ML020030170

From kanterella
Jump to navigation Jump to search

License Amendments 195, 210, & 167, Revising the Technical Specifications to Reflect a Design Change of Refuel Zone and Reactor Building Ventilation Radiation Monitoring System That Replaces Existing Analog Components
ML020030170
Person / Time
Site: Browns Ferry  Tennessee Valley Authority icon.png
Issue date: 04/13/1993
From: Hebdon F
Office of Nuclear Reactor Regulation
To: Medford M
Tennessee Valley Authority
References
-RFPFR, TAC M84161, TAC M84162, TAC M84163 NUDOCS 9304220004
Download: ML020030170 (96)


Text

0, tjF9 R EG&0q UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 April 13, 1993 Docket Nos. 50-259, 50-260 and 50-296 Tennessee Valley Authority ATTN:

Dr. Mark 0. Medford, Vice President Nuclear Assurance, Licensing & Fuels 3B Lookout Place 1101 Market Street Chattanooga, Tennessee 37402-2801

Dear Dr. Medford:

SUBJECT:

ISSUANCE OF AMENDMENTS (TAC NOS.

M84161, M84162 AND M84163)

(TS-316)

The Commission has issued the enclosed Amendment Nos.195, 210

, and 167 to Facility Operating Licenses Nos.

DPR-33, DPR-52 and DPR-68 for the Browns Ferry Nuclear Plant (BFN),

Units 1, 2, and 3, respectively, in response to an application dated July 23, 1992, as supplemented by letter dated April 6, 1993, from the Tennessee Valley Authority (TVA).

By letter dated March 16, 1993, TVA also provided the staff with additional information to support its license amendments.

These amendments revise the BFN Technical Specifications (TS) to reflect a design change of the Refuel Zone and Reactor Building Ventilation Radiation Monitoring (RBVRM) system that replaces existing analog components with digital equipment manufactured by General Electric (GE).

This digital equipment is part of the GE Nuclear Measurement Analysis ana Control (NUMAC) product line.

The NUMAC RBVRM design change will be implemented by the end of the current BFN, Unit 2, Cycle 6 Refueling Outage.

A copy of the staff's Safety Evaluation (SE) is also enclosed.

However, TVA should note that the staff's conclusions regarding the capability of the NUMAC RBVRM system to tolerate electromagnetic and radio frequency interferences are contingent upon the successful accomplishment of several TVA commitments, as described in Section 4.4 of the SE.

TVA is requested to inform the staff of the results from its plant survey, and GE's testing, as soon as practicable.

These results are to be formally submitted within 60 days after the 93042204 930413 PWR WDOCK 05000259 P

PDR

/

Wý -/

April 13, 1993 Dr. Mark 0. Medford respective plant survey or GE testing is completed, but no later than December 31, 1993.

This requirement affects one respondent and, therefore, is not subject to Office of Management and Budget review under P.L.96-511.

Also enclosed is the Notice of Issuance which has been forwarded to the Office of the Federal Register for publication.

Sincerely, Frederick J. Hebdon, Director Project Directorate 11-4 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation

Enclosures:

1. Amendment No.195to License No. DPR-33
2.

Amendment No.210to License No.

DPR-52

3.

Amendment No.167to License No. DPR-68

4.

Safety Evaluation

5.

Notice cc w/enclosures:

See next page

-2

April 13, 1993 Dr. Mark 0. Medford respective plant survey or GE testing is completed, but no later than December 31, 1993.

This requirement affects one respondent and, therefore, is not subject to Office of Management and Budget review under P.L.96-511.

Also enclosed is the Notice of Issuance which has been forwarded to the Office of the Federal Register for publication.

Sincerely, Original signed by Frederick J. Hebdon, Director Project Directorate 11-4 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation

Enclosures:

1. Amendment No.195to License No.

DPR-33

2.

Amendment No.210to License No. DPR-52

3.

Amendment No.167to License No.

DPR-68

4.

Safety Evaluation

5.

Notice cc w/enclosures:

See next page

-2

Tennessee Valley Authority ATTN:

Dr. Mark 0. Medford cc:

Mr. John B. Waters, Chairman Tennessee Valley Authority ET 12A 400 West Summit Hill Drive Knoxville, Tennessee 37902 Mr. J. R. Bynum, Vice President Nuclear Operations 3B Lookout Place 1101 Market Street Chattanooga, Tennessee 37402-2801 Site Licensing Manager Browns Ferry Nuclear Plant Tennessee Valley Authority P.O. Box 2000 Decatur, Alabama 35602 Mr. 0. J. Zeringue, Vice President Browns Ferry Nuclear Plant Tennessee Valley Authority P.O. Box 2000 Decatur, Alabama 35602 Mr. M. J. Burzynski, Manager Nuclear Licensing and Regulatory Affairs 5B Lookout Place Chattanooga, Tennessee 37402-2801 TVA Representative Tennessee Valley Authority 11921 Rockville Pike Suite 402 Rockville, Maryland 20852 General Counsel Tennessee Valley Authority ET 11H 400 West Summit Hill Drive Knoxville, Tennessee 37902 Chairman, Limestone County Commission P.O. Box 188 Athens, Alabama 35611 Browns Ferry Nuclear Plant State Health Officer Alabama Dept. of Public Health 434 Monroe Street Montgomery, Alabama 36130-1701 Regional Administrator U.S.N.R.C. Region II 101 Marietta Street, N.W.

Suite 2900 Atlanta, Georgia 30323 Mr. Charles Patterson Senior Resident Inspector Browns Ferry Nuclear Plant U.S.N.R.C.

Route 12, Box 637 Athens, Alabama 35611 Site Quality Manager Browns Ferry Nuclear Plant Tennessee Valley Authority P. 0. Box 2000 Decatur, Alabama 35602

AMENDMENT NO.

AMENDMENT NO.

AMENDMENT NO.

DATED:

April 195FOR BROWNS 210FOR BROWNS 167FOR BROWNS 13, 1993 FERRY UNIT 1 -

DOCKET NO. 50-259 FERRY UNIT 2 -

DOCKET NO.

50-260 FERRY UNIT 3 -

DOCKET NO.

50-296 DISTRIBUTION:

Docket File NRC PDR & Local PDR BFN Reading File S. Varga 14-E-4 G. Lainas 14-H-3 F. Hebdon M. Sanders T. Ross J. Williams P. Frederickson RII OGC 15-B-13 D. Hagan MNBB-3302 E. Jordan MNBB-3302 G. Hill P1-130 (2 per docket)

Wanda Jones MNBB-7103 C. Grimes 11-E-21 E. Lee ACRS (10)

OPA 2-G-5 OC/LFDCB MNBB-9112 cc:

Plant Service List 210102

R 4

0 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 TENNESSEE VALLEY AUTHORITY DOCKET NO. 50-259 BROWNS FERRY NUCLEAR PLANT UNIT 1 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No.

195 License No. DPR-33 The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Tennessee Valley Authority (the licensee) dated July 23, 1992, as supplemented March 16 and April 6, 1993, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

9304220005 930413 PDR ADOCK 05000259 p

PDR

- 2

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment and paragraph 2.C.(2) of Facility Operating License No.

DPR-33 is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No.195, are hereby incorporated in the license.

The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of its date of issuance and shall be implemented within 30 days from the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Frederick J. Hebd~n, Director Project Directorate 11-4 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications Date of Issuance:

April 13, 1993

ATTACHMENT TO LICENSE AMENDMENT NO.

195 FACILITY OPERATING LICENSE NO.

DPR-33 DOCKET NO.

50-259 Revise the Appendix A Technical Specifications by removing the pages identified below and inserting the enclosed pages.

The revised pages are identified by the captioned amendment number and contain marginal lines indicating the area of change.

Overleaf* and spillover** pages are provided to maintain document completeness.

REMOVE INSERT 1.0-9 1.0-10 3.2/4.2-7 3.2/4.2-8 3.2/4.2-9 3.2/4.2-10 3.2/4.2-12 3.2/4.2-13 3.2/4.2-40 3.2/4.2-41 3.2/4.2-59 3.2/4.2-60 3.2/4.2-61 3.2/4.2-61a 3.2/4.2-67 3.2/4.2-68 3.2/4.2-69 3.2/4.2-70 3.2/4.2-73 3.2/4.2-73a 1.0-9 1.0-10*

3.2/4.2-7*

3.2/4.2-8 3.2/4.2-9 3.2/4.2-10*

3.2/4.2-12*

3.2/4.2-13 3.2/4.2-13a 3.2/4.2-13b 3.2/4.2-40*

3.2/4.2-41

3. 2/4.2-59*

3.2/4.2-60 3.2/4.2-61 3.2/4.2-61a*

3.2/4.2-67*

3.2/4.2-68 3.2/4.2-69 3.2/4.2-70*

3.2/4.2-73 3.2/4.2-73a*

1.0 DEFINITIONS (Cont'd)

10. Logic -

A logic is an arrangement of relays, contacts, and other components that produces a decision output.

(a)

Initiating -

A logic that receives signals from channels and produces decision outputs to the actuation logic.

(b)

Actuation -

A logic that receives signals (either from initiation logic or channels) and produces decision outputs to accomplish a protective action.

11.

Channel Calibration -

Shall be the adjustment, as necessary, of the channel output such that it responds with necessary range and accuracy to known values of the parameters which the channel monitors.

The channel calibration shall encompass the entire channel including alarm and/or trip functions and shall include the channel functional test.

The channel calibration may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is calibrated.

Non-calibratable components shall be excluded from this requirement, but will be included in channel functional test and source check.

12. Channel Functional Test - Shall be:
a.

Analog/Digital Channels - the injection of a simulated signal into the channel as close to the sensor as practicable to verify OPERABILITY including alarm and/or trip functions.

b.

Bistable Channels -

the injection of a simulated signal into the sensor to verify OPERABILITY including alarm and/or trip functions.

13. Source Check - Shall be the qualitative assessment of channel response when the channel sensor is exposed to a radioactive source or multiple of sources.

BFN 1.0-9 Amendment 195 Unit 1

1.0 DEFINITIONS"-,,Jont'd)

W.

Functional Tests -

A functional test is the manual operation or initiation of a system, subsystem, or components to verify that it functions within design tolerances (e.g., the manual start of a core spray pump to verify that it runs and that it pumps the required volume of water).

X.

Shutdown -

The reactor is in a shutdown condition when the reactor mode switch is in the shutdown mode position and no core alterations are being performed.

Y.

Engineered Safeguard - An engineered safeguard is a safety system the actions of which are essential to a safety action required in response to accidents.

Z.

Reportable Event -

A reportable event shall be any of those conditions specified in Section 50.73 to 10 CFR Part 50.

AA.

Solidification - Shall be the conversion of radioactive wastes into a form that meets shipping and burial ground requirements.

BB.

Offsite Dose Calculation Manual (ODCM)

Shall be a manual describing the environmental monitoring program and the methodology and parameters used in the calculation of release rate limits and offsite doses due to radioactive gaseous and liquid effluents.

The ODCM will also provide the plant with guidance for establishing alarm/trip setpoints to ensure technical specifications sections 3.8.A.1 and 3.8.B.1 are not exceeded.

CC.

Purge or purging -

The controlled process of discharging air or gas from the primary containment to maintain temperature, pressure, humidity, concentration, or other operating condition in such a manner that replacement air or gas is required to purify the containment.

DD.

Process Control Progrwu - Shall contain the sampling, analysis, and formulation determination by which SOLIDIFICATION of radioactive wastes from liquid systems is assured.

EE.

Radiological Effluent Manual (REM)

Shall be a manual containing the site and environmental sampling and analysis programs for measurements of radiation and radioactive materials in those exposure pathways and for those radionuclides which lead to the highest potential radiation exposure to individuals from station operation.

It shall also specify operating guidelines for radioactive waste treatment systems and report content.

FF.

Venting -

The controlled process of discharging air or gas from the primary containment to maintain temperature, pressure, humidity, concentration, or other operating condition in such a manner that replacement air or gas is not provided or required.

Vent, used in system names, does not imply a venting process.

BFN 1.0-10 Unit 1

TABLE 3.2.A PRIMARY CONTAINMENT AND REACTOR BUILDING Minimum No.

Instrument Channels Operable Per Trip Sys(l)(11) 2 Function Instrument Channel Reactor Low Water Level(6)

Instrument Channel Reactor High Pressure (PS-68-93 and 94)

Instrument Channel Reactor Low Water Level (LIS-3-56A-D, SW #1)

Instrument Channel High Drywell Pressure (6)

(PS-64-56A-D)

Trip Level Setting

> 538" above vessel zero 100 +/- 15 psig

2. 378" above vessel zero j 2.5 psig ISOLATION INSTRUMENTATION Action (1)

A or (B and E)

D A

A or (B and E)

Remarks

1. Below trip setting does the following:
a.

Initiates Reactor Building Isolation

b.

Initiates Primary Containment Isolation (Groups 2,

3, and 6)

c.

Initiates SGTS

1. Above trip setting isolates the shutdown cooling suction valves of the RHR system.
1. Below trip setting initiates Main Steam Line Isolation
1. Above trip setting does the following:
a.

Initiates Reactor Building Isolation

b.

Initiates Primary Containment Isolation

c.

Initiates SGTS Fl-Z rt I.-

1 2

r-s r-w I

L*

o FO o

FO I

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable Per Trip Sys(l)(11)

Function Trio Level Settina Instrument Channel High Radiation Main Steam Line Tunnel (6)

Instrument Channel Low Pressure Main Steam Line Instrument Channel High Flow Main Steam Line Instrument Channel Main Steam Line Tunnel High Temperature Instrument Channel Reactor Water Cleanup System Floor Drain High Temperature Instrument Channel Reactor Water Cleanup System Space High Temperature Instrument Channel Reactor Building Ventilation High Radiation - Reactor Zone 3 times normal rated full power background (13)

> 825 psig (4)

< 140% of rated steam flow

< 2000 F 160 -

1800F 160 - 180°F S100 mr/hr or downscale B

B B

B C

C G

2 2

2(3) 2(12) 2(14)

-t Action (1)

1. Above trip setting initiates Main Steam Line Isolation
1. Below trip setting initiates Main Steam Line Isolation
1.

Above trip setting initiates Main Steam Line Isolation

1. Above trip setting initiates Main Steam Line Isolation.
1. Above trip setting initiates Isolation of Reactor Water Cleanup Line from Reactor and Reactor Water Return Line.
1. Same as above
1. 1 upscale channel or 2 downscale channels will
a.

Initiate SGTS

b.

Isolate reactor zone and refueling floor.

c.

Close atmosphere control system.

Remarks

(

2

0.

=4 (D

kO

=3 C+

1(15)

I

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable per Trip Sys(1)(l1) 1(15) 2(7) (8) 2(7) (8) 2(7) (8) 2(10) rt Function Instrument Channel Reactor Building Ventilation High Radiation - Refueling Zone Instrument Channel SGTS Flow -

Train A R. H. Heaters Instrument Channel SGTS Flow - Train B R. H. Heaters Instrument Channel SGTS Flow - Train C R. H. Heaters Reactor Building Isolation Timer (refueling floor)

Reactor Building Isolation Timer (reactor zone)

Group 1 (Initiating) Logic Action (1)

F Trio Level Setting

< 100 mr/hr or downscale

>2000 cfm and < 4000 cfm i2000 cfm and < 4000 cfm

>2000 cfm and < 4000 cfm 0 ' t

_ 2 secs.

0 < t < 2 secs.

N/A Remarks

1. 1 upscale channel or 2 downscale channels will
a.

Initiate SGTS

b.

Isolate refueling floor

c.

Close atmosphere control system.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

1. Below trip setting prevents spurious trips and system perturbations from initiating isolation.
1. Below trip setting spurious trips and perturbations from isolation.

prevents system initiating H and (A or F)

H and (A or F)

H and (A or F)

H or F G or A or H A

1. Group 1:

The valves in Group 1 are actuated by any of the following conditions:

a.

Reactor Vessel Low Low Water Level

b.

Main Steamline High Radiation

c.

Main Steamline High Flow

d.

Main Steamline Space High Temperature

e.

Main Steamline Low Pressure (D

3 (D

c-i C+

Un I

1

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable per Trip Sys(1)(ll)

Function Trin lpvpl Stftinn Group 1 (Actuation) Logic 2

W.

C) 2 Group 2 (Initiating) Logic Group 2 (RHR Isolation Actuation) Logic Group 8 (TIP-Actuation)

Logic Group 2 (Drywell Sump Drains-Actuation) Logic Group 2 (Reactor Building

& Refueling Floor, and Drywell Vent and Purge Actuation) Logic Group 3 (Initiating) Logic N/A N/A N/A N/A N/A N/A N/A Action (1)

B A or (B and E)

Remarks

1. Group 1:

The valves in Group I are actuated by any of the following conditions:

a.

Reactor Vessel Low Low Water Level

b.

Main Steamline High Radiation

c.

Main Steamline High Flow

d.

Main Steamline Space High Temperature

e.

Main Steamline Low Pressure

1. Group 2:

The valves in Group 2 are actuated by any of the following conditions:

a. Reactor Vessel Low Water Level
b.

High Drywell Pressure D

K F and G C

1. Part of Group 6 Logic
1. Group 3:

The valves in Group 3 are actuated by any of the following conditions:

a.

Reactor Vessel Low Water Level

b.

Reactor Water Cleanup System High Temperature

c.

Reactor Water Cleanup System High Drain Temperature I,

mr mr 1

'NOTES FOR TABLE 3.2.A

1.

Whenever the respective functions are required to be OPERABLE there shall be two OPERABLE or tripped trip systems for each function.

If the first column cannot be met for one of the trip systems, that trip system or logic for that function shall be tripped (or the appropriate action listed below shall be taken).

If the column cannot be met for all trip systems, the appropriate action listed below shall be taken.

A.

Initiate an orderly shutdown and have the reactor in Cold Shutdown in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

B.

Initiate an orderly load reduction and have Main Steam Lines isolated within eight hours.

C.

Isolate Reactor Water Cleanup System.

D.

Administratively control the affected system isolation valves in the closed position within one hour and then declare the affected system inoperable.

E.

Initiate primary containment isolation within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

F.

The handling of spent fuel will be prohibited and all operations over spent fuels and open reactor wells shall be prohibited.

G.

Isolate the reactor building and start the standby gas treatment system.

H.

Immediately perform a logic system functional test on the logic in the other trip systems and daily thereafter not to exceed 7 days.

I.

Deleted J.

Withdraw TIP.

K.

Manually isolate the affected lines.

Refer to Section 4.2.E for the requirements of an inoperable system.

L.

If one SGTS train is inoperable take actions H or A and F.

If two SGTS trains are inoperable take actions A and F.

2.

Deleted

3.

There are four sensors per steam line of which at least one sensor per trip system must be OPERABLE.

BFN 3.2/4.2-12 AMENDMENT NO. 185 Unit 1

]NOTES FOR TABLE 3.2.A (Cont'd)

4.

Only required in RUN MODE (interlocked with Mode Switch).

5.

Deleted

6.

Channel shared by RPS and Primary Containment & Reactor Vessel Isolation Control System.

A channel failure may be a channel failure in each system.

7.

A train is considered a trip system.

8.

Two out of three SGTS trains required.

A failure of more than one will require actions A and F.

9.

Deleted

10. Deleted
11.

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter.

For the Reactor Building Ventilation system, one channel may be inoperable for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperable channel is placed in the tripped condition.

12.

A channel contains four sensors, all of which must be OPERABLE for the channel to be OPERABLE.

Power operations permitted for up to 30 days with 15 of the 16 temperature switches OPERABLE.

In the event that normal ventilation is unavailable in the main steam line tunnel, the high temperature channels may be bypassed for a period of not to exceed four hours.

During periods when normal ventilation is not available, such as during the performance of secondary containment leak rate tests, the control room indicators of the affected space temperatures shall be monitored for indications of small steam leaks.

In the event of rapid increases in temperature (indicative of steam line break), the operator shall promptly close the main steam line isolation valves.

13.

The nominal setpoints for alarm and reactor trip (1.5 and 3.0 times background, respectively) are established based on the normal background at full power.

The allowable setpoints for alarm and reactor trip are 1.2-1.8 and 2.4-3.6 times background, respectively.

BFN 3.2/4.2-13 Amendment 195 Unit 1

  • NOTES FOR TABLE 3.2.A (Cont'd)
14.

Requires two independent channels from each physical location; there are two locations.

15.

There is a RBVRM trip function for the refueling zone and a RBVRM trip function for the reactor zone.

Each trip function is composed of two divisional trip systems.

Each trip system has one channel for each zone.

Each channel contains two sensors, both of which must be OPERABLE for the channel to be OPERABLE.

A channel downscale/inoperable trip occurs when either of the sensors are indicating less than the low radiation setpoint or are inoperable.

A channel upscale trip occurs when both of the sensors are indicating higher than the high radiation setpoint.

Only one channel upscale trip is required for trip function initiation.

Two channel downscale trips in a zone are required for trip function initiation.

3.2/4.2-13a BFN Unit 1 Amendment 195

THIS PAGE INTENTIONALLY LEFT BLANK BFN 3.2/4.2-13b Unit 1

Z1 I-REACTOR BUILDING ISOLATION INSTRUMENTATION Calibration Frequency Instrument Check (5) once/day TABLE 4.2.A SURVEILLANCE REQUIREMENTS FOR PRIMARY CONTAINMENT AND Function Functional Test Instrument Channel -

(1)

Reactor Low Water Level (LIS-3-203A-D, SW 2-3)

Instrument Channel -

(1)

Reactor High Pressure Instrument Channel -

(1)

Reactor Low Water Level (LIS-3-56A-D, SW #1)

Instrument Channel -

(1)

High Drywell Pressure (PS-64-56A-D)

Instrument Channel -

once/3 months (29)

High Radiation Main Steam Line Tunnel Instrument Channel -

once/3 months (27)

(29)

Low Pressure Main Steam Line (PT-I-72,

-76,

-82,

-86)

Instrument Channel -

once/3 months (27)

(29)

High Flow Main Steam Line (dPT-1-13A-D,

-25A-D,

-36A-D,

-50A-D)

None once/day (5)

(5) once/operating cycle (28) once/operating cycle (28)

N/A once/day None once/day once/3 months once/3 month 41 I

C m

m

-4 M,

z Reactor Building Isolation Timer (reactor zone)

(4)

(Cont'd)

AND REACTOR BUILDING ISOLATION INSTRUMENTATION Calibration Frequency Instrument Check once/operating cycle None C-1 TABLE 4.2.A SURVEILLANCE REQUIREMENTS FOR PRIMARY CONTAINMENT Function Functional Test Instrument Channel -

once/3 months (27)

Main Steam Line Tunnel High Temperature Instrument Channel -

(1) (30)

Reactor Building Ventilation High Radiation - Reactor Zone Instrument Channel -

(1)

(30)

Reactor Building Ventilation High Radiation - Refueling Zone Instrument Channel -

(4)

SGTS Train A Heaters Instrument Channel -

(4)

SGTS Train B Heaters Instrument Channel -

(4)

SGTS Train C Heaters Reactor Building Isolation (4)

Timer (refueling floor)

(9)

(9)

(9) once/operating cycle once/operating cycle N/A N/A N/A N/A N/A once/18 months once/18 Months once/day (8) once/day (8) t'3 C1 I

I

NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2. D AND 4.2.K

1. Functional tests shall be performed once per month.
2.

Functional tests shall be performed before each startup with a required frequency not to exceed once per week.

3.

This instrumentation is excepted from the functional test definition.

The functional test will consist of injecting a simulated electrical signal into the measurement channel.

4.

Tested iuring logic system functional tests.

5.

Refer to Table 4.1.B.

6.

The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper functioning of the trip systems.

7.

The functional test will consist of verifying continuity across the inhibit with a volt-ohmmeter.

8.

Instrument checks shall be performed in accordance with the definition of instrument check (see Section 1.0, Definitions).

An instrument check is not applicable to a particular setpoint, such as Upscale, but is a

qualitative check that the instrument is behaving and/or indicating in an acceptable manner for the particular plant condition.

Instrument check is included in this table for convenience and to indicate that an instrument check will be performed on the instrument.

Instrument checks are not required when these instruments are not required to be OPERABLE or are tripped.

9.

Calibration frequency shall be once/year.

10. Deleted
11.

Portion of the logic is functionally tested during outage only.

12.

The detector will be inserted during each operating cycle and the proper amount of travel into the core verified.

13.

Functional test will consist of applying simulated inputs (see note 3).

Local alarm lights representing upscale and downscale trips will be verified, but no rod block will be produced at this time.

The inoperative trip will be initiated to produce a rod block (SRM and IRM inoperative also bypassed with the mode switch in RUN).

The functions that cannot be verified to produce a rod block directly will be verified during the operating cycle.

BFN 3.2/4.2-59 AMENDMENT NO. 1 6 1 Unit I

'NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K (Cont'd)

14.

(Deleted)

15.

The flow bias comparator will be tested by putting one flow unit in "Test" (producing 1/2 scram) and adjusting the test input to obtain comparator rod block.

The flow bias upscale will be verified by observing a local upscale trip light during operation and verified that it will produce a rod block during the operating cycle.

16.

Performed during operating cycle.

Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.

17.

This calibration consists of removing the function from service and performing an electronic calibration of the channel.

18.

Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.

19.

Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.l.a.

20.

Calibration of the comparator requires the inputs from both recirculation loops to be interrupted, thereby removing the flow bias signal to the APRM and RBM and scramming the reactor.

This calibration can only be performed during an outage.

21.

Logic test is limited to the time where actual operation of the equipment is permissible.

22.

(Deleted)

23.

(Deleted)

24.

This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).

25.

During each refueling outage, all acoustic monitoring channels shall be calibrated.

This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.

BFN 3.2/4.2-60 Unit 1 Amendment 195

-I

NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.1D AND 4.2.K (Cont'd)

26.

This instrument check consists of comparing the background signal levels for all valves for consistency and for nominal expected values (not required during refueling outages).

27.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify OPERABILITY of the trip and alarm functions.

28.

Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.

29.

The functional test frequency decreased to once/3 months to reduce challenges to relief valves per NUREG-0737, Item II.K.3.16.

30.

Functional testing for the Reactor Building Ventilation Radiation Monitoring System (RBVRMS) shall consist of verifying the High Voltage Power Supply (HVPS) voltage at the Sensor and Convertors (detectors) is within its design limits.

A channel functional test as defined in Section 1.0, "Definitions" shall be performed once per 18 months as part of the RBVRM channel calibration.

BFN 3.2/4.2-61 Amendment 195 Unit 1 I

THIS PAGE INTENTIONALLY LEFT BLANK 3.2/4.2-61a BFN Unit I AMENDMENT NO. 1 6 4

3.2 BASES (Cont'd) steam line isolation valve closure, fission product release is limited so that 10 CFR 100 guidelines are not exceeded for this accident.

Reference Section 14.6.2 FSAR.

An alarm with a nominal setpoint of 1.5 x normal full-power background is provided also.

Pressure instrumentation is provided to close the main steam isolation valves in RUN Mode when the main steam line pressure drops below 825 psig.

The HPCI high flow and temperature instrumentation are provided to detect a break in the HPCI steam piping.

Tripping of this instrumentation results in actuation of HPCI isolation valves.

Tripping logic for the high flow is a l-out-of-2 logic, and all sensors are required to be operable.

High temperature in the vicinity of the HPCI equipment is sensed by four sets of four bimetallic temperature switches.

The 16 temperature switches are arranged in two trip systems with eight temperature switches in each trip system.

The HPCI trip settings of 90 psi for high flow and 200*F for high temperature are such that core uncovery is prevented and fission product release is within limits.

The ROIC high flow and temperature instrumentation are arranged the same as that for the HPCI.

The trip setting of 450" H2 0 for high flow and 200*F for temperature are based on the same criteria as the HPCI.

High temperature at the Reactor Cleanup System floor drain could indicate a break in the cleanup system.

When high temperature occurs, the cleanup system is isolated.

The instrumentation which initiates CSCS action is arranged in a dual bus system.

As for other vital instrumentation arranged in this fashion, the specification preserves the effectiveness of the system even during periods when maintenance or testing is being performed.

An exception to this is when logic functional testing is being performed.

The control rod block functions are provided to prevent excessive control rod withdrawal so that MCPR does not decrease to 1.07.

The trip logic for this function is 1-out-of-n:

e.g., any trip on one of six APRMs, eight IRMs, or four SRMs will result in a rod block.

The minimum instrument channel requirements assure sufficient instrumentation to assure the single failure criteria is met.

The minimum instrument channel requirements for the RBM may be reduced by one for maintenance, testing, or calibration.

This does not significantly increase the risk of an inadvertent control rod withdrawal, as the other channel is available, and the RBM is a backup system to the written sequence for withdrawal of control rods.

BFN 3.2/4.2-67 Unit I

3.2 BASES (Cont'd)

The APRM rod block function is flow biased and prevents a significant reduction in MCPR, especially during operation at reduced flow.

The APRM provides gross core protection; i.e., limits the gross core power increase from withdrawal of control rods in the normal withdrawal sequence.

The trips are set so that MCPR is maintained greater than 1.07.

The RBM rod block function provides local protection of the core; i.e.,

the prevention of critical power in a local region of the core, for a single rod withdrawal error from a limiting control rod pattern.

If the IRM channels are in the worst condition of allowed bypass, the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10.

A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough.

In either case the instrument will not respond to changes in control rod motion and thus, control rod motion is prevented.

The refueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position.

For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease rapid enough to allow either core spray or LPCI to operate in time.

The automatic pressure relief function is provided as a backup to the HPCI in the event the HPCI does not operate.

The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation.

The trip settings given in the specification are adequate to assure the above criteria are met.

The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service.

Two post treatment off-gas radiation monitors are provided and, when their trip point is reached, cause an isolation of the off-gas line.

Isolation is initiated when both instruments reach their high trip point or one has an upscale trip and the other a downscale trip or both have a downscale trip.

Both instruments are required for trip but the instruments are set so that the instantaneous stack release rate limit given in Specification 3.8 is not exceeded.

Two radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System.

These instrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling zone.

BFN 3.2/4.2-68 Amendment 195 Unit 1

3.2 BASES (Cont'd)

Trip setting of 100 mr/hr for the monitors in the refueling zone are based upon initiating normal ventilation isolation and SGTS operation so that none of the activity released during the refueling accident leaves the Reactor Building via the normal ventilation path but rather all the activity is processed by the SGTS.

The allowed inoperable time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance (with the downscale trip of the inoperable channel in the tripped condition) of the Reactor Building Ventilation system is based upon a Probabilistic Risk Assessment (PRA).

The assessment considered the failures, relay failures and the probability of an accident occurring for which the RBVRMs are required to operate.

Flow integrators and sump fill rate and pump out rate timers are used to determine leakage in the drywell.

A system whereby the time interval to fill a known volume will be utilized to provide a backup.

An air sampling system is also provided to detect leakage inside the primary containment (See Table 3.2.E).

For each parameter monitored, as listed in Table 3.2.F, there are two channels of instrumentation except as noted.

By comparing readings between the two channels, a near continuous surveillance of instrument performance is available.

Any deviation in readings will initiate an early recalibration, thereby maintaining the quality of the instrument readings.

Instrumentation is provided for isolating the control room and initiating a pressurizing system that processes outside air before supplying it to the control room.

An accident signal that isolates primary containment will also automatically isolate the control room and initiate the emergency pressurization system.

In addition, there are radiation monitors in the normal ventilation system that will isolate the control room and initiate the emergency pressurization system.

Activity required to cause automatic actuation is about one mRem/hr.

Because of the constant surveillance and control exercised by TVA over the Tennessee Valley, flood levels of large magnitudes can be predicted in advance of their actual occurrence.

In all cases, full advantage will be taken of advance warning to take appropriate action whenever reservoir levels above normal pool are predicted.

Therefore, during flood conditions, the plant will be permitted to operate until water begins to run across the top of the pumping station at elevation 565.

Seismically qualified, redundant level switches each powered from a separate division of power are provided at the pumping station to give main control room indication of this condition.

At that time an orderly shutdown of the plant will be initiated, although surges even to a depth of several feet over the pumping station deck will not cause the loss of the main condenser circulating water pumps.

BFN 3.2/4.2-69 Amendment 195 Unit 1

3.2 BASES (Cont'd)

The operability of the meteorological instrumentation ensures that sufficient meteorological data is available for estimating potential radiation dose to the public as a result of routine or accidental release of radioactive materials to the atmosphere.

This capability is required to evaluate the need for initiating protective measures to protect the health and safety of the public.

The operability of the seismic instrumentation ensures that sufficient capability is available to promptly determine the seismic response of those features important to safety.

This capability is required to permit comparison of the measured response to that used in the design basis for Browns Ferry Nuclear Plant and to determine whether the plant can continue to be operated safely.

The instrumentation provided is consistent with specific portions of the recommendations of Regulatory Guide 1.12 "Instrumentation for Earthquakes."

The radioactive gaseous effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in gaseous effluents during actual or potential releases of gaseous effluents.

The alarm/trip setpoints for these instruments will be calculated in accordance with guidance provided in the ODCM to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20.

This instrumentation also includes provisions for monitoring the concentration of potentially explosive gas mixtures in the offgas holdup system.

The operability and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

The radioactive liquid effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in liquid effluents during actual or potential releases of liquid effluents.

The alarm/trip setpoints for these instruments shall be calculated in accordance with guidance provided in the ODCM to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20 Appendix B, Table II, Column 2.

The OPERABILITY and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

ATWS/RPT, Anticipated Transients without Scram/Recirculation Pump Trip system provides a means of limiting the consequences of the unlikely occurrence of a failure to scram during an ATWS event.

The response of the plant to this postulated event (ATWS/RPT) follows the BWR Owners Group Report by General Electric NEDE-31096-P-A and the accompanying NRC Staff Safety Evaluation Report.

ATWS/RPT utilizes the engineered safety feature (ESF) master/slave analog trip units (ATU) which consists of four level and four pressure channels total.

The initiating logic consists of two independent trip systems each consisting of two reactor dome high pressure channels and two reactor vessel low level channels.

A coincident trip of either two low levels or two high pressures in the same trip system causes initiation of ATWS/RPT.

This signal from either trip system opens one of two EOC BFN 3.2/4.2-70 AMENDMENT NO. 160 Unit 1

"4.2 BASES (Cont'd-Y The conclusions to be drawn are these:

1.

A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and

2.

more than one channel should not be bypassed for testing at any one time.

The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inoperable in two channels in the same zone will initiate a trip function.

The functional testing frequencies for both the channel functional test and the high voltage power supply functional test are based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors.

The calibration frequency is based upon the drift characteristics of the radiation monitors.

The off-gas post treatment monitors are connected in a 2-out-of-2 logic arrangement.

Based on experience with instruments of similar design, a testing interval of once every three months has been found adequate.

The automatic pressure relief instrumentation can be considered to be a l-out-of-2 logic system and the discussion above applies also.

The criteria for ensuring the reliability and accuracy of the radioactive gaseous effluent instrumentation is listed in Table 4.2.K.

The criteria for ensuring the reliability and accuracy of the radioactive liquid effluent instrumentation is listed in Table 4.2.D.

The RCIC and HPCI system logic tests required by Table 4.2.B contain provisions to demonstrate that these systems will automatically restart on a RPV low water level signal received subsequent to a RPV high water level trip.

BFN 3.2/4.2-73 Amendment 195 Unit I

THIS PAGE INTENTIONALLY LEFT BLANK BFN 3.2/4.2-73a Unit 1 By letter 07/31/92

"UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 TENNESSEE VALLEY AUTHORITY DOCKET NO. 50-260 BROWNS FERRY NUCLEAR PLANT, UNIT 2 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No.

210 License No.

DPR-52 The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Tennessee Valley Authority (the licensee) dated July 23, 1992, as supplemented March 16 and April 6, 1993, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act),

and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

- 2

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment and paragraph 2.C.(2) of Facility Operating License No. DPR-52 is hereby amended to read as follows:

(2) Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 210, are hereby incorporated in the license.

The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of its date of issuance and shall be implemented within 30 days from the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Frederick J.

, Director Project Directorate 11-4 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications Date of Issuance:

April 13, 1993

ATTACHMENT TO LICENSE AMENDMENT NO. 210 FACILITY OPERATING LICENSE NO.

DPR-52 DOCKET NO.

50-260 Revise the Appendix A Technical Specifications by removing the pages identified below and inserting the enclosed pages.

The revised pages are identified by the captioned amendment number and contain marginal lines indicating the area of change.

Overleaf* and spillover** pages are provided to maintain document completeness.

REMOVE INSERT 1.0-9 1.0-10 3.2/4.2-7 3.2/4.2-8 3.2/4.2-9 3.2/4.2-10 3.2/4.2-12 3.2/4.2-13 3.2/4.2-40 3.2/4.2-41 3.2/4.2-59 3.2/4.2-60 3.2/4.2-61 3.2/4.2-61a 3.2/4.2-69 3.2/4.2-70 3.2/4.2-71 3.2/4.2-72 3.2/4.2-73 3.2/4.2-73a 1.0-9 1.0-10*

3.2/4.2-7*

3.2/4.2-8 3.2/4.2-9 3.2/4.2-10*

3.2/4.2-12*

3.2/4.2-13 3.2/4.2-13a 3.2/4.2-13b 3.2/4.2-40*

3.2/4.2-41 3.2/4.2-59*

3.2/4.2-60 3.2/4.2-61 3.2/4.2-61at 3.2/4.2-69 3.2/4.2-70**

3.2/4.2-71**

3.2/4.2-72**

3.2/4.2-73**

3.2/4.2-73a

1.0 DEFINITION.

Cont'd)

10. Logic -

A logic is an arrangement of relays, contacts, and other components that produces a decision output.

(a)

Initiating A logic that receives signals from channels and produces decision outputs to the actuation logic.

(b)

Actuation -

A logic that receives signals (either from initiation logic or channels) and produces decision outputs to accomplish a protective action.

11.

Channel Calibration -

Shall be the adjustment, as necessary, of the channel output such that it responds with necessary range and accuracy to known values of the parameters which the channel monitors.

The channel calibration shall encompass the entire channel including alarm and/or trip functions and shall include the channel functional test.

The channel calibration may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is calibrated.

Non-calibratable components shall be excluded from this requirement, but will be included in channel functional test and source check.

12. Channel Functional Test - Shall be:
a.

Analog/Digital Channels -

the injection of a simulated signal into the channel as close to the sensor as practicable to verify OPERABILITY including alarm and/or trip functions.

b.

Bistable Channels -

the injection of a simulated signal into the sensor to verify OPERABILITY including alarm and/or trip functions.

13. Source Check -

Shall be the qualitative assessment of channel response when the channel sensor is exposed to a radioactive source or multiple of sources.

BFN 1.0-9 Amendment 210 Unit 2

1.0 DEFINITIONS (Cont'd)

W.

Functional Tests -

A functional test is the manual operation or initiation of a system, subsystem, or component to verify that it functions within design tolerances (e.g., the manual start of a core spray pump to verify that it runs and that it pumps the required volume of water).

X.

Shutdown -

The reactor is in a shutdown condition when the reactor mode switch is in the shutdown mode position and no core alterations are being performed.

Y.

Engineered Safeguard - An engineered safeguard is a safety system the actions of which are essential to a safety action required in response to accidents.

Z.

Reportable Event -

A reportable event shall be any of those conditions specified in Section 50.73 to 10 CFR Part 50.

AA.

Solidification - Shall be the conversion of radioactive wastes into a form that meets shipping and burial ground requirements.

BB. Offsite Dose Calculation Manual (ODCM_

Shall be a manual describing the environmental monitoring program and the methodology and parameters used in the calculation of release rate limits and offsite doses due to radioactive gaseous and liquid effluents.

The ODCM will also provide the plant with guidance for establishing alarm/trip setpoints to ensure technical specifications sections 3.8.A.1 and 3.8.B.1 are not exceeded.

CC. Purge or purgig -

The controlled process of discharging air or gas from the primary containment to maintain temperature, pressure, humidity, concentration, or other operating condition in such a manner that replacement air or gas is required to purify the containment.

DD.

Proess CQntrolPro

-am - Shall contain the sampling, analysis, and formulation determination by which SOLIDIFICATION of radioactive wastes from liquid systems is assured.

EE. Radiological Effluent Manual (REM)

- Shall be a manual containing the site and environmental sampling and analysis programs for measurements of radiation and radioactive materials in those exposure pathways and for those radionuclides which lead to the highest potential radiation exposure to individuals from station operation.

It shall also specify operating guidelines for radioactive waste treatment systems and report content.

FF. Venting -

The controlled process of discharging air or gas from the primary containment to maintain temperature, pressure, humidity, concentration, or other operating condition in such a manner that replacement air or gas is not provided or required.

Vent, used in system names, does not imply a venting process.

BFN 1.0-10 AMENDMI' NO. I f 5 Unit 2

TABLE 3.2.A PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable Per Trip Svs(l)(11) 2 2

2 Function Instrument Channel Reactor Low Water Level(6)

(LIS-3-203 A-D)

Instrument Channel Reactor High Pressure (PS-68-93 and -94)

Instrument Channel Reactor Low Water Level (LIS-3-56A-D)

Instrument Channel High Drywell Pressure (6)

(PIS-64-56A-D)

Trip Level Setting

> 538" above vessel zero 100 +/- 15 psig

> 398" above vessel zero e< 2.5 psig Action (1)

A or (B and E)

D A

A or (B and E)

Remarks

1. Below trip setting does the following:
a.

Initiates Reactor Building Isolation

b.

Initiates Primary Containment Isolation

c.

Initiates SGTS

1.

Above trip setting isolates the shutdown cooling suction valves of the RHR system.

1. Below trip setting initiates Main Steam Line Isolation
1. Above trip setting does the following:
a.

Initiates Reactor Building Isolation

b.

Initiates Primary Containment Isolation

c.

Initiates SGTS rt U.)

I'.

I

(

-I rn wm 00 I

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable Per Trip Svs(l)(11) 2 2

2(3) 2(12) 1(14) rt Trip Level Setting Action (1) 3 times normal rated full power background (13) i 825 psig (4)

( 140% of rated steam flow

( 200OF S100 mr/hr or downscale B

B B

B G

Remarks

1. Above trip setting initiates Main Steam Line Isolation
1. Below trip setting initiates Main Steam Line Isolation
1. Above trip setting initiates Main Steam Line Isolation
1. Above trip setting initiates Main Steam Line Isolation.
1. 1 upscale channel or 2 downscale channels will
a.

Initiate SGTS

b.

Isolate reactor zone and refueling floor.

c.

Close atmosphere control system.

Function Instrument Channel High Radiation Main Steam Line Tunnel (6)

Instrument Channel Low Pressure Main Steam Line (PIS-1-72, 76, 82, 86)

Instrument Channel High Flow Main Steam Line (PdIS-l-13A-D, 25A-D, 36A-D, 50A-D)

Instrument Channel Main Steam Line Tunnel High Temperature Instrument Channel Reactor Building Ventilation High Radiation - Reactor Zone I

(0 (0

(D

=3 C-+

C)o I

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable per Trip Sys(1)(11) 1(14) 2(7) (8) 2(7) (8) 2(7) (8) 1 2(10)

Function Instrument Channel Reactor Building Ventilation High Radiation - Refueling Zone Instrument Channel SGTS Flow -

Train A R. H. Heaters Instrument Channel SGTS Flow -

Train B R. H. Heaters Instrument Channel SGTS Flow -

Train C R. H. Heaters Reactor Building Isolation Timer (refueling floor)

Reactor Building Isolation Timer (reactor zone)

Group 1 (Initiating) Logic Trio Level Settino

< 100 mr/hr or downscale

>2000 cfm and < 4000 cfm i2000 cfm and < 4000 cfm

>2000 cfm and < 4000 cfm 0 < t

_ 2 secs.

0 < t < 2 secs.

N/A Action (1)

F H and (A or F)

H and (A or F)

H and (A or F)

H or F G or A or H A

Remarks

1.

1 upscale channel or 2 downscale channels will

a.

Initiate SGTS

b.

Isolate refueling floor

c.

Close atmosphere control system.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

1. Below trip setting prevents spurious trips and system perturbations from initiating isolation.
1.

Below trip setting prevents spurious trips and system perturbations from initiating isolation.

1. Group 1:

The valves in Group 1 are actuated by any of the following conditions:

a.

Reactor Vessel Low Low Water Level

b.

Main Steamline High Radiation

c.

Main Steamline High Flow

d.

Main Steamline Space High Temperature

e.

Main Steamline Low Pressure rt

/'

LD

=3 (D

C-+

Ck C

I

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable per Trip Sys(l)(ll)

Fn tin tinn Group 1 (Actuation) Logic Group 2 (Initiating) Logic Group 2 (RHR Isolation Actuation) Logic Group 8 (TIP-Actuation)

Logic Group 2 (Drywell Sump Drains-Actuation) Logic Group 2 (Reactor Building

& Refueling Floor, and Drywell Vent and Purge Actuation) Logic Group 3 (Initiating) Logic Trip Level Setting N/A N/A N/A N/A N/A N/A N/A Action (1)

B A or (B and E)

Rpmarks

1. Group 1:

The valves in Group 1 are actuated by any of the following conditions:

a.

Reactor Vessel Low Low Water Level

b.

Main Steamline High Radiation

c.

Main Steamline High Flow

d. Main Steamline Space High Temperature
e.

Main Steamline Low Pressure

1. Group 2:

The valves in Group 2 are actuated by any of the following conditions:

a.

Reactor Vessel Low Water Level

b. High Drywell Pressure D

3 K

F and G C

1. Part of Group 6 Logic
1. Group 3:

The valves in Group 3 are actuated by any of the following conditions:

a.

Reactor Vessel Low Water Level

b.

Reactor Water Cleanup (RWCU)

System High Temperature in the main steam valve vault

c.

RWCU System High Temperature in the RWCU pump room 2A

d.

RWCU System High Temperature in the RWCU pump room 2B

e.

RWCU System High Temperature in the RWCU heat exchanger room

f.

RWCU System High Temperature in the space near the pipe trench containing RWCU piping rt 11) 2 1

C) 2 C

P 0

A

NOTES FOR TABLE 3.2.A

1.

Whenever the respective functions are required to be OPERABLE there shall be two OPERABLE or tripped trip systems for each function.

If the first column cannot be met for one of the trip systems, that trip system or logic for that function shall be tripped (or the appropriate action listed below shall be taken).

If the column cannot be met for all trip systems, the appropriate action listed below shall be taken.

A.

Initiate an orderly shutdown and have the reactor in Cold Shutdown in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

B.

Initiate an orderly load reduction and have Main Steam Lines isolated within eight hours.

C.

Isolate Reactor Water Cleanup System.

D.

Administratively control the affected system isolation valves in the closed position within one hour and then declare the affected system inoperable.

E.

Initiate primary containment isolation within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

F.

The handling of spent fuel will be prohibited and all operations over spent fuels and open reactor wells shall be prohibited.

G.

Isolate the reactor building and start the standby gas treatment system.

H.

Immediately perform a logic system functional test on the logic in the other trip systems and daily thereafter not to exceed 7 days.

I.

Deleted J.

Withdraw TIP.

K.

Manually isolate the affected lines.

Refer to Section 4.2.E for the requirements of an inoperable system.

L.

If one SGTS train is inoperable take actions H or A and F.

If two SGTS trains are inoperable take actions A and F.

2.

Deleted

3.

There are four sensors per steam line of which at least one sensor per trip system must be OPERABLE.

BFN 3.2/4.2-12 AMENDMEIT NO. 19 8 Unit 2

NOTES FOR TABLE 3.2.A (Cont'd)

4.

Only required in RUN MODE (interlocked with Mode Switch).

5.

Deleted

6.

Channel shared by RPS and Primary Containment & Reactor Vessel Isolation Control System.

A channel failure may be a channel failure in each system.

7.

A train is considered a trip system.

8.

Two out of three SGTS trains required.

A failure of more than one will require actions A and F.

9.

Deleted

10. Deleted
11.

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter.

For the Reactor Building Ventilation system, one channel may be inoperable for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperable channel is placed in the tripped condition.

12.

A channel contains four sensors, all of which must be OPERABLE for the channel to be OPERABLE.

Power operations permitted for up to 30 days with 15 of the 16 temperature switches OPERABLE.

In the event that normal ventilation is unavailable in the main steam line tunnel, the high temperature channels may be bypassed for a period of not to exceed four hours.

During periods when normal ventilation is not available, such as during the performance of secondary containment leak rate tests, the control room indicators of the affected space temperatures shall be monitored for indications of small steam leaks.

In the event of rapid increases in temperature (indicative of steam line break), the operator shall promptly close the main steam line isolation valves.

13.

The nominal setpoints for alarm and reactor trip (1.5 and 3.0 times background, respectively) are established based on the normal background at full power.

The allowable setpoints for alarm and reactor trip are 1.2-1.8 and 2.4-3.6 times background, respectively.

BFN 3.2/4.2-13 Amendment 210 Unit 2

NOTES FOR TABLE 3.2.A (Cont'd)

14.

There is a RBVRM trip function for the refueling zone and a RBVRM trip function for the reactor zone.

Each trip function is composed of two divisional trip systems.

Each trip system has one channel for each zone.

Each channel contains two sensors, both of which must be OPERABLE for the channel to be OPERABLE.

A channel downscale/inoperable trip occurs when either of the sensors are indicating less than the low radiation setpoint or are inoperable.

A channel upscale trip occurs when both of the sensors are indicating higher than the high radiation setpoint.

Only one channel upscale trip is required for trip function initiation.

Two channel downscale trips in a zone are required for trip function initiation.

BFN 3.2/4.2-13a Amendment 210 Unit 2

THIS PAGE INTENTIONALLY LEFT BLANK 3.2/4.2-13b BFN Unit 2 Amendment 210 I

TABLE 4.2.A SURVEILLANCE REQUIREMENTS FOR PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION r',

Instrument Channel Reactor Low Water Level (LIS-3-203A-D)

Instrument Channel Reactor High Pressure (PS-68-93 & 94)

Instrument Channel Reactor Low Water Level (LIS-3-56A-D)

Instrument Channel High Drywell Pressure (PIS-64-56A-D)

Instrument Channel High Radiation Main Steam Line Tunnel Instrument Channel Low Pressure Main Steam Line (PIS-1-72, 76, 82, 86)

Instrument Channel High Flow Main Steam Line (PdIS-1-13A-D, 25A-D, 36A-D, 50A-D)

Functional Test (1) (27)

(31)

(1) (27)

(1) (27) 29' (29)

(27)

(29)

(27)

Calibration Frequency Once/18 Months Once/18 months Once/18 months Once/18 Months (5)

Once/18 Months (28)

Once/18 Months (28)

INSTRUMENTATION Instrument Check (28)

Once/day None (28)

Once/day (28)

N/A Once/day None Once/day H.

r't Function C) 0 C,,

p 00 0i'

I-.Z rNt Reactor Building Isolation Timer (reactor zone)

TABLE 4.2.A (Cont'd)

FOR PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Functional Test Calibration Frequency Instrument Check once/3 months (27) once/operating cycle None SURVEILLANCE REQUIREMENTS Function Instrument Channel Main Steam Line Tunnel High Temperature Instrument Channel Reactor Building Ventilation High Radiation - Reactor Zone Instrument Channel Reactor Building Ventilation High Radiation - Refueling Zone Instrument Channel SGTS Train A Heaters Instrument Channel SGTS Train B Heaters Instrument Channel SGTS Train C Heaters Reactor Building Isolation Timer (refueling floor) once/18 months once/18 Months (4)

.(4)

(4)

(4)

(4)

(9)

(9)

(9) once/operating cycle once/operating cycle once/day (8) once/day (8)

N/A N/A N/A N/A N/A I

(1) (32)

(1) (32)

(D (D

c-I N)

C)

I

NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K

1.

Functional tests shall be performed once per month.

2.

Functional tests shall be performed before each startup with a required frequency not to exceed once per week.

3.

This instrumentation is excepted from the functional test definition.

The functional test will consist of injecting a simulated electrical signal into the measurement channel.

4.

Tested during logic system functional tests.

5.

Refer to Table 4.1.B.

6.

The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper functioning of the trip systems.

7.

The functional test will consist of verifying continuity across the inhibit with a volt-ohmmeter.

8.

Instrument checks shall be performed in accordance with the definition of instrument check (see Section 1.0, Definitions).

An instrument check is not applicable to a particular setpoint, such as Upscale, but is a qualitative check that the instrument is behaving and/or indicating in an acceptable manner for the particular plant condition.

Instrument check is included in this table for convenience and to indicate that an instrument check will be performed on the instrument.

Instrument checks are not required when these instruments are not required to be OPERABLE or are tripped.

9.

Calibration frequency shall be once/year.

10.

Deleted

11.

Portion of the logic is functionally tested during outage only.

12.

The detector will be inserted during each operating cycle and the proper amount of travel into the core verified.

13.

Functional test will consist of applying simulated inputs (see note 3).

Local alarm lights representing upscale and downscale trips will be verified, but no rod block will be produced at this time.

The inoperative trip will be initiated to produce a rod block (SRM and IRM inoperative also bypassed with the mode switch in RUN).

The functions that cannot be verified to produce a rod block directly will be verified during the operating cycle.

BFN 3.2/4.2-59 AMENDMENT IM.

Unit 2

NOTES FOR TABLES 2.A THROUGH 4.2.L except 4.2.D

.D 4.2.K (Cont'd)

14.

(Deleted)

15.

The flow bias comparator will be tested by putting one flow unit in "Test" (producing 1/2 scram) and adjusting the test input to obtain comparator rod block.

The flow bias upscale will be verified by observing a local upscale trip light during operation and verified that it will produce a rod block during the operating cycle.

16.

Performed during operating cycle.

Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.

17.

This calibration consists of removing the function from service and performing an electronic calibration of the channel.

18.

Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.

19.

Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.l.a.

20.

Calibration of the comparator requires the inputs from both recirculation loops to be interrupted, thereby removing the flow bias signal to the APRM and RBM and scramming the reactor.

This calibration can only be performed during an outage.

21.

Logic test is limited to the time where actual operation of the equipment is permissible.

22.

(Deleted)

23.

(Deleted)

24.

This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).

25.

During each refueling outage, all acoustic monitoring channels shall be calibrated.

This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.

BFN 3.2/4.2-60 Amendment 210 Unit 2

NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K (Cont'd)

26.

This instrument check consists of comparing the background signal levels for all valves for consistency and for nominal expected values (not required during refueling outages).

27.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify OPERABILITY of the trip and alarm functions.

28.

Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.

29.

The functional test frequency decreased to once/3 months to reduce challenges to relief valves per NUREG-0737, Item II.K.3.16.

30.

Calibration shall consist of an electronic calibration of the channel, not including the detector, for range decades above 10 R/hr and a one-point source check of the detector below 10 R/hr with an installed or portable gamma source.

31.

Functional Tests shall be performed once/3months.

32.

Functional testing for the Reactor Building Ventilation Radiation Monitoring System (RBVRMS) shall consist of verifying the High Voltage Power Supply (HVPS) voltage at the Sensor and Convertors (detectors) is within its design limits.

A channel functional test as defined in Section 1.0, "Definitions" shall be performed once per 18 months as part of the RBVRM channel calibration.

BFN 3.2/4.2-61 Unit 2 Amendment 210 I

THIS PAGE INTENTIONALLY LEFT BLANK BFN 3.2/4.2-61a AMFNDMM RD. Irs. a Unit 2

3.2 BASES (Cont'uc.

adequate to assure the above criteria are met.

The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service.

Two post treatment off-gas radiation monitors are provided and, when their trip point is reached, cause an isolation of the off-gas line.

Isolation is initiated when both instruments reach their high trip point or one has an upscale trip and the other a downscale trip or both have a downscale trip.

Both instruments are required for trip but the instruments are set so that the instantaneous stack release rate limit given in Specification 3.8 is not exceeded.

Two radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System.

These instrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling zone.

Trip setting of 100 mr/hr for the monitors in the refueling zone are based upon initiating normal ventilation isolation and SGTS operation so that none of the activity released during the refueling accident leaves the Reactor Building via the normal ventilation path but rather all the activity is processed by the SGTS.

The allowed inoperable time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance (with the downscale trip of the inoperable channel in the tripped condition) of the Reactor Building Ventilation system is based upon a Probabilistic Risk Assessment (PRA).

The assessment considered the failures, relay failures and the probability of an accident occurring for which the RBVRMs are required to operate.

Flow integrators and sump fill rate and pump out rate timers are used to determine leakage in the drywell.

A system whereby the time interval to fill a known volume will be utilized to provide a backup.

An air sampling system is also provided to detect leakage inside the primary containment (See Table 3.2.E).

For each parameter monitored, as listed in Table 3.2.F, there are two channels of instrumentation except as noted.

By comparing readings between the two channels, a near continuous surveillance of instrument performance is available.

Any deviation in readings will initiate an early recalibration, thereby maintaining the quality of the instrument readings.

BFN 3.2/4.2-69 Amendment 210 Unit 2

1 3.2 BASES (Cont ',ti Instrumentation is provided for isolating the control room and initiating a pressurizing system that processes outside air before supplying it to the control room.

An accident signal that isolates primary containment will also automatically isolate the control room and initiate the emergency pressurization system.

In addition, there are radiation monitors in the normal ventilation system that will isolate the control room and initiate the emergency pressurization system.

Activity required to cause automatic actuation is about one mRem/hr.

Because of the constant surveillance and control exercised by TVA over the Tennessee Valley, flood levels of large magnitudes can be predicted in advance of their actual occurrence.

In all cases, full advantage will be taken of advance warning to take appropriate action whenever reservoir levels above normal pool are predicted.

Therefore, during flood conditions, the plant will be permitted to operate until water begins to run across the top of the pumping station at elevation 565.

Seismically qualified, redundant level switches each powered from a separate division of power are provided at the pumping station to give main control room indication of this condition.

At that time an orderly shutdown of the plant will be initiated, although surges even to a depth of several feet over the pumping station deck will not cause the loss of the main condenser circulating water pumps.

The OPERABILITY of the meteorological instrumentation ensures that sufficient meteorological data is available for estimating potential radiation dose to the public as a result of routine or accidental release of radioactive materials to the atmosphere.

This capability is required to evaluate the need for initiating protective measures to protect the health and safety of the public.

The OPERABILITY of the seismic instrumentation ensures that sufficient capability is available to promptly determine the seismic response of those features important to safety.

This capability is required to permit comparison of the measured response to that used in the design basis for Browns Ferry Nuclear Plant and to determine whether the plant can continue to be operated safely.

The instrumentation provided is consistent with specific portions of the recommendations of Regulatory Guide 1.12 "Instrumentation for Earthquakes."

The radioactive gaseous effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in gaseous effluents during actual or potential releases of gaseous effluents.

The alarm/trip setpoints for these instruments will be calculated in accordance with guidance provided in the ODCM to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20.

This instrumentation also includes provisions for monitoring the concentration of potentially explosive gas mixtures in the off-gas holdup system.

The OPERABILITY and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

BFN 3.2/4.2-70 J Amendment 210 Unit 2

3.2 BASES (Cont'd)

The radioactive liquid effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in liquid effluents during actual or potential releases of liquid effluents.

The alarm/trip setpoints for these instruments shall be calculated in accordance with guidance provided in the ODCM to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20 Appendix B, Table II, Column 2.

The OPERABILITY and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

ATWS/RPT, Anticipated Transients without Scram/Recirculation Pump Trip system provides a means of limiting the consequences of the unlikely occurrence of a failure to scram during an ATWS event.

The response of the plant to this postulated event (ATWS/RPT) follows the BWR Owners Group Report by General Electric NEDE-31096-P-A and the accompanying NRC Staff Safety Evaluation Report.

ATWS/RPT utilizes the engineered safety feature (ESF) master/slave analog trip units (ATU) which consists of four level and four pressure channels total.

The initiating logic consists of two independent trip systems each consisting of two reactor dome high pressure channels and two reactor vessel low level channels.

A coincident trip of either two low levels or two high pressures in the same trip system causes initiation of ATWS/RPT.

This signal from either trip system opens one of two EOC (end-of-cycle) breakers in series (the other system opens the other breaker) between the pump motor and the Motor Generator set driving each recirculation pump.

Both systems are completely redundant such that only one trip system is necessary to perform the ATWS/RPT function.

Power comes from the 250 VDC shutdown boards.

Setpoints for reactor dome high pressure and reactor vessel low level are such that a normal Reactor Protection System scram and accompanying recirculation pump trip would occur before or coincident with the trip by ATWS/RPT.

4.2 BASES The instrumentation listed in Tables 4.2.A through 4.2.F will be functionally tested and calibrated at regularly scheduled intervals.

The same design reliability goal as the Reactor Protection System of 0.99999 generally applies for all applications of (l-out-of-2) X (2) logic.

Therefore, on-off sensors are tested once/3 months, and bistable trips associated with analog sensors and amplifiers are tested once/week.

BFN 3.2/4.2-71 Amendment 210 Unit 2

4.2 BASES (Cont'L,_

Those instruments which, when tripped, result in a rod block have their contacts arranged in a 1-out-of-n logic, and all are capable of being bypassed.

For such a tripping arrangement with bypass capability provided, there is an optimum test interval that should be maintained in order to maximize the reliability of a given channel (7).

This takes account of the fact that testing degrades reliability and the optimum interval between tests is approximately given by:

i 2t r

Where:

i =

the optimum interval between tests.

t =

the time the trip contacts are disabled from performing their function while the test is in progress.

r =

the expected failure rate of the relays.

To test the trip relays requires that the channel be bypassed, the test made, and the system returned to its initial state.

It is assumed this task requires an estimated 30 minutes to complete in a thorough and workmanlike manner and that the relays have a failure rate of 10-6 failures per hour.

Using this data and the above operation, the optimum test interval is:

!2(0"5)

=ix10 1

1lX 10O3 10-6

= 40 days For additional margin a test interval of once per month will be used initially.

The sensors and electronic apparatus have not been included here as these are analog devices with readouts in the control room and the sensors and electronic apparatus can be checked by comparison with other like instruments.

The checks which are made on a daily basis are adequate to assure OPERABILITY of the sensors and electronic apparatus, and the test interval given above provides for optimum testing of the relay circuits.

The above calculated test interval optimizes each individual channel, considering it to be independent of all others.

As an example, assume that there are two channels with an individual technician assigned to each.

Each technician tests his channel at the optimum frequency, but the two technicians are not allowed to communicate so that one can advise the other that his channel is under test.

Under these conditions, it is possible for both channels to be under test simultaneously.

Now, assume that the technicians are required to communicate and that two channels are never tested at the same time.

BFN 3.2/4.2-72 Amendment 210 Unit 2

' 4.2 BASES (Cont'd',-

(7)

UCRL-50451, Improving Availability and Readiness of Field Equipment Through Periodic Inspection, Benjamin Epstein, Albert Shiff, July 16, 1968, page 10, Equation (24), Lawrence Radiation Laboratory.

Forbidding simultaneous testing improves the availability of the system over that which would be achieved by testing each channel independently.

These one-out-of-n trip systems will be tested one at a time in order to take advantage of this inherent improvement in availability.

Optimizing each channel independently may not truly optimize the system considering the overall rules of system operation.

However, true system optimization is a complex problem.

The optimums are broad, not sharp, and optimizing the individual channels is generally adequate for the system.

The formula given above minimizes the unavailability of a single channel which must be bypassed during testing.

The minimization of the unavailability is illustrated by Curve No.

1 of Figure 4.2-1 which assumes that a channel has a failure rate of 0.1 x 10- 6 /hour and 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is required to test it.

The unavailability is a minimum at a test interval i, of 3.16 x 103 hours0.00119 days <br />0.0286 hours <br />1.703042e-4 weeks <br />3.91915e-5 months <br />.

If two similar channels are used in a l-out-of-2 configuration, the test interval for minimum unavailability changes as a function of the rules for testing.

The simplest case is to test each one independent of the other.

In this case, there is assumed to be a finite probability that both may be bypassed at one time.

This case is shown by Curve No.

2.

Note that the unavailability is lower as expected for a redundant system and the minimum occurs at the same test interval.

Thus, if the two channels are tested independently, the equation above yields the test interval for minimum unavailability.

A more usual case is that the testing is not done independently.

If both channels are bypassed and tested at the same time, the result is shown in Curve No.

3.

Note that the minimum occurs at about 40,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, much longer than for cases 1 and 2.

Also, the minimum is not nearly as low as Case 2 which indicates that this method of testing does not take full advantage of the redundant channel.

Bypassing both channels for simultaneous testing should be avoided.

The most likely case would be to stipulate that one channel be bypassed, tested, and restored, and then immediately following, the second channel be bypassed, tested, and restored.

This is shown by Curve No.

4.

Note that there is no true minimum.

The curve does have a definite knee and very little reduction in system unavailability is achieved by testing at a shorter interval than computed by the equation for a single channel.

BFN 3.2/4.2-73 Amendment 210 Unit 2

4.2 BASES (Cont'c The best test procedure of all those examined is to perfectly stagger the tests.

That is, if the test interval is four months, test one or the other channel every two months.

This is shown in Curve No.

5.

The difference between Cases 4 and 5 is negligible.

There may be other arguments, however, that more strongly support the perfectly staggered tests, including reductions in human error.

The conclusions to be drawn are these:

1. A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and
2.

more than one channel should not be bypassed for testing at any one time.

The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inoperable in two channels in the same zone will initiate a trip function.

The functional testing frequencies for both the channel functional test and the high voltage power supply functional test are based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors.

The calibration frequency is based upon the drift characteristics of the radiation monitors.

The off-gas post treatment monitors are connected in a 2-out-of-2 logic arrangement.

Based on experience with instruments of similar design, a testing interval of once every three months has been found adequate.

The automatic pressure relief instrumentation can be considered to be a l-out-of-2 logic system and the discussion above applies also.

The criteria for ensuring the reliability and accuracy of the radioactive gaseous effluent instrumentation is listed in Table 4.2.K.

The criteria for ensuring the reliability and accuracy of the radioactive liquid effluent instrumentation is listed in Table 4.2.D.

The RCIC and HPCI system logic tests required by Table 4.2.B contain provisions to demonstrate that these systems will automatically restart on a RPV low water level signal received subsequent to a RPV high water level trip.

BFN 3.2/4.2-73a Amendment 210 Unit 2

ATTACHMENT TO LICENSE AMENDMENT NO.

167 FACILITY OPERATING LICENSE NO.

DPR-68 DOCKET NO.

50-296 Revise the Appendix A Technical Specifications by removing the pages identified below and inserting the enclosed pages.

The revised pages are identified by the captioned amendment number and contain marginal lines indicating the area of change.

Overleaf* and spillover** pages are provided to maintain document completeness.

REMOVE INSERT 1.0-9 1.0-10 3.2/4.2-7 3.2/4.2-8 3.2/4.2-9 3.2/4.2-10 3.2/4.2-12 3.2/4.2-13 3.2/4.2-39 3.2/4.2-40 3.2/4.2-58 3.2/4.2-59 3.2/4.2-60 3.2/4.2-60a 3.2/4.2-66 3.2/4.2-67 3.2/4.2-68 3.2/4.2-69 3.2/4.2-72 3.2/4.2-72a 1.0-9 1.0-10" 3.2/4.2-7*

3.2/4.2-8 3.2/4.2-9 3.2/4.2-10*

3.2/4.2-12*

3.2/4.2-13 3.2/4.2-13a 3.2/4.2-13b 3.2/4.2-39*

3.2/4.2-40

3. 2/4.2-58*

3.2/4.2-59 3.2/4.2-60 3.2/4.2-60a*

3.2/4.2-66*

3.2/4.2-67 3.2/4.2-68 3.2/4.2-69*

3.2/4.2-72 3.2/4.2-72a*

UNITED STATES

('

  • NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 TENNESSEE VALLEY AUTHORITY DOCKET NO. 50-296 BROWNS FERRY NUCLEAR PLANT, UNIT 3 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No.

167 License No.

DPR-68 The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Tennessee Valley Authority (the licensee) dated July 23, 1992, as supplemented March 16 and April 6, 1993, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

- 2

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment and paragraph 2.C.(2) of Facility Operating License No. DPR-68 is hereby amended to read as follows:

(2) Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 167, are hereby incorporated in the license.

The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of its date of issuance and shall be implemented within 30 days from the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Frederick J. Hebdon, Director Project Directorate 11-4 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications Date of Issuance: April 13, 1993

1.0 DEFINITIONS (Cont'd)

10. Logic -

A logic is an arrangement of relays, contacts, and other components that produces a decision output.

(a)

Initiating -

A logic that receives signals from channels and produces decision outputs to the actuation logic.

(b)

Actuation -

A logic that receives signals (either from initiation logic or channels) and produces decision outputs to accomplish a protective action.

11.

Channel Calibration - Shall be the adjustment, as necessary, of the channel output such that it responds with necessary range and accuracy to known values of the parameters which the channel monitors.

The channel calibration shall encompass the entire channel including alarm and/or trip functions and shall include the channel functional test.

The channel calibration may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is calibrated.

Non-calibratable components shall be excluded from this requirement, but will be included in channel functional test and source check.

12. Channel Functional Test - Shall be:
a.

Analog/Digital Channels - the injection of a simulated signal into the channel as close to the sensor as practicable to verify OPERABILITY including alarm and/or trip functions.

b.

Bistable Channels - the injection of a simulated signal into the sensor to verify OPERABILITY including alarm and/or trip functions.

13. Source Check - Shall be the qualitative assessment of channel response when the channel sensor is exposed to a radioactive source or multiple of sources.

BFN 1.0-9 Amendment 167 Unit 3

.1.0 DEFINITIONS (tont'd)

W.

Functional Tests -

A functional test is the manual operation or initiation of a system, subsystem, or components to verify that it functions within design tolerances (e.g., the manual start of a core spray pump to verify that it runs and that it pumps the required volume of water).

X.

Shutdown -

The reactor is in a shutdown condition when the reactor mode switch is in the shutdown mode position and no core alterations are being performed.

Y.

Engineered Safeguard -

An engineered safeguard is a safety system the actions of which are essential to a safety action required in response to accidents.

Z.

Reportable Event -

A reportable event shall be any of those conditions specified in section 50.73 to 10 CFR Part 50.

AA.

Solidification -

Shall be the conversion of radioactive wastes into a form that meets shipping and burial ground requirements.

BB.

Offsite Dose Calculation Manual (ODCM)

Shall be a manual describing the environmental monitoring program and the methodology and parameters used in the calculation of release rate limits and offsite doses due to radioactive gaseous and liquid effluents.

The ODCM will also provide the plant with guidance for establishing alarm/trip setpoints to ensure technical specifications sections 3.8.A.1 and 3.8.B.1 are not exceeded.

CC.

Purge_* jpurging -

The controlled process of discharging air or gas from the primary containment to maintain temperature, pressure, humidity, concentration, or other operating condition in such a manner that replacement air or gas is required to purify the containment.

DD.

Process Control Program -

Shall contain the sampling, analysis, and formulation determination by which SOLIDIFICATION of radioactive wastes from liquid systems is assured.

EE.

Radiological Effluent Manual (REM_) - Shall be a manual containing the site and environmental sampling and analysis programs for measurements of radiation and radioactive materials in those exposure pathways and for those radionuclides which lead to the highest potential radiation exposure to individuals from station operation.

It shall also specify operating guidelines for radioactive waste treatment systems and report content.

FF.

Venting -

The controlled process of discharging air or gas from the primary containment to maintain temperature, pressure, humidity, concentration, or other operating condition in such a manner that replacement air or gas is not provided or required.

Vent, used in system names, does not imply a venting process.

BFN 1.0-10 Unit 3

TABLE 3.2.A PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable Per Trip Svs(l)(ll) 2 2

2 Instrument Channel Reactor Low Water Level(6)

Instrument Channel Reactor High Pressure (PS-68-93 and 94)

Instrument Channel Reactor Low Water Level (LIS-3-56A-D, SW #1)

Instrument Channel High Drywell Pressure (6)

(PS-64-56A-D)

Trip Level Setting

> 538" above vessel zero 100 +/- 15 psig

> 378" above vessel zero i 2.5 psig Action (A)

A or (B and E)

D A

A or (B and E)

Remarks

1. Below trip setting does the following:
a.

Initiates Reactor Building Isolation

b.

Initiates Primary Containment Isolation (Groups 2,

3, and 6)

c.

Initiates SGTS

1. Above trip setting isolates the shutdown cooling suction valves of the RHR system.
1. Below trip setting initiates Main Steam Line Isolation
1. Above trip setting does the following:
a.

Initiates Reactor Building Isolation

b.

Initiates Primary Containment Isolation

c.

Initiates SGTS r'3 r'3

(

rw I

I

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable Per Trio Svs(1)(11) 2 2

2(3) 2(12) 2(14) 2 1(15) rt WJ.

Trio Level Settina 3 times normal rated full power background (13)

> 825 psig (4)

< 140% of rated steam flow

< 200°F Function Instrument Channel High Radiation Main Steam Line Tunnel (6)

Instrument Channel Low Pressure Main Steam Line Instrument Channel High Flow Main Steam Line Instrument Channel Main Steam Line Tunnel High Temperature Instrument Channel Reactor Water Cleanup System Floor Drain High Temperature Instrument Channel Reactor Water Cleanup System Space High Temperature Instrument Channel Reactor Building Ventilation High Radiation - Reactor Zone 160 - 180°F

< 100 mr/hr or downscale Action (1)

B B

B B

C C

G Remarks

1.

Above trip setting initiates Main Steam Line Isolation

1.

Below trip setting initiates Main Steam Line Isolation

1. Above trip setting initiates Main Steam Line Isolation
1. Above trip setting initiates Main Steam Line Isolation.
1. Above trip setting initiates Isolation of Reactor Water Cleanup Line from Reactor and Reactor Water Return Line.
1. Same as above
1. 1 upscale channel or 2 downscale channels will
a.

Initiate SGTS

b.

Isolate reactor zone and refueling floor.

c.

Close atmosphere control system.

~t" 160 - 180°F Lý)

N.)

(I)

C+

I

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable Per Trip Svs(l)(11) 1(15) 2(7) (8) 2(7) (8) 2(7) (8) 1 Fun tion Instrument Channel Reactor Building Ventilation High Radiation - Refueling Zone Instrument Channel SGTS Flow - Train A R. H. Heaters Instrument Channel SGTS Flow - Train B R. H. Heaters Instrument Channel SGTS Flow - Train C R. H. Heaters Reactor Building Isolation Timer (refueling floor)

Reactor Building Isolation Timer (reactor zone)

Trio Level Settinq

< 100 mr/hr or downscale

>2000 cfm and ( 4000 cfm

>2000 cfm and < 4000 cfm

>2000 cfm and < 4000 cfm 0 < t < 2 secs.

0 < t < 2 secs.

Action (1)

F H and (A or F)

H and (A or F)

H and (A or F)

H or F G or A or H 2(10)

Group I (Initiating) Logic

1.

1 upscale channel or 2 downscale channels will

a.

Initiate SGTS

b.

Isolate refueling floor

c.

Close atmosphere control system.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

Below 2000 cfm airflow R.H.

heaters shall be shut off.

1. Below trip setting prevents spurious trips and system perturbations from initiating isolation.
1.

Below trip setting prevents spurious trips and system perturbations from initiating isolation.

1. Refer to Table 3.7.A for list of valves.

(

'I (1D 0*.

0%

4I I

/

N/A A

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable per Trip Sys(1)(ll) 2 Function Group 1 (Actuation) Logic Group 2 (Initiating) Logic Trip Level Setting N/A N/A Action (1)

B A or (B and E)

Remarks

1. Group 1:

The valves in Group 1 are actuated by any of the following conditions:

a.

Reactor Vessel Low Low Water Level

b.

Main Steamline High Radiation

c.

Main Steamline High Flow

d.

Main Steamline Space High Temperature

e.

Main Steamline Low Pressure

1. Group 2:

The valves in Group 2 are actuated by any of the following conditions:

a.

Reactor Vessel Low Water Level

b.

High Drywell Pressure Group 2 (RHR Isolation Actuation) Logic Group 8 (TIP-Actuation)

Logic Group 2 (Drywell Sump Drains-Actuation) Logic Group 2 (Reactor Building

& Refueling Floor, and Drywell Vent and Purge Actuation) Logic Group 3 (Initiating) Logic N/A N/A N/A N/A N/A D

J K

F and G C

1. Part of Group 6 Logic
1. Group 3:

The valves in Group 3 are actuated by any of the following conditions:

a.

Reactor Vessel Low Water Level

b.

Reactor Water Cleanup System High Temperature

c.

Reactor Water Cleanup System High Drain Temperature

(

C>

2 rn C1 14

(

NOTES FOR TABLE 3.2.A

1. Whenever the shall be two first column or logic for listed below systems, the respective functions are required to be OPERABLE, there OPERABLE or tripped trip systems for each function.

If the cannot be met for one of the trip systems, that trip system that function shall be tripped (or the appropriate action shall be taken).

If the column cannot be met for all trip appropriate action listed below shall be taken.

A.

Initiate an orderly shutdown and have the reactor in COLD SHUTDOWN CONDITION in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

B.

Initiate an orderly load reduction and have main steam lines isolated within eight hours.

C.

Isolate Reactor Water Cleanup System.

D.

Administratively control the affected system isolation valves in the closed position within one hour and then declare the affected system inoperable.

E.

Initiate primary containment isolation within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

F.

The handling of spent fuel will be prohibited and all operations over spent fuels and open reactor wells shall be prohibited.

G.

Isolate the reactor building and start the standby gas treatment system.

H.

Immediately perform a logic system functional test on the logic in the other trip systems and daily thereafter not to exceed 7 days.

I.

DELETED J.

Withdraw TIP.

K.

Manually isolate the affected lines.

Refer to Section 4.2.E for the requirements of an inoperable system.

L.

If one SGTS train is inoperable take action H or actions A and F.

If two SGTS trains are inoperable take actions A and F.

2.

Deleted

3.

There are four sensors per steam line of which at least one sensor per trip system must be OPERABLE.

BFN 3.2/4.2-12 AMENDMET io 15 7 Unit 3 d1

NOTES FOR TABLE 3.2.A (Cont'd)

4.

Only required in RUN MODE (interlocked with Mode Switch).

5.

Deleted

6.

Channel shared by RPS and Primary Containment & Reactor Vessel Isolation Control System.

A channel failure may be a channel failure in each system.

7.

A train is considered a trip system.

8.

Two out of three SGTS trains required.

A failure of more than one will require actions A and F.

9.

Deleted

10. Refer to Table 3.7.A and its notes for a listing of Isolation Valve Groups and their initiating signals.
11.

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter.

For the Reactor Building Ventilation system, one channel may be inoperable for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperable channel is placed in the tripped condition.

12.

A channel contains four sensors, all of which must be OPERABLE for the channel to be OPERABLE.

Power operations permitted for up to 30 days with 15 of the 16 temperature switches OPERABLE.

In the event that normal ventilation is unavailable in the main steam line tunnel, the high temperature channels may be bypassed for a period of not to exceed four hours.

During periods when normal ventilation is not available, such as during the performance of secondary containment leak rate tests, the control room indicators of the affected space temperatures shall be monitored for indications of small steam leaks.

In the event of rapid increases in temperature (indicative of steam line break), the operator shall promptly close the main steam line isolation valves.

13.

The nominal setpoints for alarm and reactor trip (1.5 and 3.0 times background, respectively) are established based on the normal background at full power.

The allowable setpoints for alarm and reactor trip are 1.2-1.8 and 2.4-3.6 times background, respectively.

BFN 3.2/4.2-13 Amendment 167 Unit 3

SNOTES FOR TABLE 3.>z°.A (Cont'd)

14.

Requires two independent channels from each physical location; there are two locations.

15.

There is a RBVRM trip function for the refueling zone and a RBVRM trip function for the reactor zone.

Each trip function is composed of two divisional trip systems.

Each trip system has one channel for each zone.

Each channel contains two sensors, both of which must be OPERABLE for the channel to be OPERABLE.

A channel downscale/inoperable trip occurs when either of the sensors are indicating less than the low radiation setpoint or are inoperable.

A channel upscale trip occurs when both of the sensors are indicating higher than the high radiation setpoint.

Only one channel upscale trip is required for trip function initiation.

Two channel downscale trips in a zone are required for trip function initiation.

BFN 3.2/4.2-13a Amendment 167 Unit 3

THIS PAGE INTENTIONALLY LEFT BLANK I

BFN 3.2/4.2-13b Amendment 167 Unit 3

SURVEILLANCE Function Instrument Channel Reactor Low Water Level (LIS-3-203A-D, SW 2-3)

Instrument Channel Reactor High Pressure Instrument Channel Reactor Low Water Level (LIS-3-56A-D, SW #1)

Instrument Channel High Drywell Pressure (PS-64-56A-0)

Instrument Channel High Radiation Main Steam Line Tunnel Instrument Channel Low Pressure Main Steam Line Instrument Channel High Flow Main Steam Line TABLE 4.2.A REQUIREMENTS FOR PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Functional Test Calibration Frequency Instrument Check (1)

(5) once/day once/3 months once/3 month (1)

(1)

(1)

(5) once/3 months (27) once/3 months (27) once/3 months (27)

(5) once/3 months once/3 months

(

None once/day N/A once/day None once/day

-Is Cp

'-a CA

TABLE 4.2.A SURVEILLANCE REQUIREMENTS FOR PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION P. Z Function Instrument Channel Main Steam Line Tunnel High Temperature Instrument Channel Reactor Building Ventilation High Radiation - Reactor Zone Instrument Channel Reactor Building Ventilation High Radiation - Refueling Zone Instrument Channel SGTS Train A Heaters Instrument Channel SGTS Train B Heaters CD)

C-Instrument Channel SGTS Train C Heaters Reactor Building Isolation Timer (refueling floor)

Reactor Building Isolation Timer (reactor zone)

Functional Test once/3 months (27)

(1) (30)

(1) (30)

(4)

(4)

(4)

(4)

(4)

Calibration Frequency once/operating cycle once/18 months once/l8 Months (9)

(9)

(9) once/operating cycle once/operating cycle Instrument Check None once/day (8) once/day (8)

N/A N/A N/A N/A N/A

=3 (I)

(D C-+

"-4 W.l

(

f I

NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K

1. Functional tests shall be performed once per month.
2.

Functional tests shall be performed before each startup with a required frequency not to exceed once per week.

3.

This instrumentation is excepted from the functional test definition.

The functional test will consist of injecting a simulated electrical signal into the measurement channel.

4.

Tested during logic system functional tests.

5.

Refer to Table 4.1.B.

6.

The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper functioning of the trip systems.

7.

The functional test will consist of verifying continuity across the inhibit with a volt-ohmmeter.

8.

Instrument checks shall be performed in accordance with the definition of instrument check (see Section 1.0, Definitions).

An instrument check is not applicable to a particular setpoint, such as Upscale, but is a

qualitative check that the instrument is behaving and/or indicating in an acceptable manner for the particular plant condition.

Instrument check is included in this table for convenience and to indicate that an instrument check will be performed on the instrument.

Instrument checks are not required when these instruments are not required to be operable or are tripped.

9.

Calibration frequency shall be once/year.

10.

(DELETED)

11.

Portion of the logic is functionally tested during outage only.

12.

The detector will be inserted during each operating cycle and the proper amount of travel into the core verified.

13.

Functional test will consist of applying simulated inputs (see note 3).

Local alarm lights representing upscale and downscale trips will be verified, but no rod block will be produced at this time.

The inoperative trip will be initiated to produce a rod block (SRM and IRM inoperative also bypassed with the mode switch in RUN).

The functions that cannot be verified to produce a rod block directly will be verified during the operating cycle.

BFN 3.2/4.2-58 AMENDMErT N. 135 Unit 3

NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K (Cont'd)

14.

(Deleted)

15.

The flow bias comparator will be tested by putting one flow unit in "Test" (producing 1/2 scram) and adjusting the test input to obtain comparator rod block.

The flow bias upscale will be verified by observing a local upscale trip light during operation and verified that it will produce a rod block during the operating cycle.

16.

Performed during operating cycle.

Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.

17.

This calibration consists of removing the function from service and performing an electronic calibration of the channel.

18.

Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.

19.

Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.l.a.

20.

Calibration of the comparator requires the inputs from both recirculation loops to be interrupted, thereby removing the flow bias signal to the APRM and RBM and scramming the reactor.

This calibration can only be performed during an outage.

21.

Logic test is limited to the time where actual operation of the equipment is permissible.

22.

(Deleted)

23.

(Deleted)

24.

This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).

25.

During each refueling outage, all acoustic monitoring channels shall be calibrated.

This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.

BFN 3.2/4.2-59 Unit 3 Amendment 167 A

NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K (Cont'd)

26.

This instrument check consists of comparing the background signal levels for all valves for consistency and for nominal expected values (not required during refueling outages).

27.

Functional test frequency decreased to once/3 months to reduce the challenges to relief valves per NUREG-0737, Item II.K.3.16.

28.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify OPERABILITY of the trip and alarm functions.

29.

Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.

30.

Functional testing for the Reactor Building Ventilation Radiation Monitoring System (RBVRMS) shall consist of verifying the High Voltage Power Supply (HVPS) voltage at the Sensor and Convertors (detectors) is within its design limits.

A channel functional test as defined in Section 1.0, "Definitions" shall be performed once per 18 months as part of the RBVRM channel calibration.

BFN 3.2/4.2-60 Amendment 167 Unit 3 I

THIS PAGE INTENTIONALLY LEFT BLANK BFN 3.2/4.2-60a Unit 3 AMENDMENT NO. 13 5

3.2 BASES (Cont'd) steam line isolation valve closure, fission product release is limited so that 10 CFR 100 guidelines are not exceeded for this accident.

Reference Section 14.6.2 FSAR.

An alarm with a nominal setpoint of 1.5 x normal full-power background is provided also.

Pressure instrumentation is provided to close the main steam isolation valves in RUN Mode when the main steam line pressure drops below 825 psig.

The HPCI high flow and temperature instrumentation are provided to detect a break in the HPCI steam piping.

Tripping of this instrumentation results in actuation of HPCI isolation valves.

Tripping logic for the high flow is a l-out-of-2 logic, and all sensors are required to be operable.

High temperature in the vicinity of the HPCI equipment is sensed by four sets of four bimetallic temperature switches.

The 16 temperature switches are arranged in two trip systems with eight temperature switches in each trip system.

The HPCI trip settings of 90 psi for high flow and 200*F for high temperature are such that core uncovery is prevented and fission product release is within limits.

The RCIC high flow and temperature instrumentation are arranged the same as that for the HPCI.

The trip setting of 450" water for high flow and 200 0 F for temperature are based on the same criteria as the HPCI.

High temperature at the Reactor Cleanup System floor drain could indicate a break in the cleanup system.

When high temperature occurs, the cleanup system is isolated.

The instrumentation which initiates CSCS action is arranged in a dual bus system.

As for other vital instrumentation arranged in this fashion, the specification preserves the effectiveness of the system even during periods when maintenance or testing is being performed.

An exception to this is when logic functional testing is being performed.

The control rod block functions are provided to prevent excessive control rod withdrawal so that MCPR does not decrease to 1.07.

The trip logic for this function is 1-out-of-n:

e.g., any trip on one of six APRMs, eight IRMs, or four SRMs will result in a rod block.

The minimum instrument channel requirements assure sufficient instrumentation to assure the single failure criteria is met.

The minimum instrument channel requirements for the RBM may be reduced by one for maintenance, testing, or calibration.

This does not significantly increase the risk of an inadvertent control rod withdrawal, as the other channel is available, and the RBM is a backup system to the written sequence for withdrawal of control rods.

BFN 3.2/4.2-66 Unit 3

3.2 BASES (Cont'd)

The APRM rod block function is flow biased and prevents a significant reduction in MCPR, especially during operation at reduced flow.

The APRM provides gross core protection; i.e., limits the gross core power increase from withdrawal of control rods in the normal withdrawal sequence.

The trips are set so that MCPR is maintained greater than 1.07.

The RBM rod block function provides local protection of the core; i.e.,

the prevention of critical power in a local region of the core, for a single rod withdrawal error from a limiting control rod pattern.

If the IRM channels are in the worst condition of allowed bypass, the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10.

A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough.

In either case the instrument will not respond to changes in control rod motion and thus, control rod motion is prevented.

The refueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position.

For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease rapid enough to allow either core spray or LPCI to operate in time.

The automatic pressure relief function is provided as a backup to the HPCI in the event the HPCI does not operate.

The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation.

The trip settings given in the specification are adequate to assure the above criteria are met.

The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service.

Two post treatment off-gas radiation monitors are provided and, when their trip point is reached, cause an isolation of the off-gat line.

Isolation is initiated when both instruments reach their high trip point or one has an upscale trip and the other a downscale trip or both have a downscale trip.

Both instruments are required for trip but the instruments are set so that the instantaneous stack release rate limit given in Specification 3.8 is not exceeded.

Two radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System.

These instrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling zone.

BFN 3.2/4.2-67 Amendment 167 Unit 3

3.2 BASES (Cont'd)

Trip setting of 100 mr/hr for the monitors in the refueling zone are based upon initiating normal ventilation isolation and SGTS operation so that none of the activity released during the refueling accident leaves the Reactor Building via the normal ventilation path but rather all the activity is processed by the SGTS.

The allowed inoperable time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance (with the downscale trip of the inoperable channel in the tripped condition) of the Reactor Building Ventilation system is based upon a Probabilistic Risk Assessment (PRA).

The assessment considered the failures, relay failures and the probability of an accident occurring for which the RBVRMs are required to operate.

Flow integrators and sump fill rate and pump out rate timers are used to determine leakage in the drywell.

A system whereby the time interval to fill a known volume will be utilized to provide a backup.

An air sampling system is also provided to detect leakage inside the primary containment (See Table 3.2.E).

For each parameter monitored, as listed in Table 3.2.F, there are two channels of instrumentation except as noted.

By comparing readings between the two channels, a near continuous surveillance of instrument performance is available.

Any deviation in readings will initiate an early recalibration, thereby maintaining the quality of the instrument readings.

Instrumentation is provided for isolating the control room and initiating a pressurizing system that processes outside air before supplying it to the control room.

An accident signal that isolates primary containment will also automatically isolate the control room and initiate the emergency pressurization system.

In addition, there are radiation monitors in the normal ventilation system that will isolate the control room and initiate the emergency pressurization system.

Activity required to cause automatic actuation is about one mRem/hr.

Because of the constant surveillance and control exercised by TVA over the Tennessee Valley, flood levels of large magnitudes can be predicted in advance of their actual occurrence.

In all cases, full advantage will be taken of advance warning to take appropriate action whenever reservoir levels above normal pool are predicted.

Therefore, during flood conditions, the plant will be permitted to operate until water begins to run across the top of the pumping station at elevation 565.

Seismically qualified, redundant level switches each powered from a separate division of power are provided at the pumping station to give main control room indication of this condition.

At that time an orderly shutdown of the plant will be initiated, although surges even to a depth of several feet over the pumping station deck will not cause the loss of the main condenser circulating water pumps.

BFN 3.2/4.2-68 Amendment 167 Unit 3

3.2 BASES (Cont'd)

The operability of the meteorological instrumentation ensures that sufficient meteorological data is available for estimating potential radiation dose to the public as a result of routine or accidental release of radioactive materials to the atmosphere.

This capability is required to evaluate the need for initiating protective measures to protect the health and safety of the public.

The operability of the seismic instrumentation ensures that sufficient capability is available to promptly determine the seismic response of those features important to safety.

This capability is required to permit comparison of the measured response to that used in the design basis for Browns Ferry Nuclear Plant and to determine whether the plant can continue to be operated safely.

The instrumentation provided is consistent with specific portions of the recommendations of Regulatory Guide 1.12 "Instrumentation for Earthquakes."

The radioactive gaseous effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in gaseous effluents during actual or potential releases of gaseous effluents.

The alarm/trip setpoints for these instruments will be calculated in accordance with guidance provided in the ODCM to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20.

This instrumentation also includes provisions for monitoring the concentration of potentially explosive gas mixtures in the offgas holdup system.

The operability and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

The radioactive liquid effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in liquid effluents during actual or potential releases of liquid effluents.

The alarm/trip setpoints for these instruments shall be calculated in accordance with guidance provided in the ODCM to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20 Appendix B, Table II, Column 2.

The OPERABILITY and-use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

ATWS/RPT, Anticipated Transients without Scram/Recirculation Pump Trip system provides a means of limiting the consequences of the unlikely occurrence of a failure to scram during an ATWS event.

The response of the plant to this postulated event (ATWS/RPT) follows the BWR Owners Group Report by General Electric NEDE-31096-P-A and the accompanying NRC Staff Safety Evaluation Report.

ATWS/RPT utilizes the engineered safety feature (ESF) master/slave analog trip units (ATU) which consists of four level and four pressure channels total.

The initiating logic consists of two independent trip systems each consisting of two reactor dome high pressure channels and two reactor vessel low level channels.

A coincident trip of either two low levels or two high pressures in the same trip system causes initiation of ATWS/RPT.

This signal from either trip system opens one of two EOC BFN 3.2/4.2-69 AMENDM ig. 13 6 Unit 3

4.2 BASES (Cont The conclusions to be drawn are these:

i.

A I-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and

2.

more than one channel should not be bypassed for testing at any one time.

The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inoperable in two channels in the same zone will initiate a trip function.

The functional testing frequencies for both the channel functional test and the high voltage power supply functional test are based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors.

The calibration frequency is based upon the drift characteristics of the radiation monitors.

The off-gas post treatment monitors are connected in a 2-out-of-2 logic arrangement.

Based on experience with instruments of similar design, a

testing interval of once every three months has been found adequate.

The automatic pressure relief instrumentation can be considered to be a l-out-of-2 logic system and the discussion above applies also.

The criteria for ensuring the reliability and accuracy of the radioactive gaseous effluent instrumentation is listed in Table 4.2.K.

The criteria for ensuring the reliability and accuracy of the radioactive liquid effluent instrumentation is listed in Table 4.2.D.

The RCIC and HPCI system logic tests required by Table 4.2.B contain provisions to demonstrate that these systems will automatically restart on a RPV low water level signal received subsequent to a RPV high water level trip.

BFN 3.2/4.2-72 Unit 3 Amendment 167

THIS PAGE INTENTIONALLY LEFT BLANK BFN 3.2/4.2-72a Unit 3 By letter 07/31/92

30-)

UNITED STATES NUCLEAR REGULATORY COMMISSION 0

9 WASHINGTON, D. C. 20555 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO.195 TO FACILITY OPERATING LICENSE NO.

DPR-33 AMENDMENT NO.

210 TO FACILITY OPERATING LICENSE NO. DPR-52 AMENDMENT NO.

167 TO FACILITY OPERATING LICENSE NO.

DPR-68 TENNESSEE VALLEY AUTHORITY BROWNS FERRY UNITS 1. 2. AND 3 DOCKET NOS.

50-259, 50-260, AND 50-296

1.0 INTRODUCTION

By letter dated July 23, 1992, the Tennessee Valley Authority (TVA, the licensee) submitted an application to amend Facility Operating Licenses DPR-33, DPR-52, and DPR-68 by changing the Browns Ferry Nuclear Plant (BFN)

Technical Specifications (TS) for Units 1, 2, and 3.

TVA also submitted additional information by letter dated March 16, 1993, in response to a request by the staff dated February 25, 1993.

Furthermore, TVA supplemented its July 23, 1992, application with additional Bases changes by letter dated April 6, 1993.

The proposed TS changes are intended to reflect a design change of the Refuel Zone and Reactor Building Ventilation Radiation Monitoring (RBVRM) system.

This design change will upgrade the RBVRM system by replacing the e;-sting analog monitors with digital equipment from the General Electric (GE)

Nuclear Measurement Analysis and Control (NUMAC) line.

The following discussion provides details and conclusions from the staff's safety evaluation of TVA's proposed TS changes and the NUMAC RBVRM modification at BFN.

2.0 SYSTEM DESCRIPTION The NUMAC RBVRM supports some safety-related functions and class IE components and some non-essential functions and components.

The safety-related functions of the RBVRM1 are: (a) detecting and measuring gamma radiation in reactor zone and refuel zone, and (b) comparing input signals with preselected levels, and providing upscale trips at preselected set-points.

The RBVRM also performs the following functions:

a.

Measuring input current from the digital sensor and converter (DS&C) and performing the specified radiation level calculations;

b.

Providing high voltage DC power for operating the detector; 304220,007 930413 pDR ADOCK 05000259

c.

Providing -15 VDC to power the associated DS&C electronics;

d.

Providing output trip signals to external equipment;

e.

Performing automatic calibration;

f.

Performing automatic self-test and alarm;

g.

Displaying self-test status on demand; and

h.

Providing security by keylock and password against unauthorized changes to setpoints.

2.1 Equipment Description The RBVRM consists of two chassis, each having one channel for monitoring the Reactor Zone radiation and another channel for monitoring the Refuel Zone radiation.

In addition, each chassis has the following modules:

- Essential Microcomputer

- Display Microprocessor

- Front Panel Display

- High Speed Parallel Data Bus

- Serial Data Link

- Instrument Power Supply

- Detector High Voltage Power Supply

- Trip and Analog Outputs The DS&C detects and measures gamma radiation and transmits (via an RS-485 serial connection and a signal splitter) that information to the essential microcomputer, which is based on the Harris 80C86 microprocessor.

The essential microcomputer, consisting of the necessary hardware and software, processes the received data and transmits appropriate control signals to other modules within the chassis using a high speed parallel data bus and to the display microprocessor/front panel display using a serial data link. The Essential Microcomputer also performs self-test system diagnostics when not processing instrument data.

The display microcomputer, which is based on the National Semiconductor NSC-800 microprocessor, processes the data from the Essential Microcomputer for display on the front panel display.

The front panel display contains all of the circuitry necessary to interface with the display microcomputer, the front panel's keyboard, and electro-luminescent display.

The trip outputs from the RBVRM provide inputs to the Primary Containment Isolation System (PCIS) logic, which in turn initiates the Stand-By Gas Treatment System and isolates the Refuel and Reactor Zone.

The analog outputs are used to drive main control room recorders.

The NUMAC RBVRM has instrument power supplies and detector high voltage power supplies.

Instrument power supplies power to the RBVRM chassis.

Each RBVRM chassis has two redundant diode auctioneered low voltage power supplies for uninterruptable power in the event of a power supply failure.

The Geiger Muller (GM) detectors are powered by two adjustable redundant high voltage power supplies.

The adjustable voltage range is from zero to the hardware over voltage protection limit of 650 VDC +/-50 VDC.

2.2 Improvements By using the NUMAC RBVRM, TVA expects to reduce the failures experienced by the existing RBVRM significantly.

The failures experienced by the existing RBVRM in the last 4 years include 40 equipment failures, 8 inadvertent PCIS initiations, and 12 other events.

Most of these failures were caused by (1) human error during maintenance and calibration activities, and (2) equipment and component failures.

Use of the NUMAC RBVRM could reduce the failures related to items (1) and (2),

because the NUMAC RBVRM has a lower drift rate than the present RBVRM and uses more reliable grade components and equipment than the present RBVRM.

In general, GE manufactures the NUMAC product line using military grade components.

3.0 REVIEW CRITERIA The RBVRM is part of the class 1E PCIS.

Therefore, the General Design Criteria (GDC),

IEEE standard 279, "Criteria for Protection Systems for Nuclear Power Generation Station" (10 CFR 50.55 a(h)) and the applicable acceptance criteria listed in Section 7.5 of the Standard Review Plan (NUREG-0800) were used as review guidance.

In addition, the ANSI/IEEE standard 7-4.3.2, 1982, "Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations," and corresponding Regulatory Guide (R.G.)

1.152, " Criteria for Programmable Digital Computer System Software in Safety Related Systems of Nuclear Power Plants," were also used to evaluate the NUMAC RBVRM system software design verification and validation processes.

4.0 EVALUATION 10 CFR Part 50, Appendix A, GDC 2 and 4 require that safety systems be designed to withstand the effects of natural phenomena and accommodate the effects of environmental conditions associated with normal operation and postulated accidents.

To ensure that these effects will not adversely impact the ability of the RBVRM system to perform its intended safety function(s),

the staff reviewed the environmental qualification of the NUMAC equipment for (1) temperature and humidity, (2) seismic, (3) radiation, and (4) electro magnetic and radio frequency interference.

4.1 Temperature and Humidity GE has performed temperature and humidity tests on the DS&C and the Instrument Chassis.

The test procedures and results are documented in NEDC-31974P, Appendix C.

The details of this document are found in Reference 1.

By testing equipment unique to RBVRM and analyzing equipment similar to the NUMAC product line, GE qualified the NUMAC RBVRM to the following limits:

Components located in the main control room (MCR)

(RBVRM chassis, interface panel) are qualified to a min/max temperature of 41/137 0 F, and min/max relative humidity of 10/90%.

The min/max BFN environmental requirements established by TVA are 60/104°F and 10/90% relative humidity.

Components located on the refuel floor (DS&C, signal splitter) are qualified to a min/max temperature of 22/158°F, and min/max relative humidity of 10/100% (non-condensing).

The min/max BFN environmental requirements established by TVA are 22/158°F and 10/100% relative humidity.

The staff finds that the GE temperature and humidity qualification of the GE NUMAC product envelops TVA's temperature and humidity requirements for BFN.

Therefore, the staff concludes that the temperature and humidity qualifications are acceptable.

4.2 Seismic Qualification The RBVRM equipment and panels which replace existing equipment and panels are safety-related seismic category 1 components.

Since the replacement might alter some degree of mass and stiffness characteristic of the equipment control panels and structural supports, seismic/dynamic qualification must be demonstrated for the installed equipment.

GE performed a similarity analysis of the NUMAC RBVRM chassis, interface Panels, and DS&C for the licensee.

GE performed the similarity analysis to show that the BFN specific devices are mechanically the same or equivalent to previously tested devices, as such GE demonstrated that the NUMAC RBVRM is also capable of withstanding the as tested seismic forces.

In addition, GE performed seismic calculations of the panels and ducts where the devices will be mounted and determined that the loads at the mounting locations are enveloped by the tested limits.

TVA stated that these analyses were performed in compliance with IEEE 334-1975, and are certified as such by GE on the Product Qualify Certifications provided with the equipment.

Based on TVA's statements, the staff concludes that seismic qualification has been established.

4.3 Radiation The RBVRM components located in the MCR (the chassis, interface panel) were qualified to a maximum total integrated dose (TID) of 1E+4 rad.

The RBVRM components located on the refuel floor (digital sensor and converter, signal splitter) are qualified to a TID of 9E+3 rad.

This is well within the Browns Ferry normal and accident doses for the associated areas, and therefore acceptable.

The test procedures and the test results are documented in NEDC-31974P, Appendix C.

4.4 EMI & RFI Electromagnetic interference and radio frequency interference (EMI/RFI) are random noises produced by systems within the operating environment in a nuclear plant.

This random noise can affect the safety of the plant since it can potentially lead to common cause failure of redundant safety-related equipment that are particularly vulnerable to the noise.

In safety-related (and non safety-related) instrument and control (I&C) equipment at nuclear plants, digital equipment, which operate at higher speeds and lower voltages than the analog equipment it replaces, are especially vulnerable to EMI/RFI noises.

Hence, in reviewing the application of digital I&C equipment at nuclear plants (retrofit at operating plants or in the designs of advanced plants), the NRC staff has placed additional emphasis on addressing the vulnerabilities of this equipment to EMI/RFI noise.

For general guidance on the review of EMI/RFI, the staff uses 10 CFR Part 50, Appendix A, Criterion 4, "Environmental and Dynamic Effects Design Bases," and the fourth paragraph of Standard Review Plan Section 7.1, Appendix B, "Guidance For Evaluation of Conformance to IEEE STD 279."

For specific guidance on the review of EMI/RFI, the NRC currently uses the following standards for reference:

(1) MIL-STD-461(A,B,C),

"Electro-magnetic Emission and Susceptibility Requirements for the Control of Electro-magnetic Interference," (2) MIL STD-462, "Electro-magnetic Interference Characteristics Measurement,"

(3) MIL-STD-1399, "Interface Standard for Shipboard Systems, DC Magnetic Field Environment,"

(4)

SAMA PMC 33.1-1978, "Electro-magnetic Susceptibility of Process Control Instrumentation," (5) IN83-83, "Use of Portable Radio Transmitters Inside Nuclear Power Plants," (6)

IEC 801-2 "Electromagnetic Compatibility for Industrial-Process Measurement and Control Equipment Part 2: Electrostatic Discharge Requirements," and (7)

NUREG CR-3270, "Investigation of Electro-magnetic Interference (EMI)

Levels in Commercial Nuclear Power Plants."

EMI/RFI Environmental Evaluation Using the above standards as guidance, the staff followed four steps to review the effects of the EMI/RFI noise environment around safety-related digital equipment:

1.

Evaluating the plant and identifying the potential EMI/RFI sources.

2.

Reviewing the vendor EMI/RFI qualification methodology and range of frequency tested.

3.

Reviewing the licensee's EMI/RFI qualification process for the installed equipment.

4.

Reviewing licensee's measurement of EMI/RFI field at the equipment installed at the plant and verifying that the equipment is operating within its qualified environment.

RBVRM Operating Environment Assessment The staff visited the site and performed a walkdown to assess the plant environment.

The walkdown included the refueling area, the cable spreading room, and the main control room.

The staff identified possible EMI/RFI sources in the environment surrounding the RBVRM.

The DS&C is located near the refueling bridge crane and floor crane motor and their controls.

In addition, the refueling area contained a radio antenna and a 9 Amp 420 voltage power supply on a cart.

In response to the staff's concern, the licensee made a commitment during a March 17, 1993, telephone conference, to establish additional administrative controls to prohibit temporary equipment from the immediate area around the DS&C (which already prohibits the use of walkie talkies).

Vendor Qualification Test and the NRC Review GE tested the RBVRM for four different EMI/RFI susceptibilities.

The four EMI/RFI susceptibility tests were (1) radiated electric fields, (2) radiated magnetic fields, (3) conductive noise, and (4) static discharges.

GE selected the test methodologies from various standards.

The EMI/RFI test methodologies and results for the NUMAC RBVRM are documented in NEDC-31974P Appendix B.

The staff's review of the vendor's test report is discussed below. (Item (4) is discussed separately).

GE conducted the radiated electric fields susceptibility tests in accordance with SAMA standard PMC 33.1, "Electromagnetic Susceptibility of Process Control Instrumentation."

RBVRM equipment were subjected to a field strength level of 65 V/m over the frequency range of 20 to 990 Mhz.

However, GE did not conduct the test for other frequency ranges.

In addition, GE conducted a keying test to simulate the keying of walkie talkies.

GE conducted the radiated magnetic field susceptibility test in accordance with its own internal requirements for testing electromagnetic susceotibility of process control instrumentation.

The test required 50-foot wires to be attached to the inputs/outputs of the equipment being tested, and two types of signals were injected from a generator into the test wires to simulate the noise induced on power leads.

GE, however, did not conduct the low frequency radiated magnetic field susceptibility test.

GE conducted the conductive noise test in accordance with Swedish standard Svensk Standard SS 436 15 03 and GE's conductive noise test requirements.

The staff finds that GE's testing methodologies are adequate for the tested frequency ranges.

In particular, the radiated electric field test injected 65 V/m over the frequency range of 20 to 990 Mhz.

This level of field strength appeared to be more than adequate.

However, the staff found that the testing methodologies were inadequate for the low and high frequency range.

Furthermore, the staff determined that the licensee needs to demonstrate that the BFN EMI/RFI environmental conditions are within the tested envelope either by site survey or analysis.

The staff discussed these findings and concerns with the licensee and GE.

In response to the staff's findings and concerns, the licensee has made a commitment to perform additional EMI/RFI testing for the frequency ranges that have not been covered by earlier tests.

The licensee plans to perform these additional tests through GE.

The current GE schedule calls for issuing an NEDE report sometime in September 1993 that documents the testing performed and the results.

The details of GE's planned testing are described in Reference 2.

Additionally, in a March 19, 1993 telephone conference, the licensee committed to conduct 2 days worth of site surveys - one day during transient conditions and one day during stable conditions for both the refuel floor and the control room.

Transient conditions for the refuel floor around the location of the monitor would be during refueling operations, whereas for the control room it would be during startup.

Conclusion Although, the licensee did not test the NUMAC RBVRM for all EMI/RFI noise frequencies, nor complete a plant specific survey, the staff considers the following reasons provide sufficient assurance the NUMAC RBVRM will perform its intended safety functions during the brief period until the licensee can conduct the necessary EMI/RFI tests and plant survey:

Known sources of RF energy at Browns Ferry have been identified.

Tests and analysis on the NUMAC RBVRM have been performed which include these sources of noise; The NUMAC RBVRM has a data transfer check system which detects error introduced during data transfer.

This includes data error introduced by EMI/RFI; Defenses for common mode/cause failures exist (see Section 6.0);

The NUMAC RBVRM signals are stronger than the analog RBVRM; The NUMAC RBVRM was designed to fail safe; and Plant operators will be altered to failures and can manually initiate all RBVRM safety functions.

Based on the foregoing discussion, the staff accepts that the RBVRM is EMI/RFI qualified for the BFN environment.

However, this acceptance is contingent upon the following:

1.

Performing an on-site survey and submitting a report with acceptable test results.

2.

Performing additional tests as stated in Reference 2 and submitting a report with acceptable test results.

3.

TVA maintaining administrative control on the use of walkie talkies, portable telephones, and temporary equipment in the area that already prohibits the use of walkie-talkies.

4.5 Electro Static Discharge Electro static discharge (ESD) is the transfer of static charges from one object to an another object with different electrostatic potential.

Integrated circuit (IC) components are very sensitive to ESD.

ESD can stress IC components beyond the components' designed tolerances and might cause the components to fail immediately or reduce the components' service life.

For the RBVRM system, which has numerous IC components, ESD could greatly reduce RBVRM reliability.

The NUMAC RBVRM has been qualified per IEC standard 801-2, "Electromagnetic Compatibility for Industrial-Process Measurement and Control Equipment Part 2:

Electrostatic Discharge Requirements," by GE.

In addition, the operation and maintenance manual provides information on how to avoid electrostatic voltage damage to vulnerable modules while servicing the instrument cards.

The precautions provided in the manual include:

grounding work surfaces grounding all tools and test equipment having the technicians connect themselves to ground using a conductive bracelet not wearing clothing made of nylon or the static generating materials never removing or inserting a card in a card file with power applied to the card.

Based on the RBVRM ESD qualification test and incorporated ESD precautions, the staff finds that concerns with ESD has been adequately addressed.

5.0 SOFTWARE The RBVRM application software consists of two principal modules: (1) the functional software for the essential microcomputer, including the self test system, and (2) the front panel keyboard and display software for the display computer.

The RBVRM digital equipment software is written in high level languages, to the maximum extent possible, to simplify software maintenance over the lifetime of the equipment.

The total lines of code required to perform the RBVRM's intended functions are under 20,000 lines.

The functions performed by the software include (1) sampling and filtering sensor data, (2) comparing data to operator defined trip setpoints, (3) updating operator display, (4) generating analog and trip output signals, and (5) performing self-tests.

5.1 Evaluation A software system with large inputs and outputs has an impractical number of input and output combinations to check for all possibilities.

The reliable operation of such software is assessed qualitatively based on the idea that software development processes and configuration management have a significant impact on the producing reliable software.

The staff's software review, as assisted by contractors from Lawrence Livermore National Laboratory and Sohar, included an audit of the NUMAC RBVRM and examination of the NUMAC generic software development process during January 11-15, 1993, with particular attention to: (1) software management plan (SMP)

(2) software configuration management plan (SCMP),

and (3) software verification and validation plan (SVVP).

The staff examined these plans and their implementation for compliance with R.G. 1.152, "Criteria for Programmable Digital Computer System Software in Safety-related Systems of Nuclear Power Plants,"

and ANSI/IEEE-7-4.3.2-1982, "Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations."

Verification and Validation GE used nuclear quality programs with supplemental Verification and Validation (V & V) procedures based on R.G. 1.152 to develop both Class 1E and non-Class 1E NUMAC RBVRM software.

The GE NUMAC line of instruments is highly modulerized and uses NUMAC product code where appropriate.

The application requires under 20,000 lines to perform its intended function.

The lines of code are stored in the three sets of firmware which are the functional, display, and sensor firmware.

The GE V & V method is based on logical steps with baseline reviews performed at the completion of each phase of the development process.

A list of open items was documented and maintained for each review.

The reviewers were independent from the designers and communicated their results in written reports.

The V & V reviewer team, however, was not totally independent from the design team organization.

The validation step includes a matrtx relating each validation test to a functional requirement.

The staff's review of GE 23A5163, "Software Verification and Validation Plan,"

Rev.

1, dated March 12, 1991, determined that this document did not provide sufficient detailed instructions in its description of the V & V process; however, the staff found that in actual practice, GE's software development methodology was implemented consistently and provided an internally reviewed paper trail throughout the software development process.

In response to the staff's finding, GE stated that it is currently updating GE 23A5153 to reflect its actual practices.

Software testing was done using emulators; each and every change required testing.

An organizationally independent configuration control engineer is required to sign-off on all baseline reviews (verification steps) and controls the NUMAC library of documents and firmware.

The NUMAC review team has nine members and must approve all changes for resolutions of open items.

The Design Record file (DRF) has a standard format of six sections that include the associated baseline review documents:

10 -

Definition and Planning Product Performance Definition (requirements)

High Level Software Design Design/Code Module Test Integration Test V&V Test (validation)

The DRF provided a very effective record of the project process steps and results, and it contributed substantially to the auditing process.

Configuration Control As a part of the configuration control review, the staff reviewed GE 23A5261 "Software Configuration Management Plan," Rev. 1, dated March 12,

1991, and SMP GE 23A5262, "Software Management Plan," Rev.

1, dated March 12, 1991.

This review determined that strict configuration control standards were in place and all updates to the NUMAC instruments were performed at GE.

Each version of the firmware included all software modules, whether modified or not.

Each version was controlled with a separate revision and part number.

The User's Manual has a very extensive description of the system as well as instructions for its use.

Conclusion The staff confirmed that GE has established a formal design, code, and test review process with associated documentation.

The staff also found that GE has a formal configuration management plan and it was being consistently applied.

The decision to maintain a library where each revision is a complete entity removes the problems associated with controlling different versions of the code.

The V & V process in actual use appeared adequate.

However, personnel who conducted the V&V activities report to the same first line supervisor as those responsible for the software design.

This is considered a deviation from the requirements for organizational independence in R.G. 1.152.

The existence of improper oversight or bias due to the lack of organizational independence could not be determined within the scope of the staff audit.

The staff concludes that the NUMAC RBVRM firmware is acceptable for use at BFN.

However, the staff's acceptance of the insufficiently detailed V&V program description and the RG 1.152 deviation, discussed above, was based on specific considerations that apply only to this TVA application.

Any other applications of NUMAC software by TVA or other licensees, subject to regulatory review, would be expected to resolve these issues or justify why not.

6.0 DEFENSE AGAINST THE COMMON MODE FAILURE The single failure criterion requires that any single failure within the protection system shall not prevent proper protective action at the system level when required.

Common mode/common cause failures can prevent the safety

11 -

system from performing its intended function. Common mode/common cause failures could also result in the loss of more than one echelon of defense-in-depth provided by the different safety functions (e.g., monitoring, control, reactor protection, and engineered) performed by digital I&C systems.

In particular, a microprocessor based digital system, such as the NUMAC RBVRM, which shares data bases and process equipment, has a potential for common mode/common cause failures in the area of software, hardware, and software and hardware interaction.

Defense against common mode/common cause failure is provided by quality and diversity.

The potential sources of common cause failures for the RBVRM include the software, hardware, and their qualifications.

The quality aspects of the NUMAC RBVRM's defenses against such failures are discussed in Section 4 and 5.

In the event of command-mode failure of the NUMAC RBVRM, the operator can perform the RBVRM's actuation functions manually in the MCR using the information available from the radiation indicators and alarms in the MCR.

This is diverse from the RBVRM.

Based on the staff's review of the RBVRM's defense against common mode failures or common cause failures, the staff considers the RBVRM acceptable.

7.0 TRAINING Training is an important part of implementing the NUMAC RBVRM in the BFN station environment.

The operators and technicians need to obtain a sufficient understanding on how to use and maintain the new system.

The licensee is not planning to provide specific formal training for operations and maintenance personnel.

However, BFN personnel attended two 4-hour on-site seminars provided by GE to familiarize themselves with the NUMAC RBVRMs.

The licensee's reasons for not providing specific formialized training to operational personnel were:

The existing generic experience possessed by plant operators with the NUMAC line via the main steam line radiation monitors (MSLRMs).

The user friendly nature of the NUMAC RBVRM.

In addition, TVA's reasons for not providing the specific formalized training to maintenance personnel were:

The existing generic experience possessed by maintenance personnel with the NUMAC line via the MSLRMs.

The detailed manuals supplied by GE for RBVRM maintenance.

The similarity of the NUMAC RBVRM hardware to the NUMAC MSLRMs hardware.

The staff acknowledges the similarities in operation and equipment between the NUMAC RBVRM and other NUMAC product lines, and its user friendly nature.

As

12 -

such the staff understands TVA's decision not to conduct additional training.

However, Operator and I&C personnel performance regarding use and maintenance/surveillance of NUMAC RBVRM may be subject to NRC inspection.

8.0 TECHNICAL SPECIFICATION CHANGES The licensee proposed amendments to the Technical Specifications (TS) of Facility Operating License DPR-33, DPR-52, and DPR-68.

The proposed amendments would revise TS Section 3.2/4.2 to reflect the enhancement of the RBVRM systems by installing the more reliable and accurate NUMAC RBVRM.

The proposed BFN RBVRM TS changes involve (1) decreased channel functional testing and calibration frequency, (2) editorial changes, (3) an HVPS functional test, and (4) associated BASES changes.

The details of the TS changes are described in enclosure 2 of TVA's submittal dated July 23, 1992.

More specifically, TVA proposed the following TS changes:

Expanded Definition 12.a to include "digital" channels.

In Tables 3.2.A and 4.2.A, "Reactor Building Ventilation High Radiation" instrument channels for both Reactor Zone and Refuel Zone:

(a) Incorporate the word channel(s) into the remarks section for Table 3.2.A; (b) Delete from Table 3.2.A the referal to note (9),

and add a referral to note (14) for Unit 2 and note (15) for Units 1 and 3, then add note 14(15) at the end of Table 3.2.A to describe the new RBVRM system configuration and logic operation; (c) Add allowed outage times for conducting RBVRM functional testing and calibration to note (11) at the end of Table 3.2.A; (d) Delete referral to note (22) from Table 4.2.A, and delete note (22) from the end of Table 4.2.A as the allowed outage times would not be contained in note (11) of Table 3.2.A; (e) Add a referral to Table 4.2.A for note (31) of Unit 1, note (32) of Unit 2, and note (30) of Unit 3, then add these notes to the end of Table 4.2.A to define the functional and channel functional testing requirements of the NUMAC RBVRM system; and (f) Revisethe calibration frequency of Table 4.2.A from "3 months" to "18 months."

Revise associated BASES to provide an expanded discussion on the basis for the NUMAC RBVRM allowed outage times and frequencies of calibration, functional testing and channel functional testing.

The staff reviewed TVA's proposed editorial changes and associated BASES revisions, and concluded they were acceptable.

Those portions of the above

13 -

changes dealing with decreasing the channel functional testing and calibration frequency, and HVPS functional test, are addressed below.

Using conservative parameters, the NUMAC RBVRM subsystem channel calibration frequency was calculated to be once per fuel cycle.

A cycle is defined as 18 month + 25%.

This is a substantial increase over the previous calibration frequency of once every 90 days.

The potential drift sources for the NUMAC RBVRM instrument loop include the GM tube, the DS&C's discriminator, the high voltage power supplies (HVPS),

and the digital circuits located in the RBVRM chassis.

The DS&C's discriminator and digital circuit located in the RBVRM chassis add a negligible amount to the channel drift due to the precision components used and the characteristics of the digital instrument.

However, the GM tube and the HVPS are considered to be the main contributor to the instrument drift.

The GM tube drifts by 2%

per plant cycle, and HVPS drifts a maximum of 15 volts per month.

These values are obtained from the manufacturer.

However, for the drift calculation, a 4% drift per cycle for the GM tube, and a maximum HVPS drift limit of 27 volts were used.

The results of the drift calculations were documented in the GE-NE-533-20-0492.

Based on the above information and results, the staff accepts the licensee's proposal to change the NUMAC RBVRM subsystem channels calibration frequency from once every 90 days to once every cycle.

Furthermore, the staff finds acceptable the licensee's proposal to perform an HVPS functional test every 30 days to limit HVPS drift to 12 Volts.

Defense against the common mode/cause failures of the NUMAC RBVRM was discussed in Section 6 above.

Based on this discussion, TVA's letter dated April 6, 1993, and the highly reliable nature of the components used in NUMAC RBVRM equipment (i.e., mean time between failure of components is very long),

the staff accepts the licensee's proposal to change the NUMAC RBVRM subsystem channels functional test frequency to once every cycle.

9.0 REFERENCES

1.

NEDO-31974P "NUMAC Qualification Report for RBVRM System for TVA BFNP Units 1, 2, and 3," November 1991.

2.

Letter from 0. J. Zeringue, Tennessee Valley Authority to Nuclear Regulatory Commission, dated March 16, 1993, "Browns Ferry Units 1, 2, and 3 Application for Amendment to Facility Operating Licenses DPR-33, DPR-52, and DPR-68, Section 3.2/4.2, Technical Specifications, Response to NRC Request for Additional Information, NRC Docket Nos. 50-259, 50-260, and 50-296."

14 -

10.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Alabama State official was notified of the proposed issuance of the amendment.

The State official had no comments.

11.0 ENVIRONMENTAL CONSIDERATION

Pursuant to 10 CFR 51.21, 51.32, and 51.35, an environmental assessment and and finding of no significant impact was published in the Federal Register on April 13, 1993 (58 FR 19281).

Accordingly, based upon the environmental assessment, the Commission has determined that issuance of the amendments will not have a significant effect on the quality of the human environment.

12.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that:

(1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors:

E. Lee and T. Ross Date:

April 13, 1993

UNITED STATES NUCLEAR REGULATORY COMMISSION TENNESSEE VALLEY AUTHORITY DOCKET NOS.

50-259. 50-260, AND 50-296 NOTICE OF ISSUANCE OF AMENDMENTS TO FACILITY OPERATING LICENSES The U.S. Nuclear Regulatory Commission (Commission) has issued Amendment Nos. 195, 210, and 167 to Facility Operating License Nos.

DRP-33, DPR-52, and DPR-68 issued to the Tennessee Valley Authority (TVA, the licensee) which revised the Technical Specifications for operation of the Browns Ferry Nuclear Plant, Units 1, 2, and 3 located in Limestone County, Alabama.

The amendment is effective as of the date of issuance.

The amendments modified the Technical Specifications to reflect a system modification that upgrades the Reactor Building Ventilation Radiation Monitoring system.

This upgrade replaces existing analog components with digital equipment from the General Electric Company's Nuclear Measurement Analysis and Control product line.

The application for the amendments complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations.

The Commission has made appropriate findings as required by the Act and the Commission's rules and regulations in Ag 10 CFR Chapter I, which are set forth in the license amendment.

0-0 Notice of Consideration of Issuance of Amendment and Opportunity for

§U Hearing in connection with this action was published in the FEDERAL REGISTER 9

on October 26, 1992 (57 FR 48532).

No request for a hearing or petition for 0

leave to intervene was filed following this notice.

- 2 The Commission has prepared an Environmental Assessment related to the action and has determined not to prepare an environmental impact statement.

Based upon the environmental assessment, the Commission has concluded that the issuance of this amendment will not have a significant effect on the quality of the human environment (58 FR19281).

For further details with respect to the action see (1) the application for amendments dated July 23, 1992, as supplemented by March 16 and April 6,

1993, (2) Amendment Nos.
195, 210, and 167 to License Nos. DPR-33, DPR-52, and DPR-68, (3) the Commission's related Safety Evaluation, and (4) the Commission's Environmental Assessment.

All of these items are available for public inspection at the Commission's Public Document Room, the Gelman Building, 2120 L Street NW.,

Washington, DC 20555 and at the local public document room located at the Athens Public Library, South Street, Athens, Alabama 35611.

Dated at Rockville, Maryland this 13th day of April 1993.

FOR THE NUCLEAR REGULATORY COMMISSION Frederick J. H don, Director Project Directorate 11-4 Division of Reactor Projects - I/I1 Office of Nuclear Reactor Regulation