For Trip Function 11 (Turbine Stop Valve Closure), this would require both trip systems to have three channels, each operable or in trip (or the associated trip system in trip).

The Completion Time is intended to allow the operator time to evaluate and repair' any discovered inoperabilities.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion.Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Amendment No.

236 33j

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM ACTIONS (continued)

Table 3.1.1 ACTION Notes 2.a, 2.b, 2.c and 2.d If any applicable Action and associated completion time of Table 3.1.1 ACTION Note l.a, l.b, or l.c are not met, the applicable Actions of Table 3.1.1 ACTION Note 2 and referenced in Table 3.1.1 (as identified for each Trip Function in the Table 3.1.1 "ACTIONS REFERENCED FROM ACTION NOTE 1" column) must be immediately entered and taken.

The applicable Action specified in Table 3.1.1 is Trip Function and Mode or other specified condition dependent.

For Table 3.1.1 ACTION Note 2.a, 2.b, or 2.c, if the applicable channel(s) is not restored to operable status or placed in trip (or the associated trip system placed in trip) within the allowed completion time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply.

The allowed completion times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.

For Table 3.1.1 ACTION Note 2.d, if the applicable channel(s) is not restored to operable status or placed in trip (or the associated trip system placed in trip) within the allowed completion time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply.

This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies.

Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and

are, therefore, not required to be inserted.

Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

SURVEILLANCE REQUIREMENTS Surveillance-Requirement 4.1.A.1 As indicated in Surveillance Requirement 4.1.A.1, RPS instrumentation shall be

checked, functionally tested and calibrated as indicated in Table 4.1.1.

Table 4.1.1 identifies, for each RPS Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.1.A.1 also indicates that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Trip Function maintains RPS trip capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability Anendment No.

236 33k

VYNPS BASES: 3.l.A/4.l.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued) analysis (Ref. 8) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RPS will trip when necessary.

Surveillance Requirement 4.1.A.2, Automatic Scram Contactor Functional Test There are four pairs of RPS automatic scram contactors with each pair associated with an RPS scram test switch.

Each pair of scram contactors is associated with an automatic scram logic channel (Al, A2, B1, and B2).

Using the RPS channel test switches, the automatic scram contactors can be exercised without the necessity of using a scram function trip.

However, a Functional Test of any automatic RPS Trip Function may be used to satisfy the requirement to exercise the RPS automatic scram contactors.

Surveillance Frequency extensions for RPS Functions, described in Reference 8, are allowed provided the automatic scram contactors are exercised weekly.

This Surveillance may be accomplished by placing the associated RPS scram test switch in the trip

position, which will deenergize a pair of RPS automatic scram contactors thereby tripping the associated RPS logic channel.

The RPS scram test switches were not specifically credited in the accident analysis.

However, because the Manual Scram Trip Functions at the Vermont Yankee Nuclear Power Station (VYNPS) were not configured the same as the generic model in Reference 8,

the RPS scram test switches were evaluated and it was concluded that the Frequency extensions for RPS Trip Functions are not affected by the difference in RPS configuration since each automatic RPS channel has a test switch which is functionally the same as the manual scram switches in the generic model.

As such, exercising each automatic scram contactor is required to be performed every 7 days.

The Frequency of 7 days is based on the reliability analysis of Reference 8 as modified by the VYNPS design specific RPS evaluation.

Surveillance Requirement 4.1.A.3, RPS Response Time Test This Surveillance Requirement ensures that the individual channel response times are less than or equal to 50 milliseconds.

This test may be performed in one measurement or in overlapping segments, with verification that all required components are tested.

The "Once every Operating Cycle" Frequency is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure*, are infrequent occurrences.

Amendment No.

236 331

VYNPS BASES: 3.l.A/4.l.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued)

Surveillance Requirement 4.1.A.4 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel.

The testing required by the Control Rod System Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function.

The Frequency of "once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.1.1, Check Performance of an Instrument Check once per day for Trip Functions 3.a, 5,

and 7,

ensures that a gross failure of instrumentation has not occurred.

An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel, is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Footnote (a) of Table 4.1.1 provides requirements to verify overlap for Trip Functions 3.a and 4.b to ensure that no gaps in neutron flux indication exist from subcritical to power operation for monitoring core reactivity status.

The overlap between SRMs and IRMs is required to be demonstrated to ensure that reactor power will not be increased into a neutron flux region without adequate indication.

This is required prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from the SRMs to the IRMs.

The overlap between IRMs and APRMs is of concern when reducing power into the IRM range.

On power increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained.

Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have onscale readings such that.the transition between RUN and STARTUP/HOT STANDBY can be made without either APRM downscale rod block, or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, Amendment No.

236 33m

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued) prior to withdrawing the SRMs from the fully inserted position, IRMs are above mid-scale on range 1 before SRMs have reached the upscale rod block.

As

noted, IRM/APRM overlap is only required to be met during entry into STARTUP/HOT STANDBY from RUN.

That is, after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in STARTUP/HOT STANDBY).

If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap),

the reason for the failure of the Surveillance should be determined and the appropriate channel(s) declared inoperable.

Only those appropriate channels that are required in the current MODE or condition should be declared inoperable.

A Frequency of 7 days is reasonable based on engineering judgment and the reliability of the IRMs and APRMs.

Table 4.1.1, Functional Test A Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

For Trip Function 1, this Surveillance is performed by placing the reactor mode switch in the shutdown position.

For Trip Functions 2, 3.a, 3.b, 5,

6, 7,

8, 9,

10, 10.a, 11, and 11.a, this Surveillance verifies the trip of the required channel.

For Trip Functions 4.a, 4.b, and 4.c, this Surveillance verifies the trip of the required output relay.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

For Trip Functions 3.a, 3.b, and 4.b, as noted (Table 4.1.1 Footnote (b)), the Functional Test is not required to be completed when entering STARTUP/HOT STANDBY from RUN, since testing of the STARTUP/HOT STANDBY required IRM and APRM Trip Functions cannot be performed in RUN without utilizing jumpers, lifted leads, or movable links.

This allows entry into STARTUP/HOT STANDBY if the required Frequency is not met.

In this event, the Surveillance must be completed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering STARTUP/HOT STANDBY from RUN.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance.

For Trip Function 4.b, a Frequency of 7 days provides an acceptable level of system average unavailability over the Frequency interval.

For Trip Functions 3.a and 3.b, the Frequency of 31 days is based on the safety assessment described in Reference 9.

For Trip Functions 2, 4.a, 4.c, 5,

6, 7,

8, 9,

10, and 11, the Frequency of "Every 3 Months" is based on the reliability analysis of Reference 8.

For Trip Functions 10.a and ll.a, the Frequency of "Every 6 Months" is based in engineering judgment and reliability of the components.

Amendment No.

236 33n

VYNPS BASES: 3.I.A/4.I.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued)

For Trip Function 1, The Frequency of "Each Refueling Outage" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.1.1, Calibration For Trip Function 4.a, to ensure that the APRMs are accurately indicating the true core average power, the APRMs are adjusted to conform to the reactor power calculated from a heat balance.

The Frequency of once per 7 days is based on minor changes in LPRM sensitivity, which could affect the APRM reading between performances of APRM adjustments (per heat balance).

Footnote (d) to Table 4.1.1 requires this heat balance Surveillance to be performed only at Ž 23% Rated Thermal Power because it is difficult to accurately maintain APRM indication of core Thermal Power consistent with a heat balance when < 23% Rated Thermal Power.

At low power levels, a high degree of accuracy is unnecessary because of the large, inherent margin to thermal limits (MCPR and APLHGR).

At ý 23% Rated Thermal Power, the Surveillance is required to have been satisfactorily performed within the last 7 days.

Footnote (d) is provided which allows an increase in Thermal Power above 23%

if the 7 day Frequency is not met.

In this event, the Surveillance must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching or exceeding 23% Rated Thermal Power.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance.

For Trip Function 4.a, LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP) System.

This establishes the relative local flux profile for appropriate representative input to the APRM System.

The 2000 mega-watt days per short ton (MWD/T)

Frequency is based on operating experience with LPRM sensitivity changes, and that the resulting nodal power uncertainty, combined with other uncertainties, remains less than the total uncertainty (i.e., 8.7%) allowed by the GETAB safety limit analysis.

For Trip Functions 3.a, 4.a, 4.b, 5, 6, 7,

8, 9, 10, 10.a, 11, and ll.a, an Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Instrument Calibration for Functions 9 and 11 should consist of a physical inspection and actuation of the associated position switches.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

Amendment No.

236 33o

VYNPS BASES: 3.I.A/4.I.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued)

For Trip Functions 4.a, 5,

6, 7, and 8, a calibration of the trip units is required (Footnote (e))

once every 3 months.

Calibration of the trip units provides a check of the actual setpoints.

Trip function 4.b receives trip unit calibration (Footnote(e))

on a

7 Day Frequency during Refueling, before entering STARTUP/HOT STANDBY, and during STARTUP/HOT STANDBY.

For Trip Functions 4.b,5,6,7, and 8, the channel must be declared inoperable if the trip setpoint is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures.

The calibration of Trip Function 4.a, the APRM High Flux Flow Bias Scram, trip units provides a check of the actual trip setpoints.

If the trip setting is found to be less conservative than accounted for in the appropriate setpoint calculation,, but is not beyond the Allowable Value specified in Table 3.1.1, the channel performance is still within the requirements of the plant safety analysis.

However, if the trip setting is found to be less conservative than the Allowable Value specified in Table 3.1.1, the channel should be declared inoperable.

Under these conditions, the setpoint should be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint calculation.

The Frequency of every 3 months is based on the reliability analysis of Reference 8 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

Footnote (b) to Table 4.1.1 is provided to require the APRM and IRM Surveillances to be completed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering STARTUP/HOT STANDBY from RUN. Testing of the STARTUP/HOT STANDBY APRM and IRM Trip Functions cannot be performed in RUN without utilizing jumpers, lifted leads, or movable links.

This Footnote allows entry into STARTUP/HOT STANDBY from RUN if the associated Frequency is not met.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance.

Footnote (c) to Table 4.1.1 states that neutron detectors are excluded from Instrument Calibration because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal.

Changes in LPRM neutron detector sensitivity are compensated for by performing the 7 day heat balance calibration and the 2000 MWD/T LPRM calibration against the TIP System.

Amendment No.

236 33p

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM REFERENCES

1.

UFSAR, Section 7.2.

2.

UFSAR, Chapter 14.

3.

NEDO-23842, Continuous Control Rod Withdrawal in the Startup Range, April 18, 1978.

4.

UFSAR, Section 14.5.3.

5.

UFSAR, Section 14.5.1.3.1

6.

UFSAR, Section 14.5.1.1.

7.

UFSAR, Section 14.5.1.2.

8.

NEDC-30851-P-A, Technical Specification Improvement Analyses for BWR Reactor Protection System, March 1988.

9.

Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment No.

225 to Facility Operating License No.

DPR-28, Entergy Nuclear Vermont Yankee, LLC and Entergy Nuclear Operations Inc.,

Vermont Yankee Nuclear Power Station, Docket No.

50-271, dated July 7, 2005.

Amendment No.

236 33q

VYNPS BASES: 3.2.Ai4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the ECCS to ensure that the fuel is adequately cooled in the event of a design basis accident or transient.

For most abnormal operational transients and Design Basis Accidents (DBAs),

a wide range of dependent and independent parameters are monitored.

The ECCS instrumentation actuates core spray (CS),

the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR)

System, high pressure coolant injection (HPCI),

Automatic Depressurization System (ADS),

and the diesel generators (DGs).

The equipment involved with each of these systems is described in Bases 3.5, "Core and Containment Cooling Systems,"

and in Bases 3.10, "Auxiliary Electrical Power Systems."

Core Spray System The CS System consists of two subsystems (A and B).

Subsystem A is identical in function to subsystem B.

Automatic initiation occurs for conditions of Low -

Low Reactor Vessel Water Level and-Low Reactor Pressure (Initiation) or High Drywell Pressure.

The Low -

Low Reactor Vessel Water Level and High Drywell Pressure diverse variables are each monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a

one-out-of-two taken twice logic (i.e.,

two trip systems) for each Trip Function.

The Low Reactor Pressure (Initiation) signals are initiated from two pressure transmitters that sense reactor pressure.

Each pressure transmitter provides an input to both CS trip systems with the contacts arranged in a one-out-of-two logic.

Upon receipt of an initiation

signal, if normal AC power is available, both CS pumps start.

If an initiation signal is received when normal AC power is not available, the CS pumps are started approximately 9 seconds after power is available to limit the loading of the AC power sources.

The CS test line isolation valve, which is also a primary containment isolation valve (PCIV),

is closed on a CS initiation signal to allow full system flow assumed in the accident analyses and maintain primary containment isolated in the event CS is not operating.

The CS System also monitors the pressure in the reactor to ensure that, before the injection valves open, the reactor pressure has fallen to a value below the CS System's maximum design pressure.

The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

The status of the normal and emergency AC power supplies necessary for pump operation is also monitored.

This ensures that load sequencing occurs Amendment No.

236 75

VYNPS PASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued) if normal AC power is not available.

These parameters are monitored by relays (Auxiliary Power Monitors and Pump Bus Power Monitors) whose outputs are arranged in a one-out-of-one logic and a one-out-of-two logic, respectively.

Low Pressure Coolant Injection System The LPCI is an operating mode of the Residual Heat Removal (RHR)

System, with two LPCI subsystems (A and B).

Subsystem A is identical in function to subsystem B.

Automatic initiation occurs for conditions of Low -

Low Reactor Vessel Water Level concurrent with Low Reactor Pressure (Initiation) or High Drywell Pressure (Initiation).

Each of these diverse variables, except Low Reactor Pressure (Initiation) is monitored by four redundant transmitters,

which, in turn, are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e.,

two trip systems) for each Trip Function.

The High Drywell Pressure signals are also used for the containment spray permissive.

The Low Reactor Pressure (Initiation) signals are initiated from two pressure transmitters that sense reactor pressure.

Each of these pressure transmitters provides an input to both low pressure ECCS logic trains with the contacts arranged in one-out-of-two logic.

Once an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset.

Upon receipt of an initiation

signal, if normal AC power is available, the LPCI pumps are started with no time delay.

If normal AC power is not available, LPCI pumps A and D start immediately once power is available and LPCI pumps B and C are started approximately 4 seconds after power is available to limit the loading of the AC standby'power sources.

The RHR containment cooling return line valves, torus spray isolation valves, and drywell spray isolation valves (which are also PCIVs) are also closed on a LPCI initiation signal to allow the full system flow assumed in the accident analyses and maintain primary containment isolated in the event LPCI is not operating.

The LPCI System monitors the pressure in the reactor to ensure that, before an injection valve opens, the reactor pressure has fallen to a value below the LPCI System's maximum design pressure.

The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Additionally, instruments (i.e.,

reactor water level and reactor pressure) are provided to close the recirculation loop pump discharge valves to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines.

The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a

one-out-of-two taken twice logic.

Amendment No. 236 75a

VYNPS PASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued)

Low reactor water level in the shroud is detected by two additional instruments.

When level is greater that the trip setting of the LPCI Reactor Vessel Shroud Level Trip Function, LPCI may no longer be required, therefore, other modes of RHR (e.g., suppression pool cooling) are allowed.

Manual overrides for the isolations, when water level is below the associated trip setting, are provided.

The status of the normal and emergency AC power supplies necessary for pump operation is also monitored.

This ensures that load sequencing occurs if normal AC power is not available.

These parameters are monitored by relays (Auxiliary Power Monitors and Pump Bus Power Monitors) whose outputs are arranged in a one-out-of-one logic anda one-out-of-two logic, respectively.

High Pressure Coolant Injection System Automatic initiation of the HPCI System occurs 'for conditions of Low -

Low Reactor Vessel Water Level or High Drywell Pressure.

Each of these variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Trip Function.

The HPCI test line isolation valves are closed upon receipt of a HPCI initiation signal to allow the full system flow assumed in the accident analysis.

The HPCI System also monitors the water level in the condensate storage tank (CST).

Reactor grade water in the CST is the normal source.

Upon receipt of a HPCI initiation signal, the CST suction valve is automatically signaled to open.

If the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open.

When the suppression pool suction valves start to open, the CST suction valve automatically closes.

Two level transmitters are used to detect low water level in the CST.

Either transmitter can cause the suppression pool suction valves to open and the CST suction valve to close.

The HPCI System provides makeup water to the reactor until the reactor vessel water level reaches the High Reactor Vessel Water Level trip, at which time the HPCI turbine trips, which causes the turbine's stop valve to close.

This variable is monitored by two transmitters, which are, in turn, connected to two trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a two-out-of-two logic to provide high reliability of the HPCI System.

The HPCI System automatically restarts if a Low -

Low Reactor Vessel Water Level signal is subsequently' received.

Amendment No.

236 75b

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued)

Automatic Depressurization System Automatic initiation of the ADS occurs when signals indicating Low Low Reactor Vessel Water Level; High Drywell Pressure, or sustained Low -

Low Reactor Vessel Water Level; and CS or RHR (LPCI Mode)

High Pump Discharge Pressure are all present and the ADS Time Delay has timed out.

There are two transmitters for Low -

Low Reactor Vessel Water Level and High Drywell Pressure in each of the two ADS trip system logics.

Each of these transmitters connects to a trip unit, which then'drives a relay whose contacts form the initiation logic.

Each ADS trip system logic includes a time delay between satisfying the initiation logic and the actuation of the ADS valves.

The ADS Time Delay setpoint chosen is long enough that the HPCI System has sufficient operating time to recover to a level above Low -

Low Reactor Vessel Water Level, yet not so long that the LPCI and CS Systems are unable to adequately cool the fuel if the HPCI System fails to maintain that level.

An alarm in the control room is annunciated when either of the timers is timing.

Resetting the ADS initiation signals resets the ADS Time Delay.

The ADS also monitors the discharge pressures of the four LPCI pumps and the two CS pumps.

Each ADS trip system includes two discharge pressure permissive switches from one CS pump and from each LPCI pump..

The signals are used as' a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel.

Any one of the six low pressure pumps is sufficient to permit automatic depressurization.

The ADS logic in each trip system logic is arranged in two strings.

Each string has a contact from each of the following variables: Low -

Low Reactor Vessel Water Level; High Drywell Pressure; and Sustained Low -

Low Reactor Vessel Water Level Time Delay.

All required contacts in both logic strings must close, the ADS Time Delay must time out, and a CS or LPCI pump discharge pressure signal must be present to initiate an ADS trip system logic.

Either the A or B trip system logic will cause all the ADS relief valves to open.

Once the High Drywell Pressure signal, Sustained Low -

Low Reactor Vessel Water Level Time Delay, or the ADS initiation signal is present, the trip system logic is sealed in until manually reset.

Manual inhibit switches are provided in the control room for the ADS; however, their function is not required for ADS operability (provided ADS is not inhibited when required to be operable).

Amendment No.

236

'75c

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued)

Diesel Generators Automatic initiation of the DGs occurs for conditions of Low -

Low Reactor Vessel Water Level or High Drywell Pressure.

Each of these diverse variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the four trip units are connected to relays whose contacts are connected to a one-out-of-two taken twice logic to initiate all DGs.

The DGs receive their initiation signals from the CS System initiation logic.

The DGs can also be started manually from the control room and locally from the associated DG room.

Upon receipt of a loss of coolant accident (LOCA) initiation signal, each DG is automatically started, is ready to load within 13 seconds, and will run in standby conditions (rated voltage and frequency, with the DG output breaker open).

The DGs will only energize their respective 4.16 kV emergency buses if a loss of offsite power occurs or if a degraded voltage occurs concurrent with an accident signal.

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY The actions of the ECCS are explicitly assumed in the safety analyses of References 1 and 2.

The ECCS is initiated to preserve the integrity of the fuel cladding by ensuring the requirements of 10 CFR 50.46 are met.

ECCS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c) (2)'(ii). Certain instrumentation Trip Functions are retained for other reasons and are described below in the individual Trip Functions discussion.

The operability of the ECCS instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions specified in Table 3.2.1.

Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures.

Operation.

with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.1.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

In general, the individual Trip Functions are required to be operable in the Modes or other specified conditions that may require ECCS (or DO) initiation to mitigate the consequences of a design basis transient or accident.

Table 3.2.1 Footnotes (a),

(b),

and (c) specifically indicate other conditions when certain ECCS Instrumentation Trip Functions are required to be operable.

To ensure reliable ECCS and DG functioh, a combination of Trip Functions is required to provide primary-and secondary initiation signals.

The specific Applicable Safety Analyses,

LCO, and Applicability discussions are listed below on a Trip Function by Trip Function basis.

Amendment No.

236 75d

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Core Spray and Low Pressure Coolant Injection Systems l.a, 2.b.

High Drywell Pressure High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB).

The low pressure ECCS and associated DGs are initiated upon receipt of the High Drywell Pressure Trip Function in order to minimize the possibility of fuel damage.

The High Drywell Pressure Trip Function, along with the Low -

Low Reactor Vessel Water Level Trip Function is directly assumed in the analysis of the recirculation line break (Ref. 1).

The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS),

ensures that the requirements of 10 CFR 50.46 are met.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure.

The Trip Setting was selected to be indicative of a LOCA inside primary containment.

The High Drywell Pressure Trip Function is required to be operable when the ECCS or DG is required to be operable in conjunction with times when the primary containment is required to be operable.

Thus, four channels of the CS and LPCI High Drywell Pressure Trip Functions are required to be operable in

RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN and Refuel (with reactor coolant temperature > 212qF) to ensure that no single instrument failure can preclude ECCS and DG initiation.

In other Modes or conditions, the High Drywell Pressure Trip Function is not required, since there is insufficient energy in the reactor to pressurize the primary containment to High Drywell Pressure setpoint.

l.b, 2.c.

Low -

Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

The low pressure ECCS and associated DGs are initiated at Low -

Low Reactor Vessel Water Level to ensure that core spray and flooding functions are available to prevent or minimize fuel damage.

The Low -

Low Reactor Vessel Water Level is one of the Trip Functions assumed to be operable and capable of initiating the ECCS and associated DGs during the accidents analyzed in References 1 and 2.

The core cooling function of the

ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

Low -

Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Amendment No.

236

'75e

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

The Low -

Low Reactor Vessel Water Level Trip Setting is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.

The Trip. Setting is referenced from the top of enriched fuel.

Four channels of Low -

Low Reactor Vessel Water Level Trip Function are only required to be operable when the ECCS or DG(s) are required to be operable to ensure that no single instrument failure can preclude ECCS and DG initiation.

l.c, 2.a.

Low Reactor Pressure (Initiation)

Low reactor pressure signals, in conjunction with low RPV level, indicate that the capability to cool the fuel may be threatened.

The low pressure ECCS are initiated upon simultaneous receipt of a low reactor pressure and a low-low reactor vessel water level signal to ensure that the core spray and flooding functions are available to prevent and minimize fuel damage.

The Low Reactor Pressure (Initiation) is one of the Trip Functions assumed to be operable and capable of permitting initiation of the ECCS during the accidents analyzed in References 1 and 2.

In addition, the Low Reactor Pressure (Initiation) Trip Function is directly assumed in the analysis of the recirculation line break (Ref.

1).

The core cooling function of the

ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

The Low Reactor Pressure (Initiation) signals are initiated from two pressure transmitters that sense the reactor pressure.

Each transmitter provides an input to both low pressure ECCS logic trains, such that failure of one transmitter will cause a loss of redundancy but will not result in a loss of automatic low pressure ECCS pump start capability.

The Trip Setting is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough such that the ECCS injection will ensure the requirements of 10 CFR 50.46 are met.

Two channels per trip system of Low Reactor Pressure (Initiation) Trip Function are only required to be operable when the ECCS or DG(s) are required to be operable to ensure that no single instrument failure can preclude ECCS and DG initiation.

l.d, 2.h.

Low Reactor Pressure (System Ready and Valve Permissive)

Low reactor pressure signals are used as permissives for the low pressure ECCS subsystems.

This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure.

These low reactor pressure signals are also used as permissives for recirculation pump discharge valve closure and recirculation pump discharge bypass valve closure. This ensures that the LPCI subsystems inject into the proper RPV location assumed in the safety Amendment No.

236 75f

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) analysis.

Low Reactor Pressure (System Ready and Valve Permissive) is one of the 'Trip Functions assumed to be operable and capable of permitting initiation and injection of the ECCS and capable of closing the recirculation pump discharge valve(s) and recirculation'pump discharge bypass valve(s) during the accidents and transients analyzed in References 1 and 2.

The core cooling function of the ECCS, along with the scram action of the-RPS, ensures that the requirements of 10 CFR 50.46 are met.

The Low Reactor Pressure (System Ready and Valve Permissive) Trip Function is directly assumed in the analysis of the recirculation line break (Ref.

1).

The Low Reactor Pressure (System Ready and Valve Permissive) signals are initiated from four pressure transmitters that sense the reactor pressure.

The Trip Setting is chosen to be low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough such that the ECCS injection will ensure the requirements of 10 CFR 50.46 are met and to ensure that the recirculation pump discharge valves and recirculation pump discharge bypass valves close prior to commencement of LPCI injection flow into the core, as assumed in the safety analysis.

Four channels of the Low Reactor Pressure (System Ready and Valve Permissive)

Trip Function are only required to be operable when the ECCS or DG(s) are required to be operable to ensure that no single instrument failure can p-reclude proper ECCS initiation and injection.

l.e, 2.e.

CS and LPCI B and C Pump Start Time Delay The purpose of these time delays is to stagger the start of the CS and RHR (LPCI)

B and C pumps on the associated Division 1 and Division 2 buses,.thus limiting the starting transients on the 4.16 kV emergency buses.

These Trip Functions are necessary when power is being supplied from the standby power sources.

The Core Spray Pump Start Time Delay and the LPCI B and C Pump Start Time Delay Trip Functions are assumed to be operable in the accident and transient analyses requiring ECCS initiation.

That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are two Core Spray Pump Start Time Delay relays, one for each trip system.

Each time delay relay is dedicated to a single pump start

logic, such that a single failure of a Core Spray Pump Start Time Delay relay will not result in failure of more than one CS pump.

In this condition, one of the two CS pumps will remain operable; thus, single failure criterion is satisfied.

There are two LPCI B and C Pump Start Time Delay relays, one for each trip system.

Each time delay relay is dedicated to a single pump start

logic, such that a single failure of a LPCI B or C Pump Start Time Delay relay will not result in failure of more than one of the two associated LPCI pumps.

In this condition, one of the two associated LPCI pumps will remain operable; thus, single failure criterion is satisfied.

Amendment No.

236 75g

VYN PS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

The Trip Settings for the Core Spray'and LPCI Pump B and C Pump Start Time Delays are chosen to be long enough so that most of the starting transient of the previously started pump is complete before starting a subsequent pump on the same 4.16 kV emergency bus and short enough so that ECCS operation is not degraded.

Each channel of the Core Spray and LPCI B and C Pump Start Time Delay Trip Functions is required to be operable when the associated CS and LPCI subsystems are required to be operable.

l.f, 2.f.

CS and RHR Pump Discharge Pressure The Pump Discharge Pressure signals from the CS and RHR pumps are used as permissives for ADS initiation, indicating that there is a source of low pressure cooling water available once the ADS has depressurized the vessel.

Pump Discharge Pressure is one of the Trip Functions assumed to be operable and capable of permitting ADS initiation during the events analyzed in Reference 1 with an assumed HPCI failure.

For these events, the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the core cooling functions.

This core cooling function of the ECCS, along with the scram action of the RPS, ensures that the. requirements of 10 CFR 50.46 are met.

Pump discharge pressure signals are initiated from twelve pressure switches, two on the discharge side of each of the six low pressure ECCS pumps.

In order to generate an ADS permissive in one trip system logic, it is necessary that only one-pump (one of the two channels for the pump) indicate the high discharge pressure condition.

The Pump Discharge Pressure Trip Setting is less than the pump discharge pressure when the pump is operating at all flow ranges and high enough to avoid any condition that results in a discharge pressure permissive when the CS and LPCI pumps are aligned for injection and the pumps are not running.

The actual operating point of this function is not assumed in any transient or accident analysis'.

Twelve channels of Core Spray and RHR Pump Discharge Pressure Trip Functions are only required to be operable when the ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation.

Two CS channels associated with CS pump A and four LPCI channels associated with RHR pumps A and C are required for trip system logic A.

Two CS channels associated with CS pump B and four LPCI channels associated with RHR pumps B and D are required for trip system logic B.

However, each channel output is also electrically cross-connected such that each channel provides one logic contact in each ADS trip system logic.

Amendment No.

236

-75h

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) 1.q, 2.i.

CS and LEPCI Auxiliary Power Monitors The function of the CS and LPCI Auxiliary Power Monitors is tO monitor emergency bus status and to implement load sequencing if the normal AC power supply is not available.

The CS and LPCI Auxiliary Power Monitors are assumed to be operable in the accident and transient analyses requiring ECCS initiation.

That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are a total of two CS and LPCI Auxiliary Power Monitors, one dedicated to CS A and LPCI subsystem A, and one dedicated to CS B and LPCI subsystem B.

There are no Trip Settings specified for these Trip Functions, since they are logic relays that cannot be adjusted.

Each channel of the CS and LPCI Auxiliary Power Monitors is only required to be operable when the associated CS and LPCI subsystems are required to be operable to ensure that no single instrument failure can preclude proper DG load sequencing and subsequent low pressure ECCS initiation as assumed in the safety analyses.

l.h, 2.j.

CS and LPCI Pump Bus Power Monitors The function of the CS and LPCI Pump Bus Power Monitors is to monitor emergency bus status and to delay implementation of load sequencing until the associated emergency bus is powered, assuming a loss of the normal AC power supply.

Alternately, assuming no loss of normal AC power supply, these monitors will prevent the CS and LPCI pump motor breakers from closing until the respective bus is energized.

The CS and LPCI Pump Bus Power Monitors are assumed to be operable in the accident and transient analyses requiring ECCS initiation.

That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are a total of four CS and LPCI Pump Bus Power Monitors, two dedicated to CS A and LPCI subsystem A, and two dedicated to CS B and LPCI subsystem B.

There are no Trip Settings specified for these Trip Functions, since they are logic relays that cannot be adjusted.

One of the two channels per Trip System of the CS and LPCI Pump Bus Power Monitors are only required to be operable when the associated CS and LPCI subsystems are required to be operable to ensure that no single instrument failure can preclude proper DG load sequencing and subsequent low pressure ECCS initiation as assumed in the safety analyses.

Amendment No.

236 I15i

VY.NPS EASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 2.d.

Reactor Vessel Shroud Level The Reactor Vessel Shroud Level Trip Function is provided as a permissive to, allow the RHR System to be manually aligned from the LPCI mode to the suppression pool cooling/spray 'or drywell spray modes.

The permissive ensures that water level in the vessel is at least two thirds core height before the manual transfer is allowed.

This ensures that LPCI is available to prevent or minimize fuel damage..

This Trip Function may be overridden' during accident conditions as allowed by plant procedures.

The Reactor Vessel Shroud Level Trip Function is implicitly assumed in the analysis of the recirculation line break (Ref.

1) since the analysis assumes that no LPCI flow diversion occurs when reactor water level is below the Reactor Vessel Shroud Level.

Reactor Vessel Shroud Level signals are initiated from two level transmitters that sense the difference between.the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level.(variable leg) in the vessel.

The Reactor Vessel Shroud Level Trip Setting is chosen to allow the low pressure core flooding systems to activate and provide adequate cooling before allowing a manual transfer.

Two channels of the Reactor Vessel Shroud Level Trip Function are only required to be operable in

RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN and Refuel (with reactor coolant temperature > 212 0 F).

In other Modes or conditions, the specified initiation time of the LPCI subsystems-is not assumed, 'and other administrative controls are adequate to control the valves that this Trip Function isolates (since the systems that the valves are opened for are not required to be. operable in these other Modes or conditions and are normally not used).

2.g.

LPCI High Drywell Pressure (Containment Spray Permissive)

The High Drywell Pressure (Containment Spray Permissive) Trip Function is provided as a permissive to allow the RHR System to be manually aligned from.

the LPCI mode to the 'suppression pool cooling/spray or drywell spray modes.

The permissive prevents the operator from inadvertently initiating containment spray, when it is not required to reduce drywell pressure, during a LOCA.

This ensures that LPCI is available to prevent or minimize fuel damage.

The High Drywell Pressure (Containment Spray Permissive) Trip Function is implicitlyassumed in the analysis of the recirculation line break (Ref.

i) since the analysis assumes that LPCI flow is availablewhen required.

Amendment No.

236

-75 4

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

High dryweil pressure signals are initiated from four pressure transmitters that sense drywell pressure.

The Trip Setting was selected to be indicative of a LOCA inside primary containment.

The High Drywell Pressure (Containment Spray Permissive) Trip Function is required to be operable when LPCI is required to be operable in conjunction with times when the primary containment is required to be operable.

Thus, four channels of the High Drywell Pressure (Containment Spray Permissive)

Trip Function are required to be operable in

RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN and Refuel (with reactor coolant temperature > "F) to ensure that no single instrument failure can preclude LPCI initiation or cause inadvertent Elow diversion.

In other Modes or conditions, the specified initiation time of the LPCI subsystems is not assumedi and other administrative controls are adequate to control the valves that this Trip Function isolates (since the systems that the valves are opened for are not required to be operable in these other Modes or conditions and are normally no used).

HPCI System 3.a.

Low Low Reactor Vessel Water Level Low RPV water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, the HPCI System is initiated at Low -

Low Reactor Vessel Water Level to maintain level above the top of the active fuel.

The Low -

Low Reactor Vessel Water Level is one of the Trip Functions assumed to be operable and capable of initiating HPCI during the accidents and transients analyzed in References 1 and 2.

Low -

Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Low -

Low Reactor Vessel Water Level Trip Setting is high enough above the top of enriched fuel to start HPCI in time to prevent fuel uncovering for small breaks, but far enough below normal levels that spurious HPCI startups are avoided.

The Trip Setting is referenced from the top of enriched fuel.

Four channels of Low -

Low Reactor Vessel Water Level Trip Function are required to be operable only when HPCI is required to be operable to ensure that no single instrument failure can preclude HPCI initiation.

Amendment No.

236 75k

VYNPS

-ASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM "(ECCS)

APPLICABLE SAFETY-ANALYSES,

LCO, and APPLICABILITY (continued) 3.b Low Condensate Storage Tank Level Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source.

Normally the.suction valves between HPCI and the CST are open and, upon receiving a HPCI initiation signal, water for HPCI injection would be taken from the CST.

However, if the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open.

When the suppression pool suction valves both start to open, the CST suction valve automatically closes.

This ensures that an adequate supply of makeup water is available to the HPCI pump.

To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must both start to open before the CST suction valve automatically closes.

The Trip Function is implicitly assumed in the accident and transient analyses (which take credit for HPCI) since the analyses assume that the HPCI suction source is the suppression pool.

The Low Condensate Storage Tank Level signal is initiated from two level transmitters.

The logic is arranged such that either level transmitter can cause the suppression pool suction valves to open and the CST suction valve to close.

The Low Condensate Storage Tank Level Trip Function Trip Setting is high enough to ensure adequate pump suction head while water is being taken from the CST.

The Trip Setting is presented in terms of percent instrument span.

Two channels of the Low Condensate Storage Tank Level Trip Function are required to be operable only when HPCI is required to be operable to ensure that no single instrument failure can preclude HPCI swap to suppression pool source.

3.c.

High Drywell Pressure High pressure in the drywell could indicate a break in the RCPB.

The HPCI System is initiated upon receipt of the High Drywell Pressure Trip Function in order to minimize the possibility of fuel damage.

The High Drywell Pressure Trip Function associated with HPCI is not assumed in accident or transient analyses.

It is retained since it is a potentially significant contributor to risk.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure.

The Trip Setting was selected to be as low as possible to be indicative of a LOCA inside primary containment.

Four channels of the High Drywell Pressure Trip Function are required to be operable when HPCI is required to be operable to ensure that no single instrument failure can preclude HPCI initiation.

Amendment No.

236 751

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) 3.d.

High Reactor Vessel Water Level High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel.

Therefore, the High Reactor Vessel Water Level signals are used to trip the HPCI turbine to prevent overflow into the main steam lines (MSLs) to preclude an unanalyzed event.

High Reactor Vessel Water Level signals for HPCI are initiated from two level transmitters from the narrow range water level measurement instrumentation, Both High Reactor Vessel Water Level signals are required in order to close the HPCI turbine stop valve.

This ensures that no single instrument failure can preclude HPCI initiation.

The High Reactor Vessel Water Level Trip Setting is high enough to avoid interfering with HPCI System operation during reactor water level recovery resulting from low reactor water level events and low enough to prevent flow from the HPCI System from overflowing into the MSLs.

The Trip Setting is referenced from the top of enriched fuel.

Two channels of the High Reactor Vessel Water Level Trip Function are required to be operable only when HPCI is required to be operable.

Automatic Depressurization System (ADS) 4.a.

Low -

Low Reactor Vessel Water Level Low RPV water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, ADS receives one of the signals necessary for initiation from this Trip Function.

The Low -

Low Reactor Vessel Water Level is one of the Trip Functions assumed to be operable and capable of initiating the ADS during the accident analyzed in Reference 1. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

Low.-

Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between, the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Low -

Low Reactor Vessel Water Level Trip Function are required to be operable only when ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation.

Two channels input to ADS trip system logic A, while the other two channels input to ADS trip system logic B.

The Low -

Low Reactor Vessel Water Level Trip Setting is chosen to allow time for the low pressure core flooding systems to initiate and provide adequate cooling.

The Trip Setting is referenced from the top of enriched fuel.

Amendment No.

236 75m

VY N PS BASES: 3.2.A/.1.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) 4.b High Drywell Pressure High pressure in the drywell could indicate a break in the RCPB.

Therefore, ADS receives signals necessary for initiation from this Trip Function in order to minimize the possibility of fuel damage.

The High Drywell Pressure Trip Function is assumed to be operable and capable of initiating the ADS during accidents analyzed in Reference 1. The core cooling function of the

ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure.

The Trip Setting was selected to be as low as possible to be indicative of a LOCA inside primary containment. Four channels of High Drywell Pressure Trip Function are required to be operable only when ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation.

Two channels input to ADS trip system logic A, while the other two channels input to ADS trip system logic B.

4.c. Time Delay The purpose of the ADS Time Delay is to delay depressurization of the reactor vessel to allow the HPCI System time to restore and maintain reactor vessel water level.

Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited.

By delaying initiation of the ADS function, the operator is given the chance to monitor the success or failure of the HRCI System to maintain water level, and then to decide whether or not to allow ADS to initiate or to inhibit initiation.

The ADS Time Delay Trip Function is assumed to be operable for the accident analyses of Reference 1 that require ECCS initiation and assume failure of the HPCI System.

There are two ADS Time Delay relays, one in each of the two ADS trip system logics.

The Trip Setting for the ADS Time Delay is chosen to be long enough to allow HPCI to start and avoid an inadvertent blowdown yet short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Two channels of the ADS Time Delay Trip Function are only required to be operable when the ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation.

One channel inputs to ADS trip system logic A, while the other channel inputs to ADS trip system logic B.

Amendment No.

236

'75n

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) 4.d.

Sustained Low -

Low Reactor Vessel Water Level Time Delay One of the signals received for ADS initiation is High Drywell Pressure.

However, if the event requiring ADS occurs outside the drywell (e.g., main steam line break outside containment),

a high drywell pressure signal may never be present.

Therefore, the Sustained Low -

Low Reactor Vessel Water Level Time Delay Trip Function is used to bypass the High Drywell Pressure Trip Function after a certain time period has elapsed.

The instrumentation is retained in the TS because ADS is part of the primary success path for mitigation of a DBA.

There are four Sustained Low -

Low Reactor Vessel Water Level Time Delay relays, two in each of the two ADS trip system logics.

The Trip Setting for the Sustained Low -

Low Reactor Vessel Water Level Time Delay is chosen to ensure that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Four channels of the Sustained Low -

Low Reactor Vessel Water Level Time Delay Trip Function are only required to be operable when the ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation.

ACTIONS Table 3.2.1 ACTION Note 1 Table 3.2.1 ACTION Note l.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in redundant automatic initiation capability being lost for the feature(s).

Table 3.2.1 ACTION Note l.a features would be those that are initiated by Trip Function l.a, l.b, 2.b, and 2.c (e.g., low pressure ECCS).

Redundant automatic initiation capability is lost if (a) two Trip Function l.a channels are inoperable and untripped in the same trip system, (b) two Trip Function l.b channels are inoperable and untripped in the same trip system, (c) two Trip Function 2.b channels are inoperable and untripped in the same system, or (d) two Trip Function 2.c channels are inoperable and untripped in the same trip system.

Each inoperable channel would only require the affected portion of the associated system of low pressure ECCS and DGs to be declared inoperable.

However, since channels in both associated low pressure ECCS subsystems (e.g., both CS subsystems) are inoperable and untripped, and the completion times of Table 3.2.1 ACTION Note l.a started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS and DGs being concurrently declared inoperable.

In this situation (loss of redundant dutomatic initiation capability),

the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note l.b is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared Amendment No.

236 75o

VYNPS EASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM(ECCS()

ACTIONS (continued) inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The Table 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and'repair any discovered inoperabilities.

For Table 3.2.1 ACTION Note l.a, the completion'time only begins upon discovery of a loss of initiation capability for feature(s) in both divisions (i.e.,

that a redundant feature in the same system (e.g., both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Trip Function as described in the paragraph above).

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service.time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.

3) to permit restoration of any inoperable channel to operable status.

if the inoperable, channel cannot be restored to operable status within the allowable out of Service time, the channel must be placed in the tripped condition per Table"3.2.1 ACTION Note l.b.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow'operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would.result in an initiation)', the associated systems must be declared inoperable.

With any applicable Action and associated completion time not met, the associated s.ubsystem(s) may be incapable' of performing the intended function, and the supported subsystem(s) associated with inoperable untripped channels must be declared inoperable immediately.

Table 3.2.1 ACTION Note 2 Table 3.2.1 ACTION Note 2.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in automatic initiation capability being lost for the feature(s).

Table 3.2.1 ACTION Note 2.a features would be those that are ihitiated by Trip Functions l.c, l.d, l.e, l.g, l.h, 2.a., 2.e, 2.h, 2.i, and 2.j (i.e.,

low pressure ECCS).

Automatic initiation capability is lost if either (a) two Trip Function l.c channels are inoperable, (b) two Trip Function l.d channels' are inoperable in the same trip

system, (c) one Trip Function l.e channel is, inoperable in each trip

system, (d) one Trip Function 1.g channel is inoperable in each trip system, (e) two Trip Function l.h channels inoperable in each trip system, (f) two Trip Function 2.a channels are inoperable, (g) one Trip Function 2.e channel inoperable in each trip, system,

.(h) tw o Trip Function 2.h channels inoperable in the same trip system, (i) one Trip Function 2.i channel inoperable in each trip system or (j) two Trip Function 2.j channels inoperable in each trip system.

Each inoperable channel would only require the affected portion of the associated system of:low pressure Amendment No.

236

-75p

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued)

ECCS to be declared inoperable.

However, since channels in both associated low pressure ECCS subsystems (e.g., both CS subsystems) are inoperable and untripped, and the completion times of Table 3.2.1 ACTION Note 2.a started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS being concurrently declared inoperable.

For Functions l.e and 2.e, the affected portions are the associated low pressure ECCS pumps.

In this situation (loss of automatic initiation capability),

the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 2.b is.not appropriate and the feature(s) associated with the inoperablechannels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The Table 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

For Table 3.2.1 ACTION Note 2.a, the Completion Time only begins upon discovery of a loss of initiation capability for feature(s) in both divisions (i.e.,

that a redundant feature in the same system (e.g., both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Trip Function as described in the paragraph above).

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion tinme from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable.out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.

3) to permit restoration of any inoperable channel to operable status.

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the associated systems must be decl-ared inoperable.

With any applicable Action and associated completion time not met, the associated subsystem(s) may be incapable of performing the intended function, and the supported subsystem(s) associated with inoperable channels must be declared inoperable immediately.

The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

Table 3.2.1 ACTION Note 3 Table 3.2.1 ACTION Note 3.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in redundant automatic initiation capability being lost for the feature(s).

Table 3.2.1 ACTION Note 3.a features would be those that are initiated by Trip Functions 2.d and 2.g (i.e.,

LPCI).

Redundant automatic initiation capability is lost if one Trip Function 2.d channel is inoperable in each trip system or if two Trip Function 2.g channels are inoperable in the same trip system.

Each inoperable channel would only require the affected portion of the associated LPCI subsystem to be declared inoperable.

However, since channels in both associated LPCI subsystems are inoperable and untripped, and the completion times of Table 3.2.1 ACTION Note 3.a started concurrently for the Amendment No.

236

/5q

VYNPS BASES: 3.2.A/,1.2.A EMERGENCY CORE COOLING SYSTEM (ECCS).

ACTIONS (continued) channels in both subsystems, this results in the affected portions in the associated LPCI subsystems being concurrently declared inoperable.

Table 3.2.1 ACTION Note 3.a is not applicable to Trip Function 2.d, since this Trip Function provides backup to administrative controls.ensuring that operators do not divert LPCI flow from injecting into the core when needed.

Thus, a

total loss of Trip Function 2.d capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed, since the LPCI subsystems remain capable of performing their intended function.

In the situation of loss of redundant automatic initiation capability for Trip Function 2.g, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 3.b is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within I hour.

The Table 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

For Table 3.2.1 ACTION Note 3.a, the Completion Time only begins upon discovery of a loss of LPCI initiation capability due to inoperable, untripped channels within the Trip Function 2.g as described in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.3) to permit restoration of any inoperable channel to operable status.

If an inoperable channel for Trip Function 2.d cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.1 ACTION Note 3.b.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accomodate a single failure, and allow operation to continue.

If an inoperable channel for Trip Function 2. g cannot be.restored to operable status within the allowable out of service time, the associated systems must be declared inoperable.

With any applicable Action and associated completion time not met, the associated subsystem(s) may be incapable.of performing the intended function, and the supported subsystem(s) associated with the inoperable channels must be declared inoperable immediately.

Table 3.2.1 ACTION Note 4 Table 3.2.1 ACTION-Note 4.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in redundant automatic initiation capability being lost for the feature(s).

The Table 3.2.1 ACTION Note 4.a feature would be HPCI.

Redundant automatic initiation capability is lost if two Trip Function'3.a or two Trip Function 3.c channels are inoperable and untripped in the same trip system logic.

In this situation (loss of redundant automatic initiation capability),

the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 4.b is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared Amendment No.

236 75r

VYNPS EASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The 'Fable 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and repair an"y discovered inoperabilities.

For 'fable 3.2.1 ACTION Note 4.a, the completion time only begins upon discovery of a loss of HPCI initiation capability due to inoperable, untripped channels with-in the same Trip Function as described in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.

3) to permit restoration of any inoperable channel to operable status.

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.1 ACTION Note 4.b.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation),

the HPCI System must be declared inoperable.

With any applicable Action and associated completion time not met, the HPCI System may be incapable oý performing the intended function, and the HPCI System must be declared inoperable immediately.

Table 3.2.1 ACTION Note 5 Table 3.2.1 ACTION Note 5.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in a complete loss of automatic component initiation capability for the HPCI System..

Automatic component initiation capability is lost if two Trip Function 3.b channels are inoperable and untripped.

In this situation (loss of automatic suction swap),

the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 5.b is not appropriate and the HPCI System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of HPCI initiation capability.

Table 3.2.1 ACTION Note 5.a is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Trip Function is already performed.

The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities'.

For Table 3.2.1 ACTION Note 5.a, the completion time only begins upon discovery that the HPCI System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Trip Function as described in the paragraph Amendment No.

236 75s

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing :ime for restoration or tripping of channels.

Because of the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown-to be acceptable (Ref.

3) to permit restoration of any inoperable channel to operable status.

If the inoperable channel-cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition or the suction source must be aligned to the suppression pool per Table 3.2.1 ACTION Note 5.b.

Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool).

Performance of either of the two actions of Table 3.2.1 ACTION Note 5.b will allow operation to continue.

if Table 3.2.1 ACTION Note 5.b is performed, measures should be taken to ensure that the HPCI System piping remains filled with water.

Alternately, if it is not desired to perform Table 3.2.1 ACTION NOTE 5.b. (e.g., as in the case where shifting the suction.

source could drain down the HPCI suction piping),

the HPCI System must be declared inoperible.

With any applicable Action and associated completion time not met, the HPCI System may.be incapable of performing the intended function, and the HPCI System must be declared inoperable immediately.

Table 3.2.1 ACTION Note 6 For Trip Function 3.d, the loss of one or more channels results in a loss of the function (two-out-of-two logic).

This loss was considered during the development of Reference 3 and considered acceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .allowed to permit restoration of the-inoperable channel to operable status by Table 3.2.1 ACTION Note 6.a.

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the HPCI System must be declared inoperable.

With any applicable Action and associated completion -time not met, the HPCI System may be incapable of performing the intended function, and the HPCI System must be declared inoperable immediately.

'The Required Actions-do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a-safe state for-the channel in all events.

Table 3.2.1 ACTION Note 7 Table 3.2.1 ACTION Note 7.a is intended to ensure that appropriate actions are, taken if multiple, inoperable, untripped channels within the same Trip Function result in redundant automatic initiation

-capability being lost for the ADS.

Redundant automatic initiation capability is lost if either (a) one or more Trip Function 4.a channels are inoperable and untripped in each trip system logic,.or (b) one or more Trip Function 4.b channels are inoperable and untripped in each trip system.

Amendment No.

236

/5t

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued)

In this situation (loss of automatic initiation capability),

the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Table 3.2.1 ACTION Note 7.b or 7.c, respectively, is not appropriate and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability. The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

For Table 3.2.1 ACTION Note 7.a, the completion time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within the same Trip Function as described in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref.

3) to permit-restoration of any inoperable channel to operable status if both HPCI and RCIC are operable (Table 3.2.1 ACTION Note 7.c).

If either HPCI or RCIC is inoperable, the time is shortened to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months (Table 3.2.1 ACTION Note 7.b).

If the status of HPCI or RCIC changes such that the completion time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability.

However, the total time for an inoperable, untripped channel cannot exceed 8 days.

If the status of HPCI or RCIC changes such that the completion time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the 8 day allowable out of service time begins upon discovery of the inoperable, untripped channel.

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.1 ACTION Note 7.b or 7.c, as applicable.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation),

the ADS must be declared inoperable.

With any applicable Action and associated completion time not met, the ADS may be incapable of performing the intended function, and the ADS must be declared inoperable immediately.

Table 3.2.1 ACTION Note 8 Table 3.2.1 ACTION Note 8.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in redundant automatic initiation capability being lost for the ADS.

Redundant automatic initiation capability is lost if either (a) one Trip Function 4.c channel is inoperable in each trip system logic (i.e.,

2 channels are inoperable),

(b) one or more Trip Function 4.d channels are inoperable in each trip system logic, or (c) all Trip Function l.f and 2.f channels are inoperable.

Amendment No.

236 75u

VYNPS i3ASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued)

In this situation (loss of automatic initiation capability),

the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of 'Table 3.2.1 ACTION Note 8.b or 8.c, respectively, is not appropriate and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability.

The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

For Table 3.2.1 ACTION Note 8.a, the completion time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within the same Trip Function as described in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref.

3) to permit restoration of any inoperable channel to operable status if both HPCI and RCIC are operable (Table 3.2.1 ACTION Note 8.c).

If either HPCI or RCIC is inoperable, the time shortens to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months (Table 3.2.1 ACTION Note 8.b).

If the status of HPCI or RCIC changes such that the completion time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability.

However, the total time for an inoperable channel cannot exceed 8 days.

If the status of HPCI or RCIC changes such that the completion time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the 8 day allowable out of service time begins upon discovery of-the inoperable channel.

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the ADS must' be declared inoperable.

With any' applicable Action and associated completion time not met, the ADS may be incapable of performing the intended function, and the ADS must be declared inoperable immediately.

The Required Actions do not allow placing the channel.in trip since this action would not necessarily result in a safe state for the channel in all events.

Table 3.2.1 ACTION Notes 9 and 10 The Emergency Core Cooling System Instrumentation, High Pressure Coolant Injection, Low Condensate Storage Tank Water Level function is modified by Notes 9 and 10 as identified in Table 3.2.1.

Note 9 requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance.

Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.

The ability to reset the setpoint represents continued confidence that the channel can perform its intended safety function.

The performance of this channel will be evaluated under the Corrective Action Program.

This will ensure required review and documentation of the condition for continued operability.

Note 10 requires that the as-left setting for the channel be returned to within the as-left tolerance of the Nominal Trip Setpoint.

Where a Setpoint more conservative that the Limiting Trip Setpoint is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.

This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit-is maintained.

If the as-left AmenOment No.

236 75v

VYNPS RASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) channel setting cannot be returned to a setting within the as-left tolerance of the Nominal Trip Setpoint, then the channel shall be declared inoperable.

The methodologies for calculating the Normal Trip Setpoint and the as-left and the as-found tolerances are located in the Vermont Yankee Setpoint Program Manual which is included by reference in the UFSAR.

'This ensures changes are evaluated under I0CFR50.59.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.A.1 As indicated in Surveillance Requirement 4.2.A.l, ECCS instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.1.

Table 4.2.1 identifies,, for each ECCS Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.A.1 also indicates that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months as follows:

(a) for Trip Function 3.d; and (b) for Trip Functions other than 3.d provided the associated Trip Function or redundant Trip Function maintains initiation capability. Upon completion of the surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability analysis (Ref.

3) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the ECCS will initiate when necessary.

Surveillance Requirement 4.2.A.2 The Logic System Functional Test demonstrates the operability of the required initiation logic for a specific channel.

The simulated automatic actuation testing required by the ECCS Technical Specifications and Diesel Generator Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function.

For the ADS Trip Functions, this Logic System Functional Test requirement does not include solenoids of the ADS valves.

However, a simulated automatic actuation, which opens all pilot valves of the ADS valves, shall be performed such that each trip system logic can be verified independent of its redundant counterpart.

In addition, for the ADS Trip Functions, the Logic System Functional Test will include verification of operation of all automatic initiation inhibit switches by monitoring relay contact movement.

Verification that the ADS manual inhibit switches prevent opening all ADS valves will be accomplished in conjunction with Surveillance Requirement 4.5.F.I.

The Frequency of "once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Amendment No.

236 7 5w

VYNPS BASES:.3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

SURVEILLANCE REQUIREMENTS (continued)

Table 4.2.1, Check Performance of an Instrument Check once per day for Trip Functions l.a, l.b, l.g, l.h, 2.b, 2.c, 2.i, 2.j, 3.a, 3.c, 4.a, and 4.b, ensures that a gross failure of instrumentation has not occurred.

An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare.

The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.1, Functional Test For Trip Functions l.a, l.b, l.c, l.d, l.f, l.g, l.h, 2.a, 2.b, 2.c, 2.d, 2.f, 2.g, 2.h, 2.i, 2.j, 3.a, 3.b, 3.c, 3.d, 4.a, and 4.b, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of "Every 3 Months" is based on the reliability analysis of Reference 3.

Table 4.2.1, Calibration For Trip Functions l.a, l.b, l.c, l.d, l.e, l.f, 2.a, 2.b, 2.c, 2.d, 2.e, 2.f, 2.g, 2.h,.3.a, 3.b, 3.c, 3.d, 4.a, 4.b, 4.c, and 4.d, an Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

For Trip Functions l.a, l.b,' l.c, l.d, 2.a,.2.b, 2.c, 2.d, 2.g, 2.h, 3.a, 3.c, 3.d, 4.a, and 4.b, a calibration of the trip units is required (Footnote (a))

once every 3 months.

Calibration of the trip units provides a check of the actual setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found Amendment No.

236 75x.

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

SURVEILLANCE REQUIREMENTS (continued) tolerances specified in plant procedures.

The Frequency of every 3 months is.

based on the reliability analysis of Reference 3 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1.

UFSAR, Section 6.5.

2.

UFSAR, Chapter 14.

3.

NEDC-30936-P-A, BWR Owners' Group Technical Specification Improvement Methodology (With Demonstration for BWR ECCS Actuation Instrumentation),

Parts 1 and 2, December 1988.

Amendment No.

236

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs).

The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs).

Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation.

Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic.

Functional diversity is provided by monitoring a wide range of independent parameters.

The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient temperatures, (c) main steam line (MSL)

flow, (d) main steam line pressure, (e) condenser vacuum, (f) drywell pressure, (g) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line d/p, (h)

HPCI and RCIC steam line pressure, and (i) reactor vessel pressure.

Redundant sensor input signals from each parameter are provided for initiation of isolation.

Primary containment isolation instrumentation has ihputs to the trip logic of the isolation functions listed below.

1. Main Steam Line Isolation' The Low -

Low Reactor Vessel Water Level, Low Main Steam Line Pressure, High Main Steam Line Flow -

Not in

RUN, and Condenser Low Vacuum Trip Functions each receive inputs from four channels.

The outputs of these channels are combined in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs),

MSL drain valves, and recirculation loop sample isolation valves.

The High Main Steam Line Flow Trip Function uses 16 flow channels,'four for each steam line.

One channel from each steam line inputs to one of the four trip strings.

Two trip strings make up each trip system and both trip systems must trip to cause an isolation of all

MSIVs, MSL drain valves, and recirculation sample isolation valves.

Each trip string has four inputs (one per MSL),

any one of which will trip the trip string.

The trip strings are arranged in a one-out-of-two taken twice logic.

This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation.

The High Main Steam Line Area Temperature Trip Function receives input from 16 channels, four for each of four main steam line areas.

The logic is arranged similar to the High Main Steam Line Flow Trip Function.

One channel from each steam tunnel area inputs to one of four trip strings.

Two trip strings make up a trip system and both trip systems must trip to cause isolation.

MSL Isolation Trip Functions isolate the Group 1 valves.

Amendment No.

236 76

VYNPS BASES: 3.2.B/4.2.8 PRIMARY CONTAINMENT ISOLATION BACKGROUND (continued)

2.

Primary Containment Isolation The Low Reactor Vessel Water Level and High Dryweli Pressure Trip Functions each receive inputs from four channels.

For each Trip Function, the outputs of these channels are combined in a one-out-of-two taken twice logic to initiate isolation of the PCIVs identified in Reference 1.

Primary Containment Isolation Trip Functions isolate the Groups 2, 3,

and 4 valves.

Group 5 valves are also isolated by the Low Reactor Vessel Water Level Trip Function.

3,

4.

High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation The HPCI High Steam Line d/p, RCIC High Steam Line d/p, and RCIC High Steam Line d/p 'rime Delay Trip Functions each receive input from two channels, with each channel in one trip system using a one-out-of-one logic.

The trip systems are arranged in a one-out-of-two logic.

Each of the two trip systems is connected to both valves on the associated penetration.

The HPCI and RCIC Low Steam Supply Line Pressure Trip Functions each receive input from four steam supply pressure channels.

The outputs from the associated steam supply pressure channels are connected in a one-out-of-two-twice trip system logic arrangement.

There are two trip system logics which provide input to one trip system.

The trip'system must trip to initiate isolation of both valves on the associated penetration.

The HPCI and RCIC High Main Steam Line Tunnel Temperature Trip Functions each receive input from 4 channels.

Four channels, each with an associated temperature switch, are connected in a one-out-of-two-twice arrangement which provides input to two trip systems.

Both trip systems must trip to initiate isolation of both valves on the associated penetration.

In addition, the HPCI and RCIC High Main Steam Line Tunnel Temperature Trip Functions each have time delays.

These Time Delay Trip Functions each receive input from two channels, with each channel in one of the trip system using a one-out-of-one logic.

The trip systems are arranged in a one-out-of-two logic.

The HPCI and RCIC High Steam Line Space Temperature Trip Functions each receive input from 12 channels.

There are three steam line areas each monitored by one set of four channels.

One channel from each of the three steam line areas inputs to one of the four trip strings.

Two trip strings make up each trip system and both trip systems must trip to cause an isolation of both valves on the associated penetration.

The trip strings are arranged in a one-out-of-two taken twice logic.

This is effectively a one-out-of-six taken twice logic arrangement to initiate isolation.

HPCI System and RCIC System Isolation Trip Functions isolate the Group 6 valves, as appropriate.

Amendment No.

236 76a

VYNPS BASES: 3.2.B/4.2.3 PRIMARY CONTAINMENT ISOLATION BACKGROUND (continued)

5.

Residual Heat Removal Shutdown Cooling Isolation The High Reactor Pressure Trip Function receives input from two channels.

The outputs from these channels are arranged in a one-out-of-two logic to initiate isolation of the Shutdown Cooling (SDC) supply isolation valves.

The Residual Heat Removal Shutdown Cooling Isolation Trip Function isolates the Group 4 SDC supply isolation valves.

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY

'The isolation signals generated by the primary containment isolation instrumentation are implicitly assumed in the safety analyses of Reference 2 to initiate closure of valves to limit offsite doses.

Primary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c) (2) (ii).

Certain instrumentation Trip Functions are retained for other reasons and are described below in the individual Trip Functions discussion.

The operability of the primary containment isolation instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions specified in Table 3.2.2.

Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tdlerances specified in plant procedures.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, *under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.2.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Certain Emergency Core Cooling Systems (ECCS) valves (e.g., containment spray isolation valves) also serve the dual function of automatic PCIVs.

The signals that isolate these valves are also associated with the automatic initiation of the ECCS.

Some instrumentation requirements and Actions associated with these signals are addressed in Specification 3.2.A, "Emergency Core Cooling Systems (ECCS),"

and are not included in this specification.

In general, the individual Trip Functions are required to be operable in

RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature

>212'F) consistent with the Applicability for Primary Containment Integrity requirements in Specification 3.7.A.2.

Trip Functions that have different Applicabilities are discussed below in the individual Trip Functions discussion.

The specific Applicable Safety Analyses,

LCO, and Applicability discussions are listed below on a Trip Function by Trip Function basis.

Main Steam Line Isolation l.a.

Low -

Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that the capability to Amendment No.

236

76b

VY NPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES,

ICO, and APPLICABILITY (continued) cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded.

The Low -

Low Reactor Vessel Water Level Trip Function is one of the many Trip Functions assumed to be operable and capable of providing isolation signals.

The Low -

Low Reactor Vessel Water Level Trip Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 3).

The isolation of the MSLs supports actions to ensure that offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Low -

Low Reactor Vessel Water Level Trip Function are available and are required to he operable to ensure that no single instrument failure can preclude the isolation function.

The Low -

Low Reactor Vessel Water Level Trip Setting is chosen to be the same as the ECCS Low -

Low Reactor Vessel Water Level Trip Setting (Specification 3.2.A) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 50.67 limits.

The Trip Setting is referenced from the top of enriched fuel.

This Function isolates the Group 1 valves.

L.b.

High Main Steam Line Atea Temperature Main steam line tunnel temperature is provided to detect a leak in the RCPB in the steam tunnel and provides diversity to the high flow instrumentation.

Temperature is sensed in four different areas of the steam tunnel in the vicinity of the main steam lines.

The isolation occurs when a very small leak has occurred in any one of the four areas.

If the small leak is allowed to continue without isolation, offsite dose limits may be *reached.

However, credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large

breaks, such as MSLBs.

Main steam line area temperature signals are initiated from a total of sixteen temperature switches located in the four areas being monitored.

Sixteen channels of High Main Steam Line Area Temperature Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.'

The High Main Steam Line Area Temperature Trip Setting is chosen to provide early indication of a steam line break.

These Functions isolate the Group 1 valves.

l.c.

High Main Steam Line Flow High Main Steam Line Flow is provided to detect a break of the MSL and to initiate closure of the MSIVs.

If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover.

If the RPV water level decreases too far, fuel damage could occur.

Therefore, Amendment No.

236 76c

VYNPS BASES:

3.2.3/4.2.3 PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) the isolation is initiated on hiqh flow to prevent or minimize core damage.

The High Main Steam Line Flow Trip Function is directly assumed in the analysis of the main steam line break (MSLB)

(Ref.

4).

The isolation action, along with the scram function of the Reactor Protection System (RPS),

ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 50.67 limits.

The MSL flow signals are initiated from 16 differential pressure transmitters that are connected to the four MSLs (the differential pressure transmitters sense differential pressure across a flow restrictor).

The differential pressure transmitters are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect the high flow*

Four channels of High Main Steam Line Flow Trip Function for each MSL (two channels per trip system) are available and are required to be operable so that no single instrument failure will preclude detecting a break in any ihdividual MSL.

The Trip Setting is chosen to ensure that fuel peak cladding temperature and offsite dose limits are not exceeded due to the break.

This Trip Function isolates the Group 1 valves.

l.d.

Low Main Steam Line Pressure Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100°F/hr if the pressure loss is allowed to continue.

The Low Main Steam Line Pressure Trip Function is directly assumed in the analysis of the pressure regulator failure (Ref.

5).

For this event, the closure of the MSIVs ensures that the RPV temperature change limit (100 0F/hr) is not reached.

In addition, this Trip Function supports actions to ensure that Safety Limit 1.1.B is not exceeded.

(This Trip Function closes the MSIVs at Ž800 psig prior to pressure decreasing below 785 psig [800 psia],

which results in a scram due to MSIV closure, thus reducing reactor power to < 23% RATED THERMAL POWER.)

The MSL low pressure signals are initiated from four pressure switches that are connected to the MSL header.

The switches are arranged such that, even though physically separated from each other, each pressure switch is able to detect low MSL pressure.

Four channels of Low Main Steam Line Pressure Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting was selected to be high enough to prevent excessive RPV depressurization.

The Low Main Steam Line Pressure Trip Function is only required to be operable in the RUN Mode since this is when the assumed transient can occur (Ref.

5).

This Trip Function isolates the Group I valves.

Amendment No.

236 7 6d

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

I.e.

High Main Steam Line Flow -

Not in RUN High Main Steam Line Flow when the reactor mode switch is not in RUN provides protection for a turbine pressure regulator malfunction which causes the turbine control valves'and turbine bypass valves to open or protection for a main steam line break.

These events would result in a rapid depressurization and cooldown of the RPV.

The High Main Steam Line Flow -

Not in RUN Trip Function was credited in the MSLB at low power analysis.

The MSL flow signals are initiated from 4 differential pressure transmitters, one connected to each of the four MSLs (the differential pressure switches sense differential pressure across a flow restrictor).

Four channels of High Main Steam Line Flow -

Not in RUN Trip Function (two channels per trip system) are available and are required to be operable so that no single instrument failure will preclude providing protection against a turbine pressure regulator malfunction or a break in any individual MSL.

The Trip Setting is chosen to provide early indication of a steam line break.

The High Main Steam Line Flow -

Not in RUN Trip Function is only required to be operable in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature >2120 F).

In the RUN Mode, protection for the depressurization resulting from a turbine pressure regulator malfunction is provided by the Low Main Steam Line Pressure Trip Function and protection for depressurization resulting from a main steam line break is provided by the High Main Steam Line Flow Trip Function.

This Trip Function isolates the Group 1 valves.

l.f.

Low Condenser Vacuum The Low Condenser Vacuum Trip Function is provided to prevent overpressurization of the main condenser in the event of a loss of the main condenser vacuum.

Since the integrity of the condenser is an assumption in offsite dose calculations, the Low Condenser Vacuum Trip Function is assumed to be operable and capable of initiating closure of the MSIVs.

The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture, thereby preventing a potential radiation leakage path following an accident.

Condenser vacuum pressure signals are derived from four pressure switches that sense the pressure in the condenser'.

Four channels of Low Condenser Vacuum Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting is chosen to prevent damage to the condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis.

As indicated in Footnote (b) to Table 3.2.2, the channels are not required to be-operable in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature >212'F) when all turbine stop valves. (TSVs) and turbine bypass valves (TBVs) are closed, since the potential for condenser overpressurization is minimized.

A key lock switch is provided to manually bypass the Low Condenser Vacuum Trio Function channels to enable plant Amendment No.

236 76e

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) startup and shutdown when condenser vacuum' is greater than 12 inches Hg absolute and all TSVs and TBVs are closed.

This Trip Function isolates the Group 1 valves Primary Containment Isolation 2.a.

Low Reactor Vessel Water Level Low RPV water level indicates that the capability to cool the fuel may be threatened.

The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products.

The isolation of the primary containment on low RPV water level supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded.

The Low Reactor Vessel Water Level Trip Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA.

Low Reactor Vessel Water Level signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Low Reactor Vessel Water Level Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The *Low Reactor Vessel Water Level Trip Setting was chosen to be the same as the RPS Low Reactor Vessel Water Level scram Trip Setting (Specification 3.1.A),

since isolation of these valves is not critical to orderly plant shutdown.

The Trip Setting is referenced from the top of enriched fuel.

This, Trip Function isolates the Groups 2, 3,

4, and 5 valves.

2.b.

High Drywell Pressure High drywell pressure can indicate a break in.the RCPB inside the primary containment.

The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded.

The High Drywell Pressure Trip Function, associated with isolation of the primary containment, is implicitly assumed in the UFSAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell.

Four channels of High Drywell Pressure Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting was selected to be the same as the ECCS High Drywell Pressure (Specification 3.2.A) and RPS High Drywell Pressure (Specification 3.1.A) Trip Settings, since this may be indicative of a LOCA inside primary containment.

This Trip Function isolates the Groups 2, 3 and 4 valves.

Amendment No.

236

VYNPS 2ASES: 3.2.B/1.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation 3.a, 4.c HPCI and RCIC High Steam Line Space Temperature High Steam Line Space Temperature Trip Functions are provided to detect a leak from the associated system steam piping.

The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumenta tion.

If the small leak is allowed to continue without isolation, offsite dose limits may be reached.

These Trip Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

High Steam Line Space Temperature signals are initiated from temperature switches that are appropriately located to detect a leak from the system piping that is being monitored.

For eachTrip Function, there are four instruments that monitor each of three locations.

Twelve channels for HPCI High Steam Line Space Temperature are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

Twelve channels for RCIC High Steam Line Space Temperature are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Settings are set high enough above anticipated normal operating levels to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break.

These Trip Functions isolate the associated Group 6 valves.

3.b.,

4.d.

HPCI and RCIC High Steam Line d/p (Steam Line Break)

High Steam Line d/p (Steam Line Break) Trip Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system.

If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover.

Therefore, the isolations are initiated on high d/p to prevent or minimize core damage.

The isolation action, along with the scram function of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

Specific credit for these Trip Functions is not assumed in any UFSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks.

However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

The HPCI and RCIC High Steam Line d/p (Steam Line Break) signals are initiated from differential pressure switches (two for HPCI and two for RCIC) that are connected to the associated system steam lines.

Two channels of both HPCI and RCIC High Steam Line d/p (Steam Line Break) Trip Functions are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

Amendment No.

236 76g

VYNPS BASES: 3.2.B/4.2.3 PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

The Trip Settings are set high enough above anticipated normal operating levels to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break.

These Trip Functions isolate the associated Group 6 valves.

3.c.,

4.f.

HPCI and RCIC Low Steam Supply Pressure Low steam supply pressure indicates that the pressure of the steam in the HPCI or RCIC turbine may be too low to continue operation of the associated system's turbine. These isolations are for equipment protection.

However, they also provide a diverse signal to indicate a possible system break.

These instruments are included in Technical Specifications because of the potential for possible system initiation failure resulting from these instruments.

The HPCI and RCIC Low Steam Supply Pressure signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the associated system steam line.

Four channels of both HPCI and RCIC Low Steam Supply Pressure Trip Functions are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Settings are selected to be below the pressure at which the system's turbine can effectively operate.

Since these'Trip Functions are provided for equipment protection, they are only required to be operable when the HPCI and RCIC System are required to be operable.

Therefore, as indicated in Footnote (c) to Table 3.2.2, in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel, the channels are only required to be operable when reactor steam pressure is

> 150 psig.

These Trip Functions isolate the associated Group 6 valves.

3.d.,

3.e., 4.a.,

4.b.

HPCI and RCIC High Main Steam Line Tunnel Temperature and Time Delay HPCI and RCIC High Main Steam Line Tunnel Temperature Trip Functions are provided to detect a leak from the associated system steam piping.

The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation.

If the small leak is allowed to continue without isolation, offsite dose limits may be reached.

These Trip Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

HPCI and RCIC High Main Steam Line Tunnel Temperature signals are initiated from temperature switches that are appropriately located to detect a leak from the associated system piping that is being monitored.

For each Trip Function, there are four instruments that monitor the area.

Four channels for HPCI High Main Steam Line Tunnel Temperature are available and are Amendment No.

236 76h

VYN PS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) required to be operable to ensure that no single instrument failure can preclude the isolation function. Four channels for RCIC High Main Steam Line Tunnel Temperature are availabLe and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Settings are set high enough above anticipated normal operating levels'to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break.

These Trip Functions isolate the associated Group 6 valves.

4.e RCIC High Steam Line d/p Time Delay The RCIC High Steam Line d/p Time Delay is provided to prevent false isolations on RCIC High Steam Line d/p during system startup transients and therefore improves system reliability.

This Trip Function is not assumed in any UFSAR transient or accident analyses.

The RCIC High Steam Line d/p Time Delay Trip Function delays the RCIC High Steam Line d/p (Steam Line Break) signal by use of time delay relays.

When a RCIC High Steam Line d/p (Steam Line Break) signal is generated, the time delay relays delay the tripping of the associated RCIC isolation trip system for a short time.

Two channels of RCIC High Steam Line d/p Time Delay Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting is chosen to be long enough to prevent false isolations due to System starts but not so long as to impact compliance with IOCFR50.46 requirements.

This Trip Function, in conjunction with the RCIC High Steam Line d/p (Steam Line Break) Trip Function, isolates the RCIC System Group 6 valves.

Residual Heat Removal Shutdown Cooling Isolation 5.a.

High Reactor Pressure The High Reactor Pressure Trip Function is provided to isolate the shutdown cooling portion of the Residual Heat Removal (RHR)

System.

This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the UFSAR.

The High Reactor Pressure signals are i'nitiated from two pressure switches.

Two channels of High Reactor Pressure Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

'The Trip Function is only required to be operable in

RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature >212'F),

since these are the only Modes in which the reactor can be pressurized; thus, equipment protection is needed.

The Trip Setting was chosen to be low enough to protect the system equipment from overpressurization.

This Trip Function isolates the Group 4 SDC supply isolation valves.

Amendment No. 236 76i

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION ACTIONS Table 3.2.2 ACTION Note 1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , depending on the Trip Function (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for those Trip Functions that have channel components common to RPS instrumentation, i.e.,

Trip Functions 2.a and 2.b, and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for those 'Trip Functions that do not have channel components common to RPS instrumentation, i.e.,

all other Trip Functions),

has been shown to be acceptable (Refs.

6 and 7) to permit restoration of any inoperable channel to operable status.

This out of service time is only acceptable provided the associated Trip Function is still maintaining isolation capability (refer to the next paragraph).

For all Trip Functions except for Trip Functions 3.e, 4.b, and 4.e, if the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.2 ACTION Note l.a.l) or l.a.3), as applicable.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),

the applicable actions of Table 3.2.2 ACTION Note 2 must be taken.

For Trip Functions 3.e, 4.b, and 4.e, Table 3.2.2 ACTION Note l.a.2) requires the channel to be restored to operable status.

Table 3.2.2 ACTION Note l.a.2) does not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

Table 3.2.2 ACTION Note l.b is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in redundant automatic isolation capability being lost for the associated penetration flow path(s).

The Trip Functions are considered to be maintaining isolation capability when sufficient channels are operable or in

trip, such that both trip systems will generate a trip signal from the.

given Trip Function on a valid signal.

For Trip Functions l.a, l.d, l.e, l.f, 2.a, 2.b, 3.b, 3.d, 4.a, 4.d, and 5.a,.this would require both trip systems to have one channel operable or in trip.

For Trip Function l.c, this would require both trip systems to have one channel, associated with each

MSL, operable or in trip.

Trip Functions l.b, 3.a and 4.c, consist of channels that monitor several locations within a given area (e.g., different locations within the main steam tunnel area).

Therefore, this would require both trip systems to have one channel per location operable or in trip.

For Trip Functions 3.e, 4.b and 4.e, this would require both trip systems to have one channel operable.

For Trip Functions 3.c and 4.f (which only have one trip system for each Trip Function),

this would require one trip system to have one channel in each trip system logic operable or in trip.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for res.toration or tripping of channels.

Amendment No.

23b 7 6 j

VYNPS

'BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION ACTIONS (continued)

'Fable 3.2.2 ACTION Note 1 also allows penetration flow path(s) to be unisolated intermittently under administrative controls.

These administrative controls consist of stationing a dedicated operator in the immediate vicinity of the controls of the valve, with whom Control Room communication is immediately available.

In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

Table 3.2.2 ACTION Notes 2.a, 2.b, 2.c and 2.d If any applicable Action and associated completion time of Table 3.2.2 ACTION Note l.a or l.b are not met, the applicable Actions of Table 3.2.2 ACTION Note 2 and referenced in Table 3.2.2 (as identified for each Trip Function in the Table 3.2.2 "ACTIONS REFERENCED FROM ACTION NOTE 1" column) must be immediately entered and taken.

The applicable Action specified in Table 3.2.2 is Trip Function and Mode or other specified condition dependent.

For Table 3.2.2 ACTION Note 2.a, if the channel is not restored to operable status or placed in trip within the allowed Completion Time the associated MSLs may be isolated, and, if allowed (i.e.,

plant safety analysis allows operation with an MSL isolated), operation with.that MSL isolated may continue.

Isolating the affected MSL accomplishes the safety function of the inoperable channel.

This action will generally only be used if a Trip Function l.c channel is inoperable and untripped.

The associated MSL(s) to be isolated are those whose High Main Steam Line Flow Trip Function channel(s) are inoperable.

Alternately, the plant must be placed in a Mode or other specified condition in which the LCO does not apply.

This is done by placing the plant in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Table 3.2.2 ACTION Note 2.a also allows penetration flow path(s) to be unisolated intermittently under administrative controls.

These administrative controls consist'of stationing a dedicated operator in the immediate vicinity of the controls of the valve, with whom Control Room communication is immediately available.

In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

For Table 3.2.2 ACTION Note 2.b, if the channel is not restored to operable status or placed in trip within the allowed Completion Time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply. This is done by placing the plant in COLD SHUTDOWN within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

For Table 3.2.2 ACTION Note 2.c, if the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply. This is done by placing the plant in at least STARTUP/HOT STANDBY within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, based on operating experience, to reach STARTUP/HOT STANDBY from full power conditions in an orderly manner and without challenging plant systems.

Amendment No.

27b 76k

VYNPS EASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION ACTIONS (continued)

For Table 3.2.2 ACTION Note 2.d, if the channel is not restored to operable status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated.

Isolating Lhe affected penetration flow path(s) accomplishes the safety function of the inoperable channel.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s).

Table 3.2.2 ACTION Note 2.d also allows penetration flow path(s) to be unisolated intermittently under administrative controls.

These administrative controls consist of stationing a dedicated operator in the immediate vicinit'y of the controls of the valve, with whom Control Room communication is immediately available.

In this way, The penetration can be rapidly isolated when a need for primary containment isolation is indicated.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.B.1 As indicated in Surveillance Requirement 4.2.B.1, primary containment isolation instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.2.

Table 4.2.2 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.B.1 also indicates that when a channel (and/or the affected PCIV) is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability analysis (Refs.

6 and 7) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the PCIVs will isolate the penetration flow path(s) when necessary.

Surveillance Requirement 4.2.B.2 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel.

The automatic initiation testing'required by the PCIV Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function. For Main Steam Line Isolation Trip Functions, a simulated automatic actuation, which opens all pilot valves of the main steam line isolation valves, shall be performed such that each trip system logic can be verified independent of its redundant counterpart.

The Frequency of "once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Amendment No.

236 761

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION SURVEILLANCE REQUIREMENTS (continued)

Table 4.2.2, Check Performance of an Instrument Check once per day for Trip Functions I.a, l.c, l.e, and 2.b, ensures that a gross failure of instrumentation has not occurred.

An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each-Calibration.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use' of the displays associated with the channels required by the LCO.

Table 4.2.2, Functional Test For Trip Functions l.a, l.b, l.c, l.d, l.e, l.f, 2.a, 2.b,.3.a, 3.b, 3.c, 3.d, 4.a, 4.c, 4.d, 4.e, 4.f, and 5.a, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of "Every 3 Months" is based on the reliability anaiysis of References 6 and 7.

Table 4.2.2, Calibration For Trip Functions l.a, l.b, l.c, l.d, l.e,'l.f, 2.a, 2.b, 3.a, 3.b, 3.c, 3.d, 3.e, 4.a, 4.b, 4.c, 4.d, 4.e, 4.f, and 5.a, an Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration'leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

Amendment No.

236 76m

VYN PS BASES: 3.2.B/.1.2.B PRIMARY CONTAINMENT ISOLATION SURVEILLANCE REQUIREMENTS (continued)

For Trip Functions i.a, l.c, l.e, 2.a, and 2.b, a calibration of the trip units is required (Footnote (a))

once every 3 months.

Calibration of the trip units provides a check of the actual setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures.

The Frequency of every 3 months is based on the reliability analysis of References 6 and 7 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. Technical Requirements Manual.

2.

UFSAR, Chapter 14.

3.

UFSAR, Table 6.5.3.

4.

UFSAR, Section 14.6.5.

5.

UFSAR, Section 14.5.4.1.

6.

NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

7.

NEDC-30851P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.

Amendment No.

236

-76n

VYN PS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION BACKGROUND The reactor building ventilation. isolation and Standby Gas treatment System initiation instrumentation automatically initiates closure of the Reactor Building Automatic Ventilation System Isolation Valves (RBAVSIVs) and starts the Standby Gas Treatment (SGT)

System.

The function of these components and

systems, in combination with other accident mitigation systems, is to limit fission product release during and'followinq postulated Design Basis Accidents (DBAs)

(Ref.

1).

Reactor Building (i.e.,

secondary containment) isolation and establishment of vacuum with the SGT System ensures that fission products that leak from primary containment following a DBA, or are released outside primary containment, or are released during certain operations when primary containment is not required to be operable, are maintained within applicable limits.

The isolation instrumentation includes the sensors-, relays, and switches that are necessary to cause initiation of reactor building ventilation isolation and Standby Gas Treatment System operation.

Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which then outputs a reactor building ventilation isolation and Standby Gas Treatment System initiation signal to the isolation and initation logic.

Functional diversity is provided by monitoring a wide range of independent parameters.

The input parameters to the isolation and initiation logic are (1) reactor vessel water level, (2) drywell pressure, (3) reactor building ventilation radiation, and (4) refueling floor zone radiation.

Redundant sensor input signals from each.parameter are provided for initiation and isolation.

For both the Low Reactor Vessel Water Level and High Drywell Pressure Trip Functions, the reactor building ventilation isolation and Standby Gas Treatment System initiation logic receives input from four channels.

The outputs of the channels are arranged in one-out-of-two taken twice logics.'

For the High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation Trip Functions, two radiation detectors and monitors are provided for each Trip Function.

Each channel includes a radiation detector and associated monitor.

The outputs of the channels are arranged in a one-out-of-two logic.

In addition, the outputs of each channel are provided to both Trip Systems A and B.

As such, any High Reactor Building Ventilation Radiation or High Refueling Floor Zone Radiation Trip Function channel will initiate reactor building ventilation isolation and Standby Gas Treatment System operation.

(For the purposes of the Technical Specifications, the A radiation detectors and monitors should be considered to be associated with the Trip System A and the B radiation detectors and monitors should be considered to be associated with Trip System B.).

Trip System A initiates startup of SGT subsystem A and initiates isolation of the reactor building supply and exhaust outboard isolation valves.

Trip System B initiates startup of SGT subsystem B and initiates isolation of the.reactor building supply and exhaust inboard isolation valves.

As such, either Trip System isolates the secondary containment and provides the necessary filtration of fission products.

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY The isolation and initiation signals generated by the reactor building ventilation isolation and Standby Gas Treatment System initiation Amendment No.

23b

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION.

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) instrumentation are implicitly assumed in the safety analyses of References 2, 3,

and 4, to initiate closure of the RBAVSIVs and start the SGT System to limit offsite doses..

Reactor building ventilation isolation and Standby Gas Treatment System initiation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c) (2)

(ii).

The operability of the reactor building ventilation isolation-'and Standby Gas Treatment System initiation instrumentation is dependent on the operability of the individual instrumentation channel Trip Functiohs specified in Table 3.2.3.

Each Trip Function must haVe the required number of operable channels in each trip system,. with their trip setpoints within the calculational as-found tolerances specified in plant procedures.

Operation with actual trip setpoints within caiculational as-found tolerances provides reasonable assurance that,,

under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.3.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

-The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

In general, the individual Trip Functions are required to be OPERABLE in

RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, Refuel (with reactor coolant temperature

> 212'F),

during operations with the potential for draining the reactor vessel (OPDRVs),

during movement of irradiated fuel assemblies or fuel cask in secondary containment, and during Alteration of-the. Reactor Core; consistent with the Applicability for the SGT System and secondary containment requirements in Specifications 3.7.B and 3.7.C.

Trip Functions that have different Applicabilities are discussed below in the individual Trip Functions discussion.

The specific Applicable Safety Analyses,

LCO, and Applicability discussions are listed below on a Trip Function by Trip Function basis.

1. Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

An isolation of the secondary containment and actuation of the SGT System.are initiated in order to minimize the potential of an offsite release.

The Low Reactor Vessel Water Level Trip Function isone of the Trip Functions assumed to be operable and capable of providing isolation and initiation signals.

The isolation and initiation of systems on Low Reactor Vessel Water Level support actions to ensure that any offsite releases are within the limits' calculated in the safety analysis.

Low Reactor Vessel Water Level signals are initiated from level transmitters that sense the difference between the pressure due to a constant column' of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Low Reactor Vessel Water Level Trip, Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation and initiation function.

Amendment No.

236.

76p

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

The Low Reactor Vessel Water Level Trip Settin4 was chosen to be the same as the Reactor Protection System (RPS)

Low.Reactor Vessel Water Level Trip Setting (Specification 3.1.A),

since this could indicate that the capability to cool the fuel is being threatened.

The Trip Setting is referenced from the top of enriched fuel.

The Low Reactor Vessel Water Level Trip Function is required to be operable in

RUN, STARTUP/HOT STANDBY, HOT

SHUTDOWN, Refuel (with reactor coolant temperature > 212'F) where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a possibility of pipe breaks resulting in significant releases of radioactive steam and gas.

In COLD SHUTDOWN and Refuel (with reactor coolant temperature < 212'F),

the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these Modes; thus, this Trip Function is not required.

In addition, the Trip Function is also required to be operable during OPDRVs to ensure that offsite dose limits are not exceeded if core damage occurs.

2.

High Drywell Pressure High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB).

An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite release.

The isolation and initiation of systems on High Drywell Pressure supports actions to ensure-that any offsite releases are within the limits calculated in the safety analysis.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell.

Four channels of High Drywell Pressure.Trip Function are available andlare required to be operable to ensure that no single instrument failure can preclude performance of the isolation and initiation function.

The Trip Setting was chosen to be the same as the RPS High Drywell Pressure Trip Setting (Specification 3.1.A) since this is indicative of a loss of coolant accident (LOCA).

The High Drywell Pressure Trip Function is required to be operable in

RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, Refuel (with reactor coolant temperature

> 212'F) where considerable energy exists in the RCS; thus, there is a

possibility of pipe breaks resulting in significant releases of radioactive steam and gas.

This Trip Function is not required in COLD SHUTDOWN and Refuel (with reactor coolant temperature < 212 0 F) because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these Modes.

3,

4.

High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation High reactor building ventilation radiation or refuel floor zone radiation is an indication of possible gross failure of the fuel cladding.

The release may Amendment No.

236

-76q

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) have originated from the primary containment due to a break in the RCPB or the refueling floor due to a fuel handling accident.

When High Reactor Building Ventilation Radiation or High Refueling Floor Zone Radiation is detected, secondary containment isolation and actuation of the SGT System are initiated to support actions to limit the release of fission products as assumed in the UFSAR safety analyses (Ref.

4).

The High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation signals are initiated from radiation detectors that are located on the ventilation exhaust duct coming from the reactor building and the refueling floor zones, respectively.

Two channels of High Reactor Building Ventilation Radiation Trip Function and two channels of High Refueling Floor Radiation Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation and initiation function.

The Trip Settings are chosen to promptly detect gross failure of the fuel cladding.

The High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation Trip Functions are required to be operable in

RUN, STARTUP/HOT

STANDBY, HOT SHUTDOWN, Refuel (with reactor coolant temperature > 212'F) where considerable energy exists in the 'RCS; thus, there is a possibility of pipe breaks resulting in significant releases of radioactive steam and gas.

In COLD SHUTDOWN and Refuel (with reactor coolant temperature < 212'F)., the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these Modes; thus, these Trip Functions are not required.

In addition, the Trip Functions are also required to be operable during OPDRVs, during movement of irradiated fuel assemblies or fuel cask in the secondary containment, and during Alteration of the Reactor Core, because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded.

ACTIONS Table 3.2.3 ACTION Note 1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months depending on the Trip Function (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for those Trip Functions that have channel components common to RPS instrumentation, i.e.,

Trip Functions 1 and 2, and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for those Trip Functions that do not have channel components common to RPS instrumentation, i.e.,

all other Trip Functions),

has been shown to be acceptable (Refs.

5 and 6) to permit restoration of any inoperable channel to operable status.

This out of service time is only acceptable provided the associated Trip Function is still maintaining isolation capability (refer to next paragraph).

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.3 Note l.a.l) or l.a.2),

as applicable.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, Amendment No.

236 76r

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION ACTIONS ý(continued) if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation or initiation),

the Reactor Building Ventilation Sys~tem must be isolated and the SGT System must be placed in operation within the next one hour.

Isolating the Reactor Building Ventilation System and placing the SGT System in operation performs the intended function of the instrumentation and allows operation to continue.

Table 3.2.3 Note l.b is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in a complete loss of isolation capability for the associated penetration flow path(s) or a complete loss of initiation capability for the SGT System.

A Trip Function is considered to be maintaining isolation and initiation capability when sufficient channels are operable or in trip in both trip systems, such that a trip signal will be generated from the given Trip Function on a valid signal.

This ensures that isolation of the two RBAVSIVs in the associated penetration flow path and the operation of the SGT System can be initiated on an isolation and initiation signal from the given Trip Function.

For the Trip Functions 1 and 2, this would require each trip system to have one channel operable or in trip.

For Trip Functions 3 and 4, this would require one channel to be operable or in trip.

The one hour Completion Time is intended to allow the operator'time to evaluate and repair any discovered inoperabilities.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

If any applicable Action and associated Completion Time of Table 3.2.3 ACTION Note l.a or l.b are not met, the ability to isolate the secondary containment and start the SGT System cannot be ensured.

Therefore, further actions must be performed to ensure the ability to maintain the secondary containment isolation and SGT System initiation function.

Isolating the associated penetration flow path(s) and starting the associated SGT System within the next one hour performs the intended function of the instrumentation and allows operation to continue.

One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without unnecessarily challenging plant systems.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.C.1 As indicated in Surveillance Requirement 4.2.C.1, reactor building ventilation isolation and Standby Gas Treatment System initiation instrumentation shall be

checked, functionallyftested and calibrated as indicated in Table 4.2.3.

Table 4.2.3 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.C.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains isolation and Amendment No.

236 76s

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION SURVEILLANCE REQUIREMENTS (continued) initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability analysis (Refs.

5 and 6) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RBAVSIVs will isolate the penetration flow path(s) and that the SGT System will initiate when necessary.

Surveillance Requirement 4.2.C.2 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel.

The testing required by the SGT System and RBAVSIVs Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function.

The Frequency of '"once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.3, Check Performance of an Instrument Check once per day, for Trip Function 3, and once per day during Refueling, for Trip Function 4, ensures that a gross failure of instrumentation has not occurred.

An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.3, Functional Test For Trip Functions 1, 2, 3,

and 4, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current Amendment No.

236 76t

VYNPS BASES: 3.2.C/4.2.C REACTOR RUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION SURVEILLANCE REQUIREMENTS (continued) plant specific setpoint methodology.

The Frequency of "Every 3 Months" is based on the reliability analysis of References 5 and 6.

'Table 4.2.3, Calibration For Trip Functions 1, 2, 3, and 4, an Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated

.setpoint analyses.

For Trip Functions 1 and 2, a calibration of the trip units is required (Footnote (a))

once every 3 months.

Calibration of the trip units provides a check of the actual setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures.

The Frequency of every 3 months is based on the reliability analysis of Reference 6 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. UFSAR, Section 5.3.

2.

UFSAR, Section 7.17.2.

3.

UFSAR, Section 14.6.3.6.

4.

UFSAR, Section 14.6.4.4.

5.

NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

6.

NEDC-30851P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECGS Instrumentation,"

March 1989.

Amendment No.

236 7 6u

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION BACKGROUND Control rods provide the primary means for control of reactivity changes.

Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to backup administrative controls on control rod movement.

Durihg shutdown conditions, control'rod blocks from the Reactor Mode Switch-Shutdown Position Function ensure that all control rods remain inserted to prevent inadvertent criticalities.

The purpose of the RBM (Ref.1) is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during control rod manipulations.

The RBM supplies a trip signal to the Reactor Manual Control System (RMCS) to appropriately inhibit control rod withdrawal during power operation above..the 30% RATED THERMAL POWER setpoint when a non-peripheral control rod (except control rod 34-35) is selected.

The RBM has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint.

One RBM channel inputs into one RMCS rod block circuit and the other RBM channel inputs into the second RMCS rod block circuit.

A rod block in either RMCS circuit will provide a control rod block to all control rods.

The RBM channel signal is generated by averaging a set of local power range monitor (LPRM) signals.

One RBM channel averages the signals from LPRM detectors at the A and C positions in the assigned LPRM assemblies, while the other RBM channel averages the signals from LPRM detectors at the B and D positions.

Assignment of LPRMs to be used in RBM averaging is controlled by the selection of control rods.

The RBM is automatically bypassed and the output set to zero if a peripheral rod (or control rod 34-35) is selected or the APRM used to normalize the RBM reading is at < 30% RATED THERMAL POWER.

If any LPRM detector assigned to an RBM is bypassed, the computed average signal is automatically adjusted to compensate for the number of LPRM input signals.

The minimum number of LPRM inputs required for each RBM channel to prevent an instrument inoperative trip is four when using four LPRM strings, three when using three LPRM strings, and two when using two LPRM strings.

Each RBM also receives a recirculation loop flow signal from the associated flow converter.

When a control rod is selected, the gain of each RBM channel output is normalized to a. reference APRM.

The gain setting is held constant during the movement of that particular control rod to provide an indication of the change in the relative local power level.

If the indicated power increases above the preset limit, a rod block will occur.

In'addition, to preclude rod movement with an inoperable RBM, a downscale trip and an inoperable trip are provided.

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained (Ref.

2).

This Trip Function prevents inadvertent criticality as the result of a control rod withdrawal during COLD SHUTDOWN and HOT SHUTDOWN or during a Refueling Outage when the reactor mode switch is required to be in the shutdown position.

The reactor mode switch has two

channels, each inputting into a separate RMCS rod block circuit.

A rod block in either RMCS circuit will provide a control rod block to all control rods.

Amendment No.

236 77

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION APPLICABLE SAFETY ANALYSES, LCOi and APPLICABILITY l.a, l.b, l.c Rod Block Monitor The RBM is not specifically credited in any accident or transient analysis, but it is retained for overall redundancy and diversity as required by the NRC approved licensing basis.,

The Trip Settings are based on providing operational flexibility in the MELLLA region.

Two channels of each of the RBM Trip Functions are required to be operable, with their trip setpoints within the calculational as-found tolerances specified in plant procedures, as applicable,, to ensure that no single instrument failure can preclude a rod block from these Trip Functions.

In addition, to provide adequate coverage of the entire core in the axial direction, LPRM inputs for each RBM channel are required from 'greater than or equal to half the total number of inputs from any LPRM level for every non-peripheral control rod selected for movement.

-The upper limit of the RBM Upscale (Flow Bias) Trip Function is clamped to provide protection at greater than 100% rated core flow.

Trip Settings are specified for RBM Upscale (Flow Bias) and RBM Downscale Trip Functions.

The terms for the Trip Setting of the RBM Upscale (Flow Bias) Trip Function are defined as follows: W is percent of rated two loop drive flow where 100% rated drive flow is that flow equivalent to 48 X 106 lbs/hr core flow; and AW is the difference between two loop and single loop drive flow at the same core flow (this difference must be accounted for during single loop operation).

AW = 0 for two loop operation and AW =.8% for single loop operation.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.5. As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Amendment No.

236 77a

VYN PS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

2.

Reactor Mode Switch -

Shutdown Position During HOT SHUTDOWN and COLD SHUTDOWN, and during Refueling Outages when the reactor mode switch is in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed.

The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subIritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode Switch-Shutdown Position Trip Function satisfies Criterion 3 of 10 CFR 50.36(c) (2)

(ii).

Two channels are required to be operable to ensure that no single channel failure will preclude a rod block when required.

There is no Trip Setting for this Trip Function since the channels are mechanically actuated based solely on reactor mode switch position. During shutdown conditions (HOT SHUTDOWN and COLD SHUTDOWN, and Refueling Outages when the reactor mode switch is in the shutdown position),

no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality.

Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be operable.

With the reactor mode switch in the refueling position, the refuel position one-rod-out interlock proviides the required control rod withdrawal blocks.

ACTIONS Table 3.2..5 ACTION Note 1 With one RBM Trip Function l.a, l.b, or l.c channel inoperable, the remaining operable channel is adequate to perform the control rod block function; however, overall reliability is reduced because a single failure in the remaining operable RBM channel can result in no control rod block capability for the RBM.

For this reason, Table 3.2.5 ACTION Note l.a requires restoration of the inoperable channel to operable status. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the low probability of an event occurring coincident with a failure in the remaining operable channel.

If the Table 3.2.5 ACTION Note l.a required action is not met and the associated Completion Time has expired, the inoperable channel must be placed in trip within I hour.

If both RBM Trip Function l.a, l.b, or l.c channels are inoperable, the RBM is not capable of performing its intended function;

thus, one channel must also be placed in trip.

This initiates a control rod withdrawal block, thereby ensuring that the RBM function is met.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities and is acceptable because it minimizes risk while allowing time for restoration or tripping of inoperable channels..

'Table 3.2.5 ACTION Note 2 With one Reactor Mode Switch-Shutdown Position control rod withdrawal block channel inoperable, the remaining operable channel is adequate to perform the Amendment No.236 i

77-b

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION ACTIONS (continued) control rod withdrawal block function.

However, since the required actions of Table 3.2.5 ACTION Note 2 are consistent with the normal action of an operable Reactor Mode Switch-Shutdown Position Trip Function (i.e.,

maintaining all control rods inserted),

there is no distinction between having one or two channels inoperable.

In both cases (one or both channels inoperable))

suspending all control rod withdrawal and initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcriticalbwith adequate Shutdown Margin ensured by Specification 3.3.A.I. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted.

Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.E.1 As indicated in Surveillance Requirement 4.2.E.1, control rod block instrumentation shall be functionally tested and calibrated as indicated in Table 4.2.5.

Table 4:2.5 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.E.1 also indicates that when an RBM channel is placed

.- an inoperable status solely for performance of required inctr.t

.,ation Surveillances, entry into associated LCO and required Actions r.ilayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function cainta.: 2ns control rod block capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to o*ecrr.e status or the applicable LCO entered and required Actions taken.

.:ý,-,ance is based on the reliability analysis (Ref.

4) assumption of tLe time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that a control rod block will be initiated when necessary.

Table 4.2.5, Functional Test For Trip Functions l.a, l.b, and l.c, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

The Functional Test of the RBM channels includes the Reactor Manual Control "Select Relay Matrix" System input.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of "Every 3 Months" is based on the reliability analysis of Reference 5.

For Trip Function 2, a Functional Test is performed to ensure that the entire channel will perform the intended function.

The Functional Test for the Reactor Mode Switch-Shutdown Position Trip Function is performed by attempting to withdraw any control rod with the reactor mode switch in the Amendment No.

236 77c

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION SURVEILLANCE REQUIREMENTS (continued) shutdown position and verifying a control rod block occurs.

As noted in Table 4.2.5 Footnote (a),

the Surveillance must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable links.

This allows entry into the HOT SHUTDOWN and COLD SHUTDOWN Modes if the "Every Refueling Outage" Frequency is not met.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance Requirement.

The Frequency of "Every Refueling Outage" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.5, Calibration For Trip Functions l.a and l.b, an Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the. channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The specified Instrument Calibration

-Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

The RBM is automatically bypassed when power is below a specified value or if a peripheral control rod is selected.

The power level is determined from the APRM signals input to each RBM channel.

The automatic bypass setpoint must be verified periodically to be < 30% RATED THERMAL POWER.

As a result, the Instrument Calibration of Trip Function l.a must also include calibration of the RBM Reference Downscale function (i.e.,

RBM Upscale (Flow Bias) Trip Function is not bypassed when > 30% RATED THERMAL POWER),

as noted in Footnote (c).

In addition, it must also be verified that the RBM is not bypassed when a control rod that is not a peripheral control rod is selected (only one non-peripheral control rod is required to be verified).

If any bypass setpoint is nonconservative, then the affected RBM channel is considered inoperable.

Alternatively, the APRM channel can be placed in the conservative condition to enable the RBM.

If placed in this condition, the Surveillance Requirement is met and the RBM channel is not considered inoperable.

As noted in Footnote (b),

neutron detectors are excluded from the Surveillance because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal.

Changes in neutron detector sensitivity are compensated for by performing the 7 day heat balance calibration and the 2000 MWD/T LPRM calibration against the Traversing Incore Probe System of the Reactor Protection System Technical Specification.

Amendment No.

236 77d

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION REFERENCES

1. UFSAR, Section 7.5.8.

2.

UFSAR, Section 7.7.4.3.2.

3.

UFSAR, Section 14.5.3.1.

4.

GENE-770-06-l-A, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," December 1992.

5.

NEDC-30851-P-A, Supplement 1, "Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation," October 1988.

Amendment No.

236 77e

VYNPS SASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION SACKGROUND The mechanical vacuum pump isolation instrumentation initiates an isolation of the mechanical vacuum pump following events in which main steam radiation monitors exceed a predetermined value.

Tripping and isolating the mechanical vacuum pumps limits control room and offsite doses in the event of a control rod drop accident (CRDA).

The mechanical vacuum pump isolation instrumentation includes sensors, relays and switches that are necessary to cause initiation of mechanical vacuum pump isolation.

'The channels include electronic equipment that compares measured input signals with pre-established setpoints.

When the setpoint is

exceeded, the channel output relay actuates, which then outputs an isolation signal to the mechanical vacuum pump isolation logic.

The isolation logic consists of two independent trip systems, with two channels of the High Main Steam Line Radiation Trip Function in each trip system. Each trip system is a one-out-of-two logic for this Trip Function.

Thus, either channel of the High Main Steam Line Radiation Trip Function in a

trip system is needed to trip the trip system.

The outputs of the channels in a trip system are arranged in a logic so that both trip systems must trip to result in an isolation signal.

The mechanical vacuum pump isolation valve is also associated with this Trip Function.

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY The mechanical vacuum pump isolation is assumed in the safety analysis for the CRDA.

The mechanical vacuum pump isolation instrumentation initiates an isolation of the mechanical vacuum pump to limit control room and offsite doses resulting from fuel cladding failure in a CRDA.

The mechanical vacuum pump isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c) (2) (ii).

The operability of the mechanical vacuum pump isolation instrumentation is dependent on the operability of the four High Main Steam Line Radiation Trip Function instrumentation channels with their trip setpoints within the calculational 'as-found tolerances specified in plant procedures.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Surveillance Requirement 4.2.F.l.c as required by the CRDA analysis.

As a result, a

channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

The actual trip setpoint is calibrated consistent with applicable setpoint, methodology assumptions.

The High Main Steam Line Radiation Trip Setting was chosen to be as low enough to ensure that control room and offsite dose limits are not exceeded in the event of a CRDA, but high enough to avoid spurious, isolation due to nitrogen-16 spikes, instrument instabilities, and other operational occurrences.

Channel operability also includes the mechanical vacuum pump isolation valve.

Amendment No. 236 78

VYNPS BASES:

3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

The mechanical vacuum pump isolation is required to be operable in RUN and STARTUP/HOT STANDBY when the mechanical vacuum pump is in service to mitigate the consequences of a postulated CRDA.

In this condition, fission products released during a CRDA could be discharged directly to the environment.

Therefore, the mechanical vacuum pump isolation is necessary to assure conformance with the radiological evaluation of the CRDA.

In other Modes or conditions, the consequences of a control rod drop are insignificant, and are not expected to result in any fuel damage or fission product releases.

When the mechanical vacuum pump is not in operation in RUN and STARTUP/HOT

STANDBY, fission product releases via this pathway would not occur.

ACTIONS Specification 3.2.F.2.a With one or more High Main Steam Line Radiation Trip Function channels inoperable, but with mechanical vacuum pump isolation capability maintained (refer to Specification 3.2.F.2.b Bases),

the mechanical vacuum pump isolation instrumentation is capable of performing the intended function.

However, the reliability and redundancy of the mechanical vacuum pump isolation instrumentation is reduced, such that a single failure in one of the remaining channels could result in the inability of the mechanical vacuum pump isolation instrumentation to perform the intended function.

Therefore, only a limited time is allowed to restore the inoperable channels to operable status.

Because of the low probability of an extensive number of inoperabilities affecting multiple channels, and the low probability of an event requiring the initiation of mechanical vacuum pump isolation, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Ref.

1) to permit restoration of any inoperable channel to operable status.

Alternately, the inoperable channel or associated trip system may be placed in

trip, since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

As noted, placing the channel in trip with'no further restrictions is not allowed if the inoperable channel is the result of an inoperable mechanical vacuum pump isolation valve, since this may not adequately compensate, for the inoperable mechanical vacuum pump isolation valve (e.g., the isolation valve may be inoperable such that it will not close).

If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel would result in loss of condenser vacuum),

or if the inoperable channel is the result of an inoperable mechanical vacuum pump isolation valve, Specification 3.2.F.2.b.must be entered and its required actions taken.

Specification 3.2.F.2.b With any required Action and associated completion time of Specification 3.2.F.2.a not met, the plant must be brought to a Mode or other specified condition in which the LCO does not apply.

To achieve this status, the plant must be brought to at least SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Alternately, the mechanical vacuum pump may be isolated since this performs the intended function of the instrumentation.

An additional option is provided to isolate Amendment No.

236 78a

VYNPS EASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION ACTIONS (continued) the main steam lines, which may allow operation to continue.

Isolating the main steam lines effectively provides an equivalent level of protection by precluding fission product transport to the condenser.

This isolation is accomplished by isolation of all main steam lines and main steam line drains which bypass the main steam isolation valves.

Specification 3.2.F.2.b is also intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels result in the High Main Steam Line Radiation Trip Function not maintaining mechanic'al vacuum pump isolation capability.

The High Main Steam Line Radiation Trip Function is considered to be maintaining mechanical vacuum pump isolation capability when sufficient channels are operable or in trip such that the mechanical vacuum pump isolation instruments will generate a trip signal from a valid High Main Steam Line Radiation signal, and the mechanical vacuum pump will be isolated.

This requires one channel of the High Main Steam Line Radiation Trip Function in each trip system to be operable or in trip, and the mechanical vacuum pump isolation valve to be operable.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.F.1 N

As indicated in Surveillance Requirement 4.2.F.l, the High Main Steam Line Radiation Trip Function for mechanical vacuum pump isolation shall be checked, functionally tested and calibrated as indicated Surveillance Requirements 4.2.F.l.a, b, c,

d, and e.

Surveillance Requirement 4.2.F.l also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains mechanical vacuum pump isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability analysis (Ref.

1) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that a mechanical vacuum pump will isolate when necessary.

Surveillance Requirement 4.2.F.l.a, Instrument Check Performance of an Instrument Check once each day ensures that a gross failure of instrumentation has not occurred.

An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration.

Agreement criteria are determined by the plant staff based Amendment No.

236

-78b

ViYNPS

ASES:

3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION SURVEILLANCE REQUIREMENTS (continued) on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Surveillance Requirement 4.2.F.l.b, Instrument Functional Test An Instrument Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of "once every 3 months" is based on the reliability analysis of Reference 1.

Surveillance Requirements 4.2.F.l.c and 4.2.F.l.d, Instrument Calibrations An Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An InstrumentCalibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

Surveillance Requirement 4.2.F.i.c requires a calibration to be performed once every 3 months using a current source.

This current source is provided downstream of the radiation detectors.

As such, the radiation detectors are excluded from the 3 month calibration.

Surveillance Requirement 4.2.F.l.d requires a calibration to be performed once each Refueling Outage using a radiation source.

The radiation detectors are included in the once each Refueling Outage calibration.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

Surveillance Requirement 4.2.F.l.e, Logic System Functional Test The Logic System Functional Test demonstrates the operability of the required trip logic for a specific channel.

Actuation of the mechanical vacuum pump isolation valve is included as part of this Surveillance to provide complete testing of the assumed safety function.

Therefore, if the isolation valve is incapable of actuating, the instrument channel would be inoperable.

The Frequency of "once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Amendment No.

236 78c

VYNPS 2ASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION REFERENCES

1.

NEDC-30851P-A, Supplement 2, Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation, March 1989.

Amenoment No.

236 78d

VYNPS BASES: 3.2.Gi4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION BACKGROUND The primary purpose of the post-accident monitoring (PAM) instrumentation is to display, in the control room, plant variables that provide information required by the control room operators during accident situations.

This information provides the necessary support for the operator to take the manual actions for'which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design.

Basis Events.

The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I, in accordance with Regulatory Guide 1.97 (Ref.

1).

The operability of the post-accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident.

This capability is consistent with the recommendations of Reference 1.

APPLICABLE SAFETY ANALYSES The PAM instrumentation Specification ensures the operability of Regulatory Guide 1.97, Type A variables so that the control room operating staff can:

Perform the diagnosis specified in the Emergency Operating Procedures (EOPs). These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs),

.(e.g.,

loss of

-coolant accident (LOCA)),

and Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.

The PAM instrumentation Specification also ensures operability of most Category I, non-Type A, variables so that the control room operating staff can:

Determine whether systems important to safety are performing their intended functions; Determine the potential for causing a gross breach of the barriers to radioactivity release; Determine whether a gross breach of a barrier has occurred; and Initiate action necessary to protect the public and 'for an estimate of the magnitude of any impending threat.

The plant specific Regulatory Guide 1.97 analysis (Ref.

2) documents the process that identified Type A and Category I, non-Type A, variables.

Post-accident monitoring instrumentation that satisfies the definition of Type A in Regulatory Guide 1.97 meets Criterion 3 of 10 CFR 50.36(c) (2) (ii).

Category I, non-Type A, instrumentation is retained in Technical Specifications (TS) because they are intended to assist operators in Amendment No.

236 79

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION APPLICABLE SAFETY ANALYSES (continued) minimizing the consequences of accidents.

Therefore, these Category I variables are important for reducing public risk.

LCO Specification 3.2.G and Table 3.2.6 require two operable channels for each Function to ensure that no single failure prevents the operators from being presented with the information necessary to determine the status of the plant and to bring the plant to, and maintain it in, a safe condition following an accident.

Furthermore, providing two channels allows an Instrument-Check during the post accident phase to confirm the validity of displayed information.

The following list is a discussion of the specified instrument Functions listed in Table 3.2.6.

1. Drywell Atmospheric Temperature Drywell atmospheric temperature is a Type A and Category I variable provided to detect a reactor coolant pressure boundary (RCPB) breach and to verify the effectiveness of Emergency Core Cooling System (ECCS) functions that operate to maintain containment integrity.

Two redundant temperature signals are transmitted from separate temperature elements for each channel.

The output of one of these channels is recorded on a recorder in a control room.

The output of the other channel is displayed on a.n indicator in the control room.

The drywell atmospheric temperature channels measure from 00 F to 350'F.

Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

2.

Drywell Pressure Drywell pressure is a Type A and Category I variable provided to detect breach of the RCPB and to verify ECCS functions that operate to maintain Reactor Coolant System (RCS) integrity.

Two drywell pressure signals are transmitted from separate pressure transmitters for each channel.

The output of these channels is displayed on two independent indicators in the control room.

The pressure channels measure from -15 psig to 260 psig.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

3.

Torus Pressure Torus pressure is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach.

Two torus pressure signals are transmitted from separate pressure transmitters and displayed on two independent indicators in the control room.

The range of Amendment No.

236

/9a

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION LCO (continued) indication is 15 psig to 85 psig.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

4.

Torus Water Level Torus water level is a Type A and Category I, variable provided to detect a breach in the RCPB.

This variable is also used to verify and provide long term surveillance of ECCS function.

The Torus Water Level Function provides the operator with sufficient information to assess the status of both the RCPB and the water supply to the ECCS.

The Torus Water Level Function channels monitor the torus water level from 0-25 feet. referenced to the bottom of the torus.

Two torus water level signals are transmitted from separate level transmitters to two independent control room indicators in the control room.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

5.

Torus Water Temperature Torus water temperature is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach.

Two redundant temperature signals are transmitted from separate temperature elements for each channel.

The temperature channels output-to two independent control room indicators.

The range of the torus water temperature channels is 00F to 250'F.

Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

6.

Reactor Pressure Reactor pressure is a Type A and Category I variable provided to support monitoring of RCS integrity and to verify operation of the ECCS.

Two independent pressure transmitters, with a range of 0 psig to 1500 psig, monitor pressure and provide pressure indication to the control room.

The output from these channels is provided to two independent indicators in the control room.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

7.

Reactor Vessel Water Level Reactor vessel water level is a Type A and Category I variable provided to support monitoring of core cooling and to verify operation of the ECCS.

Water level is measured by independent differential pressure transmitters for each channel.

Each channel measures from -200 inches to + 200 inches, referenced to the top of enriched fuel.

The output from these channels is provided to two independent indicators in the control room.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

Amendment No.

236 7 9b

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION LCO (continued)

8.

Torus Air Temperature Torus air temperature is a Type A and Category I variable provided to detect a RCPB breach and to verify the effectiveness of ECCS functions that operate to maintain containment integrity.

Two redundant temperature signals are transmitted from separate temperature elements for each channel.

The output of one of these channels is recorded on a recorder in a control room with a range of 50'F to 300'F.

The output off the other channel is displayed on an indicator in the control room with a range of 00F to 350'F.

Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

9.

Containment High Range Radiation Monitor Containment high range radiation is a Category 1 variable provided to monitor the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.

Two redundant radiation detectors are mounted in the drywell.

Each radiation detector provides a signal to an independent monitor in the control room, which has a range from 100 R/hr to 107 R/hr.

The outputs of these radiation monitors are displayed on two independent indicators located in the control room.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

APPLICABILITY The PAM instrumentation Specification is applicable in the RUN and STARTUP/HOT STANDBY Modes.

These variables are related to the diagnosis and preplanned actions required to mitigate DBAs.

The applicable DBAs are assumed to occur in the RUN and STARTUP/HOT STANDBY Modes.

In other Modes and conditions, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be operable in these other Modes or conditions.

Amendment No.

236 79c

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION ACTIONS Table 3.2.6 ACTION Note I Table 3.2.6 ACTION Note l.a.l) requires that, when one or more Functions (except Function 9) have one required channel that is inoperable, the required inoperable channel must be restored to operable status within 30 days.

The 30 day Completion Time is based on operating experience and takes into account the remaining operable channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments),

and the low probability of an event requiring PAM instrumentation during this interval.

If the inoperable channel of each affected Function has not been restored to operable status in 30 days, Table 3.2.6 ACTION Note l.a.2) requires a special written report be submitted to the NRC within the next 14 days.

The report will outline the preplanned alternate method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the instrumentation to operable status. This action is appropriate in lieu of a shutdown requirement, since another operable channel is monitoring the Function, an alternate method of monitoring is available, and given the likelihood of plant conditions that would require information provided by this instrumentation.

Table 3.2.6 ACTION Note l.b.l) requires that, when one or more Functions, except Function 9, have two required channels that are inoperable (i.e.,

two channels inoperable in the same Function),

one channel in the Function should be restored to operable status within 7 days.

The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information..

Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation.

Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a

degraded condition should an accident occur.

If at least one channel of each affected Function has not been restored to operable status in 7 days, Table 3.2.6 ACTION Note l.b.2) requires the plant to be brought to a Mode in which the LCO does not apply.

To achieve this status, the plant must be brought to at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Table 3.2.6 ACTION Note 2 Table 3.2.6 ACTION Note 2.a.l) requires that, when Function 9 has one required channel that is inoperable, the required inoperable channel must be restored to operable status within 30 days.

The 30 day Completion Time is based on operating experience and takes into account the remaining operable channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments),

and the low probability of an event requiring PAM instrumentation during this interval.

If the inoperable channel has not been restored to operable status in 30 days, Table 3.2.6 ACTION Note 2.a.2) requires a special written report be submitted to the NRC within the next 14 days.

The report will outline the preplanned alternate Amendment No.

236 79d

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION ACTIONS (continued) method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the instrumentation to operable status. This action is appropriate in lieu of a shutdown requirement, since another operable channel is monitoring the Function, an alternate method*of monitoring is available, and given the likelihood of plant conditions that would require information provided by this instrumentation.

Table.3.2.6 ACTION Note 2.b.l) requires that,, when Function' 9 has two required channels that are inoperable, one channel should be restored to operable status within 7 days.

The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.

Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation.

Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

Since alternate means of monitoring drywell radiation have-been developed and tested, the action required by Table 3.2.6 ACTION 2.b.2),

if at least one channel has not been restored to operable status within 7 days, is not to shut down the plant, but rather to submit a special written report to the NRC within the next 14 days.

The report will outline the preplanned alternate method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the normal PAM instrumentation to operable status.

The alternate means of monitoring may be temporarily installed if the normal PAM-channel cannot be restored to operable status within the allotted time.

The report provided to the NRC should also describe the degree to which the alternate means are equivalent to the installed PAM channels and justify the areas in which they are not equivalent.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.G.1 As indicated in Surveillance Requirement 4.2.G.1, post-accident monitoring instrumentation shall be checked and calibrated as indicated in Table 4.2.6.

Table 4.2.6 identifies, for each Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.G.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance is acceptable since it does not significantly reduce the probability of properly monitoring post-accident parameters, when necessary.

Amendment No.

236 79e

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION SURVEILLANCE REQUIREMENTS (continued)

Table 4.2.6, Check Performance of an Instrument Check once each day ensures that a gross failure of instrumentation has not occurred.

An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be

,n indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The InstrumentCheck supplements less formal, but more

frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.6, Calibration An Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

The specified Instrument Calibration Frequencies are based on operating experience.

REFERENCES

1.

Regulatory Guide 1.97, "Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," Revision 3, May 1983.

2.

NRC letter, M.B. Fairtile (NRC) to L.A.

Tremblay (VYNPC),

"Conformance to Regulatory Guide 1.97 for Vermont Yankee Nuclear Power Station," December 4,

1990.

Amendment No.

236 79f

VYNPS BASES: 3.2.1/4.2.I RECIRCULATION PUMP TRIP INSTRUMENTATION BACKGROUND The Anticipated Transient Without Scram (ATWS)

Prevention/Mitigation System initiates a Recirculation Pump Trip (RPT),

adding negative reactivity, following events in which a scram does not but should occur, to lessen the effects of an ATWS event.

Tripping the recirculation pumps adds negative reactivity from the increase in steam voiding in the core area as core flow decreases.

When Low -

Low Reactor Vessel Water Level or High Reactor Pressure setpoint is reached, the reactor recirculation motor generator (RRMG) field breakers trip.

The RPT Instrumentation (Ref.

1) of the ATWS Prevention/Mitigation. System includes sensors,.relays, and switches that are necessary to cause initiation of an RPTL The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPT signal to the trip logic.

The RPT Instrumentation consists of two independent and identical trip systems (A and B),

with two channels of High Reactor Pressure and two channels of Low -

Low Reactor Vessel Water Level in each trip system.

Each RPT Instrumentation trip system is a two-out-of-two logic for each Trip Function.

Thus, either two Low -

Low Reactor Water Level or two High Reactor Pressure signals will trip a trip system.

In addition, a combination of one Low -

Low Reactor Vessel Water Level signal and one High Reactor Pressure signal (in the same trip system) will trip the trip system.

The outputs of the channels in a.trip system are combined in a logic so that either trip system will trip both recirculation pumps (by tripping the respective RRMG

-field breakers).

Eich Low -

Low Reactor Vessel Water Level channel output must remain below the setpoint for approximately 10 seconds for the channel output to provide an actuation signal to the associated trip system.

There is one RRMG field breaker provided for each of the two recirculation pumps for a total of two breakers.

The output of each trip system is provided to both RRMG field breakers.

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY The RPT Instrumentation is not assumed to mitigate, any accident or transient in the safety analysis.

The'RPT Instrumentation initiates an RPT to aid in preserving the integrity of the fuel cladding following events in which a scram does not, but should, occur.

Based on its contribution to the reduction of overall plant risk, however, the instrumentation meets Criterion 4 of 10 CFR 50.36(c) (2) (ii).

The operability of the RPT Instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions.

Each Trip Function must have the requirednumber of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under.

worst case design basis conditions, the associated trip will occur within the Amendment No.

236 80

VYNPS 3ASES: 3.2.1/4.2.1 RECIRCULATION PUMP TRIP INSTRUMENTATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Trip Settings specified in Table 3.2.7.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Channel operability also includes the associated recirculation pump trip breakers (i.e.,

RRMG field breakers).

The individual Trip Functions are required to be operable in the RUN Mode to protect against common mode failures of the Reactor Protection System by providing a diverse trip to mitigate the consequences of a postulated ATWS event.

The High Reactor Pressure and Low -

Low Reactor Vessel Water Level Trip Functions are required to be operable in the RUN Mode, since the reactor is producing significant power and the recirculation system could be at high flow.

During this Mode, the potential exists for pressure increases or low water level, assuming an ATWS event.

In the STARTUP/HOT STANDBY Mode, the reactor is at low power and the recirculation system is at low flow; thus, the potential is low for a pressure increase or low water level, assuming an ATWS event.

Therefore, the RPT Instrumentation is not necessary.

In HOT SHUTDOWN and COLD SHUTDOWN, the reactor is shut down with all control rods inserted; thus, an ATWS event is not significant and the possibility of a significant pressure increase or low water level is negligible.

In Refuel, the one rod out interlock ensures that the reactor remains subcritical; thus, an ATWS event is not significant.

The specific Applicable Safety Analyses and LCO discussions are listed below on a Trip Function by Trip Function basis.

1, 2.

Low Low Reactor Vessel Water Level and Time Delay Low RPV water level indicates the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, RPT is initiated at low-low RPV water level to aid in maintaining level above the top of the active fuel.

The reduction of core flow reduces the neutron flux and thermal power and, therefore, the rate of coolant boiloff.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

\\Four-channels of Low -

Low Reactor Vessel Water Level, with two channels in each trip system, are available and required to be operable to ensure that no single instrument failure can preclude an RPT from this Trip Function on a valid signal.

In addition, a time delay is associated with each Low -

Low Reactor Vessel Water Level channel which dela~ys the Low -

Low Reactor Vessel Water Level TripFunction channel output signal from providing input to the associated trip system.

Four channels of Time Delay, with two channels in each trip system, are available and required to be operable to ensure that no single instrument failure can preclude an RPT from the Low -

Low Reactor Vessel Water Level Trip Function on a valid signal.

Amendment No.

236 80a

VYNPS BASES: 3.2.1/4.2.1 RECIRCULATION PUMP TRIP INSTRUMENTATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

The Low -

Low Reactor Vessel Water Level Trip Setting is chosen so that RPT will not interfere with the Reactor Protection System.

The Trip Setting is referenced from the top of enriched fuel.

The Trip Setting of the Time Delay associated with the Low -

Low Reactor Vessel Water Level Trip Function is chosen to avoid making the consequences of a loss of coolant accident more severe while ensuring the delay has an insignificant affect on the ATWS consequences.

3.

High Reactor Pressure Excessively high RPV pressure may rupture the RCPB.

An increase in the RPV pressure during reactor operation compresses the steam voids and results in a

positive reactivity insertion. This increases neutron flux and thermal power, which could potentially result in fuel failure and overpressurization.

The High Reactor Pressure Trip Function initiates an RPT for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation.

For the overpressurization event, the RPT aids in the termination of the ATWS event and, along with the safety valves, limits the peak RPV pressure to within the required limit.

The High Reactor Pressure signals are initiated from four pressure transmitters that monitor reactor pressure.

Four channels of High Reactor Vessel Pressure, with two channels in each trip system, are available and are required to be operable to ensure that no single instrument failure can preclude an RPT from this Trip Function on a valid signal.

The High Reactor Vessel Pressure Trip Setting is chosen to provide an adequate margin to the maximum allowable Reactor Coolant System pressure.

ACTIONS Table 3.2.7 ACTION Note 1 For Trip Functions 1, 2, and 3, with one or more Trip Function channels inoperable, but with RPT trip capability for each Trip Function maintained (refer to next paragraph),

the RPT instrumentation is capable of performing the intended function.

However, the reliability and redundancy of the RPT Instrumentation is reduced, such that a single failure in the remaining trip system could result in the inability of the RPT Instrumentation to perform the intended function.

Therefore, only a limited time is allowed to restore the inoperable channels to operable status. Because of the diversity of sensors available to provide trip signals,, the low probability of extensive numbers of inoperabilities affecting all diverse Trip Functions, and the low probability of an event requiring the initiation of RPT, 14 days is provided to restore the inoperable channel, (Table 3.2.7 ACTION Note l.a.l)).

Alternately, for Trip Functions 1 and 3, the inoperable channel may be placed in trip (Table 3.2.7 ACTION Note l.a.2)),

since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Inoperable channels may be placed in trip using test jacks or other permanently installed circuits.

As noted in Table 3.2.7 ACTION Note l.a.2),

placing the channel in trip with no Amendment No.

236 80b

VYNPS BASES: 3.2.1/4.2.1 RECIRCULATION PUMP TRIP INSTRUMENTATION ACTIONS (continued) further restrictions is not allowed if the inoperable channel is a Trip Function 2 channel (i.e.,

Time Delay Trip Function) or is the result of an inoperable breaker, since this may not adequately compensate for the inoperable Trip Function 2 channel or inoperable breaker (e.g., the breaker may be inoperable such that it will not open),

as applicable.

If it is not desired to place the channel in trip (e.g., as 'in the case where placing the inoperable channel in trip would result in an RPT),

or if the inoperable channel is the result of an inoperable breaker, Table 3.2.7 ACTION Note 2 must be entered and its required Actions taken.

Table 3.2.7 ACTION Note l.b is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in the Trip Function 1 and 2 not maintaining RPT trip capability or Trip Function 3 not maintaining RPT trip capability.

A Trip Function is considered to be main.taining RPT trip capability when sufficient channels are operable or in trip such that the RPT Instrumentation will generate a trip signal from the given Trip Function in either of the two trip systems.,on a valid signal, and both recirculation pumps can be tripped.

For Trip Functions 1 and 2, this requires two channels of each Trip Function in the same trip system to be operable or in trip and the RRMG field breakers to be operable or in trip.

For Trip Function 3, this requires two channels in the same trip system to be operable or in trip and the RRMG field breakers to be operable or in trip.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the RPT instrumentation during this period and that Trip Functions 1 and 2 or Trip Function 3 still maintain RPT trip capability.

Table 3.2.7 ACTION Note l.c is intended to ensure that appropriate Actions are taken if multiple, inoperable, untripped channels within Trip Functions 1, 2, and 3 result in Trip Functions 1, 2, and 3 not maintaining RPT trip capability.

The description of a Trip Function maintaining RPT trip capability is discussed in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time for restoring all but one of the Trip Functions is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the RPT Instrumentation during this period.

Table 3.2.7 ACTION Note 2 With any required Action and associated completion time not met, the plant must be brought to a Mode or other specified condition in which the LCO does not apply.

To achieve this status, the plant must be brought to at least STARTUP/HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Table 3.2.7 ACTION Note 2.b).

Alternately, the associated recirculation pump may be removed from service since this performs the intended function of the instrumentation (Table 3.2.7 ACTION Note 2.a).

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, both to reach STARTUP/HOT STANDBY from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems.

Amendment No.

236 80c

VYNPS 3ASES: 3.2.1/4.I2.

RECIRCULATION PUMP TRIP INSTRUMENTATION SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.1.1 As indicated in Surveillance Requirement 4.2.1.1, RPT Instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.7.

Table 4.2.7 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.1.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains recirculation pump trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability analysis (Ref.

2) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that recirculation pumps will trip when necessary.

Surveillance Requirement 4.2.1.2 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel.

A system functional test of the recirculation pump trip breakers (i.e.,

RRMG field breakers) is included in this Surveillance to provide complete testing of the assumed safety function.

Therefore, if an RRMG field breaker is incapable of operating, the associated instrument channel(s) would be inoperable.

The Frequency of "Once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.7, Check Performance of an Instrument Check once per day, for Trip Functions 1 and 3, ensures that a gross failure of instrumentation has not occurred.

An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel Amendment No.

236 80d

VYNPS BASES: 3.2.1/4.2.1 RECIRCULATION PUMP TRIP INSTRUMENTATION SURVEILLANCE REQUIREMENTS (continued) is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.7, Functional Test For Trip Functions 1 and 3, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

For Trip Functions 1 and 3, the Frequency of "Every 3 Months" is based on the reliability analysis of Reference 2.

Table 4.2.7, Calibration For Trip Functions 1, 2, and 3, an Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

For Trip Functions 1, 2, and 3, a calibration of the trip units is required (Footnote (a))

once every 3 months.

Calibration of the trip units provides a check of the actual setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures.

The Frequency of every 3 months is based on the reliability analysis of Reference 2 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. UFSAR, Section 7.18.

2.

GENE-770-06-1-A, "Bases for Changes To Surveillance Test Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications," December 1992.

Amendment No.

236 H0e

VYN PS BASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION 3ACKGROUND Successful operation of the required safety-functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components su'h as pump motors, motor operated valves, and the associated control components.

The Degraded Grid Protective System instrumentation monitors the 4.16 kV emergency buses.

Offsite power is the preferred source of power for the 4.16 kV emergency buses.

If the monitors determine that insufficient voltage is available and an ECCS initiation signal is present, the buses are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each 4.16 kV emergency bus has its own independent Degraded Grid Protective System instrumentation and associated trip logic.

The voltage for each bus is monitored for degraded voltage.

The Degraded Bus Voltage - Voltage Trip Function is monitored by two undervoltage relays for each 4.16 kV emergency bus, whose outputs are arranged in a two-out-of-two logic configuration (Ref.

1).

The Degraded Bus Voltage - Voltage Alarm Trip Function is monitored by the same undervoltage relays as the Voltage Trip Function, however the outputs are arranged in a

one-out-of-two logic configuration.

.For the Degraded Bus Voltage -

Time Delay Trip Function, one channel for each 4.16 kV emergency bus is provided and is dedicated to the DG start function.

For the Degraded Bus Voltage -

Alarm Time Delay Trip Function, one channel for each 4.16 kV emergency bus iS

ýalso provided and is dedicated to a control room annunciator function from which manual action is taken for degraded grid protection when an accident signal is not present.

The Degraded Bus Voltage -

Time Delay and Alarm Time Delay Trip Functions are nominally adjusted to 10 seconds since this would be indicative of a sustained degraded voltage condition.

When a Degraded Bus Voltage - Volta'ge Alarm Trip Function setpoint has been exceeded and persists for nominally ten seconds, either one of the two Degraded Bus Voltage -

Voltage Alarm Trip Function channels on an associated 4.16 kV emergency bus will actuate a control room annunciator to alert the operator of the degraded voltage condition.

If this sustained degraded voltage condition occurs coincident with a loss of coolant accident (LOCA),

both of the Degraded Bus Voltage - Voltage Trip Function channels will actuate causing the associated 4.16 kV emergency bus to be disconnected from the offsite power source and connected to the DG power source.

If the sustained degraded voltage condition does not exist at the time of a LOCA, the 4.16 kV emergency buses are not disconnected from the offsite power sources and the ECCS loads will start immediately from their normal supplies.

APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY The degraded grid protection assures the ECCS loads and other assumed systems powered from the DGs are powered from the offsite power system as long as offsite power system voltage is within an acceptable value and it assures that loads are powered from the DGs when bus voltage is insufficient for continuous operation of the connected loads.

The Degraded Grid Protective System instrumentation is required for Engineered Safety Features to function

.n any accident witiv a degradation or loss of offsite power.

The required Amendment No.

236 30f

VYNPS BASES: 3.2.KI4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) channels of Degraded Grid Protective System instrumentation ensure that the ECCS and other assumed systems powered from the DGs, provide plant protection in the event of any of the Reference 2 and 3 analyzed accidents in which a loss of offsite power is assumed.

The initiation of the DGs on degradation or loss of offsite power, and subsequent initiation of the ECCS, ensures that the requirements of 10 CFR 50.46 are met.

Accident analyses credit the loading of the DGs based on the loss of offsite power coincident with a loss of coolant accident (LOCA).

The diesel starting and loading times have been included in the delay time ass'ociated with each safety system component requiring DG supplied power following a Loss of offsite power.

The Degraded Grid Protective System instrumentation satisfies Criterion 3 of I'

CFR 50.36(c) (2)

(ii).

The operability of the Degraded Grid Protective System instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions.

Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.8.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

The specific Applicable Safety Analyses,

LCO, and Applicability discussions are listed below for the Degraded Grid Protective System instrumentation Trip Functions.

l.a, l.b, l.c, l.d.

Degraded Bus Voltage - Voltage Trip, Degraded Bus Voltage -

Time Delay Trip, Degraded Bus Voltage - Voltage Alarm and Degraded Bus Voltage -

Alarm Time Delay A reduced voltage condition on a 4.16 kV emergency bus indicates that, while offsite power may not be completely lost to the respective emergency bus, available power may be insufficient for starting large ECCS motors without risking damage to the motors that could disable the EGGS function.

Therefore, power supply to the bus is automatically transferred from offsite power to onsite DG power when the voltage on the bus drops below the Degraded Bus Voltage - Voltage Trip Function trip setpoint, is sustained in a degraded condition for approximately 10 seconds and a LOCA condition exists (as indicated by ECCS Low -

Low Reactor Vessel Water Level or High Drywell Pressure Trip Function signals).

This ensures that adequate power will be available to the required equipment.

In addition, when the voltage on the bus drops below the Degraded Bus Voltage

- Voltage Alarm Trip Function trip setpoint, and is sustained in a degraded condition for approximately 10 seconds, a control room annunciator is actuated.

This annunciator alerts the operator of the degraded voltage Amendment No.

236 80g

VYNPS RASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) condition so that manual action can be taken for degraded grid protection when an accident signal is not present.

The Degraded Bus Voltage and Voltage Alarm Trip Settings are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment.

The Time Delay Trip Settings are long enough to provide time for voltage on the station emergency bus to recover from transients such as motor starts or fault clearing, but short enough to ensure that the operating equipment is not damaged by low voltage.

Two channels of Degraded Bus Voltage - Voltage Trip Function and one channel of Degraded Bus Voltage -

Time Delay Trip Function per associated bus are required to be operable when the associated DG is required to be operable to ensure that no single instrument failure can preclude the DG function.

In addition, two channels of Degraded Bus Voltage - Voltage Alarm Trip Function and one channel of Degraded Bus Voltage -

Alarm Time Delay Trip Function per asociated bus are required to be operable when the associated DG is required to be operable to ensure that no single instrument falure can preclude the alarm function.

ACTIONS Table 3.2.8 ACTION Note 1 With one or more required channels of the Degraded Bus Voltage - Voltage Trip Function inoperable, the Trip Function is not capable of performing the intended function.

Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to operable status.

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.8 ACTION Note l.a.

The inoperable channel may be tripped using test jacks or other permanently installed circuits.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the Degraded Grid Protective System instrumentation),

and allow operation to continue.

The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

If placing an inoperable channel in the tripped condition would result in an initiation, then Action Note l.a cannot be met.

If the Action and associated completion time of Table 3.2.8 ACTION Note l.a are not met, the associated Trip Function is not capable of performing the intended function.

Therefore, the associated DG(s) is declared inoperable immediately.

This requires entry into the applicable LCO and required Actions of the DG Technical Specifications, which provide appropriate actions for the inoperable DG(s).

Amendment No.

236 80h

VYNPS BASES: 3.2.K/4.2.K DEGRADED GRID -PROTECTIVE SYSTEM INSTRUMENTATION ACTIONS (continued)

Table 3.2.8 ACTION Note 2 With one or more required channels of the Degraded Bus Voltage -

Time Delay Trip Function inoperable, the Trip Function is not capable of performing the intended function.

Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to operable status (Table 3.2.8 ACTION Note 2.a).

Table 3.2.8 ACTION Note 2.a. does not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

The completion time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time is acceptable because it minimizes risk while allowing time for restoration of channels.

If the Action and associated completion time of Table 3.2.8 ACTION Note 2.a are not met, the associated Trip Function is not capable of performing the intended function.

Therefore, the associated DG(s) is declared inoperable immediately.

This requires entry into applicable LCO and required Actions of the DG Technical Specifications, which provide appropriate actions for the inoperable DG(s).

Table 3.2.8 ACTION Note 3 With one of the required channels, for one or more buses, of' the Degraded Bus Voltage -

Voltage Alarm Trip Function inoperable, the'Trip Function is not capable of performing the intended function assuming a single failure.

Since this Trip Function is not common to RPS, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed to restore the inoperable channel to operable status (Table 3.2.8 ACTION Note 3.b).

With both of the required channels, for one or more buses, of the Degraded Bus Voltage - Voltage Alarm Trip Function inoperable, or with the one required channel, for one or more buses, of the Degraded Bus Voltage -

Alarm Time Delay Trip Function inoperable, the Trip Function is not capable of performing the intended function.

Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore at least one channel of the Degraded Bus Voltage - Voltage Alarm Trip Function and the one channel of the Degraded Bus Voltage -

Alarm Time Delay Trip Function to operable status (Table 3.2.8 ACTION Note 3.a).

Table 3.2.8 ACTION Notes 3.a and 3.b do not allow placing an inoperable channel in trip since this action would not necessarily result in a safe state for the channel in all events.

The completion times are intended to allow the operator time to evaluate and repair any discovered inoperabilities.

The completion times are acceptable because they minimize risk while allowing time for restoration of channels.

If the Action and associated completion times of Table 3.2.8 ACTION Notes 3.a or 3.b are not met, the associated Trip Function may not be capable of performing the intended function.

Therefore increased voltage monitoring of the associated 4.16 kV emergency bus(es) is initiated.

This action will compensate for the inoperable control room annunciator function to ensure manual action is taken for degraded grid protection when an accident signal is not present.

Amendment No.

236 80i

VYNPS EASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.K As indicated in Surveillance Requirement 4.2.K, Degraded Grid Protective System instrumentation shall be functionally tested and calibrated as indicated in Table 4.2.8.

Table 4.2.8 identifies, for each Trip Function, the applicable Surveillance Requirements.

Table 4.2.8, Functional Test For Trip.Functions l.a and l.b, as indicated in Table 4.2.8 Footnote (a),

separate Functional Tests are not required since Trip Function operability is demonstrated during the Trip Function Calibration and integrated ECCS test performed once per Operating Cycle.

For the Trip Function Calibration, the "once per Operating Cycle" Frequency is based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

For the integrated ECCS test, the "once per Operating Cycle" Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the integrated ECCS test when performed at the specified Frequency.

Table 4.2.8, Calibration For Trip Functions l.a and l.b, an Instrument Calibration is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

REFERENCES

1.

UFSAR, Section 8.5.3.

2.

UFSAR, Section 6.5.

3.

UFSAR, Chapter 14.

Amendment No.

236 30j

V YNPS OASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM INSTRUMENTATION BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is insufficient or unavailable, such that RCIC System initiation occurs and maintains sufficient reactor water level such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur.

A more complete discussion of the RCIC System is provided in

UFSAR, Section 4.7 (Ref.

1).

RCIC System automatic initiation occurs for conditions of Low -

Low Reactor Vessel Water Level.

'The variable is monitored by four transmitters that are connected to four trip units.

The Low -

Low Reactor Vessel Water Level Trip Function is a single trip system with two trip system logics.

-The outputs of the trip units are connected to relays whose contacts are arranged in a

one-out-of-two taken twice logic arrangement.

The RCIC test line isolation valve is closed on a RCIC initiation signal to allow full system flow.

The RCIC System also monitors the water level in the condensate storage tank (CST) since this is the initial source of wa.ter for RCIC operation.

Reactor grade water in the CST is the normal source.

Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open.

If the water level in the CST falls below a preselected level, the RCIC suppression pool suction valves automatically open.

When the suppression pool suction valves are both fully open, the RCIC CST suction valve automatically closes.

Two level transmitters are used to detect low water level in the CST. Either transmitter can cause the'suppression pool suction valves to open and the CST suction valve to close (one trip system arranged in a one-out-of-two logic).

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level trip (one trip system arranged in a

two-out-of-two logic), at which time the RCIC steam admission valve closes.

TheýRCIC System automatically restarts if a Low -

Low Reactor Vessel Water Level signal is subsequently received APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY The function of the RCIC System to provide makeup coolant to the reactor is used to respond to transient events.

The RCIC System is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation.

Based on its contribution to the reduction of overall plant risk, however, the system, and therefore its instrumentation, meets Criterion 4 of 10 CFR 50.36(c) (2) (ii).

'The operability of the RCIC System Instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions.

Each Trip Function must have the required number of operable channels with their trip setpoints within the calculational as-found tolerances specified in plant procedures.

Operation with the actual trip setpoints within the calculational as-found tolerances provides reasonable assurance that, under Amendment No.

236 80k

VYNPS SASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.9.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures.

The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

The individual Trip Functions are required to be operable in the RUN Mode and in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel with reactor steam pressure

> 150 psig since this is when RCIC is required to be operable.

The specific Applicable Safety Analyses and LCO discussions are listed below on a Trip Function by Trip Function basis.

1. Low -

Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to. cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, the RCIC System is initiated on a Low -

Low Reactor Vessel Water Level signal to assist in maintaining water level above the top of the enriched fuel.

Low -

Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Low -

Low Reactor Vessel Water Level Trip Setting is chosen to be the same as the ECCS Low -

Low Reactor Vessel Water Level Trip Setting (Specification 3.2.A).

The Trip Setting is referenced from the top of enriched fuel.

Four channels of Low -

Low Reactor Vessel Water Level Trip Function are available and are required to be operable when RCIC is required to be operable to ensure that no single instrument failure can preclude RCIC initiation.

2.

Low Condensate Storage Tank Water Level Low water level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source.

Normally, the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST.

However, if the water level in the CST falls below a preselected level, the RCIC suppression pool suction valves automatically open.

When the suppression pool suction valves are both fully open, the RCIC CST suction valve' automatically closes.

This ensures that an adequate supply of makeup water is available to the RCIC pump.

Amendment No.

236

,ý.',

0 1

VY N PS OASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES, LCO; and APPLICABILITY (continued),

Two level transmitters are used to detect low water level in the CST.

The Low Condensate Storage Tank Water Level Trip Function Trip Setting is set high enough to ensure adequate pump suction head while water is being taken from the CST.

The trip setting is presented in terms of percent instrument span.

Two channels of Low Condensate Storage Tank Water Level Trip Function are available and are required to be operable when RCIC is required to be operable to ensure that no single instrument failure can preclude RCIC swap to the suppression pool source.

3.

High Reactor Vessel Water Level High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel.

Therefore, the high water level signal is used to close the RCIC 'steam admission valve to prevent overflow into the main steam lines (MSLs).

High Reactor Vessel Water Level signals for RCIC are initiated from two level transmitters, which sense th*e difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The High Reactor Vessel Water Level Trip Setting is high enough to preclude closing the RCIC steam admission valve during normal operation, yet low enough to trip the RCIC System to prevent reactor vessel overfill.

The Trip Setting is referenced from the top of enriched fuel.

Two channels of High Reactor Vessel Water Level Trip Function are available and are required to be operable when RCIC is required to be operable.

ACTIONS Table 3.2.9 ACTION Note 1 Table 3.2.9 ACTION Note l.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels of Trip Function 1 result in a complete loss of automatic initiation capability for the RCIC System.

In this case, automatic initiation capability is lost if two Trip Function 1 channels in the same trip system logic are inoperable and untripped.

In this situation-(loss of automatic initiation capability),

the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.9 ACTION Note l.b is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability.

The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.9 ACTION Note l.a, the completion time only begins upon discovery that the RCICSystem cannot be automatically initiated due to two inoperable, untripped Low -

Amendment No.

236 80m

VYNPS BASES: 3.2.L/41.2.L PEACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM INSTRUMENTATION ACTIONS (continued)

Low Reactor Vessel Water Level channels in the same trip system logic.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.

2) to permit restor.ation of any inoperable channel to operable status.

If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.9 ACTION Note l.b.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

With any required Action and associated completion time of Table 3.2.9 ACTION Note l.a or l.b not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

Table 3.2.9 ACTION Note 2 Table 3.2.9 ACTION 2.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels of Trip Function 2 'result in automatic RCIC initiation (i.e.,

suction swap) capability being lost.

In this case, automatic RCIC suction swap capability is lost if two Trip Function 2 channels are inoperable and untripped.

In this situation (loss of automatic suction swap),

the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.9 ACTION Note 2.b is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiation capability when the RCIC System suction is aligned to the CST.

Table 3.2.9 ACTION Note 2.a is only applicable if the RCIC System suction is not aligned to the suppression pool

since, if aligned, the Trip Function is already performed.

The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

For Table 3.2.9 ACTION Note 2.a, the completion time only begins upon discovery that the RCIC System cannot -be automatically aligned to the suppression pool due to two inoperable, untripped channels in Trip Function 2.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient

analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.

2) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to operable Amendment No.

236 880n

VYNPS BASES: 3.2.L/4.2.L REACTCR CORE ISOLATION COOLING (RCIC)

SYSTEM INSTRUMENTATION ACTIONS (continued) status Within the allo'wable out of service time, the channel must be placed in the tripped condition per Table 3.2.9 ACTION Note 2.b, which performs the intended function of the channel (shifting the suction source to the suppression pool).

Alternatively, Table 3.2.9 ACTION Note 2.b allows the manual alignment of the RCIC System suction to the suppression pool, which also performs the intended function.

If either action of Table 3.2.9 ACTION Note 2.b is performed, measures should be taken to ensure that the RCIC System piping remains filled with water.

With any required Action and associated completion time of Table 3.2.9 ACTION Note 2.a or 2.b not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

Table 3.2.9 ACTION Note 3 A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref.

2) is acceptable to permit restoration of any inoperable Trip Function 3 channel to operable status (Table 3.2.9 ACTION Note 3.a).

A required Action (similar to Table 3.2.9 ACTION Note l.a) limit.ing the allowable out of service time, if a loss of automatic RCIC initiation capability (i.e.,

loss of high water level trip capability) exists, is not required.

Table 3ý.2.9 ACTION Note 3 applies to the High Reactor Vessel Water Level Trip Function whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability.

As stated above,: this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable.

One inoperable channel may result in a loss of high water level trip capability but will not prevent RCIC System automatic start capability.

However, the Required Action does not allow placing a channel in trip since this action would not necessarily result in a safe state for the channel in all events (a failure of the remaining channel-could prevent a RCIC System start).

With any required Action and associated completion time of Table 3.2.9 ACTION

'Note 3.a not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately..

SURVEILLANCE REQUIREMENTS Surveillance Renuirement 4.2.L.1 As indicated in Surveillance Requirement 4.2.L.1, RCIC System instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.9.

Table 4.2.9 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillahce Requirement 4.2.L.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed Amendment No.

236 800

VYNPS 3ASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS (continued) as follows:

(a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Function 3; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Functions 1 and 2, provided the associated Trip Function maintains RCIC initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability analysis (Ref.

2) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC System will initiate when necessary.

Surveillance Requirement 4.2.L.2 The Logic System Functional Test demonstrates the operability of the required initiation logic for a specific channel.

The system functional testing performed in Surveillance Requirement 4.5.G.1 overlaps this Surveillance to provide complete testing of the safety function.

The Frequency of "once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.9, Check Performance of an Instrument Check once per day, for Trip Function 1, ensures that a gross failure of instrumentation has not occurred.