CP-200900492, License Amendment Request (LAR) 09-005, Revision to Technical Specification 3.3.1, Reactor Trip System (RTS) Instrumentation

License Amendment Request (LAR)09-005, Revision to Technical Specification 3.3.1, Reactor Trip System (RTS) Instrumentation

ML091030383
Person / Time
Site:	Comanche Peak
Issue date:	04/02/2009
From:	Flores R, Lucas M Luminant Generation Co, Luminant Power
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CP-200900492, LAR 09-005, TXX-09055
Download: ML091030383 (33)

Text

Rafael Flores Luminant Power Senior Vice President P.O. Box 1002

&Chief Nuclear Officer 6322 North FM 56 Lutrafael.fiores@ruminat.com Glen Rose, TX 76043 Luminant T 254 897 5590 C 817 559 0403 F 254 897 6652 CP-200900492 Ref: 10 CFR 55.90 TXX-09055 April 2, 2009 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

COMANCHE PEAK STEAM ELECTRIC STATION (CPSES) DOCKET NOS. 50-445 AND 50-446, LICENSE AMENDMENT REQUEST (LAR)09-005, REVISION TO TECHNICAL SPECIFICATION 3.3.1, "Reactor Trip System (RTS) Instrumentation"

REFERENCE:

Westinghouse Nuclear Safety Advisory Letter (NSAL) 09-1, "Rod Withdrawal at Power Analysis for Reactor Coolant System Overpressure," February 9, 2009

Dear Sir or Madam:

Pursuant to 10CFR50.90, Luminant Generation Company LLC (Luminant Power) hereby requests an amendment to the Comanche Peak Steam Electric Station (CPSES), herein referred to as Comanche Peak Nuclear Power Plant (CPNPP), Unit 1 Operating License (NPF-87) and Unit 2 Operating License (NPF-89) by incorporating the attached change into the Comanche Peak Steam Electric Station Units 1 and 2 Technical Specifications (TS). This change request applies to both Units The proposed change will revise TS 3.3.1 entitled "Reactor Trip System (RTS) Instrumentation" to add Surveillance Requirement (SR) 3.3.1.16 to Function 3 of TS Table 3.3.1-1. SR 3.3.1.16 requires that RTS RESPONSE TIMES be verified to be within limits every 18 months on a STAGGERED TEST BASIS.

Function 3 is the power range neutron flux - high positive rate reactor trip function (hereafter referred to as the positive flux rate trip (PFRT) function). This change is being proposed based on a reanalysis of the Rod Cluster Control Assembly Bank Withdrawal at Power event.

Attachment 1 provides a detailed description of the proposed changes, a technical analysis of the proposed changes, Luminant Power's determination that the proposed changes do not involve a significant hazard consideration, a regulatory analysis of the proposed changes and an environmental evaluation. Attachment 2 provides the affected TS pages marked-up to reflect the proposed changes.

Attachment 3 provides the changes to the TS Bases for information only. These changes have already been implemented per CPNPP site procedures. Attachment 4 provides retyped TS pages which incorporate the requested changes.

Luminant Power requests approval of the proposed License Amendment by March 31, 2010, to be implemented within 120 days of the issuance of the license amendment. The approval date was administratively selected to allow for NRC review but the plant does not require this amendment to allow continued safe full power operations.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway - Comanche Peak - Diablo Canyon Palo Verde

• San Onofre . South Texas Project - Wolf Creek OjgL

U. S. Nuclear Regulatory Commission TXX-09055 Page 2 In accordance with 10CFR50.91(b), Luminant Power is providing the State of Texas with a copy of this proposed amendment.

This communication contains no new or revised commitments.

Should you have any questions, please contact Mr. Robert A. Slough at (254) 897-5727.

.1 state under penalty of perjury that the foregoing is true and correct.

Executed on April 2, 2009.

Sincerely, Luminant Generation Company, LLC Rafael Flores By: ___

M. L. Lucas Site Vice President RAS Attachments 1. Description and Assessment

2. Proposed Technical Specifications Changes

3. Technical Specifications Bases Changes (for information)

4. Retyped Technical Specification Pages Enclosures 1. Westinghouse Nuclear Safety Advisory Letter (NSAL) 09-1, "Rod Withdrawal at Power Analysis for Reactor Coolant System Overpressure," February 4, 2009.

2. Westinghouse Nuclear Safety Advisory Letter (NSAL) 02-11, "Reactor Protection System Response Time Requirements," July 29, 2002.

c - E. E. Collins, Region IV G. D. Replogle, Region IV B. K. Singal, NRR Resident Inspectors, CPNPP Alice Hamilton Rogers, P.E.

Inspection Unit Manager Texas Department of State Health Services Mail Code 1986 P. 0. Box 149347 Austin, Texas 78714-9347

ATTACHMENT 1 to TXX-09055 DESCRIPTION AND ASSESSMENT to TXX-09055 Page 1 04/02/2009 LICENSEE'S EVALUATION

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/Criteria

6.0 ENVIRONMENTAL CONSIDERATION

7.0 PRECEDENTS

8.0 REFERENCES

to TXX-09055 Page 2 04/02/2009

1.0 DESCRIPTION

By this letter, Luminant Generation Company LLC (Luminant Power) requests an amendment to the Comanche Peak Steam Electric Station (CPSES), herein referred to as Comanche Peak Nuclear Power Plant (CPNPP), Unit 1 Operating License (NPF-87) and Unit 2 Operating License (NPF-89) by incorporating the attached change into the Comanche Peak Steam Electric Station Units 1 and 2 Technical Specifications. Proposed change LAR 09-005 is a request to revise Technical Specifications (TS) 3.3.1, "Reactor Trip System (RTS) Instrumentation" for CPNPP Units 1 and 2 to add Surveillance Requirement (SR) 3.3.1.16 to Function 3 of TS Table 3.3.1-1.

No changes to the CPSES Final Safety Analysis Report are required at this time as a result of this License Amendment Request.

2.0 PROPOSED CHANGE

The proposed change would revise TS 3.3.1 to add Surveillance Requirement (SR) 3.3.1.16 to Function 3 of TS Table 3.3.1-1. SR 3.3.1.16 requires that RTS RESPONSE TIMES be verified to be

,within limits every 18 months on a STAGGERED TEST BASIS. Function 3 is the power range neutron flux - high positive rate reactor trip function (hereafter referred to as the positive flux rate trip (PFRT) function). This change is being proposed based on a reanalysis of the Rod Cluster Control Assembly Bank Withdrawal at Power event.

3.0 BACKGROUND

SR 3.3.1.16 requires that RTS RESPONSE TIMES be verified to be within limits every 18 months on a STAGGERED TEST BASIS, as defined in the TS. As discussed in the SR 3.3.1.16 Bases, the icceptance criteria for the response time tests are included in the Technical Requirements Manual (TRM). These limits are less than or equal to the maximum values assumed in the accident analyses. The SR 3.3.1.16 Bases also states:

"No credit was taken in the safety analyses for those channels with response times listed as N. A. No response time testing requirements apply where N.A. is listed in the TRM."

In July 2002, Westinghouse issued Nuclear Safety Advisory Letter (NSAL) 02-11, "Reactor Protection System Response Time Requirements" (Ref. 8.1) which notified licensees some protection functions (e.g., PFRT Function) may be credited for protection against anticipated transients or postulated accidents, but not explicitly credited for primary protection in the specific safety analysis cases presented in the updated Final Safety Analysis Report (FSAR). Luminant's evaluation of NSAL 02-11 determined that the PFRT was not explicitly credited for primary protection in an analysis of record for CPNPP, and that in those analyses where it was considered, the assumed response time was so much longer than the value expected for a functional channel that an explicit response time measurement was not considered necessary.

Subsequent to the evaluation of NSAL 02-11, for other purposes, Westinghouse reanalyzed the Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal at Power (RWAP) transient using more conservative analytical assumptions. The reanalysis of this event resulted in the PFRT being credited in the CPNPP safety analysis for primary protection.

Attachment I to TXX-09055 Page 3 04/02/2009

4.0 TECHNICAL ANALYSIS

A continuous uncontrolled RCCA Bank Withdrawal at Power transient due to improper operator action or an instrument or control system malfunction will result in an increase in the core heat flux, causing in an increase in the reactor coolant temperature with a corresponding rise in Reactor Coolant System (RCS) pressure and pressurizer level. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in a Departure from Nucleate Boiling (DNB) and/or fuel centerline melting, RCS overpressurization, or pressurizer overfill.

The uncontrolled RCCA Bank Withdrawal at Power transient (FSAR Section 15.4.2) was evaluated to demonstrate that the reactivity and plant control systems are sufficient to prevent:

(1) DNB and consequent fuel damage; (2) RCS overpressurization and consequent pressure boundary failure; and (3) pressurizer overfill and consequent progression of the accident sequence.

This event is classified as a Condition II fault of moderate frequency. As such, RCS pressure must be maintained within 110% of design pressure.

The primary protection function for the RWAP transient is condition dependent and provided by the power range neutron flux - high, pressurizer pressure - high, and overtemperature N-16 (OTN16) reactor trips. For a narrow range of RCS overpressure cases, it was found that the PFRT is additionally required to provide primary protection to prevent the calculated peak RCS pressure from exceeding 110% of design pressure.

0 For this reanalysis, a rate setpoint of 9% RATED THERMAL POWER (RTP) (per second) with a lagging time constant of 2.0 seconds and a 0.65 second trip delay were assumed. These values continue to support the CPNPP Nominal Trip Setpoint of 5% of RTP with a time constant of > 2 seconds, listed in TS Bases Table B 3.3.1-1, as well as the Allowable Value of < 6.3% RTP with a time constant of > 2 seconds, as reflected in TS Table 3.3.1-1.

This reanalysis shows that the acceptance criteria for the uncontrolled RCCA Bank Withdrawal at Power transient can be successfully met, with adequate protection for the primary and secondary system provided the Power Range Neutron Flux Rate - High Positive Rate trip is credited. The peak RCS pressure predicted with this analysis, using the cited values and response times for the PFRT is lower than the acceptable pressure of 110% of 2485 psig.

The Power Range Neutron Flux Rate - High Positive Rate trip Function is a sub-function of the Nuclear Instrumentation System, and is qualified as a primary protection function and accurately described in the TS and FSAR with the exception of the requirement for response time testing.

As a result, TS Table.3.3.1-1 should list SR 3.3.1.16 as a required Surveillance Test for Operability of the Power Range Neutron Flux Rate - High Positive Rate trip Function.

to TXX-09055 Page 4 04/02/2009 Interim Administrative Controls As described in Administrative Letter 98-10, "Dispositioning of Technical Specifications That Are Insufficient to Assure Plant Safety", upon discovery of this condition, Luminant Power implemented the following corrective actions and administrative controls:

The response time for the PFRT function has been verified to be a maximum of 0.53 seconds in accordance with the methodology described in WCAP-14036-P-A, "Elimination of Periodic Protection Channel Response Time Tests", Revision 1, October 6, 1998 (Ref. 8.3).

The Bases for TS 3.3.1, Function 3 will be revised in accordance with 10 CFR 50.59 and TS 5.5.14, "Technical Specification (TS) Bases Control Program" to specify that, in addition to the rod ejection accident, the PFRT also provides primary protection for the uncontrolled RCCA Bank withdrawal at power transient. The pending changes to the TS Bases are provided in Attachment 3 for information.

The CPNPP Technical Requirements Manual (TRM), Table 13.3.1-1, "Reactor Trip System (RTS) Instrumentation Response Time Limits" will be revised to specify a maximum of 0.65 seconds for the PFRT (function 3) response time.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration Luminant Power has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10CFR50.92, "Issuance of amendment," as discussed below:

1. Do the proposed changes involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed change imposes additional surveillance requirements to assure safety related structures, systems, and components are verified to be consistent with the safety analysis and licensing basis. In this specific case, a response time verification requirement will be added to the positive flux rate trip (PFRT) function.

Overall protection system performance will remain within the bounds of the accident analysis since there are no hardware changes. The design of the Reactor Trip System (RTS) instrumentation, specifically the positive flux rate trip (PFRT) function, will be unaffected. The reactor protection system will continue to function in a manner consistent with the plant design basis. All design, material, and construction standards that were applicable prior to the request are maintained.

to TXX-09055 Page 5 04/02/2009 The proposed changes will not modify any system interface. The proposed changes will not affect the probability of any event initiators. There will be no degradation in the performance of or an increase in the number of challenges imposed on safety-related equipment assumed to function during an accident situation. There will be no change to normal plant operating parameters or accident mitigation performance. The proposed changes will not alter any asumptions or change any mitigation actions in the radiological consequences evaluations in the updated Final Safety Analysis Report (FSAR).

The proposed changes do not adversely affect accident initiators or precursors nor alter the design assumptions, conditions, or configuration of the facility or the manner in which the plant is operated and maintained. The proposed changes do not alter or prevent the ability of structures, systems, and components (SSCs) to perform their intended function to mitigate the consequences of an initiating event within the assumed acceptance limits. The proposed changes do not affect the source term, containment isolation, or radiological release assumptions used in evaluating the radiological consequences of an accident previously evaluated. The proposed changes are consistent with safety analysis assumptions and resultant consequences.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Dothe proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed change imposes additional surveillance requirements to assure safety related structures, systems, and components are verified to be consistent with the safety analysis and licensing basis.

There are no hardware changes nor are there any changes in the method by which any safety related plant system performs its safety function. This change will not affect the normal method of plant operation or change any operating parameters. No performance requirements will be affected; however, the proposed change does impose additional surveillance requirements. The additional requirements are consistent with assumptions made in the safety analysis and licensing basis.

No new accident scenarios, transient precursors, failure mechanisms, or limiting single failures are introduced as a result of these changes. There will be no adverse effect or challenges imposed on any safety-related system as a result of these changes.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

to TXX-09055 Page 6 04/02/2009

3. Do the proposed changes involve a significant reduction in a margin of safety?

Response: No The proposed change imposes additional surveillance requirements to assure safety related structures, systems, and components are verified to be consistent with the safety analysis and licensing basis.

The proposed changes do not affect the acceptance criteria for any analyzed event. The margin of safety is affected in that in the new analyses of the Rod (Bank) Withdrawal at Power analyses, it is necessary to credit a previously uncredited reactor trip function in an analysis. However, that reactor trip function is described in the plantTechnical Specifications with well-defined operability requirements. An additional attribute, specifically the channel response time verification on a periodic frequency, provides additional assurance that the trip function performs as credited in the accident analysis. With the credit for this reactor trip function, all relevant event acceptance criteria continue to be met. None of the event acceptance limits are exceeded, and none of the event acceptance limits are revised by the proposed activity. There is no effect on the manner in which safety limits, limiting safety system settings, or limiting conditions for operation are determined nor is there any effect on those plant systems necessary to assure the accomplishment of protection functions. There is no impact on the overpower limit, the minimum departure from nucleate boiling ratio limit, the radial and axial peaking factor limits, the loss of coolant accident (LOCA) peak clad temperature limit, nor any other limit which, in whole or in part, defines a margin of safety. The radiological dose consequence acceptance criteria listed in the Standard Review Plan will continue to be met.

Therefore the proposed change does not involve a reduction in a margin of safety.

Based on the above evaluations, Luminant Power concludes that the proposed amendment(s) present no significant hazards under the standards set forth in 10CFR50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/Criteria The regulatory guidance documents associated with this amendment application include:

GDC-13 requires that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems..

GDC-20 requires that the protection system(s) shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.

to TXX-09055 Page 7 04/02/2009 GDC-21 requires that the protection system(s) shall be designed for high functional reliability and testability.

GDC-22 through GDC-25 and GDC-29 require various design attributes for the protection system(s), including independence, safe failure modes, separation from control systems, requirements for reactivity control malfunctions, and protection against anticipated operational occurrences.

Regulatory Guide 1.22 discusses an acceptable method of satisfying GDC-20 and GDC-21 regarding the periodic testing of protection system actuation functions. These periodic tests should duplicate, as closely as practicable, the performance that is required of the actuation devices in the event of an accident.

10 CFR 50.55a(h) requires that the Comanche Peak Nuclear Power Plant protection systems, including Reactor Trip System Function 3, meet IEEE 279-1971. Sections 4.9 -4.1 1 of IEEE 279-1971. discuss testing provisions for protection systems. Regulatory Guide 1.118, Revision 2, discusses acceptable methods for testing protection systems, including Section 6.3.4 of IEEE 338-1977 for response time testing.

There will be no changes to the Reactor Trip System instrumentation design such that any of the regulatory requirements and guidance documents would come into question.

This amendment application imposes additional surveillance requirements on Reactor Trip System Function 3 consistent with the above requirements. The evaluations performed by Comanche Peak Nuclear Power Plant confirm that Comanche Peak Nuclear Power Plant will continue to comply with all applicable regulatory requirements.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that, the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

Luminant Power has determined that the proposed amendment would change requirements with respect to the installation or use of a facility component located within the restricted area, as defined in 10CFR20, or would change an inspection or surveillance requirement. Luminant Power has evaluated the proposed changes and has determined that the changes do not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amount of effluent that may be released offsite, or (iii) a significant increase in the individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10CFR51.22 (c)(9). Therefore, pursuant to 10CFR51.22 (b), an environmental assessment of the proposed change is not required.

7.0 PRECEDENTS 7.1 A similar change was approved for the Callaway plant in Amendment No. 151 on September 3, 2002. AmerenUE also allocates a response time for this trip function based on WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response.

Time Tests." (ML022520136, ML022620567) to TXX-09055 Page 8 04/02/2009 7.2 A similar change was approved for the Wolf Creek plant in Amendment No. 165 on August 29, 2006. However, Wolf Creek does not allocate a response time for this trip function based on WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" and consequently performs the required response time testing. (ML062420150, ML061110047)

8.0 REFERENCES

8.1 Westinghouse Nuclear Safety Advisory Letter (NSAL) 02-11, "Reactor Protection System Response Time Requirements," July 29, 2009.

8.2 Westinghouse Nuclear Safety Advisory Letter (NSAL) 09-1, "Rod Withdrawal at Power Analysis for Reactor Coolant System Overpressure," February 4, 2009.

8.3 Letter from Mohan C. Thadani (NRC) to Mr C. Lance Terry dated September 25, 2003, "Comanche Peak Steam Electric Station, Units 1 & 2 - Issuance of Amendments Re:

Elimination of Periodic Protection Channel Response Time Testing (TAC Nos. MB7984 and MB7985)." (ML032751010, ML032690082)

ATTACHMENT 2 to TXX-09055 PROPOSED TECHNICAL SPECIFICATION CHANGES (MARK-UP)

Page 3.3-15

RTS Instrumentation 3.3.1 Table 3.3.1-1 (page 1 of 7)

Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

1. Manual 1,2 2 B SR 3.3 114 NA Reactor Trip 3(b), 4(b), 5(b) 2 C SR 3.3.1 14 NA

2. Power Range Neutron Flux

a. High 1,2 4 D SR 331.1 *_109.6% RTp(q)(r)#

SR 3.3.1.2 SR 331.7 SR 3.3. 1.11 SR 3.3.1.16

b. Low 1 (c), 2 4 E SR 3.3 1.1 < 25.6% RTp(q)(r)#

SR 3.3 1 8 SR 3.31,11 SR 331 16

3. Power Range 1,2 4 ESR 3.31.7 _6.3% RTP Neutron Flux Rate SR 3.3.1.11 with time constant High Positive Rate Ž 2 sec SR 3.3.1.16I

4. Intermediate 1(c), 2(d) 2 F,G SR 3.311 31.5% RTP Range Neutron SR 3.3.1.8 Flux SR 3.3,1 11 (continued)

(a) The Allowable Value defines the limiting safety system setting except for Trip Functions 2a, 2b, 6, 7, and 14 (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

(b) With Rod Control System capable of rod withdrawal or one or more rods not fully inserted.

(c) Below the P-10 (Power Range Neutron Flux) interlock.

(d) Above the P-6 (Intermediate Range Neutron Flux) interlock.

(q) If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(r) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the Nominal Trip Setpoint or a value that is more conservative than the Trip Setpoint; otherwise, the channel shall be declared inoperable. The Nominal Trip Setpoint, the methodology used to determine the as-found tolerance and the methodology used to determine the as-left tolerance shall be specified in the Technical Specification Bases.

1. For Unit 1, through Cycle 13, the ALLOWABLE VALUE for the Power Range Neutron Flux - High remains at 110.8%

RTP and the Power Range Neutron Flux - Low remains at 27.7% RTP.

COMANCHE PEAK - UNITS 1 AND 2 3.3-15 Amendment No. 89, 145

ATTACHMENT 3 to TXX-09055 TECHNICAL SPECIFICATIONS BASES CHANGES (For Information Only)

Pages B 3.3-11 B 3.3-55

RTS Instrumentation B 3.3.1 lor an uncontrolled RCCA bank withdrawal during power operation (RWAP)

BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICA ILITY (contin' ed) the accompanying ejecti n of the RCCA. This Functio complements the Powe Range Neutron Flux-High and Low Setpoint trip Functions to ens r that the criteria are met for a rc d ejection from the power range.

The LCO requires all four of the Power Range Neutro Flux-High Positive Rate channels to be OPERABLE.

In MODE 1 or 2, when there is a potential to add a la e amount of positive reactivity from a rod ejection accident (REA), the Power Range Neutron Flux-High Positive Rate trip must be OPERABLE. In MODE 3, 4, 5, or 6, the Power Range Neutron Flux-High Positive Rate trip Function does not have to be OPERABLE because other RTS trip Functions or administrative controls will provide protection against inadvertent positive reactivity additions. Also, since only the shutdown banks may be withdrawn in MODE 3, 4, or 5, the remaining complement of control bank worth ensures a sufficient degree of SDM in the event of an REA. In MODE 6, no rods are withdrawn and the SDM is increased during refueling operations. The reactor vessel head is also removed or the closure bolts are detensioned preventing any pressure buildup. In addition, the NIS power range detectors cannot detect neutron levels present in this mode.

4. Intermediate Range Neutron Flux The Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux-Low Setpoint trip Function. The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.

The LCO requires two channels of Intermediate Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function.

Because this trip Function is important only during startup, there is generally no need to disable channels for testing (generally, performed at power levels greater than the P-1 0 setpoint or less than (continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-11 Revision 57

RTS Instrumentation B 3.3.1 BASES REFERENCES (continued)

4. 10 CFR 50.49.

5. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

6. Technical Requirements Manual.

7. Not Used.

8. WCAP-10271-P-A, Supplement 3, September 1990.

9. "Westinghouse Setpoint Methodology for Protection Systems Comanche Peak Unit 1, Revision 1," WCAP-12123, Revision 2, April, 1989.

10. "Elimination of Periodic Protection Channel Response Time Tests",

WCAP-14036-P-A, Revision 1, October 6, 1998.

11. "Probabilistic Risk Analysis of the RTS and ESFAS Test Times and Completion Times," WCAP-14333-P-A, Revision 1, October 1998.

12. "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times,"

WCAP-1 5376-P-A, Revision 1, March 2003.

13. Westinghouse letter WOG-06-17, "WCAP-1 0271 -P-A Justification for Bypass Time and Completion Time Technical Specification Changes for Reactor Trip on Turbine Trip (ITSWG Action Item #314)," dated January 20, 2006.

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-55 Revision 57

ATTACHMENT 4 to TXX-09055 RETYPED TECHNICAL SPECIFICATION PAGES Page 3.3-15

RTS Instrumentation 3.3.1 Table 3.3.1-1 (page 1 of 7)

Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

1. Manual 1,2 2 B SR 33.114 NA Reactor Trip 3 (b), 4(b), 5 (b) 2 C SR 33.1 14 NA

2. Power Range Neutron Flux

a. High 1,2 4 D SR 3-3.1.1 <_109.6% RTp(q)(r)#

SR 3.3.1.2 SR 33.1 7 SR 3.3.1 11 SR 33.1.16

b. Low 1 (c), 2 4 E SR 3.3.1 1 25.6% RTP(q)(r)#

SR 31311 8 SR 3.3.1.11 SR 3_31 16

3. Power Range 1,2 4 E SR 3.3 1 7 *6.3% RTP Neutron Flux Rate SR 3.3.1 11 with time constant High Positive Rate SR 3.3 1 16 >_2 sec

4. Intermediate 1(c), 2(d) 2 F,G SR 3.31.1

• 31.5% RTP Range Neutron SR 3-3.1.8 Flux SR 3.3 111 (continued)

(a) The Allowable Value defines the limiting safety system setting except for Trip Functions 2a, 2b, 6, 7, and 14 (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

(b) With Rod Control System capable of rod withdrawal or one or more rods not fully inserted.

(c) Below the P-1 0 (Power Range Neutron Flux) interlock.

(d) Above the P-6 (Intermediate Range Neutron Flux) interlock.

(q) If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(r) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the Nominal Trip Setpoint or a value that is more conservative than the Trip Setpoint; otherwise, the channel shall be declared inoperable. The Nominal Trip Setpoint, the methodology used to determine the as-found tolerance and the methodology used to determine the as-left tolerance shall be specified in the Technical Specification Bases.

1. For Unit 1, through Cycle 13, the ALLOWABLE VALUE for the Power Range Neutron Flux - High remains at 110.8%

RTP and the Power Range Neutron Flux - Low remains at 27.7% RTP.

COMANCHE PEAK - UNITS 1 AND 2 3.3-15 Amendment No. 89,445,

ENCLOSURE 1 to TXX-09055 Westinghouse Nuclear Safety Advisory Letter (NSAL) 09-1, "Rod Withdrawal at Power Analysis for Reactor Coolant System Overpressure," February 4, 2009

Nuclear Safety OWestinghouse Advisor Letter This is a notification of a recently identified potential safety issue pertaining to basic components supplied by Westinghouse.

This information is being provided so that you can conduct a review of this issue to determine if any action is required.

P.O. Box 355, Pittsburgh, PA 15230

Subject:

Rod Withdrawal at Power Analysis for Reactor Coolant Number: NSAL-09-1 System Overpressure Basic Component: Rod Withdrawal at Power Safety Analysis Date: 02/04/2009 Affected Plants: Pressurized Water Reactors with a Westinghouse-Designed Protection System See Table 1, page 6 Substantial Safety Hazard or Failure to Comply Pursuant to 10 CFR 21.21(a) Yes [-] No [ N/A LI Transfer of Information Pursuant to 10 CFR 21.21(b) Yes rI Advisory Information Pursuant to 10 CFR 21.21(d)(2) Yes LI

References:

See page 5

SUMMARY

An uncontrolled rod cluster control assembly (RCCA) bank withdrawal during power operation or rod withdrawal at power (RWAP), is a design basis event (DBE) for pressurized water reactors (PWRs). The event is categorized as an American Nuclear Society (ANS) Condition 11event (Reference I).

Accordingly, the reactor coolant system (RCS) pressure must.not exceed 110% of design pressure during the event. This limit on RCS pressure is a Technical Specification (TS) safety limit (SL) and is typically 2735 psig (Reference 2).

Recently, Westinghouse determined that existing RWAP RCS overpressure analyses do not cover the full range of reactor power operations for all Westinghouse-designed PWRs (W-PWRs) and within the A P1000 design certification. Westinghouse has, however, concluded that no subsfantial safety hazard, as defined in 10 CFR Part 21, exists for affected plants because of this issue. Westinghouse has also performed LOFTRAN-based analyses that demonstrate that the calculated RCS pressure is within the SL.

For some plants, this required modification to either the assumed plant trip response or the assumed limit on maximum reactivity insertion rate. Additionally, depending on each affected plant's licensing batsis, the Updated Final Safety Analysis Report (UFSAR) and supporting documentation may require modification in order to address this issue. This issue does not affect Combustion Engineering (CE) designed PWRs.

Utilities with W-PWRs for which Westinghouse does not have safety analysis responsibility should review the information in this advisory letter for applicability and take action as appropriate.

Additional information, if required, may be obtained from Karen Plute, (412) 374-4439.

Originator:(s) Approved:

E. C. Ettinger J. A. Gresham, Manager Regulatory Compliance and Plant Licensing Regulatory Compliance and Plant Licensing Toby Burnett Transient Analysis Electronically approved records are authenticated in the Electronic Document Management System

NSAL-09-1 Page 2 of 6 BACKGROUND The RWAP safety analysis presented in Chapter 14 or 15 of plant UFSARs was originally intended to demonstrate that core protection reactor trips prevent violation of the specified acceptable fuel design limits (i.e., departure from nucleate boiling (DNB) and fuel centerline melt). Accordingly, analytical procedures evolved to include large conservatisms relative to these fuel design limits. The analysis addresses a wide spectrum of reactivity insertion rates and several initial power levels.

Another criterion applicable to ANS Condition 11 events (Reference I), including the RWAP, is that RCS pressure must not exceed 110% of the design value. This limit on RCS pressure is a TS SL and is typically 2735 psig (Reference 2). However, the UFSAR has not traditionally addressed this criterion for the RWAP because the event was considered to be non-limiting with respect to RCS overpressure. The UFSAR analysis assumes operation of the pressure control systems (spray and power-operated relief valves) which are conservative with respect-to DNB, but not with respect to maximum RCS pressure.

As previously described in NSAL-02-I I (Reference 3)', in the 1990s', Westinghouse determined that some RWAP cases may challenge the RCS design pressure limit when analyzed with typical safety analysis conservatisms. To address this issue;, Westinghouse performed generic RWAP analyses to demonstrate that the peak RCS pressure criterion was met for most W-PWRs equipped with a positive flux rate reactor trip (PFRT). Specific RWAP overpressure analyses have subsequently been performed by Westinghouse for some plants, including older plants with protection systems that do not include the PFRT.

The generic RWAP overpressure analyses concluded that credit for the PFRT was sufficient to demonstrate compliance with the RCS overpressure criterion. Of note, the generic analysis applied a conservative PFRT trip point of 9.0% of RTP and a response time of 3.0 seconds (Reference 3). (A much shorter PFRT response time, typically 0.5 second, is justified in the Technical Evaluation section herein.)

For plants without a PFRT, a limit is placed on the maximum reactivity insertion rate during a RWAP to demonstrate compliance with the TS RCS pressure SL. Subsequently, the plant-specific core design must ensure this maximum reactivity insertion rate will not be exceeded as part of the reload evaluation process. This ensures the RWAP RCS overpressure analysis remains valid on a cycle specific basis.

ISSUE DESCRIPTION It has recently been determined that the Westinghouse methodology for the generic and plant-specific RWAP RCS overpressure analyses incorrectly assumed that a minimum initial power level creates the most limiting condition. Previous analyses have assumed an initial power level of 10% of rated thermal power (RTP), minus calorimetric uncertainty. Further investigation has identified cases from higher initial power levels that are more limiting. With the generic analysis key parameters and methodology, some cases exceeded the RCS overpressure limit for initial power levels in the range of 60% to 80% RTP.

Since these are the results of very conservative methodology, Westinghouse has concluded that a substantial safety hazard does not exist for W-PWRs or within the API000 design certification (See Safety Significance below). However, it may be necessary to modify the UFSAR and supporting documentation for some plants.

Retirence 3 (page 5) noted that the PFRT also provides a reactor tripin the event of a low-worth RCCA ejection initiated from a part-power initial condition. That discussion is not impacted by the RWAP RCS ovCrpressurC issuLe identified herein.

NSAL-09-1 Page 3 of 6 TECHNICAL EVALUATION As described in the Safety Significance section below, Westinghouse has concluded that a substantial safety hazard does not exist for W-PWRs or within the API000 design certification with regard to the subject concern.

To demonstrate compliance with the TS RCS pressure SL, plants without the PFRT may need to reduce the current limit on maximum reactivity insertion rate assumed within the RWAP analysis. There is typically substantial conservatism in the plant-specific core.design in this regard and analyses indicate that the TS RCS SL will be met using this approach.

For some plants with a PFRT, analyses have determined that, with the conservative methodology appropriate for this event, the RCS pressure is within the safety limit with no change to the assumed trip point (safety analysis limit) and response time (i.e., 9% of RTP and 3.0 seconds respectively). However, for other plants with the PFRT, these analyses have determined that the RCS pressure is within the safety limit with no change to the assumed trip point (9% of RTP) and a response time consistent with the nuclear overpower trip (typically 0.5 seconds). For still other plants with the PFRT, these analyses have determined that the RCS pressure is within the safety limit with an assumed trip point of 7% of RTP and a response time consistent with the nuclear overpower trip (typically 0.5 seconds). The time constant (typically > 2 seconds) is not affected.

Westinghouse concludes that the PFRT response time is essentially the same as the power range high neutron flux (HNF) reactor trip and can be verified during the response time test for that trip as discussed below.

The PFRT circuitry is part of the nuclear instrumentation system (NIS). The circuit consists of the difference between the power range nuclear flux signal and that sarne signal with a first order lag. That is, Trip signal.= Flux - Flux/( I+zS),

where - is the time constant and S is the Laplacian operator.

The typical setpoint and time constant prescribed in the Technical Specifications are:

Nominal setpoint (difference) < 5% of RTP Time constant (T) > 2 seconds Both the HNF and PFRT trips process the same power range flux signals and have identical bistables.

There is no significant time delay for the PFRT added by the additional signal processing to forml the difference between the tLux signal and the lagged flux signal. Thus, apart from having different setpoints, the PFRT trip signal sent to the protection system has similar time response as the HNF reactor trip function.

The HNF and PFRT trip signals are passed friom the NIS to the protection system via the same components, and processed in the protection system with the same components. Therefore, the PFRT should have a response time similar to the HNF trip, typically < 0.5 second from the time the signal .

reaches the trip setpoint until the control rods are released and free to fall. Some plants already have a

NSAL-09-1 Page 4 of 6 response time surveillance requirement of 0.5 second for PFRT. However, each utility must consider the regulatory impact and surveillance requirements associated with imposing the HNF response time on the PFRT function if it does hot already exist 2 .

POTENTIALLY AFFECTED PLANTS Table I (page 6) lists the plants potentially impacted by this issue and differentiates between those for which Westinghouse: 1) has performed an explicit safety analysis, 2) has performed an evaluation against the generic analysis, or 3) does not perform safety analyses. For the third category of plants, Westinghouse cannot directly assess the affect of the subject issue.

SAFETY SIGNIFICANCE There is significant conservatism inherent in the Westinghouse RWAP RCS overpressure analysis methodology. These conservatisms are present in the generic and plant-specific analyses and include the following:

"Standard analytical conservatisms" include the modeling of a maximum allowable uncertainty for plant initial conditions and protection setpoints. Other standard conservatisms include the use of a minimum Doppler power coefficient, maximum allowable trip delay times for the high pressurizer pressure and HNF reactor trips, and no credit for the moderator temperature coefficient becoming less positive as core conditions approach or exceed the full power values.

In addition, a number of "methodology conservatisms" are applied in the Westinghouse RWAP analyses.

These include modeling unrealistically high reactivity insertion rates, overly conservative trip reactivity modeling, inconsistent control rod worth assumptions for the withdrawal and trip phases of the event, and conservative modeling of the PFRT setpoint and delay time.

Based on the aforementioned methodology conservatisms alone, Westinghouse concludes that no actual RWAP could cause overpressurization of the RCS. Accordingly, the use of more exact analytical methods.vould demonstrate substantial margin to the RCS pressure TS SL in all cases. However, more sophisticated analysis methods are not currently part of the approved methodology.

Based on the above considerations, it is concluded that no substantial safety hazard would exist even if the error were to go uncorrected. This justifies past and continued operation of all W-PWRs.

NRC AWARENESS Westinghouse has not notified the Nuclear Regulatory Commission regarding this issue.

2 Many plants have implemented channel response time test elimination. Consideration should be given to Reference 5.

NSAL-09-1 Page 5 of 6 RECOMMENDED ACTIONS Plants with a PFRT should review the information herein, their procedures, and licensing documentation to verify that the safety analysis trip setpoints and response time discussed in the Technical Evaluation section are justified.

For plants without a PFRT, Westinghouse will incorporate any plant specific changes to the maximum reactivity insertion rate into the reload design process.

Utilities whose plants are not covered by Westinghouse analyses should review the information herein and review and/or modify.their analyses and operational practices as appropriate.

REFERENCES I. "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants,"

American National Standards Institute (ANSI) N 18.2, Section 5, 1973.

2. NUREG-1431, Revision 3.0, "Standard Technical Specifications Westinghouse Plants," June 2004.

3. NSAL I1, Westinghouse Nuclear Safety Advisory Letter, "Reactor Protection System Response Time Requirements," July 29, 2002.

4. WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), "LOFTRAN Code Description;" April 1984.

5. WCAP- 14036-P-A (Proprietaly), "Elimination of Periodic Protection Channel Response Time Tests," October 1998.

NSAL-09-1 Page 6 of 6 Table I - Potentially Impacted Plants Plants For Which Westinghouse Plants For Which Westinghouse Plants For Which Has Performed An Has Performed An Evaluation Westinghouse Does Not Explicit Safety Analysis Against the Generic AnpIvsis Perform Safety Analyses Angra- I Point Beach- 13 AP 1000 Design Certification Almaraz- 1 Kori-3 Shearon Harris 3

Beaver Valley-I Point Beach-2 Callaway Salem-2 Almaraz-2 Kori-4 Sizewell B Beaver Valley-2 Prairie Island- I Comanche Peak- I Seabrook- I Asc6-I McGuire- I Surry- 13 Braidwood-1 Prairie Island-2 Comanche Peak-2 Tihange-1 Asc6-2 McGuire-2 Surry-2 3 Braidwood-2 South Texas- I Diablo Canyon-I Vogtle-1 Beznau- 13 Mihama- I Takahama- I Byron- I South Texas-2 Diablo Canyon-2 3 Vogtle-2 Beznau-2 Mihama-2 Tihange-3 Byron-2 Temelin-I Farley- I Watts Bar- I Catawba-I North Anna-I Ulchin-1 Cook-I Temelin-2 Farley-2 Watts Bar-2 Catawba-2 North Anna-2 Ulchin-2 3

Cook-2 Turkey Point-3 Kr~ko Doel- I Ohi-I Vandell6s 2 3

Ginna 3 Turkey Point-4 Maanshan-1 Doel-2 Ohi-2 Wolf Creek 3

Indian Point-2 V. C. Summer Maanshan-2 Doel-4 Ringhals-4 Yonggwang- I 3

3 Indian Point-3 Ringhals-2 Koeberg Robinson-2 Yonggwang-2 Kewaunee Ringhals-3 Kori-1 Sequoyah-1 Millstone-3 Salem-I Kori-2 Sequoyah-2 This document is available via the Internet at www.rle.westinghousenuclear.com. This web site is a free service for Westinghouse Electric Company LLC (Westinghouse) customers and other electric power industry-related organizations. Access will be provided based on Westinghouse's judgment of appropriate business affiliation. Westinghouse reserves the right, at its sole discretion, to grant or deny access to this web site. Requests for access should be made to giampora@westinghouse.com.

3 Denotes W-PWRs that do not have a PFRT.

ENCLOSURE 2 to TXX-09055 Westinghouse Nuclear Safety Advisory Letter (NSAL) 02-11, "Reactor Protection System Response Time Requirements," July 29, 2002

Nuclear Safety (ý)Electric 'Company SWestingouse Advisory Letter This is a notification of a recently identified potential safety issue pertaining to basic components supplied by Westinghouse.

This information is being provided so that you can conduct a review of this issue to determine if any action is required.

PO. Box 355, Pittsburgh, PA 15230

Subject:

Reactor Protection System Response Time Requirements Number: NSAL-02-11 Basic Component: Reactor Protection System Date: 07/29/2002 Plants: All Westinghouse NSSS Substantial Safety Hazard or Failure to Comply Pursuant to 10 CFR 21.21(a) Yes El No E Transfer of Information Pursuant to 10 CFR 21.21(b) Yes El Advisory Information Pursuant to 10 CFR 21.21(d)(2) Yes E]

References:

See attached

SUMMARY

The Technical Specifications (Tech Specs) for most plants require response time testing of the specific Reactor Protection System (RPS) functions. The response time acceptance criteria are typically identified in a separate licensee-controlled document or in the Tech Specs (for plants that have not relocated them out of the Tech Specs). The response time specified for some functions may be "Not Applicable." Some of these protection functions may be credited for primary protection against anticipated transients or postulated accidents, but not explicitly in the specific safety analysis cases presented in the Final Safety Analysis Report (FSAR).

Recently, sorne licensees have determined that crediting a function that has no response time requirement for primary protection may impact function operability. The purpose of this communication is to identify protection system functions potentially in this category, explain the basis for the response time requirement designation of "Not Applicable," assess the safety significance of the issue, and identify Westinghouse conclusions.

Additional inflormation, if required, may be obtained from the originators. Telephone 412-374-5773 or 412-374-5424.

Originator(s): Approved:

G. 1-. H-leberle H. A. Sepp, Manager Transient Analysis Regulatory & Licensing Engineering D. S. Hfuegel Transient Analysis Official record electronically approved in EDMS 2000

t RPS Response Time Requirements NSAL-02-11 Page 2 of 7 ISSUE DESCRIPTION The Improved Standard Technical Specifications (ISTS) for Westinghouse plants, NUREG-1431 (Reference 1) includes requirements for the Reactor Trip System (RTS) and Engineered Safety Features Actuation System (ESFAS) instrumentation. The Tech Specs identify the applicable plant operational mode(s) and other specified conditions, the minimum number of channels that must be operable, and tile nominal setpoint and/or allowable value for each function. In addition, there are surveillance requirements to verify that the RTS and ESFAS response times are within the values assumed in the safety analyses. The Standard Technical Specifications (STS) for Westinghouse plants, NUREG-0452 (Reference 2) contained specific response time values for each function. Plants that have implemented the ISTS (Reference I) or relocated the response time tables out of the Tech Specs have the response time values in a separate licensee-controlled document, such as a Technical Requirements Manual, or in Chapter 7 or 16 of the Final Safety Analysis Report (FSAR). The response time requirement specified for some RTS and ESFAS functions is "Not Applicable" (or "N.A."). It should also be noted that for some older Westinghouse plants whose original Tech Specs pre-date the STS there are no requirements in the Tech Specs to perform RTS or ESFAS response time testing.

Recently, a "condition report" was prepared by a licensee when it was identified that Westinghouse had credited the Power Range Neutron Flux - High Positive Rate reactor trip function, commonly called the positive flux rate trip (PFRT), in a safety analysis. The discussion of this trip function in the technical evaluation section below provides more details on the analytical basis. The licensee concluded that it is necessary to verify the response time of the function since it is explicitly credited for primary protection. However, the Tech Spec response time requirement for the PFRT is listed as "Not Applicable," and this function had not been response time tested.

This communication discusses the basis for the response time requirements as originally presented in the STS, including the "Not Applicable" designation. In addition, other trip functions that may be similarly credited or recognized as providing a primary protective function are identified.

TECHNICAL EVALUATION As noted in the STS (Reference 2), Bases Sections 3/4.3.1 and 3/4.3.2, Reactor Trip and Engineered Safety Feature Actuation System Instrumentation, "No credit was taken in the analyses.br those channels with response times indicated as not applicahle." In practice, "the analyses" mentioned here referred to the specific safety analyses as presented in the FSAR accident analysis section (i.e., Chapter 14 or 15). Historically, response time values were defined in the STS for those RTS or ESFAS functions that were explicitly modeled and credited for primary protection in the FSAR analyses. The response time values for other protection functions not explicitly credited in these analyses were generally listed as "Not Applicable." This practice represents the original licensing basis approach for most plants. Plants that have relocated the response time values to licensee-controlled documents have typically retained the "Not Applicable" designations that were previously contained in their Tech Specs..

RPS Response Time Requirements NSAL-02-11 Page 3 of 7 The historical designation of "Not Applicable" for a response time criterion should not be construed to imply that a particular RTS or ESFAS function is unimportant, Or that it only provides backup protection. in fact, while not credited in the specific limiting analysis case(s) presented in the FSAR, some of these functions are relied upon to provide primary protection for a plant operational mode or condition that is not explicitly analyzed and/or presented. In general, all RTS and ESFAS protection system functions are important and required to be operable to ensure that the safety analysis basis remains valid and bounding and all design criteria (e.g., diversity, defense-in-depth) are satisfied.

Westinghouse has reviewed the generic response time requirements originally listed in the STS (Reference 2) for the RTS (Table 3.3-2) and ESFAS (Table 3.3-5), as well as a sampling of current plant-specific time response requirements. As a result, the following sections numbered I through 5 identify trip functions that are typically credited as providing primary protection, but are not necessarily explicitly modeled in the analyses presented in the FSAR. Consistent with the historical approach for specifying response times identified above, the response time requirement may be specified as "Not Applicable" for some of these functions contained in the licensee-controlled document or the Tech Specs. This list captures the functions Westinghouse has identified as potentially affected by this issue. However, protection system designs vary and not all plant-specific requirements are the same. Also, Westinghouse does not retain the safety analyses of record for some plants.

1. Power Range Neutron Flux - High Positive Rate Reactor-Trip The Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal at Power (RWAP) accident is analyzed in the FSAR to demonstrate that the departure from nucleate boiling (DNB) design basis is met. Therefore, the analysis assumptions are such that the DNB ratio is minimized, including the assumption that RCS pressure control systems (pressurizer spray and relief valves) are operable.

While analyzing a specific plant in the early 1990s, Westinghouse identified the potential for Reactor Coolant System (RCS) overpressurization for some cases of RWAP. It was found that some RWAP cases from a low power level, i.e., 10% Rated Thermal Power (RTP), may approach or exceed the applicable RCS pressure limit (110% of design pressure), given the typical conseivative analysis methodology and assumptions. This could occur if the RCS pressure control systems are not operable and only the Power Range Neutron Flux - High Setpoint, Pressurizer Pressure - High, and Overtemperature AT reactor trip functions are credited. It was demonstrated that crediting the PFRT provided the necessary protection to prevent RCS overpressurization.

Subsequently, a generic analysis was performed to address this for other Westinghouse plants with the PFRT function for which Westinghouse maintains the safety analyses. As was done in the earlier plant-specific analysis, the RWAP RCS overpressure analysis employed conservative assumptions, including a conservative setpoint and a very long delay time for the PFRT. The nuclear instrumentation system (NIS) trip functions credited in the safety analyses typically assume a maximum delay time of 0.5 second. The RWAP RCS overpressure analysis conservatively assumed a much longer delay time of3.0 seconds for the- PFRT. Based on this, it was determined that the delay time of the PFRT function is not a critical parameter, and that specific response time testing to verify this assumption is not necessary. It was concluded that if the trip function is operable, as is required by the Technical Specifications; then it could reasonably be credited to actuate within the conservative delay time assumed in the RWAP RCS overpressure analysis. The conclusion was that

RPS Response Time Requirements NSAL-02-11 Page 4 of 7 plants with a PFRT function are adequately protected against RCS overpressurization from a RWAP event, and that plant-specific analyses are not required, assuming that the generic analysis assumptions are bounding for the plant. Thus, it was determined that the FSAR documentation of the plant-specific RWAP analysis, which focuses onl the DNB criterion, remains adequate and appropriate.

Note that some older Westinghouse plants do not have a PFRT function. Specific RWAP RCS overpressure analyses have been performed for these plants for which Westinghouse maintains the safety analyses. For some of these plants it has been necessary to impose a reduced maximum allowable reactivity insertion rate in the reload core safety evaluation.

In addition to RWAP RCS overpressurization discussed above, it should also be noted that the PFRT function has always been recognized as providing a primary protective function for RCCA Ejection accidents. The PFRT complements the Power Range Neutron Flux - High and Low Setpoint functions that are credited in the zero power and full power analyses presented in the FSAR. Specifically, thle PFRT provides a reactor trip in the event of a low-worth RCCA ejection from a part-power initial condition, for which the Power Range Neutron Flux - High setpoint may not be reached. This is the reason for its inclusion in the Reactor Protection System (RPS), as noted in the ISTS Bases description of the PFRT function (Reference 1). This has also been discussed in some plant-specific RPS design-basis documents provided by Westinghouse. The nominal setpoint of +5% RTP with a 2-second rate time constant was chosen generically based on scoping analyses to provide a desired trip in the event of a rapid power change indicative of a RCCA ejection, but typically avoid an unnecessary trip in the event of a load increase or load rejection transient. However, there are no generic or plant-specific RCCA ejection safety analyses that explicitly model the PFRT function or response time. While the trip response time would be expected to be consistent with the other power range NIS trip functions, it is not considered a critical parameter for a low-worth RCCA ejection friom a part-power initial condition. If the trip function is operable, as required by the Tech Specs, then it can reasonably be assumed to actuate and provide the necessary protection.

Note that the PFRT was added on a forward-fit basis to all Westinghouse plant designs with a negative flux rate trip (NFRT) function. The PFRT was not backfitted to older Westinghouse plants (i.e., those without the NFRT) by virtue of their being licensed prior to the inclusion of this function in the protection system design and the very low probability of a part-power RCCA Ejection accident.

2. Source Range Neutron Flux Reactor Trip The Source Range reactor trip function is not explicitly credited in the limiting RCCA Bank Withdrawal fi-om Subcritical (RWFS) and RCCA Ejection accident analysis cases presented in the FSAR. As a result, the response time requirement for this function was noted as "Not Applicable" in the STS, consistent with the historical approach described above. Nevertheless, this trip function is recognized as providing primary protection against reactivity insertion events such as RWFS and RCCA Ejection fi-om the lower plant operational modes, where the Power Range NIS trips are not required to be operable. Refer to NSAL-00-016 (Reference 3) for a more detailed discussion.

RPS Response Time Requirements NSAL-02-11 Page 5 of 7

3. Overpower AT Reactor Trip The Overpower AT reactor trip function was not explicitly credited in any of the specific safety analysis cases originally presented in the FSAR. As a result, the response time requirement for this function was noted as "Not Applicable" in the STS, consistent with the convention described above.

However, as described in Reference 4, this trip function is designed to provide primary protection against fuel centerline melt as a result of excessive linear heat generation during postulated transients.

It also limits the range over which the Overtemperature AT trip function is required to provide protection against DNB.

In addition, the Overpower AT trip function provides primary protection for certain main steam line break cases. The limiting main steam line break accident analysis traditionally presented in the FSAR is the core response from a zero power initial condition with control rods inserted in the core. This analysis bounds the post-trip phase of a steam line break occurring firom an at-power initial condition.

However, as described in the Westinghouse steam line break topical (Reference 5, Section 3.2), the Overpower AT reactor trip function provides primary protection against DNB for some intermediate break sizes fr'om an at-power initial condition. The limiting full power case that trips on Overpower AT is normally the largest break size that is too small to generate a trip on the safety injection actuation from a steam line break protection function (e.g., Steam Line Pressure - Low).

Subsequent to the original FSAR, Westinghouse has performed specific full power steam line break analyses for many plants to demonstrate that the DNB design basis is met. Traditionally these analyses have not been explicitly documented in the FSAR. However, in recent years some plants have included documentation of the full power steam line break analysis in the FSAR.

Note that although the STS Revision 4 (Reference 2) specified "Not Applicable" for the response time of the Overpower AT trip function, the draft STS Revision 5, upon which some plant-specific Tech ,

Specs were based, included a response time test criterion and surveillance requirement. A sampling of several plant-specific requirements shows that most now include a response time for this trip fuunction.

4. Pressurizer Water Level - High Reactor Trip As noted in the discussion on the PFRT function above, the RWAP analysis presented in the FSAR focuses on the primary concern for this event by demonstrating that the DNB design basis is met.

However, another criterion for any incident of moderate frequency (ANS Condition II event) is that a more serious plant condition should not be generated without other faults occurring independently.

For the RWAP event prior to reactor trip the pressurizer water level increases due to coolant expansion fiom the RCS heatup. This may lead to filling the pressurizer, which could in turn result in a discharge of water through the pressurizer safety valves, potentially damaging the valves such that the RCS pressure boundary cannot be subsequently isolated. Thus, a more serious plant condition could be created. These concerns are avoided for a RWAP by the presence of the Pressurizer Water Level - Hligh function, which will trip the reactor prior to pressurizer overfill and potential water relief through the safety valves, as noted in the ISTS Bases description of this trip function (Reference 1). After the reactor trip the coolant in the RCS will contract and the pressurizer level will drop. This function is not explicitly credited in the FSAR analysis cases for DNB since the normal operation of the pressurizer level control system (charging and letdown) may prevent the level from increasing. Hlowever, the trip provides a primary protective function in the event that water level does increase and challenge the overfill criterion. The specific response time for this trip is not a critical

RPS Response Time Requirements NSAL-02-11 Page 6 of 7 parameter, since any trip that occurs in a reasonable time (i.e., within several seconds) after reaching the high level setpoint will prevent overfill. Thus, Westinghouse concluded that there is no need to impose a specific response time requirement on this basis. If the trip function is operable, as is required by the Tech Specs, then it can reasonably be assumed to actuate and provide the necessary protection.

5. Safety Iniection Signal Actuation of Auxiliary Feedwater The STS included response time requirements for the Auxiliary Feedwater Pump start via the specific ESFAS functions that result in actuation of a Safety Injection (Si) signal (see Reference 2, Table 3.3-5). This is consistent with the fact that the Small Break Loss of Coolant Accident (SBLOCA) analysis presented in the FSAR typically; credits the Auxiliary Feedwater (AFW) start on the SI signal from Pressurizer Pressure - Low. In addition, steam line break mass and energy release analyses, used as input to environmental qualification of equipment in compartments outside containment, credit the actuation of AFW on the SI signal generated by the Steam Line Pressure - Low (or equivalent) function. For steam line break the actuation of AFW affects the time at which the steam generator tube bundle uncovery occuirs, following which superheated steam is released out the break.

A review of some plant-specific 'requirements documents shows that the Auxiliary (or Emergency)

Feedwater actuation response time for the specific ESFAS functions is identified as "Not Applicable."

However, it appears that these function-specific items have been superseded by a separate system-level item (not found in the STS) which identifies a response time requirement for motor-driven AFW pump start from any SI signal.

SAFETY SIGNIFICANCE The convention of specifying "Not Applicable" as a response time requirement for protection system functions that are not explicitly credited in the specific FSAR analysis cases was incorporated into the STS (Reference2). However, some of these functions are relied upon either explicitly or implicitly to provide primary protection for other plant conditions, or to address other criteria that are secondary to those addressed in the FSAR. The Tech Specs require that the trip functions be operable in the applicable plant operational modes or other specified conditions. RTS and ESFAS channel operability is verified by performing Channel Operational Tests (COTs) and Channel Calibrations required by the Tech Specs. Any significant degradation in the response time of a trip channel is likely to be detected during these tests. Thus, despite the lack of an explicit response time criterion and associated response time testing, it is reasonable to conclude that the channels are operable, i.e., capable of perTorming their intended safety function, and will trip or actuate in a timely manner. This conclusion is supported by the fact that response time requirements are defined and routinely confirmed for other similar functions.

It should also be noted that Westinghouse provided startup test procedures to each plant, which typically included response time criteria for all of the protection functions, based upon the typical safety analysis assumptions or original equipment specifications for the trip function. Thus, some plants may have confirmed response times for all of these functions at least once during initial plant startup testing. Based on the foregoing, Westinghouse concludes that this does not constitute a substantial safety hazard or failure to comply pursuant to 10 CFR Part 21.

RPS Response Time Requirements NSAL-02-11 Page 7 of 7 RECOMMENDED ACTIONS The practice of not explicitly defining a response time criterion for functions that are not explicitly credited in the FSAR, but that are nevertheless relied upon for primary protection is based on historical precedent and the contents of the original FSAR. This practice is consistent with the original licensing basis for Westinghouse plants. As noted in the assessment of safety significance above, Westinghouse does not consider this to be a safety concern, assuming that plants perform the required Tech Spec surveillance testing to demonstrate that the RTS and ESFAS channels are operable. Consistent with the original licensing basis, Westinghouse concludes that changes to define specific rgequirements for RTS and ESFAS functions currently identified as "Not Applicable" are not required unless the safety analyses explicitly crediting these functions are documented in the FSAR.

REFERENCES

1. NUREG-1431,.Standard Technical Specifications Westinghouse Plants, Revision 2, April 2001.

2. NUREG-0452, Standard Technical Specifications for Westinghouse Pressurized Water Reactors, Revision 4, Issued Fall 198 1.

3. Westinghouse Nuclear Safety Advisory Letter, NSAL-00-0l16, Rod Withdrawal from Subcritical Protection in Lower Modes, December 4, 2000.

4. WCAP-8746-A, Design Bases for the Thermal Overpower AT and Thermal Overtemperature AT Trip Functions, September 1986.

5. WCAP-9227-A, Revision 1, Reactor Core Response to Excessive Secondary Steam Releases, February 1998.

This document is available via the Internet at www.rle.westinghouse.com. This site is a free service of Westinghouse Electric Co. but requires specific access through a firewall. Requests for access should be made to kleinwdZwestinghouse.com.