Text

Part 1 of 2 - Brunswick, Units 1 and 2 - Submittal of Technical Specification Bases Changes for Revisions 21 and 22 (Units 1 and 2) and Revision 23 (Unit 1 Only)
	ML021430047
Person / Time
Site:	Brunswick
Issue date:	05/08/2002
From:	O'Neil E; Carolina Power & Light Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	-RFPFR, BSEP 02-0093
	Download: ML021430047 (186)
	v • d • e

SCP&L A Progress Energy Company MAY 0 8 2002 SERIAL.,: BSEP 02-0093 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 BRUNSWICK STEAM ELECTRIC PLANT, UNIT NOS. 1 AND 2 DOCKET NOS. 50-325 AND 50-324/LICENSE NOS. DPR-71 AND DPR-62 SUBMITTAL OF TECHNICAL SPECIFICATION BASES CHANGES FOR REVISIONS 21 AND 22 (UNITS 1 AND 2), AND REVISION 23 (UNIT 1 ONLY)

Ladies and Gentlemen:

In accordance with Technical Specification (TS) 5.5. 10.d for the Brunswick Steam Electric Plant (BSEP), Unit Nos. 1 and 2, Carolina Power & Light (CP&L) Company is submitting Revisions 21 and 22 to the BSEP Unit 1 and Unit 2 TS Bases, and Revision 23 to the BSEP Unit 1 TS Bases. Enclosure 1 provides a description of each revision, the date of implementation, and the BSEP unit affected. Instructions for replacing the pages contained in the TS Bases books are provided in Enclosure 2. Enclosure 3 provides replacement TS Bases pages for both BSEP units.

This submittal does not contain any regulatory commitments. Please refer any questions regarding this submittal to Mr. Leonard R. Beller, Supervisor - Licensing/Regulatory Programs, at (910) 457-2073.

Sincerely, Edward T. O'Neil Manager - Regulatory Affairs Brunswick Steam Electric Plant WRM/wrm

Enclosures:

1. Summary of Revisions to Technical Specification Bases

2. Technical Specification Bases Replacement Instructions C

3. Replacement Bases Pages - Units 1 and 2 Brunswick Nuclear Plant PO. Box 10429 Southport, NC 28461

Document Control Desk BSEP 02-0093 / Page 2 cc (with enclosures):

U. S. Nuclear Regulatory Commission, Region II ATTN: Mr. Luis A. Reyes, Regional Administrator Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW, Suite 23T85 Atlanta, GA 30303-8931 U. S. Nuclear Regulatory Commission ATTN: Mr. Theodore A. Easlick, NRC Senior Resident Inspector 8470 River Road Southport, NC 28461-8869 U. S. Nuclear Regulatory Commission ATTN: Ms. Brenda L. Mozafari (Mail Stop OWEN 8G9) 11555 Rockville Pike Rockville, MD 20852-2738 Ms. Jo A. Sanford Chair - North Carolina Utilities Commission P.O. Box 29510 Raleigh, NC 27626-0510 Mr. Mel Fry Director - Division of Radiation Protection North Carolina Department of Environment and Natural Resources 3825 Barrett Drive Raleigh, NC 27609-7221

BSEP 02-0093 Page 1 of 2 ENCLOSURE 1 BRUNSWICK STEAM ELECTRIC PLANT, UNIT NOS. 1 AND 2 DOCKET NOS. 50-325 AND 50-324/LICENSE NOS, DPR-71 AND DPR-62 SUBMITTAL OF TECHNICAL SPECIFICATION BASES CHANGES FOR REVISIONS 21 AND 22 (UNITS 1 AND 2),

AND REVISION 23 (UNIT 1 ONLY)

Summary of Revisions to Technical Specification Bases 21 Unit 1 March 15, 2002

Title:

Installation of General Electric Digital Power Range Neutron Monitoring System

==

Description:==

This Bases revision reflects installation of the digital General Electric (GE)

Nuclear Measurement Analysis and Control (NUMAC) Power Range Neutron Monitoring (NPRM) System with the oscillation power range monitor (OPRM) upscale trip function.

The digital GE NUMAC NPRM System has been classified as a Boiling Water Reactor Owners' Group (BWROG) Option III solution for the reactor long-term stability problem, and replaces the previously installed Enhanced Option I-A System.

21 Unit 2 March 18, 2002

Title:

Implementation of Technical Specification Task Force (TSTF) Traveler 22 Unit 1 March 18, 2002 Item 51

==

Description:==

This Bases revision reflects incorporation of NRC-approved Technical Specification Task Force (TSTF) Traveler Item 51, "Revise containment requirements during handling irradiated fuel and core alterations," Revision 2. The revision reflects the selective adoption of the Alternate Source Term (AST) for the fuel handling accident.

BSEP 02-0093 Page 2 of 2 April 10, 2002 April 10, 2002

Title:

Control Rod Scram Time Testing and Technical Specification Bases Control Program

==

Description:==

This Bases revision reflects incorporation of TSTF Item 222, Revision 1, "Control Rod Scram Time Testing," and TSTF Item 364, Revision 0, "Revision to TS Bases Control Program to Incorporate Changes to 10 CFR 50.59."

22 23 Unit 2 Unit 1

BSEP 02-0093 Page 1 of 3 ENCLOSURE 2 BRUNSWICK STEAM ELECTRIC PLANT, UNIT NOS. 1 AND 2 DOCKET NOS. 50-325 AND 50-324/LICENSE NOS. DPR-71 AND DPR-62 SUBMITTAL OF TECHNICAL SPECIFICATION BASES CHANGES FOR REVISIONS 21 AND 22 (UNITS 1 AND 2),

AND REVISION 23 (UNIT 1 ONLY)

Technical Specification Bases LOEP-1, Revision 20 LOEP-2, Revision 3 Table of Contents, Page i, Revision 0 LOEP-1, Revision 23 LOEP-2, Revision 21 Table of Contents, Page i, Revision 21 Table of Contents, Page ii, Revision 0 Table of Contents, Page ii, Revision 21 B 3.1-24, Revision 0 B 3.1-24, Revision 23 B 3.1-26, Revision 0 B 3.1-26, Revision 23 B 3.1-27, Revision 0 B 3.1-27, Revision 23 B 3.2-11 through B 3.2-16, Revision 0 B 3.3-6 through B 3.3-29, Revision 0 B 3.3-6 through B 3.3-29, Revision 21 B 3.3-30, Revision 2 B 3.3-30, Revision 21 B 3.3-31 through B 3.3-59, Revision 0 B 3.3-31 through B 3.3-59, Revision 21 B 3.3-62 through B 3.3-76, Revision 0 B 3.3-62 through B 3.3-76, Revision 21 B 3.3-77 through B 3.3-85, Revision 3 B 3.3-77 through B 3.3-85, Revision 21 B 3.3-86 through B 3.3-152, Rev B 3.3-153, Revision 5 B 3.3-154, Revision 0 B 3.3-86 through B 3.3-152, Revision 21 B 3.3-153, Revision 21 B 3.3-154, Revision 21

BSEP 02-0093 Page 2 of 3 B 3.3-155, Revision 12 B 3.3-155, Revision 21 B 3.3-156, Revision 4 B 3.3-156, Revision 21 B 3.3-157, Revision 12 B 3.3-157, Revision 21 B 3.3-158 through B 3.3-178, Revision 0 B 3.3-158 through B 3.3-178, Revision 21 B 3.3-179 through B 3.3-186, Revision 0 B 3.3-179 through B 3.3-186, Revision 22 B 3.3-187, Revision 0 B 3.3-187, Revision 21 B 3.3-188 through B 3.3-192, Revision 0 B 3.3-188 through B 3.3-192, Revision 22 B 3.3-193 through B 3.3-212, Revision 0 B 3.3-193 through B 3.3-213, Revision 21 B ases~ Book2 LOEP-1, Revision 20 LOEP-1, Revision 22 LOEP-2, Revision 18 LOEP-2, Revision 22 LOEP-3, Revision 20 LOEP-3, Revision 22 LOEP-4, Revision 13 LOEP-4, Revision 22 LOEP-5, Revision 6 LOEP-5, Revision 21 B 3.4-3, Revision 1 B 3.4-3, Revision 21 B 3.4-4, Revision 1 B 3.4-4, Revision 21 B 3.4-6, Revision 1 B 3.4-6, Revision 21 B 3.6-69 through B 3.6-85, Revision 18 B 3.6-69 through B 3.6-85, Revision 22 B 3.7-40, Revision 9 B 3.7-40, Revision 22 B 3.7-42, Revision 9 B 3.7-42, Revision 22 B 3.9-19, Revision 0 B 3.9-19, Revision 22 B 3.9-21, Revision 0 B 3.9-21, Revision 22 B 3.3-10-34 through B 3.10-36, Revision 0 B 3.3-10-34 through B 3.10-36, Revision 21

BSEP 02-0093 Page 3 of 3 Title Page, Revision 20 Title Page, Revision 22 LOEP-4, Revision 12 LOEP-4, Revision 21 B 3.1-24, Revision 0 B 3.1-24, Revision 22 B 3.1-26, Revision 0 B 3.1-26, Revision 22 B 3.1-27, Revision 0 B 3.1-27, Revision 22 B 3.3-176, Revision 0 B 3.3-176, Revision 21 B 3.3-179 through B 3.3-186, Revision 0 B 3.3-179 through B 3.3-186, Revision 21 B 3.3-188 through B 3.3-192, Revision 0 B 3.3-188 through B 3.3-192, Revision 21

-Bases Book 2 LOEP-1, Revision 20 LOEP-1; Revision 21 LOEP-2, Revision 18 LOEP-2, Revision 21 LOEP-3, Revision 20 LOEP-3, Revision 21 LOEP-4, Revision 13 LOEP-4, Revision 21 B 3.6-69 through B 3.6-79, Revision 18 B 3.6-69 through B 3.6-79, Revision 21 B 3.6-81 through B 3.6-85, Revision 18 B 3.6-81 through B 3.6-85, Revision 21 B 3.7-40, Revision 9 B 3.7-40, Revision 21 B 3.7-42, Revision 9 B 3.7-42, Revision 21 B 3.9-19, Revision 0 B 3.9-19, Revision 21 B 3.9-21, Revision 0 B 3.9-21, Revision 21 LOEP-1, Revision 22 LOEP-1, Revision 20

ENCLOSURE 3 BRUNSWICK STEAM ELECTRIC PLANT, UNIT NOS. 1 AND 2 DOCKET NOS. 50-325 AND 50-324/LICENSE NOS. DPR-71 AND DPR-62 SUBMITTAL OF TECHNICAL SPECIFICATION BASES CHANGES FOR REVISIONS 21 AND 22 (UNITS 1 AND 2),

AND REVISION 23 (UNIT 1 ONLY)

Reulacement Bases Panes - Units 1 and 2

Unit 1 Bases Book 1 Replacement Pages

BASES TO THE FACILITY OPERATING LICENSE DPR-71 TECHNICAL SPECIFICATIONS FOR BRUNSWICK STEAM ELECTRIC PLANT UNIT 1 CAROLINA POWER & LIGHT COMPANY REVISION 23

LIST OF EFFECTIVE PAGES - BASES Page No.

Revision No.

Title Page 23 List of Effective Pages - Book I LOEP-1 LOEP-2 LOEP-3 LOEP-4 i ii 2.0-1 2.0-2 2.0-3 2.0-4 2.0-5 2.0-6 2.0-7 2.0-8 3.0-1 3.0-2 3.0-3 3.0-4 3.0-5 3.0-6 3.0-7 3.0-8 3.0-9 3.0-10 3.0-11 3.0-12 3.0-13 3.0-14 3.0-15 3.1-1 3.1-2 3.1-3 3.1-4 3.1-5 3.1-6 23 21 21 22 21 21 0

0 0

10 0

0 0

Page No.

3.1-7 3.1-8 3.1-9 3.1-10 3.1-11 3.1-12 3.1-13 3.1-14 3.1-15 3.1-16 3.1-17 3.1-18 3.1-19 3.1-20 3.1-21 3.1-22 3.1-23 3.1-24 3.1-25 3.1-26 3.1-27 3.1-28 3.1-29 3.1-30 3.1-31 3.1-32 3.1-33 3.1-34 3.1-35 3.1-36 3.1-37 3.1-38 3.1-39 3.1-40 3.1-41 3.1-42 3.1-43 3.1-44 3.1-45 3.1-46 3.1-47 3.1-48 (continued)

Brunswick Unit I Revision No.

0 0

0 23 0

23 23 0

0 0

Revision 23 1 LOEP-I

LIST OF EFFECTIVE PAGES - BASES Revision No.

3.2-1 3.2-2 3.2-3 3.2-4 3.2-5 3.2-6 3.2-7 3.2-8 3.2-9 3.2-10 3.3-1 3.3-2 3.3-3 3.3-4 3.3-5 3.3-6 3.3-7 3.3-8 3.3-9 3.3-10 3.3-11 3.3-12 3.3-13 3.3-14 3.3-15 3.3-16 3.3-17 3.3-18 3.3-19 3.3-20 3.3-21 3.3-22 3.3-23 3.3-24 3.3-25 3.3-26 3.3-27 3.3-28 3.3-29 3.3-30 3.3-31 3.3-32 3.3-33 Page No.

0 0

0 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 Revision No.

3.3-34 3.3-35 3.3-36 3.3-37 3.3-38 3.3-39 3.3-40 3.3-41 3.3-42 3.3-43 3.3-44 3.3-45 3.3-46 3.3-47 3.3-48 3.3-49 3.3-50 3.3-51 3.3-52 3.3-53 3.3-54 3.3-55 3.3-56 3.3-57 3.3-58 3.3-59 3.3-60 3.3-61 3.3-62 3.3-63 3.3-64 3.3-65 3.3-66 3.3-67 3.3-68 3.3-69 3.3-70 3.3-71 3.3-72 3.3-73 3.3-74 3.3-75 3.3-76 3.3-77 (continued)

Brunswick Unit 1 Page No.

21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 0

0 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 (continued)

Revision 21 1 LOEP-2

LIST OF EFFECTIVE PAGES - BASES (continued)

Revision No.

3.3-78 3.3-79 3.3-80 3.3-81 3.3-82 3.3-83 3.3-84 3.3-85 3.3-86 3.3-87 3.3-88 3.3-89 3.3-90 3.3-91 3.3-92 3.3-93 3.3-94 3.3-95 3.3-96 3.3-97 3.3-98 3.3-99 3.3-100 3.3-101 3.3-102 3.3-103 3.3-104 3.3-105 3.3-106 3.3-107 3.3-108 3.3-109 3.3-110 3.3-111 3.3-112 3.3-113 3.3-114 3.3-115 3.3-116 3.3-117 Page No.

21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 Revision No.

3.3-118 3.3-119 3.3-120 3.3-121 3.3-122 3.3-123 3.3-124 3.3-125 3.3-126 3.3-127 3.3-128 3.3-129 3.3-130 3.3-131 3.3-132 3.3-133 3.3-134 3.3-135 3.3-136 3.3-137 3.3-138 3.3-139 3.3-140 3.3-141 3.3-142 3.3-143 3.3-144 3.3-145 3.3-146 3.3-147 3.3-148 3.3-149 3.3-150 3.3-151 3.3-152 3.3-153 3.3-154 3.3-155 3.3-156 3.3-157 (continued)

Brunswick Unit 1 Page No.

21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 Revision 21 1 LOEP-3

PAGES - BASES (continued)

Revision No.

Page No.

B B

B 3.3-158 3.3-159 3.3-160 3.3-161 3.3-162 3.3-163 3.3-164 3.3-165 3.3-166 3.3-167 3.3-168 3.3-169 3.3-170 3.3-171 3.3-172 3.3-173 3.3-174 3.3-175 3.3-176 3.3-177 3.3-178 3.3-179 3.3-180 3.3-181 3.3-182 3.3-183 3.3-184 3.3-185 3.3-186 3.3-187 3.3-188 3.3-189 3.3-190 3.3-191 3.3-192 3.3-193 3.3-194 3.3-195 3.3-196 3.3-197 3.3-198 3.3-199 3.3-200 3.3-201 3.3-202 3.3-203 3.3-204 3.3-205 3.3-206 3.3-207 3.3-208 3.3-209 3.3-210 3.3-211 3.3-212 3.3-213 Revision No.

21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 Brunswick Unit 1 Page No.

21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 22 21 21 22 22 22 22 22 22 22 22 21 22 22 22 22 22 21 21 21 21 21 21 LIST OF EFFECTIVE I

Revision 22 1 LOEP-4

TABLE OF CONTENTS B 2.0 B 2.1.1 B 2.1.2 B 3.0 B 3.0 B 3.1 B 3.1.1 B 3.1.2 B 3.1.3 B 3.1.4 B 3.1.5 B 3.1.6 B 3.1.7 B 3.1.8 B 3.2 B 3.2.1 B 3.2.2 B 3.3 B 3.3.1.1 B 3.3.1.2 B 3.3.2.1 B 3.3.2.2 B 3.3.3.1 B 3.3.3.2 B 3.3.4.1 B 3.3.5.1 B 3.3.5.2 B 3.3.6.1 B 3.3.6.2 B 3.3.7.1 SAFETY LIMITS (SLs)

Reactor Core SLs Reactor Coolant System (RCS)

Pressure SL LIMITING CONDITION FOR OPERATION (LCO)

APPLICABILITY SURVEILLANCE REQUIREMENT (SR) APPLICABILITY REACTIVITY CONTROL SYSTEMS SHUTDOWN MARGIN (SDM)

Reactivity Anomalies Control Rod OPERABILITY Control Rod Scram Times Control Rod Scram Accumulators Rod Pattern Control Standby Liquid Control (SLC) System Scram Discharge Volume (SDV)

Vent and Drain Valves.........................

POWER DISTRIBUTION LIMITS.........

AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)

MINIMUM CRITICAL POWER RATIO (MCPR)

INSTRUMENTATION Reactor Protection System (RPS)

Instrumentation Source Range Monitor (SRM)

Instrumentation Control Rod Block Instrumentation Feedwater and Main Turbine High Water Level Trip Instrumentation..............

Post Accident Monitoring (PAM)

Instrumentation Remote Shutdown Monitoring Instrumentation Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation Emergency Core Cooling System (ECCS)

Instrumentation Reactor Core Isolation Cooling (RCIC)

System Instrumentation.............

Primary Containment Isolation Instrumentation Secondary Containment Isolation Instrumentation Control Room Emergency Ventilation (CREV)

System Instrumentation................

(conti nued)

Revision No.

21 I B 2.0-1 B 2.0-1 B 2.0-6 B 3.0-1 B 3.0-10 B 3.1-1 B 3.1-1 B 3.1-7 B 3.1-12 B 3.1-21 B 3.1-28 B 3.1-33 B 3.1-38 B 3.1-44 B 3.2-1 B 3.2-1 B 3.2-6 B 3.3-1 B 3.3-1 B 3.3-44 B 3.3-53 B 3.3-68 B 3.3-75 B 3.3-87 B 3.3-93 B 3.3-102 B 3.3-133 B 3.3-144 B 3.3-175 B 3.3-186 I

Brunswick Unit I i

TABLE OF CONTENTS INSTRUMENTATION (continued)

Condenser Vacuum Pump Isolation Instrumentation Loss of Power (LOP)

Instrumentation Reactor Protection System (RPS) Electric Power Monitoring...........................

B 3.3-193 I B 3.3-200 B 3.3-207 I Revision No. 21 1 B 3.3 B 3.3.7.2 B 3.3.8.1 B 3.3.8.2 Brunswick Unit I ii

Control Rod Scram Times B 3.1.4 BASES (continued)

SURVEILLANCE The four SRs of this LCO are modified by a Note stating that REQUIREMENTS during a single control rod scram time surveillance, the CRD pumps shall be isolated from the associated scram accumulator.

With the CRD pump isolated, (i.e., charging valve closed) the influence of the CRD pump head does not affect the single control rod scram times.

During a full core scram, the CRD pump head would be seen by all control rods and would have a negligible effect on the scram insertion times.

SR 3.1.4.1 The scram reactivity used in DBA and transient analyses is based on an assumed control rod scram time.

Measurement of the scram times with reactor steam dome pressure Ž 800 psig demonstrates acceptable scram times for the transients analyzed in Reference 4.

Maximum scram insertion times occur at a reactor steam dome pressure of approximately 800 psig because of the competing effects of reactor steam dome pressure and stored accumulator energy.

Therefore, demonstration of adequate scram times at reactor steam dome pressure Ž 800 psig ensures that the measured scram times will be within the specified limits at higher pressures.

This test is performed for each control rod from its fully withdrawn position.

Limits are specified as a function of reactor pressure to account for the sensitivity of the scram insertion times with pressure and to allow a range of pressures over which scram time testing can be performed.

To ensure that scram time testing is performed within a reasonable time following a shutdown ý 120 days, all control rods are required to be tested before exceeding 40% RTP following the shutdown.

The specified Frequencies are acceptable considering the additional surveillances performed for control rod OPERABILITY, the frequent verification of adequate accumulator pressure, and the required testing of control rods affected by fuel movement within the associated core cell and by work on control rods or the CRD System.

(continued)

Revision No. 23 1 Brunswick Unit I B 3.1-24

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.3 (continued)

REQU IREMENTS scram time sequence is verified.

The limits for reactor pressures < 800 psig are established based on a high probability of meeting the acceptance criteria at reactor pressures ý 800 psig.

Limits for Ž 800 psig are found in Table 3.1.4-1 and do not apply for testing performed at

< 800 psig.

If testing demonstrates the affected control rod does not meet these limits, but is within the 7-second limit of Note 2 to Table 3.1.4-1, the control rod can be considered OPERABLE and "slow."

Specific examples of work that could affect the scram times are (but are not limited to) the following:

removal of any CRD for maintenance or modification; replacement of a control rod; and maintenance or modification of a scram solenoid pilot valve, scram valve, accumulator, isolation valve or check valve in the piping required for scram.

The Frequency of once prior to declaring the affected control rod OPERABLE is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.

SR 3.1.4.4 When work that could affect the scram insertion time is performed on a control rod or CRD System, or when fuel movement within the reactor pressure vessel occurs, testing must be performed to demonstrate each affected control rod is still within the scram time limits of Table 3.1.4-1 with the reactor steam dome pressure Ž 800 psig.

Where work has been performed at high reactor pressure, the requirements of SR 3.1.4.3 and SR 3.1.4.4 can be satisfied with one test.

For a control rod affected by work performed while shut down, however, a zero pressure and high pressure test may be required.

This testing ensures that, prior to withdrawing the control rod for continued operation, the control rod scram performance is acceptable for operating reactor pressure conditions.

This test is performed for each affected control rod from its fully withdrawn position.

Alternatively, a control rod scram test during hydrostatic pressure testing could also satisfy both criteria.

When fuel movement within the reactor pressure vessel occurs, (continued)

Revision No. 23 I Brunswick Unit I B 3.1-26

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.4 (continued)

REQU IREMENTS only those control rods associated with the control cells affected by the fuel movement are required to be scram time tested.

During a routine refueling outage, it is expected that all control rods will be affected.

The Frequency of prior to exceeding 40% RTP is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.

REFERENCES

1. USFAR, Section 3.1.2.2.1.

2.

UFSAR, Section 4.2.1.1.8.

3.

UFSAR, Section 4.3.2.

4.

UFSAR, Chapter 15.

5.

Letter from R.F. Janecek (BWROG) to R.W. Starostecki (NRC),

BWR Owners Group Revised Reactivity Control System Technical Specifications, BWROG-8754, September 17, 1987.

6.

10 CFR 50.36(c)(2)(ii).

Revision No. 23 I B 3.1-27 Brunswick Unit I

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY I.a.

Intermediate Range Monitor Neutron Flux-Hich (continued)

The Intermediate Range Monitor Neutron Flux-High Function must be OPERABLE during MODE 2 when control rods may be withdrawn and the potential for criticality exists.

In MODE 5, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions.

In MODE 1, the APRM System, the RWM, and the Rod Block Monitor provide protection against control rod withdrawal error events and the IRMs are not required.

The IRMs are automatically bypassed when the mode switch is in the run position.

I.b.

Intermediate Range Monitor-Inop This trip signal provides assurance that a minimum number of IRMs are OPERABLE.

Anytime an IRM mode switch is moved to any position other than "Operate," the detector voltage drops below a preset level, or when a module is not plugged in, an inoperative trip signal will be received by the RPS unless the IRM is bypassed.

Since only one IRM in each trip system may be bypassed, only one IRM in each RPS trip system may be inoperable without resulting in an RPS trip signal.

This Function was not specifically credited analysis but it is retained for the overall diversity of the RPS as required by the NRC licensing basis.

in the accident redundancy and approved Six channels of Intermediate Range Monitor-Inop with three channels in each trip system are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.

Since this Function is not assumed in the safety analysis, there is no Allowable Value for this Function.

This Function is required to be OPERABLE when the Intermediate Range Monitor Neutron Flux-High Function is required.

(continued)

Revision No. 21 1 I

Brunswick Unit 1 B 3.3-6

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Average Power Range Monitor (APRM)

The APRM channels provide the primary indication of neutron flux within the core and respond almost instantaneously to neutron flux increases.

The APRM channels receive input signals from the local power range monitors (LPRMs) within the reactor core to provide an indication of the power distribution and local power changes.

The APRM channels average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than RTP.

Each APRM channel also includes an Oscillation Power Range Monitor (OPRM)

Upscale Function which monitors small groups of LPRM signals to detect thermal-hydraulic instabilities.

The APRM System is divided into four APRM channels and four 2-Out-Of-4 Voter channels.

Each APRM channel provides inputs to each of the four voter channels.

The four voter channels are divided into two groups of two each with each group of two providing inputs to one RPS trip system.

The system is designed to allow one APRM channel, but no voter channels, to be bypassed.

A trip from any one unbypassed APRM will result in a "half-trip" in all four of the voter channels, but no trip inputs to either RPS trip system.

APRM trip Functions 2.a, 2.b, 2.c, and 2.d are voted independently from OPRM Upscale Function 2.f.

Therefore, any Function 2.a, 2.b, 2.c, or 2.d trip from any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system logic channel (AI, A2, Bi, and B2), thus resulting in a full scram signal.

Similarly, a Function 2.f trip from any two unbypassed APRM channels will result in a full trip from each of the four voter channels.

Three of the four APRM channels and all four of the voter channels are required to be OPERABLE to ensure that no single failure will preclude a scram on a valid signal.

In addition, to provide adequate coverage of the entire core consistent with the design bases for the APRM Functions 2.a, 2.b, and 2.c, at least 17 LPRM inputs with at least three LPRM inputs from each of the four axial levels at which the LPRMs are located, must be OPERABLE for each APRM channel.

For the OPRM Upscale Function 2.f, each LPRM in an APRM (continued)

Revision No.

21 I Brunswick Unit I B 3.3-7

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE Average Power Range Monitor (APRM)

(continued)

SAFETY ANALYSES, LCO, and channel is assigned to one, two or four OPRM "cells,"

APPLICABILITY forming a total of 24 separate OPRM cells per APRM channel, each with either three or four detectors.

LPRMs near the edge of the core are assigned to either one or two OPRM cells.

A minimum of 18 OPRM cells in an APRM channel must have at least two OPERABLE LPRMs for the OPRM Upscale Function 2.f to be OPERABLE (Ref. 22).

2.a.

Average Power Range Monitor Neutron Flux-High (Setdown)

For operation at low power (i.e., MODE 2), the Average Power I Range Monitor Neutron Flux-High (Setdown) Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range.

For most operation at low power levels, the Average Power Range Monitor Neutron Flux-High (Setdown)

Function will provide a secondary scram to the Intermediate Range Monitor Neutron Flux-High Function because of the relative setpoints.

With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor Neutron Flux-High (Setdown) Function will provide the primary trip signal for a core-wide increase in power.

No specific safety analyses take direct credit for the Average Power Range Monitor Neutron Flux-High (Setdown)

Function.

However, this Function is credited in calculations used to eliminate the need to perform the spatial analysis required for the Intermediate Range Monitor Neutron Flux-High Function (Ref. 6).

In addition, the Average Power Range Monitor Neutron Flux-High (Setdown)

Function indirectly ensures that before the reactor mode switch is placed in the run position, reactor power does not exceed 25% RTP (SL 2.1.1.1) when operating at low reactor pressure and low core flow.

Therefore, it indirectly prevents fuel damage during significant reactivity increases with THERMAL POWER < 25% RTP.

The Allowable Value is based on preventing significant increases in power when THERMAL POWER is < 25% RTP.

The Average Power Range Monitor Neutron Flux-High (Setdown)

Function must be OPERABLE during MODE 2 when control rods may be withdrawn since the potential for criticality exists.

(continued)

Revision No. 21 1 Brunswick Unit 1 B 3.3-8

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.a.

Average Power Range Monitor Neutron Flux-High SAFETY ANALYSES, (Setdown)

(continued)

LCO, and APPLICABILITY In MODE 1, the Average Power Range Monitor Simulated Thermal Power-High and Neutron Flux-High Functions provide protection against reactivity transients and the RWM and Rod Block Monitor protect against control rod withdrawal error events.

2.b.

Average Power Range Monitor Simulated Thermal Power-High The Average Power Range Monitor Simulated Thermal Power-High Function monitors neutron flux to approximate the THERMAL POWER being transferred to the reactor coolant.

The APRM neutron flux is electronically filtered with a time constant, nominally 6 seconds, representative of the fuel heat transfer dynamics to generate a signal proportional to the THERMAL POWER in the reactor.

The trip level is varied as a function of rated recirculation drive flow (W) in percent and is clamped at an upper limit that is always lower than the Average Power Range Monitor Neutron Flux-High Function Allowable Value.

The Average Power Range Monitor Simulated Thermal Power-High Function provides a general definition of the licensed core power/core flow operating domain.

A note is included, applicable when the plant is in single recirculation loop operation per LCO 3.4.1, which requires reducing by AW the flow value used in the Allowable Value equation.

The value of &W is defined in plant procedures.

The value of A1W is established to conservatively bound the inaccuracy created in the core flow/drive flow correlation due to back flow (i.e., reverse flow) in the jet pumps associated with the inactive recirculation loop.

Inaccuracy of the core flow/drive flow correlation results when in single loop operation a higher drive flow is required to produce a specified core flow in comparison to two-loop operation.

This difference exists because the single loop drive flow must compensate for back flow through the inactive jet pumps, which does not occur in two-loop operation.

The correlation factor AW was implemented to maintain the flow-biased trips at the same position, relative to the power/flow map, for single loop operation as they are for two-loop operation.

This adjusted Allowable Value thus maintains thermal margins essentially unchanged from those for two-loop operation.

The allowable value (continued)

Revision No.

21 I Brunswick Unit 1 B 3.3-9

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.b.

Average Power Range Monitor Simulated Thermal SAFETY ANALYSES, Power-High (continued)

LCO, and APPLICABILITY equation for single loop operation is only valid for flows down to W = AW. No correction is required for single loop operation for drive flows less than &W (the value of AW will always be less than about 15%).

Back flow in the inactive recirculation loop does not occur at core flows less than approximately 30 to 40% rated core flow, which corresponds to approximately 30 to 40% drive flow.

The Average Power Range Monitor Simulated Thermal Power-High Function is not associated with an LSSS.

Operating limits established for the licensed operating domain are used to develop the Average Power Range Monitor Simulated Thermal Power-High Function Allowable Values, including the clamp value, to provide pre-emptive reactor scram and prevent gross violation of the licensed operating domain.

Operation outside the licensed operating domain may result in anticipated operational occurrences and postulated accidents being initiated from conditions beyond those assumed in the safety analysis.

Each APRM channel uses one total recirculation drive flow signal representative of total core flow.

The total drive flow signal is generated by the flow processing logic, part of the APRM channel, by summing the flow calculated from two flow transmitter signal inputs, one from each of the two recirculation loops.

The flow processing logic OPERABILITY is part of the APRM channel OPERABILITY requirements for this Function.

The Average Power Range Monitor Simulated Thermal Power-High Function uses a trip level generated based on recirculation loop drive flow.

Changes in the core flow to drive flow functional relationship may vary over the core flow operating range.

These changes can result from gradual changes in the Recirculation System and core components over the reactor life time as well as specific maintenance performed on these components (e.g., jet pump cleaning).

The proper representation of drive flow as a representation of core flow is ensured through drive flow alignment, accomplished by SR 3.3.1.1.18.

The Average Power Range Monitor Simulated Thermal Power-High Function is required to be OPERABLE in MODE I when there is the possibility of generating excessive (continued)

Revision No. 21 1 Brunswick Unit I B 3.3-10

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.b.

Average Power Range Monitor Simulated Thermal SAFETY ANALYSES, Power-High (continued)

LCO, and APPLICABILITY THERMAL POWER and potentially damaging fuel cladding.

During MODES 2 and 5, other IRM and APRM Functions provide protection for fuel cladding integrity.

2.c.

Average Power Range Monitor Neutron Flux-High I

The Average Power Range Monitor Neutron Flux-High Function I

is capable of generating a trip signal to prevent fuel I

damage or excessive RCS pressure.

For the overpressurization protection analysis of References 4 and 7, the Average Power Range Monitor Neutron Flux-High Function is assumed to terminate the main steam isolation valve (MSIV) closure event and, along with the safety/relief valves (SRVs), limit the peak reactor pressure vessel (RPV) pressure to less than the ASME Code limits.

The control rod drop accident (CRDA) analysis (Ref. 2) takes credit for the Average Power Range Monitor Neutron Flux-High Function to I

terminate the CRDA.

The Allowable Value is based on the Analytical Limit assumed in the CRDA analysis.

The Average Power Range Monitor Neutron Flux-High Function is required to be OPERABLE in MODE 1 where the potential consequences of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded.

Although the Average Power Range Monitor Neutron Flux-High Function is assumed in the CRDA analysis, which is applicable in MODE 2, the Average Power Range Monitor Neutron Flux-High (Setdown) Function conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection.

Therefore, the Average Power Range Monitor Neutron Flux-High Function is not required in MODE 2.

2.d.

Average Power Range Monitor-Inop Three of the four APRM channels are required to be OPERABLE for each of the APRM Functions.

This Function (Inop) provides assurance that the minimum number of APRM channels are OPERABLE.

(continued1 Revision No. 21 I Brunswick Unit 1 B 3.3-11

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY 2.d.

Average Power Range Monitor-Inop (continued)

For any APRM channel, any time its mode switch is not in the "Operate" position, an APRM module required to issue a trip is unplugged, or the automatic self-test system detects a critical fault with the APRM channel, an Inop trip is sent to all four voter channels.

Inop trips from two or more unbypassed APRM channels result in a trip output from each of the four voter channels to its associated trip system.

This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

There is no Allowable Value for this Function.

This Function is required to be OPERABLE in the MODES where the APRM Functions are required.

2.e.

2-Out-Of-4 Voter The 2-Out-Of-4 Voter Function provides the interface between the APRM Functions, including the OPRM Upscale Function, and the final RPS trip system logic.

As such, it is required to be OPERABLE in the MODES where the APRM Functions are required and is necessary to support the safety analysis applicable to each of those Functions.

Therefore, the 2-Out-Of-4 Voter Function needs to be OPERABLE in MODES 1 and 2.

All four voter channels are required to be OPERABLE.

Each voter channel includes self-diagnostic functions.

If any voter channel detects a critical fault in its own processing, a trip is issued from that voter channel to the associated trip system.

The Two-Out-Of-Four Logic Module includes both the 2-Out-Of-4 Voter hardware and the APRM Interface hardware (the non-safety-related portion of the Two-Out-Of-Four Logic Module including annunciator output relays, status lights, etc.).

The 2-Out-Of-4 Voter Function 2.e votes APRM Functions 2.a, 2.b, 2.c, and 2.d independently of Function 2.f.

This voting is accomplished by the 2-Out-Of-4 Voter hardware in the Two-Out-Of-Four Logic Module.

The voter also includes separate outputs to RPS for the two (continued)

Revision No. 21 I I

Brunswick Unit I B 3.3-12

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY 2.e.

2-Out-Of-4 Voter (continued) independently voted sets of Functions, each of which is redundant (four total outputs).

The analysis in Reference 15 took credit for this redundancy in the justification of the 12-hour Completion Time for Condition A, so the voter Function 2.e must be declared inoperable if any of its functionality is inoperable.

The voter Function 2.e does not need to be declared inoperable due to any failure affecting only the APRM Interface hardware portion of the Two-Out-Of-Four Logic Module.

There is no Allowable Value for this Function.

2.f.

Oscillation Power Range Monitor (OPRM)

Upscale The OPRM Upscale Function provides compliance with GDC 10 and GDC 12, thereby providing protection from exceeding the fuel MCPR safety limit (SI) due to anticipated thermal-hydraulic power oscillations.

ReferencesJ17, 18 and 19 describe three algorithms for detecting thermal-hydraulic instability related neutron flux oscillations:

the period based detection algorithm, the amplitude based algorithm, and the growth rate algorithm.

All three are implemented in the OPRM Upscale Function, but the safety analysis takes credit only for the period based detection algorithm.

The remaining algorithms provide defense in depth and additional protection against unanticipated oscillations.

OPRM Upscale Function OPERABILITY for Technical Specification purposes is based only on the period based detection algorithm.

The OPRM Upscale Function receives input signals from the LPRIs within the reactor core, which are combined into "cells" for evaluation by the OPRM algorithms.

Each channel is capable of detecting thermal-hydraulic instabilities, by detecting the related neutron flux oscillations, and issuing a trip signal before the MCPR SL is exceeded.

Three of the four channels are required to be OPERABLE.

The OPRM removed) the APRM 5 60% of Upscale trip is automatically enabled (bypass when THERMAL POWER is

25% RTP, as indicated by Simulated Thermal Power, and reactor core flow is rated flow, as indicated by APRM measured (continued)

Revision No. 21 I Brunswick Unit I B 3.3-13

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY 2.f.

Oscillation Power Range Monitor (OPRM)

Upscale (continued) recirculation drive flow.

This is the operating region where actual thermal-hydraulic instability and related neutron flux oscillations may occur.

See Reference 21 for additional discussion of OPRM Upscale trip enable region limits.

The 25% RTP lower boundary of the enabled region was established by scaling the 30% value in Reference 21 for uprated power to correspond to 30% of original plant RTP.

This scaling is not required by Reference 21, but has been done for conservatism.

These setpoints, which are sometimes referred to as the "auto-bypass" setpoints, establish the boundaries of the OPRM Upscale trip enabled region.

The APRM Simulated Thermal Power auto-enable setpoint has 1% deadband while the drive flow setpoint has a 2% deadband.

The deadband for these setpoints is established so that it increased the enabled region.

The OPRM Upscale Function is required to be OPERABLE when the plant is at ! 20% RPT.

The 20% RTP level is selected to provide margin in the unlikely event that a reactor power increase transient occurring while the plant is operating below 25% RTP causes a power increase to or beyond the 25% APRM Simulated Thermal Power OPRM Upscale trip auto-enable setpoint without operator action.

This OPERABILITY requirement assures that the OPRM Upscale trip auto-enable function will be OPERABLE when required.

An OPRM Upscale trip is issued from an APRM channel when the period based detection algorithm in that channel detects oscillatory changes in the neutron flux, indicated by the combined signals of the LPRM detectors in a cell, with period confirmations and relative cell amplitude exceeding specified setpoints.

One or more cells in a channel exceeding the trip conditions will result in a channel trip.

An OPRM Upscale trip is also issued from the channel if either the growth rate or amplitude based algorithms detect growing oscillatory changes in the neutron flux for one or more cells in that channel.

(Note:

To facilitate placing the OPRM Upscale Function 2.f in one APRM channel in a (continued)

Revision No. 21 1 Brunswick Unit 1

-B 3.3-14

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.f.

Oscillation Power Range Monitor (OPRM)

Upscale SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY "tripped" state, if necessary to satisfy a Required Action, the APRM equipment is conservatively designed to force an OPRM Upscale trip output from the APRM channel if an APRM Inop condition occurs, such as when the APRM chassis keylock switch is placed in the Inop position.)

There are four *sets" of OPRM related setpoints or adjustment parameters:

(a)

OPRM trip auto-enable setpoints for Simulated Thermal Power (STP)

(25%) and drive flow (60%); (b) period based detection algorithm (PBDA) confirmation count and amplitude setpoints; (c) period based detection algorithm tuning parameters; and (d) growth rate algorithm (GRA) and amplitude based algorithm (ABA) setpoints.

The first set, the OPRM auto-enable region setpoints, as discussed in the SR 3.3.1.1.19 Bases, are treated as nominal setpoints with no additional margins added.

The settings, 25% APRM Simulated Thermal Power and 60% drive flow, are defined (limit values) in and confirmed by SR 3.3.1.1.19.

The second set, the OPRM PBDA trip setpoints, are established in accordance with methodologies defined in Reference 23, and are documented in the COLR.

There are no allowable values for these setpoints.

The third set, the OPRM PBDA "tuning" parameters, are established, adjusted, and controlled by plant procedures.

The fourth set, the GRA and ABA setpoints, in accordance with References 15 and 16, are established-as nominal values only, and controlled by plant procedures.

3.

Reactor Vessel Steam Dome Pressure-High An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion.

This causes the neutron flux and THERMAL POWER transferred to the reactor coolant to increase, which could challenge the integrity of the fuel cladding and the RCPB.

The Reactor Vessel Steam Dome Pressure-High Function initiates a scram for transients that results in a pressure increase, counteracting the pressure increase by rapidly reducing core power.

For the (continued)

Revision No.

21 I Brunswick Unit I B 3.3-15

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE

3.

Reactor Vessel Steam Dome Pressure-High (continued)

SAFETY ANALYSES, LCO, and overpressurization protection analyses of References 4, 7, APPLICABILITY and 8, reactor scram, along with the SRVs, limits the peak RPV pressure to less than the ASME Section III Code limits.

High reactor pressure signals are initiated from four pressure transmitters that sense reactor pressure.

The Reactor Vessel Steam Dome Pressure-High Allowable Value is chosen to provide a sufficient margin to the ASME Section III Code limits during the event.

Four channels of Reactor Vessel Steam Dome Pressure-High Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.

The Function is required to be OPERABLE in MODES I and 2 since the Reactor Coolant System (RCS) is pressurized and the potential for pressure increase exists.

4.

Reactor Vessel Water Level-Low Level I Low RPV water level indicates the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, a reactor scram is initiated at Low Level 1 to substantially reduce the heat generated in the fuel from fission.

The Reactor Vessel Water Level-Low Level I Function is assumed in the analysis of the recirculation line break (Ref. 9).

The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling Systems (ECCS),

ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level--Low Level 1 Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to (continued)

Revision No.

21 I Brunswick Unit I B 3.3-16

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE

4.

Reactor Vessel Water Level-Low Level 1 (continued)

SAFETY ANALYSES, LCO, and ensure that no single instrument failure will preclude a APPLICABILITY scram from this Function on a valid signal.

The Reactor Vessel Water Level-Low Level 1 Allowable Value is selected to ensure that during normal operation the steam dryer seal skirt and lowest steam separator skirt are not uncovered (this protects available recirculation pump net positive suction head (NPSH) from significant carryunder) and, for transients involving loss of all normal feedwater flow, initiation of the low pressure ECCS subsystems at Reactor Vessel Water-Low Level 3 will not be required.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

The Function is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and accidents.

ECCS initiations at Reactor Vessel Water Level-Low Level 2 and Low Level 3 provide sufficient protection for level transients in all other MODES.

5.

Main Steam Isolation Valve-Closure MSIV closure results in loss of the main turbine and the condenser as a heat sink for the nuclear steam supply system and indicates a need to shut down the reactor to reduce heat generation.

Therefore, a reactor scram is initiated on a Main Steam Isolation Valve-Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient.

However, for the overpressurization protection analyses of References 4, 7, and 8, the Average Power Range Monitor Neutron Flux-High Function, along with the SRVs, limits the peak RPV pressure to less than the ASME Code limits.

That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis.

Additionally, MSIV closure is assumed in the transients analyzed in Reference 2.

The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

(continued)

Revision No. 21 1 Brunswick Unit I 8 3.3-17

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY

5. Main Steam Isolation Valve-Closure (continued)

MSIV closure signals are initiated from position switches located on each of the eight MSIVs.

Each MSIV has two position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B.

Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve-Closure channels, each consisting of one position switch.

The logic for the Main Steam Isolation Valve-Closure Function is arranged such that either the inboard or outboard valve on three or more of the main steam lines must close in order for a scram to occur.

In addition, certain combinations of valves closed in two lines will result in a half-scram.

The Main Steam Isolation Valve-Closure Allowable Value is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient.

Sixteen channels of the Main Steam Isolation Valve-Closure Function, with eight channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude the scram from this Function on a valid signal.

This Function is only required in MODE 1 since, with the MSIVs open and the heat generation rate high, a pressurization transient can occur if the MSIVs close.

In MODE 2, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection.

6.

Drywell Pressure-High High pressure in the drywell could indicate a break in the RCPB.

A reactor scram is initiated to minimize the possibility of fuel damage and to reduce the amount of energy being added to the coolant and the drywell.

The Drywell Pressure-High Function is a secondary scram signal to Reactor Vessel Water Level-Low Level I for LOCA events inside the drywell.

However, no credit is taken for a scram (continued)

Revision No. 21 I Brunswick Unit I B 3.3-18

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY

6.

Drywell Pressure-High (continued) initiated from this Function for any of the DBAs analyzed in the UFSAR.

This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the.NRC approved licensing basis.

The reactor scram reduces the amount of be absorbed and, along with the actions that the fuel peak cladding temperature limits of 10 CFR 50.46.

energy required to of the ECCS, ensures remains below the High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure.

The Allowable Value was selected to be as low as possible and indicative of a LOCA inside primary containment.

Four channels of.Drywell Pressure-High Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.

The Function is required in MODES I and 2 where considerable energy exists in the RCS, resulting in the limiting transients and accidents.

7.

Scram Discharue Volume Water Level-Hiah The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram.

Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered.

Therefore, a reactor scram is initiated while the remaining free volume is still sufficient to accommodate the water from a full core scram.

The two types of Scram Discharge Volume Water Level-.High Functions are an input to the RPS logic.

No credit is taken for a scram initiated from these Functions for any of the design basis accidents or transients analyzed in the UFSAR.

However, they are retained to ensure the RPS remains OPERABLE.

(continued)

Revision No. 21 1 Brunswick Unit I B 3.3-19

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY

7.

Scram Discharge Volume Water Level-High (continued)

SDV water level is measured by two diverse methods.

The level in each of the two SDVs is measured by two float type level switches and two thermal probes for a total of eight level signals.

The outputs of these devices are arranged so that there is a signal from a level switch and a thermal probe to each RPS logic channel.

The level measurement instrumentation satisfies the recommendations of Reference 10.

The Allowable Value is chosen low enough to ensure that there is sufficient volume in the SDV to accommodate the water from a full scram.

Four channels of the Scram Discharge Volume Water Level--High Function, with at least one channel utilizing a float type switch and one channel utilizing a thermal probe in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from these Functions on a valid signal.

These Functions are required in MODES I and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

At all other times, this Function may be bypassed.

8.

Turbine StoD Valve-Closure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves.

The Turbine Stop Valve-Closure Function is the primary scram signal for the turbine trip event analyzed in Reference 2.

For this event, the reactor scram reduces the amount of energy required to be absorbed and ensures that the MCPR SL is not exceeded.

(continued)

Revision No.

21 I Brunswick Unit I B 3.3-20

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY

8.

Turbine Stop Valve-Closure (continued)

Turbine Stop Valve-Closure signals are initiated from position switches located on each of the four TSVs.

Two independent position switches are associated with each stop valve.

One of the two switches provides input to RPS trip system A; the other, to RPS trip system B.

Thus, each RPS trip system receives an input from four Turbine Stop Valve-Closure channels, each consisting of one position switch.

The logic for the Turbine'Stop Valve-Closure Function is such that three or more TSVs must be closed to produce a scram.

In addition, certain combinations of two valves closed will result in a half-scram.

This Function must be enabled at THERMAL POWER Ž 30% RTP.

This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Function.

The Turbine Stop Valve-Closure Allowable Value is selected to be high enough to detect imminent TSV closure, thereby reducing the severity of the subsequent pressure transient.

Eight channels of Turbine Stop Valve-Closure Function, with four channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function if any three TSVs should close.

This Function is required, consistent with analysis assumptions, whenever THERMAL POWER is t 30% RTP.

This Function is not'required when THERMAL POWER is < 30% RTP since the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Neutron Flux-High Functions are adequate to maintain the necessary safety margins.

9. Turbine Control Valve Fast Closure, Control Oil Pressure-Low Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves.

The Turbine Control Valve Fast Closure, Control Oil Pressure-Low Function is the primary scram signal for the generator load rejection event analyzed in Reference 2.

For (continued)

Revision No.

21 1 Brunswick Unit 1 B 3.3-21

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE

9.

Turbine Control Valve Fast Closure, Control Oil SAFETY ANALYSES, Pressure-Low (continued)

LCO, and APPLICABILITY this event, the reactor scram reduces the amount of energy required to be absorbed and ensures that the MCPR SL is not exceeded.

Turbine Control Valve Fast Closure, Control Oil Pressure-Low signals are initiated by the electrohydraulic control (EHC) fluid pressure at each control valve.

One pressure switch is associated with each control valve, and the signal from each switch is assigned to a separate RPS logic channel.

This Function must be enabled at THERMAL POWER Ž 30% RTP.

This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Function.

The Turbine Control Valve Fast Closure, Control Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.

Four channels of Turbine Control Valve Fast Closure, Control Oil Pressure-Low Function with two channels in each trip system arranged in a one-out-of-two logic are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.

This Function is required, consistent with the analysis assumptions, whenever THERMAL POWER is Ž 30% RTP.

This Function is not required when THERMAL POWER is < 30% RTP, since the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Neutron Flux-High Functions are I adequate to maintain the necessary safety margins.

10.

Reactor Mode Switch-Shutdown Position The Reactor Mode Switch-Shutdown Position Function provides signals, via the manual scram logic channels, to two RPS logic channels, which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability.

This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

(continued)

Revision No. 21 I Brunswick Unit I B 3.3-22

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE

10.

Reactor Mode Switch-Shutdown Position (continued)

SAFETY ANALYSES, LCO, and The reactor mode switch is a single switch with two APPLICABILITY channels, each of which provides input into one of the manual RPS logic channels (A3 and B3).

The reactor mode switch is capable of scramming the reactor if the mode switch is placed in the shutdown position.

There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on reactor mode switch position.

Two channels of Reactor Mode Switch-Shutdown Position Function, with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be OPERABLE.

The Reactor Mode Switch-Shutdown Position Function is required to be OPERABLE in MODES I and 2, and MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

11.

Manual Scram The Manual Scram push button channels provide signals to the manual scram logic channels (A3 and B3), which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability.

This Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

There is one Manual Scram push button channel for each RPS trip system.

In order to cause a scram it is necessary for each trip system to be actuated.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of Manual Scram with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be OPERABLE in MODES I and 2, and in MODE 5 (continued)

Revision No. 21 I Brunswick Unit I B 3.3-23

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE

11.

Manual Scram (continued)

SAFETY ANALYSES,

LCO, and with any control rod withdrawn from a core cell containing APPLICABILITY one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

ACTIONS A Note has been provided to modify the ACTIONS related to RPS instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable RPS instrumentation channels provide appropriate compensatory measures for separate inoperable channels.

As such, a Note has been provided that allows separate Condition entry for each inoperable RPS instrumentation channel.

A.1 and A.2 Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Refs.

11, 15, and 16) to permit restoration of any inoperable channel to OPERABLE status.

However, this out of service time is only acceptable provided the associated Function's inoperable channel is in one trip system and the Function still maintains RPS trip capability (refer to Required Actions B.1, B.2, and C.1 Bases).

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Required Actions A.1 and A.2.

Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternatively, if it is not desired to place the channel (or trip system) in trip (e.g.,

as in the case where placing the inoperable channel in trip would result in a full scram), Condition D must be entered and its Required Action taken.

(continued)

Revision No. 21 1 Brunswick Unit I B 3.3-24

RPS Instrumentation B 3.3.1.1 BASES ACTIONS A.1 and A.2 (continued)

As noted, Action A.2 is not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

Inoperability of one required APRM channel affects both trip systems.

For that condition, Required Action A.1 must be satisfied, and is the only action (other than restoring OPERABILITY) that will restore capability to accommodate a single failure.

Inoperability of more than one required APRM channel of the same trip function results in loss of trip capability and entry into Condition C, as well as entry into Condition A for each channel.

B.1 and B.2 Condition B exists when, for any one or more Functions, at least one required channel is inoperable in each trip system.

In this condition, provided at least one channel per trip system is OPERABLE, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system.

Required Actions B.1 and B.2 limit the time the RPS scram logic, for any Function, would not accommodate single failure in both trip systems (e.g., one-out-of-one and one-out-of-one arrangement for a typical four channel Function).

The reduced reliability of this logic arrangement was not evaluated in References 11, 15, or 16 for the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time.

Within the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the associated Function will have all required channels OPERABLE or in trip (or any combination) in one trip system.

This is accomplished by either placing all inoperable channels in trip or tripping the trip system.

Completing one of these Required Actions restores RPS to a reliability level equivalent to that evaluated in References 11, 15, and 16 which justified a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowable out of service time as presented in Condition A.

The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g.,

a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels if the two inoperable channels are in the same Function while the four inoperable channels are all in (continued)

Revision No. 21 1 Brunswick Unit I 8 3.3-25

RPS Instrumentation B 3.3.1.1 BASES ACTIONS B.1 and B.2 (continued) different Functions).

The decision of which trip system is in the more degraded state should be based on prudent judgment and take into account current plant conditions (i.e., what MODE the plant is in).

If this action would result in a scram, it is permissible to place the other trip system or its inoperable channels in trip.

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram.

Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram, Condition D must be entered and its Required Action taken.

As noted, Condition B is not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

Inoperability of an APRM channel affects both trip systems and is not associated with a specific trip system as are the APRM 2-Out-Of-4 Voter and other non-APRM channels for which Condition B applies.

For an inoperable APRM channel, Required Action A.1 must be satisfied, and is the only action (other than restoring OPERABILITY) that will restore capability to accommodate a single failure.

Inoperability of a Function in more than one required APRM channel results in loss of trip capability for that Function and entry into Condition C, as well as entry into Condition A for each channel.

Because Conditions A and C provide Required Actions that are appropriate for the inoperability of APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f, and because these functions are not associated with specific trip systems as are the APRM 2-Out-Of-4 Voter and other non-APRM channels, Condition B does not apply.

(continued)

Revision No. 21 I Brunswick Unit I B 3.3-26

RPS Instrumentation B 3.3.1.1 BASES ACTIONS C.1 (continued)

Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Function result in the Function not maintaining RPS trip capability.

A Function is considered to be maintaining RPS trip capability when sufficient channels are OPERABLE or in trip (or the associated trip system is in trip), such that both trip systems will generate a trip signal from the given Function on a valid signal.

For the typical Function with one-out-of-two taken twice logic and the IRM and APRM/Voter Functions, this would require both trip systems to have one channel OPERABLE or in trip (or the associated trip system in trip).

For Functions 2.a, 2.b, 2.c, 2.d, and 2.f, this would require that two of the four channels be OPERABLE or in the trip condition.

For Function 5 (Main Steam Isolation Valve-Closure), this would require both trip systems to have each channel associated with the MSIVs in three main steam lines (not necessarily the same main steam lines for both trip systems) OPERABLE or in trip (or the associated trip system in trip).

For Function 8 (Turbine Stop Valve-Closure), this would require both trip systems to have three channels,ieach OPERABLE or in trip (or the associated trip system in trip).

For Function 10 (Reactor Mode Switch-Shutdown Position) and Function 11 (Manual Scram), this would require both trip systems to have one channel, each OPERABLE or in trip (or the associated trip system in trip).

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

D.1 Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1.

The applicable Condition specified in the Table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed.

Each time an inoperable channel has not met any Required Action of Condition A, B, or C and the associated Completion Time (continued)

Revision No.

21 1 Brunswick Unit I

-B 3.3-27

RPS Instrumentation B 3.3.1.1 BASES ACTIONS D.1 (continued) has expired, Condition D will be entered for that channel and provides for transfer to the appropriate subsequent Condition.

E.1, F.I, G.1, and J.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply.

The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.

In addition, the Completion Time of Required Actions E.1 and J.1 are consistent with the Completion Time provided in LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)."

H.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply.

This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies.

Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted.

Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

1.1 Condition I exists when the OPRM Upscale Trip cabability has been lost for all APRM channels due to unanticipated equipment design or instability detection algorithm problems.

References 15 and 16 justified use of alternate methods to detect and suppress oscillations under limited conditions.

The alternate methods are procedurally established consistent with the guidelines identified in (continued)

Revision No.

21 I Brunswick Unit I B 3.3-28

RPS Instrumentation B 3.3.1.1 BASES ACTIONS 1.1 (continued)

Reference 20.

The alternate methods procedures require operating outside a "restricted zone" in the power-flow map and manual operator action to scram the plant if certain predefined events occur.

The 12-hour allowed Completion Time for Required Action I.1 is based on engineering judgment to allow orderly transition to the alternate methods while limiting the period of time during which no automatic or alternate detect and suppress trip capability is formally in place.

Based on the small probability of an instability event occurring at all, the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is judged to be reasonable.

This Required Action is intended to allow continued plant operation under limited conditions when an unanticipated equipment design or instability detection algorithm problem causes OPRM Upscale Function inoperability in all APRM channels.

This Required Action is not intended and was not evaluated as a routine alternative to return failed or inoperable equipment to OPERABLE status.

Correction of routine equipment failure or inoperability is expected to be accomplished within the completion times allowed for Required Actions for Condition A.

The alternate method to detect and suppress oscillations implemented in accordance with 1.1 is intended to be applied only as long as is necessary to implement corrective action to resolve the unanticipated equipment design or instability detection algorithm problem.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains RPS trip capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Ref.

11, 15, and 16) assumption of the average time required to perform channel Surveillance.

(continued)

Brunswick Unit 1 8 3.3-29 Revision No. 211

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing REQUIREMENTS allowance does not significantly reduce the probability that (continued) the RPS will trip when necessary.

SR 3.3.1.1.1 (Not used.)

SR 3.3.1.1.2 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures I that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

The CHANNEL CHECK for APRM functions includes a step to confirm that the automatic self-test functions for the APRM and RBM chassis are still operating.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication'that the instrument has drifted outside its limit.

The Frequencies are based upon operating experience that demonstrates channel failure is rare.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

(continued)

Revision No. 21 I Brunswick Unit I B 3.3-30

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.3 REQUIREMENTS (continued)

To ensure that the APRMs are accurately indicating the true core average power, the APRMs are adjusted to conform to the reactor power calculated from a heat balance.

The Frequency of once per 7 days is based on minor changes in LPRM sensitivity, which could affect the APRM reading between performances of SR 3.3.1.1.8.

A restriction to satisfying this SR when < 25% RTP is provided that requires the SR to be met only at - 25% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when < 25% RTP.

At low power levels, a high degree of accuracy is unnecessary because of the large, inherent margin to thermal limits (MCPR and APLHGR).

At z 25% RTP, the Surveillance is required to have been satisfactorily performed within the last 7 days, in accordance with SR 3.0.2.

A Note is provided which allows an increase in THERMAL POWER above 25% if the 7 day Frequency is not met per SR 3.0.2.

In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching or exceeding 25% RTP.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

SR 3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

As noted, SR 3.3.1.1.4 is not required to be performed when entering MODE 2 from MODE 1, since testing of the MODE 2 required IRM Functions cannot be performed in MODE I without utilizing jumpers, lifted leads, or movable links.

This allows entry into MODE 2 if the 7 day Frequency is not met per SR 3.0.2.

In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2 from MODE 1.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

A Frequency of 7 days provides an acceptable level of system average unavailability over the Frequency interval and is based on reliability analysis (Ref.

11).

(continued)

Revision No.

21 I Brunswick Unit I B 3.3-31

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.1.5 There are four pairs of RPS automatic scram contactors with each pair associated with an RPS scram test switch.

Each pair of scram contactors is associated with an automatic scram logic channel (Al, A2, BI, and B2).

The automatic scram contactors can be functionally tested without the necessity of using a scram function trip.

Surveillance Frequency extensions for RPS Functions, described in Reference 11, are allowed provided the automatic scram contactors are functionally tested weekly.

This functional test is accomplished by placing the associated RPS scram test switch in the trip position, which will deenergize a pair of RPS automatic scram contactors thereby tripping the associated RPS logic channel.

The RPS scram test switches were not specifically credited in the accident analysis.

However, because the Manual Scram Functions at BNP were not configured the same as the generic model in Reference 11, the RPS scramtest switches were evaluated in Reference 12.

Reference 12 concluded that the Frequency extensions for RPS Functions are-not affected by the difference in RPS configuration since each automatic RPS channel has a test switch which is functionally the same as the manual scram switches in the generic model.

As such, a functional test of each automatic scram contactor is required to be performed every 7 days.

The Frequency of 7 days is based on the reliability analysis of Reference 12.

SR 3.3.1.1.6 and SR 3.3.1.1.7 These Surveillances are established to ensure that no gaps in neutron flux indication exist from subcritical to power operation for monitoring core reactivity status.

The overlap between SRMs and IRMs is required to be demonstrated to ensure that reactor power will not be increased into a neutron flux region without adequate indication.

This is required prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from the SRMs to the IRMs.

The overlap between IRMs and APRMs is of concern when reducing power into the IRM range.

On power increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained.

Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs (continued)

Revision No.

21 I Brunswick Unit 1 B 3.3-32

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.6 and SR 3.3.1.1.7 (continued)

REQUIREMENTS concurrently have onscale readings such that the transition between MODE I and MODE 2 can be made without either APRM downscale rod block, or IRM upscale rod block.

Overlap between SRMs and IRMs similarly exists when, prior to withdrawing the SRMs from the fully inserted position, IRM readings have doubled before the SRMs have reached the high-high upscale trip.

As noted, SR 3.3.1.1.7 is only required to be met during entry into MODE 2 from MODE 1.

That is, after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in MODE 2).

If overlap for a group of channels is not demonstrated (e.g.,

IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channel(s) declared inoperable.

Only those appropriate channels that are required in the current MODE or condition should be declared inoperable.

A Frequency of 7 days is reasonable based on engineering judgment and the reliability of the IRMs and APRMs.

SR 3.3.1.1.8 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP)

System.

This establishes the relative local flux profile for appropriate representative input to the APRM System.

The 1100 MWD/T Frequency is based on operating experience with LPRM sensitivity changes.

The core weight, tons (T) in MWD/T, reflects metric tons.

SR 3.3.1.1.9 and SR 3.3.1.1.12 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The 92 day Frequency of SR 3.3.1.1.9 is based on the reliability analysis of Reference 11.

(continued)

Revision No. 21 I Brunswick Unit I 8 3.3-33

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.9 and SR 3.3.1.1.12 (continued)

REQUIREMENTS The 24 month Frequency of SR 3.3.1.1.12 is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency.

SR 3.3.1.1.10 Calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.1.1-1.

If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 11.

SR 3.3.1.1.11 A CHANNEL FUNCTIONAL TEST is-performed on each required channel to ensure that the entire channel will perform the intended function.

For the APRM Functions, this test supplements the automatic self-test functions that operate continuously in the APRM and voter channels.

The scope of the APRM CHANNEL FUNCTIONAL TEST is that which is necessary to test the hardware.

Software controlled functions are tested only incidentally.

Automatic self-test functions check the EPROMs in which the software-controlled logic is defined.

Changes in the EPROMs will be detected by the self-test function and alarmed via the APRM trouble alarm.

SR 3.3.1.1.2 for the APRM functions includes a step to confirm that the automatic self-test function is still operating.

(continued)

Revision No.

21 I Brunswick Unit I B 3.3-34

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.11 (continued)

REQUIREMENTS The APRM CHANNEL FUNCTIONAL TEST covers the APRM channels (including recirculation flow processing - applicable to Function 2.b and the auto-enable portion of Function 2.f only), the 2-Out-Of-4 Voter channels, and the interface connections into the RPS trip systems from the voter channels.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The 184-day Frequency of SR 3.3.1.1.11 is based on the reliability analyses of References 15 and 16.

(NOTE:

The actual voting logic of the 2-Out-Of-4 Voter Function is tested as part of SR 3.3.1.1.15.

The auto-enable setpoints for the OPRM Upscale trip are confirmed by SR 3.3.1.1.19.)

A Note is provided for Function 2.a that requires this SR to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1.

Testing of the MODE 2 APRM Function cannot be performed in MODE I without utilizing jumpers or lifted leads.

This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2.

A second Note is provided for Functions 2.b and 2.f that clarifies that the CHANNEL FUNCTIONAL TEST for Functions 2.b and 2.f includes testing of the recirculation flow processing electronics, excluding the flow transmitters.

SR 3.3.1.1.13 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The CHANNEL CALIBRATION for Functions 5 and 8 should consist of a physical inspection and actuation of the associated position switches.

Note I states that neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal.

Changes in neutron detector sensitivity (continued)

Brunswick Unit I Revision No. 21 1

B 3.3-35

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.13 (continued)

REQUIREMENTS are compensated for by performing the 7 day calorimetric calibration (SR 3.3.1.1.3) and the 1100 MWD/T LPRM calibration against the TIPs (SR 3.3.1.1.8).

A second Note is provided that requires the IRA SRs to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1.

Testing of the MODE 2 IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links.

This Note allows entry into MODE 2 from MODE I if the associated Frequency is not met per SR 3.0.2.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

A third note is provided that requires that the recirculation flow (drive flow) transmitters, which supply the flow signal to the APRMs, be included in the SR for Functions 2.b and 2.f.

The APRM Simulated Thermal Power-High Function (Function 2.b) and the OPRM Upscale Function (Function 2.f) both require a valid drive flow signal.

The APRM Simulated Thermal Power-High Function uses drive flow to automatically enable or bypass the OPRM Upscale trip output to RPS.

A CHANNEL CALIBRATION of the APRM drive flow signal requires both calibrating the drive flow transmitters and the processing hardware in the APRM equipment.

SR 3.3.1.1.18 establishes a valid drive flow/core flow relationship.

Changes throughout the cycle in the drive flow/core flow relationship due to the changing thermal hydraulic operating conditions of the core are accounted for in the margins included in the bases or analyses used to establish the setpoints for the APRM Simulated Thermal Power-High Function and the OPRM Upscale Function.

The Frequency of SR 3.3.1.1.13 is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.1.1.14 (Not used.)

(continued)

Revision No.

21 1 Brunswick Unit I B 3.3-36

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.15 REQUIREMENTS (continued)

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic and simulated automatic operation for a specific channel.

The functional testing of control rods (LCO 3.1.3), and SDV vent and drain valves (LCO 3.1.8), overlaps this Surveillance to provide complete testing of the assumed safety function.

The LOGIC SYSTEM FUNCTIONAL TEST for APRM Function 2.e simulates APR4 and OPRM trip conditions at the 2-Out-Of-4 Voter channel inputs to check all combinations of two tripped inputs to the 2-Out-Of-4 logic in the voter channels and APRM related redundant RPS relays.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency.

SR 3.3.1.1.16 This SR ensures that scrams initiated from the Turbine Stop Valve-Closure and Turbine Control Valve Fast Closure, Control Oil Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is Ž 30% RTP.

This is satisfied by calibration of the bypass channels.

Adequate margins for the instrument setpoint methodologies are incorporated into the-Allowable Value and the actual setpoint.

Because main turbine bypass flow can affect this setpoint nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must remain closed during an in-service calibration at THERMAL POWER Ž 30% RTP to ensure that the calibration is valid.

If any bypass channel setpoint is nonconservative (i.e., the Functions are bypassed at Ž 30% RTP, either due to open main turbine bypass valve(s) or other reasons), then the affected Turbine Stop Valve-Closure and Turbine Control Valve Fast Closure, Control Oil Pressure-Low Functions are considered inoperable.

Alternatively, the bypass channel can be placed (continued)

Revision No.

21 1 Brunswick Unit I B 3.3-37

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.16 (continued)

REQUIREMENTS in the conservative condition (non-bypass).

If placed in the non-bypass condition, this SR is met and the channel is considered OPERABLE.

The Frequency of 24 months is based on engineering judgment and reliability of the components.

SR 3.3.1.1.17 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis.

This test may be performed in one measurement or in overlapping segments, with verification that all components are tested.

The RPS RESPONSE TIME acceptance criteria are included in Reference 13.

RPS RESPONSE TIME for the APRM 2-Out-Of-4 Voter Function (2.e) includes the output relays of the voter and the associated RPS relays and contactors.

(The digital portion of the APRM and 2-Out-Of-4 Voter channels are excluded from RPS RESPONSE TIME testing because self-testing and calibration checks the time base of the digital electronics.

Confirmation of the time base is adequate to assure required response times are met.

Neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time.)

Note 2 states the response time of the sensors for Functions 3 and 4 may be assumed in the RPS RESPONSE TIME test to be the design sensor response time.

This is allowed since the sensor response time is a small part of the overall RPS RESPONSE TIME (Ref. 14).

RPS RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS.

Note 3 requires STAGGERED TEST BASIS Frequency to be determined based on 4 channels per trip system, in lieu of the 8 channels specified in Table 3.3.1.1-1 for the MSIV Closure Function.

This Frequency is based on the logic interrelationships of the various channels required to produce an RPS scram signal.

(continued)

Revision No.

21 I Brunswick Unit I B 3.3-38

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.1.17 (continued)

Note 4 allows the STAGGERED TEST BASIS Frequency for Function 2.e to be determined based on 8 channels rather than the 4 actual 2-Out-Of-4 Voter channels.

The redundant outputs from the 2-Out-Of-4 Voter channel (2 for APRM tripsand 2 for OPRM trips) are considered part of the same channel, but the OPRM and APRM outputs are considered to be separate channels for application of SR 3.3.1.1.17, so n = 8.

The note further requires that testing of OPRM and APRM outputs be alternated.

The testing sequence shown in the table below is one sequence that satisfies these requirements.

Function 2.e Testing Sequence for SR 3.3.1.1.17 24-Voter Channel Month Cycle Al A2 BI B2 OPRM APRM OPRM APRM OPRM APRM OPRM APRM ist X

2nd X

3 rd x

4 th x

5th x

6 th X

7 th x

8 th H _L I

_J x

Each test of an OPRM or APRM output tests each of the redundant outputs from the 2-Out-Of-4 Voter channel for that Function, and each of the corresponding relays in the RPS.

Consequently, each of the RPS relays is tested every fourth cycle.

This testing frequency is twice the frequency justified by References 15 and 16.

(continued)

Revision No.

21 1 Brunswick Unit I B 3.3-39

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.17 (continued)

REQUIREMENTS The 24 month Frequency is consistent with the BNP refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

SR 3.3.1.1.18 The APRM Simulated Thermal Power-High Function (Function 2.b) uses drive flow to vary the trip setpoint.

The OPRM Upscale Function (Function 2.f) uses drive flow to automatically enable or bypass the OPRM Upscale trip output to RPS.

Both of these Functions use drive flow as a representation of reactor core flow.

SR 3.3.1.1.13 assures that the drive flow transmitters and processing electronics are calibrated.

This SR adjusts the recirculation drive flow scaling factors in each APRM channel to provide the appropriate drive flow/core flow alignment.

The Frequency of once within 7 days after reaching equilibrium conditions following a refueling outage is based on the expectation that any change in the core flow to drive flow functional relationship during power operation would be gradual and the maintenance on the Recirculation System and core components which may impact the relationship is expected to be performed during refueling outages.

The 7 day time period after reaching equilibrium conditions is based on plant conditions required to perform the test, engineering judgment of the time required to collect and analyze the necessary flow data, and engineering judgment of the time required to enter and check the applicable scaling factors in each of the APRM channels.

The 7-day time period after reaching equilibrium conditions is acceptable based on the relatively small alignment errors expected, and the margins already included in the APRM Simulated Thermal Power-High and OPRM Upscale Function trip-enable setpoints.

SR 3.3.1.1.19 This surveillance involves confirming the OPRM Upscale trip auto-enable setpoints.

The auto-enable setpoint values are considered to be nominal values as discussed in Reference 21.

This surveillance ensures that the OPRM (continued)

Revision No.

21 I Brunswick Unit I B 3.3-40

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.19 (continued)

REQUIREMENTS Upscale trip is enabled (not bypassed) for the correct values of APRM Simulated Thermal Power and recirculation drive flow.

Other surveillances ensure that the APRM Simulated Thermal Power and recirculation drive flow properly correlate with THERMAL POWER (SR 3.3.1.1.3) and core flow (SR 3.3.1.1.18), respectively.

In any auto-enable setpoint is nonconservative (i.e, the OPRM Upscale trip is bypassed when APRM Simulated Thermal Power Ž 25% and recirculation drive flow 5 60%),

then the affected channel is considered inoperable for the OPRM Upscale Function.

Alternatively, the OPRM Upscale trip auto-enable setpoint(s) may be adjusted to place the channel in a conservative condition (not bypassed).

If the OPRM Upscale trip is placed in the not-bypassed condition, this SR is met and the channel is considered OPERABLE.

The Frequency of 24 months is based on engineering judgment and reliability of the components.

REFERENCES

1.

UFSAR, Section 7.2.

2.

UFSAR, Chapter 15.0.

3.

UFSAR, Section 7.2.2.

4.

NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units I and 2, September 1995..

5.

10 CFR 50.36(c)(2)(ii).

6.

NEDO-23842, Continuous Control Rod Withdrawal in the Startup Range, April 18, 1978.

7.

UFSAR, Section 5.2.2.

8.

UFSAR, Appendix 5.2A.

9.

UFSAR, Section 6.3.1.

(continued)

Brunswick Unit I B 3.3-41 Revision No.

21I

RPS Instrumentation B 3.3.1.1 BASES REFERENCES

10.

P. Check (NRC) letter to G. Lainas (NRC),

BWR Scram (continued)

Discharge System Safety Evaluation, December 1, 1980.

11.

NEDC-30851-P-A, Technical Specification Improvement Analyses for BWR Reactor Protection System, March 1988.

12.

MDE-81-0485, Technical Specification Improvement Analysis for the Reactor Protection System for Brunswick Steam Electric Plant, Units I and 2, April 1985.

13.

UFSAR, Table 7.2.1-3.

14.

NEDO-32291-A, System Analyses for the Elimination of Selected Response Time Testing Requirements, October 1995.

15.

NEDC-3241OP-A, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM)

Retrofit Plus Option III Stability Trip Function, October 1995.

16.

NEDC-3241OP-A, Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option III Stability Trip Function, November 1997.

17.

NEDO-31960-A, BWR Owners' Group Long-Term Stability Solutions Licensing Methodology, November 1995.

18.

NEDO-31960-A, Supplement 1, BWR Owners' Group Long-Term Stability Solutions Licensing Methodology, November 1995.

19.

NEDO-32465-A, BWR Owners' Group Long-Term Stability Detect and Suppress Solutions Licensing Basis Methodology and Reload Applications, August 1996.

20.

Letter, L. A. England (BWROG) to M. J. Virgilio, BWR Owners' Group Guidelines for Stability Interim Corrective Action, June 6, 1994.

21.

BWROG Letter 96113, K. P. Donovan (BWROG) to L. E.

Phillips (NRC),

Guidelines for Stability Option III "Enable Region" (TAC M92882),

September 17, 1996.

(continued)

Revision No.

21 I Brunswick Unit I B 3.3-42

RPS Instrumentation B 3.3.1.1 BASES REFERENCES

22.

General Electric Nuclear Energy Letter NSA 01-212, (continued)

DRF C51-00251-00, A. Chung (GE) to S. Chakraborty (GE),

"Minimum Number of Operable OPRM Cells for Option III Stability at Brunswick 1 and 2,"

June 8, 2001.

23.

NEDE-24011-P-A, General Electric Standard Application for Reload Fuel, (latest approved version).

Revision No. 21 I Brunswick Unit I B 3.3-43

SRM Instrumentation B 3.3.1.2 B 3.3 INSTRUMENTATION B 3.3.1.2 Source Range Monitor (SRM)

Instrumentation BASES BACKGROUND The SRMs provide the operator with information relative to the neutron flux level at very low flux levels in the core.

As such, the SRM indication is used by the operator to monitor the approach to criticality and determine when criticality is achieved.

The SRMs are maintained fully inserted until the count rate is greater than a minimum allowed count rate (a control rod block is set at this condition).

After SRM to intermediate range monitor (IRM) overlap is demonstrated (as required by SR 3.3.1.1.6) and the IRMs are on Range 3, the SRMs are normally fully withdrawn from the core.

The SRM subsystem of the Neutron Monitoring System (NMS) consists of four channels.

Each of the SRM channels can be bypassed, but only one at any given time, by the operation of a bypass switch.

Each channel includes one detector that can be physically positioned in the core.

Each detector assembly consists of a miniature fission chamber with associated cabling, signal conditioning equipment, and electronics associated with the various SRM functions.

The signal conditioning equipment converts the current pulses from the fission chamber to analog DC currents that correspond to the count rate.

Each channel also includes indication, alarm, and control rod blocks.

However, this LCO specifies OPERABILITY requirements only for the monitoring and indication functions of the SRMs.

During refueling, shutdown, and low power operations, the primary indication of neutron flux levels is provided by the SRMs or special movable detectors connected to the normal SRM circuits.

The SRMs provide monitoring of reactivity changes during fuel or control rod movement and give the control room operator early indication of unexpected subcritical multiplication that could be indicative of an approach to criticality.

(continued)

Revision No. 21 I Brunswick Unit I B 3.3-44

SRM Instrumentation B 3.3.1.2 BASES (continued)

APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling and low power operation is provided by LCO 3.9.1, "Refueling Equipment Interlocks"; LCO 3.1.1, "SHUTDOWN MARGIN (SDM)";

LCO 3.31.1, "Reactor Protection System (RPS)

Instrumentation"; IRM Neutron Flux-High and Average Power Range Monitor (APRM)

Neutron Flux-High (Setdown) Functions; and LCO 3.3.2.1, "Control Rod Block Instrumentation."

The SRMs have no safety function and are not assumed to function during any UFSAR design basis accident or transient analysis.

However, the SRMs provide the only on scale monitoring of neutron flux levels during startup and refueling.

Therefore, they are being retained in Technical Specifications.

LCO During startup in MODE 2, three of the four SRM channels are required to be OPERABLE to monitor the reactor flux level prior to and during control rod withdrawal, subcritical multiplication and reactor criticality, and neutron flux level and reactor period until the flux level is sufficient to maintain the IRM on Range 3 or above.

All but one of the channels are required in order to provide a representation of the overall core response during those periods when reactivity changes are occurring throughout the core.

In MODES 3 and 4, with the reactor shut down, two SRM channels provide redundant monitoring of flux levels in the core.

In MODE 5, two SRMs are required to be OPERABLE to provide redundant monitoring of reactivity changes occurring in the reactor core.

Because of the local nature of reactivity changes during refueling, adequate coverage is provided by requiring one:SRM to be OPERABLE in the quadrant of the reactor core where CORE ALTERATIONS are being performed, and the other SRM to be OPERABLE in an adjacent quadrant containing fuel.

These requirements ensure that the reactivity of the core will be continuously monitored during CORE ALTERATIONS.

Special movable detectors, according to footnote (b) of Table 3.3.1.2-1, may be used in MODE 5 in place of the normal SRM nuclear detectors.

These special detectors must be connected to the normal SRM circuits in the NMS, such (continued)

Revision No. 21 1 Brunswick Unit I B 3.3-45

SRM Instrumentation B 3.3.1.2 BASES LCO that the applicable neutron flux indication can be (continued) generated.

These special detectors provide more flexibility in monitoring reactivity changes during fuel loading, since they can be positioned anywhere within the core during refueling.

They must still meet the location requirements of SR 3.3.1:.2.2 and all other required SRs for SRMs.

For an SRM channel to be considered OPERABLE, it must be providing continuous neutron flux monitoring indication in the control room.

APPLICABILITY The SRMs are required to be OPERABLE in MODE 2 prior to the IRMs being on scale on Range 3, and MODES 3, 4, and 5 to provide for neutron monitoring.

In MODE 1, the APRMs provide adequate monitoring of reactivity changes in the core; therefore, the SRMs are not required.

In MODE 2, with IRMs on Range 3 or above, the IRMs provide adequate monitoring and the SRMs are not required.

ACTIONS A.1 and B.1 In MODE 2, with the IRMs on Range 2 or below, SRMs provide the means of monitoring core reactivity and criticality.

With any number of the required SRMs inoperable, the ability to monitor neutron flux is degraded.

Therefore, a limited time is allowed to restore the inoperable channels to OPERABLE status.

Provided at least one SRM remains OPERABLE, Required Action A.1 allows 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to restore the required SRMs to OPERABLE status.

This time is reasonable because there is adequate capability remaining to monitor the core, there is limited risk of an event during this time, and there is sufficient time to take corrective actions to restore the required SRMs to OPERABLE status or to establish alternate IRM monitoring capability.

During this time, control rod withdrawal and power increase is not precluded by this Required Action.

Having the ability to monitor the core with at least one SRM, proceeding to IRM Range 3 or:greater (with overlap required by SR 3.3.1.1.6), and thereby exiting the Applicability of this LCO, is acceptable for ensuring adequate core monitoring and allowing continued operation.

(continued)

Revision No.

21 1 Brunswick Unit I B 3.3-46

SRM Instrumentation B 3.3.1.2 BASES ACTIONS A.1 and B.1 (continued)

With three required SRMs inoperable, Required Action B.1 allows no positive changes in reactivity (control rod withdrawal must be immediately suspended) due to inability to monitor the changes.

Required Action A.1 still applies and allows 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to restore monitoring capability prior to requiring control rod insertion.

This allowance is based on the limited risk of an event during this time, provided that no control rod withdrawals are allowed, and the desire to concentrate efforts on repair, rather than to immediately shut down, with no SRMs OPERABLE.

C.'

In MODE 2, if the required number of SRMs is not restored to OPERABLE status within the allowed Completion Time, the reactor shall be placed in MODE 3.

With all control rods fully inserted, the core is in its least reactive state with the most margin to criticality.

The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

D.1 and D.2 With one or more required SRMs inoperable in MODE 3 or 4, the neutron flux monitoring capability is degraded or nonexistent.

The requirement to fully insert all insertable control rods ensures that the reactor will be at its minimum reactivity level while no neutron monitoring capability is available.

Placing the reactor mode switch in the shutdown position prevents subsequent control rod withdrawal by maintaining a control rod block.

The allowed Completion Time of I hour is sufficient to accomplish the Required Action, and takes into account the low probability of an event requiring the SRM occurring during this interval.

E.1 and E.2 With one or more required SRMs inoperable in MODE 5, the ability to detect local reactivity changes in the core (continued)

Revision No. 21 I Brunswick Unit I B 3.3-47

SRM Instrumentation B 3.3.1.2 BASES ACTIONS E.1 and E.2 (continued) during refueling is degraded.

CORE ALTERATIONS must be immediately suspended and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies.

Suspending CORE ALTERATIONS prevents the two most probable causes of reactivity changes, fuel loading and control rod withdrawal, from occurring.

Inserting all insertable control rods ensures that the reactor will be at its minimum reactivity given that fuel is present in the core.

Suspension of CORE ALTERATIONS shall not preclude completion of the movement of a component to a safe, conservative position.

Action (once required to be initiated) to insert control rods must continue until all insertable rods in core cells containing one or more fuel assembljes are inserted.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each SRM REQUIREMENTS Applicable MODE or other specified condition are found in the SRs column of Table 3.3.1.2-1.

SR 3.3.1.2.1 and SR 3.3.1.2.3 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on another channel.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

(continued)

Revision No.

21 I Brunswick Unit I B 3.3-48

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.1 and SR 3.3.1.2.3 (continued)

REQUIREMENTS The Frequency of once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for SR 3.3.1.2.1 is based on operating experience that demonstrates channel failure is rare.

While in MODES 3 and 4, reactivity changes are not expected; therefore, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is relaxed to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for SR 3.3.1.2.3.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.1.2.2 To provide adequate coverage of potential reactivity changes in the core, one SRM is required to be OPERABLE in the quadrant where CORE ALTERATIONS are being performed, and the other OPERABLE SRM must be in an adjacent quadrant containing fuel.

Note I states that the SR is required to be met only during CORE ALTERATIONS.

It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring.

This Surveillance consists of a review of plant logs to ensure that SRMs required to be OPERABLE for given CORE ALTERATIONS are, in fact, OPERABLE.

Note 2 clarifies that more than one of the three requirements can be met by the same OPERABLE SRM.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is based upon operating experience and supplements operational controls over refueling activities that include steps to ensure that the SRMs required by the LCO are in the proper quadrant.

SR 3.3.1.2.4 This Surveillance consists of a verification of the SRM instrument readout to ensure that the SRM reading is greater than a specified minimum count rate with the detector inserted to the normal operating level, which ensures that the detectors are indicating count rates indicative of neutron flux levels within the core.

With few fuel assemblies loaded, the SRMs will not have a high enough count rate to satisfy the SR.

Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the minimum count rate.

(continued)

Brunswick Unit 1 Revision No.

21 1 8 3.3-49

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.4 (continued)

REQUIREMENTS To accomplish this, the SR is modified by Note I that states that the count rate is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel assemblies are in the associated core quadrant.

With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated core quadrant, even with a control rod withdrawn, the configuration will not be critical.

In addition, Note 2 states that this requirement does not have to be met during a core spiral offload.

A core spiral offload encompasses offloading a cell on the edge of a continuous fueled region (the core cell can be offloaded in any sequence).

If the core is being unloaded in this manner, the various core configurations encountered will not be critical.

The Frequency is based upon channel redundancy and other information available in the control room, and ensures that the required channels are frequently monitored while core reactivity changes are occurring.

When no reactivity changes are in progress, the Frequency is relaxed from 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

SR 3.3.1.2.5 and SR 3.3.1.2.6 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly.

SR 3.3.1.2.5 is required in MODE 5, and the 7 day Frequency ensures that the channels are OPERABLE while core reactivity changes could be in progress.

This Frequency is reasonable, based on operating experience and on other Surveillances (such as a CHANNEL CHECK),

that ensure proper functioning between CHANNEL FUNCTIONAL TESTS.

SR 3.3.1.2.6 is required to be met in MODE 2 with IRMs on Range 2 or below, and in MODES 3 and 4.

Since core reactivity changes do not normally take place in MODES 3 and 4 and core reactivity changes are due only to control rod movement in MODE 2, the Frequency is extended from 7 days to 31 days.

The 31 day Frequency is based on operating experience and on other Surveillances (such as CHANNEL CHECK) that ensure proper functioning between CHANNEL FUNCTIONAL TESTS.

(continued)

Revision No. 21 1 Brunswick Unit I B 3.3-50

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.5 and SR 3.3.1.2.6 (continued)

REQU IREMENTS The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability (THERMAL POWER decreased to IRM Range 2 or below).

The SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after IRMs are on Range 2 or below.

The allowance to enter the Applicability with the 31 day Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels.

Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level.

In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.

SR 3.3.1.2.7 Performance of a CHANNEL CALIBRATION at a Frequency of 24 months verifies the performance of the SRM detectors and associated circuitry.

The Frequency considers the plant conditions required to perform the test, the ease of performing the test, and the likelihood of a change in the system or component status.

The neutron detectors are excluded from the CHANNEL CALIBRATION (Note 1) because they cannot readily be adjusted.

The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range and with an accuracy specified for a fixed useful life.

Note 2 to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability.

The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below.

The allowance to enter the Applicability with the 24 month Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels.

Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level.

In this event, (continued)

Revision No. 21 I Brunswick Unit I B 3.3-51

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.7 (continued)

REQUIREMENTS the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.

REFERENCES None.

Revision No.

21 I Brunswick Unit I B 3.3-52

Control Rod Block Instrumentation B 3.3.2.1 B 3.3 INSTRUMENTATION B 3.3.2.1 Control Rod Block Instrumentation BASES BACKGROUND Control rods provide the primary means for control of reactivity changes.

Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to ensure that specified fuel design limits are not exceeded for postulated transients and accidents.

During high power operation, the rod block monitor (RBM) provides protection for control rod withdrawal error events.

During low power operations, control rod blocks from the rod worth minimizer (RWM) enforce specific control rod sequences designed to mitigate the consequences of the control rod drop accident (CRDA).

During shutdown conditions, control rod blocks from the Reactor Mode Switch-Shutdown Position Function ensure that all control rods remain inserted to prevent inadvertent criticalities.

The purpose of the RBM is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during control rod manipulations.

It is assumed to function to block further control rod withdrawal to preclude a MCPR Safety Limit (SL) violation.

The RBM supplies a trip signal to the Reactor Manual Control System (RMCS) to appropriately inhibit control rod withdrawal during power operation above the low power range setpoint specified in the COLR.

The RBM has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint.

One RBM channel inputs into one RMCS rod block circuit and the other RBM channel inputs into the second RMCS rod block circuit.

The RBM channel signal is generated by averaging a set of local power range monitor (LPRM) signals at various core heights surrounding the control rod being withdrawn.

A simulated thermal power signal from one of the four redundant average power range monitor (APRM) channels supplies a reference signal for one of the RBM channels and a simulated thermal power signal from another of the APRM channels supplies the reference signal to the second RBM channel.

This reference signal is used to determine which RBM range setpoint (low, intermediate, or high) is enabled.

If the APRM Simulated Thermal Power is indicating less than the low power range setpoint, the RBM is automatically bypassed.

The RBM is also automatically bypassed if a (conti nuedl Brunswick Unit 1 Revision No. 21 1 I

B 3.3-53

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND peripheral control rod is selected (Ref.

1).

A rod block (continued) signal is also generated if an RBM inoperable trip occurs, since this could indicate a problem with the RBM channel.

The inoperable trip will occur if, during the nulling (normalization) sequence, the RBM channel fails to null or too few LPRM inputs are available, if a critical self-test fault has been detected, or the RBM instrument mode switch is moved to any position other than "Operate."

The purpose of the RWM is to control rod patterns during startup and shutdown, such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 10% RTP.

The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA.

Prescribed control rod sequences are stored in the RWM, which will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the stored

sequence, The RWM determines the actual sequence based position indication for each control rod.

The RWM also uses steam flow signals to determine when the reactor power is above the preset power level at which the RWM is automatically bypassed.

The RWM is a single channel system that provides input into the RMCS rod withdraw permissive circuit.

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained.

This Function prevents inadvertent criticality as the result of a control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position.

The reactor mode switch has two channels, each inputting into a separate RMCS rod block circuit.

A rod block in either RMCS circuit will provide a control rod block to all control rods.

APPLICABLE

1.

Rod Block Monitor SAFETY ANALYSES,

LCO, and The RBM is designed to prevent violation of the MCPR APPLICABILITY SL and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event.

The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 2.

A statistical analysis of RWE events was performed to (continued)

Revision No.

21 1 Brunswick Unit 1 B 3.3-54

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE

1. Rod Block Monitor (continued)

SAFETY ANALYSES,

LCO, and determine the RBM respokse for both channels for each event.

APPLICABILITY From these responses, the fuel thermal performance as a function of RBM Allowable Value was determined.

The Allowable Values are chosen as a function of power level.

Based on the specified Allowable Values, operating limits are established.

The RBM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3).

Two channels of the RBM are required to be OPERABLE, with their setpoints within the appropriate Allowable Value for the associated power range, to ensure that no single instrument failure can preclude a rod block from this Function.

The actual setpoints are calibrated consistent with applicable setpoint methodology.

Trip setpoints are specified in the setpoint calculations.

The setpoints are selected to ensure that the trip settings do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS.

Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip setting is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place.

The setpoints are compared to the actual process parameter, the calculated RBM flux (RBM channel signal).

When the RBM flux value exceeds the applicable setpoint, the RBM provides a trip output.

The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis.

The trip setpoints are determined from the analytic limits corrected for defined process, calibration, and instrument errors.

The Allowable Values are then determined, based on the trip setpoint value, by accounting for calibration based errors.

These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of LPRM input processing in the average power range monitor (APRM) equipment.

The RBM performs only digital calculations on digitized LPRM signals received from the APRM equipment.

The trip setpoints and Allowable Values determined in this manner provide adequate protection (continued)

Revision No.

21 1 Brunswick Unit I B 3.3-55

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE

1.

Rod Block Monitor (continued)

SAFETY ANALYSES, LCO, and because instrumentation uncertainties, process effects, APPLICABILITY calibration tolerances, instrument drift, and environment errors are accounted for and appropriately applied for the instrumentation.

The RBM is assumed to mitigate the consequences of an RWE event when operating

29% RTP.

Below this power level, the consequences of an RWE event will not exceed the MCPR SL and, therefore, the RBM is not required to be OPERABLE (Ref.

2).

When operating < 90% RTP, analyses (Ref. 2) have shown that with an initial MCPR : 1.70, no RWE event will result in exceeding the MCPR SL.

Also, the analyses demonstrate that when operating at > 90% RTP with MCPR

1.40, no RWE event will result in exceeding the MCPR SL (Ref.

2). Therefore, under these conditions, the RBM is also not required to be OPERABLE.

The RBM selects one of three different RBM flux trip setpoints to be applied based on the current value of THERMAL POWER.

THERMAL POWER is indicated to each RBM channel by a simulated thermal power (STP) reference signal input from an associated reference APRM channel.

The.

OPERABLE range is divided into three "power ranges," a "low power range," an "intermediate power range," and a "high power range."

The RBM flux trip setpoint applied within each of these three power ranges is, respectively, the "low trip setpoint," the "intermediate trip setpoint," and the "high trip setpoint" (Allowable Values for which are defined in the COLR).

To determine the current power range, each RBM channel compares its current STP input value to three power setpoints, the "low power setpoint" (29%),

the "intermediate power setpoint" (current value defined in the COLR),

and the "high power setpoint" (current value defined in the COLR), which define, respectively, the lower limit of the low power range, the lower limit of the intermediate power range, and the lower limit of the high power range.

The trip setpoint applicable for each power range is more restrictive than the corresponding setpoint for the lower power range(s).

When STP is below the low power setpoint, the RBM flux trip outputs are automatically bypassed but the low trip setpoint continues to be applied to indicate the RBM flux setpoint on the NUMAC RBM displays.

(continued)

Revision No. 21 I Brunswick Unit I B 3.3-56

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY

1. Rod Block Monitor (continued)

The calculated (required) setpoints and applicable power ranges are bounding values.

In the equipment implementation, it is necessary to apply a "deadband" to each setpoint.

The deadband is applied to the RBM trip setpoint selection logic and the RBM trip automatic bypass logic such that the setpoint being applied is always equal to or more conservative than the required setpoint.

Since the RBM flux trip setpoint applicable to the higher power ranges are more conservative than the corresponding trip setpoints for lower power ranges, the trip setpoint applicable to the higher power range (high power range or intermediate power range) continues to be applied when STP decreases below the lower limit of that range until STP is below the power range setpoint by a value exceeding the deadband.

Similarly, when STP decreases below the low power setpoint, the automatic bypass of RBM flux trip outputs will not be applied until STP decreases below the trip setpoint by a value exceeding the deadband.

The RBM channel uses THERMAL POWER, as represented by the STP input value from its reference APRM channel, to automatically enable RBM flux trip outputs (remove the automatic bypass) and to select the RBM flux trip setpoint to be applied.

However, the RBM Upscale function is only required to be OPERABLE when the MCPR values are less than either 1.40 or 1.70, depending on the THERMAL POWER level.

Therefore, even though the RBM Upscale Function is implemented in each RBM channel as a single trip function with a selected trip setpoint, it is characterized in Table 3.3.2.1-1 as three Functions, the Low Power Range-Upscale Function, the Intermediate Power Range-Upscale Function, and the High Power Range-UJpscale Function, to facilitate correct definition of the OPERABILITY requirements for the functions.

Each Function corresponds to one of the RBM power ranges.

Due to the deadband effects on the determination of the current power range, the transition between these three Functions will occur at slightly different THERMAL POWER levels for increasing power versus decreasing power.

Since the RBM flux trip setpoints applied for the higher power ranges are more conservative, the OPERABILITY requirement for the Low Power Range-Upscale Function is satisfied if the Intermediate Power Range-Upscale Function or the High (continued)

Revision No.

21 I Brunswick Unit I B 3.3-57

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE

1. Rod Block Monitor (continued)

SAFETY ANALYSES,

LCO, and Power Range-Upscale Function is OPERABLE.

Similarly, the APPLICABILITY OPERABILITY requirement for the Intermediate Power Range-Upscale Function is satisfied if the High Power Range-Upscale Function is OPERABLE.

2.

Rod Worth Minimizer The RWM enforces the banked position withdrawal sequence (BPWS) to ensure that the initial conditions of the CRDA analysis are not violated.

The analytical methods and assumptions used in evaluating the CRDA are summarized in References 4, 5, and 6.

The BPWS requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions.

Requirements that the control rod sequence is in compliance with the BPWS are specified in LCO 3.1.6, "Rod Pattern Control."'

The RWM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3).

The RWM is a microprocessor-based system with the principle task to reinforce procedural control to limit the reactivity worth of control rods under lower power conditions.

Only one channel of the RWM is available and required to be OPERABLE.

Special circumstances provided for in the Required Action of LCO 3.1.3, "Control Rod OPERABILITY,"

and LCO 3.1.6 may necessitate bypassing the RWM to allow continued operation with inoperable control rods, or to allow correction of a control rod pattern not in compliance with the BPWS.

As required by these conditions, one or more control rods may be bypassed in the RWM or the RWM may be bypassed.

However, the RWM must be considered inoperable and the Required Actions of this LCO followed since the RWM can no longer enforce compliance with the BPWS.

Compliance with the BPWS, and therefore OPERABILITY of the

RWM, is required in MODES 1 and 2 when THERMAL POWER is

10%/ RTP.

When THERMAL POWER is > 10% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Refs.

5 and 6).

In MODES 3 and 4, all (continued)

Revision No.

21 I B 3.3-58 Brunswick Unit I

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE

2.

Rod Worth Minimizer (continued)

SAFETY ANALYSES,

LCO, and control rods are required to be inserted into the core; APPLICABILITY therefore, a CRDA cannot occur.

In MODE 5, since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.

3.

Reactor Mode Switch-Shutdown Position During MODES 3 and 4, and during MODE 5 when the reactor mode switch is required to be in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed.

The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode Switch-Shutdown Position Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 3).

Two channels are required to be OPERABLE to ensure that no single channel failure will preclude a rod block when required.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.

During shutdown conditions (MODE 3, 4, or 5), no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality.

Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be OPERABLE.

During MODE 5 with the reactor mode switch in the refueling position, the refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") provides the required control rod withdrawal blocks.

(continued)

Revision No.

21 I Brunswick Unit I B 3.3-59

Control Rod Block Instrumentation B 3.3.2.1 BASES ACTIONS E.1 and E.2 (continued) consistent with the normal action of an Mode Switch-Shutdown Position Function all control rods inserted), there is no having one or two channels inoperable.

OPERABLE Reactor (i.e., maintaining distinction between In both cases (one or both channels inoperable), suspending all control rod withdrawal and initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcritical with adequate SDM ensured by LCO 3.1.1.

Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted.

Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

SURVEILLANCE REQUIREMENTS As noted at the beginning of the SRs, the SRs for each Control Rod Block instrumentation Function are found in the SRs column of Table 3.3.2.1-1.

The Surveillances are modified by a Note to indicate that when an RBM channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated' Function maintains control rod block capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Refs. 7, 9, and 10) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that a control rod block will be initiated when necessary.

SR 3.3.2.1.1 A CHANNEL to ensure function.

FUNCTIONAL TEST is performed for each RBM channel that the channel will perform the intended It includes the Reactor Manual Control System (continued)

Revision No. 21 I

I Brunswick Unit I B 3.3-62

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.1 (continued)

REQUIREMENTS input.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 184 days is based on reliability analyses (Refs. 8; 9, and 10).

SR 3.3.2.1.2 and SR 3.3.2.1.3 A CHANNEL FUNCTIONAL TEST is performed for the RWM to ensure that the system Will perform the intended function.

The CHANNEL FUNCTIONAL TEST for the RWM is performed by selecting a control rod not in compliance with the prescribed sequence and verifying proper annunciation of the selection error, and by attempting to withdraw a control rod not in compliance with the prescribed sequence and verifying a control rod block occurs.

As noted in the SRs, SR 3.3.2.1.2 is not required to be performed until I hour after any control rod is withdrawn in MODE 2.

As noted, SR 3.3.2.1.3 is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after THERMAL POWER is : 10% RTP in MODE 1. This allows entry into MODE 2 for SR 3.3.2.1.2, and entry into MODE 1 when THERMAL POWER is 5 10% RTP for SR 3.3.2.1.3, to perform the required Surveillance if the 92 day Frequency is not met per SR 3.0.2.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs.

Operating experience has demonstrated these components will usually pass the Surveillances when performed at the 92 day Frequency.

Therefore, the Frequency is acceptable from a reliability standpoint.

SR 3.3.2.1.4 The RBM setpoints are automatically varied as a function of power.

Three Allowable Values are specified in Table 3.3.2.1-1, one corresponding to each specific power range.

The purpose of this SR is to assure that for each RBM power range, the RBM flux trip rod block outputs are enabled (not bypassed) and that the RBM flux trip setpoint being applied is equal to or more conservative than the (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-63

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.4 (continued)

REQUIREMENTS specified Allowable Values in the COLR.

If any power range setpoint is non-conservative, then the affected RBM channel is considered inoperable.

The Low Power Range-Upscale Function is enabled when the RBM flux trip setpoint being applied is equal to or less than the Allowable Value for low trip setpoint defined in the COLR, and the RBM flux trip rod block outputs are enabled (not bypassed).

The Intermediate Power Range-Upscale Function is enabled when the RBM flux trip setpoint being applied is equal to or less than the Allowable Value for intermediate trip setpoint defined in the COLR, and the RBM flux trip rod block outputs are enabled (not bypassed).

The High Power Range-Upscale Function is enabled when the RBM flux trip setpoint being applied is equal to or less than the Allowable Value for high trip setpoint defined in the COLR, and the RBM flux trip rod block outputs are enabled (not bypassed).

The SR is performed by varying the APRM Simulated Thermal Power input in the RBM, and confirming that the criteria in the SR is met for both increasing and decreasing values of Simulated Thermal Power.

SR 3.3.2.1.4.a is satisfied if, for an APRM Simulated Thermal Power level, 29%, the RBM flux trip rod block outputs are not bypassed and the RBM flux trip setpoint being applied is less than or equal to the low trip setpoint Allowable Value defined in the COLR.

(Note that the intermediate trip setpoint and the high trip setpoint Allowable Values are less than the low trip setpoint Allowable Value.)

SR 3.3.2.1.4.b is satisfied if, for an APRM Simulated Thermal Power level Ž the intermediate power level setpoint Allowable Value defined in the COLR, the RBM flux trip rod block outputs are not bypassed and the RBM flux trip setpoint being applied is less than or equal to the intermediate trip setpoint Allowable Value defined in the COLR.

(Note that the high trip setpoint Allowable Value is less than the intermediate trip setpoint Allowable Value.)

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-64

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.4 (continued)

REQUIREMENTS SR 3.3.2.1.4.c is satisfied if, for an APRM Simulated Thermal Power level = the high power level setpoint Allowable Value defined in the COLR, the RBM flux trip rod block outputs are not bypassed and the RBM flux trip setpoint being applied is less than or equal to the high trip setpoint Allowable Value defined in the COLR.

SR 3.3.2.1.5 The RWM is automatically bypassed when power is above a specified value.

The power level is determined from steam flow signals.

The automatic bypass setpoint must be verified periodically to be > 10% RTP.

If the RWM low power setpoint is nonconservative, then the RWM is considered inoperable.

Alternately, the low power setpoint channel can be placed in the conservative condition (nonbypass).

If placed in the nonbypassed condition, the SR is met and the RWM is not considered inoperable.

The Frequency is based on the trip setpoint methodology utilized for the low power setpoint channel.

I SR 3.3.2.1.6 A CHANNEL FUNCTIONAL TEST is performed for the Reactor Mode Switch-Shutdown Position Function to ensure that the channel will perform the intended function.

The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch-Shutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs.

As noted in the SR, the Surveillance is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable links.

This allows entry into MODES 3 and 4 if the 24 month Frequency is not met per SR 3.0.2.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-65

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.6 (continued)

REQUIREMENTS The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

SR 3.3.2.1.7 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The CHANNEL CALIBRATION may be performed electronically.

As noted, neutron detectors are excluded from the CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal.

Neutron detectors are adequately tested in SR 3.3.1.1.3 and SR 3.3.1.1.8.

The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.2.1.8 The RWM will only enforce the proper control rod sequence if the rod sequence.is properly input into the RWM computer.

This SR ensures that the proper sequence is loaded into the RWM so that it can perform its intended function.

The Surveillance is performed once prior to declaring RWM OPERABLE following loading of sequence into RWM, since this is when rod sequence input errors are possible.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-66

Control Rod Block Instrumentation B 3.3.2.1 BASES (continued)

REFERENCES

1. UFSAR, Section 7.6.1.1.5.

2.

NEDC-31654P, Maximum Extended Operating Domain Analysis-For Brunswick Steam Electric Plant, February 1989.

3.

10 CFR 50.36(c)(2)(ii).

4.

NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Unit 1 and 2, September 1995.

5.

UFSAR Section 15.4.

6.

NRC SER, Acceptance for Referencing of Licensing Topical Report NEDE-24011-P-A; General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17, December 27, 1987.

7.

GENE-770-06-1-A, Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

8.

NEDC-30851P-A, Supplement 1, Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation, October 1988.

9. NEDC-32410P-A, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM)

Retrofit Plus Option III Stability Trip Function, October 1995.

10. NEDC-3241OP-A Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option III Stability Trip Function, November 1997.

Revision No.

21 I

Brunswick Unit I B 3.3-67

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 B 3.3 INSTRUMENTATION B 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation BASES BACKGROUND The feedwater and main turbine high water level trip instrumentation is designed to detect a potential failure of the Feedwater Level Control System that causes excessive feedwater flow.

With excessive feedwater flow, the water level in the reactor vessel rises toward the high water level setting causing the trip of the two feedwater pump turbines and the main turbine.

High water levels signals are provided by three narrow range sensors of the Digital Feedwater Control System.

These three level sensors sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level in the reactor vessel (variable leg).

The three level signals are input into a digital control computer.

The digital control computer provides three output signals to the high water level trip channels.

Each high water level trip channel consists of a relay whose contacts form the trip logic.

The high water level trip logic is arranged as a two-out-of-three logic, that trips the two feedwater pump turbines and the main turbine.

The digital control computer processes the reactor water level input signals and compares them to pre-established setpoints.

When the setpoint is exceeded, the associated channel output relay actuates, which then outputs to the main turbine and feedwater pump trip initiation logic.

A trip of:the feedwater pump turbines limits further increase in reactor vessel water level by limiting further addition of feedwater to the reactor vessel.

A trip of the main turbine and closure of the stop valves protects the turbine from damage due to water entering the turbine.

APPLICABLE The feedwater and main turbine high water level trip SAFETY ANALYSES instrumentation is assumed to be capable of providing a turbine trip in the design basis transient analysis for a feedwater controller failure, maximum demand event (Ref. 1).

(continued)

Revision No. 21 1

B 313-68 Brunswick Unit I

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES APPLICABLE The high water level trip indirectly initiates a reactor SAFETY ANALYSES scram from the main turbine trip (above 30% RTP) and trips (continued) the feedwater pumps, thereby terminating the event.

The reactor scram mitigates the reduction in MCPR.

Feedwater and main turbine high water level trip instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii)

(Ref. 2).

LCO The LCO requires three channels of the reactor vessel high water level instrumentation to be OPERABLE to ensure that the feedwater pump turbines and main turbine trip on a valid high water level signal.

Two of the three channels are needed to provide trip signals in order for the feedwater and main turbine trips to occur.

Each channel must have its setpoint set within the specified Allowable Value of SR 3.3.2.2.2.

The Allowable Value is set to ensure that the thermal limits are not exceeded during the event.

The actual setpoint is calibrated to be consistent with the applicable setpoint methodology assumptions.

Trip setpoints are specified in the setpoint calculations.

The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS.

Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip setting is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place.

The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state.

The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis.

The trip setpoints are determined from the analytic limits corrected for defined process, calibration, and instrument errors.

The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors.

These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components.

The trip setpoints and Allowable Values determined in this manner provide adequate protection (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-69

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES LCO because instrumentation uncertainties, process effects, (continued) calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.

APPLICABILITY The feedwater and main turbine high water level trip instrumentation is required to be OPERABLE at ; 25% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event.

As discussed in the Bases for LCO 3.2.1, "Average Planar Linear Heat Generation Rate (APLHGR),"

and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," sufficient margin to these limits exists below 25% RTP; therefore, these requirements are only necessary when operating at or above this power level.

ACTIONS A Note has been provided to modify the ACTIONS related to feedwater and main turbine high water level trip instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.

Section 1.3 also specifies that-Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable feedwater and main turbine high water level trip instrumentation channels provide appropriate compensatory measures for separate inoperable channels.

As such, a Note has been provided that allows separate Condition entry for each inoperable feedwater and main turbine high water level trip instrumentation channel.

A.1 With one channel inoperable, the remaining two OPERABLE channels can provide the required trip signal.

However, overall instrumentation reliability is reduced because a single failure in one of the remaining channels concurrent (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-70

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS A.1 (continued) with feedwater controller failure, maximum demand event, may result in the instrumentation not being able to perform its intended function.

Therefore, continued operation is only allowed for a limited time with one channel inoperable.

If the inoperable channel cannot be restored to OPERABLE status within the Completion Time, the channel must be placed in the tripped condition per Required Action A.1.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in a feedwater or main turbine trip), Condition C must be entered and its Required Action taken.

The Completion Time of 7 days is based on the low probability of the event occurring coincident with a single failure in a remaining OPERABLE channel.

B.1 With two or more channels inoperable, the feedwater and main turbine high water level trip instrumentation cannot perform its design function (feedwater and main turbine high water level trip capability is not maintained).

Therefore, continued operation is only permitted for a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months period, during which feedwater and main turbine high water level trip capability must be restored.

The trip capability is considered maintained when sufficient channels are OPERABLE or in trip such that the feedwater and main turbine high water level trip logic will generate a trip signal on a valid signal.

This requires two channels to each be OPERABLE or in trip.

If the required channels cannot be restored to OPERABLE status or placed in trip, Condition C must be entered and its Required Action taken.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of feedwater and main turbine high water level trip instrumentation occurring (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-71

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS B.1 (continued) during this period.

It is also consistent with the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provided in LCO 3.2.2 for Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.

C.1 With the required channels not restored to OPERABLE status or placed in trip, THERMAL POWER must be reduced to

< 25% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

As discussed in the Applicability section of the Bases, operation below 25% RTP results in sufficient margin to the required limits, and the feedwater and main turbine high water level trip instrumentation is not required to protect fuel integrity during the feedwater controller failure, maximum demand event.

The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on operating experience to reduce THERMAL POWER to < 25% RTP from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided theassociated Function maintains feedwater and main turbine high water level trip capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Ref. 3) assumption that 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the feedwater pump turbines and main turbine will tripwhen necessary.

SR 3.3.2.2.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures hat a gross failure of instrumentation has not occurred.

A HANNEL CHECK is normally a comparison of the parameter (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-72

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE SR 3.3.2.2.1 (continued)

REQUIREMENTS indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels, or something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limits.

The Frequencyis based on operating experience that demonstrates channel failure is rare.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.2.2.2; CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.2.2.3 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel.

The system functional test of the feedwater and (continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-73

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE REQUIREMENTS SR 3.3.2.2.3 (continued) main turbine valves is included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function.

Therefore, if a valve is incapable of operating, the associated instrumentation would also be inoperable.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

REFERENCES

1.

UFSAR, Section 15.1.2.

2.

10 CFR 50.36(c)(2)(ii).

3.

GENE-770-06-1-A, Bases for Changes to Surveillance Test'Intervals and Allowed Out-Of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

Revision No.

21 I

Brunswick Unit 1 B 3.3-74

PAM Instrumentation B 3.3.3.1 B 3.3 INSTRUMENTATION B 3.3.3.1 Post Accident Monitoring (PAM)

Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display in the control room plant variables that provide information required by the control room operators during accident situations.

This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events.

The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I, in accordance with Regulatory Guide 1.97 (Ref. 1).

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident.

This capability is consistent with the recommendations of Reference 1.

APPLICABLE SAFETY ANALYSES The PAM instrumentation LCO ensures the OPERABILITY of Regulatory Guide 1.97, Type A variables so that the control room operating staff can:

Perform the diagnosis specified in the Emergency Operating Procedures (EOPs).

These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs),

(e.g.,

loss of coolant accident (LOCA)),

and Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.

The PAM instrumentation LCO also ensures OPERABILITY of Category I, non-Type A, variables so that the control room operating staff can:

Determine whether systems performing their intended important to safety are functions; (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-75

PAM Instrumentation B 3.3.3.1 BASES APPLICABLE 0

Determine the potential for causing a gross breach of SAFETY ANALYSES the barriers to radioactivity release; (continued) 0 Determine whether a gross breach of a barrier has occurred; and Initiate action necessary to protect the public and for an estimate of the magnitude of any impending threat.

The plant specific Regulatory Guide 1.97 Analysis (Ref. 2) documents the process that identified Type A and Category I, non-Type A, variables.

Accident monitoring instrumentation that satisfies the definition of Type A in Regulatory Guide 1.97 meets Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref.

3). Category I, non-Type A, instrumentation is retained in Technical Specifications (TS) because they are intended to assist operators in minimizing the consequences of accidents.

Therefore, these Category I variables are important for reducing public risk.

LCO LCO 3.3.3.1 requires two OPERABLE channels for all but one Function to ensure that no single failure prevents the operators from being presented with the information necessary to'determine the status of the plant and to bring the plant to, and maintain it in, a safe condition following that accident.

Furthermore, providing two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.

The exception to the two channel requirement is primary containment isolation valve (PCIV) position.

In this case, the important information is the status of the primary containment penetrations.

The LCO requires one position indicator for each active (e.g., automatic) PCIV.

This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of passive valve or via system boundary status.

If a normally active PCIV is known to be closed and deactivated, position indication is not needed to determine status.

Therefore, the position indication for closed and deactivated valves is not required to be OPERABLE.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-76

PAM Instrumentation B 3.3.3.1 BASES LCO The following list is a discussion of the specified (continued) instrument Functions listed in Table 3.3.3.1-1 in the accompanying LCO.

1.

Reactor Vessel Pressure Reactor vessel pressure is a Type A and Category I variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems (ECCS).

Two independent pressure transmitters with a range of 0 psig to 1500 psig monitor pressure and are indicated in the control room.

Wide range instruments are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

2.a., 2.b., 2.c.

Reactor Vessel Water Level Reactor vessel water level is a Type A and Category I variable provided to support monitoring of core cooling and to verify operation of the ECCS.

Channels from three different ranges of water level provide the PAM Reactor Vessel Water Level Function.

The water level channels measure from -150 inches to +550 inches.

Water level is measured by independent differential pressure transmitters for each required channel.

The output from these channels is recorded on independent recorders or read on indicators, which are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

3.

Suppression Chamber Water Level Suppression chamber water level is a Type A and Category I variable provided to detect a breach in the reactor coolant pressure boundary (RCPB).

This variable is also used to verify and provide long term surveillance of ECCS function.

The wide range suppression pool water level measurement provides the operator with sufficient information to assess the status of both the RCPB and the water supply to the ECCS.

The wide range water level indicators are capable of monitoring the suppression pool water level from the bottom (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-77

PAM Instrumentation B 3.3.3.1 BASES LCO

3.

Suppression Chamber Water Level (continued) of the ECCS suction lines to 5 feet above the normal pool water level., Two wide range suppression pool water level signals are transmitted from separate differential pressure transmitters for each channel.

The output of one of these channels is recorded on a recorder in the control room.

The output of the other channel is read on an indicator in the control room.

These instruments are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

4.

Suppression Chamber Water Temperature Suppression chamber water temperature is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach.

The suppression chamber water temperature instrumentation, which measures from 40°F to 240°F, allows operators to detect trends in suppression pool water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool.

Suppression pool temperature is monitored by 24 (12 per division) temperature sensors spaced around the suppression pool.

A pair of sensors (one per division) is located near each of the quenchers on the discharge lines of the 11 safety/relief valves.

Each pair of sensors is located so as to sense the representative temperature of that sector of the suppression pool even with the associated safety/relief valve open.

The outputs for the sensors are indicated on two microprocessors in the control room.

The signals from the sensors are conditioned by the two microprocessors to provide an average water temperature.

A minimum of 11 out of 12 sensors are required to provide this average per division.

Average water temperature is recorded on two independent recorders in the control room.

These recorders are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-78

PAM Instrumentation B 3.3.3.1 BASES LCO

5.

Suppression Chamber Pressure (continued)

Suppression chamber pressure is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach.

Suppression chamber pressure is indicated in the control room from two separate pressure transmitters.

The range of indication is 0 psig to 75 psig.

These instruments are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

6.

Drywell Pressure Drywell pressure is a Type A and Category I variable provided to detect breach of the RCPB and to verify ECCS functions that operate to maintain RCS integrity.

Two wide range drywell pressure signals are transmitted from separate pressure transmitters for each channel.

The output of one of these channels is recorded on a recorder in a control room.

The output of the other channel is read on an indicator in the control room.

The pressure channels measure from -5 psig to 245 psig.

These instruments are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

7.

Drywell Temperature Drywell temperature is a Type A and Category I variable provided to detect a breach of the RCPB and to verify the effectiveness of ECCS functions that operate to maintain RCS integrity.

Twenty (20) temperature sensors (10 per division) are located in the drywell and suppression pool atmosphere.

In order to provide adequate monitoring of the entire air space, a minimum of 1 sensor per monitoring location, 5 per division are required (Ref.

B 3.6.1.4, SR 3.6.1.4.1 for monitoring locations).

The sensors are divided into two divisions for redundancy.

The signals from these sensors are conditioned by two divisionalized microprocessors.

Drywell temperature is recorded by two pairs of divisionalized recorders in the control room.

The range of the recorders is from 40"F to 440*F.

These (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-79

PAM Instrumentation B 3.3.3.1 BASES LCO

7.

Drywell Temperature (continued) recorders are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

8.

Primary Containment Isolation Valve (PCIV) Position PCIV position, a Category I variable, is provided for verification of containment integrity.

In the case of PCIV position, the important information is the isolation status of the containment penetration.

The LCO requires one channel of valve position indication in the control room to be OPERABLE for each active PCIV in a containment penetration flow path, i.e., two total channels of PCIV position indication for a penetration flow path with two active valves.

For containment penetrations with only one active PCIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE.

This is sufficient to redundantly verify the isolation status of each isolable penetration via indicated status of the active valve, as applicable, and prior knowledge of passive valve or system boundary status.

If a penetration flow path is isolated, position indication for the PCIV(s) in the associated penetration flow path is not needed to determine status.

Therefore, the position indication for valves in an isolated penetration flow path is not required to be OPERABLE.

The PCIV position PAM instrumentation consists of position switches, associated wiring and control room indication for active PCIVs (check valves and manual valves are not required to have position indication).

Therefore, the PAM Specification deals specifically with these instrument channels.

9. Drywell and Suppression Chamber Hydrogen and Oxygen Analyzers Drywell and suppression chamber hydrogen and oxygen analyzers are Type A and Category I instruments provided to detect high hydrogen or oxygen concentration conditions that (continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-80

PAM Instrumentation B 3.3.3.1 BASES LCO

9. Drywell and Suppression Chamber Hydrogen and Oxygen Analyzers (continued) represent a potential for containment breach.

This variable is also important in verifying the adequacy of mitigating actions.

The drywell and suppression chamber hydrogen and oxygen analyzers PAM instrumentation consists of two independent gas analyzer systems.

Each gas analyzer system consists of a hydrogen analyzer and an oxygen analyzer.

The analyzers are capable of determining hydrogen concentration in the range of 0% to 30% and oxygen concentration in the range of 0% to 25%.

Each gas analyzer system must be capable of sampling the drywell and the suppression chamber.

There are two independent recorders in the control room to display the results.

Therefore, the PAM Specification deals specifically with these portions of the analyzer channels.

10.

Drywell Area Radiation Drywell area radiation is a Category I variable provided to monitor the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.

Post accident drywell area radiation levels are monitored by four instruments, each with a range of I R/hr to 107 R/hr.

The outputs of these channels are indicated and recorded in the control room.

Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2.

These variables are related to the diagnosis and preplanned actions required to mitigate DBAs.

The applicable DBAs are assumed to occur in MODES I and 2.

In MODES 3, 4, and 5, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES.

ACTIONS Note I has been added to the ACTIONS to exclude the MODE change restriction of LCO 3.0.4.

This exception allows entry into the applicable MODE while relying on the ACTIONS even though the ACTIONS may eventually require plant (continued)

Revision No. 21 I

B 3.3-81 Brunswick Unit I

PAM Instrumentation B 3.3.3.1 BASES ACTIONS shutdown.

This exception is acceptable due to the passive (continued) function of the instruments, the operator's ability to diagnose an accident using alternative instruments and methods, and the low probability of an event requiring these instruments.

Note 2 has been provided to modify the ACTIONS related to PAM instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable PAM instrumentation channels provide appropriate compensatory measures for separate Functions.

As such, a Note has been provided that allows separate Condition entry for each inoperable PAM Function.

A.1 When one or more Functions have one required channel that is inoperable, the required inoperable channel must be restored to OPERABLE'status within 30 days.

The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

B.1 If a channel has not been restored to OPERABLE status in 30 days, this Required Action specifies initiation of action in accordance with Specification 5.6.6, which requires a written report to be submitted to the NRC.

This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions.

This Required Action is appropriate in lieu of a shutdown requirement, since another OPERABLE channel is monitoring the Function, and given the likelihood of plant conditions that would require information provided by this instrumentation.

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-82

PAM Instrumentation B 3.3.3.1 BASES ACTIONS C.1 (continued)

When one or more Functions have two required channels that are inoperable (i.e., two channels inoperable in the same Function), one channel in the Function should be restored to OPERABLE status within 7 days.

The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.

Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation.

Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

D.1 This Required Action directs entry into the appropriate Condition referenced in Table 3.3.3.1-1.

The applicable Condition referenced in the Table is Function dependent.

Each time an inoperable channel has not met the Required Action of Condition C and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.

E.1 For the majority of Functions in Table 3.3.3.1-1, if any Required Action and associated Completion Time of Condition C is not met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must~be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-83

PAM Instrumentation B 3.3.3.1 BASES ACTIONS F.1 (continued)

Since alternate means of monitoring primary containment area radiation are available, the Required Action is not to shut down the plant, but rather to follow the directions of Specification 5.6.6.

These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time.

The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.

SURVEILLANCE As noted at the beginning of the SRs, the following SRs REQUIREMENTS apply to each PAM instrumentation Function in Table 3.3.3.1-1.

SR 3.3.3.1.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is'normally a comparison of the parameter indicated on one channel against a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation'continues to operate properly between each CHANNEL CALIBRATION.

The high radiation instrumentation should be compared to similar plant instruments located throughout the plant.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-84

PAM Instrumentation B 3.3.3.1 BASES SURVEILLANCE SR 3.3.3.1.1 (continued)

REQUIREMENTS The Frequency of 31 days is based upon plant operating experience, with regard to channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given Function in any 31 day interval is rare.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the channels required by the LCO.

SR 3.3.3.1.2 and SR 3.3.3.1.3 These SRs require a CHANNEL CALIBRATION to be performed.

CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor.

The test verifies the channel responds to measured parameter with the necessary range and accuracy.

For Function 9, the CHANNEL CALIBRATION shall be performed using standard gas samples containing a nominal:

a.

Zero volume percent hydrogen, balance nitrogen;

b.

Seven to ten volume percent hydrogen, balance nitrogen;

c.

Twenty-five to thirty volume percent hydrogen, balance nitrogen;

d.

Zero volume percent oxygen, balance nitrogen;

e.

Seven to ten volume percent oxygen, balance nitrogen; and

f.

Twenty to twenty-five volume percent oxygen, balance nitrogen.

For Function 10, the CHANNEL CALIBRATION shall consist of an electronic calibration of the channel, not including the detector, for range decades above 10 R/hr and a one point calibration check of the detector below 10 R/hr with an installed or portable gamma source.

The 92 day Frequency for CHANNEL CALIBRATION of the drywell and suppression chamber hydrogen and oxygen analyzers is based on operating experience.

The 24 month Frequency for (continued)

Revision No. 21 1

Brunswick Unit I B 3.3-85

PAM Instrumentation B 3.3.3.1 BASES SURVEILLANCE SR 3.3.3.1.2 and SR 3.3.3.1.3 (continued)

REQUIREMENTS CHANNEL CALIBRATION of all other PAM Instrumentation of Table 3.3.3.1-1 is based on operating experience and consistency with the BNP refueling cycles.

REFERENCES

1.

Regulatory Guide 1.97, Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident, Revision 2, December 1980.

2.

NRC Safety Evaluation Report, Conformance to Regulatory Guide 1.97, Rev. 2, Brunswick Steam Electric Plant, Units I and 2, May 14, 1985.

3.

10 CFR 50.36(c)(2)(ii).

Revision No. 21 I

Brunswick Unit 1 B 3.3-86

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 B 3.3 INSTRUMENTATION B 3.3.3.2 Remote Shutdown Monitoring Instrumentation BASES BACKGROUND APPLICABLE SAFETY ANALYSES The remote shutdown monitoring instrumentation provides the control room operator with sufficient instrumentation to support placing and maintaining the plant in a safe shutdown condition from a location other than the control room.

This capability is necessary to protect against the possibility of the control room becoming inaccessible.

A safe shutdown condition is defined as MODE 3.

With the plant in MODE 3, the Reactor Core Isolation Cooling (RCIC)

System, the safety/relief valves, and the Residual Heat Removal (RHR)

System can be used to remove core decay heat and meet all safety requirements.

The long term supply of water for the RCIC System and the ability to operate shutdown cooling from outside the control room allow extended operation in MODE 3.

In the event that the control room becomes inaccessible, the operators can monitor the status of the reactor and primary containment and the operation of the RCIC and RHR Systems at the remote shutdown panel and place and maintain the plant in MODE 3.

Controls and selector switches will have to be operated locally at the switchgear, motor control panels, or other local stations.

The plant is in MODE 3 following a plant shutdown and can be maintained safely in MODE 3 for an extended period of time.

The OPERABILITY of the remote shutdown monitoring instrumentation Functions ensures that there is sufficient information available on selected plant parameters to place and maintain the plant in MODE 3 should the control room become inaccessible.

The remote shutdown monitoring instrumentation is required to provide equipment at appropriate locations outside the control room with a design capability to monitor the prompt shutdown of the reactor to MODE 3, including the necessary instrumentation to support maintaining the plant in a safe condition in MODE 3.

The criteria governing the design and the specific system requirements of the remote shutdown monitoring instrumentation are located in the UFSAR (Ref. 1).

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-87

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO The Remote Shutdown Monitoring Instrumentation is considered an important contributor to reducing the risk of accidents; as such, it meets Criterion 4 of 10 CFR 50.36(c)(2)(ii)

(Ref. 2).

The Remote Shutdown Monitoring Instrumentation LCO provides the requirements for the OPERABILITY of the monitoring instrumentation necessary to support placing and maintaining the plant in MODE 3 from a location other than the control room.

The monitoring instrumentation required are listed in Table B 3.3.3.2-1.

The monitoring instrumentation are those required for:

"* Reactor pressure vessel (RPV) pressure control;

"* Decay heat removal; and RPV inventory control.

The remote shutdown monitoring instrumentation is OPERABLE if all instrument channels needed to support the remote shutdown monitoring function are OPERABLE with readouts displayed external to the control room.

The remote shutdown monitoring instruments covered by this LCO do not need to be energized to be considered OPERABLE.

This LCO is intended to ensure that the instruments will be OPERABLE if plant conditions require that the remote shutdown monitoring instrumentation be placed in operation.

APPLICABILITY The Remote Shutdown Monitoring Instrumentation LCO is applicable in MODES 1 and 2.

This is required so that the plant can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.

This LCO is not applicable in MODES 3, 4, and 5.

In these MODES, the plant is already subcritical and in a condition of reduced Reactor Coolant System energy.

Under these conditions, considerable time is available to restore (continued)

Revision No.

21 I

Brunswick Unit I

.B 3.3-88

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 BASES APPLICABILITY necessary instrument Functions if control room instruments (continued) or control becomes unavailable.

Consequently, the LCO does not require OPERABILITY in MODES 3, 4, and 5.

ACTIONS A Note is included that excludes the MODE change restriction of LCO 3.0.4.

This exception allows entry into an applicable MODE while relying on the ACTIONS even though the ACTIONS may eventually require a plant shutdown.

This exception is acceptable due to the low probability of an event requiring this system.

Note 2 has been provided to modify the ACTIONS related to Remote Shutdown Monitoring Instrumentation Functions.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable Remote Shutdown Monitoring Instrumentation Functions provide appropriate compensatory measures for separate Functions.

As such, a Note has been provided that allows separate Condition entry for each inoperable Remote Shutdown Monitoring Instrumentation Function.

A.1 Condition A addresses the situation where one or more required Functions of the remote shutdown monitoring instrumentation is inoperable.

This includes any Function listed in Table B 3.3.3.2-1.

The Required Action is to restore the Function (all required channels) to OPERABLE status within 30 days.

The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.

(continued)

Revision No.

21 I

B 3.3-89 Brunswick Unit I

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 BASES ACTIONS B.1 (continued)

If the Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Time is reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.3.2.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one.channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized.

For Function 2 of Table B 3.3.3.2-1, the CHANNEL CHECK requirement does not apply to the NO17 instrument loop since this instrument loop has no displayed indication.

The CHANNEL CHECK requirement does apply to the remaining instruments of Function 2.

The Frequency is based upon plant operating experience that demonstrates channel failure is rare.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-90

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 BASES SURVEILLANCE SR 3.3.3.2.2 REQUIREMENTS (continued)

CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

The test verifies the channel responds to measured parameter values with the necessary range and accuracy.

The 24 month Frequency is based upon operating experience and consistency with the BNP refueling cycle.

REFERENCES

1.

UFSAR, Section 7.4.4.

2.

10 CFR 50.36(c)(2)(ii).

Revision No.

21 I

Brunswick Unit I B 3.3-91

Remote Shutdown Monitoring Instrumentation B 3.3.3.2 Table B 3.3.3.2-1 (page 1 of 1)

Remote Shutdown Monitoring Instrumentation REQUIRED READOUT NUMBER OF FUNCTION LOCATION CHANNELS

1. Reactor Vessel Pressure (a) 1

2.

Reactor Vessel Water Level (a) 1

3.

Suppression Chamber Water Level (a) 1

4.

Suppression Chamber Water Temperature (a) 1

5.

DrywetL Pressure (a) 1

6.

DrywelL Temperature (a) 1

7.

Residual Heat Removal System Flow (a) 1 (a)

Remote Shutdown Panel, Reactor Building 20.ft. Elevation.

Revision No.

21 I

B 3.3-92 Brunswick Unit 1

ATWS-RPT Instrumentation B 3.3.4.1 B 3.3 INSTRUMENTATION B 3.3.4.1 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation BASES BACKGROUND The ATWS-RPT System initiates an RPT, adding negative reactivity, following events in which a scram does not, but should occur, to lessen the effects of an ATWS event.

Tripping the recirculation pumps adds negative reactivity from the increase in steam voiding in the core area as core flow decreases.

When Reactor Vessel Water Level--Low Level 2 or Reactor Vessel Pressure-High setpoint is reached, the recirculation pump drive motor breakers trip.

The ATWS-RPT System (Ref. 1) includes sensors, relays, and circuit breakers that are necessary to cause initiation of an RPT.

The channels include electronic equipment (e.g.,

trip units) that compare measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which then outputs an ATWS-RPT signal to the trip logic.

The ATWS-RPT consists of two independent trip systems, with two channels of Reactor Vessel Pressure-High and two channels of Reactor Vessel Water Level--Low Level 2 in each trip system.

Each ATWS-RPT trip system is a two-out-of-two logic for each Function.

Thus, either two Reactor Water Level--Low Level 2 or two Reactor Vessel Pressure-High signals are needed to trip a trip system.

The outputs of the channels in a trip system are combined in a logic so that either trip system will trip both recirculation pumps (by tripping the respective drive motor breakers).

There is one drive motor breaker provided for each of the two recirculation pumps for a total of two breakers.

The output of each trip system is provided to these recirculation pump breakers.

APPLICABLE The ATWS-RPT is not assumed to mitigate any accident or SAFETY ANALYSES, transient in the-safety analysis.

The ATWS-RPT initiates an

LCO, and RPT to aid in preserving the integrity of the fuel cladding APPLICABILITY following events in which a scram does not, but should, occur.

Based on its contribution to the reduction of overall plant risk, however, the instrumentation meets Criterion 4 of 10 CFR 50.36(c)(2)(ii) (Ref. 2).

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-93

ATWS-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE The OPERABILITY of the ATWS-RPT is dependent on the SAFETY ANALYSES, OPERABILITY of the individual instrumentation channel LCO, and Functions.

Each Function must have a required number of APPLICABILITY OPERABLE channels in each trip system, with their setpoints (continued) within the specified Allowable Value of SR 3.3.4.1.4.

The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Channel OPERABILITY also includes the associated recirculation pump drive motor breakers.

Allowable Values are specified for each ATWS-RPT Function specified in the LCO.

Trip setpoints are specified in the setpoint calculations.

The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS.

Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip setting is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place.

The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state.

The analytic limits are derived from the limiting values of the process parameters obtained from the design analysis.

The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors.

The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors.

These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components.

The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.

The individual Functions are required to be OPERABLE in MODE 1 to protect against common mode failures of the Reactor Protection System by providing a diverse trip to mitigate the consequences of a postulated ATWS event.

The Reactor Vessel Pressure-High and Reactor Vessel Water (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-94

ATWS-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Level--Low Level 2 Functions are required to be OPERABLE in MODE 1, since the reactor is producing significant power and the recirculation system could be at high flow.

During this MODE, the potential exists for pressure increases or low water level, assuming an ATWS event.

In MODE 2, the reactor is at low power and the recirculation system is at low flow; thus, the potential is low for a pressure increase or low water level, assuming an ATWS event.

Therefore, the ATWS-RPT is not necessary.

In MODES 3 and 4, the reactor is shut down with all control rods inserted; thus, an ATWS event is not significant and the possibility of a significant pressure increase or low water level is negligible.

In MODE 5, the one rod out interlock ensures that the reactor remains subcritical; thus, an ATWS event is not significant.

In addition, the reactor pressure vessel (RPV) head is not fully tensioned and no pressure transient threat to the reactor coolant pressure boundary (RCPB) exists.

The specific Applicable Safety Analyses and LCO discussions are listed below on a Function by Function basis.

a.

Reactor Vessel Water Level--Low Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, the ATWS-RPT System is initiated at Level 2 to aid in maintaining level above the top of the active fuel.

The reduction of core flow reduces the neutron flux and THERMAL POWER and, therefore, the rate of coolant boiloff.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the'pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level--Low Level 2, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure can preclude an ATWS-RPT from this Function on a valid signal.

The Reactor Vessel Water Level-Low Level 2 Allowable Value is (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-95

ATWS-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE

a.

Reactor Vessel Water Level-Low Level 2 (continued)

SAFETY ANALYSES, LCO, and chosen so that the system will not be initiated after APPLICABILITY a Level I scram with feedwater still available, and for convenience with the reactor core isolation cooling initiation.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

b.

Reactor Vessel Pressure-High Excessively high RPV pressure may rupture the RCPB.

An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This increases neutron flux and THERMAL POWER, which could potentially result in fuel failure and overpressurization.

The Reactor Vessel Pressure-High Function initiates an RPT for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation.

For the overpressurization event, the RPT aids in the termination of the ATWS event and, along with the safety/relief valves, limits the peak RPV pressure to less than the ASME Section III Code Service Level C limits (1500 psig).

The Reactor Vessel Pressure-High signals are initiated from four pressure transmitters that monitor reactor vessel pressure.

Four channels of Reactor Vessel Pressure-High, with two channels in each trip system, are available and are required to be OPERABLE to ensurý that no single instrument failure can preclude an:ATWS-RPT from this Function on a valid signal.

The Reactor Vessel Pressure-High Allowable Value is chosen to provide an adequate margin to the ASME Section III Code Service Level C allowable Reactor Coolant System pressure.

ACTIONS A Note has been provided to modify the ACTIONS related to ATWS-RPT instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into (continued)

Revision No. 21 I

B 3.3-96 Brunswick Unit I

ATWS-RPT Instrumentation B 3.3.4.1 BASES ACTIONS the Condition.

Section 1.3 also specifies that Required (continued)

Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable ATWS-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels.

As such, a Note has been provided that allows separate Condition entry for each inoperable ATWS-RPT instrumentation channel.

A.1 and A.2 With one or more channels inoperable, but with ATWS-RPT capability for each Function maintained (refer to Required Actions B.1 and C.1 Bases), the ATWS-RPT System is capable of performing the intended function.

However, the reliability and redundancy of the ATWS-RPT instrumentation is reduced, such that a single failure in the remaining trip system could result in the inability of the ATWS-RPT System to perform the intended function.

Therefore, only a limited time is allowed to restore the inoperable channels to OPERABLE status.

Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of ATWS-RPT, 14 days is provided to restore the inoperable channel (Required Action A.1).

Alternately, the inoperable channel may be placed in trip (Required Action A.2), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open).

If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, Condition D must be entered and its Required Actions taken.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-97

ATWS-RPT Instrumentation B 3.3.4.1 BASES ACTIONS B.1 (continued)

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining ATWS-RPT trip capability.

A Function is considered to be maintaining ATWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the ATWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped.

This requires two channels of the Function in the same trip system to each be OPERABLE or in trip, and the recirculation pump drive motor breakers to be OPERABLE or in trip.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period and that one Function is still maintaining ATWS-RPT trip capability.

C.1 Required Action C.1 is intended to ensure that appropriate Actions are taken if multiple, inoperable, untripped channels within both Functions result in both Functions not maintaining ATWS-RPT trip capability.

The description of a Function maintaining ATWS-RPT trip capability is discussed in the Bases for Required Action B.1 above.

The I hour Completion Time is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period.

D.1 and D.2 With any Required Action and associated Completion Time not met, the plant must be brought to a MODE or other specified condition in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Required Action D.2).

Alternately, the associated recirculation pump(s) may be removed from service since this (continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-98

ATWS-RPT Instrumentation B 3.3.4.1 BASES ACTIONS D.1 and D.2 (continued) performs the intended function of the instrumentation (Required Action D.1).

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, both to reach MODE 2 from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into the associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains ATWS-RPT trip capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.

SR 3.3.4.1.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-99

ATWS-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.1 (continued)

REQUIREMENTS outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO.

SR 3.3.4.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 3.

SR 3.3.4.1.3 Calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.1.4.

If the trip setting is discovered to be less conservative than the setting accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant design analysis.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 3.

SR 3.3.4.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies the channel responds to the measured parameter within the necessary (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-100

ATWS-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.4 (continued)

REQUIREMENTS range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is-based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.4.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel.

The system functional test of the pump breakers is included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the design function.

Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be inoperable.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency.

REFERENCES

1.

UFSAR Sections 5.4.1.2.4 and 7.6.1.3.1.

2.

10 CFR 50.36(c)(2)(ii).

3.

GENE-770-06-1-A, Bases for Changes To Surveillance Test Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications, December 1992.

Revision No. 21 I

Brunswick Unit 1 B 3.3-101

ECCS Instrumentation B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1 Emergency Core Cooling System (ECCS)

Instrumentation BASES BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the systems to ensure that the fuel is adequately cooled in the event of a design basis accident or transient.

For most anticipated operational occurrences and Design Basis Accidents (DBAs),

a wide range of dependent and independent parameters are monitored.

The ECCS instrumentation actuates core spray (CS),

the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR)

System, high pressure coolant injection (HPCI),

Automatic Depressurization System (ADS),

and the diesel generators (DGs).

The equipment involved with each of these systems is described in the Bases for LCO 3.5.1, "ECCS-Operating" or LCO 3.8.1, "AC Sources-Operating."

Core Spray System The CS System may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Level 3 or Drywell Pressure-High coincident with Reactor Steam Dome Pressure-Low.

Each of these diverse variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) for each Function.

The CS System initiation signal is a sealed in signal and must be manually'reset.

The CS System can be reset if reactor water level and high drywell pressure have been restored.

Upon receipt of an initiation signal, the CS pumps are started approximately 15 seconds after power is available to limit the loading of the AC power sources.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-102

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Core Spray System (continued)

The CS test line isolation valve, which is also a primary containment isolation valve (PCIV),

is closed on a CS initiation signal to allow full system flow assumed in the accident analyses and maintain primary containment isolated in the event CS is not operating.

The CS System also monitors the pressure in the reactor to ensure that, before the injection valves open, the reactor pressure has fallen to a value below the CS System's maximum design pressure.

The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Low Pressure Coolant Injection System The LPCI is an operating mode of the Residual Heat Removal (RHR)

System, with two LPCI subsystems.

The LPCI subsystems may be initiated by automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level--Low Level 3 or Drywell Pressure-High coincident with Reactor Steam Dome Pressure-Low.

Each of these diverse variables is monitored by four redundant transmitters, which, in turn, are connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) for each Function.

Once an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset.

Upon receipt of an initiation signal, the LPCI pumps are started approximately 10 seconds after power is available to limit the loading of the AC power sources.

The RHR test line suppression pool cooling isolation valve, suppression pool spray isolation valves, and containment spray isolation valves (which are also PCIVs) are also closed on a LPCI initiation signal to allow the full system flow assumed in the accident analyses and maintain primary containment isolated in the event LPCI is not operating.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-103

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Low Pressure Coolant Injection System (continued)

The LPCI System monitors the pressure in the reactor to ensure that, before an injection valve opens, the reactor pressure has fallen to a value below the LPCI System's maximum design pressure.

The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Additionally, instruments are provided to close the recirculation loop pump discharge valves to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines.

The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Low reactor water level in the shroud is detected by two additional instruments to automatically isolate other modes of RHR (e.g., suppression pool cooling) when LPCI is required.

One instrument closes LPCI loop A valves and the other instrument closes LPCI loop B valves.

Manual overrides for these isolations are provided.

High Pressure Coolant Injection System The HPCI System may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Level 2 or Drywell Pressure-High.

Each of these variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Function.

The HPCI test line isolation valve is closed upon receipt of a HPCI initiation signal to allow the full system flow assumed in the accident analysis.

The HPCI System also monitors the water levels in the condensate storage tank (CST) and the suppression pool because these are the two sources of water for HPCI operation.

Reactor grade water in the CST is the normal (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-104

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND High Pressure Coolant Injection System (continued) source.

Upon receipt of a HPCI initiation signal, the CST suction valve is automatically signaled to open (it is normally in the open position) unless both suppression pool suction valves are open.

If the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open, and then the CST suction valve automatically closes.

Two level switches are used to detect low water level in the CST.

Either switch can cause the suppression pool suction valves to open and the CST suction valve to close.

Two level switches are also used to detect high water level in the suppression pool.

Either switch can cause an automatic swap of the HPCI pump suction valves.

The suppression pool suction valves also automatically open and the CST suction valve closes if high water level is detected in the suppression pool.

To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction path must be open before the CST suction path is automatically isolated.

The HPCI System provides makeup water to the reactor until the reactor vessel water level reaches the Reactor Vessel Water Level--High trip, at which time the HPCI turbine trips, which causes the turbine's stop valve and the injection valve to close.

This variable is monitored by two transmitters, which are, in turn, connected to two trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a two-out-of-two logic to provide high reliability of the HPCI System.

The HPCI System automatically restarts if a Reactor Vessel Water Level--Low Level 2 signal is subsequently received.

Automatic Depressurization System The ADS may be initiated by either automatic or manual means.

Automatic initiation occurs when signals indicating Reactor Vessel Water Level-Low Level 3; and confirmed Reactor Vessel Water Level-Low Level 1; and CS or RHR (LPCI Mode) Pump Discharge Pressure-High are all present and the ADS Timer has timed out.

There are two transmitters for Reactor Vessel Water Level-Low Level 3 and one transmitter for confirmed Reactor Vessel Water Level-Low Level I in (continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-105

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Automatic Depressurization System (continued) each of the two ADS trip systems.

Each of these transmitters connects to a trip unit, which then drives a relay whose contacts form the initiation logic.

Each ADS trip system includes a time delay between satisfying the initiation logic and the actuation of the ADS valves.

The ADS Timer time delay setpoint chosen is long enough that the HPCI System has sufficient operating time to recover to a level above Reactor Vessel Water Level -Low Level 3, yet not so long that the LPCI and CS Systems are unable to adequately cool the fuel if the HPCI System fails to maintain that level.

An alarm in the control room is annunciated when either of the timers is timing.

Resetting the ADS initiation signals resets the ADS Timers.

The ADS also monitors the discharge pressures of the four LPCI pumps and the two CS pumps.

Each ADS trip system includes two discharge pressure permissive switches from one CS pump and from each LPCI pump in a Division (i.e.,

Division II LPCI subsystems B and D input to ADS trip system A, and Division I LPCI subsystems A and C input to ADS trip system B).

The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel.

One CS pump or two RHR pumps in a LPCI loop are sufficient to permit automatic depressurization.

The ADS logic in each trip system is arranged in two strings.

Each string has a contact from Reactor Vessel Water Level--Low Level 3.

One of the two strings in each trip system also has a confirmed Reactor Vessel Water Level--Low Level 1 contact and an ADS Timer.

All contacts in both logic strings must close, the ADS timer must time out, and a CS or LPCI pump discharge pressure signal must be present to initiate an ADS trip system.

Either the A or B trip system will cause all the ADS relief valves to open.

Once the ADS Timer has timed out and the ADS initiation signal is present, the trip system is sealed in until manually reset.

Manual inhibit switches are provided in the control room for the ADS; however, their function is not required for ADS OPERABILITY (provided ADS is not inhibited when required to be OPERABLE).

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-106

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Diesel Generators (continued)

The DGs may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level--Low Level 3 or Drywell Pressure-High coincident with Reactor Steam Dome Pressure-Low.

The DGs are also initiated upon loss of voltage signals.

(Refer to the Bases for LCO 3.3.8.1, "Loss of Power (LOP)

Instrumentation," for a discussion of these signals.)

Each of these diverse variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the four trip units are connected to relays whose contacts are connected to a one-out-of-two taken twice logic to initiate all DGs.

The DGs receive their initiation signals from the CS System initiation logic.

The DGs can also be started manually from the control room and locally from the associated DG room.

Upon receipt of a loss of coolant accident (LOCA) initiation signal, each DG is automatically started, is ready to load within 10 seconds, and will run in standby conditions (rated voltage and frequency, with the DG output breaker open).

The DGs will only energize their respective 4.16 kV emergency buses if a loss of offsite power occurs.

(Refer to Bases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of Referencesi1, 2, and 3.

The ECCS is initiated

LCO, and to preserve the integrity of the fuel cladding by limiting APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref. 4).

Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1.

Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate.

The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-107

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Allowable Values are specified for each ECCS Function specified in the table.

Trip setpoints are specified in the setpoint calculations.

The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS.

Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip setting is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place.

The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process-parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state.

The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis.

The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors.

The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors.

These calibration based errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components.

The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis transient or accident.

Table 3.3.5.1-1 footnotes (a),

(b),

and (c) specifically indicate other conditions when certain ECCS Instrumentation Functions are required to be OPERABLE.

To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals.

The specific Applicable Safety Analyses,

LCO, and Applicability discussions are listed below on a Function by Function basis.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-108

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Core SDrav and Low Pressure Coolant Injection Systems l.a. 2.a.

Reactor Vessel Water Level--Low Level 3 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

The low pressure ECCS and associated DGs are initiated at Reactor Vessel Water Level-Low Level 3 to ensure that core spray and flooding functions are available to prevent or minimize fuel damage.

The Reactor Vessel Water Level--Low Level 3 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS and associated DGs during the transients analyzed in References I and 3.

In addition, the Reactor Vessel Water Level-Low Level 3 Function is directly assumed in the analysis of the recirculation line break (Ref. 5).

The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS),

ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Level 3 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Level 3 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

Four channels of Reactor Vessel Water Level -Low Level 3 Function are only required to be OPERABLE when the ECCS or DG(s) are required to be OPERABLE to ensure that no single instrument failure can preclude ECCS and DG initiation.

Refer to LCO 3.5.1 and LCO 3.5.2, "ECCS-Shutdown," for Applicability Bases for the low pressure ECCS subsystems; and LCO 3.8.1 and LCO 3.8.2, "AC Sources-Shutdown," for Applicability Bases for the DGs.

I.b. 2.b.

Drvwell Pressure-HiQh High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB).

The low pressure (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-109

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY

].b. 2.b.

Drywell Pressure-High (continued)

ECCS and associated DGs are initiated upon receipt of the Drywell Pressure-High Function coincident with Reactor Steam Dome Pressure-Low Function in order to minimize the possibility of fuel damage.

The Drywell Pressure-High Function is directly assumed in the analysis of the recirculation line break (Ref. 5).

The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure.

The Allowable Value was selected to be as low as possible to be indicative of a LOCA inside primary containment.

The Drywell Pressure-High Function is required to be OPERABLE when the ECCS or DG is required to be OPERABLE in conjunction with times when the primary containment is required to be OPERABLE.

Thus, four channels of the CS and LPCI Drywell-Pressure-High Functions are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS and DG initiation.

In MODES 4 and 5, the Drywell Pressure-High Function is not required, since there is insufficient energy in the reactor to pressurize the primary containment to Drywell Pressure-High setpoint.

Refer to LCO 3.5.1 for Applicability Bases for the low pressure ECCS subsystems and to LCO 3.8.1 for Applicability Bases for the DGs.

].c, 2.c.

Reactor Steam Dome Pressure-Low Low reactor steam dome pressure signals are used as permissives for the low pressure ECCS subsystems.

This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure.

The low reactor steam dome pressure signals are also used in the Drywell Pressure-High logic circuits to distinguish high drywell pressure caused by a LOCA from that caused by loss of drywell cooling.

The Reactor Steam Dome Pressure-Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS and associated DGs during the transients analyzed in References 2 and 3.

In addition, the Reactor Steam Dome (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-110

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE I.c, 2.c.

Reactor Steam Dome Pressure-Low (continued)

SAFETY ANALYSES, LCO, and Pressure-Low Function is directly assumed in the analysis APPLICABILITY of the recirculation line break (Ref. 5).

The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Steam Dome Pressure-Low signals are initiated from four pressure transmitters that sense the reactor dome pressure.

The Allowable Value is low enough to prevent overpressuring the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.

Four channels of Reactor Steam Dome Pressure-Low Function are only required to be OPERABLE when the ECCS or DG(s) are required to be OPERABLE to ensure that no single instrument failure can preclude ECCS and DG initiation.

Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems; and LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

1.d, 2.f.

Core Spray and RHR Pump Start-Time Delay Relays The purpose of these time delays is to stagger the start of the CS and RHR pumps that are in each of Divisions I and II, thus limiting the starting transients on the 4.16 kV emergency buses.

These Functions are necessary when power is being supplied from either the normal power sources (offsite power) or the standby power sources (DGs).

The Core Spray Pump Start-Time Delay Relays and the RHR Pump Start-Time Delay Relays are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation.

That is,'the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are eight RHR Pump Start-Time Delay Relays, two channels in each of the RHR pump start logic circuits.

There are six CS pump start timers arranged such that there are four separate channels of the Core Spray Pump Start Time-Delay Relay Function, two channels in each of the CS (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-111

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.d, 2.f.

Core Spray and RHR Pump Start-Time Delay Relays SAFETY ANALYSES (continued)

LCO, and APPLICABILITY pump start logic circuits.

Each channel consists of an individual 10 second timer and a 5 second timer.

The 5 second timer is common to both channels associated with a CS pump start logic circuit.

Each 10 second timer associated with a CS pump start logic channel is shared with an RHR pump start logic channel.

While two time delay relay channels are dedicated to a single CS pump start logic, a single failure of a 5 second CS pump timer could result in the failure of the two low pressure ECCS pumps, powered from the same 4.16 kV emergency bus, to perform their intended function within the assumed ECCS RESPONSE TIME (e.g., as in the case where both ECCS pumps on one 4.16 kV emergency bus start simultaneously due to an inoperable time delay relay).

This still leaves four of the six low pressure ECCS pumps OPERABLE.

Additionally, a failure of both shared time delay relay channels in an RHR and CS pump start logic circuit would also leave four of the six low pressure ECCS pumps OPERABLE as described above.

As a result, to satisfy the single failure criterion (i.e.,

loss of one instrument does not preclude ECCS initiation),

only one channel per pump of the Core Spray and RHR Pump Start-Time Delay Relay Functions are required to be OPERABLE when the associated ECCS subsystem is required to be OPERABLE.

Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the ECCS subsystems.

The Allowable Values for the Core Spray and RHR Pump Start-Time Delay Relays are chosen to be long enough so that most of the starting transient of the previously started pump is complete before starting a subsequent pump on the same 4.16 kV emergency bus and short enough so that ECCS operation is not degraded.

2.d.

Reactor Steam Dome Pressure-Low (Recirculation Pump Discharge Valve Permissive)

Low reactor steam dome pressure signals are used as permissives for recirculation pump discharge valve closure and recirculation pump discharge bypass valve closure.

This ensures that the LPCI subsystems inject into the proper RPV location assumed in the safety analysis.

The Reactor Steam (continued)

Revision No. 21 I

B 3.3-112 Brunswick Unit 1

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE SAFETY ANALYSES

LCO, and APPLICABILITY 2.d.

Reactor Steam Dome Pressure-Low (Recirculation Pump Discharge Valve Permissive)

(continued)

Dome Pressure-Low is one of the Functions assumed to be OPERABLE and capable of closing the valve(s) during the transients analyzed in References 2 and 3.

The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Steam Dome Pressure-Low Function is directly assumed in the analysis of the recirculation line break (Ref. 5).

The Reactor Steam Dome Pressure-Low signals are initiated from four pressure transmitters that sense the reactor dome pressure.

The Allowable Value is chosen to ensure that the valves close prior to commencement of LPCI injection flow into the core, as assumed in the safety analysis.

Four channels of the Reactor Steam Dome Pressure-Low Function are only required to be OPERABLE in MODES 1, 2, and 3 with the associated recirculation pump discharge valve open or the associated recirculation pump discharge bypass valve open.

With the valve(s) closed, the function of instrumentation has been performed; thus, the Function is not required.

In MODES 4 and 5, the loop injection location is not critical since LPCI injection through the recirculation loop in either direction will still ensure that LPCI flow reaches the core (i.e., there is no significant reactor steam dome back pressure).

2.e.

Reactor Vessel Shroud Level The Reactor Vessel Shroud Level Function is provided as a permissive to allow the RHR System to be manually aligned from the LPCI mode to the suppression pool cooling/spray or drywell spray modes.

The permissive ensures that water in the vessel is at least two thirds core height before the manual transfer is allowed.

This ensures that LPCI is available to prevent or minimize fuel damage.

This function may be overridden during accident conditions as allowed by plant procedures.

The Reactor Vessel Shroud Level Function is implicitly assumed in the analysis of the recirculation (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-113

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 2.e.

Reactor Vessel Shroud Level (continued)

SAFETY ANALYSES, LCO, and line break (Ref. 5) since the analysis assumes that no LPCI APPLICABILITY flow diversion occurs when reactor water level is below the Reactor Vessel Shroud Level.

Reactor Vessel Shroud Level signals are initiated from two level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Shroud Level Allowable Value is chosen to allow the low pressure core flooding systems to activate and provide adequate cooling before allowing a manual transfer.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

Two channels of the Reactor Vessel Shroud Level Function are only required to be OPERABLE in MODES 1, 2, and 3.

In MODES 4 and 5, the specified initiation time of the LPCI subsystems is not assumed, and other administrative controls are adequate to control the valves that this Function isolates (since the systems that the valves are opened for are not required to be OPERABLE in MODES 4 and 5 and are normally not used).

HPCI System 3.a.

Reactor Vessel Water Level-Low Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, the HPCI System is initiated at Level 2 to maintain level above the top of the active fuel.

The Reactor Vessel Water Level--Low Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCI during the transients analyzed in References 2, 3, and 6.

Reactor Vessel Water Level-Low Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-114

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY 3.a.

Reactor Vessel Water Level-Low Level 2 (continued)

The Reactor Vessel Water Level-Low Level 2 Allowable Value is low enough to avoid a HPCI System start from normal reactor level transients (e.g., a reactor scram without the loss of feedwater flow) and high enough to avoid initiation of low pressure ECCS at Reactor Vessel Water Level--Low Level 3 during a transient resulting from a complete loss of feedwater flow.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

Four channels of Reactor Vessel Water Level--Low Level 2 Function are required to be OPERABLE only when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI initiation.

Refer to LCO 3.5.1 for HPCI Applicability Bases.

3.b.

Drywell Pressure-High High pressure in the drywell could indicate a break in the RCPB.

The HPCI System is initiated upon receipt of the Drywell Pressure-High Function in order to minimize the possibility of fuel damage.

The Drywell Pressure-High Function is not assumed in accident or transient analyses.

It is retained since it is a potentially significant contributor to risk.,

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure.

The Allowable Value was selected to be as low as possible to be indicative of a LOCA inside primary containment.

Four channels of the Drywell Pressure-High Function are required to be OPERABLE when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI initiation.

Refer to LCO 3.5.1 for the Applicability Bases for the HPCI System.

3.c.

Reactor Vessel Water Level-High High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel.

Therefore, the Reactor Vessel Water Level--High signal is used to trip the HPCI turbine to prevent overflow into the main steam lines (MSLs) which precludes an unanalyzed event.

(continued)

Revision No. 21 I

B 3.3-115 Brunswick Unit 1

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.c.

Reactor Vessel Water Level-High (continued)

SAFETY ANALYSES, LCO, and Reactor Vessel Water Level-High signals for HPCI are APPLICABILITY initiated from two level transmitters from the narrow range water level measurement instrumentation.

Both Reactor Vessel Water Level-High signals are required in order to close the HPCI turbine stop valve.

This ensures that no single instrument failure can preclude HPCI initiation.

The Reactor Vessel Water Level-High Allowable Value is high enough to avoid interfering with HPCI System operation during reactor water level recovery resulting from low reactor water level events and low enough to prevent flow from the HPCI System from overflowing into the MSLs.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

Two channels of Reactor Vessel Water Level-High Function are required to be OPERABLE only when HPCI is required to be OPERABLE.

Refer to LCO 3.5.1 for HPCI Applicability Bases.

3.d Condensate Storage Tank Level--Low Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source.

Normally the suction valves between HPCI and the CST are open and, upon receiving a HPCI initiation signal, water for HPCI injection would be taken from the CST.

However, if the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open, and then the CST suction valve automatically closes.

This ensures that an adequate supply of makeup water is available to.the HPCI pump.

To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes.

The Function is implicitly assumed in the accident and transient analyses (which take credit for HPCI) since the analyses assume that the HPCI suction source is the suppression pool.

The Condensate Storage Tank Level-Low signal is initiated from two level switches.

The logic is arranged such that either level switch can cause the suppression pool suction valves to open and the CST suction valve to close.

The (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-116

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE Condensate Storage Tank Level-Low (continued)

SAFETY ANALYSES

LCO, and

\\Condensate Storage Tank Level-Low Function Allowable Value APPLICABILITY i s-high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of the Condensate Storage Tank Level--Low Function are required to be OPERABLE only when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI swap to suppression pool source.

Refer to LCO 3.5.1 for HPCI Applicability Bases.

3.e.

Suppression Chamber Water Level--High Excessively high suppression pool water could impact operation of the HPCI and Reactor Core Isolation Cooling (RCIC) exhaust vacuum breakers resulting in an inoperable HPCI or RCIC System.

Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCI from the CST to the suppression pool to eliminate the possibility of HPCI continuing to provide additional water from a source outside containment.

To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes.

This Function is implicitly assumed in the accident and transient analyses (which take credit for HPCI) since the analyses assume that the HPCI suction source is the suppression pool.

The Suppression Chamber Water Level--High signal is initiated from two level switches.

The logic is arranged such that either switch can cause the suppression pool suction valves to open and the CST suction valve to close.

The Allowable Value for the Suppression Chamber Water Level--High Function is chosen to ensure that HPCI will be aligned for suction from the suppression pool before the water level reaches the point at which the HPCI and RCIC exhaust vacuum breakers become inoperable.

The Allowable Value is referenced from the suppression chamber water level zero.

Suppression chamber water level zero is one inch below the torus centerline.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-117

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.e.

Suppression Chamber Water Level--High (continued)

SAFETY ANALYSES, LCO, and Two channels of Suppression Chamber Water Level-High APPLICABILITY Function are required to be OPERABLE only when HPCI is (continued) required to be OPERABLE to ensure that no single instrument failure can preclude HPCI swap to suppression pool source.

Refer to LCO 3.5.1 for HPCI Applicability Bases.

Automatic Depressurization System (ADS) 4.a, 5.a.

Reactor Vessel Water Level-Low Level 3 Low RPV water level indicates that the capability to cool the'fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, ADS receives one of the signals necessary for initiation from this Function.

The Reactor Vessel Water Level-Low Level 3 is one of the Functions assumed to be OPERABLE and capable of initiating the ADS during the accident analyzed in References 2 and 5.

The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level--Low Level 3 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level-Low Level 3 Function are required to be OPERABLE only when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.

Two channels input to ADS trip system A, while the other two channels input to ADS trip system ý. Refer to LCO 3.5.1 for ADS Applicability Bases.

The Reactor Vessel Water Level-Low Level 3 Allowable Value is chosen to allow time for the low pressure core flooding systems to initiate and provide adequate cooling.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

(continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-118

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 4.b. 5.b.

ADS Timer The purpose of the ADS Timer is to delay depressurization of the reactor vessel to allow the HPCI System time to maintain reactor vessel water level.

Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited.

By delaying initiation of the ADS Function, the operator is given the chance to monitor the success or failure of the HPCI System to maintain water level, and then to decide whether or not to allow ADS to initiate, to delay initiation further by recycling the timer, or to inhibit initiation permanently.

The ADS Timer Function is assumed to be OPERABLE for the accident analyses of References 2 and 5 that require ECCS initiation and assume failure of the HPCI System.

There are two ADS Timer relays, one in each of the two ADS trip systems.

The Allowable Value for the ADS Timer is chosen to be long enough to allow HPCI to start and avoid an inadvertent blowdown yet short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Two channels of the ADS Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.

One channel inputs to ADS trip system A, while the other channel inputs to ADS trip system B.

Refer to LCO 3.5.1 for ADS Applicability Bases.

4.c. 5.c.

Reactor Vessel Water Level-Low Level I The Reactor Vessel Water Level-Low Level 1 Function is used by the ADS only as a confirmatory low water level signal.

ADS receives one of the signals necessary for initiation from Reactor Vessel Water Level-Low Level 3 signals.

In order to prevent spurious initiation of the ADS due to spurious Level 3 signals, a Level I signal must also be received before ADS initiation commences.

Reactor Vessel Water Level-Low Level 1 signals are initiated from two level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Allowable (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-119

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.c, 5.c.

Reactor Vessel Water Level--Low Level I SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY Value for Reactor Vessel Water Level--Low Level 1 is selected at the RPS Level.1 scram Allowable Value for convenience.

Refer to LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation," for the Bases discussion of this Function.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

Two channels of Reactor Vessel Water Level--Low Level I Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.

One channel inputs to ADS trip system A, while the other channel inputs to ADS trip system B.

Refer to LCO 3.5.1 for ADS Applicability Bases.

4.d, 4.e. 5.d, 5.e.

Core Spray and RHR (LPCI Mode) Pump Discharge Pressure-High The Pump Discharge Pressure-High signals from the CS and RHR pumps are used as permissives for ADS initiation, indicating that there is a source of low pressure cooling water available once the ADS has depressurized the vessel.

Pump Discharge Pressure-High is one of the Functions assumed to be OPERABLE and capable of permitting ADS initiation during the events analyzed in References 2 and 5 with an assumed HPCI failure.

For these events the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the core cooling functions.

This core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Pump discharge pressure signals are initiated from twelve pressure switches, two on the discharge side of each of the six low pressure ECCS pumps.

In order to generate an ADS permissive in one trip system, it is necessary that only one CS pump (both channels for the pump) indicate the high discharge pressure condition or two RHR pumps in one LPCI loop (one channel for each pump) indicate a high discharge pressure condition.

The Pump Discharge Pressure-High Allowable Value is less than the pump discharge pressure when the pump is operating at all flow ranges and high (continued)

Revision No. 21 I

B 3.3-120 Brunswick Unit I

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.d. 4.e, 5.d, 5.e.

Core Spray and RHR (LPCI Mode)

Pump SAFETY ANALYSES, Discharge Pressure-High (continued)

LCO, and APPLICABILITY enough to avoid any conditi.on that results in a discharge pressure permissive when the CS and LPCI pumps are aligned for injection and the pumps are not running.

The actual operating point of this function is not assumed in any transient or accident analysis.

Twelve channels of Core Spray and RHR (LPCI Mode)

Pump Discharge Pressure-High Functions are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.

Two CS channels associated with CS pump B and four LPCI channels associated with RHR pumps B and D are required for trip system A.

Two CS channels associated with CS pump A and four LPCI channels associated with RHR pumps A and C are required for trip system B.

Refer to LCO 3.5.1 for ADS Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related to ECCS instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable ECCS instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable ECCS instrumentation channel.

A._1 RequiredAction A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.1-1.

The applicable Condition referenced in the Table is Function dependent.

Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-121

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.I, B.2, and B.3 (continued)

Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant automatic initiation capability being lost for the feature(s).

Required Action B.1 features would be those that are initiated by Functions I.a, 1.b, 2.a, and 2.b (e.g., low pressure ECCS).

The Required Action B.2 system would be HPCI.

For Required Action B.1, redundant automatic initiation capability is lost if (a) two Function I.a channels are inoperable and untripped in the same trip system, (b) two Function 2.a channels are inoperable and untripped in the same trip system, (c) two Function 1.b channels are inoperable and untripped in the same system, or (d) two Function 2.b channels are inoperable and untripped in the same trip system.

For low pressure ECCS, since each inoperable channel would have Required Action B.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated system of low pressure ECCS and DGs to be declared inoperable.

However, since channels in both associated low pressure ECCS subsystems (e.g., both CS subsystems) are inoperable and untripped, and the Completion Times started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS ard DGs being concurrently declared inoperable.

For Required Action B.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system.

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

As noted (Note I to Required Action B.1),

Required Action B.1 is only applicable in MODES 1, 2, and 3.

In MODES 4 and 5, the specific initiation time of the low pressure ECCS is not assumed and the probability of a LOCA is lower.

Thus, a total loss of initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action B.3) is allowed during MODES 4 and 5.

There is no similar Note provided for Required Action B.2 since HPCI instrumentation is not required in MODES 4 and 5; thus, a Note is not necessary.

(continued)

Revision No. 21 I

Brunswick Unit 1

.B 3.3-122

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.I, B.2. and B.3 (continued)

Notes are also provided (Note 2 to Required Action B.1 and the Note to Required Action B.2) to delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable.

This ensures that the proper loss of initiation capability check is performed.

Required Action B.1 (the Required Action for certain inoperable channels in the low pressure ECCS subsystems) is not applicable to Function 2.e, since this Function provides backup to administrative controls ensuring that operators do not divert LPCI flow from injecting into the core when needed.

Thus, a total loss of Function 2.e capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed, since the LPCI subsystems remain capable of performing their intended function.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in the same system (e.g., both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Function as described in the paragraph above.

For Required Action B.2, the Completion Time only begins upon discovery that the HPCI System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system.

The I hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

(continued)

Revision No.

21 1

Brunswick Unit I B 3.3-123

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued)

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in frip would result in an initiation), Condition G must be entered and its Required Action taken.

C.1 and C.2 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in redundant automatic initiation capability being lost for the feature(s).

Required Action C.1 features would be those that are initiated by Functions 1.c, I.d, 2.c, 2.d, and 2.f (i.e., low pressure ECCS).

Redundant automatic initiation capability is lost if either (a) two Function 1.c channels are inoperable in the same trip system, (b) two Function 2.c channels are inoperable in the same trip system, (c) two Function 2.d channels are inoperable in the same trip system, or (d) two or more required Function 1.d and 2.f channels associated with low pressure ECCS pumps powered from separate 4.16 kV emergency buses are inoperable.

Since each inoperable channel would have Required Action C.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated system of low pressure ECCS and DGs to be declared inoperable.

However, since channels for both associated low pressure ECCS subsystems are inoperable (e.g., both CS subsystems),

and the Completion Times started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS and DGs being concurrently declared inoperable.

For Functions L.d and 2.f, the affected portions are the associated low pressure ECCS pumps.

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

As noted (Note 1 to Required Actions C.1), Required Action C.1 is only applicable in MODES 1, 2, and 3.

In MODES 4 and 5, the specific initiation time of the ECCS is not assumed and the probability of a LOCA occurring during (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-124

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C.1 and C.2 (continued) the period the channels are inoperable is low.

Thus, a total loss of automatic initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action C.2) is allowed during MODES 4 and 5.

Note 2 to Required Action C.1 states that it is only applicable for Functions 1.c, 1.d, 2.c, 2.d, and 2.f.

Required Action C.1 is not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), since the loss of one channel results in a loss of the Function (two-out-of-two logic).

This loss was considered during the development of Reference 7 and considered acceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed by Required Action C.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both subsystems (e.g., both CS subsystems) cannot be automatically initiated due to inoperable channels within the same Function as described in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition G must be entered and its Required Action taken.

The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-125

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.I. D.2.1, and D.2.2 (continued)

Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic component initiation capability for the HPCI System.

Automatic component initiation capability is lost if two Function 3.d channels or two Function 3.e channels are inoperable and untripped.

In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate and the HPCI System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of HPCI initiation capability.

As noted, Required Action D.1 is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action D.1, the Completion Time only begins upon discovery that the HPCI System cannot be automatically aligned to:the suppression pool due to two inoperable, untripped channels in the same Function as described in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.

7) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1 or the suction source must be aligned to the suppression pool per Required Action D.2.2.

Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool).

Performance of either of these two Required Actions will allow operation to continue.

If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the HPCI System piping remains filled with water.

Alternately, if it is not (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-126

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.1, D.2.1. and D.2.2 (continued) desired to perform Required Actions D.2.1 and D.2.2 (e.g.,

as in the case where shifting the suction source could drain down the HPCI suction piping), Condition G must be entered and its Required Action taken.

E.1 and E.2 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within similar ADS trip system A and B Functions result in redundant automatic initiation capability being lost for the ADS.

Redundant automatic initiation capability is lost if either (a) one Function 4.a channel and one Function 5.a channel are inoperable and untripped, or (b) one Function 4.c channel and one Function 5.c channel are inoperable and untripped.

In this situation (loss of automatic initiation capability),

the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Required Action E.2 is not appropriate and all ADS valves must be declared inoperable within I hour after discovery of loss of ADS initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action E.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within similar ADS trip system Functions as described in the paragraph above.

The I hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE.

If either HPCI or RCIC is inoperable, the time is shortened to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months .

If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-127

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2 (continued) 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability.

However, the total time for an inoperable, untripped channel cannot exceed 8 days.

If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable, untripped channel.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action E.2.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition G must be entered and its Required Action taken.

F.1 and F.2 Required Action F.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within similar ADS trip system A and B Functions result in redundant automatic initiation capability being lost for the ADS.

Redundant automatic initiation capability is lost if either (a) one Function 4.b channel and one Function 5.b channel are inoperable, or (b) a combination of Function 4.d, 4.e, 5.d, and 5.e channels are inoperable such that channels associated with both CS pumps and one RHR pump in each LPCI loop are inoperable.

In this situation (loss of automatic initiation capability),

the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Required Action F.2 is not appropriate and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action F.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within similar ADS trip (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-128

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS F.1 and F.2 (continued) system Functions as described in the paragraph above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 7) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE (Required Action F.2).

If either HPCI or RCIC is inoperable, the time shortens to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months .

If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability.

However, the total time for an inoperable channel cannot exceed 8 days.

If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable channel.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition G must be entered and its Required Action taken.

The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

G.1 With any Required Action and associated Completion Time not met, the associated feature(s) may be incapable of performing the intended function, and the supported feature(s) associated with inoperable untripped channels must be declared inoperable immediately.

SURVEILLANCE As noted (Note 1) in the beginning of the SRs, the SRs for REQUIREMENTS each ECCS instrumentation Function are found in the SRs column of Table 3.3.5.1-1.

The Surveillances are modified by a Note (Note 2) to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months as follows:

(a) for Function 3.c; (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-129

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued) and (b) for Functions other than 3.c provided the associated Function or redundant Function maintains ECCS initiation capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Ref. 7) assumption of the average time required to perform channel surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the ECCS will initiate when necessary.

SR 3.3.5.1.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

A CHANNEL CHECK guarantees that undetected outright channel failure is limited to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.5.1.2 and SR 3.3.5.1.6 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-130

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.2 and SR 3.3.5.1.6 (continued)

REQUIREMENTS function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The 92 day Frequency of SR 3.3.5.1.2 is based on the reliability analyses of Reference 7.

The 24 month Frequency of SR 3.3.5.1.6 is based on engineering judgment and the reliability of the components.

SR 3.3.5.1.3 Calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.1-1.

If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analyses.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than the setting accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 7.

SR 3.3.5.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

(continued)

Revision No.

21 I

Brunswick Unit I 8 3.3-131

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.5.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic and simulated automatic operation for a specific channel.

The system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency.

REFERENCES

1. UFSAR, Section 5.2.

2.

UFSAR, Section 6.3.

3.

UFSAR, Chapter 15.

4.

10 CFR 50.36(c)(2)(ii).

5.

NEDC-31624P, Brunswick Steam Electric Plant Units and 2 SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis (Revision 2), July 1990.

1

6.

GE-NE-187-26-1292, Power Uprate Transient Analysis for Brunswick Steam Electric Plant Units I and 2, Revision 1, November 1995.

7.

NEDC-30936-P-A, BWR Owners' Group Technical Specification Improvement Methodology (With Demonstration for BWR ECCS Actuation Instrumentation),

Parts I and 2, December 1988.

Revision No.

21 I

Brunswick Unit I B 3.3-132

RCIC System Instrumentation B 3.3.5.2 B 3.3 INSTRUMENTATION B 3.3.5.2 Reactor Core Isolation Cooling (RCIC)

System Instrumentation BASES BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is insufficient or unavailable, such that RCIC System initiation occurs and maintains sufficient reactor water level such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur.

A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."

The RCIC System may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Level 2.

The variable is monitored by four transmitters that are connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement.

The RCIC test line isolation valve is closed on a RCIC initiation signal to allow full system flow.

The RCIC System also monitors the water levels in the condensate storage tank (CST) since this is the initial source of water for RCIC operation.

Reactor grade water in the CST is the normal source.

Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open.

If the water level in the CST falls below a preselected level, first the RCIC suppression pool suction valves automatically open, and then the RCIC CST suction valve automatically closes.

Two level switches are used to detect low water level in the CST.

Either switch can cause the suppression pool suction valves to open and the CST suction valve to close (one-out-of-two logic).

To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-133

RCIC System Instrumentation B 3.3.5.2 BASES BACKGROUND The RCIC System provides makeup water to the reactor until (continued) the reactor vessel water level reaches the high water level trip (two-out-of-two logic), at which time the RCIC steam supply valve closes.

The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The function of the RCIC System to provide makeup coolant to the reactor is used to respond to transient events.

The RCIC System is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation.

Based on its contribution to the reduction of overall plant risk, however, the system, and therefore its instrumentation, meets Criterion 4 of 10 CFR 50.36(c)(2)(ii)

(Ref.

1). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RCIC System instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.2-1.

Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate.

The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC System instrumentation Function specified in Table 3.3.5.2-1.

Trip setpoints are specified in the setpoint calculations.

The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS.

Operation-with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip setting is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place.

The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,

trip unit) changes state.

The analytic limits are derived from the limiting values of the process parameters obtained from the analysis.

The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errorý.

The Allowable Values (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-134

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) are then determined, based on the trip setpoint values, by accounting for calibration based errors.

These calibration based errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components.

The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.

The individual Functions are required to be OPERABLE in MODE 1, and in MODES 2 and 3 with reactor steam dome pressure > 150 psig since this is when RCIC is required to be OPERABLE.

Refer to LCO 3.5.3 for Applicability Bases for the RCIC System.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1.

Reactor Vessel Water Level-Low Level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.

Reactor Vessel Water Level--Low Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow with high pressure coolant injection assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Level 3.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

(continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-135

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE

1.

Reactor Vessel Water Level-Low Level 2 (continued)

SAFETY ANALYSES,

LCO, and Four channels of Reactor Vessel Water Level--Low Level 2 APPLICABILITY Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

2.

Reactor Vessel Water Level-High High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel.

Therefore, the high water level signal is used to close the RCIC steam supply valve to prevent overflow into the main steam lines (MSLs).

Reactor Vessel Water Level-High signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-High Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC System to prevent reactor vessel overfill.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

Two channels of Reactor Vessel Water Level-High Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

3.

Condensate Storage Tank Level--Low Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source.

Normally, the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST.

However, if the water level in the CST falls below a preselected level, first the suppression pool suction valves (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-136

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE

3.

Condensate Storage Tank Level-Low (continued)

SAFETY ANALYSES, LCO, and automatically open, and then the CST suction valve APPLICABILITY automatically closes.

This ensures that an adequate supply of makeup water is available to the RCIC pump.

To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes.

Two level switches are used to detect low water level in the CST.

The Condensate Storage Tank Level-Low Function Allowable Value is set high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of Condensate Storage Tank Level-Low Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels.

As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.

A._1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1.

The applicable Condition referenced in the Table is Function dependent.

Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

(continued)

Revision No.

21 I

B 3.3-137 Brunswick Unit 1

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS B.1 and B.2 (continued)

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System.

In this case, automatic initiation capability is lost if two Function I channels in the same trip system are inoperable and untripped.

In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within I hour after discovery of loss of RCIC initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel Water Level-Low Level 2 channels in the same trip system.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the' channel must be placed in the tripped condition per Required Action B.2.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-138

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS C.1 (continued)

A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref. 2) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1).

A Required Action (similar to Required Action B.1) limiting the allowable out of service time, if a loss of automatic RCIC initiation capability exists, is not required.

This Condition applies to the Reactor Vessel Water Level-High Function whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability (loss of high water level trip capability).

As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable.

One inoperable channel may result in a loss of high water level trip capability but will not prevent RCIC System automatic start capability.

However, the Required Action does not allow placing a channel in trip since this action would not necessarily result in a safe state for the channel in all events (a failure of the remaining channel could prevent a RCIC System start).

D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature(s).

For Required Action D.1, the RCIC System is the only associated feature.

In this case, automatic initiation capability is lost if two Function 3 channels are inoperable and untripped.

In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within I hour from discovery of loss of RCIC initiation capability.

As noted, Required Action D.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-139

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued)

For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool).

Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool, which also performs the intended function.

If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water.

If it is not desired to perform Required Actions D.2.1 and D.2.2 (e.g., as in the case where shifting the suction source could drain down the RCIC suction piping), Condition E must be entered and its Required Action taken.

E.1 With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC REQUIREMENTS System instrumentation Function are found in the SRs column of Table 3.3.5.2-1.

(continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-140

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows:

(a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Function 2; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 1 and 3, provided the associated Function maintains RCIC initiation capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.

SR 3.3.5.2.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a parameter on other similar channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-141

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.2 REQUIREMENTS (continued)

A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 2.

SR 3.3.5.2.3 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.2-1.

If the trip setting is discovered to be less conservative than the setting accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 2.

SR 3.3.5.2.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

(continued)

Revision No. 21 1

Brunswick Unit I B 3.3-142

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.5.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel and includes simulated automatic actuation of the channel.

The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the 24 month Frequency.

REFERENCES

1.

10 CFR 50.36(c)(2)(ii).

2.

GENE-770-06-2P-A, Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

Revision No.

21 I

Brunswick Unit I B 3.3-143

Primary Containment Isolation Instrumentation B 3.3.6.1 B 3.3 INSTRUMENTATION B 3.3.6.1 Primary Containment Isolation Instrumentation BASES BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs).

The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs).

Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation.

Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic.

Functional diversity is provided by monitoring a wide range of independent parameters.

The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient and differential temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC)

System initiation, (e) condenser vacuum, (f) main steam line pressure, (g) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line flow, (h) drywell pressure, (i)

HPCI and RCIC steam line pressure, (j) HPCI and RCIC turbine exhaust diaphragm pressure, (k) reactor water cleanup (RWCU) differential flow, (1) reactor steam dome pressure, (m) main stack radiation, and (n) reactor building exhaust radiation.

Redundant sensor input signals from each parameter are provided for initiation of isolation.

The exceptions are SLC System initiation and main stack radiation.

Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-144

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND

1. Main Steam Line Isolation (continued)

Most MSL Isolation Functions receive inputs from four channels.

The outputs from these channels are combined in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs).

The outputs from the same channels are arranged into two two-out-of-two logic trip systems to isolate all MSL drain valves.

Each MSL drain line has two isolation valves with one two-out-of-two logic system associated with each valve.

The exceptions to this arrangement are the Main Steam Line Flow-High Function and the Main Steam Isolation Valve Pit Temperature-High Function.

The Main Steam Line Flow-High Function uses 16 flow channels, four for each steam line.

One channel from each steam line inputs to one of the four trip strings.

Two trip strings make up each trip system and both trip systems must trip to cause an MSL isolation.

Each trip string has four inputs (one per MSL),

any one of which will trip the trip string.

The trip strings are arranged in a one-out-of-two taken twice logic.

This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation of the MSIVs.

Similarly, the 16 flow channels are connected into two two-out-of-two logic trip systems (effectively, two one-out-of-four twice logic), with each trip system isolating one of the two MSL drain valves on the associated steam line.

The Main Steam Isolation Valve Pit Temperature-High Function consists of the four MSL tunnel temperature monitoring channels that sense temperature in the MSIV pit.

Each channel receives input from an individual temperature switch.

The inputs are arranged in a one-out-of-two taken twice logic to isolate all MSIVs.

Similarly, the inputs are arranged in two two-out-of-two logic trip systems, with each trip system required to isolate the two MSL drain valves per drain line.

MSL Isolation Functions isolate the Group I valves.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-145

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND

2.

Primary Containment Isolation (continued)

Primary Containment Isolation Functions associated with Reactor Vessel Water Level-Low Level 1 and Drywell Pressure-High receive inputs from four channels.

The outputs from these channels are arranged into one-out-of-two taken twice logics.

One trip system initiates isolation of all inboard primary containment isolation valves, while the other trip system initiates isolation of all outboard primary containment isolation valves.

Each logic closes one of the two valves on each penetration, so that operation of either logic isolates the penetration.

The Main Stack Radiation-High Function receives input from one channel.

The output from this channel is provided to each of two one-out-of-one logic trip systems.

Each trip system isolates both valves in the associated penetration.

The Reactor Building Radiation-High Function receives input from two channels.

The outputs from these channels are arranged into two one-out-of-one logic trip systems.

Each trip system isolates one valve per associated penetration.

Primary Containment Isolation Drywell Pressure-High and Reactor Vessel Water Level-Low Level I Functions isolate the Group 2 and 6 valves.

The Drywell Pressure-High Function in conjunction with reactor low pressure isolates Group 10 valves.

Primary Containment Isolation Main Stack Radiation-High Function isolates the containment purge and vent valves.

Reactor Building Exhaust Radiation-High Function isolates the Group 6 valves.

3,

4.

High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation Most Functions that isolate HPCI and RCIC receive input from two channels, with each channel in one trip system using a one-out-of-one logic.

Each of the two trip systems in each isolation group is connected to one of the two valves on each associated penetration.

The exceptions are the HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High, Steam Supply Line Pressure-Low, and Equipment Area Temperature-High Functions.

These Functions receive inputs from four turbine exhaust diaphragm pressure, four steam supply pressure, and four equipment (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-146

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 3, 4.

High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation (continued) area temperature channels for each system.

The outputs from the turbine exhaust diaphragm pressure and steam supply pressure channels are each connected to two two-out-of-two trip systems.

The outputs from the equipment area temperature channels are connected to two one-out-of-two trip systems.

In addition, the output from one channel per trip system of the Steam Supply Line Pressure-Low Function coincident with a high drywell pressure signal will initiate isolation of the associated HPCI and RCIC turbine exhaust line vacuum breaker isolation valves.

Each trip system isolates one valve per associated penetration.

HPCI and RCIC Functions isolate the Group 4, 5, 7, and 9 valves.

5.

Reactor Water Cleanup System Isolation The Reactor Vessel Water Level-Low Level 2 Isolation Function receives input from four reactor vessel water level channels.

The outputs from the reactor vessel water level channels are connected into two two-out-of-two trip systems.

The Differential Flow-High Function receives input from one channel.

The output from this channel is provided to each of two one-out-of-one logic trip systems.

The Piping Outside RWCU Rooms Area Temperature-High Function receives input from two channels with each channel in one trip system using a one-out-of-one logic.

The Area Temperature-High Function receives input from six temperature monitors, three to each trip system.

The Area Ventilation Differential Temperature-High Function receives input from six differential temperature monitors, three in each trip system.

These are configured so that any one input will trip the associated trip system.

Each of the two trip systems is connected to one of the two valves on each RWCU penetration.

The SLC System Initiation Function receives input from one channel.

The output from this channel is provided to a one-out-of-one logic trip system.

The trip system isolates the RWCU suction outboard isolation valve.

RWCU Functions isolate the Group 3 valves.

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-147

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND

6.

Shutdown Cooling System Isolation (continued)

The Reactor Vessel Water Level-Low Level 1 Function receives input from four reactor vessel water level channels.

The outputs from the reactor vessel water level channels are connected to two one-out-of-two taken twice logic trip systems.

The Reactor Vessel Pressure-High Function receives input from two channels, with each channel in one trip system using a one-out-of-one logic.

Each of the two trip systems is connected to one of the two valves on each shutdown cooling penetration.

Shutdown Cooling System Isolation Functions isolate the Group 8 valves.

APPLICABLE The isolation signals generated by the primary containment SAFETY ANALYSES, isolation instrumentation are implicitly assumed in the

LCO, and safety analyses of References 1, 2, and 3 to initiate APPLICABILITY closure of valves to limit offsite doses.

Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs),"

Applicable Safety Analyses Bases for more detail of the safety analyses.

Primary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii)

(Ref. 4).

Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the primary containment instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.1-1.

Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate.

The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each channel must also respond within its assumed response time, where appropriate.

Allowable Values are specified for each Primary Containment Isolation Function specified in Table 3.3.6.1-1.

Trip setpoints are specified in the setpoint calculations.

The setpoints are selected to ensure that the trip settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS.

Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable.

A channel is inoperable if its actual trip (continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-148

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) setting is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place.

The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,

trip unit) changes state.

The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis.

The trip setpoints are determined from the analytic limits, corrected for process, calibration, and instrument errors.

The Allowable Values are then determined, based on the trip setpoint values, by accounting for calibration based errors.

These calibration based instrument errors are limited to instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components.

The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.

Certain Emergency Core Cooling Systems (ECCS) and RCIC valves (e.g., LPCI injection) also serve the dual function of automatic PCIVs.

The signals that isolate these valves are also associated with the automatic initiation of the ECCS and RCIC.

The instrumentation requirements and ACTIONS associated with these signals are addressed in LCO 3.3.5.1, "Emergency Core Cooling Systems (ECCS)

Instrumentation," and LCO 3.3.5.2, "Reactor Core Isolation Cooling (RCIC) System Instrumentation," and are not included in this LCO.

In general,.the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment."

Functions that have different Applicabilities are discussed below in the individual Functions discussion.

The specific Applicable Safety Analyses, LCO, Applicability discussions are listed below on Function basis.

and a Function by (continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-149

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued)

Main Steam Line Isolation l.a.

Reactor Vessel Water Level-Low Level 3 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level--Low Level 3 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals.

The Reactor Vessel Water Level-Low Level 3 Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1).

The isolation of the MSLs on Level 3 supports actions to ensure that offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level--Low Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Level 3 Allowable Value is chosen to be the same as the ECCS Level 3 Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 100 limits.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

This Function isolates the Group I valves.

].b.

Main Steam Line Pressure-Low Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100°F/hr if the pressure loss is allowed to continue.

The Main Steam Line Pressure-Low Function is directly assumed in the analysis of the pressure regulator (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-150

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.b.

Main Steam Line Pressure-Low (continued)

SAFETY ANALYSES

LCO, and failure (Ref. 2).

For this event, the closure of the MSIVs APPLICABILITY ensures that no significant thermal stresses are imposed on the RPV.

In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded.

(This Function closes the MSIVs prior to pressure decreasing below 785 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 25% RTP.)

The MSL low pressure signals are initiated from four transmitters that are connected to the MSL header.

The transmitters are arranged such that each transmitter is able to detect low MSL pressure.

Four channels of Main Steam Line Pressure-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be far enough below normal turbine inlet pressures to avoid spurious isolations, yet high enough to provide timely detection of a pressure regulator malfunction.

The Main Steam Line Pressure-Low Function is only required to be OPERABLE in MODE 1 since this is when the assumed transient can occur (Ref. 2).

This Function isolates the Group I valves except for sample line isolation valves B32-FO19 and B32-F020.

I.c.

Main Steam Line Flow-High Main Steam Line Flow-High is provided to detect a break of the MSL and'to initiate closure of the MSIVs.

If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover.

If the RPV water level decreases too far, fuel damage could occur.

Therefore, the isolation is initiated on high flow to prevent or minimize core damage.

The Main Steam Line Flow-High Function is directly assumed in the analysis of the main steam line break (MSLB)

(Ref. 5).

The isolation action, along with the scram function of the Reactor Protection System (RPS),

ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 100 limits.

(continued)

Revision No.

21 1

Brunswick Unit 1 B 3.3-151

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY 1.c.

Main Steam Line Flow-High (continued)

The MSL flow signals are initiated from 16 transmitters that are connected to the four MSLs.

The transmitters are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect the high flow.

Four channels of Main Steam Line Flow-High Function for each unisolated MSL (two channels per trip system) are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL.

The Allowable Value is chosen to be high enough to permit isolation of one main steam line for test at rated power without causing an automatic isolation of the rest of the steam lines, yet low enough to permit early detection of a gross steam line break.

This Function isolates the Group I valves except for sample line isolation valves B32-F019 and B32-F020.

I.d.

Condenser Vacuum-Low The Condenser Vacuum-Low Function is provided to prevent overpressurization of the main condenser in the event of a loss of the main condenser vacuum.

Since the integrity of the condenser is an assumption in offsite dose calculations, the Condenser Vacuum-Low Function is assumed to be OPERABLE and capable of initiating closure of the MSIVs.

The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture, thereby preventing a potential radiation leakage path following an accident.

Condenser vacuum pressure signals are derived from four pressure transmitters that sense the pressure in the condenser.

Four channels of Condenser Vacuum-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value is chosen to prevent damage to the condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis.

As noted (footnote (a)

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-152

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE I.d.

Condenser Vacuum-Low (continued)

SAFETY ANALYSES,

LCO, and to Table 3.3.6.1-1), the channels are not required to be APPLICABILITY OPERABLE in MODES 2 and 3 when all turbine stop valves (TSVs) are closed, since the potential for condenser overpressurization is minimized.

Therefore, the channels may be bypassed when all TSVs are closed.

This Function isolates the Group 1 valves.

I.e. Main Steam Isolation Valve Pit Temperature-High Main steam isolation valve pit temperature is provided to detect a leak in the RCPB and provides diversity to the high flow instrumentation.

The isolation occurs when a very small leak has occurred in the main steam isolation valve pit.

If the small leak is allowed to continue without isolation, offsite dose limits may be reached.

However, credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large breaks, such as MSLBs.

Main steam isolation valve pit temperature signals are initiated from temperature switches located in the area being monitored.

Four channels of Main Steam Isolation Valve Pit Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The temperature switches are located or shielded so that they are sensitive to air temperature and not in the radiated heat from hot equipment.

The main steam isolation valve pit temperature monitoring Allowable Value is chosen to detect a leak equivalent to between 1% and 10% rated steam flow.

This Function isolates the Group 1 valves except for sample line isolation valves B32-FO19 and B32-F020.

Primary Containment Isolation 2.a. Reactor Vessel Water Level-Low Level I Low RPV water level indicates that the capability to cool the fuel may be threatened.

The valves whose penetrations communicate with the primary containment are isolated to (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-153

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.a. Reactor Vessel Water Level-Low Level I (continued)

SAFETY ANALYSES,

LCO, and limit the release of fission products.

The isolation of the APPLICABILITY primary containment on Level I supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded.

The Reactor Vessel Water Level-Low Level I Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level-Low Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level-Low Level I Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Level I Allowable Value was chosen to be the same as the RPS Level 1 scram Allowable Value (LCO 3.3.1.1), since isolation of these valves is not critical to orderly plant shutdown.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

This Function isolates the Group 2, 6,

and 8 valves.

2.b.

Drywell Pressure-High High drywell pressure can indicate a break in the RCPB inside the primary containment.

The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded.

The Drywell Pressure-High Function, associated with isolation of the primary containment, is implicitly assumed in the UFSAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell.

Four channels of Drywell Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

(continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-154

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.b.

Drywell Pressure-High (continued)

SAFETY ANALYSES,

LCO, and The Allowable Value was selected to be the same as the ECCS APPLICABILITY Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

This Function isolates the Group 2 and 6 valves.

This Function in conjunction with reactor low pressure also isolates Group 10 valves.

2.c.

Main Stack Radiation-High High main stack radiation indicates increased airborne radioactivity levels in primary containment being released through the containment vent valves.

Therefore, Main Stack Radiation-High Function initiates an isolation to assure timely closure of valves to protect against substantial releases of radioactive materials to the environment.

However, this Function is not assumed in any accident or transient analysis in the UFSAR because other leakage paths (e.g., MSIVs) are more limiting.

The main stack radiation signal is initiated from a radiation detector that is located in the main stack.

The Allowable Value is established in accordance with the methodology in the Offsite Dose Calculation Manual.

This Function isolates the containment vent and purge valves.

2.d.

Reactor Building Exhaust Radiation-High High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding.

The release may have originated from the primary containment due to a break in the RCPB.

When Reactor Building Exhaust Radiation-High is detected, valves whose penetrations communicate with the primary containment atmosphere are isolated to limit the release of fission products.

The Reactor Building Exhaust Radiation-High signals are initiated from radiation detectors that are located on the ventilation exhaust piping coming from the reactor building.

The signal from each detector is input to an individual (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-155

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.d.

Reactor Building Exhaust Radiation-High (continued)

SAFETY ANALYSES, LCO, and monitor whose trip outputs are assigned to an isolation APPLICABILITY channel.

Two channels of Reactor Building Exhaust-High Function are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

These Functions isolate the Group 6 valves.

High Pressure Coolant Injection and Reactor Core Isolation Cooling Systems Isolation 3.a., 3.b., 4.a., 4.b.

HPCI and RCIC Steam Line Flow-High and Time Delay Relays Steam Line Flow-High Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system.

If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover.

Therefore, the isolations are initiated on high flow to prevent or minimize core damage.

The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Specific credit for these Functions is not assumed in any UFSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks.

However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

The HPCI and RCIC Steam Line Flow-High signals are initiated after a short time delay from differential pressure instruments (two for HPCI and two for RCIC) that are connected to the system steam lines.

Two channels of both HPCI and RCIC Steam Line Flow-High Functions and the associated Time Delay Relays are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The time delay was (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-156

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.a., 3.b., 4.a., 4.b.

HPCI and RCIC Steam Line Flow-High SAFETY ANALYSES, and Time Delay Relays (continued)

LCO, and APPLICABILITY selected to prevent spurious isolation of HPCI and RCIC due to transient high steam flow during turbine starts and spurious operation during HPCI and RCIC operation.

The Allowable Values are chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event.

These Functions isolate the Group 4 and 5 valves, as appropriate.

3.c., 4.c.

HPCI and RCIC Steam Supply Line Pressure-Low The steam line low pressure function is provided so that the steam line isolation valves are automatically closed after reactor steam pressure is below that at which HPCI or RCIC can effectively operate.

This closure ensures that long term containment leakage rates are within limits after a LOCA.

The HPCI and RCIC Steam Supply Line Pressure-Low signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the system steam line.

Four channels of both HPCI and RCIC Steam Supply Line Pressure-Low Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are selected to be below the pressure at which the system's turbine can effectively operate.

The Allowable Values are also selected to be above the peak expected drywell pressure to ensure that an elevated drywell pressure during a LOCA does not prevent timely closure of the valves.

These Functions isolate the Group 4 and 5 valves, as appropriate.

(continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-157

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE SAFETY ANALYSES,

LCO, and APPLICABILITY (continued) 3.d., 4.d.

HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High High turbine exhaust diaphragm pressure could indicate a degraded inner rupture disc during system operation, before the redundant outer disc is significantly challenged by thermal/cyclic fatigue.

These isolations are for equipment protection and are not assumed in any transient or accident analysis in the UFSAR.

These instruments are included in the TS because of the potential for risk due to possible failure of the instruments preventing HPCI and RCIC initiations.

Therefore, they meet Criterion 4 of Reference 4.

The HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the area between the rupture diaphragms on each system's turbine exhaust line.

Four channels of both HPCI and RCIC Turbine Exhaust Diaphragm Pressure-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are high enough to prevent isolation of HPCI or RCIC if the associated turbine is operating, yet low enough to detect degradation of the inner rupture disc during operation.

These Functions isolate the Group 4 and 5 valves, as appropriate.

3.e., 4.e.

Drywell Pressure-High High drywell pressure can indicate a break in the RCPB.

The HPCI and RCIC isolation of the turbine exhaust is provided to prevent communication with the drywell when high dryell pressure exists.

A potential leakage path exists via the turbine exhaust.

The isolation is delayed until the system becomes unavailable for injection (i.e., low steam line pressure).

The isolation of the HPCI and RCIC turbine exhaust by Drywell Pressure-High is indirectly assumed in the UFSAR accident analysis because the turbine exhaust leakage path is not assumed to contribute to offsite doses.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-158

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.e., 4.e.

Drywell Pressure-High (continued)

SAFETY ANALYSES, LCO, and High drywell pressure signals are initiated from pressure APPLICABILITY transmitters that sense the pressure in the drywell.

Two channels of both HPCI and RCIC Drywell Pressure-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this is indicative of a LOCA inside primary containment.

This Function isolates the Group 7 and 9 valves.

3.f., 3.q., 3.h., 3.i., 4.f., 4.q., 4.h., 4.i., 4.J., 4.k.

Area and Differential Temperature-High and Time Delay Area and differential temperatures are provided to detect a leak from the associated system steam piping.

The isolation occurs to prevent excessive loss of reactor coolant and the release of significant amounts of radioactive material from the nuclear system process barrier and is diverse to the high flow instrumentation.

If the small leak is allowed to continue without isolation, offsite dose limits may be reached.

These Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

Area and Differential Temperature-High signals are initiated from thermocouples that are appropriately located to protect the system that is being monitored.

Two instruments monitor each area.

Two channels for each HPCI and RCIC Area and Differential Temperature-High Function, except for the HPCI and RCIC Equipment Area Temperature-High Function which are required to have four channels each, are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

In addition, a time delay is associated with the RCIC Steam Line Area Temperature-High, the RCIC Steam Line Tunnel Ambient Temperature-High, and the RCIC Steam Line Tunnel Differential Temperature-High Functions.

The time delay was selected to eliminate spurious isolations which might occur when switching from normal ventilation to standby ventilation.

(continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-159

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.f., 3.q., 3.h., 3.i., 4.f., 4.q., 4.h., 4.i., 4.J., 4.k.

SAFETY ANALYSES, Area and Differential Temperature-High and Time Delay LCO, and (continued)

APPLICABILITY The Allowable Values are set high enough above anticipated normal operating levels to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break.

These Functions isolate the Group 4 and 5 valves, as appropriate.

Reactor Water Cleanup System Isolation 5.a., 5.b.

Differential Flow-High and Time Delay The high differential flow signal is provided to detect a break in the RWCU System.

Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded.

Therefore, isolation of the RWCU System is initiated when high differential flow is sensed to prevent excessive loss of reactor coolant and release of significant amounts of radioactive material.

A time delay is provided to prevent spurious trips during most RWCU operational transients.

This Function is not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.

The high differential flow signals are initiated from transmitters that are connected to the inlet (from the reactor vessel) and outlets (to condenser and feedwater) of the RWCU System.

The outputs of the transmitters are compared (in a common summer) and the resulting output is sent to two high flow trip units.

If the difference between the inlet and outlet flow is too large, each trip unit generates an isolation signal.

Two channels of Differential Flow-High Function are available and are required to be OPERABLE to ensure that no single instrument failure downstream of the common summer can preclude the isolation function.

The Differential Flow-High Allowable Value ensures that a break of the RWCU piping is detected.

This Function isolates the Group 3 valves.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-160

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 5.c., 5.d., 5.e.

Area, Area Ventilation Differential, and Piping Outside RWCU Rooms Area Temperature-High RWCU area, area ventilation differential, and piping outside RWCU area temperatures are provided to detect a leak from the RWCU System.

If the small leak continues without isolation, offsite dose limits may be reached.

Credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

Area and area ventilation differential temperature signals are initiated from temperature elements that are located in the room that is being monitored.

Six thermocouples provide input to the Area Temperature-High Function (two per room).

Six channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

Twelve thermocouples provide input to the Area Ventilation Differential Temperature--High Function.

The output of these thermocouples is used to determine the differential temperature.

Each channel consists of a differential temperature instrument that receives inputs from thermocouples that are located in the inlet and outlet ducts which ventilate the RWCU System rooms for a total of six available channels (two per room).

However, only four channels are required to be OPERABLE.

Temperature signals are initiated from temperature elements monitoring in the 20'/50' elevation RWCU System general piping areas located outside the RWCU System equipment rooms.

Two thermocouples provide input to the Piping Outside RWCU Rooms Area Temperature-High Function.

Two channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Area and Area Ventilation Differential Temperature-High Allowable.Values are set low enough to provide timely detection of a break in the RWCU System within the associated room(s).

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-161

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY 5.c., 5.d., 5.e.

Area, Area Ventilation Differential, and Piping Outside RWCU Rooms Area Temperature-High (continued)

The Piping Outside RWCU Rooms Area Temperature-High Function Allowable Value is set low enough to isolate a design basis high energy line break at any point in the high temperature RWCU System piping located outside of the RWCU System equipment rooms.

These Functions isolate the Group 3 valves.

5.f.

SLC System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 6).

The SLC System initiation signal is initiated from the SLC pump start hand switch signal.

There is no Allowable Value associated with this Function since the channel is mechanically actuated based solely on the position of the SLC System initiation switch.

One channel of the SLC System Initiation Function is available and required to be OPERABLE only in MODES 1 and 2, since these are the only MODES where the reactor can be critical, and these MODES are consistent with the Applicability for the SLC System (LCO 3.1.7).

As noted (footnote (c) only required to close since the signals only to Table 3.3.6.1-1), this Function is one of the RWCU isolation valves provide input into one trip system.

5.q.

Reactor Vessel Water Level-Low Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, isolation of some interfaces with the reactor vessel occurs to isolate the potential sources of a break.

The isolation of the RWCU System on Level 2 supports actions to ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Vessel Water Level--Low Level 2 Function associated with RWCU isolation is not directly (continued)

Revision No. 21 I

Brunswick Unit I B 3.3-162

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.q.

Reactor Vessel Water Level-Low Level 2 (continued)

SAFETY ANALYSES, LCO, and assumed in the UFSAR safety analyses because the RWCU System APPLICABILITY line break is bounded by breaks of larger systems (recirculation and MSL breaks are more limiting).

Reactor Vessel Water Level-Low Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level-Low Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level--Low Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.

The Allowable Value is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

This Function isolates the Group 3 valves.

RHR Shutdown Cooling System Isolation 6.a.

Reactor Steam Dome Pressure-High The Reactor Steam Dome Pressure-High Function is provided to isolate the shutdown cooling portion of the Residual Heat Removal (RHR)

System.

This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the UFSAR.

The Reactor Steam Dome Pressure-High signals are initiated from two pressure switches that are connected to different taps on the RPV.

Two channels of Reactor Steam Dome Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Function is only required to be OPERABLE in MODES 1, 2, and 3, since these (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-163

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 6.a.

Reactor Steam Dome Pressure-High (continued)

SAFETY ANALYSES, LCO, and are the only MODES in which the reactor can be pressurized; APPLICABILITY thus, equipment protection is needed.

The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization.

This Function isolates the Group 8 valves except for the LPCI injection valves Ell-FOI5A and ElI-FO15B.

6.b.

Reactor Vessel Water Level--Low Level 1 Low RPV water level indicates that the capability to cool the fuel may be threatened.

Should RPV water level decrease too far, fuel damage could result.

Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break.

The Reactor Vessel Water Level--Low Level I Function associated with RHR Shutdown Cooling System isolation is not directly assumed in safety analyses because a break of the RHR Shutdown Cooling System is bounded by breaks of the recirculation and MSL.

The RHR Shutdown Cooling System isolation on Level 1 supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level-Low Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels (two channels per trip system) of the Reactor Vessel Water Level--Low Level I Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

As noted (footnote (d) to Table 3.3.6.1-1), only one channel per trip system (with an isolation signal available to one RHR shutdown cooling pump suction isolation valve) of the Reactor Vessel Water Level--Low Level I Function is required to be OPERABLE in MODES 4 and 5, provided the RHR Shutdown Cooling System integrity is maintained.

System integrity is maintained provided the piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the system.

(continued)

Revision No.

21 I

Brunswick Unit I B 3.3-164

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 6.b.

Reactor Vessel Water Level-Low Level 1 (continued)

SAFETY ANALYSES, LCO, and The Reactor Vessel Water Level-Low Level 1 Allowable Value APPLICABILITY was chosen to be the same as the RPS Reactor Vessel Water Level--Low Level 1 Allowable Value (LCO 3.3.1.1), since the capability to cool the fuel may be threatened.

The Allowable Values is referenced from reference level zero.

Reference level zero is 367 inches above the vessel zero point.

The Reactor Vessel Water Level-Low Level 1 Function is only required to be OPERABLE in MODES 3, 4, and 5 to prevent this potential flow path from lowering the reactor vessel level to the top of the fuel.

In MODES I and 2, another isolation (i.e., Reactor Steam Dome Pressure-High) and administrative controls ensure that this flow path remains isolated to prevent unexpected loss of inventory via this flow path.

This Function isolates the Group 8 valves.

ACTIONS A Note has been provided to-modify the ACTIONS related to primary containment isolation instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.

Section 1.3 also-specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable primary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels.

As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment isolation instrumentation channel.

A._1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, and 6.b and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 2.a, 2.b, and 6.b has been shown to be (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-165

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS A.1 (continued) acceptable (Refs.

7 and 8) to permit restoration of any inoperable channel to OPERABLE status.

This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases).

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),

Condition C must be entered and its Required Action taken.

B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant automatic isolation capability being lost for the associated penetration flow path(s).

The MSL Isolation Functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that both trip systems will generate a trip signal from the given Function on a valid signal.

The other isolation functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal.

This ensures that one of the two PCIVs in the associated penetration flow path can receive an isolation signal from the given Function.

For Functions 1.a, I.b, 1.d, and 1.e, this would require both trip systems to have a total of three channels OPERABLE or in trip.

For Functions 2.a, 2.b, and 6.b, this would require both trip systems to have one channel OPERABLE or in trip.

For Function 1.c, this would require both trip systems to have a total of three channels, associated with each MSL, OPERABLE or in trip.

For Functions 3.c, 3.d, 4.c, 4.d, and 5.g, this would require one trip system to have two channels, each OPERABLE or in trip.

For Functions 2.c, 2.d, 3.a, 3.b, 3.e, 3.f, 3.g, 3.h, 3.i, 4.a, 4.b, 4.e, 4.f, 4.g, 4.h, 4.i, 4.j, 4.k, 5.a, 5.b, 5.e, 5.f, and 6.a, this would (continued)

Revision No.

21 I

Brunswick Unit I B 3.3-166

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS B.1 (continued) require one trip system to have one channel OPERABLE or in trip.

For Functions 5.c and 5.d, each Function consists of channels that monitor several different locations.

Therefore, this would require one channel per location to be OPERABLE or in trip (the channels are not required to be in the same trip system).

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

The I hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1.

The applicable Condition specified in Table 3.3.6.1-1 is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed.

Each time an inoperable channel has not met any Required Action of Condition A or B and the associated Completion Time has expired, Condition C will be entered for that channel and provides for transfer to the appropriate subsequent Condition.

D.1, D.2.1, and D.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in'which the LCO does not apply.

This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (Required Actions D.2.1 and D.2.2).

Alternately, the associated MSLs may be isolated (Required Action D.1),

and, if allowed (i.e., plant safety analysis allows operation with an MSL isolated), operation with that MSL isolated may continue.

Isolating the affected MSL accomplishes the-safety function of the inoperable channel.

The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-167

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS E.1 (continued)

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply.

This is done by placing the plant in at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

F.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated.

Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.

For the RWCU Area and Area Ventilation Differential Temperature-High Functions, the affected penetration flow path(s) may be considered isolated by isolating only that portion of the system in the associated room monitored by the inoperable channel.

That is, if the RWCU pump room A area channel is inoperable, the pump room A area can be isolated while allowing continued RWCU operation utilizing the B RWCU pump.

Alternately, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition G must be entered and its Required Actions taken.

The I hour Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s).

(continued)

Revision No. 21 I

Brunswick Unit I B 3.3-168

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS G.1 and G.2 (continued)

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, or the Required Action of Condition F is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply.

This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

H.1 and H.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated.

Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystems inoperable or isolating the RWCU System.

The I hour Completion Time is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.

1.1 and 1.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be closed.

However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to isolate the RHR Shutdown Cooling System (i.e., provide alternate decay heat removal capabilities so the penetration flow path can be isolated).

Actions must continue until the channel is restored to OPERABLE status or the RHR Shutdown Cooling System is isolated.

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-169

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES (continued)

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Primary Containment Isolation instrumentation Function are found in the SRs column of Table 3.3.6.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows:

(a) for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for Functions with a design that provides only one channel per trip system and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for all other Functions provided the associated Function maintains trip capability.

Upon completion of the Surveillance, or expiration of the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allowance for Functions with a design that provides only one channel per trip system or the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance for all other Functions, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Refs. 7 and 8) assumption of the average time required to perform channel surveillance.

That analysis demonstrated that the 2 and 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowances do not significantly reduce the probability that the PCIVs will isolate the penetration flow path(s) when necessary.

SR 3.3.6.1.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.

A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability.

If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

(continued)

Brunswick Unit 1 Revision No.

21 I

B 3.3-170

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.1 (continued)

REQUIREMENTS The Frequency is based on operating experience that demonstrates channel failure is rare.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.1.2, SR 3.3.6.1.5 and SR 3.3.6.1.9 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The 92 day Frequency of SR 3.3.6.1.2 is based on the reliability analysis described in References 7 and 8.

The 184 day Frequency of SR 3.3.6.1.5 and the 24 month Frequency of SR 3.3.6.1.9 are based on engineering judgment and the reliability of the components.

SR 3.3.6.1.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1.

If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than that accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of References 7 and 8.

SR 3.3.6.1.4 and SR 3.3.6.1.6 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies the channel responds to the measured parameter within the necessary (continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-171

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.4 and SR 3.3.6.1.6 (continued)

REQUIREMENTS range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency of SR 3.3.6.1.4 is based on the assumption of a 92 day calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

The Frequency of SR 3.3.6.1.6 is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.1.7 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel and includes simulated automatic operation of the channel.

The system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has demonstrated these components will usually pass the Surveillance when performed at the 24 month Frequency.

SR 3.3.6.1.8 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis.

Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time.

For channels assumed to respond within the DG start time, sufficient margin exists in the 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test (Ref. 9).

(continued)

Revision No.

21 I

Brunswick Unit 1 B 3.3-172

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.8 (continued)

REQUIREMENTS Note I to the Surveillance states that the radiation detectors are excluded from ISOLATION INSTRUMENTATION RESPONSE TIME testing.

This Note is necessary because of the difficulty of generating an appropriate detector input signal and because the principles of detector operation virtually ensure an instantaneous response time.

Response

times for radiation detector channels shall be measured from detector output or the input of the first electronic component in the channel.

In addition, Note 2 to the Surveillance states that the response time of the sensors for Functions I.a and 1.c may be assumed to be the design sensor response time and therefore, are excluded from the ISOLATION INSTRUMENTATION RESPONSE TIME testing.

This is allowed since the sensor response time is a small part of the overall ISOLATION INSTRUMENTATION RESPONSE TIME (Ref. 9).

ISOLATION INSTRUMENTATION RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS.

The 24 month Frequency is consistent with the BNP refueling cycle and is based upon plant operating experience that shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

REFERENCES

1.

UFSAR, Section 6.3.

2.

UFSAR, Chapter 15.

3.

NEDC-32466P, Power Uprate Safety Analysis Report for Brunswick Steam Electric Plant Units 1 and 2, September 1995.

4.

10 CFR 50.36(c)(2)(ii).

5.

UFSAR, Section 6.2.4.3.

6.

UFSAR, Section 7.3.1.1.6.18.

7.

NEDC-31677P-A, Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation, July 1990.

(continued)

Revision No. 21 I

Brunswick Unit 1 B 3.3-173

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES REFERENCES

8.

NEDC-30851P-A Supplement 2, Technical Specifications (continued)

Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation, March 1989.

9.

NEDO-32291-A, System Analyses for Elimination of Selected Response Time Requirements, October 1995.

Revision No.

21 I

Brunswick Unit I B 3.3-174

ML021430047

Text

Enclosures:

Title:

Title:

Title:

Response

Navigation menu

Search