Text

Application for Amendment to Facility Operating License Re Revision of Safety Limits and Instrumentation Setpoints
	ML021020362
Person / Time
Site:	Ginna
Issue date:	04/09/2002
From:	Mecredy R; Rochester Gas & Electric Corp
To:	Clark R; Document Control Desk, NRC/NRR/DLPM/LPD1
References
	Download: ML021020362 (178)
	v • d • e

T A Subsidiary of RGS Energy Group, Inc.

ROCHESTER GAS AND ELECTRIC CORPORATION 0 89 EASTAVENUE, ROCHESTER, N.Y 14649-0001

716 546-2700 www.rge.com ROBERT C. MECREDY Vice President Nuclear Operations April 9, 2002 U.S. Nuclear Regulatory Commission Document Control Desk Attn: Robert L. Clark Project Directorate I-1 Washington, D.C. 20555

Subject:

Application for Amendment to Facility Operating License Revision to Safety Limits and Instrumentation Setpoints Rochester Gas & Electric Corporation R.E. Ginna Nuclear Power Plant Docket No. 50-244 Dear Mr. Clark The enclosed License Amendment Request (LAR) proposes to revise the Ginna Station Improved Technical Specifications (ITS) associated with Safety Limits (Section 2.1),

Instrumentation (Sections 3.3.1, 3.3.2, 3.3.4, and 3.3.5), and the Core Operating Limits Report (COLR) (Section 5.6.5).

The purpose of this LAR is to revise Chapter 3.3 of the Ginna Station ITS to provide a clear and consistent identification of instrumentation setpoints and their operability basis. This amendment is based on an NRC-approved travelers, TSTF-355 and TSTF-365. Specifically, setpoints for the following Limiting Condition for Operations (LCOs) are being revised:

3.3.1, Reactor Trip System (RTS) Instrumentation 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation 3.3.4, Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation 3.3.5, Containment Ventilation Isolation (CVI) Instrumentation In addition to the setpoint changes, the following changes are being requested since they are related to Chapter 3.3:

1. The Reactor Safety Limits Figure 2.1.1-1 is being relocated to the COLR consistent with NUREG-1431 and NRC-approved traveler, TSTF-339 Revision 2, loco\-

2. Additional surveillances are added to ITS Table 3.3.1-1 Function 6 to provide consistency with Ginna Station testing practices,

3. Constants associated with ITS Table 3.3.1-1 Functions 5 and 6 are being relocated to the COLR consistent with NURG-1431 and NRC-approved traveler, TSTF-339 Revision 2, which also results in a change to ITS section 5.6.5, and

4. Additional requirements are added to ITS Table 3.3.2-1 and ITS Table 3.3.5-1 to specify all related CVI inputs.

Approval of this amendment application is requested at your earliest convenience. RG&E requests that upon NRC approval, this LAR should be effective immediately and implemented within 90 days.

Very truly yours, Robert C. Mecredy //

Attachments:

I. License Amendment Request II. No Significant Hazards Consideration Determination III. Environmental Impact Consideration Determination IV. Marked up Copy of R.E. Ginna Nuclear Power Plant Improved Technical Specifications and COLR V. Proposed Revised R.E. Ginna Nuclear Power Plant Improved Technical Specifications VI. Simplified Containment Isolation and Containment Ventilation Isolation Diagram.

Enclosures:

1. EP-3-S-0505, Instrument Setpoint/Loop Accuracy Calculation Methodology

2. DA EE-92-041-21, Instrument Loop Performance Evaluation and Setpoint Verification Instrument Loop Number CV P945 xc: Mr. Robert L. Clark (Mail Stop O-8-C2)

Project Directorate I Division of Licensing Project Management Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Regional Administrator, Region 1 U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406 Ginna Senior Resident Inspector Mr. William M. Flynn, President New York State Energy, Research, and Development Authority Corporate Plaza West 286 Washington Avenue Extension Albany, NY 12203-6399 Mr. Paul Eddy NYS Department of Public Service 3 Empire Plaza Albany, NY 12223 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION In the Matter of )

)

Rochester Gas and Electric Corporation ) Docket No. 50-244 (R.E. Ginna Nuclear Power Plant) )

APPLICATION FOR AMENDMENT TO OPERATING LICENSE Pursuant to Section 50.90 of the regulations of the U.S. Nuclear Regulatory Commission (NRC), Rochester Gas and Electric Corporation (RG&E), holder of Facility Operating License No. DPR-18, hereby requests that the Technical Specifications set forth in Appendix A to that license, be amended. This request for change is to revise several instrumentation setpoints contained in Chapter 3.3 of the Technical Specifications to provide a clear reference point with respect to operability. Other instrument related surveillance and requirement changes are made to be consistent with existing Ginna Station testing practices and design. The Reactor Safety Limits Figure 2.1.1-1 is being relocated to the COLR consistent with NUREG-1431.

A description of the amendment request, necessary background information, and justification of the requested change are provided in Attachment I. The no significant hazards consideration determination is provided as Attachment II. The environmental impact consideration determination is provided as Attachment III. A marked up copy of the current Ginna Station Improved Technical Specifications which shows the requested change is set forth in Attachment IV. The proposed revised Improved Technical Specifications are provided in Attachment V.

The evaluation set forth in Attachment I and III demonstrates that the proposed change does not involve a significant change in the types or a significant increase in the amounts of effluents or any change in the authorized power level of the facility. The proposed change also does not involve a significant hazards consideration, as documented in Attachment II.

WHEREFORE, Applicant respectfully requests that Appendix A to Facility Operating License No. DPR-18 be amended in the form attached hereto as Attachment V.

Rochester Gas and Electric Corporation By __ _A Robert C. Mecrecy Vice President Nuclear Operations Group Subscribed and sworn to before me on this 9th day of April 2002.

Notary Public SHARON L.MLUR Notary Public, StatoafNmk Monoe~Confy l legfstratlt*-No,01*U01 Attachment I R.E. Ginna Nuclear Power Plant LICENSE AMENDMENT REQUEST REVISION TO SAFETY LIMITS AND INSTRUMENTATION SETPOINTS This attachment provides a description of the amendment request and necessary justification for the proposed changes. The attachment is divided into four sections as follows. Section A identifies all changes to the current Ginna Station Improved Technical Specifications (ITS) while Section B provides the background and history associated with the changes being requested. Section C provides detailed justification for the proposed changes. Section D lists all references used in Attachments I, II, and III.

A. DESCRIPTION OF AMENDMENT REQUEST This LAR proposes to revise the Ginna Station ITS to clarify instrument related operability requirements. Other instrument related surveillance and requirement changes are made to be consistent with existing Ginna Station testing practices and design. The Reactor Safety Limits Figure 2.1.1-1 is being relocated to the COLR consistent with NUREG- 1431. The change is summarized below and shown in Attachments IV and V.

1. 2.1

a. The Reactor Safety Limits Figure 2.1.1-1 is being relocated to the Core Operating Limits Report (COLR). The figure is being replaced with limits for departure from nucleate boiling ratio (DNBR) and peak fuel centerline temperature. This change is consistent with WCAP-14483-A (Reference 1),

NUREG-1431 (Reference 2), and TSTF-339 Revision 2.

2. LCO 3.3.1

a. Table 3.3.1-1 is being revised to replace the column heading "Trip Setpoint" with "Allowable Value." The values provided in this column are revised consistent with the Ginna Station setpoint analysis described later in this attachment. This change is consistent with NUREG- 1431 (Reference 2) and TSTF-355.

b. Table 3.3.1-1, Function #6 is being revised to add two new surveillance requirements (SRs). The addition of these SRs ensures that the Overtemperature AT and Overpower AT instrumentation channel operability requirements are treated consistent with operating practice.

c. The Notes associated with Table 3.3.1-1, Function #5 and #6 are being revised to relocate the Overtemperature AT and Overpower AT setpoint parameter constant values to the COLR. This change is consistent with WCAP-14483-A (Reference 1), NUREG- 1431 (Reference 2), and TSTF-339 Revision 2.

3. LCO 3.3.2

a. Table 3.3.2-1 is being revised to remove the "Trip Setpoint" column. The "Allowable Value" column is revised consistent with the Ginna Station setpoint analysis described later in this attachment. This change is consistent with NUREG- 1431 (Reference 2) and TSTF-3 55.

b. Table 3.3.2-1 Function #1 is being revised to include a requirement for manual Safety Injection operability during Mode 4. This aligns the Applicability of the manual actuation with that of LCO 3.3.5.

c. Table 3.3.2-1 Function #3 is being revised to include a requirement for manual Containment Isolation operability during core alterations and movement of irradiated fuel assemblies in containment. A clarification is also being made that only automatic Safety Injection leads to a containment isolation signal. This is consistent with the Ginna Station design.

4. LCO 3.3.4

a. SR 3.3.4.2 is being revised to remove the "Trip Setpoint" column. This change is consistent with NUREG- 1431 (Reference 2).

b. Upper voltage limits are also being added for degraded voltage and loss of voltage. This change is consistent with NUREG-1431 and TSTF-365.

5. LCO 3.3.5

a. The MODE OF APPLICABILTY is relocated to Table 3.3.5-1.

b. Table 3.3.5-1 is being revised to replace the column heading "Trip Setpoint" with "Allowable Value." The values referenced in this column are revised consistent with the Ginna Station setpoint analysis.

c. A clarification is being made that only manual Containment Isolation leads to a containment ventilation isolation (CVI) signal. This is consistent with the Ginna Station design.

d. A reference to Safety Injection requirements per LCO 3.3.2 Function 1 is provided in Table 3.3.5-1 since this also generates a CVI signal.

6. 5.6.5

a. The Core Operating Limits Report (COLR) section 5.6.5 is being revised to include a reference to 2.1, LCO 3.3.1, and also a reference to an additional WCAP.

B. BACKGROUND B. 1 History During the NRC review of a proposed instrument setpoint change related to Main Steam isolation on high steam flow coincident with safety injection (SI) and low Tavg (ITS Table 3.3.2-1, Function 4.d), questions were raised with respect to operability decisions and these setpoints. Specifically, Table 3.3.2-1 contains two setpoint columns, "Trip Setpoint" and "Allowable Value." The bases for LCO 3.3.2 state that "the Trip Setpoints are the limiting values at which the bistables are set. If the measured setpoint exceeds the Trip Setpoint Value, the bistable is considered OPERABLE unless the Allowable Value as specified in plant procedures is exceeded." Consequently, operability decisions for instrumentation channels was being defined and controlled within plant procedures. The "Allowable Value" column within ITS serves no other purpose than to specify a value used in the Ginna Station accident analysis. In addition, other instrument LCOs (e.g., Table 3.3.1-1) only specified a "Trip Setpoint" column with no "Allowable Value." A meeting was subsequently held with representatives of RG&E and the NRC (Reference 3) to discuss this issue and a proposed resolution. RG&E proposed to submit an application for amendment to revise the form of the instrumentation tables contained within ITS Chapter 3.3, Instrumentation, to provide a single "Allowable Value" column that uses a common basis for channel operability.

Additional details on these issues are provided below.

In September 1969, Ginna Station was issued a provisional operating license (POL),

including technical specifications (TS). These TS contained setpoints for the reactor trip system (RTS), but no other instrument related setpoints. In POL Amendment No. 38, setpoints for 480V safeguard bus undervoltage were added via a curve (Reference 4) while setpoints for the engineered safety feature actuation system (ESFAS) and containment ventilation isolation (CVI) were added by POL Amendment No. 42 (Reference 5). Finally, setpoints for the control room isolation on high radiation and toxic gas were issued by full term operating license (FTOL) Amendment No. 9 (Reference 6). However, with issuance of each amendment, the basis for the newly specified setpoints was different. This is summarized below:

a. The original 1969 TS contained setpoints for the RTS that were typically the upper limit of the tolerance band for the specified channel. For example, the Power Range Neutron Flux - High function (ITS Table 3.3.1-1, Function 2.a) has a field setpoint (referred to as a "nominal trip setpoint") of 108% rated thermal power (RTP). The accident analysis uses a value (or "analytical limit") of 118% RTP (see UFSAR Table 15.0-4). However, the TS specify a value of _*109% RTP which is between the nominal trip setpoint and analytical limit. A value of 1% higher than the nominal trip setpoint is the typical tolerance value associated with instrument channels (see section B.3 below). The bases for LCO 3.3.1 state that the "Trip Setpoint" is the operability basis since a channel is considered inoperable "when the "as found" value exceeds the Trip Setpoint specified in Table 3.3.1-1".

b. The 480V undervoltage setpoints were originally specified as a curve, but converted to actual numbers during the conversion to ITS (Reference 7). The "Trip Setpoint" specified in SR 3.3.4.2 is the nominal trip setpoint while the "Allowable Value" is the actual analytical limit.

c. The ESFAS setpoints in ITS Table 3.3.2-1 contain both "Trip Setpoints" and "Allowable Values." However, as described above, the "Trip Setpoint" is the nominal trip setpoint and the "Allowable Value" is the analytical limit. The channel operability limit is defined in plant procedures.

d. The control room ventilation isolation (LCO 3.3.6) and CVI (LCO 3.3.5) specifications only contain a "Trip Setpoint" column which is meant to provide both the nominal trip setpoint and the operability limit similar to LCO 3.3.1.

These issues were discussed in detail with NRC staff during a meeting on July 9, 1998 (Reference 3) at which time RG&E proposed to submit a LAR that would revise all five LCOs to provide a single "Allowable Value" column that uses a common basis for channel operability. Proposed changes to LCO 3.3.6 have been previously addressed under a separate amendment request (Reference 8). Section B.3 below summarizes how these "Allowable Values" were generated while Enclosure 2 provides an example setpoint calculation for the Containment Pressure Transmitters.

In the course of resolving the instrument operability basis, issues were identified with missing surveillances for ITS Table 3.3.1-1 Function 6, and inconsistencies with the description of manual and automatic functions for CVI (LCO 3.3.5). These items are included within this LAR for completeness.

As the result of referring to NUREG-1431 revision 2 as guidance for the proposed change to the instrumentation tables, previously approved generic changes to the Standard Technical Specifications were identified. These changes include the relocation of the Overtemperature AT and Overpower AT setpoint parameter constant values to the Core Operating Limits Report (COLR) and the relocation of the Reactor Safety Limits Figure 2.1.1-1 to the COLR.

These generic changes have been previously approved by the NRC, as documented in WCAP-14483-A (Reference 1) and TSTF-339 Revision 2. Upper voltage limits are also being added to SR 3.3.4.2 for degraded voltage and loss of voltage Loss of Power (LOP)

Diesel Generator (DG) Start Instrumentation. This proposed change is intended to prevent the unnecessary separation of the offsite power system and is consistent with TSTF-365.

B.2 Hardware Modifications There are no hardware modifications required to implement this LAR. The requested changes are related to providing instrumentation setpoints with more clearly defined operability requirements and changing requirements to be more consistent with Ginna Station design and testing practices.

B.3 Setpoint Analysis Summary The Ginna Station Setpoint Verification Program (SVP) is designed to document the acceptability of safety-related instrumentation setpoints as used in the accident analysis and emergency operating procedures (EOPs). The following are several terms which are defined for consistent use and application in the setpoint verification process. See also Figure 1 to this attachment.

Nominal Trip Setpoint - The value at which a given instrument channel is expected to trip or actuate. This value is surrounded by a tolerance band, typically 1%, since it is recognized that a bistable or relay cannot continuously be set for a single exact value. Consequently, the SVP assumes that the "as left" instrument channel value is the Nominal Trip Setpoint plus or minus the non-conservative tolerance band (e.g., the Power Range Neutron Flux - High "as left" value assumed in the SVP is the nominal trip setpoint of 108% + 1% tolerance band or 109% RTP).

Calculated Trip Setpoint - The maximum value at which the Nominal Trip Setpoint would normally be allowed to be set. This value is calculated by taking the Analytical Limit minus the TLU.

Analytical Limit - The value at which the accident analysis assumes the instrument channel will trip. The SVP documents the analytical limit is met by comparing the Nominal Trip Setpoint with the Calculated Trip Setpoint.

Allowable Value - The value documented in the SVP that is used in the ITS as the operability setpoint. This value is generated by taking the Calculated Trip Setpoint and adding to it the applicable Channel Operational Test (COT) Uncertainty (see below) for component(s) located between the testing point and the bistable or relay that is verified during periodic COTs. For example, the COT for the containment pressure instrument channels (see , Figure 1) is performed by sending a current signal through the test jack until bistable PC-945A/B trips. Consequently, only COT Uncertainties for the test point resister and bistable must be considered. In addition, only COT Uncertainties for the test point resister and bistable under normal testing conditions must be included since it is non conservative to include accident uncertainties for operability requirements based on the COT.

Total Instrument Uncertainty (TIU) - The total uncertainty assigned to each component within the instrument channel. This value is generated by calculating the squared root of the summed squares (SRSSs) of the component's individual uncertainties. For example, uncertainties are calculated separately for process measurement (PMU), measurement and test equipment (M&TEU), accident environment (AEU), accident current leakage (CLU),

instrument rack (REU), sensor (SU), drift (DU), tolerance (TU) effects.

Note that a TIU may not include all of the above effects, only those which are relevant to the component (e.g., a pressure transmitter would include the sensor uncertainty but not the instrument rack uncertainties).

COT Uncertainty-The TIU uncertainty associated with the Channel Operational Test, which typically includes calibration setting tolerance, accuracy and drift values. The M&TE uncertainty for the M&TE being used for the COT is not included.

Total Loop Uncertainty(TLU) - The total uncertainty assigned to the entire instrument loop for a specific channel. This is generated by calculating the SRSSs of each of the applicable instrument TIUs (see above description).

The SVP is basically comprised of setpoint calculations for each required instrument channel. Each calculation documents the instrument channel being evaluated, performance requirements (e.g., EOP setpoints and analytical limits), calculation uncertainties, and generaton of TIUs, TLUs, and Allowable Values. Enclosure 1 provides the administrative design standard which was prepared to establish a consistent methodology for use in the preparation of instrument setpoint and uncertainty calculations. Enclosure 2 provides a sample setpoint calculation for the Ginna Station containment pressure transmitters.

Specifically, Section 10.3 documents the calculation of the Allowable Values proposed to be added to the ITS.

C. JUSTIFICATION OF CHANGES This section provides the justification for all changes described in Section A above and shown on Attachments IV and V. The justifications are organized based on whether the change is: more restrictive (M), less restrictive (L), administrative (A), or the requirement is relocated (R). The justifications listed below are also referenced in the technical specification(s) which are affected (see Attachment IV).

C. 1 More Restrictive M.1 Two new surveillance requirements are added to ITS Table 3.3.1-1 Function 6, related to the comparison and calibration of the excore channels to agree with incore detector measurements. The Ginna Station Overtemperature AT and Overpower AT instrument channels both have inputs from the excore instrumentation as shown in Notes 1 and 2 to Table 3.3.1-1 (f Al inputs) and as such, the current SR 3.3.1.3 and SR 3.3.1.6 should be applicable to both. Performance of these new surveillance will provide a higher assurance of the operability of the instrumentation. These surveillance requirements are not listed in NUREG-1431 for the Overpower AT function, as the f(AI) input was previously set to [0] (Revision 2 of NUREG-1431 moved the setpoint parameter constant values to the COLR).

M.2 Upper voltage limits are being added to ITS SR 3.3.4.2 for degraded voltage and loss of voltage Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation. This proposed change is based on a recommendation from the NRC that the Westinghouse Standard Technical Specifications (STS) were the only industry STS that did not specify an upper limit for these values. This generic change (TSTF-365) was incorporated into Revision 2 of NUREG-1431. This requirement is intended to prevent the unnecessary separation of the offsite power system following the increased electrical loading associated with a Design Basis Accident (DBA) if the offsite system voltage is adequate to power the safety systems.

C.2 Administrative A.1 ITS Tables 3.3.1-1, 3.3.2-1, 3.3.5-1, and SR 3.3.4.2 are being changed to include only an "Allowable Value" column format. This change is consistent with NUREG

-1431 Revision 2 and the Ginna Station Setpoint Verification Program (SVP). It also provides consistent terminology for instrumentation requirements within the ITS, with the "Allowable Value" providing a clearly defined basis for operability. The actual determination of the Allowable Value for each of these tables is controlled in the Ginna Station SVP A.2 ITS Tables 3.3.2-1 and 3.3.5-1 are being changed to more accurately address the Ginna Station design for Containment Isolation (CI) and Containment Ventilation Isolation (CVI) actuation signals. The current Table 3.3.2-1 Function #3.c description would suggest that any Safety Injection (SI) signal will result in a CI actuation, when by design, only an automatic SI will result in CI. The current Table 3.3.5-1 Function #3 description would suggest that any CI signal will result in a CVI actuation, when by design, only a manual CI signal will directly result in CVI. Table 3.3.5-1 also does not currently list SI as a required Function, when by design, any SI signal will result in a CVI. These Functions are depicted in an attached simplified diagram (Attachment VI). These changes will result in the Technical Specifications being consistent with the Ginna Station design.

As a result of these changes, there are also changes being proposed for the modes of applicability for LCO 3.3.2 and LCO 3.3.5. A requirement for manual SI to be operable during Mode 4 is being added to Table 3.3.2-1 Function #1.a, as this provides a signal for CVI. A requirement for manual CI to also be operable during core alterations and movement of irradiated fuel assemblies inside containment is being added to Table 3.3.2-1 Function #3.a, as this also provides a signal for CVI.

The modes of applicability for LCO 3.3.5 are being moved to Table 3.3.5-1, such that they may be specifically associated with a Function.

These changes are considered administrative in nature due to the interaction between Tables LCO 3.3.2 and LCO 3.3.5 in regards to SI, CI, and CVI, and simply clarify the requirements based on current design. The changes maintain and strengthen the requirement for both manual and automatic initiation of CVI. The movement of the LCO 3.3.5 modes of applicability to Table 3.3.5-1 is in compliance with NUREG 1431.

C.3 Relocated R.1 ITS Reactor Safety Limits (RSL) Figure 2.1.1-1 is being relocated to the Core Operating Limits Report (COLR), and the limits for departure from nucleate boiling ratio (DNBR) and peak fuel centerline temperature are being added to LCO 2.1.1 in its place. The most significant reason for replacing the RSL figure is that there are limitations associated with the figure that could result in drawing an incorrect conclusion with respect to the DNB design basis. Drawing a correct conclusion with respect to the safety limits is an important consideration given the ramifications associated with the violation of a safety limit. As noted in WCAP-14483-A (Reference 1), the violation of a safety limit could only result if the reactor protection system were not functioning as designed. The reactor protection system and main steam system safety valves ensure that all the safety limits will be met, independent of the RSL figure. Using the figure to determine whether or not a safety limit had been violated is marginal at best. In the event of a Condition I or II transient, verification that the reactor protection system and the main steam system safety valves are functioning as designed will ensure that all safety limits are met. In the very low probability occurrence that the reactor protection system is not functioning as designed, an evaluation of any transient condition would be required to determine whether or not the DNB design basis is satisfied.

It is proposed that the RSL figure be relocated to the COLR (Specification 5.6.5) and be replaced with the DNBR design basis limit and the fuel centerline melting limit, which are taken from the Ginna Station UFSAR. Both ofthese limits are criteria that must be satisfied for all Condition I and II transients. Confirmation that the reactor protection system and the main steam system safety valves are functioning as designed will ensure that both the DNB design basis and fuel centerline melting criteria are satisfied for any Condition I or II event. With this approach, the chance of reaching an incorrect conclusion with respect to the safety limits would be greatly reduced, if not eliminated. It should be noted that using the DNBR and fuel centerline melting criteria, in combination with ensuring compliance with the TS prior to the initiation of an event, satisfies 10CFR50.36 and is also consistent with NUREG- 1431, Revision 2.

R.2 The ITS Table 3.3.2-1 Notes 1 and 2 Overtemperature (OT) AT and Overpower (OP)

AT setpoint parameter constant values are being relocated to the Core Operating Limits Report (COLR). The justification for moving the OTAT and OPAT setpoint parameter values (Ks, ts, and f(AI) functions) to the COLR is based on several considerations. These considerations are based primarily on the fact that the OTAT and OPAT setpoints are based on several parameters which are considered to be important reload design parameters. This is discussed further below.

A. The design basis of the OTAT reactor trip setpoint, in conjunction with the OPAT setpoint, is to ensure that on a 95/95 basis that DNB is precluded. The OTAT and OPAT setpoints are calculated using the Reactor Safety Limits (RSLs) and the Axial Offset Limits, as described in Reference 9. The RSLs present the locus of RCS T-inlet conditions at various pressures and power levels, for a specific RCS total flow rate and a limiting reference axial power shape, where the DNBR safety analysis limit is satisfied and where exit boiling is precluded. The DNB limits are calculated using the FAH which is the enthalpy rise in the hottest channel of the core relative to the enthalpy rise in the average channel of the core. The RSLs are a key reload design input which is verified on a cycle-specific basis as part of the reload process.

Changes in reload related parameters, such as the FAH, can impact the RSLs and thus the OTAT (and OPAT) reactor trip setpoints on a cycle specific basis.

B. The Axial Offset Limits are used to generate the f(AI) penalty function of the OTAT setpoint which reduces the setpoint for highly skewed axial power shapes to ensure that the DNB design basis is satisfied. The Axial Offset Limits are calculated based on the allowable peaking factors and the axial offset control strategy used for normal operation and are verified on a cycle specific basis. The peaking factors and axial offset control strategy parameters are TS limits whose values have been previously relocated to the COLR. A change in any of these limit values could result in a change to the Axial Offset Limits and thus a change to the OTAT reactor trip setpoint on a cycle-specific basis.

C. The OTAT and OPAT setpoints are included in the reload process and can be used to ensure that fuel design criteria are satisfied. It is possible that the OTAT/OPAT setpoints may need to be revised on a cycle-specific basis to ensure that the fuel rod design criteria are satisfied. Thus, it is possible that cycle-specific reload designs could result in changes to the OTAT and/or OPAT reactor trip setpoints.

Given the above, there is sufficient justification for moving the OTAT and OPAT setpoint parameter values to the COLR (Specification 5.6.5). This justification includes: 1) the setpoints are based on core design parameters which are verified on a cycle-specific basis, 2) the setpoints can be used on a cycle-specific basis to verify fuel design criteria, and 3) the setpoints typically have significant amounts of margin built into them, which currently cannot be fully utilized. This change is consistent with WCAP-14483-A and TSTF-339, Revision 2.

There are not any less restrictive (L) changes associated with this LAR.

D. REFERENCES I1. WCAP-14483-A, Generic methodology for Expanded Core Operating Limits Report.

2. NUIREG- 143 1, Revision 2, Standard Technical Specifications Westinghouse Plants.

3. Letter to file from Guy S. Vissing (NRC), "Summary of Meeting with Representatives of Rochester Gas and Electric Corporation (RG&E) July 9, 1998, Concerning a Proposed Change in the Engineered Safeguards Features Actuation System Instrumentation Technical Specifications Chapter 3.3", dated August 7, 1999.

4. Letter from Dennis M. Crutchfield (NRC) to John E. Maier (RG&E), "Amendment No. 38 to Provisional Operating License No. DPR-18 for the R.E. Ginna Nuclear Power Plant", March 26, 1981.

5. Letter from Dennis M. Crutchfield (NRC) to John E. Maier (RG&E), "TMI-2 Category "A" Items", May 11, 1981.

6. Letter from John A. Zwolinski (NRC) to Roger W. Kober (RG&E), "TMI Action Plan Technical Specifications", July 30, 1985, 1981.

7. Letter from Allen R. Johnson (NRC) to Dr. Robert C. Mecredy (RG&E), "Issuance of Amendment No. 61 to Facility Operating License No. DPR-18, R.E. Ginna Nuclear Power Plant", February 13, 1996.

8. Letter from Robert C. Mecredy (RG&E) to Guy S. Vissing (NRC), "Application for Amendment to Facility Operating License, Control Room Emergency Air Treatment System (CREATS) Actuation Instrumentation Change (LCO 3.3.6)", May 3, 2001.

9. WCAP-8745, Design Basis for the Thermal Overpower AT and Thermal Overtemperature AT Trip Functions.

Analytical Limit (specified in Accident Analysis)

TLU TI-Uof component A TIU of component B Allowable Value I (specified in ITS)

! "CalculatedTrip Setpoint (determined in SVP)

+/- tolerance band Nominal Trip Setpoint (specified in procedures)

Figure 1 Graphical Depiction of Ginna SVP Attachment II R.E. Ginna Nuclear Power Plant No Significant Hazards Consideration Evaluation The proposed changes to the Ginna Station Improved Technical Specifications as identified in Attachment I Section A and justified by Section C have been evaluated with respect to 10 CFR 50.92(c) and shown not to involve a significant hazards consideration as described below.

1) Operation of Ginna Station in accordance with the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

The Reactor Trip System (RTS) Instrumentation, Engineered Safety Feature Actuation System (ESFAS), Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation, and Containment Ventilation Isolation trip functions are part of the accident mitigation response and are not themselves an initiator for any transient. Therefore, the probability of an accident previously evaluated is not significantly affected, including the probability of a spurious actuation. This proposed amendment includes changes to Allowable Values that have been determined with the use of an accepted methodology. The new values ensure that all automatic protective actions will be initiated at or before the condition assumed in the safety analysis. This change will allow the nominal trip setpoints to be adjusted within the calibration tolerance band allowed by the setpoint methodology. Plant operation with these revised values will not cause any design or analysis acceptance criteria to be exceeded. The structural and functional integrity of plant systems is unaffected. There will be no adverse effect on the ability of the channels to perform their safety functions as assumed in the safety analyses. Since there will be no adverse effect on the trip setpoints or the instrumentation associated with the trip setpoints, there will be no significant increase in the consequences of any accident previously evaluated.

Other changes in trip system function, content and format are proposed based on the current configuration of the trip system hardware. Similarly, since the ability of the instrumentation to perform its safety function is not adversely affected, there will be no significant increase in the consequences of any accident previously evaluated. The proposed editorial, administrative and format changes do not affect plant safety and are in accordance with NUREG-1431.

The proposed change to relocate core safety limits and trip setpoint parameter values to the Core Operating Limits Report (COLR) is a programmatic and administrative change that does not physically alter safety-related systems, nor does it affect the way in which safety related systems perform their functions. Because the design of the facility and system operating parameters are not being changed, the proposed amendment does not involve a significant increase in the probability or consequences of any accident previously evaluated.

The cycle-specific values relocated into the COLR will continue to be controlled by the Ginna Station programs and procedures. Accident analyses addressed in the UFSAR will be examined with respect to changes in the cycle-dependent parameters, which are obtained from the use of NRC approved reload design methodologies, to ensure that the transient evaluation of new reloads are bounded by previously accepted analyses. This examination, which will be conducted per the requirements of 10 CFR 50.59, will ensure that future reloads will not involve a significant increase in the probability or consequences of an accident previously evaluated. Therefore, the probability or consequences of an accident previously evaluated is not significantly increased.

2) Operation of Ginna Station in accordance with the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

The proposed amendment includes changes to the format and magnitudes of nominal trip setpoints and allowable values that preserve all safety analysis assumptions related to accident mitigation. The protection system will continue to initiate the protective actions as assumed in the safety analysis. The proposed changes to will continue to ensure that the trip setpoints are maintained consistent with the setpoint methodology and the plant safety analysis. Plant operation will not be changed.

Other proposed changes are made so that the technical specifications more accurately reflect the installed plant specific trip system hardware. Furthermore, the proposed changes do not alter the functioning of the protection systems. No new mode of failure has been created and no new equipment performance requirements are imposed. The proposed amendment has no affect on any previously evaluated accident.

The proposed change to relocate core safety limits and trip setpoint parameter values to the COLR is a programmatic and administrative change and does not result in any change in the manner in which the plant is operated or the way in which the Reactor Trip System provides plant protection. All of the accident transients analyzed in the UFSAR will continue to be protected by the same trip functions with the required trip setpoints. Removal of the cycle specific variables has no influence or impact on, nor does it contribute in any way to the probability or consequences of an accident. No safety-related equipment, safety function, or plant operation will be altered as a result of this proposed change. The cycle specific variables are calculated using the NRC approved methods, and submitted to the NRC to allow the staff to continue to review the values of these limits. The technical specifications will continue to require operation within the core operating limits, and appropriate actions will be required if these limits are exceeded. Therefore, the possibility for a new or different kind of accident from any accident previously evaluated is not created.

3) Operation of Ginna Station in accordance with the proposed changes do not involve a significant reduction in a margin of safety. The proposed trip setpoint Allowable Values are calculated with an accepted methodology. The proposed changes will continue to ensure that the trip setpoints are maintained consistent with the setpoint methodology and the plant safety analysis. The response of the protection system to accident transients reported in the Updated Final Safety Analysis Report (UFSAR) is unaffected by this change. Therefore, accident analysis acceptance criteria are not affected.

Other proposed changes are made so that the protection system technical specifications more accurately reflect the plant-specific trip system hardware. The proposed change does not involve revisions to any safety limits or safety system setting that would adversely impact plant safety. The proposed change does not alter the functional capabilities assumed in a safety analysis for any system, structure, or component important to the mitigation and control of design bases accident conditions within the facility. Nor does this change revise any parameters or operating restrictions that are assumptions of a design basis accident. In addition, the proposed change does not affect the ability of safety systems to ensure that the facility can be placed and maintained in a shutdown condition for extended periods of time.

The proposed change to relocate core safety limits and trip setpoint parameter values to the COLR represents an administrative change and no hardware changes are involved; therefore, no accident analysis acceptance criteria are affected. The margin of safety is not affected by the removal of cycle specific core operating limits from the technical specifications. The margin of safety presently provided by current technical specifications remains unchanged.

Appropriate measures exist to control the values of these cycle specific limits. The proposed amendment continues to require operation within the core limits as obtained from NRC approved methodologies, and the actions to be taken if a limit is exceeded. The development of the limits for future reloads will continue to conform to those methods described in NRC approved documentation. In addition, each future reload will involve a 10 CFR 50.59 review. The proposed amendment is a programmatic and administrative change that provides assurance that plant operations continue to be conducted in a safe manner. The proposed amendment does not result in any change in the manner in which the plant is operated or the way in which the Reactor Trip System (RTS) provides plant protection. The proposed relocation does not alter the manner in which safety limits, limiting safety system setpoints or limiting conditions for operation are determined. Therefore, the response of the RTS to accident transients described in the UFSAR is unaffected by this change. As stated previously, this portion of the proposed amendment does not physically alter safety-related systems, nor does it affect the way in which safety-related systems perform their functions.

The accident transients are unaffected and the safety analysis acceptance limits are unaffected. The design of the facility and system operating parameters are not being changed. Therefore, this change does not involve a significant reduction in a margin of safety.

Based upon the preceding information, it has been determined that the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated, create the possibility of a new or different kind of accident from any accident previously evaluated, or involve a significant reduction in a margin of safety. Therefore, it is concluded that the proposed changes meet the requirements of 10 CFR 50.92(c) and do not involve a significant hazards consideration.

Attachment III R.E. Ginna Nuclear Power Plant Environmental Impact Consideration Determination RG&E has evaluated the proposed changes and determined that:

1. The changes do not involve a significant hazards consideration as documented in Attachment II; and

2. The changes do not involve a significant change in the types or significant increase in the amounts of any effluent that may be released offsite since there is no change in accident assumptions; and

3. The changes do not involve a significant increase in individual or cumulative occupational radiation exposure since no new or different type of equipment are required to be installed as a result of this LAR.

Accordingly, the proposed changes meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), an environmental assessment of the proposed changes is not required.

Attachment IV R.E. Ginna Nuclear Power Plant Marked up Copy of R.E. Ginna Nuclear Power Plant Improved Technical Specifications and COLR Included pages:

2.0-1 to 2.0-2 3.3.1-1 to 3.3.1-16 3.3.2-1 to 3.3.2-10 3.3.4-1 to 3.3.4-2 3.3.5-1 to 3.3.5-3 5.6-1 to 5.6-5 B 2.1.1-1 to B 2.1.1-5

B 3.3.1-1 to B 3.3.1-44

B 3.3.2-1 to B 3.3.2-32

B 3.3.4-1 to B 3.3.4-7

B 3.3.5-1 to B 3.3.5-6*

B 3.4.1-1 to B 3.4.1-5

COLR-2 to COLR- 11 These Bases and COLR pages are being provided for information only to show the changes that RG&E intends to make following approval of the LAR. The Bases and COLR are under RG&E control for all changes in accordance with Specification 5.5.13 and Specification 5.6.5. RG&E requests that the NRC document acceptance of these Bases and COLR changes in the SER.

SLs 2.0 2.0 SAFETY LIMITS (SLs) 2.0 SLs and SL Violations 2.1 SLs 2.1.1 Reactor Core SLs In MODES 1 and 2, the combination of THERMAL POWER, Reactor Coolant System (RCS) average tem erature, and pressurizer pressure shall not exceed the Ls specified in 2.1.2 RCS Pressure SL i-* D_.

In MODES 1, 2, 3, 4, and 5, the RCS pressure shall be maintained *2735 psig.

2.2 SL Violations 2.2.1 If SL 2.1.1 is violated, restore compliance and be in MODE 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

2.2.2 If SL 2.1.2 is violated:

2.2.2.1 In MODE 1 or2, restore compliance and be in MODE 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

2.2.2.2 In MODE 3, 4, or 5, restore compliance within 5 minutes.

R.E.: Ginna t. i2.0-1m(3 Powe PIan A, 4endm R.E. Ginna Nuclear Power Plant 2.0-1 Amendment 0

SLs 2.0 0.5 0.6 0.7 0.8 0.9 1.0 1.1 1.2 (Fraction of Nominal)

"Figure 2.1.1-1 Reactor Safety Limits R.E. Ginna Nuclear Power Plant 2.0-2 AmendmentO

RTS Instrumentation 3.3.1 3.3 INSTRUMENTATION 3.3.1 Reactor Trip System (RTS) Instrumentation LCO 3.3.1 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1-1.

ACTIONS

- NOTE Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Enter the Condition Immediately with one channel referenced in Table 3.3.1-1 inoperable, for the channel(s).

OR Two source range channels inoperable.

B. As required by Required B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Action A.1 and referenced OPERABLE status.

by Table 3.3.1-1.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition B not AND met.

C.2 Initiate action to fully insert 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months all rods.

AND C.3 Place Control Rod Drive 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months System in a condition incapable of rod withdrawal.

R.E. Ginna Nuclear Power Plant 3.3.1-1 Amendment,89

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME D. As required by Required D.1 Action A.1 and referenced ---- -------

by Table 3.3.1-1. - NOTE The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months E. As required by Required E.1 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Action A.1 and referenced to < 5E-11 amps.

by Table 3.3.1-1.

OR E.2

- NOTE Required Action E.2 is not applicable when:

a. Two channels are inoperable, or

b. THERMAL POWER is

< 5E-11 amps.

Increase THERMAL 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months POWER to > 8% RTP.

F. As required by Required F.1 Open RTBs and RTBBs Immediately upon Action A.1 and referenced upon discovery of two discovery of two by Table 3.3.1-1. inoperable channels. inoperable channels AND F.2 Suspend operations Immediately involving positive reactivity additions.

AND F.3 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

R.E. Ginna Nuclear Power Plant 3.3.1-2 Amendment(8ý0

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME G. Required Action and G.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition D, E, or F is not met.

H. As required by Required H.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced channel to OPERABLE discovery of two by Table 3.3.1-1. status upon discovery of two inoperable channels inoperable channels.

AND H.2 Suspend operations Immediately involving positive reactivity additions.

AND H.3 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

Required Action and 1.1 Initiate action to fully insert Immediately associated Completion all rods.

Time of Condition H not met. AND 1.2 Place the Control Rod Drive 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months System in a condition incapable of rod withdrawal.

J. As required by Required J.1 Suspend operations Immediately Action A.1 and referenced involving positive reactivity by Table 3.3.1-1. additions.

AND J.2 Perform SR 3.1.1.1. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter R.E. Ginna Nuclear Power Plant 3.3.1-3 Amendment 0*

RTS Instrumentation 3.3.1 CONDITION [ REQUIRED ACTION COMPLETION TIME K. As required by Required K.1 Action A. 1 and referenced ------------

by Table 3.3.1-1. - NOTE The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months L. Required Action and L.1 ReduceTHERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion to < 8.5% RTP.

Time of Condition K not met.

M. As required by Required M.1 Action A.1 and referenced- ----------

by Table 3.3.1-1. -NOTE The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months N. As required by Required N.1 Restore channel to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action A.1 and referenced OPERABLE status.

by Table 3.3.1-1.

0. Required Action and 0.1 Reduce THERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion to < 50% RTP.

Time of Condition M or N not met.

P. As required by Required P.1 Action A.1 and referenced- -----------

by Table 3.3.1-1. - NOTE The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months R.E. Ginna Nuclear Power Plant 3.3.1-4 Amendment i*"

RTS Instrumentation 3.3.1 CONDITION I REQUIRED ACTION I COMPLETION TIME

0. Required Action and Q.1 ReduceTHERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion to < 50% RTP.

Time of Condition P not met. AND Q.2.1 Verify Steam Dump System 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months is OPERABLE.

OR Q.2.2 ReduceTHERMAL POWER 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months to <.8% RTP.

R. As required by Required R.1 Action A. 1 and referenced ------------

by Table 3.3.1-1. - NOTE One train may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing provided the other train is OPERABLE.

Restore train to OPERABLE 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months status.

S. As required by Required S.1 Verify interlock is in required 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Action A.1 and referenced state for existing plant by Table 3.3.1-1. conditions.

OR S.2 Declare associated RTS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Function channel(s) inoperable.

R.E. Ginna Nuclear Power Plant 3.3.1-5 Amendments,

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION J COMPLETION TIME T. As required by Required T.1 Action A.1 and referenced -----------

Table 3.3.1-1. NOTE by 1. One train may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing, provided the other train is OPERABLE.

2. One RTB may be bypassed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance on undervoltage or shunt trip mechanisms, provided the other train is OPERABLE.

Restore train to OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months status.

U. As required by Required U.1 Restore at least one trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced mechanism to OPERABLE discovery of two by Table 3.3.1-1. status upon discovery of two inoperable trip RTBs with inoperable trip mechanisms mechanisms.

AND U.2 Restore trip mechanism to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

V. Required Action and V.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition R, S, T, or U not met.

W. As required by Required W.1 Restore at least one trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced mechanism to OPERABLE discovery of two by Table 3.3.1-1. status upon discovery of two inoperable trip RTBs with inoperable trip mechanisms mechanisms.

AND R.E. Ginna Nuclear Power Plant 3.3.1-6 Amendmentg"*

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME W.2 Restore trip mechanism or 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months train to OPERABLE status.

X. Required Action and X.1 Initiate action to fully insert Immediately associated Completion all rods.

Time of Condition W not met. AND X.2 Place the Control Rod Drive 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months System in a Condition incapable of rod withdrawal.

SURVEILLANCE REQUIREMENTS Refer to Table 3.3.1 -1 to determine which SRs apply for each FITS Function.

SURVEILLANCE FREQUENCY S R 3.3. 1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.1.2 - NOTE Required to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is >! 50% RTP.

Compare results of calorimetric heat balance 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months calculation to Nuclear Instrumentation System (NIS) channel output and adjust if calorimetric power is

> 2% higher than indicated NIS power.

SR 3.3.1.3 ------- NOTE - ---------------

1. Required to be performed within 7 days after THERMAL POWER is >: 50% RTP but prior to exceeding 90% RTP following each refueling and if the Surveillance has not been performed within the last 31 EFPD.

2. Performance of SR 3.3.1.6 satisfies this SR.

Compare-results of the incore detector measurements ;31 effective full to NIS AFD and adjust if absolute difference is >: 3%. power days (EFPD)

R.E. Ginna Nuclear Power Plant 3.3.1-7 Amendment(5

RTS Instrumentation 3.3.1 SURVEILLANCE F FREQUENCY SR 3.3.1.4 Perform TADOT. 31 days on a STAGGEREDTEST BASIS SR 3.3.1.5 Perform ACTUATION LOGIC TEST. 31 days on a STAGGEREDTEST BASIS SR 3.3.1.6 - NOTE Not required to be performed until 7 days after THERMAL POWER is _>50% RTP, but prior to exceeding 90% RTP following each refueling.

Calibrate excore channels to agree with incore 92 EFPD detector measurements.

S R3.3.1.7 N-OTE Not required to be performed for source range instrumentation prior to entering MODE 3 from MODE 2 until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after entering MODE 3.

Perform COT. 92 days

- NOTE SR 3.3.1.8

1. Not required for power range and intermediate range instrumentation until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power < 6% RTP.

2. Not required for source range instrumentation until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power < 5E-11 amps.

Perform COT. 92 days

- NOTE SR 3.3.1.9 Setpoint verification is not required.

Perform TADOT. 92 days R.E. Ginna Nuclear Power Plant 3.3.1-8 Amendment(8:70

RTS Instrumentation 3.3.1 SURVEILLANCE FREQUENCY SR 3.3.1.10 -NOTE Neutron detectors are excluded.

Perform CHANNEL CALIBRATION. 24 months SR 3.3.1.11 Perform TADOT. 24 months SR 3.3.1.12 ....---------- OE ----------------

Setpoint verification is not required.

Perform TADOT. Prior to reactor startup if not performed within previous 31 days SR 3.3.1.13 Perform COT. 24 months R.E. Ginna Nuclear Power Plant 3.3.1-9 Amendmen d~

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER (9 SPECIFIED REQUIRED SURVEILLANCE CONDITIONS CHANNELS CONDITIONS REQUIREMENTS FUNCTION

1. Manual Reactor Trip 1,2, 2 B,C SR 3.3.1.11 NA 3(a), 4 (a), 5 (a)

2. Power Range Neutron Flux

a. High 1,2 4 D,G SR 3.3.1.1 SR 3.3.1.2 RTP SR 3.3.1.7 SR 3.3.1.10 D,G SR 3.3.1.1 <5l RTP

b. Low 1(b), 2 4 SR 3.3.1.8 SR 3.3.1.10 SR 3.3.1.1 (C)

3. Intermediate Range 1 (b), 2 2 E,G SR 3.3.1.8 Neutron Flux SR 3.3.1.10 F,G SR 3.3.1.1 (c)

4. Source Range 2 (d) 2 SR 3.3.1.8 Neutron Flux SR 3.3.1.10 2 H,I SR 3.3.1.1 (c) 3 (a), 4 (a), 5 (a)

SR 3.3.1.7 SR 3.3.1.10 SR 3.3.1.1 NA 3(e), 4 (e), 5 (e) 1 SR 3.3.1.10

5. Overtemperature AT 1,2 4 D,G SR 3.3.1.1 Refer to SR 3.3.1.3 Note 1 SR 3.3.1.6 SR 3.3.1.7 SR 3.3.1.10

6. Overpower AT 1,2 4 D,G SR 3.3.1.1 Refer to SR 3.3.1.7 Note 2 SR 3.3. 1. 10 R.E. Ginna Nuclear Power Plant 3.3.1-10 Amendmentc_'*

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE CONDITIONS CHANNELS CONDITIONS REQUIREMENTS FUNCTION

7. Pressurizer Pressure

a. Low 4 K,L SR 3.3.1.1 (186,)sig SR 3.3.1.7 SR 3.3.1.10 2410(o

b. High 1,2 3 D,G SR 3.3.1.1 SR 3.3.1.7 SR 3.3.1.10

8. Pressurizer Water 1,2 3 D,G SR 3.3.1.1 Level-High SR 3.3.1.7 SR 3.3.1.10

9. Reactor Coolant Flow-Low

a. Single Loop 1 (g) 3 per loop M,O SR 3.3.1.1 SR 3.3.1.7 SR 3.3.1.10 iiID

b. Two Loops 1(h) 3 per loop K,L SR 3.3.1.1 SR 3.3.1.7 SR 3.3.1.10

10. Reactor Coolant Pump (RCP)

Breaker Position

a. Single Loop 1 (g) 1 per RCP N,O SR 3.3.1.11 NA

b. Two Loops 1 per RCP K,L SR 3.3.1.11 NA 2 per bus K,L SR 3.3.1.9 (c)

11. Undervoltage Bus 11A and 11B SR 3.3.1.10

12. Underfrequency 1 (f) 2 per bus K,L SR 3.3.1.9 Bus 11A and 11B SR 3.3.1.10 R.E. Ginna Nuclear Power Plant 3.3.1-11 Amendment(8J

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE LLOVA(IIf5 MODES OR V4LVE C OTHER SPECIFIED REQUIRED SURVEILLANCE TRIP FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS SETPOINT

13. Steam Generator 1,2 3 per SG D,G SR 3.3.1.1 (SG) Water Level- SR 3.3.1.7 Low Low SR 3.3.1.10

14. Turbine Trip 3 P,Q SR 3.3.1.10 (c)

a. Low Autostop 1 (j)(k)

Oil Pressure SR 3.3.1.12

b. Turbine Stop 1 (J)(k) 2 Po SR 3.3.1.12 NA Valve Closure

15. Safety Injection (SI) 1,2 2 R,V SR 3.3.1.11 NA Input from Engineered Safety Feature Actuation System (ESFAS) 3.3.1-12 Amendmrent 8((8 R.E. Ginna Nuclear Power Plant

RTS Instrumentation 3.3.1 Table 3.3.1-1 Reactor Trip System Instrumentation APPLICABLE ALL-0 1-/4 &45 MODES OR fvJA4 I OTHER SPECIFIED REQUIRED SURVEILLANCE CHANNELS CONDITIONS REQUIREMENTS TRImý2 FUNCTION CONDITIONS

16. Reactor Trip System Interlocks

a. Intermediate (d) 2 S,V SR 3.3.1.10 2

Range SR 3.3.1.13 amp Neutron Flux, P-6

b. Low Power 4 (power range S,V SR 3.3.1.10 RTP 1 Mf)

Reactor Trips only) SR 3.3.1.13 Block, P-7

c. Power Range 4 S,V SR 3.3.1.10 aro RTP 1 (g)

Neutron Flux, SR 3.3.1.13 P-8 Power Range 4 S,V SR 3.3.1.10 RTP

d. 1 (k)

Neutron Flux, SR 3.3.1.13 P-9

10) 4 S,V SR 3.3.1.10 0% RTP SR 3.3.1.13

e. Power Range 1 (b), 2 4 S,v SR 3.3.1.10 _#/o RTP Neutron Flux, SR 3.3.1.13 P-10

17. Reactor Trip 1,2 2 trains T,V SR 3.3.1.4 NA 3(a), 4 (a), 5 (a) 2 trains W,X SR 3.3.1.4 NA Breakers(')

18. Reactor Trip 1,2 1 each per RTB U,V SR 3.3.1.4 NA Breaker 3 (a), 4 (a), 5 (a) 1 each per RTB W,X SR 3.3.1.4 NA Undervoltage and Shunt Trip Mechanisms

19. Automatic Trip Logic 1,2 2 trains R,V SR 3.3.1.5 NA 3(a), 4 (a), 5 (a) 2 trains w,X SR 3.3.1.5 NA R.E. Ginna Nuclear Power Plant 3.3.1-13 Amendment*

RTS Instrumentation 3.3.1 (a) With Control Rod Drive (CRD) System capable of rod withdrawal or all rods not fully inserted.

(b) THERMAL POWER < 6% RTP.

(c) UFSAR Table 7.2-3.

(d) Both Intermediate Range channels < 5E-11 amps.

(e) With CRD System incapable of withdrawal and all rods fully inserted. In this condition, the Source Range Neutron Flux function does not provide a reactor trip, only indication.

(f) THERMAL POWER Ž:8.5% RTP.

(g) THERMAL POWER Ž50% RTP.

(h) THERMAL POWER > 8.5% RTP and Reactor Coolant Flow-Low (Single Loop) trip Function blocked.

(i) THERMAL POWER > 8.5% RTP and RCP Breaker Position (Single Loop) trip Function blocked.

(j) THERMAL POWER > 8% RTP, and either no circulating water pump breakers closed, or condenser vacuum < 20".

(k) THERMAL POWER > 50% RTP, 1 of 2 circulating water pump breakers closed, and condenser vacuum > 20".

(I) Including any reactor trip bypass breakers that are racked in and closed for bypassing an RTB.

R.E. Ginna Nuclear Power Plant 3.3.1-14 Amendment@8*

RTS Instrumentation 3.3.1 Table 3.3.1-1 (Note 1)

Overtemperature AT S- NOTE- -

The Overtemperature AT Function Trip Setpoint is defined b Overtemperature AT _AT0 {K1 + K2 (P-P') - K3 (T-T') [(1+tlS) / (l+t 2 s)] - f(AI)}

Where:

AT is measured RCS AT, OF.

AT0 is the indicated AT at RTP, OF.

s is the Laplace transform operator, sec"1 .

T is the measured RCS average temperature, OF.

T' is the nominal Tavg at RTP, OF.

P is the measured pressurizer pressure, psig.

P' is the nominal RCS operating pressure, psig.

K1 is the Overtemperature AT reactor trip setpoint,C. C K2 is the Overtemperature AT reactor trip depressurization setpoint penalty coefficient, K3 is the Overtemperature AT reactor trip heatup setpoint penalty coefficient,0OO2 0 F.

t, is the measured leadatime constant, ýVeconds. f-]

"T 2 is the measured ea-lAg time constant, (geconds. j f(AI) is a function of the indicated difference between the top and bottom detectors of the Power Range Neutron Flux channels where qt and qb are the percent power in the top and bottom halves of the core, respectively, and qt + qb is the total THERMAL POWER in percent RTP.

f(AI) = 0 when qt - qb is*64< RTP f(AI) =*{(qt- qb) - when qt - qb is >{* o RTP R--- G N P P m-

-m-R.E. Ginna Nuclear Power Plant 3.3.1-15 Amendment*

RTS Instrumentation 3.3.1 Table 3.3.1-1 (Note 2)

Overpower AT S.

. .. . . .- . . . N E The Overpower AT Functionf S t is d'efined ýby.

LIA71 Overpower AT < AT0 {K4 - K5 (T-T') - K6 [('C3 sT) / (1 3s+1)] - f(AI)}

Where:

AT is measured RCS AT, OF.

AT0 is the indicated AT at RTP, OF.

s is the Laplace transform operator, sec-1 .

T is the measured RCS average temperature, IF.

T' is the nominal Tavg at RTP, OF.

K4 is the Overpower AT reactor trip setpoint, 1 .077.

K5 is the Overpower AT reactor trip heatup setpoint penalty coefficient which is:

(Z// I g OFforT<T'and; j/OF for T > T'. S:Ia°51 K6 is the Overpower AT reactor trip thermal time delay setpoint penalty which is:

( 0. °F for increasing T and; for decreasi T.

t 3 is the measured q.ýiag time constant, 6 econds.

(E7 f(AI) is a function of the indicated difference between the top and bottom detectors of the Power Range Neutron Flux channels where qt and qb are the percent power in the top and bottom halves of the core, respectively, and qt + qb is the total THERMAL POWER in percent RTP.

f(AI)=C04 when qt - qb is <5o RTP f(AI) = (qt - qb) -6 15 when qt - qb is >e*i2 RTP R.E. Ginna Nuclear Power Plant 3.3.1-16 Amendment97

ESFAS Instrumentation 3.3.2 3.3 INSTRUMENTATION 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation LCO 3.3.2 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.2-1.

ACTIONS

-NOTE Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION JCOMPLETION TIME A. One or more Functions A.1 Enter the Condition Immediately with one channel or train referenced in Table 3.3.2-1 inoperable, for the channel or train.

B. As required by Required B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Action A.1 and referenced OPERABLE status.

by Table 3.3.2-1.

C. Required Action and C.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition B not met.

D. As required by Required D.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Action A.1 and referenced OPERABLE status.

by Table 3.3.2-1.

E. As required by Required E.1 Restore train to OPERABLE 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action A. 1 and referenced status.

by Table 3.3.2-1.

R.E. Ginna Nuclear Power Plant 3.3.2-1 Amendmentg,

ESFAS Instrumentation 3.3.2 CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Action A.1 and referenced

- NOTE by Table 3.3.2-1.

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of the other channels.

Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months G. Required Action and G.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition D, E, or AND F not met.

G.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months H. As required by Required H.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Action A.1 and referenced OPERABLE status.

by Table 3.3.2-1.

As required by Required 1.1 Restore train to OPERABLE 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action A.1 and referenced status.

by Table 3.3.2-1.

J. As required by Required J.1 Action A.1 and referenced- ----------

by Table 3.3.2-1. - NOTE The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of the other channels.

Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months K. Required Action and K.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition H, I, or AND J not met.

K.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Amendment @

R.E. Ginna Nuclear Power Plant 3.3.2-2

ESFAS Instrumentation 3.3.2 CONDITION REQUIRED ACTION COMPLETION TIME L. As required by Required L.1 Action A.1 and referenced -----------

by Table 3.3.2-1. - NOTE The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of the other channels.

Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months M. Required Action and M.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition L not AND met.

M.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to < 2000 psig.

N. As required by Required N.1 Declare associated Auxiliary Immediately Action A.1 and referenced Feedwater pump inoperable by Table 3.3.2-1. and enter applicable condition(s) of LCO 3.7.5, "Auxiliary Feedwater (AFW)

System."

SURVEILLANCE REQUIREMENTS

-NOTE Refer to Table 3.3.2-1 to determine which SRs apply for each ESFAS Function.

SURVEILLANCE FREQUENCY SR 3.3.2.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.2.2 Perform COT. 92 days SR 3.3.2.3 - NOTE Verification of relay setpoints not required.

Perform TADOT. 92 days R.E. Ginna Nuclear Power Plant 3.3.2-3 Amendmentc*

ESFAS Instrumentation 3.3.2 SURVEILLANCE I FREQUENCY SR 3.3.2.4 - NOTE Verification of relay setpoints not required.

Perform TADOT. 24 months SR 3.3.2.5 Perform CHANNEL CALIBRATION. 24 months SR 3.3.2.6 Verify the Pressurizer Pressure-Low and Steam Line 24 months Pressure-Low Functions are not bypassed when pressurizer pressure > 2000 psig.

SR 3.3.2.7 Perform ACTUATION LOGIC TEST. 24 months R.E. Ginna Nuclear Power Plant 3.3.2-4 Amendmenta

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation Systeh Instrumentation APPLICABLE MODES OR SURVEIL OTHER LANCE ALLOW SPECIFIED REQUIRED CONDI- REQUIRE- ABLE FUNCTION CONDITIONS CHANNELS TIONS MENTS VALUE

1. Safety Injection

a. Manual 1,2,30 2 D,G SR 3.3.2.4 NA Initiation

b. Automatic 1,2,3,4 2 trains I,K SR 3.3.2.7 NA Actuation Logic and Actuation Relays

c. Containment 1,2,3,4 3 J,K SR 3.3.2.1 Pressure-High SR 3.3.2.2 SR 3.3.2.5 1igD

d. Pressurizer 3 L,M SR 3.3.2.1 Pressure-Low SR 3.3.2.2 psig SR 3.3.2.5 SR 3.3.2.6 0ý

e. Steam Line 1,2,3(a) 3 per steam L,M SR 3.3.2.1 2:ýKpsig Pressure-Low line SR 3.3.2.2 SR 3.3.2.5 SR 3.3.2.6 Amendment 89 R.E. Ginna Nuclear Power Plant 3.3.2-5

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR SURVEIL OTHER LANCE ALLOW SPECIFIED REQUIRED CONDI- REQUIRE- ABLE FUNCTION CONDITIONS CHANNELS TIONS MENTS VALUE

2. Containment Spray

a. Manual Initiation Left 1,2,3,4 1 H,K SR 3.3.2.4 NA pushbutton Right 1,2,3,4 1 H,K SR 3.3.2.4 NA pushbutton

b. Automatic 1,2,3,4 2 trains I,K SR 3.3.2.7 NA Actuation Logic and Actuation Relays

c. Containment 1,2,3,4 3 per set J,K SR 3.3.2.1 *<32.5 Pressure-High SR 3.3.2.2 High SR 3.3.2.5

3. Containment Isolation

a. Manual 1,2,3,40} 2 H,K SR 3.3.2.4 NA Initiation

b. Automatic 1,2,3,4 2 trains I,K SR 3.3.2.7 NA R13117 Actuation Logic and Actuation Relays

c. Safety Refer to Function 1 (Safety Injection) for all initiation Injection functions and requirements.

R.E. Ginna Nuclear Power Plant 3.3.2-6 AmendmentO

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR SURVEIL OTHER LANCE ALLOW SPECIFIED REQUIRED CONDI- REQUIRE- ABLE FUNCTION CONDITIONS CHANNELS TIONS MENTS VALUE

4. Steam Line Isolation

a. Manual 1 per loop D,G SR 3.3.2.4 NA Initiation

b. Automatic 2 trains E,G SR 3.3.2.7 NA

-1,2W,3&

Actuation Logic and Actuation Relays C9:D F,G SR 3.3.2.1

<*psig

c. Containment 1, 29,'3W 3 Pressure-High SR 3.3.2.2 High SR 3.3.2.5

d. High Steam 1,26T Or 2 per steam FG SR 3.3.2.1 Flow line SR 3.3.2.2 Ibm/hr @

SR 3.3.2.5 1005 psig Coincident Refer to Function 1 (Safety Injection) for all initiation with Safety functions and requirements.

Injection and 0

> 43 Coincident 1,29,O 2 per loop F,G SR 3.3.2.1 with Tavg-Low SR 3.3.2.2 SR 3.3.2.5 Lýiý

e. High-High 2 per steam F,G SR 3.3.2.1 Steam Flow line SR 3.3.2.2 Ibm/hr @

SR 3.3.2.5 755 psig Coincident Refer to Function 1 (Safety Injection) for all initiation with Safety functions and requirements.

Injection R.E. Ginna Nuclear Power Plant 3.3.2-7 Amendment*",

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR SURVEIL OTHER LANCE ALLOW SPECIFIED REQUIRED CONDI- REQUIRE- ABLE FUNCTION CONDITIONS CHANNELS TIONS MENTS VALUE

5. Feedwater Isolation

a. Automatic c1I 2 trains E,G SR 3.3.2.7 NA Actuation Logic and Actuation Relays ciý0

b. SG Water Level-High

,,Pro 3 per SG F,G SR 3.3.2.1 SR 3.3.2.2 SR 3.3.2.5

c. Safety Refer to Function 1 (Safety Injection) for all initiation Injection functions and requirements.

R.E. Ginna Nuclear Power Plant 3.3.2-8 Amendment4'

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR SURVEIL OTHER LANCE ALLOW SPECIFIED REQUIRED CONDI- REQUIRE- ABLE FUNCTION CONDITIONS CHANNELS TIONS MENTS VALUE

6. Auxiliary Feedwater (AFW)

a. Manual Initiation AFW 1,2,3 1 per pump N SR 3.3.2.4 NA Standby AFW 1,2,3 1 per pump N SR 3.3.2.4 NA

b. Automatic 1,2,3 2 trains E,G SR 3.3.2.7 NA Actuation Logic and Actuation Relays

c. SG Water 1,2,3 3 per SG F,G SR 3.3.2.1 Level-Low Low SR 3.3.2.2 SR 3.3.2.5

d. Safety Refer to Function 1 (Safety Injection) for all initiation Injection functions and requirements.

(Motor driven pumps only)

e. Undervoltage 1,2,3 2 per bus D,G SR 3.3.2.3 > (__5_ V Bus 11A and SR 3.3.2.5 with _ 3.6 11B (Turbine sec time driven pump delay only)

f. Trip of Both 1 2 per MFW B,C SR 3.3.2.4 NA Main pump Feedwater Pumps (Motor driven pumps only)

R.E. Ginna Nuclear Power Plant 3.3.2-9 Amendment(9

ESFAS Instrumentation 3.3.2 (a) Pressurizer Pressure 2 2000 psig.

C b7 Except when both MSIVs are closed and de-activated.

Except when all Main Feedwater Regulating and associated bypass valves are closed and de-activated or isolated by a closed manual valve.

16::-:

R.E. Ginna Nuclear Power Plant 3.3.2-10 Amendment w"

LOP DG Start Instrumentation 3.3.4 3.3 INSTRUMENTATION 3.3.4 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.4 Each 480 V safeguards bus shall have two OPERABLE channels of LOP DG Start Instrumentation.

APPLICABILITY: MODES 1, 2, 3, and 4, When associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources - MODES 5 and 6."

ACTIONS

-NOTE Separate Condition entry is allowed for each 480 V safeguards bus.

CONDITION ] REQUIRED ACTION COMPLETION TIME A. One or more 480 V A.1 Place channel(s) in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months bus(es) with one channel inoperable.

B. Required Action and B.1 Enter applicable Immediately associated Completion Condition(s) and Required Time of Condition A not Action(s) for the associated met. DG made inoperable by LOP DG start OR instrumentation.

One or more 480 V bus(es) with two channels inoperable.

R.E. Ginna Nuclear Power Plant 3.3.4-1 Amendment(qý

LOP DG Start Instrumentation 3.3.4 SURVEILLANCE REQUIREMENTS

- NOTE When a channel is placed in an inoperable status solely for the performance of required Surveillances, entry into the associated Conditions and Required Actions may be delayed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months provided the second channel maintains LOP DG start capability.

S- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

SURVEILLANCE FREQUENCY SR 3.3.4.1 Perform TADOT. j31 days 24 months SR 3.3.4 .2 Perform CHANNEL CALIBRATION with diii J*r~llowable Value for each 480 V bus as follows: ALI

a. Loss of voltage:

Allowable Value Trip Setpoint Bus voltage > 368 V > 372.8 V Time delay < 2.75 sec 2.4 +/- 0.12 sec

b. Degraded voltage:

Allowable Value Trip Setpoint Bus voltage >414V >419.2V Time delay < 1520 sec 1520 sec

a. Loss of voltage Allowable Value.-- 369.2 V and

<382.4 V with a time delay of 2!1.50 seconds and

<2.75 seconds.

b. Degraded voltage Allowable Value 2 414.8 V and

<431.2 V with a time delay of A30.7 seconds and

1520 seconds (@ 416.8 V) and Ž25.1 seconds and

<475 seconds (@ 368 V).

3.3.4-2 Amendment 8~

R.E. Ginna Nuclear Power Plant

Containment Ventilation Isolation Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Containment Ventilation Isolation Instrumentation LCO 3.3.5 The Containment Ventilation Isolation instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

, 4: "

_d____.A cc,/4;- 35*

APPLICABILITY: MODES 1,2,3, and 4,L During CORE ALTERATIONS, During movement of irra fu within me ACTIONS

-NOTE Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION [COMPLETION TIME A. One radiation monitoring A.1 Restore the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months channel inoperable, channel to OPERABLE status.

B. B.1 Enter applicable Conditions Immediately

. and Required Actions of

-NOTE - LCO 3.6.3, "Containment Only applicable in MODE Isolation Boundaries," for 1, 2, 3, or 4. containment mini-purge isolation valves made One or more Functions inoperable by isolation with one or more manual instrumentation.

or automatic actuation trains inoperable.

OR Both radiation monitoring channels inoperable.

OR Required Action and associated Completion Time of Condition A not met.

R.E. Ginna Nuclear Power Plant 3.3.5-1 Amendment(8ýO

Containment Ventilation Isolation Instrumentation 3.3.5 CONDITION REQUIRED ACTION COMPLETION TIME C. C.1 Place and maintain Immediately

.... - . -containment purge and

- NOTE - exhaust valves in closed Only applicable during position.

or CORE ALTERATIONS movement of irradiated OR fuel assemblies within containment. C.2 Enter applicable Conditions Immediately and Required Actions of One or more Functions LCO 3.9.3, "Containment with one or more manual Penetrations," for or automatic actuation containment purge and trains inoperable, exhaust isolation valves made inoperable by OR isolation instrumentation.

Both radiation monitoring channels inoperable.

OR Required Action and associated Completion Time for Condition A not met.

SURVEILLANCE REQUIREMENTS

- NOTE Refer to Table 3.3.5-1 to determine which SRs apply for each Containment Ventilation Isolation Function.

SURVEILLANCE FREQUENCY SR 3.3.5.1 Perform CHANNEL CHECK. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months SR 3.3.5.2 Perform COT. 92 days SR 3.3.5.3 Perform ACTUATION LOGIC TEST. 24 months SR 3.3.5.4 Perform CHANNEL CALIBRATION. 24 months R.E. Ginna Nuclear Power Plant 3.3.5-2 Amendmentgý

Containment Ventilation Isolation Instrumentation 3.3.5 Table 3.3.5-1 vA LI C Containment Ventilatiofn Isolation Instrumentation,-

,"-n FUNCTION REQUIRED SURVEILLANCE ýTRIP___

X~J4 A Plo7TYq/,

(AA'E MO D6S o kes59c~r7(q CHANNELS REQUIREMENTS SETPýOINT

_ z'&I-T1110w

1. Automatic Actuation Logic and Actuation Relays 2 trains SR 3.3.5.3 NA

2. Containment Radiation

a. Gaseous 1 SR 3.3.5.1

/1/

SR 3.3.5.2 SR 3.3.5.4

b. Particulate I, 5 9 (o.) SR 3.3.5.1 (A) (Q SR 3.3.5.2 SR 3.3.5.4

3. Containment Isolation Refer to LCO 3.3.2, "ESFAS Instrumentation,"

Function 3,for all initiation functions and requirements.

4. Containment Spray-Manual Initiation Refer to LCO 3.3.2, "ESFAS Instrumentation,"

Function 2.a, for all initiation functions and requirements.

, j, Per Radiological Effluent Controls Program.

R.E. Ginna Nuclear Power Plant 3.3.5-3 Amendment 60

Reporting Requirements 5.6 5.0 ADMINISTRATIVE CONTROLS 5.6 Reporting Requirements The following reports shall be submitted in accordance with 10 CFR 50.4.

5.6.1 Occupational Radiation Exposure Report A tabulation on an annual basis of the number of station, utility, and other personnel (including contractors) receiving exposures > 100 mrem/yr and their associated man rem exposure according to work and job functions (e.g., reactor operations and surveillance, inservice inspection, routine maintenance, special maintenance, waste processing, and refueling).

This tabulation supplements the requirements of 10 CFR 20.2206. The dose assignments to various duty functions may be estimated based on pocket dosimeter, thermoluminescent dosimeter (TLD), or film badge measurements. Small exposures totalling < 20% of the individual total dose need not be accounted for. In the aggregate, at least 80% of the total whole body dose received from external sources should be assigned to specific major work functions. The report shall be submitted on or before April 30 of each year.

5.6.2 Annual Radioloqical Environmental Operating Report The Annual Radiological Environmental Operating Report covering the operation of the plant during the previous calenaar year shall be submitted by May 15 of each year. The report shall include summaries, interpretations, and analyses of trends of the results of the radiological environmental monitoring activities for the reporting period. The material provided shall be consistent with the objectives outlined in the Offsite Dose Calculation Manual (ODCM), and in 10 CFR 50, Appendix I, Sections IV.B.2, IV.B.3, and IV.C.

The Annual Radiological Environmental Operating Report shall include the results of analyses of all radiological environmental samples and of all environmental radiation measurements taken during the period pursuant to the locations specified in the table and figures in the ODCM, as well as summarized and tabulated results of these analyses and measurements in the format of the table in the Radiological Assessment Branch Technical Position, Revision 1, November 1979. In the event that some individual results are not available for inclusion with the report, the report shall be submitted noting and explaining the reasons for the missing results. The missing data shall be submitted in a supplementary report as soon as possible.

R.E. Ginna Nuclear Power Plant 5.6-1 Amendmentd

Reporting Requirements 5.6 5.6.3 Radioactive Effluent Release Report The Radioactive Effluent Release Report covering the operation of the plant shall be submitted in accordance with 10 CFR 50.36a. The report shall include a summary of the quantities of radioactive liquid and gaseous effluents and solid waste released from the plant. The material provided shall be consistent with the objectives outlined in the ODCM and in conformance with 10 CFR 50.36a and 10 CFR 50, Appendix I, Section IV.B.1.

5.6.4 Monthly Operating Reports Routine reports of operating statistics and shutdown experience, including documentation of all challenges to the pressurizer power operated relief valves or pressurizer safety valves, shall be submitted on a monthly basis no later than the 15th of each month following the calendar month covered by the report.

5.6.5 CORE OPERATING LIMITS REPORT (COLR)

The following administrative requirements apply to the COLR:

a. Core operating limits shall be established prior to each reload cycle, or prior to any remaining portion of a reload cycle, and shall be documented in the COLR for the following:

N LCO 3.1.1, "SHUTDOWN MARGIN (SDM)";

LCO 3.1.3, "MODERATOR TEMPERATURE COEFFICIENT (MTC)";

LCO 3.1.5, "Shutdown Bank Insertion Limit";

LCO 3.1.6, "Control Bank Insertion Limits";

LCO 3.2.1, "Heat Flux Hot Channel Factor (FQ(Z))";

LCO 3.2.2, "Nuclear Enthalpy Rise Hot Channel Factor (FN AH)";

LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)";

LICO

'4O 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)

Limits"; and LCO 3.9.1, "Boron Concentration."

R.E. Ginna Nuclear Power Plant 5.6-2 Amendmentf8Y'*

Reporting Requirements 5.6

b. The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NRC, specifically those described in the following documents:

1. WCAP-9272-P-A, "Westinghouse Reload Safety Evaluation Methodology," July 1985. '2.

(Methodology fot*LCO 3.1.1, LCO 3.1.3, LCO 3.1.5, LCO 3.1.6, LCO 3.2.1, LCO 3.2.2, LCO 3.2.3, and LCO 3.9.1.)

2. WCAP-1 3677-P-A, "10 CFR 50.46 Evaluation Model Report:

WCOBRA/TRAC Two-Loop Upper Plenum Injection Model Updates to Support ZIRLOTM Cladding Option," February 1994.

(Methodology for LCO 3.2.1.)

3. WCAP-8385, "Power Distribution Control and Load Following Procedures - Topical Report," September 1974.

(Methodology for LCO 3.2.3.)

4. WCAP-12610-P-A, "VANTAGE + Fuel Assembly Reference Core Report," April 1995.

(Methodology for LCO 3.2.1.)

5. WCAP 11397-P-A, "Revised Thermal Design Procedure,"

April 1989.

(Methodology for LCO 3.4.1 when using RTDP.)

6. WCAP-1 0054-P-A and WCAP-1 0081 -A, "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code," August 1985.

(Methodology for LCO 3.2.1.)

7. WCAP-1 0924-P-A, Volume 1, Revision 1, "Westinghouse Large-Break LOCA Best-Estimate Methodology, Volume 1:

Model Description and Validation Responses to NRC Questions," and Addenda 1,2,3, December 1988.

(Methodology for LCO 3.2.1.)

/0A P 8. WCAP-1 0924-P-A, Volume 2, Revision 2, "Westinghouse Large-Break LOCA Best-Estimate Methodology, Volume 2:

Application to Two-Loop PWRs Equipped with Upper Plenum 0eJ 77, Injection," and Addendum 1, December 1988.

(Methodology for LCO 3.2.1.)

9. WCAP-1 0924-P-A, Volume 1, Revision 1, Addendum 4, "Westinghouse Large-Break LOCA Best-Estimate Methodology, Volume 1: Model Description and Validation, Addendum 4: Model Revisions," March 1991.

(Methodology for LCO 3.2.1.)

R.E. Ginna Nuclear Power PIlant 5.6-3 Amendment4

Reporting Requirements 5.6

c. The core operating limits shall be determined such that all applicable limits (e.g., fuel thermal mechanical limits, core thermal hydraulic limits, Emergency Core Cooling Systems (ECCS) limits, nuclear limits such as SDM, transient analysis limits, and accident analysis limits) of the safety analysis are met.

d. The COLR, including any midcycle revisions or supplements, shall be provided upon issuance for each reload cycle to the NRC.

5.6.6 Reactor Coolant System (RCS) PRESSURE AND TEMPERATURE LIMITS REPORT (PTLR)

The following administrative requirements apply to the PTLR:

a. RCS pressure and temperature limits for heatup, cooldown, criticality, and hydrostatic testing as well as heatup and cooldown rates shall be established and documented in the PTLR for the following:

LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits"

b. The power operated relief valve lift settings required to support the Low Temperature Overpressure Protection (LTOP) System, and the LTOP enable temperature shall be established and documented in the PTLR for the following:

LCO 3.4.6, "RCS Loops - MODE 4";

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";

LCO 3.4.10, "Pressurizer Safety Valves"; and LCO 3.4.12, "LTOP System."

c. The analytical methods used to determine the RCS pressure and temperature and LTOP limits shall be those previously reviewed and approved by the NRC in NRC letter, "R.E. Ginna - Acceptance for Referencing of Pressure Temperature Limits Report, Revision 2 (TAC No. M96529)," dated November 28, 1997. Specifically, the methodology is described in the following documents:

1. Letter from R.C. Mecredy, Rochester Gas and Electric Corporation (RG&E), to Document Control Desk, NRC, Attention: Guy S. Vissing, "Application for Facility Operating License, Revision to Reactor Coolant System (RCS)

Pressure and Temperature Limits Report (PTLR)

Administrative Controls Requirements," Attachment VI, R.E. Ginna Nuclear Power Plant 5.6-4 Amendment 00

Reporting Requirements 5.6 September 29, 1997, as supplemented by letter from R.C.

Mecredy, RG&E, to Guy S. Vissing, NRC, "Corrections to Proposed Low Temperature Overpressure Protection System Technical Specification," October 8, 1997.

2. WCAP-14040-NP-A, "Methodology used to Develop Cold Overpressure Mitigating System Setpoints and RCS Heatup and Cooldown Limit Curves," Sections 1 and 2, January, 1996.

d. The PTLR shall be provided to the NRC upon issuance for each reactor vessel fluence period and for revisions or supplement thereto.

R.E. Ginna Nuclear Power Plant 5.6-5 Amendm

Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core SLs BASES BACKGROUND Atomic Industrial Forum (AIF) GDC 6 (Ref. 1) requires that the reactor core shall be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits which have been stipulated and justified. This integrity is required during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).

This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95%

confidence level (the 95/95 DNB criterion) that DNB will not occur on the limiting fuel rods and by requiring that fuel centerline temperature stays below the melting temperature (Ref. 2).

The restrictions of this SL prevent overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.

Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.

Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium - water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.

The proper functioning of the Reactor Protection System (RPS) and main steam safety valves prevents violation of the reactor core SLs.

R.E. Ginna Nuclear Power Plant B 2. 1.1 -1 Revision 21

Reactor Core SLs B 2.1.1 APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY operation and AQOs. The reactor core SLs are established to preclude ANALYSES violation of the following fuel design criteria (Ref. 3):

a. The hot fuel pellet in the core must not experience centerline fuel melting; and

b. There must be at least 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB.

In meeting the DNB design criterion, uncertainties in plant operating parameters, nuclear and thermal parameters, fuel fabrication parameters and computer codes must be considered. The effects of these uncertainties have been statistically combined with the correlation uncertainty to determine design limit departure from nucleate boiling ratio (DNBR) values that satisfy the DNB design criterion. The observable parameters, thermal power, reactor coolant temperature and pressure have been related to DNB through the W-3 and/or WRB-1 DNB correlation. These DNB correlations have been developed to predict the DNB flux and the location of DNB for auxiliary uniform and non-uniform heat flux distributions. The local DNB heat flux ratio, defined as the ratio of the heat flux that would cause DNB at a particular core location to the local heat flux, is indicative of the margin to DNB. A minimum value of the DNB ratio is specified so that during steady state operation, normal operational transients and anticipated transients, there is a 95%

probability at a 95% confidence level that DNB will not occur.ffhecurves ofFigure B 2.1.1-1 represent the loci of points of thermal power, coolant system pressure and average temperature for which this minimum DNB value is satisfied. The area of safe operation is at or below these lines.

operation relative to Figure B 2.1.1 -1 refers to transient or accident lSafe conditions. Normal steady state operation is governed by LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits."

Additional DNBR margin is maintained by performing the safety analyses to a higher DNBR limit. This margin between the design and safety analysis limit DNBR values is used to offset known DNBR penalties (e.g.,

rod bow and transition core) and to provide DNBR margin for operating and design flexibility (Ref. 4).

The Reactor Trip System setpoints specified in LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation", in combination with all the LCOs, are designed to prevent any anticipated combination of trarisgent conditions ,-

for Reactor Coolant System (RCS) temperature, pr:essurize p ssure, and THERMAL POWER level that would result in a DNBR of less than the DNBR limit and preclude the existence of flow instabilities.

R.E. Ginna Nuclear Power Plant B 2.1.1 -2 Revision 21

Reactor Core SLs B 2.1.1 Automatic enforcement of these reactor core SLs is provided by the F ollowing functions (Ref. 5): ,

a. High pressurizer pressure trip; ,, 4, ,

b. Low pressurizer pressure trip;

c. Overtemperature AT trip;

d. Overpower AT trip;

e. Power Range Neutron Flux trip; and

f. Steam generator safety valves.

Additional anticipatory trip functions are also provided for specific abnormal conditions.

The SLs represent a design requirement for establishing the RPS trip setpoints identified previously. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," or the assumed initial conditions of the safety analyses (Ref. P)-provide more restrictive limits to ensure that the SLs are not exceeded."-*-0 SAFETY LIMITS 2.1.1 etdvl',9Ž ;^ 4.f'.e'. f4 '

74 Aigure 2. 1 - shows an example of the reactor core safe limit of THERMAL POWER, RCS pressure, and average temperature for which the minimum DNBR is greater than or equal to the safety analyses limit, that fuel centerline temperature remains below melting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, or that the core exit ualitv is within the limits defined b .. the DNBR

_ý at on.. rom t is type of figure, the u--esonFigr 1- ft aho h curves of C acgmayrg spcfication can be genrtd RiaurýQ.ý-ý.f7 asthree distinct slopes. Working from left to right, the frst slope ensures that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid such that overtemperature AT indication remains valid. The second slope ensures that the hot leg steam quality remains < 15%. The final slope ensures that DNBR is always > 1.4.

The SL is higher than the limit calculated when the Axial Flux Difference (AFD) is within the limits of the F(AI) function of the overtemperature AT reactor trip. When the AFD is not within the tolerance, the AFD effect on the overtemperature AT reactor trips will reduce the setpoints to provide protection consistent with the reactor core SLs.

JAErJl R.E. Ginna Nuclear Power Plant B 2.1.1-3 Revision 21

Reactor Core SLs B 2.1.1 APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves and automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the plant into MODE 3. Setpoints for the reactor trip functions are is not

' J" d*,*(,),,4 "-specified

-r,1 in LCO 3.3.1. In MODES 3, 4, 5, and 6, Applicability required since the reactor is not generating significant THERMAL

. (**):S*s,*,**',/POWER*

SAFETY LIMIT 2.2.1 VIOLATIONS If SL 2.1.1 is violated, the requirement to restore compliance and go to MODE 3 places the plant in a safe condition and in a MODE in which this SL is not applicable.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of bringing the plant to a MODE of operation where this SL is not applicable, and reduces the probability of fuel damage. If the Completion Time is exceeded, actions shall continue in order to bring the plant to a MODE of operation where this SL is not applicable.

REFERENCES 1. Atomic Industrial Forum (AIF) GDC 6, Issued for comment July 10, 1967.

2. Letter from J. A. Zwolinski, NRC, to R. W. Kober, RG&E,

Subject:

"Deletion of Information Pertaining to Definition of Hot Channel Factors," dated May 30, 1985.

3. UFSAR, Section 4.2.1.3.3.

4. UFSAR, Section 4.4.3.

5. WCAP-8745, "Design Bases for the Thermal Overpower Delta T) and Thermal Overtemperature Delta T Trip Functions," March 1977.-_-_----

5>

UFSAR, Section 7.2.1.1.1.

R.E. Ginna Nuclear Power Plant B 2.1.1-4 Revision 21

Reactor Core SLs B 2.1.1 475 70 % OPAT 65 20 0p 6 . 4 M0 pma*

60 % %, Locus of

/

//

U JI50 - 7 "%I \ %

O D

4-45 o ,,, ,, \MA,/

30 1lb1 565 570 575 580 585 590 595 600 605 610 615 620 625 630 T-AVG (°F)

Figure B 2.1.1-1 Reactor Core Safety Limits vs. Boundary of Protection R.E. Ginna Nuclear Power Plant B 2.1.1-5 Revision 21

RTS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES BACKGROUND Atomic Industry Forum (AIF) GDC 14 (Ref. 1) requires that the core protection systems, together with associated engineered safety features equipment, be designed to prevent or suppress conditions that could result in exceeding acceptable fuel design limits. The RTS initiates a plant shutdown, based on the values of selected plant parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the Engineered Safety Features (ESF)

Systems in mitigating accidents.

The installed protection and monitoring systems have been designed to assure safe operation of the reactor at all times. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RTS, as well as specifying LCOs with respect to these parameters and other reactor system parameters and equipment.

The LSSS, defined in this specification as the Trip Setpoints, in

[conjunction with the associated LCOs, establish the threshold for g Sprotective system action to prevent exceeding acceptable limits during k.Design=Basis Accidents (DBAs). :These acceptable limits are:

a. The Safety Limit (SL) values shall be maintained to prevent departure from nucleate boiling (DNB);

b. Fuel centerline melt shall not occur; and

c. The RCS pressure SL of 2735 psig shall not be exceeded.

,Operation within the SLs of Specification 2.0, "Safety Limits (SLs),"

maintains the above values and assures that offsite dose will be within 10 CFR 100 limits (Ref. 2) during AOOs.

DBAs are events that are analyzed even though they are not expected to occur during the plant life. The DBA acceptance limit is that offsite doses shall be maintained within an acceptable fraction of 10 CFR 100 limits (Ref. 2). There are five different accident categories which are organized based on the probability of occurrence (Ref. 3). Each accident category is allowed a different fraction of the 10 CFR 100 limits, inversely proportioned to the probability of occurrence. Meeting the acceptable dose limit for an accident category is considered as having acceptable consequences for that event.

R.E. Ginna Nuclear Power Plant B 3.3.1 -1 Revision 18

RTS Instrumentation B 3.3.1 The RTS instrumentation is segmented into three distinct but interconnected modules as described in UFSAR, Chapter 7 (Ref. 4):

a. Field transmitters or process sensors;

b. Signal process control and protection equipment; and

c. Reactor trip switchgear.

These modules are shown in Figure B 3.3.1-1 and discussed in more detail below.

Field Transmitters and Process Sensors Field transmitters and process sensors provide a measurable electronic signal based on the physical characteristics of the parameter being measured. To meet the design demands for redundancy and reliability, two, three, and up to four field transmitters or sensors are used to measure required plant parameters. To account for the calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are provided. These statistical allowances provide the basis for determining acceptable "as left" and "as found" calibration values for each transmitter or sensor as provided in established plant procedures.

Signal Process Control and Protection Equipment The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are defined in UFSAR, Chapter 7 (Ref. 4), Chapter 6 (Ref. 5), and Chapter 15 (Ref. 6). If the measured value of a plant parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the logic relays.

Generally, three or four channels of process control equipment are used for the signal processing of plant parameters measured by the field transmitters and sensors. If a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are typically sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function can still be accomplished with a two-out-of-two logic. If one channel fails in a direction that a partial Function trip occurs, a trip will not occur unless a second channel fails or trips in the remaining one-out-of-two logic.

R.E. Ginna Nuclear Power Plant 6 3.3.1-2 Revision 18

RTS Instrumentation B 3.3.1 If a parameter has no measurable setpoint and is only used as an input to the protection circuits (e.g., manual trip functions) two channels with a one-out-of-two logic are sufficient. A third channel is not required since no surveillance testing is required during the time period in which the parameter is required.

If a parameter is used for input to the protection system and a control function, four channels with a two-out-of-four logic are typically sufficient to provide the required reliability and redundancy.

This ensures that the circuit is able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Therefore, a single failure will neither cause nor prevent the protection function actuation. These requirements are described in IEEE-279-1971 (Ref. 7).

The two, three, and four process control channels discussed above all feed two logic trains. Figure B 3.3.1-1 shows a two-out-of-four logic function which provides input into two logic trains (Train A-and B). Two logic trains are required to ensure that no single failure of one logic train will disable the RTS. Provisions to allow removing logic trains from service during maintenance are unnecessary because of the logic system's designed reliability. During normal operation, the two logic trains remain energized.

Reactor Trip Switchgear The reactor trip switchgear includes the reactor trip breakers (RTBs) and bypass breakers as shown on Figure B 3.3.1-1. The RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the control rod drive mechanisms (CRDMs). Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity and shutdown the reactor. Each RTB may be bypassed with a bypass breaker to allow testing of the RTB while the plant is at power. During normal operation, the output from the protection system is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use.

When the required logic matrix combination is completed, the protection system output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open allowing the shutdown rods and control rods to fall into the core. Therefore, a loss of power to the protection system or RTBs will cause a reactor trip. In addi Lon to the de-energization of the undervoltage coils, each also equipped with a shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the protection system (except for the zirconium guide tube trip which R.E. Ginna Nuclear Power Plant B 3.3.1-3 Revision 18

'7",e/kyJ *- r e , - 1r(, RTS Instrumentation j 4 B 3.3.1

-ony utilizes the undervoltage coils). Either the undervoltage coil or the shunt trip mechanism is sufficient by itself to open the RTBs, thus providing diverse trip mechanisms.

APPLICABLE The RTS functions to maintain the SLs during all ACOs and mitigates the SAFETY consequences of DBAs which initiate in any MODE in which the RTBs ANALYSES, are closed.

LCO, AND APPLICABILITY Each of the analyzed accidents and transients can be detected by one or more RTS Functions. The accident analysis described in Reference 6 takes credit for most RTS trip Functions. RTS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the plant. These RTS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. They may also serve as anticipatory trips to RTS trip Functions that were credited in the accident analysis.

The LCO requires all instrumentation performing an RTS Function, listed 3 in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of three or four channels in each instrumentation Function, two channels of Manual Reactor Trip in each logic Function, and two trains in each Automatic Trip Logic Function. Four OPERABLE instrumentation channels in a two-out-of-four configuration are required when one RTS channel is also used as a control system input. This configuration accounts for the possibility of the shared channel failing in such a manner that it creates a trarisient that requires RTS action. In this case, the RTS will still provide protection, even with random failure of one of the other three protection channels.

Three operable instrumentation channels in a two-out-of-three configuration are generally required when there is no potential for control system and protection system interaction that could simultaneously create a need for a RTS trip and disable one RTS channel. The two-out of-three and two-out-of-four configurations allow one channel to be tripped or bypassed during maintenance or testing without causing a reactor trip. Specific exceptions to the above eneral hit and are discussed below. ', i*& voJI le V, e The LCO and Applicability of each RTS4unction are provided in Table 3.3.1-1. Included on Table 3.3.1-1 are. rip" etpoints for all applicable RTS Functions.-ý. -Q efo for RTS Functions not specifically modeled in the safety analysis are based on established limits provided in the UFSAR (Reference 4). Note that in the haSSOrn3 the_!poin'6f Table 3.3.1 -1 are the LSSS. h rpStonsa R.E. Ginna Nuclear Power Plant B 3.3.1-4 Revision 18

RTS Instrumentation B 3.3.1 the Tritint us hich the bistables are set. Any bistable is li such tha e proterly adjusted w hen "as left" value is within the aloal tlrnebnd for CHANNEL CALIBRATION accuracy as prcessitim dlaysprocedures. The channel containing the bistable is unconsidered inoperable when the "as found" value exceeds the Trip Setpoint specified in Table 3.3.1-1. areotherefore onservativlytadjusted n ýý T "if , ý-:::E d References 4, 5, mh and 6. The logy useeto vf th rip Setpoints is tsuch that adequate protection is provided when all sensor and totenaltcllmts wthe resp ecttime processing delays, calibrationin the usedbitb r tolerances, accideonth analysis.l instrumentation Aiit uncertainties, and instrument drift are taken into account. The Trip Setpoints specified in Table 3.3.1-1 are therefore conservatively adjusted with respect to the analytical limits used in the accident analysis. Ate detailed description of the methodoloagy used to verify the adequacy of the existing Trip Setpoints, including their explicit uncertainties, is provided in Reference 8.

The RITS utilizes various permissive signals to ensure reactor trip Functions are in the correct configuration for the current plant status.

These permissives back up operator actions to ensure protection system Functions are not bypassed during plant conditions under which the safety analysis assumes the Function is available.

In addition to the RTS Functions listed in Table 3.3.1-1, a zirconium guide tube trip function exists. This trip function was added by RG&E to prevent potential damage to the control rod drive mechanisms when cooling down due to the different thermal expansion rates of zirconium and stainless steel. This trip function is not credited in the accident analysis, and as such, is not addressed by this LCO. However, the trip function is used for testing the RTBs since the function only actuates the RTB undervoltage mechanism (versus shunt trip).

The safety analyses and OPERABILITY requirements applicable to each RTS Function and permissive provided in Table 3.3.1t-1 are discussed below:

1. Manual Reactor Trip The Manual Reactor Trip Function ensures that the control room oPe'rator can initiate a reactor trip at any time by using either of two reactor trip pushbuttons on the main control board. A Manual Reactor Trip energizes the shunt trip device and de-energizes the undervoltage coils for the RTBs and bypass breakers. It is used at the discretion of the control room operators to shut down the reactor whenever any parameter is rapidly trending toward its Trip Setpoint or during other degrading plant conditions.

R.E. Ginna Nuclear Power Plant B 3.3.1-5 Revision 18

RTS Instrumentation B 3.3.1 The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip pushbutton which actuates the reactor trip breaker in both trains.

Two independent channels are required to be OPERABLE so that no single failure will disable the Manual Reactor Trip Function. This function has no adjustable trip setpoint with which to associate an LSSS, therefore no setpoints are provided.

In MODE 1 or 2, manual initiation capability of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core. In MODE 3, 4, or 5, the manual initiation Function must also be OPERABLE if the RTBs are closed and the Control Rod Drive (CRD) System is capable of withdrawing the shutdown rods or the control rods. In this condition, inadvertent control rod withdrawal is possible. In MODE 3, 4, or 5, manual initiation of a reactor trip is not required to be OPERABLE if the CRD System is not capable of withdrawing the shutdown rods or control rods, or if one or more RTBs are open. If the rods cannot be withdrawn from the core, there is no need to be able to trip the reactor because all of the rods are inserted. In MODE 6, neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.

2. Power Range Neutron Flux The Power Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident. The Nuclear Instrumentation System (NIS) power range detectors (N-41, N-42, N-43, and N-44) are located external to the reactor vessel and measure neutrons leaking from the core. The NIS power range detectors provide input to the CRD System for determination of automatic rod speed and direction.

Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.

a. Power Range Neutron Flux-High The Power Range Neutron Flux-High trip Function ensures that protection is provided, from all power levels, against a positive reactivity excursion leading to DNB during power operations. These reactivity excursions can be caused by rod withdrawal or reductions in RCS temperature. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip.

Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.

R.E. Ginna Nuclear Power Plant B 3.3.1-6 Revision 18

RTS Instrumentation B 3.3.1 The LCO requires all four of the Power Range Neutron Flux High trip Function channels to be OPERABLE.

In MODE 1 or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux-High trip must be OPERABLE. This Function will terminate the reactivity excursion and shut down the reactor prior to reaching a power level that could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power range detectors cannot detect neutron levels in this range. In these MODES, the Power Range Neutron Flux-High trip Function is not required to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely.

Other RTS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or6.

b. Power Range Neutron Flux-Low The LCO requirement for the Power Range Neutron Flux-Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.

The LCO requires all four of the Power Range Neutron Flux Low trip Function channels (N-41, N-42, N-43, and N-44) to be OPERABLE.

In MODE 1, below 6% RTP, and in MODE 2, the Power Range Neutron Flux-Low trip must be OPERABLE. This Function may be manually blocked by the operator when two out-of-four power range channels are greater than approximately 8% RTP (P-1 0 setpoint). This Function is automatically unblocked when three-out-of-four power range channels are below the P-1 0 setpoint. Above the P-1 0 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux-High trip Function.

In MODE 3, 4, 5, or 6, the Power Range Neutron Flux-Low trip Function is not required to be OPERABLE because the reactor is shut down and the NIS power range detectors cannot detect neutron levels in this range. Other RTS trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.

R.E. Ginna Nuclear Power Plant B 3.3.1-7 Revision 18

RTS Instrumentation B 3.3.1

3. Intermediate Range Neutron Flux The Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition. This trip Function provides redundant protection to the Power Range Neutron Flux Low trip Function and is not specifically modeled in the accident analysis. The NIS intermediate range detectors (N-35 and N-36) are located external to the reactor vessel and measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.

The LCO requires two channels of the Intermediate Range Neutron Flux trip Function to-be OPERABLE. Two OPERABLE channels are sufficient to ensure no single failure will disable this trip Function. Because this trip Function is important only during low power conditions, there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary.

In MODE 1 below 6% RTP, and in MODE 2,The Intermediate Range Neutron Flux trip Function must be OPERABLE since there is a potential for an uncontrolled RCCA bank rod withdrawal accident. This Function may be manually blocked by the operator when two-out-of-four power range channels are greater tha approximately 8% RTP (P-1 0 setpoint). Above % RTP -10 setpoinr,the Power Range Neutron Flux-High trip provides core protection for a rod withdrawal accident. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip Function is not required to be OPERABLE because the NIS intermediate range detectors cannot detect neutron levels in this range. Other RTS trip Functions and administrative controls provide protection against reactivity additions or power excursions in MODE 3, 4, 5, or 6.

R.E. Ginna Nuclear Power Plant B 3.3.1-8 Revision 18

RTS Instrumentation B 3.3.1

4. Source Range Neutron Flux The LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition and provides protection against boron dilution and rod ejection events. This trip Function provides redundant protection to the Power Range Neutron Flux-Low and Intermediate Range Neutron Flux trip Functions in MODE 2 and is not specifically credited in the accident analysis at these conditions. The NIS source range detectors (N-31 and N-32) are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5. Therefore, the functional capability at the specified Trip Setpoint is assumed to be available.

The LCO requires two channels of Source Range Neutron Flux trip Function to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single failure will disable this trip Function.

The LCO also requires one channel of the Source Range Neutron Flux trip Function to be OPERABLE in MODE 3, 4, or 5 with the CRD System not capable of rod withdrawal and all rods fully inserted. In this case, the source range Function is to provide control room indication. The outputs of the Function to RTS logic are not required to be OPERABLE when the CRD system is not capable of rod withdrawal and all rods fully inserted.

The Source Range Neutron Flux Trip Function provides protection for control rod withdrawal from subcritical, boron dilution and control rod ejection events. The Function also provides visual neutron flux indication in the control room.

In MODE 2 when both intermediate range channels are < 5E-11 amps (below the P-6 setpoint), the Source Range Neutron Flux trip Function must be OPERABLE. Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux-Low trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range detectors are manually de-energized by the operator and are inoperable.

R.E. Ginna Nuclear Power Plant B 3.3.1-9 Revision 18

RTS Instrumentation B 3.3.1 In MODE 3, 4, or 5 with the CRD System capable of rod withdrawal or all rods are not fully inserted, the Source Range Neutron Flux trip Function must be OPERABLE to provide core protection against a rod withdrawal accident. If the CRD System is not capable of rod withdrawal and all rods are fully inserted, the source range detectors are not required to trip the reactor. However, their monitoring Function must be OPERABLE to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution. The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.2, "Nuclear Instrumentation."

5. Overtemperature AT The Overtemperature AT trip Function is provided to ensure that the design limit departure from nucleate boiling ratio (DNBR) is met.

This trip Function also limits the range over which the Overpower AT trip Function must provide protection. The inputs to the Overtemperature AT trip include pressure, Tavg, axial power distribution, and reactor power as indicated by loop AT assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system. The Overtemperature AT trip Function monitors both variation in power and flow since a decrease in flow has the same effect on AT as a power increase.

The Overtemperature AT trip Function uses the AT of each loop as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters:

"* reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature;

"* pressurizer pressure - the Trip Setpoint is varied to correct for changes in system pressure; and

"* axial power distribution f(AI) - the Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors.

If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower NIS power range detectors, the Trip Setpoint is reduced in accordance with Note 1 of .Table 3.3.1-1.

Dynamic compensation is included for system piping delays from the core to the temperature measurement system.

R.E. Ginna Nuclear Power Plant B 3.3.1 -10 Revision 18

RTS Instrumentation B 3.3.1 The Overtemperature AT trip Function is calculated in two channels for each loop as described in Note 1 of Table 3.3.1-1. A reactor trip occurs if the Overtemperature AT Trip Setpoint is reached in two out-of-four channels. Since the pressure and temperature signals are used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.

Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function. Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overtemperature AT condition and may prevent an unnecessary reactor trip.

The LCO requires all four channels of the Overtemperature AT trip Function to be OPERABLE. Note that the Overtemperature AT Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.

In MODE 1 or 2, the Overtemperature AT trip must be OPERABLE to prevent DNB. In MODE 3, 4, 5, or 6, this trip Function is not required to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.

6. Overpower AT The Overpower AT trip Function ensures that protection is provided to ensure the integrity of the fuel (i.e., no fuel pellet melting and less than 1% cladding failure) under all possible overpower conditions.

This trip Function also limits the required range of the Overtemperature AT trip Function and provides a backup to the Power Range Neutron Flux-High Setpoint trip. The Overpower AT trip Function ensures that the allowable heat generation rate (kW/ft) of the fuel is not exceeded. It uses the AT of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters:

"* reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature;

"* rate of change of reactor coolant average temperature including dynamic compensation for the delays between the core and the temperature measurement system; and R.E. Ginna Nuclear Power Plant B 3.3.1 -11 Revision 18

RTS Instrumentation B 3.3.1 axial power distribution f(AI) - the Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors.

If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower NIS power range detectors, the Trip Setpoint is reduced in accordance with Note 2 of Table 3.3.1-1.

The Overpower AT trip Function is calculated in two channels for each loop as described in Note 2 of Table 3.3.1-1. A reactor trip occurs if the Overpower AT trip setpoint is reached in two-out-of four channels. Since the temperature signals are used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation and a single failure in the remaining channels providing the protection function actuation. Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function. Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overpower AT condition and may prevent an unnecessary reactor trip.

The LCO requires four channels of the Overpower AT trip Function to be OPERABLE. Note that the Overpower AT trip Function receives input from channels shared with other RTS Functions.

Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.

In MODE 1 or 2, the Overpower AT trip Function must be OPERABLE. These are the only MODES where enough heat is generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function is not required to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about fuel overheating and fuel damage.

7. Pressurizer Pressure The same sensors (PT-429, PT-430, and PT-431) provide input to the Pressurizer Pressure-High and -Low trips and the Overtemperature AT trip with the exception that the Pressurizer Pressure-Low and Overtemperature AT trips also receive input from PT-449. Since the Pressurizer Pressure channels are also used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function.

R.E. Ginna Nuclear Power Plant B 3.3.1-12 Revision 18

RTS Instrumentation B 3.3.1

a. Pressurizer Pressure-Low The Pressurizer Pressure-Low trip Function ensures that protection is provided against violating the DNBR limit due to low pressure. The LCO requires four channels of the Pressurizer Pressure-Low trip Function to be OPERABLE.

In MODE 1, when DNB is a major concern, the Pressurizer Pressure-Low trip function must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock 0 RTP). On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, the Pressurizer Pressure-Low trip Function is not required to be OPERABLE because no conceivable power distributions can occur that would cause DNB concerns.

b. Pressurizer Pressure-High The Pressurizer Pressure-High trip Function ensures that protection is provided against overpressurizing the RCS.

This trip Function operates in conjunction with the pressurizer relief and safety valves to prevent RCS overpressure conditions. The LCO requires three channels of the Pressurizer Pressure-High trip Function to be OPERABLE.

In MODE 1 or 2, the Pressurizer Pressure-High trip Function must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the relief and safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure-High trip Function is not required to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate plant conditions and take corrective actions.

Additionally, low temperature overpressure protection systems provide overpressure protection when in or below MODE 4.

8. Pressurizer Water Level-High The Pressurizer Water Level-High trip Function provides a backup signal for the Pressurizer Pressure-High trip and also provides protection against water relief through the pressurizer safety valves. These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. This trip Function is not specifically modeled in the accident analysis.

R.E. Ginna Nuclear Power Plant B 3.3.1-13 Revision 18

RTS Instrumentation B 3.3.1 The LCO requires three channels of the Pressurizer Water Level High trip Function to be OPERABLE. The pressurizer level channels (LT-426, LT-427, and LT-428) are also used for other control functions. Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function. The level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting. Therefore, with the slow rate of charging available, pressure overshoot due to level channel failure cannot cause the safety valve to lift before the reactor high pressure trip.

In MODE 1 or 2, when there is a potential for overfilling the pressurizer, the Pressurizer Water Level-High trip Function must be OPERABLE. In MODES 3, 4, 5, or 6, the Pressurizer Water Level High trip Function is not required to be OPERABLE because transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate plant conditions and take corrective actions.

9. Reactor Coolant Flow-Low The Reactor Coolant Flow-Low (Single Loop) and (Two Loops) trip SFunctions utilize three common flow transmitters per RCS loop to generate a reactor trip above8C$O/o RTP (P-7 setpoint). Flow transmitters FT-411, FT-412, and FT-413 are used for RCS Loop A and FT-414, FT-415, and FT-416 are used for RCS Loop B.

a. Reactor Coolant Flow-Low (Single Loop)

The Reactor Coolant Flow-Low (Single Loop) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in the RCS loop, while avoiding reactor trips due to normal variations in loop flow. Above the 4 P-Ispn /o RTP), a loss of flow in either RCS loop will actuate a reactor trip. Each RCS loop has three flow detectors to monitor flow. The flow signals are not used for any control system input.

The LCO requires three Reactor Coolant Flow-Low (Single Loop) trip Function channels per RCS loop to be OPERABLE in MODE 1 _>50% RTP (above P-8 setpoint). Each loop is considered a separate Function for the purpose of this LCO.

In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in the core. In MODE 1 below the P-8 setpoint the Reactor Coolant Flow-Low (Single Loop) trip Function is not required to be OPERABLE because a loss of flow in one loop has been evaluated and found to be acceptable (Ref. 6).

R.E. Ginna Nuclear Power Plant B 3.3.1-14 Revision 18

RTS Instrumentation B 3.3.1

b. Reactor Coolant Flow-Low (Two Loops)

The Reactor Coolant Flow-Low (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in both RCS loops while avoiding reactor trips due to normal variations in loop flow.

The LCO requires three Rea or Coolant Flow-Low (Two Loops) trip Function channe s per loop to be OPERABLE in MODE 1 above 8.5% RTP -7 setpoint) and before the Reactor Coolant Flow-Low (Single Loop) trip Function is OPERABLE (below the P-8 setpoint). Each loop is considered a separate Function for the purpose of this LCO.

Above the P-7 setpoint and below the P-8 setpoint, a loss of flow in both loops will initiate a reactor trip. Each loop has three flow detectors to monitor flow. The flow signals are not used for any control system input.

Below the P-7 setpoint, this trip Function is not required to be OPERABLE because all reactor trips on low flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern-at this low power level. Above the P-7 setpoint, the reactor trip on low flow in both RCS loops is automatically enabled.

Above the P-8 setpoint, the Reactor Coolant Flow-Low (Two Loops) trip Function is not required to be OPERABLE because loss of flow in any one loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR.

10. RCP Breaker Position Both RCP Breaker Position trip Functions (Single Loop and Two Loops) utilize a common auxiliary contact located on each RCP.

These Functions anticipate the Reactor Coolant Flow-Low trips to avoid RCS heatup that would occur before the low flow trip actuates but are not specifically credited in the accident analysis.

a. Reactor Coolant Pump Breaker Position (Single Loop)

The RCP Breaker Position (Single Loop) trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in one RCS loop. The position of each RCP breaker is monitored. If one RCP isktri is open a willaed reaker ove(g/o RTP, a reactor trip isct is initiated.

eThis trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Single Loop) Trip Setpoint is reached.

R.E. Ginna Nuclear Power Plant B 3.3.1-15 Revision 18

FITS Instrumentation B 3.3.1 The LCO requires one RCP Breaker Position trip Function channel per RCP to be OPERABLE in MODE 1 Ž 50% RTP (above the P-8 setpoint). Each RCP is considered a separate Function for the purpose of this LCO. One OPERABLE channel is sufficient for this trip Function because the RCS Flow-Low trip alone provides sufficient protection of plant SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of a pump.

This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch.

Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS.

In MODE 1 above the P-8 setpoint, when a loss of flow in any RCS loop could result in DNB conditions in the core, the RCP Breaker Position (Single Loop) trip Function must be OPERABLE. In MODE 1 below the P-8 setpoint, the RCP Breaker Position (Single Loop) trip Function is not required to be OPERABLE because a loss of flow in one loop has been evaluated and found to be acceptable (Ref. 6).

b. RCP Breaker Position (Two Loops)

The RCP Breaker Position (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in both RCS lools. The position of each RCP breaker is monitored. If both RCP breakers are open above 4M RTP (P-7 setpoint) and before the RCP Breaker Position (Single Loop) trip Function is OPERABLE (below the P-8 setpoint), a reactor trip is initiated. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached.

The LCO requires one RCP Breaker Position trip Function channel per RCP to be OPERABLE in MODE 1 above the P 7 and below the P-8 setpoints. Each RCP is considered a separate Function for the purpose of this LCO. One OPERABLE channel is sufficient for this Function because the RCS Flow-Low trip alone provides sufficient protection of plant SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of an RCP.

This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch.

Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS.

R.E. Ginna Nuclear Power Plant B 3.3.1-16 Revision 18

RTS Instrumentation B 3.3.1 In MODE 1 above the P-7 setpoint and below the P-8 setpoint, the RCP Breaker Position (Two Loops) trip Function must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow (including RCP breaker position) are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in both RCS loops is automatically enabled.

Above the P-8 setpoint, the RCP Breaker Position (Two Loops) trip Function is not required to be OPERABLE because a loss of flow in any one loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR.

11. Undervoltaqe-Bus 11 A and 11B The Undervoltage-Bus 11A and 11B reactor trip Function ensures that protection is provided against violating the DNBR limit due to t, loss of flow in both RCS loops from a major network voltage i Q-1&

disturbance. The voltage to each RCP is monitored. Abovexiip RTP (the P-7 setpoint), an undervoltage condition detected on both Buses 11 A and 11B will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached. Time delays are incorporated into the Undervoltage Bus 11A and 11B channels to prevent reactor trips due to momentary electrical power transients.

The LCO requires two Undervoltage-Bus 11 A and 11B trip Function channels per bus to be OPERABLE in MODE 1 above the P-7 setpoint. Each bus is considered a separate Function for the purpose of this LCO.

Below the P-7 setpoint, the Undervoltage-Bus 11 A and 11B trip Function is not required to be OPERABLE because all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on Undervoltage-Bus 11A and 11B is automatically enabled.

12. Underfrequency-Bus 11 A and 11B The Underfrequency-Bus 11 A and 11B reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in both RCP loops from a major network frequency disturbance. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. The proper coastdown time is required so that reactor heat can be removed immediatel after reactor trip. The frequency 0 of eachofRCP a loss bus i-smonitored.

frequency detected onAbove both RCPj5%RTP buses (the P-7 setpoint),

will initiate a 6

R.E. Ginna Nuclear Power Plant B 3.3.1-17 Revision 18

RTS Instrumentation B 3.3.1 reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached.

Time delays are incorporated into the Underfrequency RCPs channels to prevent reactor trips due to momentary electrical power transients.

The LCO requires two Underfrequency-Bus 11A and 11B channels per bus to be OPERABLE in Mode 1 above the P-7 setpoint. Each bus is considered a separate Function for the purpose of this LCO.

Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on Underfrequency Bus 11 A and 11 B is automatically enabled.

13. Steam Generator Water Level-Low Low The Steam Generator (SG) Water Level-Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the Auxiliary Feedwater (AFW) System prior to uncovering the SG tubes. The SGs are the heat sink for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in any SG is indicative of a loss of heat sink for the reactor. Three level transmitters per SG (LT 461, LT-462, and LT-463 for SG A and, LT-471, LT-472, and LT-473 for SG B) provide input to the SG Level Control System. Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. This Function also performs the Engineered Safety Feature Actuation System (ESFAS) function of starting the AFW pumps on low low SG level. The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor.

The LCO requires three trip Function channels of SG Water Level Low Low per SG to be OPERABLE in MODES 1 and 2. Each SG is considered a separate Function for the purpose of this LCO.

In MODE 1 or 2, the SG Water Level-Low Low trip Function must be OPERABLE to ensure that a heat sink is available to the reactor.

In MODE 3, 4, 5, or 6, the SG Water Level-Low Low trip Function is not required to be OPERABLE because the reactor is not operating. Decay heat removal is accomplished by the AFW System in MODE 3 and by the Residual Heat Removal (RHR)

System in MODE 4, 5, or 6.

R.E. Ginna Nuclear Power Plant B 3.3.1-18 Revision 18

RTS Instrumentation B 3.3.1

14. Turbine Trip Credit for these trip Functions is not credited in the accident analysis.

a. Turbine Trip-Low Autostop Oil Pressure The Turbine Trip-Low Autostop Oil Pressure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip from a power level above the P-9 setpoint. Below the P-9 setpoint this action will not actuate a reactor trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. Three pressure switches monitor the control oil pressure in the Autostop Oil System. A low pressure condition sensed by two-out-of-three pressure switches will actuate a reactor trip. These pressure switches do not provide any input to the control system. The plant is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure-High trip Function and RCS integrity is ensured by the pressurizer safety valves.

The LCO requires three trip Function channels of Turbine Trip-Low Autostop Oil Pressure to be OPERABLE in MODE 1 above P-9.

Below the P-9 setpoint, the Turbine Trip-Low Autostop Oil Pressure trip Function is not required to be OPERABLE because load rejection can be accommodated by the steam dump system. Therefore, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, the turbine is not operating, therefore, there is no potential for a turbine trip.

b. Turbine Trip-Turbine Stop Valve Closure The Turbine Trip-Turbine Stop Valve Closure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip from a power level above the P-9 setpoint. Below the P-9 setpoint this action will not actuate a reactor trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. This trip Function will not and is not required to operate in the presence of a single channel failure. The plant is designed to withstand a R.E. Ginna Nuclear Power Plant B 3.3.1-19 Revision 18

RTS Instrumentation B 3.3.1 complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure-High trip Function, and RCS integrity is ensured by the pressurizer safety valves.

This trip Function is diverse to the Turbine Trip-Low Autostop Oil Pressure trip Function. Each turbine stop valve is equipped with one limit switch that inputs to the RTS. If both limit switches indicate that the stop valves are closed, a reactor trip is initiated.

This Function only measures the discrete position (open or closed) of the turbine stop valves. Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS.

The LCO requires two Turbine Trip-Turbine Stop Valve Closure trip Function channels, one per valve, to be OPERABLE in MODE 1 above P-9. Both channels must trip to cause reactor trip.

Below the P-9 setpoint, the Turbine Trip-Turbine Stop Valve Closure trip Function is not required to be OPERABLE because a load rejection can be accommodated by the steam dump system. Therefore, a turbine trip does not actuate a.

reactor trip. In MODE 2, 3, 4, 5, or 6, the turbine is not operating, therefore there is no potential for a turbine trip.

15. Safety Iniection Input from Engineered Safety Feature Actuation System The Safety Injection (SI) Input from ESFAS ensures that if a reactor trip has not already been generated by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal that initiates SI. This trip is assumed in the safety analyses for the loss of coolant accident (LOCA). However, other transients and accidents take credit for varying levels of ESF performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown. Therefore, a reactor trip is initiated every time an SI signal is present.

Trip Setpoints are not applicable to this Function. The SI Input is provided by relays in the ESFAS. Therefore, there is no measurement signal with which to associate an LSSS.

The LCO requires two trip Function channels of SI Input from ESFAS to be OPERABLE in MODE 1 or 2.

R.E. Ginna Nuclear Power Plant B 3.3.1-20 Revision 18

RTS Instrumentation B 3.3.1 A reactor trip is initiated every time an Sl signal is present.

Therefore, this trip Function must be OPERABLE in MODE 1 or 2, when the reactor is critical, and must be shut down in the event of an accident. In MODE 3, 4, 5, or 6, the reactor is not critical, and this trip Function does not need to be OPERABLE.

16. Reactor Trig System Interlocks Reactor protection interlocks (i.e., permissives) are provided to ensure reactor trips are in the correct configuration for the current plant status. They back up operator actions to ensure protection system Functions are not bypassed during plant conditions under which the safety analysis assumes the Functions are not bypassed.

Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip functions are outside the applicable MODES.

These are:

a. Intermediate Range Neutron Flux, P-6 Permissive The Intermediate Range Neutron Flux, P-6 permissive is actuated when any NIS intermediate range channel goes approximately one decade (1 E-1 0 amps) above the minimum channel reading. If both channels drop below the setpoint, the permissive will automatically be defeated. The LCO requirement for the P-6 permissive ensures that the following Functions are performed:

on increasing power, the P-6 interlock allows the manual block of the NIS Source Range, Neutron Flux reactor trip by use of two defeat push buttons. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range.

When the source range trip is blocked, the high voltage to the detectors is also removed; and

on decreasing power, the P-6 interlock automatically energizes the NIS source range detectors and enables the Source Range Neutron Flux reactor trip at 5E-11 amps.

The LCO requires two channels of Intermediate Range Neutron Flux, P-6 permissive to be OPERABLE in MODE 2 when below the P-6 permissive setpoint.

R.E. Ginna Nuclear Power Plant B 3.3.1-21 Revision 18

RTS Instrumentation B 3.3.1 Above the P-6 permissive setpoint, the Source Range Neutron Flux reactor trip will be blocked, and this Function is no longer required.

In MODE 3, 4, 5, or 6 the P-6 permissive does not have to be OPERABLE because the Source Range is providing the required core protection.

b. Low Power Reactor Trips Block, P-7 Permissive The Low Power Reactor Trips Block, P-7 interlock is actuated by input from either the Power Range Neutron Flux, P-10, or from first stage turbine pressure. The LCO requirement for the P-7 permissive allows the bypass of the following Functions:

"* Pressurizer Pressure-Low;

"* Reactor Coolant Flow-Low (Two Loops);

"* RCP Breaker Position (Two Loops);

"* Undervoltage-Bus 11A and 11B; and

"* Underfrequency-Bus 11 A and 11 B.

These reactor trip functions are not required below the P-7 setpoint since the RCS is capable of providing sufficient natural circulation without any RCP running.

The LCO requires four channels of Low Power Reactor Trips Block, P-7 permissive to be OPERABLE in MODE 1 > 8.5%

RTP.

In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the permissive performs its Function when power level drops below 8.5% power, which is in MODE 1.

R.E. Ginna Nuclear Power Plant B 3.3.1-22 Revision 18

RTS Instrumentation B 3.3.1

c. Power Range Neutron Flux. P-8 Permissive The Power Range Neutron Flux, P-8, permissive is actuated at approximately 49% power as determined by two-out-of four NIS power range detectors. The P-8 interlock allows the Reactor Coolant Flow-Low (Single Loop) and RCP Breaker Position (Single Loop) reactor trips on low flow in one or more RCS loops to be blocked so that a loss of a single loop will not cause a reactor trip. The LCO requirement for this trip Functions ensures that protection is provided against a loss of flow in any RCS loop that could result in DNB conditions in the core when > 50% power.

The LCO requires four channels of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1 > 50% RTP.

In MODE 1, a loss of flow in one RCS loop could result in DNB conditions, so the Power Range Neutron Flux, P-8 permissive must be OPERABLE. In MODE 1 < 50% RTP, this function is not required to be OPERABLE because a loss of flow in one loop will not result in DNB. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions.

d. Power Ranae Neutron Flux, P-9 Permissive The Power Range Neutron Flux, P-9 permissive is actuated at approximately 50% power as determined by two-out-of four NIS power range detectors if the Steam Dump System is avai able and at 8% if the Steam Dump System is unavailable. The LCO requirement for this Function ensures that the Turbine Trip-Low Autostop Oil Pressure and Turbine Trip-Turbine Stop Valve Closure reactor trips are enabled above the P-9 setpoint. Above the P-9 setpoint, a turbine trip will cause a load rejection beyond the capacity of the Steam Dump System and RCS. A reactor trip is automatically initiated on a turbine trip when it is above the P-9 setpoint, to minimize the transient on the reactor.

The LCO require four channels of Power Range Neutron Flux, P-9 permissive to be OPERABLE in MODE 1 above the permissive setpoint.

R.E. Ginna Nuclear Power Plant B 3.3.1-23 Revision 18

RTS Instrumentation B 3.3.1 In MODE 1 above the permissive setpoint, a turbine trip could cause a load rejection beyond the capacity of the Steam Dump System and RCS, so the Power Range Neutron Flux interlock must be OPERABLE. In MODE 1 below the permissive setpoint and MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at a power level sufficient to have a load rejection beyond the capacity of the Steam Dump System.

e. Power Range Neutron Flux, P-1 0 Permissive The Power Range Neutron Flux, P-1 0 permissive is actuated at approximately 8% power, as determined by two-out-of- four NIS power range detectors. If power level falls below 8%

RTP on 3 of 4 channels, the nuclear instrument trips will be automatically unblocked. The LCO requirement for the P-1 0 permissive ensures that the following Functions are performed:

"* on increasing power, the P-1 0 permissive allows the operator to manually block the Intermediate Range Neutron Flux and Power Range Neutron Flux-low reactor trips;

"* on increasing power, the P-10 permissive automatically provides a backup signal to the P-6 permissive to block the Source Range Neutron Flux reactor trip, and also to de-energize the NIS source range detector;

"* the P-1 0 interlock provides one of the two inputs to the P-7 interlock; and

"* on decreasing power, the P-1 0 interlock automatically enables the Power Range Neutron Flux-Low reactor trip and the Intermediate Range Neutron Flux reactor trip (and rod stop).

The LCO requires four channels of Power Range Neutron Flux, P-10 interlock to be OPERABLE in MODE 1 < 6% RTP and MODE 2.

R.E. Ginna Nuclear Power Plant B 3.3.1-24 Revision 18

RTS Instrumentation "B3.3.1 OPERABILITY in MODE 1 < 6% RTP ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown. This Function must also be OPERABLE in MODE 2 to ensure that core protection is providing during a startup or shutdown by the Power Range Neutron Flux-Low and Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection.

17. Reactor Trip Breakers This trip Function applies to the RTBs exclusive of individual trip mechanisms. The OPERABILITY requirement for the individual trip mechanisms is provided in Function 18 below. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the CRD System. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single failure can disable the RTS trip capability.

These trip Functions must be OPERABLE in MODE 1 or 2 because the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the CRD System is capable of rod withdrawal and all rods are not fully inserted.

18. Reactor Trip Breaker Undervoltaqe and Shunt Trig Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the CRD System, or declared inoperable under Function 17 above.

OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure will prevent opening any breaker on a valid signal.

These trip Functions must be OPERABLE in MODE 1 or 2 because the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the CRD System is capable of rod withdrawal and all rods are not fully inserted.

R.E. Ginna Nuclear Power Plant B 3.3.1-25 Revision 18

RTS Instrumentation B 3.3.1

19. Automatic Trip) Logic The LCO requirement for the RTBs (Functions 17 and 18) and Automatic Trip Logic (Function 19) ensures that means are provided to interrupt the power to allow the rods to fall into the reactor core. Each RTB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. Each RTB is also equipped with a redundant bypass breaker to allow testing of the trip breaker while the plant is at power. The reactor trip signals generated by the RTS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.

The LCO requires two trains of RTS Automatic Trip Logic to be OPERABLE. Having two OPERABLE trains ensures that failure of a single logic train will not prevent reactor trip.

These trip Functions must be OPERABLE in MODE 1 or 2 because the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the CRD System is capable of rod withdrawal and all rods are not fully inserted.

The RTS instrumentation satisfies Criterion 3 of the NRC Policy Statement.

ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.1-1.

In the event a channel's Trip Setpoint is found nonconservative with respect to analytical values specified in plant procedures, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.

As shown on Figure B 3.3.1-1, the RTS is comprised of multiple interconnected modules and components. For the purpose of this LCO, a channel is defined as including all related components from the field instrument to the Automatic Trip Logic (Function 19 in Table 3.3.1-1).

Therefore, a channel may be inoperable due to the failure of a field instrument or a bistable failure which affects one or both RTS trains that is comprised of the RTBs and Automatic Trip Logic Function. The only exception to this are the Manual Reactor Trip and SI Input from ESFAS trip Functions which are defined strictly on a train basis (i.e., failure of these Functions may only affect one RTS train).

R.E. Ginna Nuclear Power Plant B 3.3.1-26 Revision 18

RTS Instrumentation B 3.3.1 A.1 Condition A applies to all RTS protection functions. Condition A addresses the situation where one required channel for one or more Functions is inoperable or if both source range channels are inoperable.

The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.

When the number of inoperable channels in a trip Function exceed those specified in all related Conditions associated with a trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 must be immediately entered if the trip Function is applicable in the current MODE of operation. This essentially applies to the loss of more than one channel of any RTS Function except with respect to Condition H.

B._1 Condition B applies to the Manual Reactor Trip Function in MODE 1 or 2 and in MODES 3, 4, and 5 with the CRD system capable of rod withdrawal or all rods not fully inserted. With one channel inoperable, the inoperable channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . In this Condition, the remaining OPERABLE channel is adequate to perform the required safety function.

The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE, and the low probability of an event occurring during this interval.

C.1, C.2, and C.3 If the Manual Reactor Trip Function cannot be restored to OPERABLE status within the allowed 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time of Condition B, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , action must be initiated within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to ensure that all rods are fully inserted, and the Control Rod Drive System must be placed in a condition incapable of rod withdrawal within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . The Completion Times provide adequate time to exit the MODE of Applicability from full power operation in an orderly manner without challenging plant systems based on operating experience.

D.1 Condition D applies to the following reactor trip Functions:

"* Power Range Neutron Flux-High;

"* Power Range Neutron Flux-Low; R.E. Ginna Nuclear Power Plant B 3.3.1-27 Revision 18

RTS Instrumentation B 3.3.1

"* Overtemperature AT;

"* Overpower AT;

"° Pressurizer Pressure-High;

"° Pressurizer Water Level-High; and

"* SG Water Level-Low Low.

With one channel inoperable, the channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Placing the channel in the tripped condition results in a partial trip condition. For the Power Range Neutron Flux-High, Power Range Neutron Flux-Low, Overtemperature AT, and Overpower AT functions, this results in a one-out-of-three logic for actuation. For the Pressurizer Pressure-High and Pressurizer Water Level-High Functions, this results in a one-out-of two logic for actuation. For the SG Water Level-Low Low Function, this results in a one-out-of-two logic per each affected SG for actuation. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is consistent with Reference 9.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypass condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of other channels. This includes placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. This 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the remaining OPERABLE channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

E.1 and E.2 Condition when THERMAL E applies POWER is a ve the Range to the Intermediate Neutron P-6 setpoint (5E-11 trip Function Flux aamp as, --

en from a bistable circuit of the intermediate range channels) and beow

0 setpoint the P-1 ane hanes~ndon %d RTPne*owr channis from a bistable circuit s derivedisiopbrove, the theofP_6*

i nt erm e ti of in s the ioeabloed ediate ran g s the onipRange Powermeit retuiedto C channels ot Theros andonercannle2hor Tim alo foroaslownd is con.th toveiýtherP ower tan eothee P-1 0 setpoint, thee NIS po ntermrnediatectrangerfr dthectrprom monitoring and protection function.

anWhitreiath range NISno itreit r mangetioanelTinoesrable, 2oursaslo all ontowed towiter F1r"

,* *- *./"-adjustment above or belowP--nd take into account the redundant

, 0, capability afforded by the rPedundant OPERABLE channel, and the low probability of its failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out-R.E. Ginna Nuclear Power Plant B 3.3.1-28 Revision 18

RTS Instrumentation B 3.3.1 of-two logic. Tripping one channel would trip the reactor. Thus, the Required Actions specified in this Condition are only applicable when channel inoperability does not result in reactor trip.

Required Action E.2 is modified by a Note which states that the option to increase THERMAL POWER is not allowed if both intermediate range channels are inoperable or if THERMAL POWER is < 5E-11 amps. This prevents the plant from increasing THERMAL POWER when the trip capability of the Intermediate Range Neutron Flux trip Function is not avial r if the plant has not yet entered this trip Funct-ion's MOE jof.

F.1, F.2, and F.3 Condition F applies to the Source Range Neutron Flux trip Function when in MODE Pbelow the P-6 set oin . In this Condition, the NIS source range performs the monitoring and protection functions. With two channels inoperable, the RTBs and RTBBs must be opened immediately.

With the RTBs and RTBBs opened, the core is in a more stable condition.

With one channel inoperable, operations involving positive reactivity additions shall be suspended immediately. This will preclude any power escalation since with only one source range channel OPERABLE, core protection is severely reduced. The inoperable channel must also be restored within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

G..1 If the Required Actions of Condition D, E, or F cannot be met within the specified Completion Times, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

H.1, H.2, and H.3 Condition H applies to an inoperable source range channel in MODE 3, 4, or 5 with the CRD System capable of rod withdrawal or all rods not fully inserted. In this Condition, the NIS source range performs the monitoring and protection functions. With two channels inoperable, at least one channel must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable considering the low probability of an event occurring during this interval.

With one of the source range channels inoperable, operations involving positive reactivity additions must be suspended immediately and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to restore it to OPERABLE status. The suspension of positive reactivity additions will preclude any power escalation.

R.E. Ginna Nuclear Power Plant B 3.3.1-29 Revision 18

RTS Instrumentation B 3.3.1 1.1 and 1.2 If the Source Range trip Function cannot be restored to OPERABLE status within the required Completion Time of Condition H, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, action must be immediately initiated to fully insert all rods. Additionally, the CRD System must be placed in a condition incapable of rod withdrawal within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is sufficient to accomplish the Required Action, and takes into account the low probability of an event occurring during this interval.

J.1 and J.2 Condition J applies when the required Source Range Neutron Flux channel is inoperable in MODE 3, 4, or 5 with the CRD System not capable of rod withdrawal and all rods are fully inserted. In this Condition, the NIS source range performs the monitoring function. With no source range channels OPERABLE, operations involving positive reactivity additions shall be suspended immediately. This will preclude any power escalation.

Also, the SDM must be verified once within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter as per SR 3.1.1.1, SDM verification. With no source range channels OPERABLE, core protection is severely reduced. Verifying the SDM once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows sufficient time to perform the calculations and determine that the SDM requirements are met and to ensure that the core reactivity has not changed. Required Action J.1 precludes any positive reactivity additions; therefore, core reactivity should not be increasing, and a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is adequate. The Completion Time of once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on operating experience in performing the Required Actions and the knowledge that plant conditions will change slowly.

K.1 Condition K applies to the following reactor trip Functions:

"* Pressurizer Pressure-Low;

"* Reactor Coolant Flow-Low (Two Loops);

"* RCP Breaker Position (Two Loops);

"* Undervoltage-Bus 11A and 11B; and

"* Underfrequency-Bus 11A and 11B.

R.E. Ginna Nuclear Power Plant B 3.3.1-30 Revision 18

RTS Instrumentation B 3.3.1 With one channel inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Placing the channel in the tripped condition results in a partial trip condition requiring only one additional channel to initiate a reactor trip.

The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the channel in the tripped condition is consistent with Reference 9 if the inoperable channel cannot be restored to OPERABLE status.

Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel(s),

and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition K.

For the Reactor Coolant Flow-Low (Two Loops) Function, Condition K applies on a per loop basis. For the RCP Breaker Position (Two Loops)

Function, Condition K applies on a per RCP basis. For Undervoltage-Bus 11A and 11B and underfrequency-Bus 11A and 11B, Condition K applies on a per bus basis. This allows one inoperable channel from each loop, RCP, or bus to be considered on a separate condition entry basis.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the remaining OPERABLE channels.

L._1 If the Required Action and Completion Time of Condition K is not met, the plant must be brought to a MODE in which the LCO does not apply. To.

achieve this status, the plant must be placed in MODE 1 < 8.5% RTPeýY a2Eoi t which point the Function is no longer required. An alternative is not provided for increasing THERMAL POWER above the P-8 setpoint for the Reactor Coolant Flow-Low (Two Loops) and RCP Breaker Position (Two Loops) trip Functions since this places the plant in Condition M. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 1 < 8.5% RTP from full power conditions in an orderly manner and without challenging plant systems.

M._1 Condition M applies to the Reactor Coolant Flow-Low (Single Loop) reactor trip Function. Condition M applies on a per loop basis. With one channel per loop inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or place in trip is consistent with Reference 9.

R.E. Ginna Nuclear Power Plant B 3.3.1-31 Revision 18

RTS Instrumentation B 3.3.1 The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the two OPERABLE channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

N.1 Condition N applies to the RCP Breaker Position (Single Loop) trip Function. Condition N applies on a per loop basis. There is one breaker position device per RCP breaker. With one channel per RCP inoperable, the inoperable channel must be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status is consistent with Reference 9.

0.1 If the Required Action and associated Completion Time of Condition M or N is not met, the plant must be placed in a MODE where the Functions are not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced to < 50% RTP P ithin the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 9.

P.1 Condition P applies to Turbine Trip on Low Autostop Oil Pressure or on Turbine Stop Valve Closure in MODE 1 above the P-9 setpoint. With one channel inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If placed in the tripped Condition, this results in a partial trip condition requiring only one additional channel to initiate a reactor trip. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is consistent with Reference 9.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each remaining OPERABLE channel. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

Q.1, Q.2.1. and Q.2.2 If the Required Action and Associated Completion Time of Condition P are not met, the plant must be placed in a MODE where the Turbine Trip Functions are no longer required to be OPERABLE. To achieve this status THERMAL POWER must be reduced to < 50% RTP(1-4

ýwithin the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 9.

R.E. Ginna Nuclear Power Plant B 3.3.1-32 Revision 18

RTS Instrumentation B 3.3.1 The Steam Dump system must also be verified OPERABLE within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months or THERMAL POWER must be reduced to < 8% RTP. This ensures that either the secondary system or RCS is capable of handling the heat rejection following a reactor trip. The Completion Times are reasonable considering the need to perform the actions in an orderly manner and the low probability of an event occurring in this time.

R.1 Condition R applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES 1 and 2. With one train inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the train to OPERABLE status. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the train to OPERABLE status is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval.

The Required Action has been modified by a Note that allows bypassing one train up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing, provided the other train is OPERABLE.

S.1 and S.2 Condition S applies to the P-6, P-7, P-8, P-9, and P-1 0 permissives. With one channel inoperable, the associated interlock must be verified to be in its required state for the existing plant condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the associated RTS channel(s) must be declared inoperable. These actions are conservative for the case where power level is being raised. Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on operating experience and the minimum amount of time allowed for manual operator actions.

T. 1 Condition T applies to the RTBs in MODES 1 and 2. With one train inoperable, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the train to OPERABLE status.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on operating experience and the minimum amount of time allowed for manual operator actions.

The Required Action has been modified by two Notes. Note 1 allows one train to be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing, provided the other train is OPERABLE. Note 2 allows one RTB to be bypassed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance on undervoltage or shunt trip mechanisms if the other RTB train is OPERABLE. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance is in addition to the 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing (e.g., if a RTB fails 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months into its testing window, it must be restored within 6 additional hours (or 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months from start of test)).

R.E. Ginna Nuclear Power Plant B 3.3.1-33 Revision 18

RTS Instrumentation B 3.3.1 U.1 and U.2 Condition U applies to the RTB Undervoltage and Shunt Trip Mechanisms (i.e., diverse trip features) in MODES 1 and 2. Condition U applies on a RTB basis. This allows one diverse trip feature to be inoperable on each RTB. However, with two diverse trip features inoperable (i.e., one on each of two different RTBs), at least one diverse trip feature must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable considering the low probability of an event occurring during this time interval.

With one trip mechanism for one RTB inoperable, it must be restored to an OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The affected RTB shall not be bypassed while one of the diverse trip features is inoperable except for the time required to perform maintenance to one of the diverse trip features. The allowable time for performing maintenance of the diverse trip features is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for the reasons stated under Condition T. The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for Required Action U.2 is reasonable considering that in this Condition there is one remaining diverse trip feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.

V.1 If the Required Action and Associated Completion Time of Condition R, S, T, or U is not met, the plant must be placed in a MODE where the Functions are no longer required to be OPERABLE. To achieve this status, the plant must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner without challenging plant systems.

It should be noted that for inoperable channels of Functions 16a, 16b, 16c, and 16d, the MODE of Applicability will be exited before Required Action V.1 is completed. Therefore, the plant shutdown may be stopped upon exiting the MODE of Applicability per LCO 3.0.2.

W.1 and W.2 Condition W applies to the following reactor trip Functions in MODE 3, 4, or 5 with the CRD System capable of rod withdrawal or all rods not fully inserted:

RTBs;

RTB Undervoltage and Shunt Trip Mechanisms; and 0 Automatic Trip Logic.

R.E. Ginna Nuclear Power Plant B 3.3.1-34 Revision 18

RTS Instrumentation B 3.3.1 With two trip mechanisms inoperable, at least one trip mechanism must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable considering the low probability of an event occurring during this time interval.

With one trip mechanism or train inoperable, the inoperable trip mechanism or train must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . For the trip mechanisms, Condition W applies on a RTB basis.

This allows one diverse trip feature to be inoperable on each RTB.

However, with two diverse trip features inoperable (i.e., one on each of two different RTBs), at least one diverse trip feature must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function, and given the low probability of an event occurring during this interval.

X.1 and X.2 If the Required Action and Associated Completion Time of Condition W is not met, the plant must be placed in a MODE where the Functions are no longer required. To achieve this status, action be must initiated immediately to fully insert all rods and the CRD System must be incapable of rod withdrawal within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . These Completion Times are reasonable, based on operating experience to exit the MODE of Applicability in an orderly manner.

SURVEILLANCE The SRs for each RTS Function are identified by the SRs column of Table REQUIREMENTS 3.3.1-1 for that Function.

A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RTS Functions.

Note that each channel of process protection supplies both trains of the RTS. When testing Channel 1, Train A and Train B must be examined.

Similarly, Train A and Train B must be examined when testing Channel 2, Channel 3, and Channel 4 (if applicable). The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies (Ref. 8).

SR 3.3.1.1 A CHANNEL CHECK is required for the following RTS trip functions:

"* Power Range Neutron Flux-High;

"* Power Range Neutron Flux-Low; R.E. Ginna Nuclear Power Plant B 3.3.1-35 Revision 18

RTS Instrumentation B 3.3.1

"* Intermediate Range Neutron Flux;

"* Source Range Neutron Flux;

"* Overtemperature AT;

"* Overpower AT;

Pressurizer Pressure-Low;

"* Pressurizer Pressure-High;

"* Pressurizer Water Level-High;

"* Reactor Coolant Flow-Low (Single Loop);

"* Reactor Coolant Flow-Low (Two Loops); and

"* SG Water Level-Low Low Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of more serious instrument conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is a verification that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Channel check acceptance criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

R.E. Ginna Nuclear Power Plant B 3.3.1-36 Revision 18

RTS Instrumentation B 3.3.1 SR 3.3.1.2 This SR compares the calorimetric heat balance calculation to the NIS Power Range Neutron Flux-High channel output every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If the calorimetric exceeds the NIS channel output by > 2% RTP, the NIS is still OPERABLE but must be adjusted. If the NIS channel output cannot be properly adjusted, the channel is then declared inoperable.

This SR is modified by a Note which states that this Surveillance is required to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after power is _>50% RTP. At lower power levels, calorimetric data are inaccurate.

The Frequency of every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on plant operating experience, considering instrument reliability and operating history data for instrument drift. Together these factors demonstrate the change in the absolute difference between NIS and heat balance calculated powers rarely exceeds 2% in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

In addition, control room operators periodically monitor redundant indications and alarms to detect deviations in channel outputs.

SR 3.3.1.3 This SR compares the incore system to the NIS channel output every 31 effective full power days (EFPD). If the absolute difference is > 3%, the NIS channel is still OPERABLE, but must be readjusted. If the NIS channel cannot be properly readjusted, the channel is then declared inoperable. This surveillance is performed to verify the f(AI) input to the Overtemperature AT Functior ,*.ýp,.,

This SR is modified by two Notes. Note 1 clarifies that the Surveillance is required to be performed within 7 days after THERMAL POWER is > 50%

RTP but prior to exceeding 90% RTP following each refueling and if it has not been performed within the last 31 EFPD. Note 2 states that performance of SR 3.3.1.6 satisfies this SR since it is a more comprehensive test.

The Frequency of every 31 EFPD is based on plant operating experience, considering instrument reliability and operating history data for instrument drift. Also, the slow changes in neutron flux during the fuel cycle can be detected during this interval.

SR 3.3.1.4 This SR is the performance of a TADOT every 31 days on a STAGGERED TEST BASIS of the RTB, and the RTB Undervoltage and Shunt Trip Mechanisms. This test shall verify OPERABILITY by actuation of the end devices.

R.E. Ginna Nuclear Power Plant B 3.3.1-37 Revision 18

RTS Instrumentation B 3.3.1 The test shall include separate verification of the undervoltage and shunt trip mechanisms except for the bypass breakers which do not require separate verification since no capability is provided for performing such a test at power. The independent test for bypass breakers is included in SR 3.3.1.11. However, the bypass breaker test shall include a local shunt trip. This test must be performed on the bypass breaker prior to placing it in service to take the place of a R197.

The Frequency of every 31 days on a STAGGERED TEST BASIS is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.1.5 This SR is the performance of an ACTUATION LOGIC TEST on the RTS Automatic Trip Logic every 31 days on a STAGGERED TEST BASIS.

The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. All possible logic combinations, with and without applicable permissives, are tested for each protection function. The Frequency of every 31 days on a STAGGERED TEST BASIS is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.1.6 This SR is a calibration of the excore channels to the incore channels every 92 EFPD. If the measurements do not agree, the excore channels are still OPERABLE but must be calibrated to agree with the incore detector measurements. If the excore channels cannot be adjusted, the channels are then declared inoperable. This surveillance is performed to verify the f(AI) input to the Overtemperature AT Functio . A r,- .

This SR has been modified by a Note stating that this Surveillance is required to be performed within 7 days after THERMAL POWER is > 50%

RTP but prior to exceeding 90% RTP following each refueling.

The Frequency of 92 EFPD is adequate based on industry operating experience, considering instrument reliability and operating history data for instrument drift.

SR 3.3.1.7 This SR is the performance of a COT every 92 days for the following RTS functions:

"* Power Range Neutron Flux-High;

"* Source Range Neutron Flux (in MODE 3, 4, or 5 with CRD System capable of rod withdrawal or all rods not fully inserted);

"* Overtemperature AT; R.E. Ginna Nuclear Power Plant B 3.3.1-38 Revision 18

RTS Instrumentation B 3.3.1

Overpower AT;

"* Pressurizer Pressure-Low;

"* Pressurizer Pressurizer-High;

"* Pressurizer Water Level-High;

"* Reactor Coolant Flow-Low (Single Loop);

"* Reactor Coolant Flow-Low (Two Loops); and

"* SG Water Level-Low Low A COT is performed on each required channel to ensure the entire channel will perform the intended Function. Setpoints must be within the Trip Setpoint of Table 3.3.1-1. The "as left" values must be consistent with the drift allowance used in the setpoint methodology (Ref. 8).

This SR is modified by a Note that provides a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months delay in the requirement to perform this surveillance for source range instrumentation when entering MODE 3 from MODE 2. This Note allows a normal shutdown to proceed without a delay for testing in MODE 2 and for a short time in MODE 3 until the RTBs are open and SR 3.3.1.7 is no longer required to be performed. If the plant is in MODE 3 with the RTBs closed for greater than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , this SR must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after entry into MODE 3.

The Frequency of 92 days is consistent with Reference 9.

SR 3.3.1.8 This SR is the performance of a COT as described in SR 3.3.1.7 for the Power Range Neutron Flux-Low, Intermediate Range Neutron Flux, and Source Range Neutron Flux (MODE 2), except that this test also includes verification that the P-6 and P-10 interlocks are in their required state for the existing plant condition. This SR is modified by two Notes that provide a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months delay in the requirement to perform this surveillance.

These Notes allow a normal shutdown to be completed and the plant removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance. The Frequency of every 92 days applies if the plant remains in the MODE of Applicability after the initial performances of prior to reactor startup and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power below P-10 or P-6.

R.E. Ginna Nuclear Power Plant B 3.3.1-39 Revision 18

RTS Instrumentation 0 B 3.3.1 The MODE of Applicability for this surveillance is <ijfor the power range low and intermediate range channels and <"Jfor-the Source range channels. Once the plant is in MODE 3, this surveillance is no longer required. If power is to be maintainedg' Oo Pfor more than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , then the testing required by this surveillance must be performed prior to the expiration of the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months limit. Four hours is a reasonable time to complete the required testing or place the plant in a MODE where this surveillance is no longer required. This test ensures that the NIS source, intermediate, and power range low channels are OPERABLE prior to taking the reactor critical and after reducing power into the applicable MODE (< or <: P- ,for periods > 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

SR 3.3.1.9 ,*- o, -- /

This SR is the performance of a TADOT for the Undervoltage-Bus 11A and 11 B and Underfrequency-Bus 11 A and 11 B trip Functions. The Frequency of every 92 days is consistent with Reference 9.

This SR is modified by a Note that excludes verification of setpoints from the TADOT. Since this SR applies to Bus 11A and 11B undervoltage and underfrequency relays, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION required by SR 3.3.1.10.

SR 3.3.1.10 This SR is the performance of a CHANNEL CALIBRATION for the following RTS Functions:

Power Range Neutron Flux-High;

Power Range Neutron Flux-Low; Intermediate Range Neutron Flux; Source Range Neutron Flux;

"* Overtemperature AT;

"* Overpower AT;

"* Pressurizer Pressure-Low;

"* Pressurizer Pressure-High;

"* Pressurizer Water Level-High;

"* Reactor Coolant Flow-Low (Single Loop);

"* Reactor Coolant Flow-Low (Two Loops);

R.E. Ginna Nuclear Power Plant B 3.3.1-40 Revision 18

RTS Instrumentation B 3.3.1

"* Undervoltage-Bus 11A and 11 B;

"* Underfrequency-Bus 11A and 11B;

"* SG Water Level-Low Low;

"* Turbine Trip-Low Autostop Oil Pressure; and

"* Reactor Trip System Interlocks.

A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the plant specific setpoint methodology (Ref. 8). The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 24 months is based on the assumption of 24 month calibration intervals in the determination of the magnitude of equipment drift in the setpoint methodology.

With respect to RTDs, whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors shall include an inplace qualitative assessment of sensor behavior and normal calibration of the remaining adjustable devices in the channel. This is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.

This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the power range neutron detectors consists of a normalization of the detectors based on a power calorimetric and flux map performed above 50% RTP. The CHANNEL CALIBRATION for the source range and intermediate range neutron detectors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. This Surveillance is not required for the NIS power range detectors for entry into MODE.2 or 1, and is not required for the NIS intermediate range detectors for entry into MODE 2, because the plant must be in at least MODE 2 to perform the test for the intermediate range detectors and MODE 1 for the power range detectors. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has R.E. Ginna Nuclear Power Plant B 3.3.1-41 Revision 18

RTS Instrumentation B 3.3.1 shown these components usually pass the Surveillance when performed on the 24 month Frequency.

SR 3.3.1.11 This SR is the performance of a TADOT of the Manual Reactor Trip, RCP Breaker Position, and the SI Input from ESFAS trip Functions. This TADOT is performed every 24 months. This test independently verifies the OPERABILITY of the undervoltage and shunt trip mechanisms for the Manual Reactor Trip Function for the Reactor Trip Breakers and Reactor Trip Bypass Breakers.

The Frequency is based on the known reliability of the Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.1.12 This SR is the performance of a TADOT for Turbine Trip Functions which is performed prior to reactor startup if it has not been performed within the last 31 days. This test shall verify OPERABILITY by actuation of the end devices.

The Frequency is based on the known reliability of the Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

This SR is modified by a Note stating that verification of the Trip Setpoint does not have to be performed for this Surveillance. Performance of this test will ensure that the turbine trip Function is OPERABLE prior to taking the reactor critical because portions of this test cannot be performed with the reactor at power.

SR 3.3.1.13 This SR is the performance of a COT of the RTS interlocks every 24 months.

The Frequency is based on the known reliability of the interlocks and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

R.E. Ginna Nuclear Power Plant B 3.3.1-42 Revision 18

RTS Instrumentation B 3.

3.1 REFERENCES

1. Atomic Industry Forum (AIF) GDC 14, Issued for comment July 10, 1967.

2. 10 CFR 100.

3. American National Standard, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.

4. UFSAR, Chapter 7.

5. UFSAR, Chapter 6.

6. UFSAR, Chapter 15.

7. IEEE-279-1971.

8. G&E Engineering Work Request (EWR) 5512266, "Guideliness ffor 9 I.sWCAment0271-P-AoSpplee 2,tion aRnd. Setpoi t1

9. WCAP-1 0271 -P-A, Supplement 2, Rev. 1, June 1990.

0J E/P- 3 -oxS,"J F, *r*/op,< <,"

R.E. Ginna Nuclear Power Plant B 3.3.1-43 Revision 18

RTS Instrumentation B 3.3.1 Field Instrument Signal Process Channel Control & 11 Control &

Protection Protection Equipment Equipment F.

Signal Process Signal Process Control & Control &

Protection Protection SEquipment I-* Equipment Reactor Trip .......... Reactor Trip Switchgear Switchgear Bypass RTB A RTB B UV Bypass RTB B V ShuntTrip and Shunt Shunt Trip Trip Trip Mechanism Mechanism Mechanism Bypass RTB A RTB B RTB A RTB B CRDMs For illustration only

- Train A -7 Bistable AC 120V AC Power Source B .......

.Train

.-- Automatic Trip Logic DOC125V DC Power Source Figure B 3.3.1-1 R.E. Ginna Nuclear Power Plant B 3.3.1-44 Revision 18

ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND Atomic Industrial Forum (AIF) GDC 15 (Ref. 1) requires that protection systems be provided for sensing accident situations and initiating the operation of necessary engineered safety features.

The ESFAS initiates necessary safety systems, based on the values of selected plant parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.

The ESFAS instrumentation is segmented into two distinct but interconnected modules as described in UFSAR, Chapter 7 (Ref. 2):

"* Field transmitters or process sensors; and

"* Signal processing equipment.

These modules are discussed in more detail below.

Field Transmitters and Process Sensors Field transmitters and process sensors provide a measurable electronic signal based on the physical characteristics of the parameter being measured. To meet the design demands for redundancy and reliability, two, three, and up to four field transmitters or sensors are used to measure required plant parameters. In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS). To account for calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are provided. These statistical allowances provide the basis for determining acceptable "as left" and "as found" calibration values for each transmitter or sensor.

R.E. Ginna Nuclear Power Plant B 3.3.2-1 Revision 18

ESFAS Instrumentation B 3.3.2 Siqnal Processing Equipment The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are defined in UFSAR, Chapter 6 (Ref. 3), Chapter 7 (Ref. 2), and Chapter 15 (Ref. 4). If the measured value of a plant parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the logic relays.

Generally, three or four channels of process control equipment are used for the signal processing of plant parameters measured by the field transmitters and sensors. If a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are typically sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function can still be accomplished with a two-out-of-two logic. If one channel fails in a direction that a partial Function trip occurs, a trip will not occur unless a second channel fails or trips in the remaining one-out-of-two logic.

If a parameter is used for input to the protection system and a control function, four channels with a two-out-of-four logic are typically sufficient to provide the required reliability and redundancy.

This ensures that the circuit is able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Therefore, a single failure will neither cause nor prevent the protection function actuation. These requirements are described in IEEE-279-1 971 (Ref. 5).

The actuation of ESF components is accomplished through master and slave relays. The protection system energizes the master relays appropriate for the condition of the plant. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices.

R.E. Ginna Nuclear Power Plant B 3.3.2-2 Revision 18

ESFAS Instrumentation B 3.3.2 APPLICABLE Each of the analyzed accidents can be detected by one or more ESFAS SAFETY Functions. One of the ESFAS Funtions is the primary actuation signal for ANALYSES, that accident. An ESFASFunction may be the primary actuation signal for LCO, AND more than one type of accident. An ESFAS Function may also be a APPLICABILITY secondary, or backup, actuation signal for one or more other accidents.

For example, SI-Pressurizer Pressure-Low is a primary actuation signal for small break loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment. Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the plant. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as anticipatory actions to Functions that were credited in the accident analysis (Ref. 4).

S e4his LCO requires all instrumentation performing an ESFAS Function to be 0 Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single failure disables the ESFAS.

The LCO and Applicability of each ESFAS Function are provided in Table 3.3.2-1. Included on Table 3.3.2-1 are Allowable Valuesc Tr

(ý nt for all applicable ESFAS Functions. Setpoints in accordance wiff- the Allowable Value ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the plant is operated within the LCOs, including any Required Actions that are in effect at the onset of the DBA and the equipment functions as designed.

ET~',447 . The Trip Setpoints are the limiting values at which the bistables are set.

Any bistable is considered to be properly adjusted when the "as left" value is within the allowable tolerance band for CHANNEL CALIBRATION accuracy.

R.E. Ginna Nuclear Power Plant B 3.3.2-3 Revision 18

ESFAS Instrumentation B 3.3.2 The trip Setpoints used in the bistables are based on the analyticall limits stated in References 2, 3, and 4. The selection of these trip Setpoints is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, and instrument drift are taken into account. The Trip Setpoints specified in Table 3.3.2-1 are therefore conservatively adjusted with respect to The analytical limits (i.e., Allowable Values) used in the accident analysis. A detailed description of the methodology used to verify the adequacy of the existing Trip Setpoints, including their explicit uncertainties, is provided in Reference 6. If the measured setpoint exceeds the Trip Setpoint Value, the bistable is considered OPERABLE unless the Allowable Value as specified in plant procedures is exceeded.

The Allowable Value specified in the plant procedures bounds that provided in Table 3.3.2-1 since the values in the table are typically those used in the accident analysis.

The Trip Setpoints and Allowable Values listed in Table 3.3.2-1 have been applicable for each channel.

confirmed based on the methodology described in Reference 6, which all of the known uncertainties incorporates The magnitudes of these uncertainties are factored into the determination of each Trip Setpoint. All field sensors and signal processing equipmentt for these channels are assumed to operate within the allowances of these uncertainty magnitudes.

The required channels of ESFAS instrumentation provide plant protection in the event of any of the analyzed accidents. ESFAS protection functions provided in Table 3.3.2-1 are as follows:

1. Safetly Injection Safety Injection (SI) provides two primary functions:

1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200 0 F); and

2. Boration to ensure recovery and maintenance of SDM (keff

< 1.0).

These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment.

The SI signal is also used to initiate other Functions such as:

Containment Isolation;

Containment Ventilation Isolation;

Reactor Trip; R.E. Ginna Nuclear Power Plant B 3.3.2-4 Revision 18

ESFAS Instrumentation B 3.3.2

"° Feedwater Isolation; and

"° Start of motor driven auxiliary feedwater (AFW) pumps.

These other functions ensure:

"* Isolation of nonessential systems through containment penetrations;

"* Trip of the reactor to limit power generation;

"* Isolation of main feedwater (MFW)to limit secondary side mass losses; and

"* Start of AFW to ensure secondary side cooling capability.

a. Safety Iniection-Manual Initiation This LCO requires oine c annel per train to be OPERABLE in MODES 1, 2, 6 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. The operator can initiate SI at any time by using either of two pushbuttons on the main control board. This action will cause actuation of all components with the exception of Containment Isolation Cajdn onainm`ent Ventilation lsolatiorý The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.

Each channel consists of one pushbutton and the interconnecting wiring to the actuation logic cabinet. Each pushbutton actuates both trains. This configuration does not allow testing at power.

This function is not required to be OPERABLE in MODES4Q' 51 and 6 because there is adequate time for the operator to evaluate plant conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.

Plant pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadverten overoressurizatfion of lant systems. Also, this Function is not required in MODE 4 since it oes not actuate Containment Isolation or Containment Ventilation Isolation.

R.E. Ginna Nuclear Power Plant B 3.3.2-5 Revision 18

ESFAS Instrumentation B 3.3.2

b. Safety Injection-Automatic Actuation Logic and Actuation Relays This LCO requires two trains to be OPERABLE in MODES 1, 2, 3, and 4. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

This Function is not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate plant conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.

Plant pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of plant systems.

c. Safety Iniection-Containment Pressure-High This signal provides protection against the following accidents:

"* SLB inside containment;

"* LOCA; and

"* Feed line break inside containment.

Containment Pressure-High provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic.

PT-945, PT-947, and PT-949 are the three channels required for this function. The transmitters and electronics are located outside of containment with the sensing lines passing through containment penetrations to sense the containment atmosphere in three different locations.

Thus, the high pressure Function will not ex aen__

adverse environmental conditions and fhe Setoi reflects only steady state instrument uncertainties.

R.E. Ginna Nuclear Power Plant B 3.3.2-6 Revision 18

ESFAS Instrumentation B 3.3.2 Containment Pressure-High must be OPERABLE in MODES 1, 2, 3, and 4 because there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 5 and 6, Containment Pressure-High is not required to be OPERABLE because there is insufficient energy in the primary or secondary systems to pressurize the containment.

d. Safety Iniection-Pressurizer Pressure-Low This signal provides protection against the following accidents:

"* Inadvertent opening of a steam generator (SG) atmospheric relief or safety valve;

"* SLB;

"* Rod cluster control assembly ejection accidents (rod ejection);

"* Inadvertent opening of a pressurizer relief or safety valve;

"* LOCAs; and

"* SG Tube Rupture.

Since there are dedicated protection and control channels, only three protection channels are necessary to satisfy the protective requirements. PT-429, PT-430, and PT-431 are the three channels required for this function.

The transmitters are located inside containment, with the taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions LOCA, SLB inside containment, rod ejection). Therefore, the SV/e rp.STetpoin reflects the inclusion of both steady state and adverse environmental instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 (above the Pressurizer Pressure interlock)to mitigate the consequences of an HELB inside containment. This signal may be manually blocked by the operator below the interlock setpoint. Automatic SI actuation below this interlock setpoint is performed by the Containment Pressure-High signal.

R.E. Ginna Nuclear Power Plant B 3.3.2-7 Revision 18

ESFAS Instrumentation B 3.3.2 This function is not required to be OPERABLE in MODE 3 below the Pressurizer Pressure interlock setpoint. Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.

e. Safety Iniection-Steam Line Pressure-Low Steam Line Pressure-Low provides protection against the following accidents:

"* SLB;

"* Feed line break; and

"* Inadvertent opening of an SG atmospheric relief or an SG safety valve.

Steam line pressure transmitters provide control input, but the control function cannot initiate events that the Function acts to mitigate. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the protective requirements with a two-out-of-three logic on each steam line. PT-468, PT-469, and PT-482 are the three channels required for steam line A.

PT-478, PT-479, and PT-483 are the three channels required for steam line B. Each steam line is considered a separate function for the purpose of this LCO.

With the transmitters located in the Intermediate Building, it is possible for them to experience adverse environmental conditions during a secondary side break. Therefore, the A(v eireflects both steady state and adverse environmental instrument uncertainties.

Steam Line Pressure-Low must be OPERABLE in MODES 1, 2, and 3 (above The Pressurizer Pressure interlock) when a secondary side break or stuck open SG atmospheric relief or safety valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the interlock setpoint. Below the interlock setpoint, a feed line break is not a concern. This Function is not required to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the plant to cause an accident.

R.E. Ginna Nuclear Power Plant B 3.3.2-8 Revision 18

ESFAS Instrumentation B 3.3.2

2. Containment Spray (CS)

CS provides three primary functions:

1. Lowers containment pressure and temperature after an HELB in containment;

2. Reduces the amount of radioactive iodine in the containment atmosphere; and

3. Adjusts the pH of the water in containment sump B after a large break LOCA.

These functions are necessary to:

"* Ensure the pressure boundary integrity of the containment structure;

"* Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure; and

"* Minimize corrosion of the components and systems inside containment following a LOCA.

CS is actuated manually or by Containment Pressure-High High.

The CS actuation signal starts the CS pumps and aligns the discharge of the pumps to the CS nozzle headers in the upper levels of containment. Water is initially drawn from the RWST by the CS pumps and mixed with a sodium hydroxide solution from the spray additive tank. During the recirculation phase of accident recovery, the spray pump suctions are manually shifted to containment sump B if continued CS is required.

a. CS-Manual Initiation The operator can initiate CS at any time from the control room by simultaneously depressing two CS actuation pushbuttons.

Because an inadvertent actuation of CS could have serious consequences, two pushbuttons must be simultaneously depressed to initiate both trains of CS. Therefore, the inoperability of either pushbutton fails both trains of manual initiation.

Manual initiation of CS must be OPERABLE in MODES 1, 2, 3, and 4 because a DBA could cause a release of radioactive material to containment and an increase in containment temperature and pressure requiring the operation of the CS System.

R.E. Ginna Nuclear Power Plant B 3.3.2-9 Revision 18

ESFAS Instrumentation B 3.3.2 In MODES 5 and 6, this function is not required to be OPERABLE because the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. In MODES 5 and 6, there is also adequate time for the operators to evaluate plant conditions and respond to mitigate the consequences of abnormal conditions by manually starting individual components.

b. CS-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

Automatic initiation of CS must be OPERABLE in MODES 1, 2, 3, and 4 because a DBA could cause a release of radioactive material to containment and an increase in containment temperature and pressure requiring the operation of the CS System.

In MODES 5 and 6, this Function is not required to be OPERABLE because the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. In MODES 5 and 6, there is also adequate time for the operators to evaluate plant conditions and respond to mitigate the consequences of abnormal conditions by manually starting individual components.

c. CS-Containment Pressure-High High This signal provides protection against a LOCA or an SLB inside containment. The transmitters are located outside of containment with the sensing lines passing through containment penetrations to sense the containment atmosphere in three different locations. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions and the qeflects only steady state instrument uncertainties.

This is the only ESFAS Function that requires the bistable output to energize to perform its required action. It is not desirable to have a loss of power actuate CS, since the consequences of an inadvertent actuation of CS could be serious.

R.E. Ginna Nuclear Power Plant B 3.3.2-10 Revision 18

ESFAS Instrumentation B 3.3.2 The Containment Pressure-High High instrument function consists of two sets with three channels in each set. One set is comprised of PT-945, PT-947, and PT-949. The second set is comprised of PT-946, PT-948, and PT-950. Each set is a two-out-of-three logic where the outputs are combined so that both sets tripped initiates CS. Each set is considered a separate function for the purposes of this LCO. Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements. Additional redundancy is warranted because this Function is energize to trip. Containment Pressure-High High must be OPERABLE in MODES 1, 2, 3 and 4 because a DBA could cause a release of radioactive material to containment and an increase in containment temperature and pressure requiring the operation of the CS System.

In MODES 5 and 6, this Function is not required to be OPERABLE because the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. In MODES 5 and 6, there is also adequate time for the operators to evaluate plant conditions and respond to mitigate the consequences of abnormal conditions by manually starting individual components.

3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and selected process systems that penetrate containment, from the environment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a LOCA.

Containment Isolation signals isolate all automatically isolatable process lines, except feedwater lines, main steam lines, and component cooling water (CCW). The main feedwater and steam lines are isolated by other functions since forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW is required to support RCP operation, not isolating CCW enhances plant safety by allowing operators to use forced RCS circulation to cool the plant. Isolating CCW may require the use of feed and bleed cooling, which could prove more difficult to control.

a. Containment Isolation-Manual Initiation Manual Containment Isolation is actuated by either of two pushbuttons on the main control board. Either pushbutton actuates both trains. Manual initiation of Containment Isolation also actuates Containment Ventilation Isolation.

R.E. Ginna Nuclear Power Plant B 3.3.2-11 Revision 18

ESFAS Instrumentation B 3.3.2 Manual initiation of Containment Isolation must be OPERABLE in MODES 1, 2, 3 and 4, because there is a potential for an accident to occur.

In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Containment Isolation. There also is adequate time for the operator to evaluate plant conditions and manually actuate individual isolation valves in response to abnormal or 2 f'accident conditions.

b. Containment Isolation-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

Automatic initiation of Containment Isolation must be OPERABLE in MODES 1, 2, 3 and 4, because there is a potential for an accident to occur.

In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Containment Isolation. There also is adequate time for the operator to evaluate plant conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

c. Containment Isolation-Safety Injection Containment Isolation is also initiated by all Functions that automatically initiate SI. The Containment Isolation requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable initiating Functions and requirements.

4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. Closure of the main steam isolation valves (MSIVs) and their associated non-return check valves limits the accident to the blowdown from only the affected SG. For a SLB downstream of the MSIVs, closure of the MSIV.s terminates the accident as soon as the steam lines depressurize.

Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.

R.E. Ginna Nuclear Power Plant B 3.3.2-12 Revision 18

ESFAS Instrumentation B 3.3.2

a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two actuation devices (one pushbutton and one switch) on the main control board for each MSIV. Each device can initiate action to immediately close its respective MSIV. The LCO requires one channel (device) per loop to be OPERABLE. Each loop is not considered a separate function since there is only one required per loop.

Manual initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 because a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. In MODES 4, 5, and 6, the steam line isolation function is not required to be OPERABLE because there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.

b. Steam Line Isolation-Automatic Actuation Loqic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

Automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 because a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. In MODES 4, 5, and 6, the steam line isolation function is not required to be OPERABLE because there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.

R.E. Ginna Nuclear Power Plant B 3.3.2-13 Revision 18

ESFAS Instrumentation B 3.3.2 C. Steam Line Isolation-Containment Pressure-High High This Function actuates closure of both MSIVs in the event of a LOCA or an SLB inside containment to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. The transmitters are located outside containment with the sensing lines passing through containment penetrations to sense the containment atmosphere in three different locations. Thus, they will not experience any adverse environmental V< J /ve conditions, and the ( o'reflects only steady state "instrumentuncertainties. Containment Pressure-High High provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with two-out-of-three logic. PT-946, PT-948, and PT-950 are the three channels required for this function.

Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, because there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs. The steam line isolation Function must be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. In MODES 4, 5, and 6 the steam line isolation Function is not required to be OPERABLE because there is not enough energy in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.

d. Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Tv.Y.-Low This Function provides closure of the MSIVs during an SLB or inadvertent opening of multiple SG atmospheric relief or safety valves to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.

The specified Allowable Value is based on steam line breaks occurring from no load conditions (1005 psig). Specifically,

_ýN line breakswhich result in a > 10% RTP step change Q* (0.66E6%m/hr) are considered. The steam flow signal to this function's bistables are not pressure compensated (i.e.,

only the main control board indicators are compensated).

However, the high steam flow bistable setpoint is determined Sfrom the expeed flow transmitter differential pressure under Ssteam conditions of 0.66E6f'm/hr at 1005 psig. Steam breaks which result in higher flowrates or lower pressure generate larger differential pressures such that the high R.E. Ginna Nuclear Power Plant B63.3.2-14 Revision 18

ESFAS Instrumentation B 3.3.2 steam flow bistables would be tripped. Steam line breaks which result in a < 10% RTP step change can be manually isolated by operators. The high steam flow bistables are OPERABLE if they are placed ip.the tripped condition since the specified StiaAllowable Value Crmet.- "

However, all applicable surveillances related to the tripped channel must continue to be performed and met.

Two steam line flow channels per steam line are required to be OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high steam flow in one steam line. FT-464 and FT-465 are the two channels required for steam line A. FT-474 and FT-475 are the two channels required for steam line B. Each steam line is considered a separate function for the purpose of this LCO. The steam flow transmitters provide control inputs, but the control function cannot initiate events that the function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues. The one-out of-two configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation.

With the transmitters (d/p cells) located inside containment, it is possible for them to experience adverse environmental conditions during an SLB event. Therefore, th t

--- i e-fec both steady state and adverse environmental 1641 1 instrument uncertainties.

The main steam line isolates only if the high steam flow signal occurs coincident with an SI and low RCS average temperature. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable initiating functions and requirements.

Two channels of Tavg per loop are required to be OPERABLE for this Function. TC-401 and TC-402 are the two channels required for RCS loop A. TC-403 and TC-404 are the two channels required for RCS loop B. Each loop is considered a separate Function for the purpose of this LCO. The Tavg channels are combined in a logic such that any two of the four Tavgchannels tripped in conjunction with SI and one of the two high steam line flow channels tripped causes isolation of the steam line associated with the tripped steam line flow channels. The accidents that this Function protects against cause reduction of T avg in the entire primary system.

Therefore, the provision of two OPERABLE channels per R.E. Ginna Nuclear Power Plant B 3.3.2-15 Revision 18

ESFAS Instrumentation B 3.3.2 loop in a two-out-of-four configuration ensures no single failure disables the Tavg-Low Function. The Tavg channels provide control inputs, but the control function cannot initiate events that the Function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues.

This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the plant to have an accident.

e. Steam Line Isolation-Hiqh High Steam Flow Coincident With Safety Iniection This Function provides closure of the MSIVs during a large steam line break to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.

The specified allowable Value is based on steamline breaks occurring from full power steam conditions which result in

_>109% RTP steam flow. The steam flow signal to this function's bistables are not pressure compensated (i.e., only the main control board indicators are compensated).

However, the high-high steam flow bistable setpoint is determined from the expected flow transmitr differential pressure under steam conditions of 3.7E6 bin/hr at 755 psig.

Steam breaks which result in higher flowrates or lower pressure generate larger differential pressures such that the high-high steam flow bistables would be tripped.

Two steam line flow channels per steam line are required to be OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high-high steam flow in one steam line. FT-464 and FT-465 are the two channels required for steam line A. FT-474 and FT-475 are the two channels required for steam line B. Each steam line is considered a separate function for the purpose of this LCO.

The steam flow transmitters provide control inputs, but the control function cannot initiate events that the Function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues.

R.E. Ginna Nuclear Power Plant B 3.3.2-16 Revision 18

ESFAS Instrumentation B 3.3.2 The main steam lines isolate only if the high-high steam flow signal occurs coincident with an SI signal.- Steamline isolation occurs only for the steam line associated with the tripped steam flow channels. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable initiating functions and requirements.

This Function must be OPERABLE in MODES 1, 2, and 3 because a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIV's are closed and de activated. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the plant to have an accident.

5. Feedwater Isolation The primary function of the Feedwater Isolation signals is to prevent and mitigate the effects of highwater level in the SGs which could cause carryover of water into the steam lines and result in excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows.

This Function is actuated by either a SG Water Level-High or an SI signal. The Function provides feedwater isolation by closing the Main Feedwater Regulating Valves (MFRVs) and the associated bypass valves. In addition, on an SI signal, the AFW System is automatically started, and the MFW pump breakers are opened which closes the MFW pump discharge valves. The SI signal was discussed previously.

a. Feedwater Isolation-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

Automatic initiation must be OPERABLE in MODES 1, 2, and

3. The Feedwater Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this Function is not required to be OPERABLE.

R.E. Ginna Nuclear Power Plant B 3.3.2-17 Revision 18

ESFAS Instrumentation B 3.3.2

b. Feedwater Isolation-Steam Generator Water Level-High The Steam Generator Water Level-High Function must be OPERABLE in MODES 1, 2, and 3. The Feedwater Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this Function is not required to be OPERABLE.

This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments have dedicated protection and control channels, only three protection channels are necessary to satisfy the protective requirements. LT-461, LT-462, and LT-463 are the three channels required for SG A. LT-471, LT-472, and LT-473 are the three channels required for SG B. Each SG is considered a separate Function for the purpose of this LCO. The Allowable Value for SG Water Level-High is a percent of narrow range instrument span. ah therip etpotin is ýstmii ar; Ccalrculat~ed_.j

c. Feedwater Isolation-Safety Iniection The Safety Injection Function must be OPERABLE in MODES 1, 2, and 3. The Feedwater Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MFRVs and associated bypass valves are closed and de activated or isolated by a closed manual valve. In MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this Function is not required to be OPERABLE.

Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.

6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available.

The preferred system has two motor driven pumps and a turbine driven pump, making it available during normal plant operatiop, during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break (depending on break location). A Standby AFW (SAFW) System is also available in the event the preferred system is unavailable. The normal source of water for the AFW System is R.E. Ginna Nuclear Power Plant B 3.3.2-18 Revision 18

ESFAS Instrumentation B 3.3.2 the condensate storage tank (CST) which is not safety related.

Upon a low level in the CST the operators can manually realign the pump suctions to the Service Water (SW) System which is the safety related water source. The SW System also is the safety related water source for the SAFW System. The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately while the SAFW System is only manually initiated and aligned.

a. Auxiliary Feedwater-Manual Initiation The operator can initiate AFW or SAFW at any time by using control switches on the Main Control board (one switch for each pump in each system). This action will cause actuation of their respective pump.

The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained to ensure the operator has manual AFW and SAFW initiation capability.

The LCO requires one channel per pump in each system to be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

b. Auxiliary Feedwater-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

Automatic initiation of Auxiliary Feedwater must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

R.E. Ginna Nuclear Power Plant B 3.3.2-19 Revision 18

ESFAS Instrumentation B 3.3.2

c. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low must be OPERABLE in MODES 1, 2, and 3 to provide protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low in either SG will cause both motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level-Low Low in both SGs will cause the turbine driven pump to start. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or RHR will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.

This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

LT-461, LT-462, and LT-463 are the three channels required for SG A. LT-471, LT-472, and LT-473 are the three channels required for SG B. Each SG is considered a separate Function for the purpose of this LCO. The Allowable Value for SG Water Level - Low Low is a percent of narrow range instrument span. _e Tp Setpoint imilarl ý With the transmitters (d/p cells) located inside containment and thus possibly experiencing adverse envir _nmental conditions (feed line break), the Seoire ects; the inclusion of both steady state and adverse environmental instrument uncertainties.

d. Auxiliary Feedwater-Safety Iniection The SI function must be OPERABLE in MODES 1,2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.

This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

An SI signal starts the motor driven and turbine driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable initiating functions and requirements.

R.E. Ginna Nuclear Power Plant B 3.3.2-20 Revision 18

ESFAS Instrumentation B 3.3.2

e. Auxiliary Feedwater-Undervoltage-Bus 11 A and 11 B The Undervoltage-Bus 11A and 11B Function must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or RHR will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

A loss of power to 4160 V Bus 11A and 11B will be accompanied by a loss of power to both MFW pumps and the subsequent need for some method of decay heat removal.

The loss of offsite power is detected by a voltage drop on each bus. Loss of power to both buses will start the turbine driven AFW pump to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip. Each bus is considered a separate Function for the purpose of this LCO.

f. Auxiliary Feedwater-Trip Of Both Main Feedwater Pumps A trip of both MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal. The MFW pumps are equipped with a breaker position sensing device. An open supply breaker indicates that the pump is not running. Two OPERABLE channels per MFW pump satisfy redundancy requirements with two-out-of-two logic. Each MFW pump is considered a Separate Function for the purpose of this LCO. A trip of both MFW pumps starts both motor driven AFW (MDAFW) pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor. However, this actuation of the MDAFW pumps is not credited in the mitigation of any accident.

This Function must be OPERABLE in MODE 1. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 2, 3, 4, 5, and 6 the MFW pumps may not be in operation, and thus pump trip is not indicative of a condition requiring automatic AFW initiation.

R.E. Ginna Nuclear Power Plant B 3.3.2-21 Revision 18

ESFAS Instrumentation B 3.3.2 ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.

In the event a channel's.rip$'etpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. As shown on Figure B 3.3.2-1, the ESFAS is comprised of multiple interconnected modules and components. For the purpose of this LCO, a cha nnel is defined as including all related components from the field instrument to the Automatic Actuation Logic. Therefore, a channel may be inoperable due to the failure of a field instrument, loss of 120 VAC instrument bus power or a bistable failure which affects one or both ESFAS trains. The only exception to this are the Manual ESFAS and Automatic Actuation Logic Functions which are defined strictly on a train basis. The Automatic Actuation Logic consists of all circuitry housed within the actuation subsystem, including the master relays, slave relays, and initiating relay contacts responsible for activating the ESF equipment.

A..1 Condition A applies to all ESFAS protection functions.

Condition A addresses the situation where one channel or train for one or more Functions are inoperable. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.

When the number of inoperable channels in an ESFAS Function exceed those specified in all related Conditions associated with an ESFAS Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered if the ESFAS function is applicable in the current MODE of operation.

B..1 Condition B applies to the AFW-Trip of Both MFW Pumps ESFAS Function. If a channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to return it to OPERABLE status. The specified Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is reasonable considering the nature of this Function, the available redundancy, and the low probability of an event occurring during this interval.

R.E. Ginna Nuclear Power Plant B 3.3.2-22 Revision 18

ESFAS Instrumentation B 3.3.2 C.1 If the Required Action and Completion Time of Condition B is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion time is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

D..1 Condition D applies to the following ESFAS Functions:

"* Manual Initiation of SI;

"* Manual Initiation of Steam Line Isolation; and

"* AFW-Undervoltage-Bus 11A and 11 B.

If a channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to restore it to OPERABLE status. The specified Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each manual initiation Function, additional AFW actuation channels available besides the Undervoltage Bus 11 A and 11 B AFW Initiation Function, and the low probability of an event occurring during this interval.

E.1 Condition E applies to the automatic actuation logic and actuation relays for the following ESFAS Functions:

"* Steam Line Isolation;

"* Feedwater Isolation; and

"* AFW.

Condition E addresses the train orientation of the protection system and the master and slave relays. If one train is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the train to OPERABLE status. This Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this time interval. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 7.

R.E. Ginna Nuclear Power Plant B 3.3.2-23 Revision 18

ESFAS Instrumentation B 3.3.2 F..1 Condition F applies to the following Functions:

"* Steam Line Isolation-Containment Pressure-High High;

"* Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Tavg -Low;

"* Steam Line Isolation-High-High Steam Flow Coincident With Safety Injection;

"* Feedwater Isolation-SG Water Level-High; and

"* AFW-SG Water Level-Low Low.

Condition F applies to Functions that typically operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Placing the channel in the Tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. This 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for testing, are justified in Reference 7.

G..1 If the Required Actions and Completion Times of Conditions D, E, or F are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

R.E. Ginna Nuclear Power Plant B 3.3.2-24 Revision 18

ESFAS Instrumentation B 3.3.2 H.1 Condition H applies to the following ESFAS functions:

"* Manual Initiation of CS; and

"* Manual Initiation of Containment Isolation.

If a channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to restore it to OPERABLE status. The specified Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each Function (except for CS) and the low probability of an event occurring during this interval.

1.1 Condition I applies to the automatic actuation logic and actuation relays for the following Functions:

"* SI;

"* CS; and

"* Containment Isolation.

Condition I addresses the train orientation of the protection system and the master and slave relays. If one train is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the train to OPERABLE status. This Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 7.

J. 1 Condition J applies to the following Functions:

"* SI-Containment Pressure-High; and

"* CS-Containment Pressure-High High.

Condition J applies to Functions that operate on a two-out-of-three logic (for CS-Containment Pressure-High High there are two sets of this logic).

Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

R.E. Ginna Nuclear Power Plant B 3.3.2-25 Revision 18

ESFAS Instrumentation B 3.3.2 If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the inoperable channel or place it in trip, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for surveillance testing is justified in Reference 7.

K.1 If the Required Actions and Completion Times of Conditions H, I, or J are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

L.1 Condition L applies to the following Functions:

"* SI-Pressurizer Pressure-Low; and

"* SI-Steam Line Pressure-Low.

Condition L applies to Functions that operate on a two-out-of-three logic.

Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

R.E. Ginna Nuclear Power Plant B 3.3.2-26 Revision 18

ESFAS Instrumentation B 3.3.2 The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the inoperable channel or place it in trip, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for surveillance testing is justified in Reference 7.

M.1 If the Required Actions and Completion Times of Condition L are not met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to < 2000 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

N.1 Condition N applies if an AFW Manual Initiation channel is inoperable. If a manual initiation switch is inoperable, the associated AFW or SAFW pump must be declared inoperable and the applicable Conditions of LCO 3.7.5, "Auxiliary Feedwater (AFW) System" must be entered immediately.

Each AFW manual initiation switch controls one AFW or SAFW pump.

Declaring the associated pump inoperable ensures that appropriate action is taken in LCO 3.7.5 based on the number and type of pumps involved.

SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column of REQUIREMENTS Table 3.3.2-1. Each channel of process protection supplies both trains of the ESFAS. When testing Channel 1, Train A and Train B must be examined. Similarly, Train A and Train B must be examined when testing Channel 2, Channel 3, and Channel 4 (if applicable). The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.

SR 3.3.2.1 This SR is the performance of a CHANNEL CHECK for the following ESFAS Functions:

"* SI-Containment Pressure-High;

"* SI-Pressurizer Pressure-Low;

"* SI-Steam Line Pressure-Low; R.E. Ginna Nuclear Power Plant B 3.3.2-27 Revision 18

ESFAS Instrumentation B 3.3.2

"* CS-Containment Pressure-High High;

"* Steam Line Isolation-Containment Pressure-High High;

"* Steam Line Isolation-High Steam Flow Coincident with SI and Tavg Low;

"* Steam Line Isolation-High-High Steam Flow Coincident with SI;

"* Feedwater Isolation-SG Water Level-High; and

"* AFW-SG Water Level-Low Low.

Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of more serious instrument conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is a verification the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

CHANNEL CHECK acceptance criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.2.2 This SR is the performance of a COT every 92 days for the following ESFAS functions:

"* SI-Containment Pressure-High;

"* SI-Pressurizer Pressure-Low;

"* SI-Steam Line Pressure-Low;

CS-Containment Pressure-High High; R.E. Ginna Nuclear Power Plant B 3.3.2-28 Revision 18

ESFAS Instrumentation B 3.3.2

Steam Line Isolation-Containment Pressure-High High;

"* Steam Line Isolation-High Steam Flow Coincident with Sl and Tavg Low;

"* Steam Line Isolation-High-High Steam Flow Coincident with SI;

"* Feedwater Isolation-SG Water Level-High; and

AFW-SG Water Level-Low Low.

A COT is performed on each required channel to ensure the entire channel will perform the intended Function. Setpoints must be found to be within the Allowable Values specified in Table 3.3.2-1 and established plant procedures. The "as left" values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 92 days is consistent with in Reference 7. The Frequency is adequate based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.3 This SR is the performance of a TADOT every 92 days. This test is a check of the AFW-Undervoltage-Bus 11A and 11 B Function.

The test includes trip devices that provide actuation signals directly to the protection system. The SR is modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION. The Frequency of 92 days is adequate based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.4 This SR is the performance of a TADOT every 24 months. This test is a check of the SI, CS, Containment Isolation, Steam Line Isolation, and AFW Manual Initiations, and the AFW-Trip of Both MFW Pumps Functions. Each Function is tested up to, and including, the master transfer relay coils. The Frequency of 24 months is based on industry operating experience and is consistent with the typical refueling cycle.

The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Manual Initiations, and AFW-Trip of Both MFW Pumps Functions have no associated setpoints.

R.E. Ginna Nuclear Power Plant B 3.3.2-29 Revision 18

ESFAS Instrumentation B 3.3.2 SR 3.3.2.5 This SR is the performance of a CHANNEL CALIBRATION every 24 months of the following ESFAS Functions:

"* SI-Containment Pressure-High;

"* SI-Pressurizer Pressure-Low;

"* SI-Steam Line Pressure-Low;

CS-Containment Pressure-High High;

"* Steam Line Isolation-Containment Pressure-High High;

"* Steam Line Isolation-High Steam Flow Coincident with SI and Tavg Low;

"* Steam Line Isolation-High-High Steam Flow Coincident with SI;

"* Feedwater Isolation-SG Water Level-High;

"* AFW-SG Water Level-Low Low; and

"* AFW-Undervoltage-Bus 11A and 11B.

CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the plant specific setpoint methodology. The "as left" values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 24 months is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.

SR 3.3.2.6 This SR ensures the SI-Pressurizer Pressure-Low and SI-Steam Line Pressure-Low Functions are not bypassed when pressurizer pressure

> 2000 psig while in MODES 1, 2, and 3. Periodic testing of the pressurizer pressure channels is required to verify the setpoint to be-less than or equal to the limit.

R.E. Ginna Nuclear Power Plant B 3.3.2-30 Revision 18

ESFAS Instrumentation B 3.3.2 The difference between the current uas found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology (Ref. 6). The setpoint shall be left set consistent with the assumptions of the current plant specific setpoint methodology.

If the pressurizer pressure interlock setpoint is nonconservative, then the Pressurizer Pressure-Low and Steam Line Pressure-Low Functions are considered inoperable. Alternatively, the pressurizer pressure interlock can be placed in the conservative condition (nonbypassed). If placed in the nonbypassed condition, the SR is met and the Pressurizer Pressure Low and Steam Line Pressure-Low Functions would not be considered inoperable.

SR 3.3.2.7 This SR is the performance of an ACTUATION LOGIC TEST on all ESFAS Automatic Actuation Logic and Actuation Relays Functions every 24 months. This test includes the application of various simulated or actual input combinations in conjunction with each possible interlock state and verification of the required logic output. Relay and contact operation is verified by a continuance check or actuation of the end device.

The Frequency of 24 months is based on operating experience and the need to perform this testing during a plant shutdown to prevent a reactor trip from occurring.

REFERENCES 1. Atomic Industrial Forum (AIF) GDC 15, Issued for Comment July 10,1967.

2. UFSAR, Chapter 7.

3. UFSAR, Chapter 6.

4. UFSAR, Chapter 15.

5. IEEE-279-1971.

6. EWR:-5126, "Guidelines For Instrument Loop Performance

Evaluation and Setpoint Verification," August 1992.

7. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

3 - S-cp Q1 C,

/Ax R.E. Ginna Nuclear Power Plant B 3.3.2-31 Revision 18

ESFAS Instrumentation B 3.3.2 Field Instrument Channel Signal Process 11 Equipment Equipment I.-.

r I -

Master Master Relays Relays r -- -

Slave Slave Relays Relays r r ý--= 1! 7 1,-- ',, %4 -

Individual Components Individual Components Train A 7Bistable © 120V AC Power Source Train B 1Automatic Actuation Logic 125V DC Power Source 1)

For illustration only Figure B 3.3.2-1 R.E. Ginna Nuclear Power Plant B 3.3.2-32 Revision 18

LOP DG Start Instrumentation B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe plant operation.

The LOP DG start instrumentation consists of two channels on each of safeguards Buses 14, 16, 17, and 18 (Ref. 1). Each channel contains one loss of voltage relay and one degraded voltage relay (see Figure B 3.3.4-1). A one-out-of-two logic in both channels will cause the following actions on the associated safeguards bus:

a. trip of the normal feed breaker from offsite power;

b. trip of the bus-tie breaker to the opposite electrical train (if closed);

c. shed of all bus loads except the CS pump, component cooling water pump (if no safety injection signal is present), and safety related motor control centers; and

d. start of the associated DG.

The degraded voltage logic is provided on each 480 V safeguards bus to protect Engineered Safety Features (ESF) components from exposure to long periods of reduced voltage conditions which can result in degraded performance and to ensure that required motors can start. The loss of voltage logic is provided on each 480 V safeguards bus to ensure the DG is started within the time limits assumed in the accident analysis to provide the required electrical power if offsite power is lost.

The degraded voltage relays have time delays which have inverse operating characteristics such that the lower the bus voltage, the faster the operating time. The loss of voltage relays have definite time delays which are not related to the rate of the loss of bus voltage. These time delays are set to permit voltage transients during worst case motor T starting conditions.

APPLICABLE The LOP DG start instrumentation is required for the ESF Systems to SAFETY function in any accident with a loss of offsite power. Its design basis is ANALYSES that of the ESF Actuation System (ESFAS). Undervoltage conditions which occur independent of any accident conditions result in the start and bus connection of the associated DG, but no automatic loading occurs.

R.E. Ginna Nuclear Power Plant B 3.3.4-1 Revision 18

LOP DG Start Instrumentation B 3.3.4 Accident analyses credit the loading of the DG based on the loss of offsite power during a Design Basis Accident (DBA). The most limiting DBA of concern is the large break loss of coolant accident (LOCA) which requires ESF Systems in order to maintain containment integrity and protect fuel contained within the reactor vessel (Ref. 2). The detection and processing of an undervoltage condition, and subsequent DG loading, has been included in the delay time assumed for each ESF component requiring DG supplied power following a DBA and loss of offsite power.

The loss of offsite power has been assumed to occur either coincident with the DBA or-at a later period (40 to 90 seconds following the reactor trip) due to a grid disturbance caused by the turbine generator trip. If the loss of offsite power occurs at the same time as the safety injection (SI) signal parameters are reached, the accident analyses assumes the SI signal will actuate the DG within 2 seconds and that the DG will connect to the affected safeguards bus within an additional 10 seconds (12 seconds total time). If the loss of offsite power occurs before the SI signal parameters are reached, the accident analyses assumes the LOP DG start instrumentation will actuate the DG within 2.75 seconds and that the DG will connect to the affected safeguards bus within an additional 10 seconds (12.75 seconds total time). If the loss of offsite power occurs after the SI signal parameters are reached (grid disturbance), the accident analyses assumes the DG will connect to the bus within 1.5 seconds after the feeder breaker to the bus is opened (DG was actuated by SI signal). The grid disturbance has been evaluated based on a 140 OF peak clad temperature penalty during a LOCA and demonstrated to result in acceptable consequences. CAflo:WL The degraded voltage and undervoltagei tare based on the minimum voltage required for continued operation of ESF Systems assuming worst case loading conditions (i.e., maximum loading upon DG equencing). Their the loss of voltage relays, and associated time delays, have been chosen based on the following considerations:

a. Actuate the associated DG within 2.75 seconds as assumed in the accident analysis; *

b. Prevent DG actuation on momentary voltage drops associated with starting of ESF components during an accident with offsite power available and during normal operation due to minor system

Therefore,

ýdisturbance the time delay setting must be greater

,,ýhan the time between the largest assumed voltage drop below the

)voltage setting and the reset value of the trip function:,

R.E. Ginna Nuclear Power Plant B 3.3.4-2 Revision 18

LOP DG Start Instrumentation B 3.3.4 The for the degraded voltage channels, and associated time delays, have been chosen based on the following considerations;

a. Prevent motors supplied by the 480 V bus from operating at reduced voltage conditions for long periods of time; and

b. Prevent DG actuation on momentary voltage drops associated with starting of ESF components during an accident with offsite power available, and during normal operation due to minor system disturbanýe Therefore, the time delay setting must be greater than t e time between the largest voltage drop below the maximum voltage setting and the reset value of the trip function.

The LOP DG start instrumentation channels satisfy Criterion 3 of the NRC Policy Statement.

LCO This LCO requires that each 480 V safeguards bus have two OPERABLE 6-, channels of the LO P DG start instrum entation in MO DES 1, 2, 3, and 4

-reA , .* when the associated DG supports safety systems associated with the C.- oc ,te'f"* . ESFAS. In MODES 5 and 6, the LOP DG start instrumentation channels

- a

- l - "for each 480 V safeguards bus must be OPERABLE whenever the 00 Arcc,* .: associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. Loss of the LOP DG Start

&,A ,Instrumentation Function could result in the delay of safety systems I initiation when required. This could lead to unacceptable consequences

'V 0eA*

0 during accidents.

" ,The LOP start instrumentation is considered OPERABLE when two channels, each comprised of one degraded voltage and one loss of voltage relays are available for each 480 V safeguards bus (i.e., Bus 14, 16, 17, and 18). Each of the LOP channels must be capable of detecting undervoltage conditions within the voltage limits and time delays assumed in the accident analysis.

The Allowable Values 7 einsor the degraded voltage and loss of voltage Functions are specified in SR 3.3.4.2. The Allowable Ac9- Values specified in SR 3.3.4.2 are those setpoints which ensure that the eassociated DG will actuate within 2.75 seconds on undervoltage conditions, and that the DG will not actuate on momentary voltage drops which could affect ESF actuation times as assumed in the accident analysis. he ri etpoints specified in SR 3.3.4.2 are the nominal o Surveillance does not setpoints selected to ensure exceedthat thethe setpoint measured by the Allowable Value accounting for maximum instrument uncertainties between scheduled surveillances.

STherefore, LPsatisrmnaincanl Therefore, LOP start instrumentation channels are r OPERABLE PRBEwe when the h CHANNEL CALIBRATION "as left" value is within the Trip Setpoint limits and the CHANNEL CALIBRATION and TADOT "as found" value is within R.E. Ginna Nuclear Power Plant B 3.3.4-3 Revision 18

LOP DG Start Instrumentation B 3.3.4 the Allowed Value setpoints. The basis for all setpoints is contained i Reference 3.___

APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on an LOP or degraded power to the 480 V safeguards buses.

ACTIONS In the event a relay's 'rip ,XSetpoint is found to be nonconservative with respect to the Allowable Value, or the channel is found to be inoperable, then the channel must be declared inoperable and the LCO Condition entered as applicable.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. This Note states that separate Condition entry is allowed for each 480 V safeguards bus.

A.1 With one or more 480 V bus(es) with one channel inoperable, Required Action A.1 requires the inoperable channel(s) to be placed in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . With an undervoltage channel in the tripped condition, the LOP DG start instrumentation channels are configured to provide a one-out-of one logic to initiate a trip of the incoming offsite power for the respective bus. The remaining OPERABLE channel is comprised of one-out-of-two logic from the degraded and loss of voltage relays. Any additional failure of either of these two OPERABLE relays requires entry into Condition B.

B1.1 Condition B applies to the LOP DG start Function when the Required Action and associated Completion Time for Condition A are not met or with one or more 480 V bus(es) with two channels of LOP start instrumentation inoperable.

Condition B requires immediate entry into the Applicable Conditions specified in LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4," or LCO 3.8.2, "AC Sources - MODES 5 and 6," for the DG made inoperable by failure of the LOP DG start instrumentation. The actions of those LCOs provide for adequate compensatory actions to assure plant safety.

R.E. Ginna Nuclear Power Plant B 3.3.4-4 Revision 18

LOP DG Start Instrumentation B 3.3.4 SURVEILLANCE The Surveillances are modified by a Note to indicate that, when a REQUIREMENTS channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , provided the second channel maintains trip capability. Upon completion of the Surveillance, or expiration of the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the assumption that 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the average time required to perform channel surveillance. Based on engineering judgement, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months testing allowance does not significantly reduce the probability that the LOP DG start instrumentation will trip when necessary.

SR 3.3.4.1 This SR is the performance of a TADOT every 31 days. This test checks trip devices that provide actuation signals directly. For these tests, the relay 4ripXetpoints are verified and adjusted as necessary to ensure Allowable Values can still be met. The 31 day Frequency is based on the known reliability of the relays and controls and has been shown to be acceptable through operating experience.

SR 3.3.4.2 This SR is the performance of a CHANNEL CALIBRATION every 24 months, or approximately at every refueling of the LOP DG start instrumentation for each 480 V bus. bh The voltage setpoint verification, as well as the time response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay.

CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency of 24 months is based on operating experience consistent with the typical industry refueling cycle and is justified by the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

R.E. Ginna Nuclear Power Plant B 3.3.4-5 Revision 18

LOP DG Start Instrumentation B 3.

3.4 REFERENCES

1. UFSAR, Section 8.3.

2. UFSAR, Chapter 15.

3. RG&E Design Analysis DA-EE-93-006-08, "480 Volt Undervoltage Relay Settings and Test Acceptance Criteria."

R.E. Ginna Nuclear Power Plant B 3.3.4-6 Revision 18

LOP DG Start Instrumentation B 3.3.4 Channel 1 Channel 2 r - - - - - -- ---- ---- ---- I --- -- -- --- -- -- -- -

Degraded Loss of Voltage Voltage 1/2 IFor illustration only I UV Signal on 480 V Bus Figure B 3.3.4-1 DG LOP Instrumentation R.E. Ginna Nuclear Power Plant B 3.3.4-7 Revision 18

Containment Ventilation Isolation Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Containment Ventilation Isolation Instrumentation BASES BACKGROUND Containment ventilation isolation instrumentation closes the containment isolation valves in the Mini-Purge System and the Shutdown Purge System. This action isolates the containment atmosphere from the environment to minimize releases of radioactivity in the event of an accident. The Mini-Purge System may be used in all MODES while the Shutdown Purge System may only be used with the reactor shutdown.

(Col,*,,,l, Containment ventilation isolatitninitiates on a ment isolatior

=ii containment radiation signal, r b anual actuation of containment spray (CS,. The Bases for LCO 3.3.2, "Engineered Safety

-Feature Actuation System (ESFAS) Instrumentation," discuss the

""Y/containment isolation 4ýlrmanual containment spray modes of initiation.

Two containment radiation monitoring chann--s are provided as input to the containment ventilation isolation. The two radiation detectors are of different types: gaseous (R-12), and particulate (R-11). Both detectors will respond to most events that release radiation to containment.

However, analyses have not been conducted to demonstrate that all credible events will be detected by more than one monitor. Therefore, for the purposes of this LCO the two channels are not considered redundant.

Instead, they are treated as two one-out-of-one Functions. Since the radiation monitors constitute a sampling system, various components such as sample line valves, sample line heaters, sample pumps, and filter motors are required to support monitor OPERABILITY.

The Mini-Purge System has inner and outer containment isolation valves in its supply and exhaust ducts while the Shutdown Purge System only has one valve located outside containment since the inside valve was replaced by a blind flange that is used during MODES 1, 2, 3, and 4. A high radiation signal from any one of the two channels initiates containment ventilation isolation, which closes all isolation valves in the Mini-Purge System and the Shutdown Purge System. These systems are described in the Bases for LCO 3.6.3, "Containment Isolation Boundaries."

R.E. Ginna Nuclear Power Plant B 3.3.5-1 Revision 1 8

Containment Ventilation Isolation Instrumentation B 3.3.5 APPLICABLE The safety analyses assume that the containment remains intact with SAFETY penetrations unnecessary for accident mitigation functions isolated early ANALYSES in the event, within approximately 60 seconds. The isolation of the purge valves has not been analyzed mechanistically in the dose calculations, although its rapid isolation is assumed. The containment ventilation isolation radiation monitors act as backup to the containment isolation signal to ensure closing of the ventilation valves. They are also the primary means for automatically isolating containment in the event of a fuel handling accident during shutdown even though containment isolation is not specifically credited for this event. Containment isolation in turn ensures meeting the containment leakage rate assumptions of the safety analyses, and ensures that the calculated accident offsite radiological doses are below 10 CFR 100 (Ref. 1) limits.

The containment ventilation isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement.

LCO The LCO requirements ensure that the instrumentation necessary to initiate Containment Ventilation Isolation, listed in Table 3.3.5-1, is OPERABLE.

1. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Automatic Actuation Logic and Actuation Relays OPERABLE to ensure that no single random failure can prevent automatic actuation.

Automatic Actuation Logic and Actuation Relays consist of the same features and perate in the same manner as described for ,

ESFAS Function .2. , Containment Spray-Manual Initiation, and SF-AS Function 3, Containment Isolation'. The applicable MODES and specified conditions for the containment ventilation isolation portion of these Functions are diferent and less restrictive than those for their respectiv S an ESFAS roles. If one or more of SS- th.S or containment isolatio Functions becomes inoperable in such a manner that only the Containment Ventilation Isolation Function is affected, the Conditions applicable to their respective isolation Functions in LCO 3.3.2 need not be entered. The less restrictive Actions specified for inoperability of the Containment Ventilation Isolation Functions specify sufficient compensatory measures for this case.

R.E. Ginna Nuclear Power Plant B 3.3.5-2 Revision 18

Containment Ventilation Isolation Instrumentation B 3.3.5

2. Containment Radiation The LCO specifies two required channels of radiation monitors (R 11 and R-1 2) to ensure that the radiation monitoring instrumentation necessary to initiate Containment Ventilation Isolation remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than OPERABILITY of the channel electronics. OPERABILITY may also require correct valve lineups, sample pump operation, and filter motor operation, as well as detector OPERABILITY, if these supporting features are necessary for trip to occur.

3. Containment Isolation (-ýMC A' II,A';t 'o, Refer to LCO 3.3.2, Function 3, forvi all-,jinitiating Functions and requirements. 7-,,, r~ ro 4i. V4e k,--Ant. A* 4.,--* ' ,,, Iz4)

/.,'

4. Containment Spray-Manual Initiation Refer to LCO 3.3.2, Function 2.a, for all initiating Functions and requirements. This Function provides the manual initiation

'I capability for containment ventilation isolation.

APPLICABILITY The Automatic Actuation Logic and Actuation Relays, Containment Isolation(oo-tainmýent Spr *-Manual Initiation, and Containment Radiation Functions are required to be OPERABLE in MODES 1, 2, 3, and 4, and during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment. Under these conditions, the potential exists for an accident that could release fission product radioactivity into containment. Therefore, the containment ventilation isolation instrumentation must be OPERABLE in these MODES.

While in MODES 5 and 6 without fuel handling in progress, the containment ventilation isolation instrumentation need not be OPERABLE since the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of Reference 1.

R.E. Ginna Nuclear Power Plant B 3.3.5-3 Revision 18

Containment Ventilation Isolation Instrumentation B 3.3.5 ACTIONS The most common cause of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by plant specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set u for adjustment to brinq it within specification.flFt ripSetpoint is less conservative than the tolerance spec_-ied by the calibration procedure, the channel must be declared inoperable immediately and the appropriate Condition entered.

A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.5-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies to the failure of one containment ventilation isolation radiation monitor channel. Since the two containment radiation monitors measure different parameters, failure of a single channel may result in loss of the radiation monitoring Function for certain events.

Consequently, the failed channel must be restored to OPERABLE status.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed to restore the affected channel is justified by the low likelihood of events occurring during this interval, and recognition that one or more of the remaining channels will respond to most events.

B.1 Condition B applies to all Containment Ventilation Isolation Functions and addresses the train orientation of the system and the master and slave relays for these Functions. It also addresses the failure of multiple radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1.

If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action for the applicable Conditions of LCO 3.6.3 is met for each mini-purge isolation valve made inoperable by failure of isolation instrumentation. For example, if R-11 and R-12 were both inoperable, then all four mini-purge isolation valves must be declared inoperable. If CVI Train A were inoperable, then the two mini-purge valves which receive a Train A isolation signal must be declared inoperable.

R.E. Ginna Nuclear Power Plant B 3.3.5-4 Revision 18

Containment Ventilation Isolation Instrumentation B 3.3.5 A Note is added stating that Condition B is only applicable in MODE 1, 2, 3, or 4.

C.1 and C.2 Condition C applies to all Containment Ventilation Isolation Functions and addresses the train orientation of the system and the master and slave relays for these Functions. It also addresses the failure of multiple radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1.

If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operaton may continue as long as the Required Action to place each i urge isolation valve in its closed position or the applicable Conditions of LCO 3.9.3, "Containment Penetrations," are met for each on1I'urge isolation valve made inoperable by failure of isolation instrumentation. The Completion Time for these Required Actions is Immediately.

A Note states that Condition C is applicable during CORE ALTERATIONS and during movement of irradiated fuel assemblies within containment.

SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.5-1 REQUIREMENTS determines which SRs apply to which Containment Ventilation Isolation Functions.

SR 3.3.5.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred and the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The CHANNEL CHECK agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. Ifa channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

R.E. Ginna Nuclear Power Plant B 3.3.5-5 Revision 18

Containment Ventilation Isolation Instrumentation B 3.3.5 SR 3.3.5.2 A COT is performed every 92 days on each required channel to ensure the entire channel will perform the intended Function. The Frequency is based on the staff recommendation for increasing the availability of radiation monitors according to NUREG-1 366 (Ref. 2). This test verifies the capability of the instrumentation to provide the containment ventilation system isolation. The setpoint shall be left consistent with the current plant specific calibration procedure tolerance.

SR 3.3.5.3 This SR is the performance of an ACTUATION LOGIC TEST. All possible logic combinations, with and without applicable permissives, are tested for each protection function. In addition, the master relay is tested for continuity. This verifies that the logic modules are OPERABLE and there is an intact voltage signal path to the master relay coils. This test is performed every 24 months. The Surveillance interval is acceptable based on instrument reliability and industry operating experience.

SR 3.3.5.4 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency is based on operating experience and is consistent with the typical industry refueling cycle.

REFERENCES 1. 10 CFR 100.11.

2. NUREG-1 366.

R.E. Ginna Nuclear Power Plant B 3.3.5-6 Revision 18

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEMS (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)

Limits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses.

The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on RCS pressure, temperature, and flow rate ensure that the departure from nucleate boiling (DNB) design criterion will be met for each of the transients analyzed.

The design method employed to meet the DNB design criterion for fuel assemblies is the Revised Thermal Design Procedure (RTDP). With the RTDP methodology, uncertainties in plant operating parameters, computer codes and DNB correlation predictions are considered statistically to obtain DNB uncertainty factors. Based on the DNB uncertainty factors, RTDP design limit departure from nucleate boiling ratio (DNBR) values are determined in order to meet the DNB design criterion.

The RTDP design limit DNBR values are 1.24 and 1.23 for the typical and thimble cells, respectively, for fuel analyses witlh the WRB-1 correlation.

Additional DNBR margin is maintained by performing the safety analyses to DNBR limits higher than the design limit DNBR values. This margin between the design and safety analysis limit DNBR values is used to offset known DNBR penalties (e.g., rod bow and transition core) and to provide DNBR margin for operating and design flexibility. The safety analysis DNBR value is 1.40 for the typical and thimble cells.

For the WRB-1 correlation, the 95/95 DNBR correlation limit is 1.17. The W-3 DNB correlation is used where the primary DNBR correlation is not applicable. The WRB-1 correlation was developed based on mixing vane data and therefore is only applicable in the heated rod spans above the first mixing vane grid. The W-3 correlation, which does not take credit for mixing vane grids, is used to calculate DNBR values in the heated region below the first mixing vane grid. In addition, the W-3 correlation is applied in the analysis of accident conditions where the system pressure is below the range of the primary correlations. For system pressures in the range of 500 to 1000. psia, the W-3 correlation limit is 1.45. For system pressures greater than 1000 psia, the W-3 correlation limit is 1.30.

R.E. Ginna Nuclear Power Plant B 3.4.1 -1 Revision 21

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 The RCS pressure limit as specified in the COLR, is consistent with operation within the nominal operational envelope. Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits.

The RCS coolant average temperature limit as specified in the COLR, is consistent with full power operation within the nominal operational envelope. Indications of temperature are averaged to determine a value for comparison to the limit. A higher average temperature will cause the core to approach DNB limits.

The RCS flow rate as specified in the COLR, normally remains constant during an operational fuel cycle with both pumps running. The minimum RCS flow limit corresponds to that assumed for DNB analyses. Flow rate indications are averaged to come up with a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits.

Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.

APPLICABLE The requirements of this LCO represent the initial conditions for DNB SAFETY limited transients analyzed in the plant safety analyses (Ref. 1). The ANALYSES safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the DNB design criterion. This is the acceptance limit for the RCS DNB parameters. Changes to the plant that could impact these parameters must be assessed for their impact on the DNB design criterion. The transients analyzed include loss of coolant flow events and dropped or stuck rod events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, "Control Bank Insertion Limits"; LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)"; and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."

The limit for pressurizer pressure is based on a +/- 30 psig instrument uncertainty. The accident analyses assume that nominal pressure is maintained at 2235 psig. By Reference 2, minor fluctuations are acceptable provided that the time averaged pressure is 2235 psig.

The RCS coolant average temperature limit is based on a +/- 4 0 F instrument uncertainty which includes a +/- 1.50 F deadband. It is assumed that nominal Tavg is maintained within +/- 1.5 0 F of the nominal Tavg specified in the COLR. By Reference 2, minor fluctuations are acceptable provided that the time averaged temperature is within 1.5 0 F of nominal.

R.E. Ginna Nuclear Power Plant B 3.4.1-2 Revision 21

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 The limit for RCS flow rate is based on the nominal Tavg and SG plugging criteria limit. Additional margin of approximately 3% is then added for conservatism.

The RCS DNB parameters satisfy Criterion 2 of the NRC Policy Statement.

LCO This LCO specifies limits on the monitored process variables-pressurizer pressure, RCS average temperature, and RCS total flow rate-to ensure the core operates within the limits assumed in the safety analyses.

Operating within these limits will result in meeting the DNB design criterion in the event of a DNB limited transient.

A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL POWER ramp > 5% RTP per minute or a THERMAL POWER step

> 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive. Also, since they represent transients initiated from power levels < 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations.

Another set of limits on DNB related arameter is provided in SL 2.1 .1, "Reactor Core SLs." hose" -i are less restrictive than the limits of this

_, LCO, but violation of a afety Limit (SL) merits a stricter, more severe V 6 Required Action. Should a violation of this LCO occur, the operator must check whether or not an SL may have been exceeded.

APPLICABILITY In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNB design criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In MODE 2, an increased DNBR margin exists. In all other MODES, the power level is low enough that DNB is not a concern.

ACTIONS A.1 RCS pressure and RCS average temperature are controllable and measurable parameters. With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s).

R.E. Ginna Nuclear Power Plant B 3.4.1-3 Revision 21

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation. If the indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B.1, to restore DNB margin and eliminate the potential for violation of the accident analysis bounds.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for restoration of the parameters provides sufficient time to determine the cause for the off normal condition, to adjust plant parameters, and to restore the readings within limits, and is based on plant operating experience.

B..1 If Required Action A.1 is not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable to reach the required plant conditions in an orderly manner.

SURVEILLANCE SR 3.4.1.1 REQUIREMENTS Since Required Action A.1 allows a Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore parameters that are not within limits, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Surveillance Frequency for pressurizer pressure is sufficient to ensure tthe pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

SR 3.4.1.2 Since Required Action A.1 allows a Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore parameters that are not within limits, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Surveillance Frequency for RCS average temperature is sufficient to ensure the temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

R.E. Ginna Nuclear Power Plant B 3.4.1-4 Revision 21

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 SR 3.4.1.3 Measurement of RCS total flow rate once every 24 months verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate. This verification may be performed via a precision calorimetric heat balance or other accepted means.

The Frequency of 24 months reflects the importance of verifying flow after a refueling outage when the core has been altered, which may have caused an alteration of flow resistance. Verification of RCS flow rate on a shorter interval is not required since this parameter is not expected to vary during steady state operation as there are no RCS loop isolation valves or other installed devices which could significantly alter flow.

Reduced performance of a reactor coolant pump (RCP) would be observable due to bus voltage and frequency changes, and installed alarms that would result in operator investigation.

This SR is modified by a Note that allows entry into MODE 1, without having performed the SR, and placement of the plant in the best condition for performing the SR. The Note states that the SR shall be performed within 7 days after reaching 95% RTP. This exception is appropriate since the heat balance requires the plant to be at a minimum of 95% RTP to obtain the stated RCS flow accuracies.

REFERENCES 1. UFSAR, Chapter 15.

2. NRC Memorandum from E.L. Jordan, Assistant Director for Technical Programs, Division of Reactor Operations Inspection to Distribution;

Subject:

"Discussion of Licensed Power Level (AITS F14580H2)," dated August 22. 1980.

R.E. Ginna Nuclear Power Plant B 3.4.1-5 Revision 21

IMPROVED TECHNICAL SPECIFICATION BASES INSERTS Insert 1 The reactor core SLs are established to preclude violation of the following fuel design criteria:

a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB and

b. There must be at least a 95% probability at a 95% confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.

The reactor core SLs are used to define the various RPS functions such that the above criteria are satisfied during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). To ensure that the RPS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower AT reactor trip functions.

That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS average temperature, RCS flow rate, and Al that the reactor core SLs will be satisfied during steady state operation, normal operational transients, and AOOs.

Insert 2 Technical specifications are required by 10 CFR 50.36 to contain LSSS defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytic Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

The Nominal Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit and thus ensuring that the SL would not be exceeded. As such, the Nominal Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g.,

drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the Nominal Trip Setpoint plays an important role in ensuring that SLs are not exceeded. As such, the Nominal Trip Setpoint meets the definition of an LSSS and could be used to meet the requirement that they be contained in the technical specifications.

Technical specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in technical specifications as "...being capable of performing its safety functions(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 is the same as the OPERABILITY limit for these devices. However, use of the Nominal Trip Setpoint to define OPERABILITY in technical specifications and its corresponding designation as the LSSS required by 10 CFR 50.36 would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as found" value of a protective device setting during a surveillance. This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Nominal Trip Setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the Nominal Trip Setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as found" setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to the Nominal Trip Setpoint to account for further drift during the next surveillance interval.

Use of the Nominal Trip Setpoint to define "as found" OPERABILITY and its designation as the LSSS under the expected circumstances described above would result in actions required by both the rule and technical specifications that are clearly not warranted. However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. This value needs to be specified in the technical specifications in order to define OPERABILITY of the devices and is designated as the Allowable Value which, as stated above, is the same as the LSSS.

The Allowable Value specified in Table 3.3.1-1 serves as the LSSS such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). As such, the Allowable Value differs from the Nominal Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established Nominal Trip Setpoint calibration tolerance band, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a technical specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.

During AQOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are:

Insert 3 A channel is considered OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint.

Insert 4 The trip setpoints used in the bistables are based on the analytical limits stated in References 4, 5, and 6. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RTS channels that must function in harsh environments as defined by 10 CFR 50.49, the Allowable Values specified in Table 3.3.1-1 in the accompanying LCO are conservative with respect to the analytical limits. A detailed description of the methodology used to calculate the Allowable Value and trip setpoints is provided in the "Instrument Setpoint/Loop Accuracy Calculation Methodology" (Ref. 8). The magnitudes of these uncertainties are factored into the determination of each trip setpoint and corresponding Allowable Value. The trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value (LSSS) to account for measurement errors detectable by the COT. The Allowable Value serves as the technical specification OPERABILITY limit for the purpose of the COT. One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

The trip setpoint is the value at which the bistable is set and is the expected value to be achieved during calibration. The trip setpoint value ensures the LSSS and the safety analysis limits are met for surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the "as left" setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance.

Trip setpoints consistent with the requirements of the Allowable Value ensure that SLs are not violated during AOOs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed).

Insert 5 The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for ESFAS action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable. The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). Note that, although a channel is "OPERABLE" under these circumstances, the ESFAS setpoint must be left adjusted to within the established calibration tolerance band of the ESFAS setpoint in accordance with the uncertainty assumptions stated in the referenced setpoint methodology, (as-left criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.

Insert 6 A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the calibration tolerance band of the Nominal Trip Setpoint.

Insert 7 The trip setpoints used in the bistables are based on the analytical limits stated in References 2, 3, and 4. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49, the Allowable Values specified in Table 3.3.2-1 in the accompanying LCO are conservative with respect to the analytical limits. A detailed description of the methodology used to calculate the Allowable Value and ESFAS setpoints, is provided in the "Instrument Setpoint/Loop Accuracy Calculation Methodology" (Ref. 6). The magnitudes of these uncertainties are factored into the determination of each ESFAS setpoint and corresponding Allowable Value. The nominal ESFAS setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for measurement errors detectable by the COT. The Allowable Value serves as the Technical Specification OPERABILITY limit for the purpose of the COT.

One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

The ESFAS setpoints are the values at which the bistables are set and is the expected value to be achieved during calibration. The ESFAS setpoint value ensures the safety analysis limits are met for the surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the "as-left" setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance.

Setpoints adjusted consistent with the requirements of the Allowable Value ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.

Insert 8 Containment Isolation-Manual Initiation is required to be OPERABLE during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment, since it provides actuation of Containment Ventilation Isolation (LCO 3.3.5). Under these conditions, the potential exists for an accident that could release fission product radioactivity into containment.

Insert 9 The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for Engineered Safety Features Actuation System (ESFAS) action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable. The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL CALIBRATION. Note that although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration tolerance band of the setpoint in accordance with uncertainty assumptions stated in the setpoint methodology (Reference 3), (as-left-criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.

Insert 10 A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint.

Insert 11

5. Safety Injection Refer to LCO 3.3.2, Function 1, for all initiating Functions and requirements. This Function provides both manual and automatic initiation capability for containment ventilation isolation.

Insert 12 The Containment Spray-Manual Initiation and Safety Injection Functions are required to be OPERABLE in MODES 1, 2, 3, and 4. Due to the potential negative affects of system actuations, and the redundancy provided by the alternate Functions, these Functions are not required during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment.

Insert 13 A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint.

COLR Cycle 29 1.0 CORE OPERATING LIMITS REPORT "

This Core Operating Limits Report (COLR) for the R.E. Ginna Nuclear Power Plant has been prepared in accordance with the requirements of Technical Specification 5.6.5.

The Technical Specifications affected by this report are listed e 3.1.1 SHUTDOWN MARGIN (SDM) ') ")

3.1.3 MODERATOR TEMPERATURE COEFFICIENT (MTC) 3.1.5 Shutdown Bank Insertion Limit 3.1.6 Control Bank Insertion Limits 3.2.1 Heat Flux Hot Channel Factor (F0 (Z))

3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (FN H) 3.2.3 AXIAL FLUX DIFFERENCE (AFD)

3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)

/ Limits 3.9.1 Boron Concentration

ý33. ac ~

0(eeco i ;-/A7 e R.E. Ginna Nuclear Power Plant COLR-2 Revision 0

COLR Cycle 29 2.0 OPERA .TING LIMITS The cycle-specific parameter limits for the specifications listed in Section 1.0 are presented in the following subsections. These limits have been developed using the NRC approved methodologies specified in Technical Specification 5.6.5. All items that appear in capitalized type are defined in Technical Specification 1.1, Definitions.

2.V' SHUTDOWN MARGIN 1 (LCO 3.1.1) 2.1.1 The SHUTDOWN MARGIN in MODE 2 with Keff < 1.0 and MODES 3 and 4 r, shall be greater than or equal to the limits specified in Figure COLR -6ifor the number of reactor coolant pumps in operation (non main feedwater operation).

2.).2 The SHUTDOWN MARGIN in MODE 4 when both reactor coolant pumps are not OPERABLE and in operation and in MODE 5 shall be greater than or equal to the one loop operation curve of Figure COLR - 6r to 2.*.3 The SHUTDOWN MARGIN required in LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, LCO 3.1.8, and LCO 3.4.5 shall be greater than the limits specified in Figure COLR l1(for the number of reactor coolant pumps in operation and the status of the main feedwater system.

24 MODERATOR TEMPERATURE COEFFICIENT1 (LCO 3.1.3) 2..1 The Moderator Temperature Coefficient (MTC) limits are:

The BOL ARO/HZP - MTC shall be less positive than +5.0 pcm/°F for power levels below 70% RTP and less than or equal to 0 pcm/°F for power levels at or above 70% RTP.

The EOL ARO/RTP - MTC shall be less negative than -42.9 pcm/°F.

where:

ARO stands for All Rods Out BOL stands for Beginning of Cycle Life EOL stands for End of Cycle Life HZP stands for Hot Zero-Power RTP stands for RATED THERMAL POWER R.E. Ginna Nuclear Power Plant COLR-3 Revision 0

COLR Cycle 29 2.f Shutdown Bank Insertion Limit' (LCO 3.1.5) 26' The shutdown bank shall be fully withdrawn which is defined as > 221 steps.

2.*" Control Bank Insertion Limits 1 (LCO 3.1.6) 2.e.1 The control banks shall be limited in physical insertion as shown in Figure 0 COLR 2.0:2 The control banks shall be moved sequentially with a 100 (+ 5) step overlap 0 between successive banks.

2 2* Heat Flux Hot Channel Factor (F0 (Z))

(J (LCO 3.2.1) 2.(1 FQ(Z) < ((FQ) *K(Z) / P) when P > 0.5 SFQ(Z) < ((FQ) *K(Z) /0.5) when P *0.5 where:

Z is the height in the core, FQ = 2.45, K(Z) is provided in Figure COLR -aand P = THERMAL POWER / RATED THERMAL POWER 2.4 Nuclear Enthalpy Rise Hot Channel Factor (FN H)l 2? (LCO 3.2.2) 2.e1 FNaH < FRTPAH * (1 + PFaH * (1-P))

where:

FRTPH= 1. 7 5 ,

PFaH = 0.3, and P = THERMAL POWER / RATED THERMAL POWER R.E. Ginna Nuclear Power Plant COLR-4 R'e~ision 0

COLR Cycle 29 27- AXIAL FLUX DIFFERENCE3

(* (LCO 3.2.3) 2.6l The AXIAL FLUX DIFFERENCE (AFD) target band is _ 5%. The actual target 0 bands are provided by Procedure RE-11.1.

2.6 The AFD acceptable operation limits are provided in Figure COLR -.

2. RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) 4 Limits J(LCO 3.4.1).

2.l The pressurizer pressure shall be >_2205 psig.

2.e.2 The RCS average temperature shall be < 577.5 OF.

2.d.3 The RCS total flow rate shall be > 177,300 gpm (includes 4% minimum flow 0/ uncertainty per Revised Thermal Design Methodology).

2Jý Boron Concentration 1 62 (LCO 3.9.1 )

2.0.l The boron concentrations of the hydraulically coupled Reactor Coolant System, 0 the refueling canal, and the refueling cavity shall be > 2300 ppm.

R.E. Ginna Nuclear Power Plant COLR-5 Revision 0

COLR Cycle 29

3.0 REFERENCES

1. WCAP-9272-P-A, Westinghouse Reload Safety Evaluation Methodology, July 1985.

2. WCAP-1 0054-P-A and WCAP-1 0081-A, "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code," August 1985.

3. WCAP-10924-P-A, Volume 1, Revision 1, "Westinghouse Large-Break LOCA Best Estimate Methodology, Volume 1: Model Description and Validation Responses to NRC Questions," and Addenda 1,2,3, December 1988.

4. WCAP-1 0924-P-A, Volume 2, Revision 2, "Westinghouse Large-Break LOCA Best Estimate Methodology, Volume 2: Application to Two-Loop PWRs Equipped with Upper Plenum Injection," and Addendum 1, December 1988.

5. WCAP-1 0924-P-A, Volume 1, Revision 1, Addendum 4, "Westinghouse Large-Break LOCA Best-Estimate Methodology, Volume 1: Model Description and Validation, Addendum 4: Model Revisions," March 1991.

6. WCAP-1 3677-P-A, "10 CFR 50.46 Evaluation Model Report: WCOBRA/TRAC Two Loop Upper Plenum Injection Model Updates to Support ZIRLOTM Cladding Option,"

February 1994.

7. WCAP-12610-P-A, "VANTAGE + Fuel Assembly Reference Core Report," April 1995.

8. WCAP-8385, "Power Distribution Control and Load Following Procedures - Topical Report,", September 1974.

9. WCAP-11397-P-A, "Revised Thermal Design Procedure", April 1989.

R.E. Ginna Nuclear Power Plant COLR-6 Revision 0

CcLt?

Cycle STs 670 660 650 640

.630 0

CD620

(.L 610 600 590 580 570 I 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 1.1 1.2 POWER (Fraction of Nominal)

Figure Reactor Safety Limits

/?-

R.E. Ginna Nuclear Power Plant Amendmentga"

COLR Cycle 29 SACCEPTABL-E 2.5 OPERATION - (0.2.45)

(02.40)

U 5 (0.1.80) 0 I

"t" ~UNACCEPTABLE C0.5 OPERATION 0

1500 1000 500 0 COOLANT BORON CONCENTRATION (ppm)

- .....- One Loop Operawon - Two Loop Operatio, -non MFW - - - Two Loop Operation - MFW NOTE:

Two Loop Operaro

non MFW mearis 1*itihe main feedwmer systen is riot supplyi the steam generaors.

Two LooP Ogert'on -MFW mearts # thae main feedwater system1 is suplki the 9102M goeeators.

Figure COLR REQUIRED SHUTDOWN MARGIN R.E. Ginna Nuclear Power Plant COLR-7 Revision 0

COLR Cycle 29 I I°

~220 6 TO 180,0./ 200 BBank(100). 16B4)

S160 ank 0-140 S120 DBank 2 100 Y/

o 80 60

~40 o 20 0 ~(30, 0 10 20 30 40 50 60 70 80 90 100 Core Power (Percent of 1520 MWVT)

"~The fully withdrawn positioni is defined as Ž!221 steps.

Figure COLR-0 1 CONTROL BANK INSERTION LIMITS R.E. Ginna Nuclear Power Plant COLR-8 Revision 0

COLR Cycle 29 1.2 N

S1.0 0

,I U

L 0.8 0 0.6 - Total F. 2.450 Elevation (ft) KQ

< 0.4 0.0 1.0 "0 11.783 1.0 E0.2 0

z 0.0 1 0.0 2.0 4.0 6.0 8.0 10.0 1.783 Elevation (ft)

Figure COLR -or 0 K(Z) - NORMALIZED FQ(Z) AS A FUNCTION OF CORE HEIGHT R.E. Ginna Nuclear Power Plant COLR-9 Revision 0

COLR Cycle 29 100 I I DO NOT OPERATE IN THIS AREA WITH AFO OUTSIDE THE TARGET BAND 80 S~ACCEPTABLE OPERATION WITH AFD

..................... ..................... OUTS DE THE ------- ---- - "' ..............

VWTH PENALTY ' I R 0 60 DEVIATION

n. TIME

(-31,60) (31Ao) 40 F

lo Lu ACCEPTABLE OPERATION 20 W

............... .............................. I............... ............... .............................

0

-30 -20 -10 0 10 20 30 AXIAL FLUX DIFFERENCE (%)

Figure COLR-ýý AXIAL FLUX DIFFERENCE ACCEPTABLE OPERATION LIMITS AND TARGET BAND LIMITS AS A FUNCTION OF RATED THERMAL POWER R.E. Ginna Nuclear Power Plant COLR-1 0 Revision 0

COLR Cycle 29 END NOTES

1. (Limits generated using Reference 1)

2. (Limits generated using References 1 through 7)

3. (Limits generated using References 1 and 8)

4. (Limits generated using Reference 9)

R.E. Ginna Nuclear Power Plant COLR-1 1 Revision 0

COLR INSERTS Insert 1 2.1 Safety Limits (SLs)1 (2.1) 2.1.1 In MODES 1 and 2, the combination of THERMAL POWER, Reactor Coolant System (RCS) average temperature, and pressurizer pressure shall not exceed the SLs specified in Figure COLR-1.

Insert 2 2.9 Reactor Trip System (RTS) Setpoints s (LCO 3.3.1) 2.9.1 Overtemperature AT Setpoint Parameter Values Parameter Value Overtemperature AT reactor trip setpoint K, 1.20 Overtemperature AT reactor trip depressurization K2

0.000900/psi setpoint penalty coefficient Overtemperature AT reactor trip heatup setpoint K3 Ž 0.0209/°F penalty coefficient Measured lead time constant "Žl 25 seconds Measured lag time constant T2 - 5 seconds f(AI) constants f(AI) = 0 when q - qb is _ + 13% RTP f(AI) = 1.3 ((qt- qb) -13} when qt - qbis > + 13% RTP 2.9.2 Overpower AT Setpoint Parameter Values Parameter Value Overpower AT reactor trip setpoint K4 - 1.077 Overpower AT reactor trip heatup setpoint K5= 0/ 0F forT<T' penalty coefficient > 0.0011/OF for T > T' Overpower AT reactor trip thermal time delay K6 >0.0262/°F for increasing T setpoint penalty = 0.00/°F for decreasing T Measured impulse/lag time constant "r3 10 seconds f(A) constants f(AI) = 0 when q,- qb is < + 13% RTP f(AI) = 1.3 {(qt - qb) - 13) when qt - qb is > + 13% RTP

ML021020362

Contents

Text

Subject:

Enclosures:

Subject:

3.1 REFERENCES

3.4 REFERENCES

Subject:

3.0 REFERENCES

Navigation menu

ML021020362

Text

Subject:

Enclosures:

Subject:

3.1 REFERENCES

3.4 REFERENCES

Subject:

3.0 REFERENCES

Navigation menu

Search